feat: add cache abstraction for fetching signing keys (#14777)

- Adds the database implementation for fetching and caching keys
used for JWT signing. It's been merged into the `keyrotate` pkg and
renamed to `cryptokeys` since they're coupled concepts.

coderd/database/db2sdk/db2sdk.go

@@ -659,3 +659,17 @@ func Organization(organization database.Organization) codersdk.Organization {
 		IsDefault:   organization.IsDefault,
 	}
 }
+
+func CryptoKeys(keys []database.CryptoKey) []codersdk.CryptoKey {
+	return List(keys, CryptoKey)
+}
+
+func CryptoKey(key database.CryptoKey) codersdk.CryptoKey {
+	return codersdk.CryptoKey{
+		Feature:   codersdk.CryptoKeyFeature(key.Feature),
+		Sequence:  key.Sequence,
+		StartsAt:  key.StartsAt,
+		DeletesAt: key.DeletesAt.Time,
+		Secret:    key.Secret.String,
+	}
+}

coderd/database/dbgen/dbgen.go

@@ -920,7 +920,7 @@ func CryptoKey(t testing.TB, db database.Store, seed database.CryptoKey) databas
 		Secret:      seed.Secret,
 		SecretKeyID: takeFirst(seed.SecretKeyID, sql.NullString{}),
 		Feature:     seed.Feature,
-		StartsAt:    takeFirst(seed.StartsAt, time.Now()),
+		StartsAt:    takeFirst(seed.StartsAt, dbtime.Now()),
 	})
 	require.NoError(t, err, "insert crypto key")
 

coderd/database/modelmethods.go

@@ -1,6 +1,7 @@
 package database
 
 import (
+	"encoding/hex"
 	"sort"
 	"strconv"
 	"time"
@@ -451,3 +452,18 @@ func (r GetAuthorizationUserRolesRow) RoleNames() ([]rbac.RoleIdentifier, error)
 func (k CryptoKey) ExpiresAt(keyDuration time.Duration) time.Time {
 	return k.StartsAt.Add(keyDuration).UTC()
 }
+
+func (k CryptoKey) DecodeString() ([]byte, error) {
+	return hex.DecodeString(k.Secret.String)
+}
+
+func (k CryptoKey) CanSign(now time.Time) bool {
+	isAfterStart := !k.StartsAt.IsZero() && !now.Before(k.StartsAt)
+	return isAfterStart && k.CanVerify(now)
+}
+
+func (k CryptoKey) CanVerify(now time.Time) bool {
+	hasSecret := k.Secret.Valid
+	isBeforeDeletion := !k.DeletesAt.Valid || now.Before(k.DeletesAt.Time)
+	return hasSecret && isBeforeDeletion
+}