database::security::credential_manager Class Reference

Manages encrypted credential storage and retrieval. More...

#include <secure_connection.h>

Collaboration diagram for database::security::credential_manager:

Public Member Functions
	credential_manager ()=default
	Default constructor - used by database_context.
bool	store_credentials (const std::string &connection_id, const security_credentials &credentials)
std::optional< security_credentials >	get_credentials (const std::string &connection_id) const
bool	remove_credentials (const std::string &connection_id)
void	set_master_key (const std::string &key)
bool	rotate_encryption_keys ()
std::string	hash_password (const std::string &password) const
bool	verify_password (const std::string &password, const std::string &hash) const

Private Member Functions
std::string	encrypt_data (const std::string &data) const
std::string	decrypt_data (const std::string &encrypted_data) const

Private Attributes
std::mutex	credentials_mutex_
std::unordered_map< std::string, std::string >	encrypted_credentials_
std::string	master_key_

Detailed Description

Manages encrypted credential storage and retrieval.

Note

This class uses dependency injection pattern. Access via database_context::get_credential_manager() (Sprint 3, Task 3.3).

Example:

auto context = std::make_shared<database_context>();
auto cred_mgr = context->get_credential_manager();

Definition at line 99 of file secure_connection.h.

Constructor & Destructor Documentation

credential_manager()

database::security::credential_manager::credential_manager ( )

default

Default constructor - used by database_context.

Member Function Documentation

decrypt_data()

std::string database::security::credential_manager::decrypt_data ( const std::string & encrypted_data ) const

private

Definition at line 352 of file secure_connection.cpp.

    {
        if (encrypted_data.empty())
        {
            return {};
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // AES-256-GCM decryption: parse "aes:<iv_hex>:<ciphertext_hex>:<tag_hex>"
        if (encrypted_data.substr(0, 4) == "aes:")
        {
            auto first = encrypted_data.find(':', 4);
            auto second = encrypted_data.find(':', first + 1);
            if (first == std::string::npos || second == std::string::npos)
            {
                return {};
            }
 
            auto iv = hex_to_bytes(encrypted_data.substr(4, first - 4));
            auto ciphertext = hex_to_bytes(encrypted_data.substr(first + 1, second - first - 1));
            auto tag = hex_to_bytes(encrypted_data.substr(second + 1));
 
            std::string key = master_key_.empty() ? "default_key_placeholder!!" : master_key_;
            key.resize(32, '\0');
 
            EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
            if (!ctx) return {};
 
            std::vector<uint8_t> plaintext(ciphertext.size() + EVP_MAX_BLOCK_LENGTH);
            int len = 0, plaintext_len = 0;
 
            EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), nullptr, nullptr, nullptr);
            EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, static_cast<int>(iv.size()), nullptr);
            EVP_DecryptInit_ex(ctx, nullptr, nullptr,
                               reinterpret_cast<const unsigned char*>(key.data()), iv.data());
            EVP_DecryptUpdate(ctx, plaintext.data(), &len,
                              ciphertext.data(), static_cast<int>(ciphertext.size()));
            plaintext_len = len;
            EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, static_cast<int>(tag.size()),
                                const_cast<uint8_t*>(tag.data()));
 
            int ret = EVP_DecryptFinal_ex(ctx, plaintext.data() + len, &len);
            EVP_CIPHER_CTX_free(ctx);
 
            if (ret <= 0) return {};  // Authentication failed
            plaintext_len += len;
 
            return std::string(plaintext.begin(), plaintext.begin() + plaintext_len);
        }
#endif
 
        // Legacy XOR format (with or without "xor:" prefix)
        std::string hex_data = encrypted_data;
        if (hex_data.substr(0, 4) == "xor:")
        {
            hex_data = hex_data.substr(4);
        }
 
        std::string decoded;
        decoded.reserve(hex_data.size() / 2);
        for (size_t i = 0; i + 1 < hex_data.size(); i += 2)
        {
            unsigned int byte = 0;
            std::istringstream iss(hex_data.substr(i, 2));
            iss >> std::hex >> byte;
            decoded.push_back(static_cast<char>(byte));
        }
 
        std::string key = master_key_.empty() ? "default_key" : master_key_;
        for (size_t i = 0; i < decoded.size(); ++i)
        {
            decoded[i] ^= key[i % key.size()];
        }
 
        return decoded;
    }

References master_key_.

Referenced by get_credentials(), and rotate_encryption_keys().

Here is the caller graph for this function:

encrypt_data()

std::string database::security::credential_manager::encrypt_data ( const std::string & data ) const

private

Definition at line 282 of file secure_connection.cpp.

    {
        if (data.empty())
        {
            return {};
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // AES-256-GCM encryption
        std::string key = master_key_.empty() ? "default_key_placeholder!!" : master_key_;
        // Pad or truncate key to 32 bytes for AES-256
        key.resize(32, '\0');
 
        constexpr int iv_len = 12;
        constexpr int tag_len = 16;
 
        std::vector<uint8_t> iv(iv_len);
        RAND_bytes(iv.data(), iv_len);
 
        EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
        if (!ctx) return {};
 
        std::vector<uint8_t> ciphertext(data.size() + EVP_MAX_BLOCK_LENGTH);
        std::vector<uint8_t> tag(tag_len);
        int len = 0, ciphertext_len = 0;
 
        EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), nullptr, nullptr, nullptr);
        EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, nullptr);
        EVP_EncryptInit_ex(ctx, nullptr, nullptr,
                           reinterpret_cast<const unsigned char*>(key.data()), iv.data());
        EVP_EncryptUpdate(ctx, ciphertext.data(), &len,
                          reinterpret_cast<const unsigned char*>(data.data()),
                          static_cast<int>(data.size()));
        ciphertext_len = len;
        EVP_EncryptFinal_ex(ctx, ciphertext.data() + len, &len);
        ciphertext_len += len;
        EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, tag_len, tag.data());
        EVP_CIPHER_CTX_free(ctx);
 
        ciphertext.resize(ciphertext_len);
 
        // Format: "aes:<iv_hex>:<ciphertext_hex>:<tag_hex>"
        return "aes:" + bytes_to_hex(iv) + ":" + bytes_to_hex(ciphertext) + ":" + bytes_to_hex(tag);
#else
        // WARNING: XOR obfuscation is NOT cryptographically secure.
        static bool warned = false;
        if (!warned)
        {
            std::cerr << "[database_system] WARNING: Using XOR placeholder for data encryption. "
                      << "Build with OpenSSL for AES-256-GCM support.\n";
            warned = true;
        }
 
        std::string key = master_key_.empty() ? "default_key" : master_key_;
        std::string result = data;
        for (size_t i = 0; i < result.size(); ++i)
        {
            result[i] ^= key[i % key.size()];
        }
 
        std::ostringstream oss;
        for (unsigned char c : result)
        {
            oss << std::hex << std::setfill('0') << std::setw(2)
                << static_cast<int>(c);
        }
        return "xor:" + oss.str();
#endif
    }

References master_key_.

Referenced by rotate_encryption_keys(), and store_credentials().

Here is the caller graph for this function:

get_credentials()

std::optional< security_credentials > database::security::credential_manager::get_credentials

(

const std::string &

connection_id

)

const

Definition at line 51 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(credentials_mutex_);
 
        auto it = encrypted_credentials_.find(connection_id);
        if (it == encrypted_credentials_.end())
        {
            return std::nullopt;
        }
 
        std::string decrypted = decrypt_data(it->second);
        if (decrypted.empty())
        {
            return std::nullopt;
        }
 
        // Deserialize credentials
        std::istringstream iss(decrypted);
        security_credentials creds;
        std::getline(iss, creds.username);
        std::getline(iss, creds.password_hash);
        std::getline(iss, creds.certificate_path);
        std::getline(iss, creds.private_key_path);
        std::getline(iss, creds.ca_cert_path);
 
        int auth_method_int = 0;
        int encryption_int = 0;
        iss >> auth_method_int >> encryption_int;
        creds.auth_method = static_cast<authentication_method>(auth_method_int);
        creds.encryption = static_cast<encryption_type>(encryption_int);
 
        return creds;
    }

References database::security::security_credentials::auth_method, database::security::security_credentials::ca_cert_path, database::security::security_credentials::certificate_path, credentials_mutex_, decrypt_data(), encrypted_credentials_, database::security::security_credentials::encryption, database::security::security_credentials::password_hash, database::security::security_credentials::private_key_path, and database::security::security_credentials::username.

Here is the call graph for this function:

hash_password()

std::string database::security::credential_manager::hash_password

(

const std::string &

password

)

const

Definition at line 175 of file secure_connection.cpp.

    {
        if (password.empty())
        {
            return {};
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // PBKDF2-HMAC-SHA256: cryptographically secure password hashing
        constexpr int iterations = 100000;
        constexpr int salt_len = 16;
        constexpr int hash_len = 32;
 
        std::vector<uint8_t> salt(salt_len);
        RAND_bytes(salt.data(), salt_len);
 
        std::vector<uint8_t> hash(hash_len);
        PKCS5_PBKDF2_HMAC(
            password.c_str(), static_cast<int>(password.size()),
            salt.data(), salt_len,
            iterations,
            EVP_sha256(),
            hash_len, hash.data()
        );
 
        // Format: "pbkdf2:<iterations>:<salt_hex>:<hash_hex>"
        std::ostringstream oss;
        oss << "pbkdf2:" << iterations << ":" << bytes_to_hex(salt) << ":" << bytes_to_hex(hash);
        return oss.str();
#else
        // WARNING: FNV1a is NOT cryptographically secure.
        // Build with OpenSSL to enable PBKDF2-HMAC-SHA256 password hashing.
        static bool warned = false;
        if (!warned)
        {
            std::cerr << "[database_system] WARNING: Using FNV1a placeholder for password hashing. "
                      << "Build with OpenSSL for PBKDF2-HMAC-SHA256 support.\n";
            warned = true;
        }
 
        uint64_t hash = 0xcbf29ce484222325ULL;
        for (char c : password)
        {
            hash ^= static_cast<uint64_t>(c);
            hash *= 0x100000001b3ULL;
        }
 
        std::ostringstream oss;
        oss << std::hex << std::setfill('0') << std::setw(16) << hash;
        return "fnv1a:" + oss.str();
#endif
    }

References database::security::password.

Referenced by verify_password().

Here is the caller graph for this function:

remove_credentials()

bool database::security::credential_manager::remove_credentials

(

const std::string &

connection_id

)

Definition at line 86 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(credentials_mutex_);
        return encrypted_credentials_.erase(connection_id) > 0;
    }

References credentials_mutex_, and encrypted_credentials_.

rotate_encryption_keys()

bool database::security::credential_manager::rotate_encryption_keys

(

)

Definition at line 98 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(credentials_mutex_);
 
        if (master_key_.empty())
        {
            return false;
        }
 
        // Generate new key
        std::string old_key = master_key_;
        std::random_device rd;
        std::mt19937 gen(rd());
        std::uniform_int_distribution<int> dist(33, 126);  // printable ASCII
        std::string new_key;
        new_key.reserve(32);
        for (int i = 0; i < 32; ++i)
        {
            new_key.push_back(static_cast<char>(dist(gen)));
        }
 
        // Re-encrypt all stored credentials with new key
        std::unordered_map<std::string, std::string> rotated;
        for (const auto& [id, encrypted] : encrypted_credentials_)
        {
            // Decrypt with old key
            std::string decrypted = decrypt_data(encrypted);
            if (decrypted.empty())
            {
                return false;  // Rotation failed — abort to preserve data
            }
 
            // Re-encrypt with new key (temporarily set new key)
            master_key_ = new_key;
            std::string re_encrypted = encrypt_data(decrypted);
            master_key_ = old_key;  // Restore old key in case of further failures
 
            if (re_encrypted.empty())
            {
                return false;
            }
            rotated[id] = re_encrypted;
        }
 
        // Commit: swap all credentials and update key
        encrypted_credentials_ = std::move(rotated);
        master_key_ = new_key;
        return true;
    }

References credentials_mutex_, decrypt_data(), encrypt_data(), encrypted_credentials_, and master_key_.

Here is the call graph for this function:

set_master_key()

void database::security::credential_manager::set_master_key

(

const std::string &

key

)

Definition at line 92 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(credentials_mutex_);
        master_key_ = key;
    }

References credentials_mutex_, and master_key_.

store_credentials()

bool database::security::credential_manager::store_credentials	(	const std::string &	connection_id,
		const security_credentials &	credentials )

Definition at line 30 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(credentials_mutex_);
 
        // Serialize credentials to a simple format and encrypt
        std::ostringstream oss;
        oss << credentials.username << "\n"
            << credentials.password_hash << "\n"
            << credentials.certificate_path << "\n"
            << credentials.private_key_path << "\n"
            << credentials.ca_cert_path << "\n"
            << static_cast<int>(credentials.auth_method) << "\n"
            << static_cast<int>(credentials.encryption);
 
        std::string serialized = oss.str();
        std::string encrypted = encrypt_data(serialized);
        encrypted_credentials_[connection_id] = encrypted;
        return true;
    }

References database::security::security_credentials::auth_method, database::security::security_credentials::ca_cert_path, database::security::security_credentials::certificate_path, credentials_mutex_, encrypt_data(), encrypted_credentials_, database::security::security_credentials::encryption, database::security::security_credentials::password_hash, database::security::security_credentials::private_key_path, and database::security::security_credentials::username.

Here is the call graph for this function:

verify_password()

bool database::security::credential_manager::verify_password	(	const std::string &	password,
		const std::string &	hash ) const

Definition at line 228 of file secure_connection.cpp.

    {
        if (password.empty() || hash.empty())
        {
            return false;
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // Parse format: "pbkdf2:<iterations>:<salt_hex>:<hash_hex>"
        if (hash.substr(0, 7) == "pbkdf2:")
        {
            auto first_colon = hash.find(':', 7);
            auto second_colon = hash.find(':', first_colon + 1);
            if (first_colon == std::string::npos || second_colon == std::string::npos)
            {
                return false;
            }
 
            int iterations = std::stoi(hash.substr(7, first_colon - 7));
            auto salt = hex_to_bytes(hash.substr(first_colon + 1, second_colon - first_colon - 1));
            auto expected_hash = hex_to_bytes(hash.substr(second_colon + 1));
 
            std::vector<uint8_t> computed(expected_hash.size());
            PKCS5_PBKDF2_HMAC(
                password.c_str(), static_cast<int>(password.size()),
                salt.data(), static_cast<int>(salt.size()),
                iterations,
                EVP_sha256(),
                static_cast<int>(computed.size()), computed.data()
            );
 
            return computed == expected_hash;
        }
 
        // Legacy FNV1a format migration: verify with old algorithm
        if (hash.substr(0, 6) == "fnv1a:")
        {
            uint64_t h = 0xcbf29ce484222325ULL;
            for (char c : password)
            {
                h ^= static_cast<uint64_t>(c);
                h *= 0x100000001b3ULL;
            }
            std::ostringstream oss;
            oss << std::hex << std::setfill('0') << std::setw(16) << h;
            return hash == ("fnv1a:" + oss.str());
        }
#endif
 
        // Fallback: direct comparison (covers fnv1a format without OpenSSL)
        return hash_password(password) == hash;
    }

References hash_password(), and database::security::password.

Here is the call graph for this function:

Member Data Documentation

credentials_mutex_

std::mutex database::security::credential_manager::credentials_mutex_

mutableprivate

Definition at line 124 of file secure_connection.h.

Referenced by get_credentials(), remove_credentials(), rotate_encryption_keys(), set_master_key(), and store_credentials().

encrypted_credentials_

std::unordered_map<std::string, std::string> database::security::credential_manager::encrypted_credentials_

private

Definition at line 125 of file secure_connection.h.

Referenced by get_credentials(), remove_credentials(), rotate_encryption_keys(), and store_credentials().

master_key_

std::string database::security::credential_manager::master_key_

private

Definition at line 126 of file secure_connection.h.

Referenced by decrypt_data(), encrypt_data(), rotate_encryption_keys(), and set_master_key().

---

The documentation for this class was generated from the following files:

• database/security/secure_connection.h
• database/security/secure_connection.cpp