From 3483ed85ffde85f82e7352ae88140abfa369b6ee Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Tue, 15 Apr 2025 01:03:45 +0800 Subject: [PATCH 1/4] misc: add proper display of auth failure message oidc --- backend/src/ee/routes/v1/oidc-router.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/routes/v1/oidc-router.ts b/backend/src/ee/routes/v1/oidc-router.ts index df5c61fe4..66bced3df 100644 --- a/backend/src/ee/routes/v1/oidc-router.ts +++ b/backend/src/ee/routes/v1/oidc-router.ts @@ -136,11 +136,12 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => { url: "/login/error", method: "GET", handler: async (req, res) => { + const failureMessage = req.session.get("messages"); await req.session.destroy(); return res.status(500).send({ error: "Authentication error", - details: req.query + details: failureMessage ?? req.query }); } }); From f3078040fccf756e7f056765f75df0982b840a42 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:22:59 +0400 Subject: [PATCH 2/4] fix: improve kms key migration --- .../migrations/20250402000941_add-type-to-kms-keys.ts | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts index fd99938db..76114035f 100644 --- a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts +++ b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts @@ -5,15 +5,19 @@ import { KmsKeyUsage } from "@app/services/kms/kms-types"; import { TableName } from "../schemas"; export async function up(knex: Knex): Promise { - const hasTypeColumn = await knex.schema.hasColumn(TableName.KmsKey, "type"); + const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (!hasTypeColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); + if (!hasKeyUsageColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); }); } export async function down(knex: Knex): Promise { + const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); + await knex.schema.alterTable(TableName.KmsKey, (t) => { - t.dropColumn("keyUsage"); + if (hasKeyUsageColumn) { + t.dropColumn("keyUsage"); + } }); } From b9d74e0aedbb0e00715b6f3377e74be6f95a0a20 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:36:16 +0400 Subject: [PATCH 3/4] requested changes --- .../20250402000941_add-type-to-kms-keys.ts | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts index 76114035f..591c5f1ec 100644 --- a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts +++ b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts @@ -7,17 +7,19 @@ import { TableName } from "../schemas"; export async function up(knex: Knex): Promise { const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); - await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (!hasKeyUsageColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); - }); + if (!hasKeyUsageColumn) { + await knex.schema.alterTable(TableName.KmsKey, (t) => { + t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); + }); + } } export async function down(knex: Knex): Promise { const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); - await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (hasKeyUsageColumn) { + if (hasKeyUsageColumn) { + await knex.schema.alterTable(TableName.KmsKey, (t) => { t.dropColumn("keyUsage"); - } - }); + }); + } } From c0926bec6973681ee677689808c1ddf47bf04535 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:36:38 +0400 Subject: [PATCH 4/4] fix: no check for encryption algorithm on external KMS --- backend/src/services/kms/kms-service.ts | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 754c9be76..07ed90bef 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -288,11 +288,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; @@ -353,6 +348,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm); @@ -509,11 +509,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) { @@ -568,6 +563,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm);