[🚀 | Feature request]: Port: Sequester

[mmmarcos]

Sequester service must be ported to the V3 branch (master).

Brief description

The sequester service allows to recover an organization's entire data set. It can only be activated when the organization is created (the authority key is signed with the organization root secret key).

The typical use case for this service: an investigation is carried out by an inspection service requiring access to data stored on the workspaces of the person(s) involved in the investigation. Note that the secret parts of both authority and service keys are only used in an off-line mode (i.e. no direct communication with the Parsec server is required), so that they can be stored in a secure location and the environment in which they are used can be controlled as much as possible.

V2 Implementation

• Sequester feature #2462 (meta-issue)
• RFCs:
  • https://github.com/Scille/parsec-cloud/blob/master/docs/rfcs/old/0021-sequester-realm-extract-file-format.md
  • https://github.com/Scille/parsec-cloud/blob/master/docs/rfcs/old/0022-sequester-encryption-signing-key-formats.md
  • https://github.com/Scille/parsec-cloud/blob/master/docs/rfcs/old/0023-sequester-protocol-data-api-evolutions.md
  • https://github.com/Scille/parsec-cloud/blob/master/docs/rfcs/old/0024-sequester-realmextract-creation-cli.md
  • https://github.com/Scille/parsec-cloud/blob/master/docs/rfcs/old/0025-sequester-client-synchro-evolutions.md

User documentation is missing (see #2477), but there are some Resana-Secure documents explaining how to use it (ask @Landeers).

V3

Task List:

• Sequester: RFC porting to V3 #8665

Related open issues (needs re-triage):

• [Sequester] User documentation #2477
• Handle sequestered organization in CLI during bootstrap-organization #5930
• Create KEYS_BUNDLE_ACCESS for sequester services #6645
• Implement Sequester CLI in server #6258
• Test Sequester webhook in server #6259
• RFC for new sequester revok service certificate #6260
• [🚀 | Feature request]: Show if organization has sequestered mode enabled #6825

[mmmarcos]

I've reopened this issue because #6644 does not fully port Sequester feature.

There is still ongoing work (#9342 #9343) and API version is yet to be bumped.