Test secrets manager

go.mod

@@ -5,6 +5,7 @@ go 1.23
 require (
 	github.com/golang-jwt/jwt/v5 v5.2.1
 	github.com/google/uuid v1.6.0
+	github.com/gorilla/mux v1.8.1
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
 	github.com/hashicorp/terraform-plugin-docs v0.19.4
 	github.com/hashicorp/terraform-plugin-log v0.9.0

go.sum

@@ -65,6 +65,8 @@ github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/hashicorp/cli v1.1.6 h1:CMOV+/LJfL1tXCOKrgAX0uRKnzjj/mpmqNXloRSy2K8=
 github.com/hashicorp/cli v1.1.6/go.mod h1:MPon5QYlgjjo0BSoAiN0ESeT5fRzDjVRp+uioJ0piz4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=

internal/bitwarden/crypto/keybuilder/encryption_key.go

@@ -3,7 +3,6 @@ package keybuilder
 import (
 	"crypto/rand"
 	"crypto/sha256"
-	"encoding/base64"
 	"fmt"
 
 	"github.com/maxlaverse/terraform-provider-bitwarden/internal/bitwarden/crypto"
@@ -41,13 +40,8 @@ func EncryptEncryptionKey(key symmetrickey.Key, encryptionKey []byte) (newEncryp
 	return newEncryptionKey, encryptedEncryptionKey, err
 }
 
-func DeriveFromAccessTokenEncryptionKey(accessToken string) (*symmetrickey.Key, error) {
-	accessTokenEncryptionKey, err := base64.StdEncoding.DecodeString(accessToken)
-	if err != nil {
-		return nil, fmt.Errorf("error base64 decoding access token encryption key: %w", err)
-	}
-
-	extractedKey := helpers.HMACSum(accessTokenEncryptionKey, []byte("bitwarden-accesstoken"), sha256.New)
+func DeriveFromAccessTokenEncryptionKey(accessToken []byte) (*symmetrickey.Key, error) {
+	extractedKey := helpers.HMACSum(accessToken, []byte("bitwarden-accesstoken"), sha256.New)
 	expandedKey := helpers.HKDFExpand(extractedKey, []byte("sm-access-token"), sha256.New, 64)
 
 	return symmetrickey.NewFromRawBytesWithEncryptionType(expandedKey, symmetrickey.AesCbc256_HmacSha256_B64)

internal/bitwarden/embedded/secrets_manager.go

@@ -349,7 +349,7 @@ func parseAccessToken(accessToken string) (string, string, *symmetrickey.Key, er
 	}
 
 	credentialsPart := accessTokenParts1[0]
-	encryptionPart := accessTokenParts1[1]
+	base64EncodedEncryptionKey := accessTokenParts1[1]
 
 	accessTokenParts := strings.Split(credentialsPart, ".")
 	if len(accessTokenParts) != 3 {
@@ -363,7 +363,12 @@ func parseAccessToken(accessToken string) (string, string, *symmetrickey.Key, er
 	clientId := accessTokenParts[1]
 	clientSecret := accessTokenParts[2]
 
-	userEncryptionKey, err := keybuilder.DeriveFromAccessTokenEncryptionKey(encryptionPart)
+	accessTokenEncryptionKey, err := base64.StdEncoding.DecodeString(base64EncodedEncryptionKey)
+	if err != nil {
+		return "", "", nil, fmt.Errorf("error base64 decoding access token encryption key: %w", err)
+	}
+
+	userEncryptionKey, err := keybuilder.DeriveFromAccessTokenEncryptionKey(accessTokenEncryptionKey)
 	if err != nil {
 		return "", "", nil, fmt.Errorf("error creating symmetric key: %w", err)
 	}