feat: added logic for webhook and dynamic secret to use the kms encryption

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts

@@ -48,6 +48,7 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
           db.ref("folderId").withSchema(TableName.DynamicSecret).as("dynFolderId"),
           db.ref("status").withSchema(TableName.DynamicSecret).as("dynStatus"),
           db.ref("statusDetails").withSchema(TableName.DynamicSecret).as("dynStatusDetails"),
+          db.ref("encryptedConfig").withSchema(TableName.DynamicSecret).as("dynEncryptedConfig"),
           db.ref("createdAt").withSchema(TableName.DynamicSecret).as("dynCreatedAt"),
           db.ref("updatedAt").withSchema(TableName.DynamicSecret).as("dynUpdatedAt")
         );
@@ -71,7 +72,8 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
           status: doc.dynStatus,
           statusDetails: doc.dynStatusDetails,
           createdAt: doc.dynCreatedAt,
-          updatedAt: doc.dynUpdatedAt
+          updatedAt: doc.dynUpdatedAt,
+          encryptedConfig: doc.dynEncryptedConfig
         }
       };
     } catch (error) {

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts

@@ -1,8 +1,12 @@
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
+import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
 import { TDynamicSecretDALFactory } from "../dynamic-secret/dynamic-secret-dal";
 import { DynamicSecretStatus } from "../dynamic-secret/dynamic-secret-types";
@@ -14,6 +18,8 @@ type TDynamicSecretLeaseQueueServiceFactoryDep = {
   dynamicSecretLeaseDAL: Pick<TDynamicSecretLeaseDALFactory, "findById" | "deleteById" | "find" | "updateById">;
   dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findById" | "deleteById" | "updateById">;
   dynamicSecretProviders: Record<DynamicSecretProviders, TDynamicProviderFns>;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+  folderDAL: Pick<TSecretFolderDALFactory, "findById">;
 };
 
 export type TDynamicSecretLeaseQueueServiceFactory = ReturnType<typeof dynamicSecretLeaseQueueServiceFactory>;
@@ -22,7 +28,9 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
   queueService,
   dynamicSecretDAL,
   dynamicSecretProviders,
-  dynamicSecretLeaseDAL
+  dynamicSecretLeaseDAL,
+  kmsService,
+  folderDAL
 }: TDynamicSecretLeaseQueueServiceFactoryDep) => {
   const pruneDynamicSecret = async (dynamicSecretCfgId: string) => {
     await queueService.queue(
@@ -77,15 +85,38 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
         if (!dynamicSecretLease) throw new DisableRotationErrors({ message: "Dynamic secret lease not found" });
 
         const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
-        const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-        const decryptedStoredInput = JSON.parse(
-          infisicalSymmetricDecrypt({
+        const folder = await folderDAL.findById(dynamicSecretCfg.folderId);
+        if (!folder) throw new DisableRotationErrors({ message: "Folder not found" });
+        const { projectId } = folder;
+
+        const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+          type: KmsDataKey.SecretManager,
+          projectId
+        });
+
+        let dynamicSecretInputConfig = "";
+        if (
+          dynamicSecretCfg.keyEncoding &&
+          dynamicSecretCfg.inputCiphertext &&
+          dynamicSecretCfg.inputTag &&
+          dynamicSecretCfg.inputIV
+        ) {
+          dynamicSecretInputConfig = infisicalSymmetricDecrypt({
             keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
             ciphertext: dynamicSecretCfg.inputCiphertext,
             tag: dynamicSecretCfg.inputTag,
             iv: dynamicSecretCfg.inputIV
-          })
-        ) as object;
+          });
+        } else if (dynamicSecretCfg.encryptedConfig) {
+          dynamicSecretInputConfig = secretManagerDecryptor({
+            cipherTextBlob: dynamicSecretCfg.encryptedConfig
+          }).toString();
+        } else {
+          throw new BadRequestError({ message: "Missing secret input config" });
+        }
+
+        const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
+        const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object;
 
         await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId);
         await dynamicSecretLeaseDAL.deleteById(dynamicSecretLease.id);
@@ -100,17 +131,39 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
         if ((dynamicSecretCfg.status as DynamicSecretStatus) !== DynamicSecretStatus.Deleting)
           throw new DisableRotationErrors({ message: "Document not deleted" });
 
+        const folder = await folderDAL.findById(dynamicSecretCfg.folderId);
+        if (!folder) throw new DisableRotationErrors({ message: "Folder not found" });
+        const { projectId } = folder;
+        const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+          type: KmsDataKey.SecretManager,
+          projectId
+        });
+
         const dynamicSecretLeases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfgId });
         if (dynamicSecretLeases.length) {
           const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-          const decryptedStoredInput = JSON.parse(
-            infisicalSymmetricDecrypt({
+          let dynamicSecretInputConfig = "";
+
+          if (
+            dynamicSecretCfg.keyEncoding &&
+            dynamicSecretCfg.inputCiphertext &&
+            dynamicSecretCfg.inputTag &&
+            dynamicSecretCfg.inputIV
+          ) {
+            dynamicSecretInputConfig = infisicalSymmetricDecrypt({
               keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
               ciphertext: dynamicSecretCfg.inputCiphertext,
               tag: dynamicSecretCfg.inputTag,
               iv: dynamicSecretCfg.inputIV
-            })
-          ) as object;
+            });
+          } else if (dynamicSecretCfg.encryptedConfig) {
+            dynamicSecretInputConfig = secretManagerDecryptor({
+              cipherTextBlob: dynamicSecretCfg.encryptedConfig
+            }).toString();
+          } else {
+            throw new BadRequestError({ message: "Missing secret input config" });
+          }
+          const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object;
 
           await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id)));
           await Promise.all(

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import ms from "ms";
 
-import { SecretKeyEncoding } from "@app/db/schemas";
+import { SecretKeyEncoding, TDynamicSecrets } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -9,6 +9,8 @@ import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
@@ -34,6 +36,7 @@ type TDynamicSecretLeaseServiceFactoryDep = {
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TDynamicSecretLeaseServiceFactory = ReturnType<typeof dynamicSecretLeaseServiceFactory>;
@@ -46,8 +49,32 @@ export const dynamicSecretLeaseServiceFactory = ({
   permissionService,
   dynamicSecretQueueService,
   projectDAL,
-  licenseService
+  licenseService,
+  kmsService
 }: TDynamicSecretLeaseServiceFactoryDep) => {
+  const $getDynamicSecretInputConfig = (dynamicSecretCfg: TDynamicSecrets, decryptValue: (arg: Buffer) => string) => {
+    if (
+      dynamicSecretCfg.keyEncoding &&
+      dynamicSecretCfg.inputCiphertext &&
+      dynamicSecretCfg.inputTag &&
+      dynamicSecretCfg.inputIV
+    ) {
+      return JSON.parse(
+        infisicalSymmetricDecrypt({
+          keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+          ciphertext: dynamicSecretCfg.inputCiphertext,
+          tag: dynamicSecretCfg.inputTag,
+          iv: dynamicSecretCfg.inputIV
+        })
+      ) as object;
+    }
+    if (dynamicSecretCfg.encryptedConfig) {
+      return JSON.parse(decryptValue(dynamicSecretCfg.encryptedConfig)) as object;
+    }
+
+    throw new BadRequestError({ message: "Missing secret input config" });
+  };
+
   const create = async ({
     environmentSlug,
     path,
@@ -94,14 +121,13 @@ export const dynamicSecretLeaseServiceFactory = ({
       throw new BadRequestError({ message: `Max lease limit reached. Limit: ${appCfg.MAX_LEASE_LIMIT}` });
 
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-    const decryptedStoredInput = JSON.parse(
-      infisicalSymmetricDecrypt({
-        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
-        ciphertext: dynamicSecretCfg.inputCiphertext,
-        tag: dynamicSecretCfg.inputTag,
-        iv: dynamicSecretCfg.inputIV
-      })
-    ) as object;
+    const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
+    const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) =>
+      kmsDecryptor({ cipherTextBlob: value }).toString()
+    );
 
     const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL;
     const { maxTTL } = dynamicSecretCfg;
@@ -164,14 +190,13 @@ export const dynamicSecretLeaseServiceFactory = ({
 
     const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-    const decryptedStoredInput = JSON.parse(
-      infisicalSymmetricDecrypt({
-        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
-        ciphertext: dynamicSecretCfg.inputCiphertext,
-        tag: dynamicSecretCfg.inputTag,
-        iv: dynamicSecretCfg.inputIV
-      })
-    ) as object;
+    const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
+    const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) =>
+      kmsDecryptor({ cipherTextBlob: value }).toString()
+    );
 
     const selectedTTL = ttl ?? dynamicSecretCfg.defaultTTL;
     const { maxTTL } = dynamicSecretCfg;
@@ -231,14 +256,13 @@ export const dynamicSecretLeaseServiceFactory = ({
 
     const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-    const decryptedStoredInput = JSON.parse(
-      infisicalSymmetricDecrypt({
-        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
-        ciphertext: dynamicSecretCfg.inputCiphertext,
-        tag: dynamicSecretCfg.inputTag,
-        iv: dynamicSecretCfg.inputIV
-      })
-    ) as object;
+    const { decryptor: kmsDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
+    const decryptedStoredInput = $getDynamicSecretInputConfig(dynamicSecretCfg, (value) =>
+      kmsDecryptor({ cipherTextBlob: value }).toString()
+    );
 
     const revokeResponse = await selectedProvider
       .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId)

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -4,8 +4,10 @@ import { SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
+import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
@@ -34,6 +36,7 @@ type TDynamicSecretServiceFactoryDep = {
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TDynamicSecretServiceFactory = ReturnType<typeof dynamicSecretServiceFactory>;
@@ -46,7 +49,8 @@ export const dynamicSecretServiceFactory = ({
   dynamicSecretProviders,
   permissionService,
   dynamicSecretQueueService,
-  projectDAL
+  projectDAL,
+  kmsService
 }: TDynamicSecretServiceFactoryDep) => {
   const create = async ({
     path,
@@ -96,16 +100,16 @@ export const dynamicSecretServiceFactory = ({
 
     const isConnected = await selectedProvider.validateConnection(provider.inputs);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
+    const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
 
-    const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(inputs));
+    const encryptedConfig = secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(inputs)) }).cipherTextBlob;
     const dynamicSecretCfg = await dynamicSecretDAL.create({
       type: provider.type,
       version: 1,
-      inputIV: encryptedInput.iv,
-      inputTag: encryptedInput.tag,
-      inputCiphertext: encryptedInput.ciphertext,
-      algorithm: encryptedInput.algorithm,
-      keyEncoding: encryptedInput.encoding,
+      encryptedConfig,
       maxTTL,
       defaultTTL,
       folderId: folder.id,
@@ -164,28 +168,51 @@ export const dynamicSecretServiceFactory = ({
         throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" });
     }
 
+    let dynamicSecretInputConfig = "";
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-    const decryptedStoredInput = JSON.parse(
-      infisicalSymmetricDecrypt({
+    const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
+      await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
+    if (
+      dynamicSecretCfg.keyEncoding &&
+      dynamicSecretCfg.inputCiphertext &&
+      dynamicSecretCfg.inputTag &&
+      dynamicSecretCfg.inputIV
+    ) {
+      dynamicSecretInputConfig = infisicalSymmetricDecrypt({
         keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
         ciphertext: dynamicSecretCfg.inputCiphertext,
         tag: dynamicSecretCfg.inputTag,
         iv: dynamicSecretCfg.inputIV
-      })
-    ) as object;
+      });
+    } else if (dynamicSecretCfg.encryptedConfig) {
+      dynamicSecretInputConfig = secretManagerDecryptor({
+        cipherTextBlob: dynamicSecretCfg.encryptedConfig
+      }).toString();
+    } else {
+      throw new BadRequestError({ message: "Missing secret input config" });
+    }
+
+    const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object;
     const newInput = { ...decryptedStoredInput, ...(inputs || {}) };
     const updatedInput = await selectedProvider.validateProviderInputs(newInput);
 
     const isConnected = await selectedProvider.validateConnection(newInput);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
 
-    const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(updatedInput));
+    const encryptedConfig = secretManagerEncryptor({
+      plainText: Buffer.from(JSON.stringify(updatedInput))
+    }).cipherTextBlob;
+
     const updatedDynamicCfg = await dynamicSecretDAL.updateById(dynamicSecretCfg.id, {
-      inputIV: encryptedInput.iv,
-      inputTag: encryptedInput.tag,
-      inputCiphertext: encryptedInput.ciphertext,
-      algorithm: encryptedInput.algorithm,
-      keyEncoding: encryptedInput.encoding,
+      encryptedConfig,
+      inputIV: null,
+      inputTag: null,
+      keyEncoding: null,
+      algorithm: null,
+      inputCiphertext: null,
       maxTTL,
       defaultTTL,
       name: newName ?? name,
@@ -286,14 +313,33 @@ export const dynamicSecretServiceFactory = ({
 
     const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" });
-    const decryptedStoredInput = JSON.parse(
-      infisicalSymmetricDecrypt({
+    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.SecretManager,
+      projectId
+    });
+
+    let dynamicSecretInputConfig = "";
+    if (
+      dynamicSecretCfg.keyEncoding &&
+      dynamicSecretCfg.inputCiphertext &&
+      dynamicSecretCfg.inputTag &&
+      dynamicSecretCfg.inputIV
+    ) {
+      dynamicSecretInputConfig = infisicalSymmetricDecrypt({
         keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
         ciphertext: dynamicSecretCfg.inputCiphertext,
         tag: dynamicSecretCfg.inputTag,
         iv: dynamicSecretCfg.inputIV
-      })
-    ) as object;
+      });
+    } else if (dynamicSecretCfg.encryptedConfig) {
+      dynamicSecretInputConfig = secretManagerDecryptor({
+        cipherTextBlob: dynamicSecretCfg.encryptedConfig
+      }).toString();
+    } else {
+      throw new BadRequestError({ message: "Missing secret input config" });
+    }
+
+    const decryptedStoredInput = JSON.parse(dynamicSecretInputConfig) as object;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const providerInputs = (await selectedProvider.validateProviderInputs(decryptedStoredInput)) as object;
     return { ...dynamicSecretCfg, inputs: providerInputs };