feat(cli): Unsafe update key cli

otdfctl/cmd/policy/kasKeys.go

@@ -406,6 +406,68 @@ func policyUpdateKasKey(cmd *cobra.Command, args []string) {
 	common.HandleSuccess(cmd, kasKey.GetKey().GetId(), t, kasKey)
 }
 
+func unsafeUpdateKasKeyMode(modeArg string) (policy.KeyMode, error) {
+	if modeArg == "" {
+		return policy.KeyMode_KEY_MODE_UNSPECIFIED, nil
+	}
+
+	mode, err := modeToEnum(modeArg)
+	if err != nil {
+		return policy.KeyMode_KEY_MODE_UNSPECIFIED, err
+	}
+
+	switch mode { //nolint:exhaustive // only remote and public_key are supported for unsafe update.
+	case policy.KeyMode_KEY_MODE_REMOTE, policy.KeyMode_KEY_MODE_PUBLIC_KEY_ONLY:
+		return mode, nil
+	default:
+		return policy.KeyMode_KEY_MODE_UNSPECIFIED, fmt.Errorf("mode must be %q or %q", keyModeRemote, keyModePublicKeyOnly)
+	}
+}
+
+func policyUnsafeUpdateKasKey(cmd *cobra.Command, args []string) {
+	c := cli.New(cmd, args)
+
+	id := c.Flags.GetRequiredID("id")
+	modeArg := c.Flags.GetOptionalString("mode")
+	providerConfigID := c.Flags.GetOptionalID("provider-config-id")
+	force := c.Flags.GetOptionalBool("force")
+
+	mode, err := unsafeUpdateKasKeyMode(modeArg)
+	if err != nil {
+		cli.ExitWithError("Invalid key mode", err)
+	}
+
+	h := common.NewHandler(c)
+	defer h.Close()
+
+	existingKasKey, err := h.GetKasKey(c.Context(), id, nil)
+	if err != nil {
+		cli.ExitWithError("Failed to get kas key", err)
+	}
+
+	existingKey := existingKasKey.GetKey()
+	confirmID := fmt.Sprintf("Id: %s\n\tKAS URI: %s\n\tKID: %s", existingKey.GetId(), existingKasKey.GetKasUri(), existingKey.GetKeyId())
+	cli.ConfirmAction(cli.ActionUpdateUnsafe, "key", confirmID, force)
+	if !force {
+		input := cli.AskForInput(fmt.Sprintf("To confirm you want to %s this key and accept any side effects, please enter the KID to proceed: %s", cli.ActionUpdateUnsafe, existingKey.GetKeyId()))
+		if input != existingKey.GetKeyId() {
+			cli.ExitWithError("Confirmation prompt failed", fmt.Errorf("entered KID [%s] does not match required KID: %s", input, existingKey.GetKeyId()))
+		}
+	}
+
+	kasKey, err := h.UnsafeUpdateKasKey(c.Context(), id, mode, providerConfigID)
+	if err != nil {
+		cli.ExitWithError("Failed to update kas key", err)
+	}
+
+	rows := getTableRows(kasKey)
+	if mdRows := getMetadataRows(kasKey.GetKey().GetMetadata()); mdRows != nil {
+		rows = append(rows, mdRows...)
+	}
+	t := cli.NewTabular(rows...)
+	common.HandleSuccess(cmd, kasKey.GetKey().GetId(), t, kasKey)
+}
+
 func policyListKasKeys(cmd *cobra.Command, args []string) {
 	c := cli.New(cmd, args)
 	h := common.NewHandler(c)
@@ -1137,7 +1199,30 @@ func initKASKeysCommands() {
 		unsafeDeleteDoc.GetDocFlag("kas-uri").Description,
 	)
 
-	unsafeCmd.AddSubcommands(unsafeDeleteDoc)
+	unsafeUpdateDoc := man.Docs.GetCommand(
+		"policy/kas-registry/key/unsafe/update",
+		man.WithRun(policyUnsafeUpdateKasKey),
+	)
+	unsafeUpdateDoc.Flags().StringP(
+		unsafeUpdateDoc.GetDocFlag("id").Name,
+		unsafeUpdateDoc.GetDocFlag("id").Shorthand,
+		unsafeUpdateDoc.GetDocFlag("id").Default,
+		unsafeUpdateDoc.GetDocFlag("id").Description,
+	)
+	unsafeUpdateDoc.Flags().StringP(
+		unsafeUpdateDoc.GetDocFlag("mode").Name,
+		unsafeUpdateDoc.GetDocFlag("mode").Shorthand,
+		unsafeUpdateDoc.GetDocFlag("mode").Default,
+		unsafeUpdateDoc.GetDocFlag("mode").Description,
+	)
+	unsafeUpdateDoc.Flags().StringP(
+		unsafeUpdateDoc.GetDocFlag("provider-config-id").Name,
+		unsafeUpdateDoc.GetDocFlag("provider-config-id").Shorthand,
+		unsafeUpdateDoc.GetDocFlag("provider-config-id").Default,
+		unsafeUpdateDoc.GetDocFlag("provider-config-id").Description,
+	)
+
+	unsafeCmd.AddSubcommands(unsafeDeleteDoc, unsafeUpdateDoc)
 	policyKasRegistryKeysCmd.AddSubcommands(createDoc, getDoc, updateDoc, listDoc, rotateDoc, importDoc, mappingsDoc, unsafeCmd)
 	KasRegistryCmd.AddCommand(&policyKasRegistryKeysCmd.Command)
 }

otdfctl/docs/man/policy/kas-registry/key/unsafe/delete.md

@@ -24,5 +24,5 @@ Make sure you know what you are doing.
 ## Example
 
 ```shell
-otdfctl policy kas-keys unsafe delete --id 3c51a593-cbf8-419d-b7dc-b656d0bedfbb --kas-uri https://kas.example.com --key-id "key-1"
+otdfctl policy kas-registry key unsafe delete --id 3c51a593-cbf8-419d-b7dc-b656d0bedfbb --kas-uri https://kas.example.com --key-id "key-1"
 ```

otdfctl/docs/man/policy/kas-registry/key/unsafe/update.md

@@ -0,0 +1,45 @@
+---
+title: Unsafely update a key
+command:
+  name: update
+  flags:
+    - name: id
+      shorthand: i
+      description: System-given ID of the key to update.
+      required: true
+    - name: mode
+      shorthand: m
+      description: Target key mode. Only "remote" and "public_key" are supported.
+    - name: provider-config-id
+      shorthand: p
+      description: Configuration ID for the key provider. Required when changing to "remote" mode, or when updating only the provider configuration for an existing remote key.
+---
+
+# Unsafe Update Warning
+
+Updating a key in place is a dangerous support operation. It can retroactively change decryptability for existing TDFs.
+
+This command is limited to switching a key between `remote` and `public_key` modes, or updating the provider configuration
+for an existing `remote` key. The key ID, KAS URI, and public key are preserved.
+
+Make sure you know what you are doing.
+
+## Examples
+
+Change a public key-only key to remote mode:
+
+```shell
+otdfctl policy kas-registry key unsafe update --id 3c51a593-cbf8-419d-b7dc-b656d0bedfbb --mode remote --provider-config-id 298c9446-ef71-49eb-a6ef-960149095a76
+```
+
+Change a remote key to public key-only mode:
+
+```shell
+otdfctl policy kas-registry key unsafe update --id 3c51a593-cbf8-419d-b7dc-b656d0bedfbb --mode public_key
+```
+
+Update only the provider configuration for an existing remote key:
+
+```shell
+otdfctl policy kas-registry key unsafe update --id 3c51a593-cbf8-419d-b7dc-b656d0bedfbb --provider-config-id 298c9446-ef71-49eb-a6ef-960149095a76
+```