Validate break-glass key from file. Returns `true` if the provided key matches the key in the configured file. Used for emergency access when normal auth is unavailable.
(&self, provided_key: &str)
| 102 | /// Returns `true` if the provided key matches the key in the configured file. |
| 103 | /// Used for emergency access when normal auth is unavailable. |
| 104 | pub fn validate_break_glass(&self, provided_key: &str) -> bool { |
| 105 | let Some(ref path) = self.break_glass_key_path else { |
| 106 | return false; |
| 107 | }; |
| 108 | let Ok(stored_key) = std::fs::read_to_string(path) else { |
| 109 | warn!(path = %path, "break-glass key file not readable"); |
| 110 | return false; |
| 111 | }; |
| 112 | let stored_trimmed = stored_key.trim(); |
| 113 | if stored_trimmed.is_empty() { |
| 114 | return false; |
| 115 | } |
| 116 | // Constant-time comparison. |
| 117 | provided_key.len() == stored_trimmed.len() |
| 118 | && provided_key |
| 119 | .as_bytes() |
| 120 | .iter() |
| 121 | .zip(stored_trimmed.as_bytes()) |
| 122 | .fold(0u8, |acc, (a, b)| acc | (a ^ b)) |
| 123 | == 0 |
| 124 | } |
| 125 | |
| 126 | /// Check if an operation requires two-party authorization. |
| 127 | pub fn requires_two_party(&self, operation: &str) -> bool { |