Fix/decryption section for workflows #577
Conversation
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
- Added comprehensive WorkflowPayloadDecryptor class - Included AES-GCM decryption implementation - Added ASP.NET Core controller example - Included configuration management examples - Added proper error handling and data models
…n-key.mdx Delete from this PR
New topic - accidentally deleted
WalkthroughAdds a new documentation page Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Client as Workflow Client
participant Kinde as Kinde Workflows
participant Service as Backend Service
rect rgb(236,248,255)
Note over Client,Kinde: Client uses secureFetch (encryption enabled)
Client->>Kinde: secureFetch(payload)
Kinde->>Kinde: Encrypt body (AES‑GCM: nonce|tag|ciphertext) → Base64
Kinde->>Service: POST encrypted payload
end
rect rgb(240,255,240)
Service->>Service: Decode Base64, extract nonce/tag/ciphertext, decrypt with active key
alt Decryption succeeds
Service-->>Kinde: 2xx response
Kinde-->>Client: Success
else Decryption fails
Service-->>Kinde: 4xx/5xx error
Kinde-->>Client: Error
end
end
Note over Kinde: Keys can be added/updated/activated/deactivated/deleted via Workflows UI
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Deploying kinde-docs-preview with
|
| Latest commit: |
2432a1b
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://9dfea226.kinde-docs-preview.pages.dev |
| Branch Preview URL: | https://fix-decryption-section-for-w.kinde-docs-preview.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx(1 hunks)src/content/docs/workflows/manage-workflows/workflow-encryption-key.mdx(0 hunks)
💤 Files with no reviewable changes (1)
- src/content/docs/workflows/manage-workflows/workflow-encryption-key.mdx
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx
Show resolved
Hide resolved
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx
Outdated
Show resolved
Hide resolved
| using System; | ||
| using System.Security.Cryptography; | ||
| using System.Text; | ||
| using System.Text.Json; | ||
|
|
||
| public class WorkflowPayloadDecryptor | ||
| { | ||
| private readonly byte[] _encryptionKey; | ||
|
|
||
| public WorkflowPayloadDecryptor(string base64EncryptionKey) | ||
| { | ||
| _encryptionKey = Convert.FromBase64String(base64EncryptionKey); | ||
| } | ||
|
|
||
| public string DecryptPayload(string encryptedPayload) | ||
| { | ||
| try | ||
| { | ||
| // Step 1: Base64 decode the incoming payload | ||
| byte[] encryptedData = Convert.FromBase64String(encryptedPayload); | ||
|
|
||
| // Step 2: Parse the payload structure | ||
| // The payload contains: nonce (12 bytes) + tag (16 bytes) + ciphertext | ||
| const int nonceLength = 12; | ||
| const int tagLength = 16; | ||
|
|
||
| if (encryptedData.Length < nonceLength + tagLength) | ||
| { | ||
| throw new ArgumentException("Invalid encrypted payload structure"); | ||
| } | ||
|
|
||
| // Extract components | ||
| byte[] nonce = new byte[nonceLength]; | ||
| byte[] tag = new byte[tagLength]; | ||
| byte[] ciphertext = new byte[encryptedData.Length - nonceLength - tagLength]; | ||
|
|
||
| Array.Copy(encryptedData, 0, nonce, 0, nonceLength); | ||
| Array.Copy(encryptedData, nonceLength, tag, 0, tagLength); | ||
| Array.Copy(encryptedData, nonceLength + tagLength, ciphertext, 0, ciphertext.Length); | ||
|
|
||
| // Step 3: Decrypt using AES-GCM | ||
| using (var aesGcm = new AesGcm(_encryptionKey)) | ||
| { | ||
| byte[] decryptedBytes = new byte[ciphertext.Length]; | ||
| aesGcm.Decrypt(nonce, ciphertext, tag, decryptedBytes); | ||
|
|
||
| // Convert decrypted bytes to string | ||
| return Encoding.UTF8.GetString(decryptedBytes); | ||
| } | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| throw new InvalidOperationException("Failed to decrypt workflow payload", ex); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // Example usage in an ASP.NET Core controller | ||
| [ApiController] | ||
| [Route("api/[controller]")] | ||
| public class WorkflowController : ControllerBase | ||
| { | ||
| private readonly WorkflowPayloadDecryptor _decryptor; | ||
|
|
||
| public WorkflowController(IConfiguration configuration) | ||
| { | ||
| // Get the encryption key from configuration | ||
| string encryptionKey = configuration["KindeWorkflowEncryptionKey"]; | ||
| _decryptor = new WorkflowPayloadDecryptor(encryptionKey); | ||
| } | ||
|
|
||
| [HttpPost("webhook")] | ||
| public async Task<IActionResult> HandleWorkflowWebhook() | ||
| { | ||
| try | ||
| { | ||
| // Read the encrypted payload from the request body | ||
| using var reader = new StreamReader(Request.Body); | ||
| string encryptedPayload = await reader.ReadToEndAsync(); | ||
|
|
||
| // Decrypt the payload | ||
| string decryptedJson = _decryptor.DecryptPayload(encryptedPayload); | ||
|
|
||
| // Parse the decrypted JSON | ||
| var workflowData = JsonSerializer.Deserialize<WorkflowData>(decryptedJson); | ||
|
|
||
| // Process the decrypted data | ||
| // ... your business logic here ... | ||
|
|
||
| return Ok(new { message = "Workflow payload processed successfully" }); | ||
| } | ||
| catch (Exception ex) | ||
| { | ||
| return BadRequest(new { error = "Failed to process workflow payload", details = ex.Message }); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| // Example data model for the decrypted payload | ||
| public class WorkflowData | ||
| { | ||
| public string UserId { get; set; } | ||
| public string EventType { get; set; } | ||
| public Dictionary<string, object> Data { get; set; } | ||
| } | ||
| ``` |
There was a problem hiding this comment.
Add the missing using directives so the sample compiles.
The C# snippet references StreamReader, ControllerBase, IConfiguration, Task<IActionResult>, and Dictionary<string, object>, but the code block only imports core namespaces. Without the matching using statements (System.IO, System.Collections.Generic, System.Threading.Tasks, Microsoft.AspNetCore.Mvc, Microsoft.Extensions.Configuration), readers copying the sample will hit compile errors. Please prepend the snippet with the full set of namespaces (or annotate them inline) so the example builds cleanly.
🤖 Prompt for AI Agents
In src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx
around lines 67 to 172, the C# sample is missing required using directives which
cause compile errors for StreamReader, Dictionary, Task<IActionResult>,
ControllerBase and IConfiguration; prepend the file’s code block with the
following usings: System.IO, System.Collections.Generic, System.Threading.Tasks,
Microsoft.AspNetCore.Mvc, and Microsoft.Extensions.Configuration (keeping the
existing System, System.Security.Cryptography, System.Text, and System.Text.Json
lines) so the sample compiles cleanly.
alex72508
left a comment
alex72508
left a comment
There was a problem hiding this comment.
Changes look good. Fixed up a reference to the encryption keys that was added in another pull request.
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 21029323 | Triggered | Generic High Entropy Secret | 71dcde2 | scripts/generate-llms-txt-sections.js | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
There was a problem hiding this comment.
Actionable comments posted: 0
♻️ Duplicate comments (1)
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx (1)
71-176: Add missing using statements so the C# sample compiles.The code block references
ControllerBase,ApiController,Route,HttpPost,IConfiguration,Task<IActionResult>,StreamReader, andDictionarybut lacks the required imports. Readers copying this example will hit compile errors.Add these using statements before the class declarations:
using System; using System.Security.Cryptography; using System.Text; using System.Text.Json; +using System.Collections.Generic; +using System.IO; +using System.Threading.Tasks; +using Microsoft.AspNetCore.Mvc; +using Microsoft.Extensions.Configuration;
🧹 Nitpick comments (2)
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx (2)
64-66: Reduce sentence repetition for smoother prose.The three numbered steps (lines 64–66) all begin with "In [technology]," making the text feel repetitive. Consider varying the sentence structure while preserving clarity.
Example revision:
1. In Base64, decode the incoming payload. -2. In AES-GCM, decrypt the decoded data using your workflow's active encryption key (the one you created in the Kinde dashboard). -3. In .NET, for example, use the `System.Security.Cryptography.AesGcm` class for decryption. +2. Decrypt the decoded data using AES-GCM with your workflow's active encryption key (created in the Kinde dashboard). +3. For .NET, use the `System.Security.Cryptography.AesGcm` class for decryption.
202-202: Hyphenate compound adjective "three-dot menu".Multiple instances use "three dots menu," but when a compound adjective precedes a noun, it should be hyphenated: "three-dot menu."
Apply these changes:
-7. When you are ready to update the key in your code, select the three dots menu on the new key, then select **Activate**. +7. When you are ready to update the key in your code, select the three-dot menu on the new key, then select **Activate**. - 1. Select the three dots menu on the active key. + 1. Select the three-dot menu on the active key. - 1. Select the three dots menu on the inactive key. An inactive key shows no status. + 1. Select the three-dot menu on the inactive key. An inactive key shows no status. -3. Next to an inactive key, select the three dots menu. +3. Next to an inactive key, select the three-dot menu.Also applies to: 213-213, 217-217, 227-227
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/content/docs/workflows/bindings/secure-fetch-binding.mdx(1 hunks)src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx(1 hunks)
🧰 Additional context used
🪛 LanguageTool
src/content/docs/workflows/manage-workflows/encrypt-decrypt-workflows.mdx
[style] ~66-~66: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...you created in the Kinde dashboard). 3. In .NET, for example, use the `System.Secu...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[grammar] ~202-~202: Use a hyphen to join words.
Context: ...e the key in your code, select the three dots menu on the new key, then select **...
(QB_NEW_EN_HYPHEN)
[grammar] ~213-~213: Use a hyphen to join words.
Context: ...te an active key: 1. Select the three dots menu on the active key. 2. Selec...
(QB_NEW_EN_HYPHEN)
[grammar] ~217-~217: Use a hyphen to join words.
Context: ... deactivated key: 1. Select the three dots menu on the inactive key. An inacti...
(QB_NEW_EN_HYPHEN)
[grammar] ~227-~227: Use a hyphen to join words.
Context: ...ext to an inactive key, select the three dots menu. 4. Select Delete key. A c...
(QB_NEW_EN_HYPHEN)
🔇 Additional comments (1)
src/content/docs/workflows/bindings/secure-fetch-binding.mdx (1)
33-33: Link update correctly points to the new documentation page.The updated reference to
/workflows/manage-workflows/encrypt-decrypt-workflows/aligns with the migration from the old documentation structure and ensures the binding documentation remains properly linked.
New code snippet and decrypt section for workflows.
Summary by CodeRabbit