feat: added logic for webhook and dynamic secret to use the kms encryption

backend/src/db/migrations/20240716105646_secret-v2.ts

@@ -1,6 +1,6 @@
 import { Knex } from "knex";
 
-import { SecretType, TableName } from "../schemas";
+import { SecretEncryptionAlgo, SecretKeyEncoding, SecretType, TableName } from "../schemas";
 import { createJunctionTable, createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
@@ -143,6 +143,32 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
     });
   }
+
+  if (await knex.schema.hasTable(TableName.Webhook)) {
+    const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms");
+    const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl");
+    await knex.schema.alterTable(TableName.Webhook, (t) => {
+      if (!hasEncryptedWebhookSecretKey) t.binary("encryptedSecretKeyWithKms");
+      if (!hasEncryptedWebhookUrl) t.binary("encryptedUrl");
+    });
+  }
+
+  if (await knex.schema.hasTable(TableName.DynamicSecret)) {
+    const hasInputIV = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV");
+    const hasInputCipherText = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext");
+    const hasInputTag = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag");
+    const hasAlgorithm = await knex.schema.hasColumn(TableName.DynamicSecret, "algorithm");
+    const hasKeyEncoding = await knex.schema.hasColumn(TableName.DynamicSecret, "keyEncoding");
+    const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig");
+    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
+      if (hasInputIV) t.string("inputIV").alter();
+      if (hasInputCipherText) t.text("inputCiphertext").alter();
+      if (hasInputTag) t.string("inputTag").alter();
+      if (hasAlgorithm) t.string("algorithm").defaultTo(SecretEncryptionAlgo.AES_256_GCM).alter();
+      if (hasKeyEncoding) t.string("keyEncoding").defaultTo(SecretKeyEncoding.UTF8).alter();
+      if (!hasEncryptedConfig) t.binary("encryptedConfig");
+    });
+  }
 }
 
 export async function down(knex: Knex): Promise<void> {
@@ -177,4 +203,19 @@ export async function down(knex: Knex): Promise<void> {
       if (hasEncryptedAwsIamAssumRole) t.dropColumn("encryptedAwsAssumeIamRoleArn");
     });
   }
+  if (await knex.schema.hasTable(TableName.Webhook)) {
+    const hasEncryptedWebhookSecretKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedSecretKeyWithKms");
+    const hasEncryptedWebhookUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl");
+    await knex.schema.alterTable(TableName.Webhook, (t) => {
+      if (hasEncryptedWebhookSecretKey) t.dropColumn("encryptedSecretKeyWithKms");
+      if (hasEncryptedWebhookUrl) t.dropColumn("encryptedUrl");
+    });
+  }
+
+  if (await knex.schema.hasTable(TableName.DynamicSecret)) {
+    const hasEncryptedConfig = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedConfig");
+    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
+      if (hasEncryptedConfig) t.dropColumn("encryptedConfig");
+    });
+  }
 }

backend/src/db/schemas/dynamic-secrets.ts

@@ -5,6 +5,8 @@
 
 import { z } from "zod";
 
+import { zodBuffer } from "@app/lib/zod";
+
 import { TImmutableDBKeys } from "./models";
 
 export const DynamicSecretsSchema = z.object({
@@ -14,16 +16,17 @@ export const DynamicSecretsSchema = z.object({
   type: z.string(),
   defaultTTL: z.string(),
   maxTTL: z.string().nullable().optional(),
-  inputIV: z.string(),
-  inputCiphertext: z.string(),
-  inputTag: z.string(),
-  algorithm: z.string().default("aes-256-gcm"),
-  keyEncoding: z.string().default("utf8"),
+  inputIV: z.string().nullable().optional(),
+  inputCiphertext: z.string().nullable().optional(),
+  inputTag: z.string().nullable().optional(),
+  algorithm: z.string().default("aes-256-gcm").nullable().optional(),
+  keyEncoding: z.string().default("utf8").nullable().optional(),
   folderId: z.string().uuid(),
   status: z.string().nullable().optional(),
   statusDetails: z.string().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  encryptedConfig: zodBuffer.nullable().optional()
 });
 
 export type TDynamicSecrets = z.infer<typeof DynamicSecretsSchema>;

backend/src/db/schemas/integration-auths.ts

@@ -35,7 +35,6 @@ export const IntegrationAuthsSchema = z.object({
   awsAssumeIamRoleArnCipherText: z.string().nullable().optional(),
   awsAssumeIamRoleArnIV: z.string().nullable().optional(),
   awsAssumeIamRoleArnTag: z.string().nullable().optional(),
-  encryptedAwsIamAssumRole: zodBuffer.nullable().optional(),
   encryptedAccess: zodBuffer.nullable().optional(),
   encryptedAccessId: zodBuffer.nullable().optional(),
   encryptedRefresh: zodBuffer.nullable().optional(),

backend/src/db/schemas/webhooks.ts

@@ -5,6 +5,8 @@
 
 import { z } from "zod";
 
+import { zodBuffer } from "@app/lib/zod";
+
 import { TImmutableDBKeys } from "./models";
 
 export const WebhooksSchema = z.object({
@@ -25,7 +27,9 @@ export const WebhooksSchema = z.object({
   urlCipherText: z.string().nullable().optional(),
   urlIV: z.string().nullable().optional(),
   urlTag: z.string().nullable().optional(),
-  type: z.string().default("general").nullable().optional()
+  type: z.string().default("general").nullable().optional(),
+  encryptedSecretKeyWithKms: zodBuffer.nullable().optional(),
+  encryptedUrl: zodBuffer.nullable().optional()
 });
 
 export type TWebhooks = z.infer<typeof WebhooksSchema>;