add auto redeploy, new secrets api, and new service token

2026-10-02 17:25:44 +00:00 · 2023-01-15 16:47:09 -08:00
parent e552be0a81
commit 63f22c554a
14 changed files with 630 additions and 301 deletions
@@ -0,0 +1,187 @@
+package util
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+
+	"github.com/Infisical/infisical/k8-operator/packages/api"
+	"github.com/Infisical/infisical/k8-operator/packages/crypto"
+	"github.com/go-resty/resty/v2"
+)
+
+type SingleEnvironmentVariable struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+	Type  string `json:"type"`
+	ID    string `json:"_id"`
+}
+
+type DecodedSymmetricEncryptionDetails = struct {
+	Cipher []byte
+	IV     []byte
+	Tag    []byte
+	Key    []byte
+}
+
+func VerifyServiceToken(serviceToken string) (string, error) {
+	serviceTokenParts := strings.SplitN(serviceToken, ".", 4)
+	if len(serviceTokenParts) < 4 {
+		return "", fmt.Errorf("invalid service token entered. Please double check your service token and try again")
+	}
+
+	serviceToken = fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
+	return serviceToken, nil
+}
+
+func GetServiceTokenDetails(infisicalToken string) (api.GetServiceTokenDetailsResponse, error) {
+	serviceTokenParts := strings.SplitN(infisicalToken, ".", 4)
+	if len(serviceTokenParts) < 4 {
+		return api.GetServiceTokenDetailsResponse{}, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
+	}
+
+	serviceToken := fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
+
+	httpClient := resty.New()
+	httpClient.SetAuthToken(serviceToken).
+		SetHeader("Accept", "application/json")
+
+	serviceTokenDetails, err := api.CallGetServiceTokenDetailsV2(httpClient)
+	if err != nil {
+		return api.GetServiceTokenDetailsResponse{}, fmt.Errorf("unable to get service token details. [err=%v]", err)
+	}
+
+	return serviceTokenDetails, nil
+}
+
+func GetPlainTextSecretsViaServiceToken(fullServiceToken string, etag string) ([]SingleEnvironmentVariable, api.GetEncryptedSecretsV2Response, error) {
+	serviceTokenParts := strings.SplitN(fullServiceToken, ".", 4)
+	if len(serviceTokenParts) < 4 {
+		return nil, api.GetEncryptedSecretsV2Response{}, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
+	}
+
+	serviceToken := fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
+
+	httpClient := resty.New()
+	httpClient.SetAuthToken(serviceToken).
+		SetHeader("Accept", "application/json")
+
+	serviceTokenDetails, err := api.CallGetServiceTokenDetailsV2(httpClient)
+	if err != nil {
+		return nil, api.GetEncryptedSecretsV2Response{}, fmt.Errorf("unable to get service token details. [err=%v]", err)
+	}
+
+	encryptedSecretsResponse, err := api.CallGetSecretsV2(httpClient, api.GetEncryptedSecretsV2Request{
+		WorkspaceId:     serviceTokenDetails.Workspace,
+		EnvironmentName: serviceTokenDetails.Environment,
+		ETag:            etag,
+	})
+
+	if err != nil {
+		return nil, api.GetEncryptedSecretsV2Response{}, err
+	}
+
+	decodedSymmetricEncryptionDetails, err := GetBase64DecodedSymmetricEncryptionDetails(serviceTokenParts[3], serviceTokenDetails.EncryptedKey, serviceTokenDetails.Iv, serviceTokenDetails.Tag)
+	if err != nil {
+		return nil, api.GetEncryptedSecretsV2Response{}, fmt.Errorf("unable to decode symmetric encryption details [err=%v]", err)
+	}
+
+	plainTextWorkspaceKey, err := crypto.DecryptSymmetric([]byte(serviceTokenParts[3]), decodedSymmetricEncryptionDetails.Cipher, decodedSymmetricEncryptionDetails.Tag, decodedSymmetricEncryptionDetails.IV)
+	if err != nil {
+		return nil, api.GetEncryptedSecretsV2Response{}, fmt.Errorf("unable to decrypt the required workspace key")
+	}
+
+	plainTextSecrets, err := GetPlainTextSecrets(plainTextWorkspaceKey, encryptedSecretsResponse)
+	if err != nil {
+		return nil, api.GetEncryptedSecretsV2Response{}, fmt.Errorf("unable to decrypt your secrets [err=%v]", err)
+	}
+
+	return plainTextSecrets, encryptedSecretsResponse, nil
+}
+
+func GetBase64DecodedSymmetricEncryptionDetails(key string, cipher string, IV string, tag string) (DecodedSymmetricEncryptionDetails, error) {
+	cipherx, err := base64.StdEncoding.DecodeString(cipher)
+	if err != nil {
+		return DecodedSymmetricEncryptionDetails{}, fmt.Errorf("Base64DecodeSymmetricEncryptionDetails: Unable to decode cipher text [err=%v]", err)
+	}
+
+	keyx, err := base64.StdEncoding.DecodeString(key)
+	if err != nil {
+		return DecodedSymmetricEncryptionDetails{}, fmt.Errorf("Base64DecodeSymmetricEncryptionDetails: Unable to decode key [err=%v]", err)
+	}
+
+	IVx, err := base64.StdEncoding.DecodeString(IV)
+	if err != nil {
+		return DecodedSymmetricEncryptionDetails{}, fmt.Errorf("Base64DecodeSymmetricEncryptionDetails: Unable to decode IV [err=%v]", err)
+	}
+
+	tagx, err := base64.StdEncoding.DecodeString(tag)
+	if err != nil {
+		return DecodedSymmetricEncryptionDetails{}, fmt.Errorf("Base64DecodeSymmetricEncryptionDetails: Unable to decode tag [err=%v]", err)
+	}
+
+	return DecodedSymmetricEncryptionDetails{
+		Key:    keyx,
+		Cipher: cipherx,
+		IV:     IVx,
+		Tag:    tagx,
+	}, nil
+}
+
+func GetPlainTextSecrets(key []byte, encryptedSecretsResponse api.GetEncryptedSecretsV2Response) ([]SingleEnvironmentVariable, error) {
+	plainTextSecrets := []SingleEnvironmentVariable{}
+	for _, secret := range encryptedSecretsResponse.Secrets {
+		// Decrypt key
+		key_iv, err := base64.StdEncoding.DecodeString(secret.SecretKeyIV)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret IV for secret key")
+		}
+
+		key_tag, err := base64.StdEncoding.DecodeString(secret.SecretKeyTag)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret authentication tag for secret key")
+		}
+
+		key_ciphertext, err := base64.StdEncoding.DecodeString(secret.SecretKeyCiphertext)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret cipher text for secret key")
+		}
+
+		plainTextKey, err := crypto.DecryptSymmetric(key, key_ciphertext, key_tag, key_iv)
+		if err != nil {
+			return nil, fmt.Errorf("unable to symmetrically decrypt secret key")
+		}
+
+		// Decrypt value
+		value_iv, err := base64.StdEncoding.DecodeString(secret.SecretValueIV)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret IV for secret value")
+		}
+
+		value_tag, err := base64.StdEncoding.DecodeString(secret.SecretValueTag)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret authentication tag for secret value")
+		}
+
+		value_ciphertext, _ := base64.StdEncoding.DecodeString(secret.SecretValueCiphertext)
+		if err != nil {
+			return nil, fmt.Errorf("unable to decode secret cipher text for secret key")
+		}
+
+		plainTextValue, err := crypto.DecryptSymmetric(key, value_ciphertext, value_tag, value_iv)
+		if err != nil {
+			return nil, fmt.Errorf("unable to symmetrically decrypt secret value")
+		}
+
+		plainTextSecret := SingleEnvironmentVariable{
+			Key:   string(plainTextKey),
+			Value: string(plainTextValue),
+			Type:  string(secret.Type),
+			ID:    secret.ID,
+		}
+
+		plainTextSecrets = append(plainTextSecrets, plainTextSecret)
+	}
+
+	return plainTextSecrets, nil
+}