feat: use hash as pw & move to symmetric encrpytion

backend/src/db/migrations/20240528190137_secret_sharing.ts

@@ -8,7 +8,10 @@ export async function up(knex: Knex): Promise<void> {
     await knex.schema.createTable(TableName.SecretSharing, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.string("name").notNullable();
-      t.text("signedValue").notNullable();
+      t.text("encryptedValue").notNullable();
+      t.text("iv").notNullable();
+      t.text("tag").notNullable();
+      t.text("hashedHex").notNullable();
       t.timestamp("expiresAt").notNullable();
       t.uuid("userId").notNullable();
       t.uuid("orgId").notNullable();

backend/src/db/schemas/secret-sharing.ts

@@ -10,7 +10,10 @@ import { TImmutableDBKeys } from "./models";
 export const SecretSharingSchema = z.object({
   id: z.string().uuid(),
   name: z.string(),
-  signedValue: z.string(),
+  encryptedValue: z.string(),
+  iv: z.string(),
+  tag: z.string(),
+  hashedHex: z.string(),
   expiresAt: z.date(),
   userId: z.string().uuid(),
   orgId: z.string().uuid(),

backend/src/server/routes/v1/secret-sharing-router.ts

@@ -41,16 +41,24 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
       params: z.object({
         id: z.string().uuid()
       }),
+      querystring: z.object({
+        hashedHex: z.string()
+      }),
       response: {
-        200: SecretSharingSchema.pick({ name: true, signedValue: true, expiresAt: true })
+        200: SecretSharingSchema.pick({ name: true, encryptedValue: true, iv: true, tag: true, expiresAt: true })
       }
     },
     handler: async (req) => {
-      const sharedSecret = await req.server.services.secretSharing.getActiveSharedSecretById(req.params.id);
+      const sharedSecret = await req.server.services.secretSharing.getActiveSharedSecretByIdAndHashedHex(
+        req.params.id,
+        req.query.hashedHex
+      );
       if (!sharedSecret) return undefined;
       return {
         name: sharedSecret.name,
-        signedValue: sharedSecret.signedValue,
+        encryptedValue: sharedSecret.encryptedValue,
+        iv: sharedSecret.iv,
+        tag: sharedSecret.tag,
         expiresAt: sharedSecret.expiresAt
       };
     }
@@ -65,7 +73,10 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
     schema: {
       body: z.object({
         name: z.string(),
-        signedValue: z.string(),
+        encryptedValue: z.string(),
+        iv: z.string(),
+        tag: z.string(),
+        hashedHex: z.string(),
         expiresAt: z.string().refine((date) => new Date(date) > new Date(), {
           message: "Expires at should be a future date"
         })
@@ -78,7 +89,7 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const { name, signedValue, expiresAt } = req.body;
+      const { name, encryptedValue, iv, tag, hashedHex, expiresAt } = req.body;
       const sharedSecret = await req.server.services.secretSharing.createSharedSecret({
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -86,7 +97,10 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
         name,
-        signedValue,
+        encryptedValue,
+        iv,
+        tag,
+        hashedHex,
         expiresAt: new Date(expiresAt)
       });
       return { id: sharedSecret.id };

backend/src/services/secret-sharing/secret-sharing-service.ts

@@ -16,13 +16,16 @@ export const secretSharingServiceFactory = ({
   secretSharingDAL
 }: TSecretSharingServiceFactoryDep) => {
   const createSharedSecret = async (createSharedSecretInput: TCreateSharedSecretDTO) => {
-    const { actor, actorId, orgId, actorAuthMethod, actorOrgId, name, signedValue, expiresAt } =
+    const { actor, actorId, orgId, actorAuthMethod, actorOrgId, name, encryptedValue, iv, tag, hashedHex, expiresAt } =
       createSharedSecretInput;
     const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
     if (!permission) throw new UnauthorizedError({ name: "User not in org" });
     const newSharedSecret = await secretSharingDAL.create({
       name,
-      signedValue,
+      encryptedValue,
+      iv,
+      tag,
+      hashedHex,
       expiresAt,
       userId: actorId,
       orgId
@@ -38,8 +41,8 @@ export const secretSharingServiceFactory = ({
     return userSharedSecrets;
   };
 
-  const getActiveSharedSecretById = async (sharedSecretId: string) => {
-    const sharedSecret = await secretSharingDAL.findById(sharedSecretId);
+  const getActiveSharedSecretByIdAndHashedHex = async (sharedSecretId: string, hashedHex: string) => {
+    const sharedSecret = await secretSharingDAL.findOne({ id: sharedSecretId, hashedHex });
     if (sharedSecret && sharedSecret.expiresAt < new Date()) {
       return;
     }
@@ -58,6 +61,6 @@ export const secretSharingServiceFactory = ({
     createSharedSecret,
     getSharedSecrets,
     deleteSharedSecretById,
-    getActiveSharedSecretById
+    getActiveSharedSecretByIdAndHashedHex
   };
 };

backend/src/services/secret-sharing/secret-sharing-types.ts

@@ -10,7 +10,10 @@ export type TSharedSecretPermission = {
 
 export type TCreateSharedSecretDTO = {
   name: string;
-  signedValue: string;
+  encryptedValue: string;
+  iv: string;
+  tag: string;
+  hashedHex: string;
   expiresAt: Date;
 } & TSharedSecretPermission;