Refactor encryption key resolution to rely solely on symmetric_encryption_key system property

Author: eng-dedalus

tomcat-password-encryption/pom.xml

@@ -4,7 +4,7 @@
     <groupId>it.eng.knowage</groupId>
     <artifactId>tomcat-password-encryption</artifactId>
     <version>9.0.0-SNAPSHOT</version>
-    <name>Archetype - tomcat-password-encryption</name>
+    <name>tomcat-password-encryption</name>
     <url>http://maven.apache.org</url>
 
     <properties>

tomcat-password-encryption/src/main/java/it/eng/knowage/tomcatpasswordencryption/helper/EncryptOnce.java

@@ -2,6 +2,8 @@
 import org.jasypt.encryption.pbe.StandardPBEStringEncryptor;
 import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
 
+import static it.eng.knowage.tomcatpasswordencryption.helper.EncryptedPasswordUtils.ENCRYPTION_KEY_SYSTEM_PROPERTY_NAME;
+
 public class EncryptOnce {
 
     public static void main(String[] args) {
@@ -11,14 +13,14 @@ public static void main(String[] args) {
             System.exit(1);
         }
         String clear = args[0];
-        String key = EncryptedPasswordUtils.resolveKey();
-        if (key == null || key.isEmpty()) {
-            System.err.println("Missing -Dknowage.enc.password.file");
+        String encryptionKey =System.getProperty(ENCRYPTION_KEY_SYSTEM_PROPERTY_NAME);
+        if (encryptionKey == null || encryptionKey.isEmpty()) {
+            System.err.println("Missing decryption key. Provide it via system property symmetric_encryption_key.");
             System.exit(2);
         }
 
         SimpleStringPBEConfig cfg = new SimpleStringPBEConfig();
-        cfg.setPassword(key);
+        cfg.setPassword(encryptionKey);
         cfg.setPoolSize("1");
         cfg.setStringOutputType("base64");
 

tomcat-password-encryption/src/main/java/it/eng/knowage/tomcatpasswordencryption/helper/EncryptedPasswordUtils.java

@@ -10,6 +10,7 @@
 
 public final class EncryptedPasswordUtils {
     private static final String ENCRYPTED_PREFIX = "#encr#";
+    public static final String ENCRYPTION_KEY_SYSTEM_PROPERTY_NAME = "symmetric_encryption_key";
 
     private EncryptedPasswordUtils() {}
 
@@ -19,56 +20,18 @@ public static String decrypt(String value) {
             return value;
         }
         String cipherText = value.substring(ENCRYPTED_PREFIX.length());
-        String password = resolveKey();
-        if (password == null || password.isEmpty()) {
-            throw new IllegalStateException("""
-                    Missing decryption key. Provide it via system property knowage.enc.password, " +
-                                        "environment variable KNOWAGE_ENC_PASSWORD, or a file at ${catalina.base}/conf/knowageTomcatEncryptedPasswordDatasource " +
-                                        "or -Dknowage.enc.password.file=/secure/path
-                    """);
+        String decryptionKey = System.getProperty(ENCRYPTION_KEY_SYSTEM_PROPERTY_NAME);
+        if (decryptionKey == null || decryptionKey.isEmpty()) {
+            throw new IllegalStateException("Missing decryption key. Provide it via system property symmetric_encryption_key");
         }
 
         SimpleStringPBEConfig cfg = new SimpleStringPBEConfig();
-        cfg.setPassword(password);
+        cfg.setPassword(decryptionKey);
         cfg.setPoolSize("1");
         cfg.setStringOutputType("base64");
 
         StandardPBEStringEncryptor enc = new StandardPBEStringEncryptor();
         enc.setConfig(cfg);
         return enc.decrypt(cipherText);
     }
-
-    public static String resolveKey() {
-        // Prefer explicit file path via system property
-        String fileProp = System.getProperty("knowage.enc.password.file");
-        if (fileProp != null && !fileProp.isEmpty()) {
-            String fromFile = readFirstLineTrimmed(Path.of(fileProp));
-            if (fromFile != null && !fromFile.isEmpty()) return fromFile;
-        }
-
-        // Default file under Tomcat conf: ${catalina.base}/conf/passwordEncryptionSecret
-        String catalinaBase = System.getProperty("catalina.base");
-        if (catalinaBase != null && !catalinaBase.isEmpty()) {
-            Path defaultPath = Path.of(catalinaBase, "conf", "knowageTomcatEncryptedPasswordDatasource");
-            String fromFile = readFirstLineTrimmed(defaultPath);
-            if (fromFile != null && !fromFile.isEmpty()) return fromFile;
-        }
-
-        return null;
-    }
-
-    private static String readFirstLineTrimmed(Path path) {
-        try {
-            if (Files.isRegularFile(path)) {
-                for (String line : Files.readAllLines(path, StandardCharsets.UTF_8)) {
-                    String trimmed = line.trim();
-                    if (!trimmed.isEmpty()) return trimmed;
-                }
-            }
-        } catch (IOException ignored) {
-        }
-        return null;
-    }
-
-
 }