awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into feat/showWarningOnImportedSecretDeletion

Browse Source
This commit is contained in:
carlosmonastyrski
2025-04-14 15:30:41 -03:00
parent 3c58bf890d bdab16f64b
commit 31a4bcafbe
3 changed files with 25 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts
View File

@@ -5,15 +5,21 @@ import { KmsKeyUsage } from "@app/services/kms/kms-types";
import { TableName } from "../schemas"; import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> { export async function up(knex: Knex): Promise<void> {
const hasTypeColumn = await knex.schema.hasColumn(TableName.KmsKey, "type"); const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage");
await knex.schema.alterTable(TableName.KmsKey, (t) => { if (!hasKeyUsageColumn) {
if (!hasTypeColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); await knex.schema.alterTable(TableName.KmsKey, (t) => {
}); t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT);
});
}
} }
export async function down(knex: Knex): Promise<void> { export async function down(knex: Knex): Promise<void> {
await knex.schema.alterTable(TableName.KmsKey, (t) => { const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage");
t.dropColumn("keyUsage");
}); if (hasKeyUsageColumn) {
await knex.schema.alterTable(TableName.KmsKey, (t) => {
t.dropColumn("keyUsage");
});
}
} }

3
backend/src/ee/routes/v1/oidc-router.ts
View File

@@ -136,11 +136,12 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
url: "/login/error", url: "/login/error",
method: "GET", method: "GET",
handler: async (req, res) => { handler: async (req, res) => {
const failureMessage = req.session.get<any>("messages");
await req.session.destroy(); await req.session.destroy();
return res.status(500).send({ return res.status(500).send({
error: "Authentication error", error: "Authentication error",
details: req.query details: failureMessage ?? req.query
}); });
} }
}); });

20
backend/src/services/kms/kms-service.ts
View File

@@ -288,11 +288,6 @@ export const kmsServiceFactory = ({
throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
} }
const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm;
verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, {
forceType: KmsKeyUsage.ENCRYPT_DECRYPT
});
if (kmsDoc.externalKms) { if (kmsDoc.externalKms) {
let externalKms: TExternalKmsProviderFns; let externalKms: TExternalKmsProviderFns;
@@ -353,6 +348,11 @@ export const kmsServiceFactory = ({
}; };
} }
const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm;
verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, {
forceType: KmsKeyUsage.ENCRYPT_DECRYPT
});
// internal KMS // internal KMS
const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256);
const dataCipher = symmetricCipherService(encryptionAlgorithm); const dataCipher = symmetricCipherService(encryptionAlgorithm);
@@ -509,11 +509,6 @@ export const kmsServiceFactory = ({
throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` });
} }
const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm;
verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, {
forceType: KmsKeyUsage.ENCRYPT_DECRYPT
});
if (kmsDoc.externalKms) { if (kmsDoc.externalKms) {
let externalKms: TExternalKmsProviderFns; let externalKms: TExternalKmsProviderFns;
if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) { if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) {
@@ -568,6 +563,11 @@ export const kmsServiceFactory = ({
}; };
} }
const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm;
verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, {
forceType: KmsKeyUsage.ENCRYPT_DECRYPT
});
// internal KMS // internal KMS
const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256);
const dataCipher = symmetricCipherService(encryptionAlgorithm); const dataCipher = symmetricCipherService(encryptionAlgorithm);