misc: removed kms from service

backend/src/@types/fastify.d.ts

@@ -48,7 +48,6 @@ import { TIdentityTokenAuthServiceFactory } from "@app/services/identity-token-a
 import { TIdentityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";
 import { TIntegrationServiceFactory } from "@app/services/integration/integration-service";
 import { TIntegrationAuthServiceFactory } from "@app/services/integration-auth/integration-auth-service";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TOrgRoleServiceFactory } from "@app/services/org/org-role-service";
 import { TOrgServiceFactory } from "@app/services/org/org-service";
 import { TProjectServiceFactory } from "@app/services/project/project-service";
@@ -165,7 +164,6 @@ declare module "fastify" {
       secretSharing: TSecretSharingServiceFactory;
       rateLimit: TRateLimitServiceFactory;
       userEngagement: TUserEngagementServiceFactory;
-      kms: TKmsServiceFactory;
       externalKms: TExternalKmsServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data

backend/src/ee/routes/v1/project-router.ts

@@ -194,7 +194,14 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const secretManagerKmsKey = await server.services.kms.getProjectSecretManagerKmsKey(req.params.workspaceId);
+      const secretManagerKmsKey = await server.services.project.getProjectSecretManagerKmsKey({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        projectId: req.params.workspaceId
+      });
+
       return {
         secretManagerKmsKey
       };

backend/src/server/routes/index.ts

@@ -1054,7 +1054,6 @@ export const registerRoutes = async (
     identityProjectAdditionalPrivilege: identityProjectAdditionalPrivilegeService,
     secretSharing: secretSharingService,
     userEngagement: userEngagementService,
-    kms: kmsService,
     externalKms: externalKmsService
   });
 

backend/src/services/project/project-service.ts

@@ -39,6 +39,7 @@ import {
   TCreateProjectDTO,
   TDeleteProjectDTO,
   TGetProjectDTO,
+  TGetProjectKmsKey,
   TListProjectCasDTO,
   TListProjectCertsDTO,
   TLoadProjectKmsBackupDTO,
@@ -81,7 +82,11 @@ type TProjectServiceFactoryDep = {
   keyStore: Pick<TKeyStoreFactory, "deleteItem">;
   kmsService: Pick<
     TKmsServiceFactory,
-    "updateProjectSecretManagerKmsKey" | "getProjectKeyBackup" | "loadProjectKeyBackup" | "getKmsById"
+    | "updateProjectSecretManagerKmsKey"
+    | "getProjectKeyBackup"
+    | "loadProjectKeyBackup"
+    | "getKmsById"
+    | "getProjectSecretManagerKmsKeyId"
   >;
 };
 
@@ -767,6 +772,33 @@ export const projectServiceFactory = ({
     return kmsBackup;
   };
 
+  const getProjectSecretManagerKmsKey = async ({
+    projectId,
+    actor,
+    actorId,
+    actorAuthMethod,
+    actorOrgId
+  }: TGetProjectKmsKey) => {
+    const { membership } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    if (!membership) {
+      throw new ForbiddenRequestError({
+        message: "User is not a member of the project"
+      });
+    }
+
+    const kmsKeyId = await kmsService.getProjectSecretManagerKmsKeyId(projectId);
+    const kmsKey = await kmsService.getKmsById(kmsKeyId);
+
+    return kmsKey;
+  };
+
   return {
     createProject,
     deleteProject,
@@ -783,6 +815,7 @@ export const projectServiceFactory = ({
     updateAuditLogsRetention,
     updateProjectKmsKey,
     getProjectKmsBackup,
-    loadProjectKmsBackup
+    loadProjectKmsBackup,
+    getProjectSecretManagerKmsKey
   };
 };

backend/src/services/project/project-types.ts

@@ -112,3 +112,5 @@ export type TUpdateProjectKmsDTO = {
 export type TLoadProjectKmsBackupDTO = {
   backup: string;
 } & TProjectPermission;
+
+export type TGetProjectKmsKey = TProjectPermission;