check operator version and provide correct presigned url

conf/default-config.json

@@ -17,5 +17,6 @@
     "att_token_enc_key": null,
     "att_token_enc_salt": null,
     "enforceJwt": false,
-    "s3_keys_metadata_path": null
+    "s3_keys_metadata_path": null,
+    "encryption_support_version": "5"
 }

conf/integ-config.json

@@ -18,5 +18,6 @@
     "keyset_keys_metadata_path": "uid2/keyset_keys/metadata.json",
     "salts_metadata_path": "uid2/salts/metadata.json",
     "enforceJwt": false,
-    "s3_keys_metadata_path": "uid2/s3encryption_keys/metadata.json"
+    "s3_keys_metadata_path": "uid2/s3encryption_keys/metadata.json",
+    "encryption_support_version": "5"
 }

conf/local-config.json

@@ -19,5 +19,6 @@
     "att_token_enc_salt": "<salt-for-attestation-token>",
     "provide_private_site_data": true,
     "enforceJwt": false,
-    "s3_keys_metadata_path": "/com.uid2.core/test/s3encryption_keys/metadata.json"
+    "s3_keys_metadata_path": "/com.uid2.core/test/s3encryption_keys/metadata.json",
+    "encryption_support_version": "5"
 }

conf/local-e2e-config.json

@@ -33,5 +33,6 @@
     "aws_kms_jwt_signing_public_keys": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmvwB41qI5Fe41PDbXqcX5uOvSvfKh8l9QV0O3M+NsB4lKqQEP0t1hfoiXTpOgKz1ArYxHsQ2LeXifX4uwEbYJFlpVM+tyQkTWQjBOw6fsLYK2Xk4X2ylNXUUf7x3SDiOVxyvTh3OZW9kqrDBN9JxSoraNLyfw0hhW0SHpfs699SehgbQ7QWep/gVlKRLIz0XAXaZNw24s79ORcQlrCE6YD0PgQmpI/dK5xMML82n6y3qcTlywlGaU7OGIMdD+CTXA3BcOkgXeqZTXNaX1u6jCTa1lvAczun6avp5VZ4TFiuPo+y4rJ3GU+14cyT5NckEcaTKSvd86UdwK5Id9tl3bQIDAQAB",
     "core_public_url": "http://localhost:8088",
     "optout_url": "http://localhost:8081",
-    "s3_keys_metadata_path": "s3encryption_keys/metadata.json"
+    "s3_keys_metadata_path": "s3encryption_keys/metadata.json",
+    "encryption_support_version": "5"
 }

conf/local-e2e-docker-config.json

@@ -32,5 +32,6 @@
   "aws_kms_jwt_signing_public_keys": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmvwB41qI5Fe41PDbXqcX5uOvSvfKh8l9QV0O3M+NsB4lKqQEP0t1hfoiXTpOgKz1ArYxHsQ2LeXifX4uwEbYJFlpVM+tyQkTWQjBOw6fsLYK2Xk4X2ylNXUUf7x3SDiOVxyvTh3OZW9kqrDBN9JxSoraNLyfw0hhW0SHpfs699SehgbQ7QWep/gVlKRLIz0XAXaZNw24s79ORcQlrCE6YD0PgQmpI/dK5xMML82n6y3qcTlywlGaU7OGIMdD+CTXA3BcOkgXeqZTXNaX1u6jCTa1lvAczun6avp5VZ4TFiuPo+y4rJ3GU+14cyT5NckEcaTKSvd86UdwK5Id9tl3bQIDAQAB",
   "core_public_url": "http://core:8088",
   "optout_url": "http://optout:8081",
-  "s3_keys_metadata_path": "s3encryption_keys/metadata.json"
+  "s3_keys_metadata_path": "s3encryption_keys/metadata.json",
+  "encryption_support_version": "5"
 }

pom.xml

@@ -6,7 +6,7 @@
 
   <groupId>com.uid2</groupId>
   <artifactId>uid2-core</artifactId>
-  <version>2.17.0</version>
+  <version>2.17.8-alpha-44-SNAPSHOT</version>
 
   <properties>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -24,7 +24,7 @@
     <vertx.verticle>com.uid2.core.vertx.CoreVerticle</vertx.verticle>
     <launcher.class>io.vertx.core.Launcher</launcher.class>
 
-    <uid2-shared.version>7.17.0</uid2-shared.version>
+    <uid2-shared.version>7.17.8-alpha-140-SNAPSHOT</uid2-shared.version>
     <image.version>${project.version}</image.version>
   </properties>
 
@@ -109,6 +109,11 @@
       <version>5.2.0</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>net.bytebuddy</groupId>
+      <artifactId>byte-buddy</artifactId>
+      <version>1.14.17</version>
+    </dependency>
     <dependency>
       <groupId>io.vertx</groupId>
       <artifactId>vertx-micrometer-metrics</artifactId>

src/main/java/com/uid2/core/service/ClientMetadataProvider.java

@@ -23,7 +23,7 @@ public class ClientMetadataProvider implements IClientMetadataProvider {
 
     @Override
     public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(ClientsMetadataPathName));
+        String pathname = getMetadataPathName(info, SecretStore.Global.get(ClientsMetadataPathName));
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("client_keys");

src/main/java/com/uid2/core/service/ISiteMetadataProvider.java

@@ -1,5 +1,7 @@
 package com.uid2.core.service;
 
+import com.uid2.core.util.OperatorInfo;
+
 public interface ISiteMetadataProvider {
-    String getMetadata() throws Exception;
+    String getMetadata(OperatorInfo info) throws Exception;
 }

src/main/java/com/uid2/core/service/KeysetKeysMetadataProvider.java

@@ -21,7 +21,7 @@ public KeysetKeysMetadataProvider(ICloudStorage cloudStorage) {
 
     @Override
     public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetKeysMetadataPathProp));
+        String pathname = getMetadataPathName(info, SecretStore.Global.get(Const.Config.KeysetKeysMetadataPathProp));
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keyset_keys");

src/main/java/com/uid2/core/service/KeysetMetadataProvider.java

@@ -20,7 +20,7 @@ public KeysetMetadataProvider(ICloudStorage cloudStorage) {
 
     @Override
     public String getMetadata(OperatorInfo info) throws Exception {
-        String pathname = getMetadataPathName(info.getOperatorType(), info.getSiteId(), SecretStore.Global.get(Const.Config.KeysetsMetadataPathProp));
+        String pathname = getMetadataPathName(info, SecretStore.Global.get(Const.Config.KeysetsMetadataPathProp));
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("keysets");

src/main/java/com/uid2/core/service/SiteMetadataProvider.java

@@ -1,6 +1,8 @@
 package com.uid2.core.service;
 
 import com.uid2.core.model.SecretStore;
+import com.uid2.core.util.OperatorInfo;
+import com.uid2.shared.Const;
 import com.uid2.shared.cloud.ICloudStorage;
 import com.uid2.shared.store.CloudPath;
 import com.uid2.shared.store.scope.GlobalScope;
@@ -11,6 +13,7 @@
 import java.io.InputStream;
 import java.io.InputStreamReader;
 
+import static com.uid2.core.util.MetadataHelper.getMetadataPathName;
 import static com.uid2.core.util.MetadataHelper.readToEndAsString;
 
 public class SiteMetadataProvider implements ISiteMetadataProvider {
@@ -22,8 +25,8 @@ public SiteMetadataProvider(ICloudStorage cloudStorage) {
         this.metadataStreamProvider = this.downloadUrlGenerator = cloudStorage;
     }
     @Override
-    public String getMetadata() throws Exception {
-        String pathname = new GlobalScope(new CloudPath(SecretStore.Global.get(SiteMetadataPathName))).getMetadataPath().toString();
+    public String getMetadata(OperatorInfo info) throws Exception {
+        String pathname = getMetadataPathName(info, SecretStore.Global.get(SiteMetadataPathName));
         String original = readToEndAsString(metadataStreamProvider.download(pathname));
         JsonObject main = (JsonObject) Json.decodeValue(original);
         JsonObject obj = main.getJsonObject("sites");

src/main/java/com/uid2/core/util/MetadataHelper.java

@@ -4,6 +4,7 @@
 import com.uid2.shared.auth.OperatorType;
 import com.uid2.shared.auth.Role;
 import com.uid2.shared.store.CloudPath;
+import com.uid2.shared.store.scope.EncryptedScope;
 import com.uid2.shared.store.scope.GlobalScope;
 import com.uid2.shared.store.scope.SiteScope;
 import com.uid2.shared.store.scope.StoreScope;
@@ -22,17 +23,34 @@ public static String getSiteSpecificMetadataPathName(int siteId, String metadata
         return SiteSpecificDataSubDirPath +siteId + metadataPathName;
     }
 
-    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName)
-    {
+    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName) {
+        return getMetadataPathName(operatorType, siteId, metadataPathName, false);
+    }
+
+    public static String getMetadataPathName(OperatorInfo info, String metadataPathName) {
+        return getMetadataPathName(info.getOperatorType(), info.getSiteId(), metadataPathName, info.getSupportsEncryption());
+    }
+
+
+    public static String getMetadataPathName(OperatorType operatorType, int siteId, String metadataPathName, Boolean canDecrypt) {
         StoreScope store;
         Boolean providePrivateSiteData = ConfigStore.Global.getBoolean("provide_private_site_data");
-        if (operatorType == OperatorType.PUBLIC || (providePrivateSiteData == null || !providePrivateSiteData.booleanValue()))
-        {
-            store = new GlobalScope(new CloudPath(metadataPathName));
-        }
-        else //PRIVATE
-        {
-            store = new SiteScope(new CloudPath(metadataPathName), siteId);
+        if (canDecrypt) { // Check if decryption is possible
+            if (operatorType == OperatorType.PUBLIC ) //siteId_public folder
+            {
+                store = new EncryptedScope(new CloudPath(metadataPathName), siteId, true);
+            } else //siteId_private folder
+            {
+                store = new EncryptedScope(new CloudPath(metadataPathName), siteId, false);
+            }
+        } else {
+            if (operatorType == OperatorType.PUBLIC || (providePrivateSiteData == null || !providePrivateSiteData.booleanValue()))
+            {
+                store = new GlobalScope(new CloudPath(metadataPathName));
+            } else //PRIVATE
+            {
+                store = new SiteScope(new CloudPath(metadataPathName), siteId);
+            }
         }
         return store.getMetadataPath().toString();
     }

src/main/java/com/uid2/core/util/OperatorInfo.java

@@ -1,9 +1,19 @@
 package com.uid2.core.util;
+import com.uid2.core.Const;
 import com.uid2.shared.auth.IAuthorizable;
 import com.uid2.shared.auth.OperatorKey;
 import com.uid2.shared.auth.OperatorType;
+import io.vertx.core.http.HttpServerRequest;
 import io.vertx.ext.web.RoutingContext;
 
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import com.uid2.core.model.ConfigStore;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import static com.uid2.shared.Const.Config.encryptionSupportVersion;
+import static com.uid2.shared.Const.Http.AppVersionHeader;
 import static com.uid2.shared.middleware.AuthMiddleware.API_CLIENT_PROP;
 
 /**
@@ -13,6 +23,9 @@
 public class OperatorInfo {
     private final OperatorType operatorType;
     private final int siteId;
+    private final boolean supportsEncryption;
+
+    static Logger logger = LoggerFactory.getLogger(OperatorInfo.class);
 
     public OperatorType getOperatorType() {
         return operatorType;
@@ -22,17 +35,73 @@ public int getSiteId() {
         return siteId;
     }
 
-    public OperatorInfo(OperatorType operatorType, int siteId) {
+    public boolean getSupportsEncryption() {return supportsEncryption;}
+
+    public OperatorInfo(OperatorType operatorType, int siteId, boolean supportsEncryption) {
         this.operatorType = operatorType;
         this.siteId = siteId;
+        this.supportsEncryption = supportsEncryption;
     }
 
     public static OperatorInfo getOperatorInfo(RoutingContext rc) throws Exception {
         IAuthorizable profile = (IAuthorizable) rc.data().get(API_CLIENT_PROP);
         if (profile instanceof OperatorKey) {
             OperatorKey operatorKey = (OperatorKey) profile;
-            return new OperatorInfo(operatorKey.getOperatorType(), operatorKey.getSiteId());
+            return new OperatorInfo(operatorKey.getOperatorType(), operatorKey.getSiteId(), supportsEncryption(rc));
         }
         throw new Exception("Cannot determine the operator type and site id from the profile");
     }
+
+    static boolean supportsEncryption(RoutingContext rc) {
+        String appVersion = rc.request().getHeader(AppVersionHeader);
+        if (appVersion == null) {
+            logger.warn("AppVersion header is missing.");
+            return false;
+        }
+        String[] versions = appVersion.split(";");
+        for (String version : versions) {
+            if (version.startsWith("uid2-operator=")) {
+                String operatorVersion = version.substring("uid2-operator=".length());
+                boolean isSupported = isVersionGreaterOrEqual(operatorVersion, ConfigStore.Global.getOrDefault(encryptionSupportVersion, "9999"));
+                logger.debug("Operator version: {}, {}",
+                        operatorVersion, isSupported ? "Supports encryption" : "Does not support encryption");
+                return isSupported;
+            }
+        }
+        logger.warn("No operator version found in AppVersion header.");
+        return false;
+    }
+
+    /*
+    Returns if the version of a semvar v1 is greater or equal to v2
+     */
+    static boolean isVersionGreaterOrEqual(String v1, String v2) {
+        Pattern pattern = Pattern.compile("(\\d+)(?:\\.(\\d+))?(?:\\.(\\d+))?");
+        Matcher m1 = pattern.matcher(v1);
+        Matcher m2 = pattern.matcher(v2);
+
+        int[] parts1 = extractParts(m1);
+        int[] parts2 = extractParts(m2);
+
+        for (int i = 0; i < Math.max(parts1.length, parts2.length); i++) {
+            int p1 = i < parts1.length ? parts1[i] : 0;
+            int p2 = i < parts2.length ? parts2[i] : 0;
+            if (p1 != p2) {
+                return p1 > p2;
+            }
+        }
+
+        return true;
+    }
+
+    private static int[] extractParts(Matcher matcher) {
+        int[] parts = new int[3];
+        if (matcher.find()) {
+            for (int i = 1; i <= 3; i++) {
+                String group = matcher.group(i);
+                parts[i - 1] = group != null ? Integer.parseInt(group) : 0;
+            }
+        }
+        return parts;
+    }
 }

src/main/java/com/uid2/core/vertx/CoreVerticle.java

@@ -358,7 +358,7 @@ private void handleSiteRefresh(RoutingContext rc) {
                 return;
             }
             rc.response().putHeader(HttpHeaders.CONTENT_TYPE, "application/json")
-                    .end(siteMetadataProvider.getMetadata());
+                    .end(siteMetadataProvider.getMetadata(info));
         } catch (Exception e) {
             logger.warn("exception in handleSiteRefresh: " + e.getMessage(), e);
             Error("error", 500, rc, "error processing sites refresh");

src/main/resources/com.uid2.core/test/operators/operators.json

@@ -1,4 +1,21 @@
 [
+  {
+    "key": "UID2-O-L-999-dp9Dt0.JVoGpynN4J8nMA7FxmzsavxJa8B9H74y9xdEE=",
+    "name": "Special",
+    "contact": "Special",
+    "protocol": "trusted",
+    "created": 1701210253,
+    "disabled": false,
+    "roles": [
+      "OPERATOR",
+      "OPTOUT"
+    ],
+    "site_id": 999,
+    "operator_type": "PUBLIC",
+    "key_hash": "rTD7MpJn5/j4G6N+Ph659F4FGtiJy7MLNtfVA7XUdu6cYC9ok6EwGeI2upyDOvxvPkOCUn7HBKay8ubPQmRc0A==",
+    "key_salt": "ZpqdDFksFeWx/ouPAoWi39TVuGrSGwijfCN4f0pAl2Y=",
+    "key_id": "UID2-O-L-999-dp9Dt"
+  },
   {
     "key": "test-partner-key",
     "name": "[email protected]",

src/test/java/com/uid2/core/util/TestMetadataHelper.java

@@ -0,0 +1,67 @@
+package com.uid2.core.util;
+
+import com.uid2.core.model.ConfigStore;
+import com.uid2.shared.auth.OperatorType;
+import io.vertx.core.json.JsonObject;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.mockito.Mockito.when;
+
+
+public class TestMetadataHelper {
+
+    @Mock
+    private OperatorInfo operatorInfo;
+
+    @BeforeEach
+    void setUp() {
+        MockitoAnnotations.openMocks(this);
+        ConfigStore.Global.load(new JsonObject().put("provide_private_site_data", true));
+    }
+
+    @Test
+    void testGetMetadataPathNameDecryptPublic() {
+        when(operatorInfo.getOperatorType()).thenReturn(OperatorType.PUBLIC);
+        when(operatorInfo.getSiteId()).thenReturn(42);
+        when(operatorInfo.getSupportsEncryption()).thenReturn(true);
+
+        String result = MetadataHelper.getMetadataPathName(operatorInfo, "s3://test-bucket/folder/");
+        assertEquals("s3://test-bucket/encrypted/42_public/folder", result);
+    }
+
+    @Test
+    void testGetMetadataPathNameDecryptPrivate() {
+        when(operatorInfo.getOperatorType()).thenReturn(OperatorType.PRIVATE);
+        when(operatorInfo.getSiteId()).thenReturn(42);
+        when(operatorInfo.getSupportsEncryption()).thenReturn(true);
+
+        String result = MetadataHelper.getMetadataPathName(operatorInfo, "s3://test-bucket/folder/");
+        assertEquals("s3://test-bucket/encrypted/42_private/folder", result);
+    }
+
+
+    @Test
+    void testGetMetadataPathNamePublic() {
+        when(operatorInfo.getOperatorType()).thenReturn(OperatorType.PUBLIC);
+        when(operatorInfo.getSiteId()).thenReturn(42);
+        when(operatorInfo.getSupportsEncryption()).thenReturn(false);
+
+        String result = MetadataHelper.getMetadataPathName(operatorInfo, "s3://test-bucket/folder/");
+        assertEquals("s3://test-bucket/folder", result);
+    }
+
+
+    @Test
+    void testGetMetadataPathNamePrivate() {
+        when(operatorInfo.getOperatorType()).thenReturn(OperatorType.PRIVATE);
+        when(operatorInfo.getSiteId()).thenReturn(42);
+        when(operatorInfo.getSupportsEncryption()).thenReturn(false);
+
+        String result = MetadataHelper.getMetadataPathName(operatorInfo, "s3://test-bucket/folder/");
+        assertEquals("s3://test-bucket/site/42/folder", result);
+    }
+}