Complete v1 API reference docs, pre-launch

docs/api-reference/overview/examples/create-secrets.mdx

@@ -13,52 +13,140 @@ Prerequisites:
 
 1. Get your (encrypted) private key.
 2. Decrypt your (encrypted) private key with your password.
-3. Get the project key for the project.
-4. Decrypt the project key with your private key.
-5. Encrypt your secrets with the project key.
-6. Send (encrypted) secrets to the Infical API
+3. Get the (encrypted) project key for the project.
+4. Decrypt the (encrypted) project key with your private key.
+5. Encrypt your secret(s) with the project key.
+6. Send (encrypted) secret(s) to the Infical API
 
 ## Example
 
 ```js
-const axios = require("axios");
-const aes = require("aes-256-gcm");
-const nacl = require("tweetnacl");
-nacl.util = require("tweetnacl-util");
+const crypto = require('crypto');
+const axios = require('axios');
 
-const WORKSPACE_KEY = "3a7a243eb62078c13f09203e75e8cb32";
+const ALGORITHM = 'aes-256-gcm';
+const BLOCK_SIZE_BYTES = 16;
 
-const secretKey = "SOME_KEY";
-const secretValue = "SOME_VALUE";
+const encrypt = (
+	text,
+	secret
+) => {
+	const iv = crypto.randomBytes(BLOCK_SIZE_BYTES);
+	const cipher = crypto.createCipheriv(ALGORITHM, secret, iv);
 
-// encrypt key of secret
-const {
-  ciphertext: secretKeyCiphertext,
-  iv: secretKeyIV,
-  tag: secretKeyTag,
-} = aes.encrypt(secretKey, WORKSPACE_KEY);
+	let ciphertext = cipher.update(text, 'utf8', 'base64');
+	ciphertext += cipher.final('base64');
+	return {
+		ciphertext,
+		iv: iv.toString('base64'),
+		tag: cipher.getAuthTag().toString('base64')
+	};
+}
 
-// encrypt value of secret
-const {
-  ciphertext: secretValueCiphertext,
-  iv: secretValueIV,
-  tag: secretValueTag,
-} = aes.encrypt(secretKey, WORKSPACE_KEY);
+const decrypt = (ciphertext, iv, tag, secret) => {
+	const decipher = crypto.createDecipheriv(
+		ALGORITHM,
+		secret,
+		Buffer.from(iv, 'base64')
+	);
+	decipher.setAuthTag(Buffer.from(tag, 'base64'));
 
-// construct request body
-const secret = {
-  secretKeyCiphertext,
-  secretKeyIV,
-  secretKeyTag,
-  secretValueCiphertext,
-  secretValueIV,
-  secretValueTag,
-};
+	let cleartext = decipher.update(ciphertext, 'base64', 'utf8');
+	cleartext += decipher.final('utf8');
+
+	return cleartext;
+}
+
+const createSecrets = async () => {
+	const API_KEY = 'your_api_key';
+	const PSWD = 'your_pswd';
+	const WORKSPACE_ID = 'your_workspace_id';
+
+	const SECRET_KEY = 'SOME_KEY';
+    const SECRET_VALUE = 'SOME_VALUE';
+
+	// 1. get (encrypted) private key
+	const user = await axios.get(
+		'https://api.infisical.com/api/v2/users/me', {
+			headers: {
+				'X-API-KEY': API_KEY
+			}
+		}
+	);
+
+	// 2. decrypt your (encrypted) private key with your password
+	const privateKey = decrypt({
+		ciphertext: user.encryptedPrivateKey,
+		iv: user.iv,
+		tag: user.tag,
+		secret: PSWD.slice(0, 32).padStart(32, '0');
+	});
+
+	// 3. get the (encrypted) project key for the project
+	const encryptedProjectKey = await axios.get(
+		`https://api.infisical.com/api/v2/workspace/${WORKSPACE_ID}`, {
+			headers: {
+				'X-API-KEY': API_KEY
+			}
+		}
+	);
+
+	// 4. decrypt the project key with your private key
+	const projectKey = nacl.box.open(
+		util.decodeBase64(encryptedProjectKey),
+		util.decodeBase64(projectKey.nonce),
+		util.decodeBase64(projectKey.sender.publicKey),
+		util.decodeBase64(privateKey)
+	);
+
+	// 5. encrypt your secret(s) with the project key
+	const {
+		ciphertext: secretKeyCiphertext,
+		iv: secretKeyIV,
+		tag: secretKeyTag
+	} = encrypt(SECRET_KEY, projectKey);
+
+	const {
+		ciphertext: secretValueCiphertext,
+		iv: secretValueIV,
+		tag: secretValueTag
+	} = encrypt(SECRET_VALUE, projectKey);
+
+	const secret = {
+		secretKeyCiphertext,
+		secretKeyIV,
+		secretKeyTag,
+		secretValueCiphertext,
+		secretValueIV,
+		secretValueTag
+	}
+
+	// 6. Send (encrypted) secret(s) to the Infisical API
+	await axios.post(
+		`https://api.infisical.com/api/v2/secrets`,
+		{
+			workspaceId: WORKSPACE_ID,
+			environment: 'dev',
+			secrets: secret
+		},
+		{
+			headers: {
+				'X-API-KEY': API_KEY
+			}
+		}
+	);
+}
+
+createSecrets();
 ```
 
 <Info>
   This example uses [TweetNaCl.js](https://tweetnacl.js.org/#/), a port of
   TweetNacl/Nacl, to perform asymmeric decryption of the project key but there
-  are ports of NaCl in every major language.
-
+  are ports of NaCl available in every major language.
 </Info>
+<Tip>
+  It can be useful to perform steps 1-4 ahead of time and store away your
+  private key (and even project key) for later use. The Infisical CLI works by
+  securely storing your private key via your OS keyring.
+</Tip>