Adds support for CYOK end-points (#744)

auth0 · Nov 7, 2024 · e769e45 · e769e45
2 parents 1f547ec + 2167a12
commit e769e45
Show file tree

Hide file tree

Showing 3 changed files with 54 additions and 1 deletion.
diff --git a/src/Auth0.ManagementApi/Clients/IKeysClient.cs b/src/Auth0.ManagementApi/Clients/IKeysClient.cs
@@ -82,5 +82,11 @@ public interface IKeysClient
     /// <param name="request"><see cref="WrappingKeyCreateRequest"/></param>
     /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
     Task<WrappingKey> CreatePublicWrappingKeyAsync(WrappingKeyCreateRequest request, CancellationToken cancellationToken = default);
+
+    /// <summary>
+    /// Perform rekeying operation on the key hierarchy.
+    /// </summary>
+    /// <param name="cancellationToken">The cancellation token to cancel operation.</param>
+    Task RekeyAsync(CancellationToken cancellationToken = default);
   }
 }
diff --git a/src/Auth0.ManagementApi/Clients/KeysClient.cs b/src/Auth0.ManagementApi/Clients/KeysClient.cs
@@ -160,13 +160,24 @@ public Task<WrappingKey> CreatePublicWrappingKeyAsync(
 
             if (string.IsNullOrEmpty(request.Kid))
                 throw new ArgumentNullException(nameof(request.Kid));
-            
+
             return Connection.SendAsync<WrappingKey>(
                 HttpMethod.Post,
                 BuildUri($"keys/encryption/{EncodePath(request.Kid)}/wrapping-key"),
                 body: null,
                 headers: DefaultHeaders,
                 cancellationToken: cancellationToken);
         }
+
+        /// <inheritdoc cref="IKeysClient.RekeyAsync"/>
+        public Task RekeyAsync(CancellationToken cancellationToken = default)
+        {
+            return Connection.SendAsync<object>(
+                HttpMethod.Post,
+                BuildUri("keys/encryption/rekey"),
+                body: null,
+                headers: DefaultHeaders,
+                cancellationToken: cancellationToken);
+        }
     }
 }
diff --git a/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs b/tests/Auth0.ManagementApi.IntegrationTests/KeysTests.cs
@@ -155,5 +155,41 @@ public async void Test_import_encrypted_keys()
             importedKeys.Type.Should().Be(EncryptionKeyType.CustomerProvidedRootKey);
             importedKeys.ParentKid.Should().Be("a20128c5-9bf5-4209-8c43-b6dfcee60e9b");
         }
+
+        [Fact]
+        public async void Test_rekey_encrypted_keys()
+        {
+            // Get the existing Tenant Master Key
+            var existingTenantMasterKey = await GetExistingTenantMasterKey();
+
+            await fixture.ApiClient.Keys.RekeyAsync();
+
+            var newTenantMasterKey = await GetExistingTenantMasterKey();
+
+            // After rekey operation, a new Tenant Master Key should be generated
+            existingTenantMasterKey.Should().NotBeEquivalentTo(newTenantMasterKey);
+
+            var existingTenantMasterKeyAfterRekey = 
+                await fixture.ApiClient.Keys.GetEncryptionKeyAsync(
+                    new EncryptionKeyGetRequest() 
+                        {
+                            Kid = existingTenantMasterKey.Kid
+                        }
+                    );
+
+            // Confirming that the old master key is destroyed
+            existingTenantMasterKeyAfterRekey.State.Should().Be(EncryptionKeyState.Destroyed);
+        }
+
+        private async Task<EncryptionKey> GetExistingTenantMasterKey()
+        {
+            var existingEncryptionKeys = await fixture.ApiClient.Keys.GetAllEncryptionKeysAsync(new PaginationInfo());
+
+            // Get the existing Tenant Master Key
+            var existingTenantMasterKey = 
+                existingEncryptionKeys.FirstOrDefault(x => x.State == EncryptionKeyState.Active &&
+                                                           x.Type == EncryptionKeyType.TenantMasterKey);
+            return existingTenantMasterKey;
+        }
     }
 }