feat(infisical-pg): fixed org bot gone missing

backend-pg/src/db/seed-data.ts

@@ -6,7 +6,7 @@ import nacl from "tweetnacl";
 import { encodeBase64 } from "tweetnacl-util";
 
 import {
-  decryptAsymmetric,
+  // decryptAsymmetric,
   decryptSymmetric,
   encryptAsymmetric,
   encryptSymmetric
@@ -110,9 +110,9 @@ export const getUserPrivateKey = async (password: string, user: TUserEncryptionK
   });
   if (!derivedKey) throw new Error("Failed to derive key from password");
   const key = decryptSymmetric({
-    ciphertext: user.protectedKey,
+    ciphertext: user.protectedKey as string,
-    iv: user.protectedKeyIV,
+    iv: user.protectedKeyIV as string,
-    tag: user.protectedKeyTag,
+    tag: user.protectedKeyTag as string,
     key: derivedKey.toString("base64")
   });
   const privateKey = decryptSymmetric({

backend-pg/src/ee/services/saml-config/saml-config-service.ts

@@ -12,7 +12,10 @@ import { getConfig } from "@app/lib/config/env";
 import {
   decryptSymmetric,
   encryptSymmetric,
-  infisicalSymmetricDecrypt
+  generateAsymmetricKeyPair,
+  generateSymmetricKey,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
 } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 import { AuthTokenType } from "@app/services/auth/auth-type";
@@ -39,7 +42,7 @@ type TSamlConfigServiceFactoryDep = {
     TOrgDALFactory,
     "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById"
   >;
-  orgBotDAL: Pick<TOrgBotDALFactory, "findOne">;
+  orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "create" | "transaction">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
@@ -77,9 +80,47 @@ export const samlConfigServiceFactory = ({
           "Failed to update SAML SSO configuration due to plan restriction. Upgrade plan to update SSO configuration."
       });
 
-    const orgBot = await orgBotDAL.findOne({ orgId });
+    const orgBot = await orgBotDAL.transaction(async (tx) => {
-    if (!orgBot)
+      const doc = await orgBotDAL.findOne({ orgId }, tx);
-      throw new BadRequestError({ message: "Org bot not found", name: "OrgBotNotFound" });
+      if (doc) return doc;
+
+      const { privateKey, publicKey } = generateAsymmetricKeyPair();
+      const key = generateSymmetricKey();
+      const {
+        ciphertext: encryptedPrivateKey,
+        iv: privateKeyIV,
+        tag: privateKeyTag,
+        encoding: privateKeyKeyEncoding,
+        algorithm: privateKeyAlgorithm
+      } = infisicalSymmetricEncypt(privateKey);
+      const {
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        encoding: symmetricKeyKeyEncoding,
+        algorithm: symmetricKeyAlgorithm
+      } = infisicalSymmetricEncypt(key);
+
+      return orgBotDAL.create(
+        {
+          name: "Infisical org bot",
+          publicKey,
+          privateKeyIV,
+          encryptedPrivateKey,
+          symmetricKeyIV,
+          symmetricKeyTag,
+          encryptedSymmetricKey,
+          symmetricKeyAlgorithm,
+          orgId,
+          privateKeyTag,
+          privateKeyAlgorithm,
+          privateKeyKeyEncoding,
+          symmetricKeyKeyEncoding
+        },
+        tx
+      );
+    });
+
     const key = infisicalSymmetricDecrypt({
       ciphertext: orgBot.encryptedSymmetricKey,
       iv: orgBot.symmetricKeyIV,
@@ -346,7 +387,7 @@ export const samlConfigServiceFactory = ({
             }
           : {})
       },
-      appCfg.JWT_AUTH_SECRET,
+      appCfg.AUTH_SECRET,
       {
         expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME
       }

backend-pg/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -273,7 +273,7 @@ export const secretRotationQueueFactory = ({
         properties: {
           numberOfSecrets: encryptedSecrets.length,
           environment: secretRotation.environment.slug,
-          folderId: "",
+          secretPath: secretRotation.secretPath,
           workspaceId: secretRotation.projectId
         }
       });