Revert "Root encrypted data to kms encryption"

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -1,15 +1,29 @@
 import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
 
-import { OrgMembershipStatus, TableName, TSamlConfigs, TSamlConfigsUpdate, TUsers } from "@app/db/schemas";
+import {
+  OrgMembershipStatus,
+  SecretKeyEncoding,
+  TableName,
+  TSamlConfigs,
+  TSamlConfigsUpdate,
+  TUsers
+} from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
+import {
+  decryptSymmetric,
+  encryptSymmetric,
+  generateAsymmetricKeyPair,
+  generateSymmetricKey,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { AuthTokenType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
 import { TIdentityMetadataDALFactory } from "@app/services/identity/identity-metadata-dal";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { getDefaultOrgMembershipRole } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
@@ -38,19 +52,21 @@ type TSamlConfigServiceFactoryDep = {
     TOrgDALFactory,
     "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById" | "findOne" | "updateById"
   >;
+
   identityMetadataDAL: Pick<TIdentityMetadataDALFactory, "delete" | "insertMany" | "transaction">;
   orgMembershipDAL: Pick<TOrgMembershipDALFactory, "create">;
+  orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "create" | "transaction">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
   tokenService: Pick<TAuthTokenServiceFactory, "createTokenForUser">;
   smtpService: Pick<TSmtpService, "sendMail">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TSamlConfigServiceFactory = ReturnType<typeof samlConfigServiceFactory>;
 
 export const samlConfigServiceFactory = ({
   samlConfigDAL,
+  orgBotDAL,
   orgDAL,
   orgMembershipDAL,
   userDAL,
@@ -59,8 +75,7 @@ export const samlConfigServiceFactory = ({
   licenseService,
   tokenService,
   smtpService,
-  identityMetadataDAL,
-  kmsService
+  identityMetadataDAL
 }: TSamlConfigServiceFactoryDep) => {
   const createSamlCfg = async ({
     cert,
@@ -84,18 +99,70 @@ export const samlConfigServiceFactory = ({
           "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
       });
 
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+    const orgBot = await orgBotDAL.transaction(async (tx) => {
+      const doc = await orgBotDAL.findOne({ orgId }, tx);
+      if (doc) return doc;
+
+      const { privateKey, publicKey } = generateAsymmetricKeyPair();
+      const key = generateSymmetricKey();
+      const {
+        ciphertext: encryptedPrivateKey,
+        iv: privateKeyIV,
+        tag: privateKeyTag,
+        encoding: privateKeyKeyEncoding,
+        algorithm: privateKeyAlgorithm
+      } = infisicalSymmetricEncypt(privateKey);
+      const {
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        encoding: symmetricKeyKeyEncoding,
+        algorithm: symmetricKeyAlgorithm
+      } = infisicalSymmetricEncypt(key);
+
+      return orgBotDAL.create(
+        {
+          name: "Infisical org bot",
+          publicKey,
+          privateKeyIV,
+          encryptedPrivateKey,
+          symmetricKeyIV,
+          symmetricKeyTag,
+          encryptedSymmetricKey,
+          symmetricKeyAlgorithm,
+          orgId,
+          privateKeyTag,
+          privateKeyAlgorithm,
+          privateKeyKeyEncoding,
+          symmetricKeyKeyEncoding
+        },
+        tx
+      );
     });
 
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    const { ciphertext: encryptedEntryPoint, iv: entryPointIV, tag: entryPointTag } = encryptSymmetric(entryPoint, key);
+    const { ciphertext: encryptedIssuer, iv: issuerIV, tag: issuerTag } = encryptSymmetric(issuer, key);
+    const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
     const samlConfig = await samlConfigDAL.create({
       orgId,
       authProvider,
       isActive,
-      encryptedSamlIssuer: encryptor({ plainText: Buffer.from(issuer) }).cipherTextBlob,
-      encryptedSamlEntryPoint: encryptor({ plainText: Buffer.from(entryPoint) }).cipherTextBlob,
-      encryptedSamlCertificate: encryptor({ plainText: Buffer.from(cert) }).cipherTextBlob
+      encryptedEntryPoint,
+      entryPointIV,
+      entryPointTag,
+      encryptedIssuer,
+      issuerIV,
+      issuerTag,
+      encryptedCert,
+      certIV,
+      certTag
     });
 
     return samlConfig;
@@ -123,21 +190,40 @@ export const samlConfigServiceFactory = ({
       });
 
     const updateQuery: TSamlConfigsUpdate = { authProvider, isActive, lastUsed: null };
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+    const orgBot = await orgBotDAL.findOne({ orgId });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot not found for organization with ID '${orgId}'`,
+        name: "OrgBotNotFound"
+      });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
     if (entryPoint !== undefined) {
-      updateQuery.encryptedSamlEntryPoint = encryptor({ plainText: Buffer.from(entryPoint) }).cipherTextBlob;
+      const {
+        ciphertext: encryptedEntryPoint,
+        iv: entryPointIV,
+        tag: entryPointTag
+      } = encryptSymmetric(entryPoint, key);
+      updateQuery.encryptedEntryPoint = encryptedEntryPoint;
+      updateQuery.entryPointIV = entryPointIV;
+      updateQuery.entryPointTag = entryPointTag;
     }
-
     if (issuer !== undefined) {
-      updateQuery.encryptedSamlIssuer = encryptor({ plainText: Buffer.from(issuer) }).cipherTextBlob;
+      const { ciphertext: encryptedIssuer, iv: issuerIV, tag: issuerTag } = encryptSymmetric(issuer, key);
+      updateQuery.encryptedIssuer = encryptedIssuer;
+      updateQuery.issuerIV = issuerIV;
+      updateQuery.issuerTag = issuerTag;
     }
-
     if (cert !== undefined) {
-      updateQuery.encryptedSamlCertificate = encryptor({ plainText: Buffer.from(cert) }).cipherTextBlob;
+      const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
+      updateQuery.encryptedCert = encryptedCert;
+      updateQuery.certIV = certIV;
+      updateQuery.certTag = certTag;
     }
 
     const [ssoConfig] = await samlConfigDAL.update({ orgId }, updateQuery);
@@ -147,14 +233,14 @@ export const samlConfigServiceFactory = ({
   };
 
   const getSaml = async (dto: TGetSamlCfgDTO) => {
-    let samlConfig: TSamlConfigs | undefined;
+    let ssoConfig: TSamlConfigs | undefined;
     if (dto.type === "org") {
-      samlConfig = await samlConfigDAL.findOne({ orgId: dto.orgId });
-      if (!samlConfig) return;
+      ssoConfig = await samlConfigDAL.findOne({ orgId: dto.orgId });
+      if (!ssoConfig) return;
     } else if (dto.type === "orgSlug") {
       const org = await orgDAL.findOne({ slug: dto.orgSlug });
       if (!org) return;
-      samlConfig = await samlConfigDAL.findOne({ orgId: org.id });
+      ssoConfig = await samlConfigDAL.findOne({ orgId: org.id });
     } else if (dto.type === "ssoId") {
       // TODO:
       // We made this change because saml config ids were not moved over during the migration
@@ -173,51 +259,81 @@ export const samlConfigServiceFactory = ({
 
       const id = UUIDToMongoId[dto.id] ?? dto.id;
 
-      samlConfig = await samlConfigDAL.findById(id);
+      ssoConfig = await samlConfigDAL.findById(id);
     }
-    if (!samlConfig) throw new NotFoundError({ message: `Failed to find SSO data` });
+    if (!ssoConfig) throw new NotFoundError({ message: `Failed to find SSO data` });
 
     // when dto is type id means it's internally used
     if (dto.type === "org") {
       const { permission } = await permissionService.getOrgPermission(
         dto.actor,
         dto.actorId,
-        samlConfig.orgId,
+        ssoConfig.orgId,
         dto.actorAuthMethod,
         dto.actorOrgId
       );
       ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
     }
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: samlConfig.orgId
+    const {
+      entryPointTag,
+      entryPointIV,
+      encryptedEntryPoint,
+      certTag,
+      certIV,
+      encryptedCert,
+      issuerTag,
+      issuerIV,
+      encryptedIssuer
+    } = ssoConfig;
+
+    const orgBot = await orgBotDAL.findOne({ orgId: ssoConfig.orgId });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot not found in organization with ID '${ssoConfig.orgId}'`,
+        name: "OrgBotNotFound"
+      });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
     let entryPoint = "";
-    if (samlConfig.encryptedSamlEntryPoint) {
-      entryPoint = decryptor({ cipherTextBlob: samlConfig.encryptedSamlEntryPoint }).toString();
+    if (encryptedEntryPoint && entryPointIV && entryPointTag) {
+      entryPoint = decryptSymmetric({
+        ciphertext: encryptedEntryPoint,
+        key,
+        tag: entryPointTag,
+        iv: entryPointIV
+      });
     }
 
     let issuer = "";
-    if (samlConfig.encryptedSamlIssuer) {
-      issuer = decryptor({ cipherTextBlob: samlConfig.encryptedSamlIssuer }).toString();
+    if (encryptedIssuer && issuerTag && issuerIV) {
+      issuer = decryptSymmetric({
+        key,
+        tag: issuerTag,
+        iv: issuerIV,
+        ciphertext: encryptedIssuer
+      });
     }
 
     let cert = "";
-    if (samlConfig.encryptedSamlCertificate) {
-      cert = decryptor({ cipherTextBlob: samlConfig.encryptedSamlCertificate }).toString();
+    if (encryptedCert && certTag && certIV) {
+      cert = decryptSymmetric({ key, tag: certTag, iv: certIV, ciphertext: encryptedCert });
     }
 
     return {
-      id: samlConfig.id,
-      organization: samlConfig.orgId,
-      orgId: samlConfig.orgId,
-      authProvider: samlConfig.authProvider,
-      isActive: samlConfig.isActive,
+      id: ssoConfig.id,
+      organization: ssoConfig.orgId,
+      orgId: ssoConfig.orgId,
+      authProvider: ssoConfig.authProvider,
+      isActive: ssoConfig.isActive,
       entryPoint,
       issuer,
       cert,
-      lastUsed: samlConfig.lastUsed
+      lastUsed: ssoConfig.lastUsed
     };
   };