remove logging of secure data

models/secret.go

@@ -49,7 +49,7 @@ func GetSecrets(s *Secret, adminRole bool) ([]Secret, error) {
 	var rows *sqlx.Rows
 	var secretResults []Secret
 
-	log.Printf("GetSecret querying values '%v' with admin role '%v'\n", s, adminRole)
+	log.Printf("GetSecrets querying values '%v' with admin role '%v'\n", s, adminRole)
 
 	// Admin roles should be able to access all secrets so don't do any filter based on RoleId
 	if adminRole {
@@ -116,7 +116,9 @@ func GetSecrets(s *Secret, adminRole bool) ([]Secret, error) {
 			// Decrypt the secret
 			_, err = r.DecryptSecret()
 			if err != nil {
-				log.Printf("GetSecret unable to decrypt stored secret '%v', skipping result.\n", r.Secret)
+				//log.Printf("GetSecret unable to decrypt stored secret '%v' : '%s'\n", r.Secret, err)
+				log.Printf("GetSecret unable to decrypt stored secret : '%s'\n", err)
+				return secretResults, err
 			} else {
 				secretResults = append(secretResults, r)
 			}
@@ -153,6 +155,28 @@ func (s *Secret) UpdateSecret() (*Secret, error) {
 	return s, nil
 }
 
+// startCipher does the initial setup of the AES256 GCM mode cipher
+func startCipher() (cipher.AEAD, error) {
+	key, err := ProvideKey()
+	if err != nil {
+		return nil, err
+	}
+
+	block, err := aes.NewCipher(key)
+	if err != nil {
+		log.Printf("startCipher NewCipher error '%s'\n", err)
+		return nil, err
+	}
+
+	aesgcm, err := cipher.NewGCM(block)
+	if err != nil {
+		log.Printf("startCipher NewGCM error '%s'\n", err)
+		return nil, err
+	}
+
+	return aesgcm, nil
+}
+
 func (s *Secret) EncryptSecret() (*Secret, error) {
 
 	//keyString := os.Getenv("SECRETS_KEY")
@@ -161,25 +185,34 @@ func (s *Secret) EncryptSecret() (*Secret, error) {
 	// The key argument should be the AES key, either 16 or 32 bytes
 	// to select AES-128 or AES-256.
 	//key := []byte(keyString)
-	key, err := ProvideKey()
-	if err != nil {
-		return s, err
-	}
+	/*
+		key, err := ProvideKey()
+		if err != nil {
+			return s, err
+		}
+	*/
 
 	plaintext := []byte(s.Secret)
 
-	log.Printf("EncryptSecret applying key '%v' of length '%d' to plaintext secret '%s'\n", key, len(key), s.Secret)
-
 	// TODO : move block and aesgcm generation to separate function since the identical code is used for encrypt and decrypt
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		log.Printf("EncryptSecret NewCipher error '%s'\n", err)
-		return s, err
-	}
+	/*
+		log.Printf("EncryptSecret applying key '%v' of length '%d' to plaintext secret '%s'\n", key, len(key), s.Secret)
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			log.Printf("EncryptSecret NewCipher error '%s'\n", err)
+			return s, err
+		}
 
-	aesgcm, err := cipher.NewGCM(block)
+		aesgcm, err := cipher.NewGCM(block)
+		if err != nil {
+			log.Printf("EncryptSecret NewGCM error '%s'\n", err)
+			return s, err
+		}
+	*/
+
+	aesgcm, err := startCipher()
 	if err != nil {
-		log.Printf("EncryptSecret NewGCM error '%s'\n", err)
+		log.Printf("EncryptSecret error commencing GCM cipher '%s'\n", err)
 		return s, err
 	}
 
@@ -189,15 +222,15 @@ func (s *Secret) EncryptSecret() (*Secret, error) {
 		log.Printf("EncryptSecret nonce generation error '%s'\n", err)
 		return s, err
 	}
-	log.Printf("EncryptSecret random nonce value is '%x'\n", nonce)
+	//log.Printf("EncryptSecret random nonce value is '%x'\n", nonce)
 
 	ciphertext := aesgcm.Seal(nil, nonce, plaintext, nil)
-	log.Printf("EncryptSecret generated ciphertext '%x''\n", ciphertext)
+	//log.Printf("EncryptSecret generated ciphertext '%x''\n", ciphertext)
 
 	// Create a new slice to store nonce at the start and then the resulting ciphertext
 	// Nonce is always 12 bytes
 	combinedText := append(nonce, ciphertext...)
-	log.Printf("EncryptSecret combined secret value is now '%x'\n", combinedText)
+	//log.Printf("EncryptSecret combined secret value is now '%x'\n", combinedText)
 
 	// Store the value back into the struct ready for database operations
 	s.Secret = hex.EncodeToString(combinedText)
@@ -214,10 +247,12 @@ func (s *Secret) DecryptSecret() (*Secret, error) {
 	//keyString := secretKey
 
 	//key := []byte(keyString)
-	key, err := ProvideKey()
-	if err != nil {
-		return s, err
-	}
+	/*
+		key, err := ProvideKey()
+		if err != nil {
+			return s, err
+		}
+	*/
 
 	if len(s.Secret) < nonceSize {
 		log.Printf("DecryptSecret ciphertext is too short to decrypt\n")
@@ -230,23 +265,31 @@ func (s *Secret) DecryptSecret() (*Secret, error) {
 		return s, err
 	}
 
-	log.Printf("DecryptSecret processing secret '%x'\n", crypted)
+	//log.Printf("DecryptSecret processing secret '%x'\n", crypted)
 
 	// The nonce is the first 12 bytes from the ciphertext
 	nonce := crypted[:nonceSize]
 	ciphertext := crypted[nonceSize:]
 
-	log.Printf("DecryptSecret applying key '%v' and nonce '%x' to ciphertext '%x'\n", key, nonce, ciphertext)
+	/*
+		log.Printf("DecryptSecret applying key '%v' and nonce '%x' to ciphertext '%x'\n", key, nonce, ciphertext)
 
-	block, err := aes.NewCipher(key)
-	if err != nil {
-		log.Printf("DecryptSecret NewCipher error '%s'\n", err)
-		return s, err
-	}
+		block, err := aes.NewCipher(key)
+		if err != nil {
+			log.Printf("DecryptSecret NewCipher error '%s'\n", err)
+			return s, err
+		}
 
-	aesgcm, err := cipher.NewGCM(block)
+		aesgcm, err := cipher.NewGCM(block)
+		if err != nil {
+			log.Printf("DecryptSecret NewGCM error '%s'\n", err)
+			return s, err
+		}
+	*/
+
+	aesgcm, err := startCipher()
 	if err != nil {
-		log.Printf("DecryptSecret NewGCM error '%s'\n", err)
+		log.Printf("DecryptSecret error commencing GCM cipher '%s'\n", err)
 		return s, err
 	}
 
@@ -256,7 +299,7 @@ func (s *Secret) DecryptSecret() (*Secret, error) {
 		return s, err
 	}
 
-	log.Printf("DecryptSecret plaintext is '%s'\n", plaintext)
+	//log.Printf("DecryptSecret plaintext is '%s'\n", plaintext)
 
 	s.Secret = string(plaintext)
 	return s, nil