diff --git a/backend/src/controllers/v1/integrationController.ts b/backend/src/controllers/v1/integrationController.ts index 6b633fc2c..060f89b33 100644 --- a/backend/src/controllers/v1/integrationController.ts +++ b/backend/src/controllers/v1/integrationController.ts @@ -56,7 +56,8 @@ export const createIntegration = async (req: Request, res: Response) => { // trigger event - push secrets EventService.handleEvent({ event: eventPushSecrets({ - workspaceId: integration.workspace.toString() + workspaceId: integration.workspace, + environment: sourceEnvironment }) }); } @@ -117,7 +118,8 @@ export const updateIntegration = async (req: Request, res: Response) => { // trigger event - push secrets EventService.handleEvent({ event: eventPushSecrets({ - workspaceId: integration.workspace.toString(), + workspaceId: integration.workspace, + environment }), }); } diff --git a/backend/src/controllers/v1/secretController.ts b/backend/src/controllers/v1/secretController.ts index 4b377ec72..3ec69122a 100644 --- a/backend/src/controllers/v1/secretController.ts +++ b/backend/src/controllers/v1/secretController.ts @@ -1,5 +1,6 @@ import { Request, Response } from 'express'; import * as Sentry from '@sentry/node'; +import { Types } from 'mongoose'; import { Key, Secret } from '../../models'; import { v1PushSecrets as push, @@ -84,7 +85,8 @@ export const pushSecrets = async (req: Request, res: Response) => { // trigger event - push secrets EventService.handleEvent({ event: eventPushSecrets({ - workspaceId + workspaceId: new Types.ObjectId(workspaceId), + environment }) }); diff --git a/backend/src/controllers/v2/secretsController.ts b/backend/src/controllers/v2/secretsController.ts index c7d586d85..e05e758ed 100644 --- a/backend/src/controllers/v2/secretsController.ts +++ b/backend/src/controllers/v2/secretsController.ts @@ -248,7 +248,7 @@ export const batchSecrets = async (req: Request, res: Response) => { // // trigger event - push secrets await EventService.handleEvent({ event: eventPushSecrets({ - workspaceId + workspaceId: new Types.ObjectId(workspaceId) }) }); @@ -404,7 +404,7 @@ export const createSecrets = async (req: Request, res: Response) => { // trigger event - push secrets await EventService.handleEvent({ event: eventPushSecrets({ - workspaceId + workspaceId: new Types.ObjectId(workspaceId) }) }); }, 5000); @@ -471,9 +471,7 @@ export const createSecrets = async (req: Request, res: Response) => { postHogClient.capture({ event: 'secrets added', distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData + authData: req.authData }), properties: { numberOfSecrets: listOfSecretsToCreate.length, @@ -648,9 +646,7 @@ export const getSecrets = async (req: Request, res: Response) => { postHogClient.capture({ event: 'secrets pulled', distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData + authData: req.authData }), properties: { numberOfSecrets: secrets.length, @@ -837,7 +833,7 @@ export const updateSecrets = async (req: Request, res: Response) => { setTimeout(async () => { await EventService.handleEvent({ event: eventPushSecrets({ - workspaceId: key + workspaceId: new Types.ObjectId(key) }) }); }, 10000); @@ -872,9 +868,7 @@ export const updateSecrets = async (req: Request, res: Response) => { postHogClient.capture({ event: 'secrets modified', distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData + authData: req.authData }), properties: { numberOfSecrets: workspaceSecretObj[key].length, @@ -975,7 +969,7 @@ export const deleteSecrets = async (req: Request, res: Response) => { // trigger event - push secrets await EventService.handleEvent({ event: eventPushSecrets({ - workspaceId: key + workspaceId: new Types.ObjectId(key) }) }); const deleteAction = await EELogService.createAction({ @@ -1008,9 +1002,7 @@ export const deleteSecrets = async (req: Request, res: Response) => { postHogClient.capture({ event: 'secrets deleted', distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData + authData: req.authData }), properties: { numberOfSecrets: workspaceSecretObj[key].length, diff --git a/backend/src/controllers/v2/workspaceController.ts b/backend/src/controllers/v2/workspaceController.ts index ec32dcbaf..3605656c3 100644 --- a/backend/src/controllers/v2/workspaceController.ts +++ b/backend/src/controllers/v2/workspaceController.ts @@ -95,7 +95,8 @@ export const pushWorkspaceSecrets = async (req: Request, res: Response) => { // trigger event - push secrets EventService.handleEvent({ event: eventPushSecrets({ - workspaceId + workspaceId: new Types.ObjectId(workspaceId), + environment }) }); diff --git a/backend/src/controllers/v3/secretsController.ts b/backend/src/controllers/v3/secretsController.ts index 0df6b961c..35575b7b4 100644 --- a/backend/src/controllers/v3/secretsController.ts +++ b/backend/src/controllers/v3/secretsController.ts @@ -1,6 +1,11 @@ import { Request, Response } from 'express'; import { Types } from 'mongoose'; -import { SecretService, TelemetryService } from '../../services'; +import { + SecretService, + TelemetryService, + EventService +} from '../../services'; +import { eventPushSecrets } from '../../events'; import { getAuthDataPayloadIdObj } from '../../utils/auth'; import { BadRequestError } from '../../utils/errors'; @@ -20,25 +25,6 @@ export const getSecrets = async (req: Request, res: Response) => { authData: req.authData }); - const postHogClient = TelemetryService.getPostHogClient(); - if (postHogClient) { - postHogClient.capture({ - event: 'secrets pulled', - distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData - }), - properties: { - numberOfSecrets: secrets.length, - environment, - workspaceId, - channel: req.authData.authChannel, - userAgent: req.headers?.['user-agent'] - } - }); - } - return res.status(200).send({ secrets }); @@ -62,25 +48,6 @@ export const getSecretByName = async (req: Request, res: Response) => { type, authData: req.authData }); - - const postHogClient = TelemetryService.getPostHogClient(); - if (postHogClient) { - postHogClient.capture({ - event: 'secrets pull', - distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData - }), - properties: { - numberOfSecrets: 1, - environment, - workspaceId, - channel: req.authData.authChannel, - userAgent: req.headers?.['user-agent'] - } - }); - } return res.status(200).send({ secret @@ -120,24 +87,12 @@ export const createSecret = async (req: Request, res: Response) => { secretValueTag }); - const postHogClient = TelemetryService.getPostHogClient(); - if (postHogClient) { - postHogClient.capture({ - event: 'secrets added', - distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData - }), - properties: { - numberOfSecrets: 1, - environment, - workspaceId, - channel: req.authData.authChannel, - userAgent: req.headers?.['user-agent'] - } - }); - } + await EventService.handleEvent({ + event: eventPushSecrets({ + workspaceId: new Types.ObjectId(workspaceId), + environment + }) + }); const secretWithoutBlindIndex = secret.toObject(); delete secretWithoutBlindIndex.secretBlindIndex; @@ -173,26 +128,13 @@ export const updateSecretByName = async (req: Request, res: Response) => { secretValueIV, secretValueTag }); - - - const postHogClient = TelemetryService.getPostHogClient(); - if (postHogClient) { - postHogClient.capture({ - event: 'secrets modified', - distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData - }), - properties: { - numberOfSecrets: 1, - environment, - workspaceId, - channel: req.authData.authChannel, - userAgent: req.headers?.['user-agent'] - } - }); - } + + await EventService.handleEvent({ + event: eventPushSecrets({ + workspaceId: new Types.ObjectId(workspaceId), + environment + }) + }); return res.status(200).send({ secret @@ -220,24 +162,12 @@ export const deleteSecretByName = async (req: Request, res: Response) => { authData: req.authData }); - const postHogClient = TelemetryService.getPostHogClient(); - if (postHogClient) { - postHogClient.capture({ - event: 'secrets deleted', - distinctId: TelemetryService.getDistinctId({ - user: req.user, - serviceAccount: req.serviceAccount, - serviceTokenData: req.serviceTokenData - }), - properties: { - numberOfSecrets: secrets.length, - environment, - workspaceId, - channel: req.authData.authChannel, - userAgent: req.headers?.['user-agent'] - } - }); - } + await EventService.handleEvent({ + event: eventPushSecrets({ + workspaceId: new Types.ObjectId(workspaceId), + environment + }) + }); return res.status(200).send({ secret diff --git a/backend/src/events/secret.ts b/backend/src/events/secret.ts index 479255a31..6007dd682 100644 --- a/backend/src/events/secret.ts +++ b/backend/src/events/secret.ts @@ -1,3 +1,4 @@ +import { Types } from 'mongoose'; import { EVENT_PUSH_SECRETS, EVENT_PULL_SECRETS @@ -22,13 +23,16 @@ interface PushSecret { * @returns */ const eventPushSecrets = ({ - workspaceId + workspaceId, + environment }: { - workspaceId: string; + workspaceId: Types.ObjectId; + environment?: string; }) => { return ({ name: EVENT_PUSH_SECRETS, workspaceId, + environment, payload: { } diff --git a/backend/src/helpers/bot.ts b/backend/src/helpers/bot.ts index 7b7c773ea..ff55a5e2c 100644 --- a/backend/src/helpers/bot.ts +++ b/backend/src/helpers/bot.ts @@ -151,7 +151,7 @@ const getSecretsHelper = async ({ workspaceId, environment }: { - workspaceId: string; + workspaceId: Types.ObjectId; environment: string; }) => { const content = {} as any; @@ -196,7 +196,7 @@ const getSecretsHelper = async ({ * @param {String} obj.workspaceId - id of workspace * @returns {String} key - decrypted workspace key */ -const getKey = async ({ workspaceId }: { workspaceId: string }) => { +const getKey = async ({ workspaceId }: { workspaceId: Types.ObjectId }) => { let key; try { const botKey = await BotKey.findOne({ @@ -245,7 +245,7 @@ const encryptSymmetricHelper = async ({ workspaceId, plaintext }: { - workspaceId: string; + workspaceId: Types.ObjectId; plaintext: string; }) => { @@ -282,7 +282,7 @@ const decryptSymmetricHelper = async ({ iv, tag }: { - workspaceId: string; + workspaceId: Types.ObjectId; ciphertext: string; iv: string; tag: string; diff --git a/backend/src/helpers/event.ts b/backend/src/helpers/event.ts index 4128752e5..43375814d 100644 --- a/backend/src/helpers/event.ts +++ b/backend/src/helpers/event.ts @@ -1,11 +1,13 @@ -import { Bot, IBot } from '../models'; +import { Types } from 'mongoose'; import * as Sentry from '@sentry/node'; +import { Bot, IBot } from '../models'; import { EVENT_PUSH_SECRETS } from '../variables'; import { IntegrationService } from '../services'; interface Event { name: string; - workspaceId: string; + workspaceId: Types.ObjectId; + environment?: string; payload: any; } @@ -22,7 +24,10 @@ const handleEventHelper = async ({ }: { event: Event; }) => { - const { workspaceId } = event; + const { + workspaceId, + environment + } = event; // TODO: moduralize bot check into separate function const bot = await Bot.findOne({ @@ -36,7 +41,8 @@ const handleEventHelper = async ({ switch (event.name) { case EVENT_PUSH_SECRETS: IntegrationService.syncIntegrations({ - workspaceId + workspaceId, + environment }); break; } diff --git a/backend/src/helpers/integration.ts b/backend/src/helpers/integration.ts index fbbc2f807..4d2666de4 100644 --- a/backend/src/helpers/integration.ts +++ b/backend/src/helpers/integration.ts @@ -217,14 +217,19 @@ const handleOAuthExchangeHelper = async ({ * @param {Object} obj.workspaceId - id of workspace */ const syncIntegrationsHelper = async ({ - workspaceId + workspaceId, + environment }: { - workspaceId: string; + workspaceId: Types.ObjectId; + environment?: string; }) => { let integrations; try { integrations = await Integration.find({ workspace: workspaceId, + ...(environment ? { + environment + } : {}), isActive: true, app: { $ne: null } }); @@ -234,7 +239,7 @@ const syncIntegrationsHelper = async ({ for await (const integration of integrations) { // get workspace, environment (shared) secrets const secrets = await BotService.getSecrets({ // issue here? - workspaceId: integration.workspace.toString(), + workspaceId: integration.workspace, environment: integration.environment }); @@ -281,7 +286,7 @@ const syncIntegrationsHelper = async ({ if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'}); refreshToken = await BotService.decryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, ciphertext: integrationAuth.refreshCiphertext as string, iv: integrationAuth.refreshIV as string, tag: integrationAuth.refreshTag as string @@ -318,7 +323,7 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati if (!integrationAuth) throw UnauthorizedRequestError({message: 'Failed to locate Integration Authentication credentials'}); accessToken = await BotService.decryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, ciphertext: integrationAuth.accessCiphertext as string, iv: integrationAuth.accessIV as string, tag: integrationAuth.accessTag as string @@ -340,7 +345,7 @@ const getIntegrationAuthAccessHelper = async ({ integrationAuthId }: { integrati if (integrationAuth?.accessIdCiphertext && integrationAuth?.accessIdIV && integrationAuth?.accessIdTag) { accessId = await BotService.decryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, ciphertext: integrationAuth.accessIdCiphertext as string, iv: integrationAuth.accessIdIV as string, tag: integrationAuth.accessIdTag as string @@ -386,7 +391,7 @@ const setIntegrationAuthRefreshHelper = async ({ if (!integrationAuth) throw new Error('Failed to find integration auth'); const obj = await BotService.encryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, plaintext: refreshToken }); @@ -435,14 +440,14 @@ const setIntegrationAuthAccessHelper = async ({ if (!integrationAuth) throw new Error('Failed to find integration auth'); const encryptedAccessTokenObj = await BotService.encryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, plaintext: accessToken }); let encryptedAccessIdObj; if (accessId) { encryptedAccessIdObj = await BotService.encryptSymmetric({ - workspaceId: integrationAuth.workspace.toString(), + workspaceId: integrationAuth.workspace, plaintext: accessId }); } diff --git a/backend/src/helpers/secrets.ts b/backend/src/helpers/secrets.ts index fa8af5c19..f900fb70b 100644 --- a/backend/src/helpers/secrets.ts +++ b/backend/src/helpers/secrets.ts @@ -6,21 +6,18 @@ import { UpdateSecretParams, DeleteSecretParams } from '../interfaces/services/SecretService'; +import { + AuthData +} from '../interfaces/middleware'; import { User, - IUser, ServiceAccount, - IServiceAccount, ServiceTokenData, - IServiceTokenData, Secret, ISecret, SecretBlindIndexData, } from '../models'; -import { - IAction, - SecretVersion -} from '../ee/models'; +import { SecretVersion } from '../ee/models'; import { validateMembership } from '../helpers/membership'; @@ -55,8 +52,12 @@ import { } from '../variables'; import crypto from 'crypto'; import * as argon2 from 'argon2'; -import { decryptSymmetric } from '../utils/crypto'; +import { + encryptSymmetric, + decryptSymmetric +} from '../utils/crypto'; import { getEncryptionKey } from '../config'; +import { TelemetryService } from '../services'; import { EESecretService, EELogService @@ -80,10 +81,7 @@ const validateClientForSecret = async ({ acceptedRoles, requiredPermissions }: { - authData: { - authMode: string; - authPayload: IUser | IServiceAccount | IServiceTokenData; - }, + authData: AuthData; secretId: Types.ObjectId; acceptedRoles: Array<'admin' | 'member'>; requiredPermissions: string[]; @@ -157,10 +155,7 @@ const validateClientForSecrets = async ({ secretIds, requiredPermissions }: { - authData: { - authMode: string; - authPayload: IUser | IServiceAccount | IServiceTokenData; - }, + authData: AuthData; secretIds: Types.ObjectId[]; requiredPermissions: string[]; }) => { @@ -222,6 +217,39 @@ const validateClientForSecrets = async ({ }); } +/** + * Create secret blind index data containing encrypted blind index salt + * for workspace with id [workspaceId] + * @param {Object} obj + * @param {Types.ObjectId} obj.workspaceId + */ +const createSecretBlindIndexDataHelper = async ({ + workspaceId +}: { + workspaceId: Types.ObjectId; +}) => { + // initialize random blind index salt for workspace + const salt = crypto.randomBytes(16).toString('base64'); + + const { + ciphertext: encryptedSaltCiphertext, + iv: saltIV, + tag: saltTag + } = encryptSymmetric({ + plaintext: salt, + key: getEncryptionKey() + }); + + const secretBlindIndexData = await new SecretBlindIndexData({ + workspace: workspaceId, + encryptedSaltCiphertext, + saltIV, + saltTag + }).save(); + + return secretBlindIndexData; +} + /** * Generate blind index for secret with name [secretName] * for workspace with id [workspaceId] @@ -389,6 +417,24 @@ const createSecretHelper = async ({ await EESecretService.takeSecretSnapshot({ workspaceId }); + + const postHogClient = TelemetryService.getPostHogClient(); + + if (postHogClient) { + postHogClient.capture({ + event: 'secrets added', + distinctId: TelemetryService.getDistinctId({ + authData + }), + properties: { + numberOfSecrets: 1, + environment, + workspaceId, + channel: authData.authChannel, + userAgent: authData.authUserAgent + } + }); + } return secret; } @@ -430,6 +476,7 @@ const getSecretsHelper = async ({ } })); + // (EE) create (audit) log const action = await EELogService.createAction({ name: ACTION_READ_SECRETS, ...getAuthDataPayloadIdObj(authData), @@ -445,6 +492,24 @@ const getSecretsHelper = async ({ ipAddress: authData.authIP }); + const postHogClient = TelemetryService.getPostHogClient(); + + if (postHogClient) { + postHogClient.capture({ + event: 'secrets pulled', + distinctId: TelemetryService.getDistinctId({ + authData + }), + properties: { + numberOfSecrets: secrets.length, + environment, + workspaceId, + channel: authData.authChannel, + userAgent: authData.authUserAgent + } + }); + } + return secrets; } @@ -501,6 +566,7 @@ const getSecretHelper = async ({ if (!secret) throw SecretNotFoundError(); + // (EE) create (audit) log const action = await EELogService.createAction({ name: ACTION_READ_SECRETS, ...getAuthDataPayloadIdObj(authData), @@ -516,6 +582,24 @@ const getSecretHelper = async ({ ipAddress: authData.authIP }); + const postHogClient = TelemetryService.getPostHogClient(); + + if (postHogClient) { + postHogClient.capture({ + event: 'secrets pull', + distinctId: TelemetryService.getDistinctId({ + authData + }), + properties: { + numberOfSecrets: 1, + environment, + workspaceId, + channel: authData.authChannel, + userAgent: authData.authUserAgent + } + }); + } + return secret; } @@ -610,7 +694,7 @@ const updateSecretHelper = async ({ secretValueTag }); - // // (EE) add version for new secret + // (EE) add version for new secret await EESecretService.addSecretVersions({ secretVersions: [secretVersion] }); @@ -636,6 +720,24 @@ const updateSecretHelper = async ({ workspaceId }); + const postHogClient = TelemetryService.getPostHogClient(); + + if (postHogClient) { + postHogClient.capture({ + event: 'secrets modified', + distinctId: TelemetryService.getDistinctId({ + authData + }), + properties: { + numberOfSecrets: 1, + environment, + workspaceId, + channel: authData.authChannel, + userAgent: authData.authUserAgent + } + }); + } + return secret; } @@ -728,6 +830,24 @@ const deleteSecretHelper = async ({ workspaceId }); + const postHogClient = TelemetryService.getPostHogClient(); + + if (postHogClient) { + postHogClient.capture({ + event: 'secrets deleted', + distinctId: TelemetryService.getDistinctId({ + authData + }), + properties: { + numberOfSecrets: secrets.length, + environment, + workspaceId, + channel: authData.authChannel, + userAgent: authData.authUserAgent + } + }); + } + return ({ secrets, secret @@ -737,6 +857,7 @@ const deleteSecretHelper = async ({ export { validateClientForSecret, validateClientForSecrets, + createSecretBlindIndexDataHelper, generateSecretBlindIndexHelper, createSecretHelper, getSecretsHelper, diff --git a/backend/src/helpers/workspace.ts b/backend/src/helpers/workspace.ts index 220102eff..e6be64f8c 100644 --- a/backend/src/helpers/workspace.ts +++ b/backend/src/helpers/workspace.ts @@ -30,6 +30,7 @@ import { } from '../variables'; import { getEncryptionKey } from '../config'; import { encryptSymmetric } from '../utils/crypto'; +import { SecretService } from '../services'; /** * Validate authenticated clients for workspace with id [workspaceId] based @@ -158,23 +159,9 @@ const createWorkspace = async ({ }); // initialize blind index salt for workspace - const salt = crypto.randomBytes(16).toString('base64'); - - const { - ciphertext: encryptedSaltCiphertext, - iv: saltIV, - tag: saltTag - } = encryptSymmetric({ - plaintext: salt, - key: getEncryptionKey() + await SecretService.createSecretBlindIndexData({ + workspaceId: workspace._id }); - - await new SecretBlindIndexData({ - workspace: workspace._id, - encryptedSaltCiphertext, - saltIV, - saltTag - }).save(); } catch (err) { Sentry.setUser(null); diff --git a/backend/src/interfaces/middleware/index.ts b/backend/src/interfaces/middleware/index.ts index 4b54399ce..34230de05 100644 --- a/backend/src/interfaces/middleware/index.ts +++ b/backend/src/interfaces/middleware/index.ts @@ -9,4 +9,5 @@ export interface AuthData { authPayload: IUser | IServiceAccount | IServiceTokenData; authChannel: string; authIP: string; + authUserAgent: string; } \ No newline at end of file diff --git a/backend/src/middleware/requireAuth.ts b/backend/src/middleware/requireAuth.ts index 508248b19..86ebf416c 100644 --- a/backend/src/middleware/requireAuth.ts +++ b/backend/src/middleware/requireAuth.ts @@ -91,7 +91,8 @@ const requireAuth = ({ authMode, authPayload, // User, ServiceAccount, ServiceTokenData authChannel: getChannelFromUserAgent(req.headers['user-agent']), - authIP: req.ip + authIP: req.ip, + authUserAgent: req.headers['user-agent'] ?? 'other' } return next(); diff --git a/backend/src/services/BotService.ts b/backend/src/services/BotService.ts index 792bd8e35..4e8118fbe 100644 --- a/backend/src/services/BotService.ts +++ b/backend/src/services/BotService.ts @@ -1,3 +1,4 @@ +import { Types } from 'mongoose'; import { getSecretsHelper, encryptSymmetricHelper, @@ -21,7 +22,7 @@ class BotService { workspaceId, environment }: { - workspaceId: string; + workspaceId: Types.ObjectId; environment: string; }) { return await getSecretsHelper({ @@ -41,7 +42,7 @@ class BotService { workspaceId, plaintext }: { - workspaceId: string; + workspaceId: Types.ObjectId; plaintext: string; }) { return await encryptSymmetricHelper({ @@ -65,7 +66,7 @@ class BotService { iv, tag }: { - workspaceId: string; + workspaceId: Types.ObjectId; ciphertext: string; iv: string; tag: string; diff --git a/backend/src/services/EventService.ts b/backend/src/services/EventService.ts index 9f982bf75..160086be8 100644 --- a/backend/src/services/EventService.ts +++ b/backend/src/services/EventService.ts @@ -1,8 +1,10 @@ +import { Types } from 'mongoose'; import { handleEventHelper } from '../helpers/event'; interface Event { name: string; - workspaceId: string; + workspaceId: Types.ObjectId; + environment?: string; payload: any; } diff --git a/backend/src/services/IntegrationService.ts b/backend/src/services/IntegrationService.ts index 0fd634c33..1e7409ad0 100644 --- a/backend/src/services/IntegrationService.ts +++ b/backend/src/services/IntegrationService.ts @@ -52,9 +52,11 @@ class IntegrationService { * @param {Object} obj.workspaceId - id of workspace */ static async syncIntegrations({ - workspaceId + workspaceId, + environment }: { - workspaceId: string; + workspaceId: Types.ObjectId; + environment?: string; }) { return await syncIntegrationsHelper({ workspaceId diff --git a/backend/src/services/SecretService.ts b/backend/src/services/SecretService.ts index 0275b2cfb..3682c0543 100644 --- a/backend/src/services/SecretService.ts +++ b/backend/src/services/SecretService.ts @@ -11,6 +11,7 @@ import { DeleteSecretParams } from '../interfaces/services/SecretService'; import { + createSecretBlindIndexDataHelper, generateSecretBlindIndexHelper, createSecretHelper, getSecretsHelper, @@ -20,12 +21,28 @@ import { } from '../helpers/secrets'; class SecretService { + /** + * Create secret blind index data containing encrypted blind index salt + * for workspace with id [workspaceId] + * @param {Object} obj + * @param {Types.ObjectId} obj.workspaceId + */ + static async createSecretBlindIndexData({ + workspaceId + }: { + workspaceId: Types.ObjectId; + }) { + return await createSecretBlindIndexDataHelper({ + workspaceId + }); + } + /** * Create and return blind index for secret with * name [secretName] part of workspace with id [workspaceId] * @param {Object} obj - * @param {Object} obj.secretName - name of secret to generate blind index for - * @param {Object} obj.workspaceId - id of workspace that secret belongs to + * @param {String} obj.secretName - name of secret to generate blind index for + * @param {Types.ObjectId} obj.workspaceId - id of workspace that secret belongs to */ static async generateSecretBlindIndex({ secretName, @@ -50,32 +67,8 @@ class SecretService { * @param {AuthData} obj.authData - authentication data on request * @returns */ - static async createSecret({ - secretName, - workspaceId, - environment, - type, - authData, - secretKeyCiphertext, - secretKeyIV, - secretKeyTag, - secretValueCiphertext, - secretValueIV, - secretValueTag - }: CreateSecretParams) { - return await createSecretHelper({ - secretName, - workspaceId, - environment, - type, - authData, - secretKeyCiphertext, - secretKeyIV, - secretKeyTag, - secretValueCiphertext, - secretValueIV, - secretValueTag - }); + static async createSecret(createSecretParams: CreateSecretParams) { + return await createSecretHelper(createSecretParams); } /** @@ -86,16 +79,8 @@ class SecretService { * @param {AuthData} obj.authData - authentication data on request * @returns */ - static async getSecrets({ - workspaceId, - environment, - authData - }: GetSecretsParams) { - return await getSecretsHelper({ - workspaceId, - environment, - authData - }); + static async getSecrets(getSecretsParams: GetSecretsParams) { + return await getSecretsHelper(getSecretsParams); } /** @@ -108,20 +93,8 @@ class SecretService { * @param {AuthData} obj.authData - authentication data on request * @returns */ - static async getSecret({ - secretName, - workspaceId, - environment, - type, - authData - }: GetSecretParams) { - return await getSecretHelper({ - secretName, - workspaceId, - environment, - type, - authData - }); + static async getSecret(getSecretParams: GetSecretParams) { + return await getSecretHelper(getSecretParams); } /** @@ -137,26 +110,8 @@ class SecretService { * @param {AuthData} obj.authData - authentication data on request * @returns */ - static async updateSecret({ - secretName, - workspaceId, - environment, - type, - secretValueCiphertext, - secretValueIV, - secretValueTag, - authData - }: UpdateSecretParams) { - return await updateSecretHelper({ - secretName, - workspaceId, - environment, - type, - authData, - secretValueCiphertext, - secretValueIV, - secretValueTag - }); + static async updateSecret(updateSecretParams: UpdateSecretParams) { + return await updateSecretHelper(updateSecretParams); } /** @@ -169,20 +124,8 @@ class SecretService { * @param {AuthData} obj.authData - authentication data on request * @returns */ - static async deleteSecret({ - secretName, - workspaceId, - environment, - type, - authData - }: DeleteSecretParams) { - return await deleteSecretHelper({ - secretName, - workspaceId, - environment, - type, - authData - }); + static async deleteSecret(deleteSecretParams: DeleteSecretParams) { + return await deleteSecretHelper(deleteSecretParams); } } diff --git a/backend/src/services/TelemetryService.ts b/backend/src/services/TelemetryService.ts index 6e35a403f..be9857d99 100644 --- a/backend/src/services/TelemetryService.ts +++ b/backend/src/services/TelemetryService.ts @@ -1,5 +1,6 @@ import { PostHog } from 'posthog-node'; import { getLogger } from '../utils/logger'; +import { AuthData } from '../interfaces/middleware'; import { getNodeEnv, getTelemetryEnabled, @@ -11,7 +12,8 @@ import { User, IServiceAccount, ServiceAccount, - IServiceTokenData + IServiceTokenData, + ServiceTokenData } from '../models'; import { BadRequestError @@ -48,42 +50,27 @@ class Telemetry { return postHogClient; } - /** - * Return a distinct id for client to be used for logging telemetry - */ - static getDistinctId = ({ - user, - serviceAccount, - serviceTokenData + static getDistinctId ({ + authData }: { - user?: IUser; - serviceAccount?: IServiceAccount; - serviceTokenData?: any; // TODO: fix (it's ServiceTokenData with user populated) - }) => { - - // TODO: modify to accept authData instead - - let distinctId = ''; - - if (user) { - distinctId = user.email; + authData: AuthData; + }) { + let distinctId: any = ''; + if (authData.authPayload instanceof User) { + distinctId = authData.authPayload.email; + } else if (authData.authPayload instanceof ServiceAccount) { + distinctId = `sa.${authData.authPayload._id.toString()}`; + } else if (authData.authPayload instanceof ServiceTokenData) { + if (authData.authPayload.user instanceof User) { + distinctId = authData.authPayload?.user.email; + } else if (authData.authPayload?.serviceAccount) { + distinctId = distinctId = `sa.${authData.authPayload.serviceAccount.toString()}`; + } } - if (serviceAccount) { - distinctId = `sa.${serviceAccount._id.toString()}`; - } - - if (serviceTokenData?.user && serviceTokenData?.user instanceof User) { - distinctId = serviceTokenData.user.email; - } else if (serviceTokenData?.serviceAccount && serviceTokenData?.serviceAccount instanceof ServiceAccount) { - distinctId = `sa.${serviceTokenData.serviceAccount._id.toString()}`; - } - - if (distinctId === '') { - throw BadRequestError({ - message: 'Failed to obtain distinct id for logging telemetry' - }); - } + if (distinctId === '') throw BadRequestError({ + message: 'Failed to obtain distinct id for logging telemetry' + }); return distinctId; }