feat: updated kms service to return only kms details and some more minor changes

backend/src/ee/routes/v1/project-router.ts

@@ -7,6 +7,7 @@ import { getLastMidnightDateISO, removeTrailingSlash } from "@app/lib/fn";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { KmsType } from "@app/services/kms/kms-types";
 
 export const registerProjectRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -194,7 +195,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const kmsKeys = await server.services.project.getProjectKmsKeys({
+      const kmsKey = await server.services.project.getProjectKmsKeys({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -202,7 +203,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         projectId: req.params.workspaceId
       });
 
-      return kmsKeys;
+      return kmsKey;
     }
   });
 
@@ -217,7 +218,10 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         workspaceId: z.string().trim()
       }),
       body: z.object({
-        secretManagerKmsKeyId: z.string()
+        kms: z.discriminatedUnion("type", [
+          z.object({ type: z.literal(KmsType.Internal) }),
+          z.object({ type: z.literal(KmsType.External), kmsId: z.string() })
+        ])
       }),
       response: {
         200: z.object({

backend/src/ee/services/external-kms/external-kms-service.ts

@@ -5,6 +5,7 @@ import { BadRequestError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
@@ -23,10 +24,7 @@ import { ExternalKmsAwsSchema, KmsProviders } from "./providers/model";
 
 type TExternalKmsServiceFactoryDep = {
   externalKmsDAL: TExternalKmsDALFactory;
-  kmsService: Pick<
-    TKmsServiceFactory,
-    "getOrgKmsKeyId" | "decryptWithInputKey" | "encryptWithInputKey" | "getOrgKmsDataKey"
-  >;
+  kmsService: Pick<TKmsServiceFactory, "getOrgKmsKeyId" | "createCipherPairWithDataKey">;
   kmsDAL: Pick<TKmsKeyDALFactory, "create" | "updateById" | "findById" | "deleteById" | "findOne">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -84,12 +82,12 @@ export const externalKmsServiceFactory = ({
         throw new BadRequestError({ message: "external kms provided is invalid" });
     }
 
-    const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId);
-    const kmsEncryptor = await kmsService.encryptWithInputKey({
-      key: orgKmsDataKey
+    const { encryptor: orgDataKeyEncryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actorOrgId
     });
 
-    const { cipherTextBlob: encryptedProviderInputs } = kmsEncryptor({
+    const { cipherTextBlob: encryptedProviderInputs } = orgDataKeyEncryptor({
       plainText: Buffer.from(sanitizedProviderInput, "utf8")
     });
 
@@ -150,13 +148,13 @@ export const externalKmsServiceFactory = ({
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
     let sanitizedProviderInput = "";
-    if (provider) {
-      const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId);
-      const kmsDecryptor = await kmsService.decryptWithInputKey({
-        key: orgKmsDataKey
+    const { encryptor: orgDataKeyEncryptor, decryptor: orgDataKeyDecryptor } =
+      await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.Organization,
+        orgId: actorOrgId
       });
-
-      const decryptedProviderInputBlob = kmsDecryptor({
+    if (provider) {
+      const decryptedProviderInputBlob = orgDataKeyDecryptor({
         cipherTextBlob: externalKmsDoc.encryptedProviderInputs
       });
 
@@ -179,11 +177,7 @@ export const externalKmsServiceFactory = ({
 
     let encryptedProviderInputs: Buffer | undefined;
     if (sanitizedProviderInput) {
-      const orgKmsDataKey = await kmsService.getOrgKmsDataKey(actorOrgId);
-      const kmsEncryptor = await kmsService.encryptWithInputKey({
-        key: orgKmsDataKey
-      });
-      const { cipherTextBlob } = kmsEncryptor({
+      const { cipherTextBlob } = orgDataKeyEncryptor({
         plainText: Buffer.from(sanitizedProviderInput, "utf8")
       });
       encryptedProviderInputs = cipherTextBlob;
@@ -266,12 +260,12 @@ export const externalKmsServiceFactory = ({
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
-    const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId);
-    const kmsDecryptor = await kmsService.decryptWithInputKey({
-      key: orgKmsDataKey
+    const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actorOrgId
     });
 
-    const decryptedProviderInputBlob = kmsDecryptor({
+    const decryptedProviderInputBlob = orgDataKeyDecryptor({
       cipherTextBlob: externalKmsDoc.encryptedProviderInputs
     });
     switch (externalKmsDoc.provider) {
@@ -306,12 +300,12 @@ export const externalKmsServiceFactory = ({
     const externalKmsDoc = await externalKmsDAL.findOne({ kmsKeyId: kmsDoc.id });
     if (!externalKmsDoc) throw new BadRequestError({ message: "External kms not found" });
 
-    const orgKmsDataKey = await kmsService.getOrgKmsDataKey(kmsDoc.orgId);
-    const kmsDecryptor = await kmsService.decryptWithInputKey({
-      key: orgKmsDataKey
+    const { decryptor: orgDataKeyDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: actorOrgId
     });
 
-    const decryptedProviderInputBlob = kmsDecryptor({
+    const decryptedProviderInputBlob = orgDataKeyDecryptor({
       cipherTextBlob: externalKmsDoc.encryptedProviderInputs
     });
 

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -17,6 +17,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { EnforcementLevel } from "@app/lib/types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
@@ -89,10 +90,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   projectDAL: Pick<TProjectDALFactory, "checkProjectUpgradeStatus" | "findById" | "findProjectById">;
   secretQueueService: Pick<TSecretQueueFactory, "syncSecrets" | "removeSecretReminder">;
-  kmsService: Pick<
-    TKmsServiceFactory,
-    "getProjectSecretManagerKmsDataKey" | "encryptWithInputKey" | "decryptWithInputKey"
-  >;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey" | "encryptWithInputKey" | "decryptWithInputKey">;
   secretV2BridgeDAL: Pick<
     TSecretV2BridgeDALFactory,
     "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany"
@@ -214,8 +212,10 @@ export const secretApprovalRequestServiceFactory = ({
 
     let secrets;
     if (shouldUseSecretV2Bridge) {
-      const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId);
-      const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey });
+      const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
       const encrypedSecrets = await secretApprovalRequestSecretDAL.findByRequestIdBridgeSecretV2(
         secretApprovalRequest.id
       );
@@ -427,8 +427,10 @@ export const secretApprovalRequestServiceFactory = ({
       );
       if (!secretApprovalSecrets) throw new BadRequestError({ message: "No secrets found" });
 
-      const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId);
-      const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey });
+      const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
 
       const conflicts: Array<{ secretId: string; op: SecretOperations }> = [];
       let secretCreationCommits = secretApprovalSecrets.filter(({ op }) => op === SecretOperations.Create);
@@ -1074,8 +1076,10 @@ export const secretApprovalRequestServiceFactory = ({
     const commits: Omit<TSecretApprovalRequestsSecretsV2Insert, "requestId">[] = [];
     const commitTagIds: Record<string, string[]> = {};
 
-    const secretManagerDataKey = await kmsService.getProjectSecretManagerKmsDataKey(projectId);
-    const secretManagerEncryptor = await kmsService.encryptWithInputKey({ key: secretManagerDataKey });
+    const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
 
     // for created secret approval change
     const createdSecrets = data[SecretOperations.Create];