awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated codebase for new field changes made on project level enc migration

Browse Source
This commit is contained in:
=
2024-11-29 14:23:34 +05:30
parent 3e5a58eec4
commit 5f6870fda8
19 changed files with 254 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
backend/src/db/migrations/20241127091918_webhook-to-kms.ts
View File

@@ -33,7 +33,18 @@ export async function up(knex: Knex): Promise<void> {
const webhooks = await knex(TableName.Webhook)
.where({})
.leftJoin(TableName.Environment, `${TableName.Environment}.id`, `${TableName.Webhook}.envId`)
.select("url", "encryptedSecretKey", "iv", "tag", "keyEncoding", "urlCipherText", "urlIV", "urlTag", "id", "envId")
.select(
"url",
"encryptedSecretKey",
"iv",
"tag",
"keyEncoding",
"urlCipherText",
"urlIV",
"urlTag",
knex.ref("id").withSchema(TableName.Webhook),
"envId"
)
.select(knex.ref("projectId").withSchema(TableName.Environment));
const updatedWebhooks = await Promise.all(
@@ -55,7 +66,9 @@ export async function up(knex: Knex): Promise<void> {
tag: el.tag,
ciphertext: el.encryptedSecretKey
});
encryptedSecretKey = projectKmsService.encryptor({ plainText: Buffer.from(decyptedSecretKey, "utf8") });
encryptedSecretKey = projectKmsService.encryptor({
plainText: Buffer.from(decyptedSecretKey, "utf8")
}).cipherTextBlob;
}
const decryptedUrl =
@@ -68,7 +81,9 @@ export async function up(knex: Knex): Promise<void> {
})
: null;
const encryptedUrl = projectKmsService.encryptor({ plainText: Buffer.from(decryptedUrl || el.url) });
const encryptedUrl = projectKmsService.encryptor({
plainText: Buffer.from(decryptedUrl || el.url)
}).cipherTextBlob;
return { id: el.id, encryptedUrl, encryptedSecretKey, envId: el.envId };
})
);

30
backend/src/db/migrations/20241128090536_secret-rotation-to-kms.ts
View File

@@ -3,6 +3,7 @@ import { Knex } from "knex";
import { inMemoryKeyStore } from "@app/keystore/memory";
import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
import { selectAllTableCols } from "@app/lib/knex";
import { initLogger } from "@app/lib/logger";
import { KmsDataKey } from "@app/services/kms/kms-types";
import { SecretKeyEncoding, TableName } from "../schemas";
@@ -21,6 +22,7 @@ export async function up(knex: Knex): Promise<void> {
});
}
await initLogger();
const envConfig = getMigrationEnvConfig();
const keyStore = inMemoryKeyStore();
const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
@@ -33,31 +35,39 @@ export async function up(knex: Knex): Promise<void> {
.select(knex.ref("projectId").withSchema(TableName.Environment));
const updatedRotationData = await Promise.all(
secretRotations.map(async (el) => {
let projectKmsService = projectEncryptionRingBuffer.getItem(el.projectId);
secretRotations.map(async ({ projectId, ...el }) => {
let projectKmsService = projectEncryptionRingBuffer.getItem(projectId);
if (!projectKmsService) {
projectKmsService = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.SecretManager,
projectId: el.projectId
projectId
});
projectEncryptionRingBuffer.push(el.projectId, projectKmsService);
projectEncryptionRingBuffer.push(projectId, projectKmsService);
}
const decryptedRotationData =
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
el.encryptedDataTag && el.encryptedDataIV && el.encryptedData && el.keyEncoding
? infisicalSymmetricDecrypt({
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
keyEncoding: el.keyEncoding as SecretKeyEncoding,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
iv: el.encryptedDataIV,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
tag: el.encryptedDataTag,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
ciphertext: el.encryptedData
})
: null;
: "";
const encryptedRotationData = decryptedRotationData
? projectKmsService.encryptor({
plainText: Buffer.from(decryptedRotationData)
})
: null;
const encryptedRotationData = projectKmsService.encryptor({
plainText: Buffer.from(decryptedRotationData)
}).cipherTextBlob;
return { ...el, encryptedRotationData };
})
);

31
backend/src/db/migrations/20241128092853_dynamic-secret-root-to-kms.ts
View File

@@ -3,6 +3,7 @@ import { Knex } from "knex";
import { inMemoryKeyStore } from "@app/keystore/memory";
import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
import { selectAllTableCols } from "@app/lib/knex";
import { initLogger } from "@app/lib/logger";
import { KmsDataKey } from "@app/services/kms/kms-types";
import { SecretKeyEncoding, TableName } from "../schemas";
@@ -21,6 +22,7 @@ export async function up(knex: Knex): Promise<void> {
});
}
await initLogger();
const envConfig = getMigrationEnvConfig();
const keyStore = inMemoryKeyStore();
const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
@@ -34,31 +36,40 @@ export async function up(knex: Knex): Promise<void> {
.select(knex.ref("projectId").withSchema(TableName.Environment));
const updatedDynamicSecrets = await Promise.all(
dynamicSecretRootCredentials.map(async (el) => {
let projectKmsService = projectEncryptionRingBuffer.getItem(el.projectId);
dynamicSecretRootCredentials.map(async ({ projectId, ...el }) => {
let projectKmsService = projectEncryptionRingBuffer.getItem(projectId);
if (!projectKmsService) {
projectKmsService = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.SecretManager,
projectId: el.projectId
projectId
});
projectEncryptionRingBuffer.push(el.projectId, projectKmsService);
projectEncryptionRingBuffer.push(projectId, projectKmsService);
}
const decryptedInputData =
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
el.inputIV && el.inputTag && el.inputCiphertext && el.keyEncoding
? infisicalSymmetricDecrypt({
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
keyEncoding: el.keyEncoding as SecretKeyEncoding,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
iv: el.inputIV,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
tag: el.inputTag,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore This will be removed in next cycle so ignore the ts missing error
ciphertext: el.inputCiphertext
})
: null;
: "";
const encryptedInput = projectKmsService.encryptor({
plainText: Buffer.from(decryptedInputData)
}).cipherTextBlob;
const encryptedInput = decryptedInputData
? projectKmsService.encryptor({
plainText: Buffer.from(decryptedInputData)
})
: null;
return { ...el, encryptedInput };
})
);

3
backend/src/db/migrations/utils/services.ts
View File

@@ -19,6 +19,8 @@ type TDependencies = {
};
export const getMigrationEncryptionServices = async ({ envConfig, db, keyStore }: TDependencies) => {
// eslint-disable-next-line no-param-reassign
db.replicaNode = () => db;
const hsmModule = initializeHsmModule(envConfig);
hsmModule.initialize();
@@ -45,6 +47,7 @@ export const getMigrationEncryptionServices = async ({ envConfig, db, keyStore }
});
await hsmService.startService();
await kmsService.startService();
return { kmsService };
};