refactor(ui): migrated secret endpoints of e2ee to raw

frontend/src/hooks/api/secrets/mutations.tsx

@@ -1,18 +1,11 @@
-import crypto from "crypto";
-
 import { MutationOptions, useMutation, useQueryClient } from "@tanstack/react-query";
 
-import {
-  decryptAssymmetric,
-  encryptSymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
 import { secretApprovalRequestKeys } from "../secretApprovalRequest/queries";
 import { secretSnapshotKeys } from "../secretSnapshots/queries";
 import { secretKeys } from "./queries";
 import {
-  CreateSecretDTO,
   TCreateSecretBatchDTO,
   TCreateSecretsV3DTO,
   TDeleteSecretBatchDTO,
@@ -22,50 +15,6 @@ import {
   TUpdateSecretsV3DTO
 } from "./types";
 
-const encryptSecret = (randomBytes: string, key: string, value?: string, comment?: string) => {
-  // encrypt key
-  const {
-    ciphertext: secretKeyCiphertext,
-    iv: secretKeyIV,
-    tag: secretKeyTag
-  } = encryptSymmetric({
-    plaintext: key,
-    key: randomBytes
-  });
-
-  // encrypt value
-  const {
-    ciphertext: secretValueCiphertext,
-    iv: secretValueIV,
-    tag: secretValueTag
-  } = encryptSymmetric({
-    plaintext: value ?? "",
-    key: randomBytes
-  });
-
-  // encrypt comment
-  const {
-    ciphertext: secretCommentCiphertext,
-    iv: secretCommentIV,
-    tag: secretCommentTag
-  } = encryptSymmetric({
-    plaintext: comment ?? "",
-    key: randomBytes
-  });
-
-  return {
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretCommentCiphertext,
-    secretCommentIV,
-    secretCommentTag
-  };
-};
-
 export const useCreateSecretV3 = ({
   options
 }: {
@@ -78,32 +27,20 @@ export const useCreateSecretV3 = ({
       type,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretValue,
-      latestFileKey,
       secretComment,
       skipMultilineEncoding
     }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
-        workspaceId,
-        environment,
-        type,
+      const { data } = await apiRequest.post(`/api/v3/secrets/raw/${secretKey}`, {
         secretPath,
-        ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
+        type,
+        environment,
+        workspaceId,
+        secretValue,
+        secretComment,
         skipMultilineEncoding
-      };
-      const { data } = await apiRequest.post(`/api/v3/secrets/${secretName}`, reqBody);
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -132,44 +69,30 @@ export const useUpdateSecretV3 = ({
     mutationFn: async ({
       secretPath = "/",
       type,
-      secretId,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretValue,
-      latestFileKey,
-      tags,
+      tagIds,
       secretComment,
       secretReminderRepeatDays,
       secretReminderNote,
       newSecretName,
       skipMultilineEncoding
     }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+      const { data } = await apiRequest.patch(`/api/v3/secrets/raw/${secretKey}`, {
         workspaceId,
         environment,
         type,
         secretReminderNote,
         secretReminderRepeatDays,
         secretPath,
-        secretId,
-        ...encryptSecret(randomBytes, newSecretName ?? secretName, secretValue, secretComment),
-        tags,
         skipMultilineEncoding,
-        secretName: newSecretName
-      };
-      const { data } = await apiRequest.patch(`/api/v3/secrets/${secretName}`, reqBody);
+        newSecretName,
+        secretComment,
+        tagIds,
+        secretValue
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -201,19 +124,17 @@ export const useDeleteSecretV3 = ({
       type,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretId
     }) => {
-      const reqBody = {
-        workspaceId,
-        environment,
-        type,
-        secretPath,
-        secretId
-      };
-
-      const { data } = await apiRequest.delete(`/api/v3/secrets/${secretName}`, {
-        data: reqBody
+      const { data } = await apiRequest.delete(`/api/v3/secrets/raw/${secretKey}`, {
+        data: {
+          workspaceId,
+          environment,
+          type,
+          secretPath,
+          secretId
+        }
       });
       return data;
     },
@@ -241,33 +162,13 @@ export const useCreateSecretBatch = ({
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TCreateSecretBatchDTO>({
-    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
+      const { data } = await apiRequest.post("/api/v3/secrets/batch/raw", {
         workspaceId,
         environment,
         secretPath,
-        secrets: secrets.map(
-          ({ secretName, secretValue, secretComment, metadata, type, skipMultilineEncoding }) => ({
-            secretName,
-            ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
-            type,
-            metadata,
-            skipMultilineEncoding
-          })
-        )
-      };
-
-      const { data } = await apiRequest.post("/api/v3/secrets/batch", reqBody);
+        secrets
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -294,33 +195,13 @@ export const useUpdateSecretBatch = ({
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TUpdateSecretBatchDTO>({
-    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
+      const { data } = await apiRequest.patch("/api/v3/secrets/batch/raw", {
         workspaceId,
         environment,
         secretPath,
-        secrets: secrets.map(
-          ({ secretName, secretValue, secretComment, type, tags, skipMultilineEncoding }) => ({
-            secretName,
-            ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
-            type,
-            tags,
-            skipMultilineEncoding
-          })
-        )
-      };
-
-      const { data } = await apiRequest.patch("/api/v3/secrets/batch", reqBody);
+        secrets
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -348,15 +229,13 @@ export const useDeleteSecretBatch = ({
 
   return useMutation<{}, {}, TDeleteSecretBatchDTO>({
     mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
-      const reqBody = {
-        workspaceId,
-        environment,
-        secretPath,
-        secrets
-      };
-
-      const { data } = await apiRequest.delete("/api/v3/secrets/batch", {
-        data: reqBody
+      const { data } = await apiRequest.delete("/api/v3/secrets/batch/raw", {
+        data: {
+          workspaceId,
+          environment,
+          secretPath,
+          secrets
+        }
       });
       return data;
     },
@@ -443,7 +322,7 @@ export const useMoveSecrets = ({
   });
 };
 
-export const createSecret = async (dto: CreateSecretDTO) => {
+export const createSecret = async (dto: TCreateSecretsV3DTO) => {
   const { data } = await apiRequest.post(`/api/v3/secrets/${dto.secretKey}`, dto);
   return data;
 };

frontend/src/hooks/api/secrets/queries.tsx

@@ -8,13 +8,13 @@ import {
 } from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
-import { UserWsKeyPair } from "../keys/types";
 import {
-  DecryptedSecret,
-  EncryptedSecret,
   EncryptedSecretVersion,
   GetSecretVersionsDTO,
   SecretType,
+  SecretV3Raw,
+  SecretV3RawResponse,
+  SecretV3RawSanitized,
   TGetProjectSecretsAllEnvDTO,
   TGetProjectSecretsDTO,
   TGetProjectSecretsKey
@@ -27,61 +27,49 @@ export const secretKeys = {
   getSecretVersion: (secretId: string) => [{ secretId }, "secret-versions"] as const
 };
 
-export const decryptSecrets = (
-  encryptedSecrets: EncryptedSecret[],
-  decryptFileKey: UserWsKeyPair
-) => {
-  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-  const key = decryptAssymmetric({
-    ciphertext: decryptFileKey.encryptedKey,
-    nonce: decryptFileKey.nonce,
-    publicKey: decryptFileKey.sender.publicKey,
-    privateKey: PRIVATE_KEY
+export const fetchProjectSecrets = async ({
+  workspaceId,
+  environment,
+  secretPath,
+  includeImports,
+  expandSecretReferences
+}: TGetProjectSecretsKey) => {
+  const { data } = await apiRequest.get<SecretV3RawResponse>("/api/v3/secrets/raw", {
+    params: {
+      environment,
+      workspaceId,
+      secretPath,
+      expandSecretReferences,
+      include_imports: includeImports
+    }
   });
 
+  return data;
+};
+
+export const mergePersonalSecrets = (rawSecrets: SecretV3Raw[]) => {
   const personalSecrets: Record<string, { id: string; value: string }> = {};
-  const secrets: DecryptedSecret[] = [];
-  encryptedSecrets.forEach((encSecret) => {
-    const secretKey = decryptSymmetric({
-      ciphertext: encSecret.secretKeyCiphertext,
-      iv: encSecret.secretKeyIV,
-      tag: encSecret.secretKeyTag,
-      key
-    });
-
-    const secretValue = decryptSymmetric({
-      ciphertext: encSecret.secretValueCiphertext,
-      iv: encSecret.secretValueIV,
-      tag: encSecret.secretValueTag,
-      key
-    });
-
-    const secretComment = decryptSymmetric({
-      ciphertext: encSecret.secretCommentCiphertext,
-      iv: encSecret.secretCommentIV,
-      tag: encSecret.secretCommentTag,
-      key
-    });
-
-    const decryptedSecret: DecryptedSecret = {
-      id: encSecret.id,
-      env: encSecret.environment,
-      key: secretKey,
-      value: secretValue,
-      tags: encSecret.tags,
-      comment: secretComment,
-      reminderRepeatDays: encSecret.secretReminderRepeatDays,
-      reminderNote: encSecret.secretReminderNote,
-      createdAt: encSecret.createdAt,
-      updatedAt: encSecret.updatedAt,
-      version: encSecret.version,
-      skipMultilineEncoding: encSecret.skipMultilineEncoding
+  const secrets: SecretV3RawSanitized[] = [];
+  rawSecrets.forEach((el) => {
+    const decryptedSecret: SecretV3RawSanitized = {
+      id: el.id,
+      env: el.environment,
+      key: el.secretKey,
+      value: el.secretValue,
+      tags: el.tags || [],
+      comment: el.secretComment || "",
+      reminderRepeatDays: el.secretReminderRepeatDays,
+      reminderNote: el.secretReminderNote,
+      createdAt: el.createdAt,
+      updatedAt: el.updatedAt,
+      version: el.version,
+      skipMultilineEncoding: el.skipMultilineEncoding
     };
 
-    if (encSecret.type === SecretType.Personal) {
+    if (el.type === SecretType.Personal) {
       personalSecrets[decryptedSecret.key] = {
-        id: encSecret.id,
-        value: secretValue
+        id: el.id,
+        value: el.secretValue
       };
     } else {
       secrets.push(decryptedSecret);
@@ -99,33 +87,17 @@ export const decryptSecrets = (
   return secrets;
 };
 
-export const fetchProjectEncryptedSecrets = async ({
-  workspaceId,
-  environment,
-  secretPath
-}: TGetProjectSecretsKey) => {
-  const { data } = await apiRequest.get<{ secrets: EncryptedSecret[] }>("/api/v3/secrets", {
-    params: {
-      environment,
-      workspaceId,
-      secretPath
-    }
-  });
-
-  return data.secrets;
-};
 export const useGetProjectSecrets = ({
   workspaceId,
   environment,
-  decryptFileKey,
   secretPath,
   options
 }: TGetProjectSecretsDTO & {
   options?: Omit<
     UseQueryOptions<
-      EncryptedSecret[],
+      SecretV3RawResponse,
       unknown,
-      DecryptedSecret[],
+      SecretV3RawSanitized[],
       ReturnType<typeof secretKeys.getProjectSecret>
     >,
     "queryKey" | "queryFn"
@@ -134,25 +106,24 @@ export const useGetProjectSecrets = ({
   useQuery({
     ...options,
     // wait for all values to be available
-    enabled: Boolean(decryptFileKey && workspaceId && environment) && (options?.enabled ?? true),
+    enabled: Boolean(workspaceId && environment) && (options?.enabled ?? true),
     queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }),
-    queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }),
-    select: (secrets: EncryptedSecret[]) => decryptSecrets(secrets, decryptFileKey)
+    queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }),
+    select: ({ secrets }) => mergePersonalSecrets(secrets)
   });
 
 export const useGetProjectSecretsAllEnv = ({
   workspaceId,
   envs,
-  decryptFileKey,
   secretPath
 }: TGetProjectSecretsAllEnvDTO) => {
   const secrets = useQueries({
     queries: envs.map((environment) => ({
       queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }),
-      enabled: Boolean(decryptFileKey && workspaceId && environment),
-      queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }),
-      select: (secs: EncryptedSecret[]) =>
-        decryptSecrets(secs, decryptFileKey).reduce<Record<string, DecryptedSecret>>(
+      enabled: Boolean(workspaceId && environment),
+      queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }),
+      select: (el: SecretV3RawResponse) =>
+        mergePersonalSecrets(el.secrets).reduce<Record<string, SecretV3RawSanitized>>(
           (prev, curr) => ({ ...prev, [curr.key]: curr }),
           {}
         )

frontend/src/hooks/api/secrets/types.ts

@@ -30,15 +30,16 @@ export type EncryptedSecret = {
   tags: WsTag[];
 };
 
-export type DecryptedSecret = {
+// both personal and shared secret stitiched together for dashboard
+export type SecretV3RawSanitized = {
   id: string;
   version: number;
   key: string;
   value: string;
-  comment: string;
+  comment?: string;
   reminderRepeatDays?: number | null;
   reminderNote?: string | null;
-  tags: WsTag[];
+  tags?: WsTag[];
   createdAt: string;
   updatedAt: string;
   env: string;
@@ -49,6 +50,35 @@ export type DecryptedSecret = {
   skipMultilineEncoding?: boolean;
 };
 
+export type SecretV3Raw = {
+  id: string;
+  _id: string;
+  workspace: string;
+  environment: string;
+  version: number;
+  type: string;
+  secretKey: string;
+  secretValue: string;
+  secretComment?: string;
+  secretReminderNote?: string;
+  secretReminderRepeatDays?: number;
+  skipMultilineEncoding?: boolean;
+  metadata?: Record<string, string>;
+  tags?: WsTag[];
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type SecretV3RawResponse = {
+  secrets: SecretV3Raw[];
+  imports: {
+    secretPath: string;
+    environment: string;
+    folderId: string;
+    secrets: SecretV3Raw[];
+  }[];
+};
+
 export type EncryptedSecretVersion = {
   id: string;
   secretId: string;
@@ -75,16 +105,15 @@ export type TGetProjectSecretsKey = {
   workspaceId: string;
   environment: string;
   secretPath?: string;
+  includeImports?: boolean;
+  expandSecretReferences?: boolean;
 };
 
-export type TGetProjectSecretsDTO = {
-  decryptFileKey: UserWsKeyPair;
-} & TGetProjectSecretsKey;
+export type TGetProjectSecretsDTO = TGetProjectSecretsKey;
 
 export type TGetProjectSecretsAllEnvDTO = {
   workspaceId: string;
   envs: string[];
-  decryptFileKey: UserWsKeyPair;
   folderId?: string;
   secretPath?: string;
   isPaused?: boolean;
@@ -98,8 +127,7 @@ export type GetSecretVersionsDTO = {
 };
 
 export type TCreateSecretsV3DTO = {
-  latestFileKey: UserWsKeyPair;
-  secretName: string;
+  secretKey: string;
   secretValue: string;
   secretComment: string;
   skipMultilineEncoding?: boolean;
@@ -110,20 +138,18 @@ export type TCreateSecretsV3DTO = {
 };
 
 export type TUpdateSecretsV3DTO = {
-  latestFileKey: UserWsKeyPair;
   workspaceId: string;
   environment: string;
-  type: SecretType;
   secretPath: string;
+  type: SecretType;
   skipMultilineEncoding?: boolean;
   newSecretName?: string;
-  secretName: string;
-  secretId?: string;
+  secretKey: string;
   secretValue: string;
   secretComment?: string;
   secretReminderRepeatDays?: number | null;
   secretReminderNote?: string | null;
-  tags?: string[];
+  tagIds?: string[];
 };
 
 export type TDeleteSecretsV3DTO = {
@@ -131,7 +157,7 @@ export type TDeleteSecretsV3DTO = {
   environment: string;
   type: SecretType;
   secretPath: string;
-  secretName: string;
+  secretKey: string;
   secretId?: string;
 };
 
@@ -139,13 +165,13 @@ export type TCreateSecretBatchDTO = {
   workspaceId: string;
   environment: string;
   secretPath: string;
-  latestFileKey: UserWsKeyPair;
   secrets: Array<{
-    secretName: string;
+    secretKey: string;
     secretValue: string;
     secretComment: string;
     skipMultilineEncoding?: boolean;
     type: SecretType;
+    tagIds?: string[];
     metadata?: {
       source?: string;
     };
@@ -156,14 +182,16 @@ export type TUpdateSecretBatchDTO = {
   workspaceId: string;
   environment: string;
   secretPath: string;
-  latestFileKey: UserWsKeyPair;
   secrets: Array<{
     type: SecretType;
-    secretName: string;
-    skipMultilineEncoding?: boolean;
+    secretKey: string;
     secretValue: string;
-    secretComment: string;
-    tags?: string[];
+    secretComment?: string;
+    skipMultilineEncoding?: boolean;
+    tagIds?: string[];
+    metadata?: {
+      source?: string;
+    };
   }>;
 };
 
@@ -172,7 +200,7 @@ export type TDeleteSecretBatchDTO = {
   environment: string;
   secretPath: string;
   secrets: Array<{
-    secretName: string;
+    secretKey: string;
     type: SecretType;
   }>;
 };
@@ -187,23 +215,3 @@ export type TMoveSecretsDTO = {
   secretIds: string[];
   shouldOverwrite: boolean;
 };
-
-export type CreateSecretDTO = {
-  workspaceId: string;
-  environment: string;
-  type: SecretType;
-  secretKey: string;
-  secretKeyCiphertext: string;
-  secretKeyIV: string;
-  secretKeyTag: string;
-  secretValueCiphertext: string;
-  secretValueIV: string;
-  secretValueTag: string;
-  secretCommentCiphertext: string;
-  secretCommentIV: string;
-  secretCommentTag: string;
-  secretPath: string;
-  metadata?: {
-    source?: string;
-  };
-};