awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-13 19:29:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: hsm improvements

Browse Source
This commit is contained in:
Daniel Hougaard
2025-10-21 00:12:44 +04:00
parent e4c75cbb89
commit 76aacaa627
6 changed files with 173 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/crypto/cryptography/crypto.ts
+15
View File
@@ -258,6 +258,13 @@ const cryptographyFactory = () => {
const rootEncryptionKey = appCfg.ROOT_ENCRYPTION_KEY;
const encryptionKey = appCfg.ENCRYPTION_KEY;
// Sanity check
if (!rootEncryptionKey && !encryptionKey) {
throw new CryptographyError({
message: "Tried to encrypt with instance root encryption key, but no root encryption key is set."
});
}
if (rootEncryptionKey) {
const { iv, tag, ciphertext } = encrypt({
plaintext: data,
@@ -303,6 +310,14 @@ const cryptographyFactory = () => {
// the or gate is used used in migration
const rootEncryptionKey = appCfg?.ROOT_ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY;
const encryptionKey = appCfg?.ENCRYPTION_KEY || process.env.ENCRYPTION_KEY;
// Sanity check
if (!rootEncryptionKey && !encryptionKey) {
throw new CryptographyError({
message: "Tried to decrypt with instance root encryption key, but no root encryption key is set."
});
}
if (rootEncryptionKey && keyEncoding === SecretKeyEncoding.BASE64) {
const data = symmetric().decrypt({
key: rootEncryptionKey,