EnsureRightLabelOnSecret: dual label support for workflow_owner and org_id#21680
EnsureRightLabelOnSecret: dual label support for workflow_owner and org_id#21680prashantkumar1982 wants to merge 1 commit intodevelopfrom
Conversation
…rg_id Update EnsureRightLabelOnSecret to accept explicit workflowOwner and orgID parameters, supporting both ETH address (left-padded) and SHA256(org_id) label encodings. Centralize all label utilities in vaultutils/labels.go. Made-with: Cursor
product-security-plaid-production
bot
requested review from
krehermann,
silaslenihan and
vyzaldysanchez
|
👋 prashantkumar1982, thanks for creating this pull request! To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team. Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks! |
|
I see you updated files related to
|
|
✅ No conflicts with other open PRs targeting |
| // - Ethereum address (detected via common.IsHexAddress): left-padded with 12 zero bytes | ||
| // followed by the 20-byte address, matching the legacy workflow_owner encoding. | ||
| // - org_id (any non-address string): SHA256 hash of the org_id string. | ||
| func OwnerToLabel(owner string) [32]byte { |
There was a problem hiding this comment.
I would consider adding a version bit going forward
That way we can just check this first and then if it's present we'll know it's an org; if not we know it has to be an address
|
|
|
2 participants
Summary
EnsureRightLabelOnSecretto accept explicitworkflowOwnerandorgIDparameters, supporting dual label encoding: ETH address (left-padded) for legacy secrets andSHA256(org_id)for new secrets. Either parameter can be empty to skip that check.core/capabilities/vault/vaultutils/labels.go:OwnerToLabel,EncryptSecretWithWorkflowOwner,EncryptSecretWithOrgID.validator.go,plugin.go, system-testsvault.go) to use the new signature and shared utilities.EnsureRightLabelOnSecretandOwnerToLabelcovering dual-label matching, backward compat, error cases, and migration scenarios.Context
Part of the JWT-based authorization work for Vault. This PR is standalone with no behavior change — existing callers pass
""fororgID, preserving current behavior. TheorgIDparameter will be wired in by a later PR (plugin changes + final wiring).