Revert "Root encrypted data to kms encryption"

backend/src/server/app.ts

@@ -17,7 +17,7 @@ import { Knex } from "knex";
 
 import { HsmModule } from "@app/ee/services/hsm/hsm-types";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { getConfig, IS_PACKAGED, TEnvConfig } from "@app/lib/config/env";
+import { getConfig, IS_PACKAGED } from "@app/lib/config/env";
 import { CustomLogger } from "@app/lib/logger/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TQueueServiceFactory } from "@app/queue";
@@ -43,11 +43,10 @@ type TMain = {
   keyStore: TKeyStoreFactory;
   hsmModule: HsmModule;
   redis: Redis;
-  envConfig: TEnvConfig;
 };
 
 // Run the server!
-export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, keyStore, redis, envConfig }: TMain) => {
+export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, keyStore, redis }: TMain) => {
   const appCfg = getConfig();
 
   const server = fastify({
@@ -128,7 +127,7 @@ export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, key
       })
     });
 
-    await server.register(registerRoutes, { smtp, queue, db, auditLogDb, keyStore, hsmModule, envConfig });
+    await server.register(registerRoutes, { smtp, queue, db, auditLogDb, keyStore, hsmModule });
 
     await server.register(registerServeUI, {
       standaloneMode: appCfg.STANDALONE_MODE || IS_PACKAGED,

backend/src/server/routes/index.ts

@@ -85,7 +85,7 @@ import { sshCertificateTemplateServiceFactory } from "@app/ee/services/ssh-certi
 import { trustedIpDALFactory } from "@app/ee/services/trusted-ip/trusted-ip-dal";
 import { trustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { getConfig, TEnvConfig } from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { TQueueServiceFactory } from "@app/queue";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { accessTokenQueueServiceFactory } from "@app/services/access-token-queue/access-token-queue";
@@ -244,8 +244,7 @@ export const registerRoutes = async (
     hsmModule,
     smtp: smtpService,
     queue: queueService,
-    keyStore,
-    envConfig
+    keyStore
   }: {
     auditLogDb?: Knex;
     db: Knex;
@@ -253,7 +252,6 @@ export const registerRoutes = async (
     smtp: TSmtpService;
     queue: TQueueServiceFactory;
     keyStore: TKeyStoreFactory;
-    envConfig: TEnvConfig;
   }
 ) => {
   const appCfg = getConfig();
@@ -393,8 +391,7 @@ export const registerRoutes = async (
   const licenseService = licenseServiceFactory({ permissionService, orgDAL, licenseDAL, keyStore });
 
   const hsmService = hsmServiceFactory({
-    hsmModule,
-    envConfig
+    hsmModule
   });
 
   const kmsService = kmsServiceFactory({
@@ -404,8 +401,7 @@ export const registerRoutes = async (
     internalKmsDAL,
     orgDAL,
     projectDAL,
-    hsmService,
-    envConfig
+    hsmService
   });
 
   const externalKmsService = externalKmsServiceFactory({
@@ -451,6 +447,7 @@ export const registerRoutes = async (
   const samlService = samlConfigServiceFactory({
     identityMetadataDAL,
     permissionService,
+    orgBotDAL,
     orgDAL,
     orgMembershipDAL,
     userDAL,
@@ -458,8 +455,7 @@ export const registerRoutes = async (
     samlConfigDAL,
     licenseService,
     tokenService,
-    smtpService,
-    kmsService
+    smtpService
   });
   const groupService = groupServiceFactory({
     userDAL,
@@ -510,6 +506,7 @@ export const registerRoutes = async (
     ldapGroupMapDAL,
     orgDAL,
     orgMembershipDAL,
+    orgBotDAL,
     groupDAL,
     groupProjectDAL,
     projectKeyDAL,
@@ -521,8 +518,7 @@ export const registerRoutes = async (
     permissionService,
     licenseService,
     tokenService,
-    smtpService,
-    kmsService
+    smtpService
   });
 
   const telemetryService = telemetryServiceFactory({
@@ -973,8 +969,7 @@ export const registerRoutes = async (
     permissionService,
     webhookDAL,
     projectEnvDAL,
-    projectDAL,
-    kmsService
+    projectDAL
   });
 
   const secretTagService = secretTagServiceFactory({ secretTagDAL, permissionService });
@@ -1154,8 +1149,7 @@ export const registerRoutes = async (
     secretDAL,
     folderDAL,
     projectBotService,
-    secretV2BridgeDAL,
-    kmsService
+    secretV2BridgeDAL
   });
 
   const integrationService = integrationServiceFactory({
@@ -1244,9 +1238,9 @@ export const registerRoutes = async (
     identityKubernetesAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
+    orgBotDAL,
     permissionService,
-    licenseService,
-    kmsService
+    licenseService
   });
   const identityGcpAuthService = identityGcpAuthServiceFactory({
     identityGcpAuthDAL,
@@ -1278,7 +1272,7 @@ export const registerRoutes = async (
     identityAccessTokenDAL,
     permissionService,
     licenseService,
-    kmsService
+    orgBotDAL
   });
 
   const identityJwtAuthService = identityJwtAuthServiceFactory({
@@ -1295,9 +1289,7 @@ export const registerRoutes = async (
     queueService,
     dynamicSecretLeaseDAL,
     dynamicSecretProviders,
-    dynamicSecretDAL,
-    folderDAL,
-    kmsService
+    dynamicSecretDAL
   });
   const dynamicSecretService = dynamicSecretServiceFactory({
     projectDAL,
@@ -1307,8 +1299,7 @@ export const registerRoutes = async (
     dynamicSecretProviders,
     folderDAL,
     permissionService,
-    licenseService,
-    kmsService
+    licenseService
   });
   const dynamicSecretLeaseService = dynamicSecretLeaseServiceFactory({
     projectDAL,
@@ -1318,8 +1309,7 @@ export const registerRoutes = async (
     dynamicSecretLeaseDAL,
     dynamicSecretProviders,
     folderDAL,
-    licenseService,
-    kmsService
+    licenseService
   });
   const dailyResourceCleanUp = dailyResourceCleanUpQueueServiceFactory({
     auditLogDAL,
@@ -1347,7 +1337,7 @@ export const registerRoutes = async (
     licenseService,
     tokenService,
     smtpService,
-    kmsService,
+    orgBotDAL,
     permissionService,
     oidcConfigDAL,
     projectBotDAL,

backend/src/server/routes/sanitizedSchema/directory-config.ts

@@ -1,42 +0,0 @@
-import { LdapConfigsSchema, OidcConfigsSchema, SamlConfigsSchema } from "@app/db/schemas";
-
-export const SanitizedSamlConfigSchema = SamlConfigsSchema.pick({
-  id: true,
-  orgId: true,
-  isActive: true,
-  lastUsed: true,
-  createdAt: true,
-  updatedAt: true,
-  authProvider: true
-});
-
-export const SanitizedLdapConfigSchema = LdapConfigsSchema.pick({
-  updatedAt: true,
-  createdAt: true,
-  isActive: true,
-  orgId: true,
-  id: true,
-  url: true,
-  searchBase: true,
-  searchFilter: true,
-  groupSearchBase: true,
-  uniqueUserAttribute: true,
-  groupSearchFilter: true
-});
-
-export const SanitizedOidcConfigSchema = OidcConfigsSchema.pick({
-  id: true,
-  orgId: true,
-  isActive: true,
-  createdAt: true,
-  updatedAt: true,
-  lastUsed: true,
-  issuer: true,
-  jwksUri: true,
-  discoveryURL: true,
-  tokenEndpoint: true,
-  userinfoEndpoint: true,
-  configurationType: true,
-  allowedEmailDomains: true,
-  authorizationEndpoint: true
-});

backend/src/server/routes/sanitizedSchemas.ts

@@ -11,7 +11,7 @@ import {
 } from "@app/db/schemas";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 
-import { UnpackedPermissionSchema } from "./sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "./santizedSchemas/permission";
 
 // sometimes the return data must be santizied to avoid leaking important values
 // always prefer pick over omit in zod
@@ -201,11 +201,10 @@ export const SanitizedRoleSchemaV1 = ProjectRolesSchema.extend({
 });
 
 export const SanitizedDynamicSecretSchema = DynamicSecretsSchema.omit({
-  encryptedInput: true,
-  keyEncoding: true,
-  inputCiphertext: true,
   inputIV: true,
   inputTag: true,
+  inputCiphertext: true,
+  keyEncoding: true,
   algorithm: true
 });
 

backend/src/server/routes/v1/identity-kubernetes-auth-router.ts

@@ -8,19 +8,13 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
 
-const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.pick({
-  id: true,
-  accessTokenTTL: true,
-  accessTokenMaxTTL: true,
-  accessTokenNumUsesLimit: true,
-  accessTokenTrustedIps: true,
-  createdAt: true,
-  updatedAt: true,
-  identityId: true,
-  kubernetesHost: true,
-  allowedNamespaces: true,
-  allowedNames: true,
-  allowedAudience: true
+const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.omit({
+  encryptedCaCert: true,
+  caCertIV: true,
+  caCertTag: true,
+  encryptedTokenReviewerJwt: true,
+  tokenReviewerJwtIV: true,
+  tokenReviewerJwtTag: true
 }).extend({
   caCert: z.string(),
   tokenReviewerJwt: z.string()

backend/src/server/routes/v1/identity-oidc-auth-router.ts

@@ -12,20 +12,10 @@ import {
   validateOidcBoundClaimsField
 } from "@app/services/identity-oidc-auth/identity-oidc-auth-validators";
 
-const IdentityOidcAuthResponseSchema = IdentityOidcAuthsSchema.pick({
-  id: true,
-  accessTokenTTL: true,
-  accessTokenMaxTTL: true,
-  accessTokenNumUsesLimit: true,
-  accessTokenTrustedIps: true,
-  identityId: true,
-  oidcDiscoveryUrl: true,
-  boundIssuer: true,
-  boundAudiences: true,
-  boundClaims: true,
-  boundSubject: true,
-  createdAt: true,
-  updatedAt: true
+const IdentityOidcAuthResponseSchema = IdentityOidcAuthsSchema.omit({
+  encryptedCaCert: true,
+  caCertIV: true,
+  caCertTag: true
 }).extend({
   caCert: z.string()
 });