From f3078040fccf756e7f056765f75df0982b840a42 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:22:59 +0400 Subject: [PATCH 1/3] fix: improve kms key migration --- .../migrations/20250402000941_add-type-to-kms-keys.ts | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts index fd99938db..76114035f 100644 --- a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts +++ b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts @@ -5,15 +5,19 @@ import { KmsKeyUsage } from "@app/services/kms/kms-types"; import { TableName } from "../schemas"; export async function up(knex: Knex): Promise { - const hasTypeColumn = await knex.schema.hasColumn(TableName.KmsKey, "type"); + const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (!hasTypeColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); + if (!hasKeyUsageColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); }); } export async function down(knex: Knex): Promise { + const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); + await knex.schema.alterTable(TableName.KmsKey, (t) => { - t.dropColumn("keyUsage"); + if (hasKeyUsageColumn) { + t.dropColumn("keyUsage"); + } }); } From b9d74e0aedbb0e00715b6f3377e74be6f95a0a20 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:36:16 +0400 Subject: [PATCH 2/3] requested changes --- .../20250402000941_add-type-to-kms-keys.ts | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts index 76114035f..591c5f1ec 100644 --- a/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts +++ b/backend/src/db/migrations/20250402000941_add-type-to-kms-keys.ts @@ -7,17 +7,19 @@ import { TableName } from "../schemas"; export async function up(knex: Knex): Promise { const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); - await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (!hasKeyUsageColumn) t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); - }); + if (!hasKeyUsageColumn) { + await knex.schema.alterTable(TableName.KmsKey, (t) => { + t.string("keyUsage").notNullable().defaultTo(KmsKeyUsage.ENCRYPT_DECRYPT); + }); + } } export async function down(knex: Knex): Promise { const hasKeyUsageColumn = await knex.schema.hasColumn(TableName.KmsKey, "keyUsage"); - await knex.schema.alterTable(TableName.KmsKey, (t) => { - if (hasKeyUsageColumn) { + if (hasKeyUsageColumn) { + await knex.schema.alterTable(TableName.KmsKey, (t) => { t.dropColumn("keyUsage"); - } - }); + }); + } } From c0926bec6973681ee677689808c1ddf47bf04535 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 14 Apr 2025 21:36:38 +0400 Subject: [PATCH 3/3] fix: no check for encryption algorithm on external KMS --- backend/src/services/kms/kms-service.ts | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 754c9be76..07ed90bef 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -288,11 +288,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; @@ -353,6 +348,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm); @@ -509,11 +509,6 @@ export const kmsServiceFactory = ({ throw new NotFoundError({ message: `KMS with ID '${kmsId}' not found` }); } - const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; - verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { - forceType: KmsKeyUsage.ENCRYPT_DECRYPT - }); - if (kmsDoc.externalKms) { let externalKms: TExternalKmsProviderFns; if (!kmsDoc.orgKms.id || !kmsDoc.orgKms.encryptedDataKey) { @@ -568,6 +563,11 @@ export const kmsServiceFactory = ({ }; } + const encryptionAlgorithm = kmsDoc.internalKms?.encryptionAlgorithm as SymmetricKeyAlgorithm; + verifyKeyTypeAndAlgorithm(kmsDoc.keyUsage as KmsKeyUsage, encryptionAlgorithm, { + forceType: KmsKeyUsage.ENCRYPT_DECRYPT + }); + // internal KMS const keyCipher = symmetricCipherService(SymmetricKeyAlgorithm.AES_GCM_256); const dataCipher = symmetricCipherService(encryptionAlgorithm);