search

gaborcsardi / secret

:closed_lock_with_key: Secure sharing of sensitive information in R packages
Other
102 stars 16 forks source link

Throw a warning if users with identical fingerprint exist? #39

Open s-fleck opened 4 years ago

s-fleck commented 4 years ago

I recently had a very stupid bug in one of my packages. I had a duplicated user in vault/users with two identical .pem files with different filenames (the username was misspelled in one).

The result was that the user got "access denied" for the secret he wanted to access, despite the secret being correctly shared with him. Obviously this was my mistake, but it was pretty hard to debug. I think it would be cool if secret:::lookup_user() issued a warning (or threw an error?) on duplicate key files in /users

gaborcsardi commented 4 years ago

Good idea. Do you want to submit a PR?

s-fleck commented 4 years ago

Yes! sure! :) It would probably have slightly negative impact on performance because you would now have to read all keyfiles instead of stop on the first matching one.

gaborcsardi commented 4 years ago

I think that is fine. If somebody complains then we can make it optional.