diff --git a/backend/src/services/kms/kms-service.ts b/backend/src/services/kms/kms-service.ts index 08465284b..d5a48ddef 100644 --- a/backend/src/services/kms/kms-service.ts +++ b/backend/src/services/kms/kms-service.ts @@ -102,6 +102,13 @@ export const kmsServiceFactory = ({ return doc; }; + const deleteInternalKms = async (kmsId: string, orgId: string, tx?: Knex) => { + const kms = await kmsDAL.findByIdWithAssociatedKms(kmsId, tx); + if (kms.isExternal) return; + if (kms.orgId !== orgId) throw new BadRequestError({ message: "KMS doesn't belong to organization" }); + return kmsDAL.deleteById(kmsId, tx); + }; + /* * Simple encryption service function to do all the encryption tasks in infisical * This can be even later exposed directly as api for encryption as function @@ -794,6 +801,7 @@ export const kmsServiceFactory = ({ return { startService, generateKmsKey, + deleteInternalKms, encryptWithKmsKey, decryptWithKmsKey, encryptWithInputKey, diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index bfb7fcbab..d1f393e7b 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -81,6 +81,7 @@ type TProjectServiceFactoryDep = { | "loadProjectKeyBackup" | "getKmsById" | "getProjectSecretManagerKmsKeyId" + | "deleteInternalKms" >; }; @@ -337,7 +338,12 @@ export const projectServiceFactory = ({ const deletedProject = await projectDAL.transaction(async (tx) => { const delProject = await projectDAL.deleteById(project.id, tx); const projectGhostUser = await projectMembershipDAL.findProjectGhostUser(project.id, tx).catch(() => null); - + if (delProject.kmsCertificateKeyId) { + await kmsService.deleteInternalKms(delProject.kmsCertificateKeyId, delProject.orgId, tx); + } + if (delProject.kmsSecretManagerKeyId) { + await kmsService.deleteInternalKms(delProject.kmsSecretManagerKeyId, delProject.orgId, tx); + } // Delete the org membership for the ghost user if it's found. if (projectGhostUser) { await userDAL.deleteById(projectGhostUser.id, tx); diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/E2EESection/E2EESection.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/E2EESection/E2EESection.tsx deleted file mode 100644 index f0f921834..000000000 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/E2EESection/E2EESection.tsx +++ /dev/null @@ -1,38 +0,0 @@ -import Link from "next/link"; - -import { UpgradeProjectAlert } from "@app/components/v2/UpgradeProjectAlert"; -import { useWorkspace } from "@app/context"; -import { useGetWorkspaceBot } from "@app/hooks/api"; -import { ProjectVersion } from "@app/hooks/api/workspace/types"; - -export const E2EESection = () => { - const { currentWorkspace } = useWorkspace(); - const { data: bot } = useGetWorkspaceBot(currentWorkspace?.id ?? ""); - - if (!currentWorkspace) return null; - - return bot && currentWorkspace.version === ProjectVersion.V1 ? ( -
End-to-End Encryption
-
- We are updating our encryption logic to make sure that Infisical can be the most versatile
- secret management platform.
-
- Upgrading the project version is required to continue receiving the latest improvements and
- patches.
-