From b3e72c338f11d7b6166af0f9b93cc2b5f616cfdc Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 12 Feb 2025 20:26:19 +0400 Subject: [PATCH 1/2] Update group-dal.ts --- backend/src/ee/services/group/group-dal.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/ee/services/group/group-dal.ts b/backend/src/ee/services/group/group-dal.ts index fc38a2a9b..7702e90fb 100644 --- a/backend/src/ee/services/group/group-dal.ts +++ b/backend/src/ee/services/group/group-dal.ts @@ -111,7 +111,7 @@ export const groupDALFactory = (db: TDbClient) => { } if (search) { - void query.andWhereRaw(`CONCAT_WS(' ', "firstName", "lastName", "username") ilike '%${search}%'`); + // void query.andWhereRaw(`CONCAT_WS(' ', "firstName", "lastName", "username") ilike '%${search}%'`); } else if (username) { void query.andWhere(`${TableName.Users}.username`, "ilike", `%${username}%`); } From 296efa975c653027369aa7613c4bdb6eba35ef8d Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Wed, 12 Feb 2025 20:33:13 +0400 Subject: [PATCH 2/2] chore: fix lint --- .../20250210101840_webhook-to-kms.ts | 13 +- ...250210101841_dynamic-secret-root-to-kms.ts | 11 +- .../20250210101841_secret-rotation-to-kms.ts | 11 +- .../20250210101842_identity-k8-auth-to-kms.ts | 142 ++++++++++-------- ...0250210101842_identity-oidc-auth-to-kms.ts | 11 +- .../20250210101845_directory-config-to-kms.ts | 33 ++-- 6 files changed, 126 insertions(+), 95 deletions(-) diff --git a/backend/src/db/migrations/20250210101840_webhook-to-kms.ts b/backend/src/db/migrations/20250210101840_webhook-to-kms.ts index c9b8e7fec..a2d856388 100644 --- a/backend/src/db/migrations/20250210101840_webhook-to-kms.ts +++ b/backend/src/db/migrations/20250210101840_webhook-to-kms.ts @@ -31,7 +31,7 @@ export async function up(knex: Knex): Promise { const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex }); const projectEncryptionRingBuffer = createCircularCache>>(25); - const webhooks = await knex(TableName.Webhook) + const webhooks = await knex(TableName.Webhook) .where({}) .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.Webhook}.envId`) .select( @@ -53,10 +53,13 @@ export async function up(knex: Knex): Promise { webhooks.map(async (el) => { let projectKmsService = projectEncryptionRingBuffer.getItem(el.projectId); if (!projectKmsService) { - projectKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.SecretManager, - projectId: el.projectId - }, knex); + projectKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.SecretManager, + projectId: el.projectId + }, + knex + ); projectEncryptionRingBuffer.push(el.projectId, projectKmsService); } diff --git a/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts b/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts index 41dc6ba9f..dde1e7188 100644 --- a/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts +++ b/backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts @@ -46,10 +46,13 @@ export async function up(knex: Knex): Promise { dynamicSecretRootCredentials.map(async ({ projectId, ...el }) => { let projectKmsService = projectEncryptionRingBuffer.getItem(projectId); if (!projectKmsService) { - projectKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.SecretManager, - projectId - }, knex); + projectKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.SecretManager, + projectId + }, + knex + ); projectEncryptionRingBuffer.push(projectId, projectKmsService); } diff --git a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts index 567cace99..e11ef926e 100644 --- a/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts +++ b/backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts @@ -39,10 +39,13 @@ export async function up(knex: Knex): Promise { secretRotations.map(async ({ projectId, ...el }) => { let projectKmsService = projectEncryptionRingBuffer.getItem(projectId); if (!projectKmsService) { - projectKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.SecretManager, - projectId - }, knex); + projectKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.SecretManager, + projectId + }, + knex + ); projectEncryptionRingBuffer.push(projectId, projectKmsService); } diff --git a/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts b/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts index 3d62ab04f..934dce5e8 100644 --- a/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts +++ b/backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts @@ -76,77 +76,87 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => { ) .orderBy(`${TableName.OrgBot}.orgId` as "orgId"); - const updatedIdentityKubernetesConfigs = []; + const updatedIdentityKubernetesConfigs = []; - for (const { encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, orgId, ...el } of identityKubernetesConfigs) { - let orgKmsService = orgEncryptionRingBuffer.getItem(orgId); - - if (!orgKmsService) { - orgKmsService = await kmsService.createCipherPairWithDataKey({ + for await (const { + encryptedSymmetricKey, + symmetricKeyKeyEncoding, + symmetricKeyTag, + symmetricKeyIV, + orgId, + ...el + } of identityKubernetesConfigs) { + let orgKmsService = orgEncryptionRingBuffer.getItem(orgId); + + if (!orgKmsService) { + orgKmsService = await kmsService.createCipherPairWithDataKey( + { type: KmsDataKey.Organization, orgId - }, knex); - orgEncryptionRingBuffer.push(orgId, orgKmsService); - } - - const key = infisicalSymmetricDecrypt({ - ciphertext: encryptedSymmetricKey, - iv: symmetricKeyIV, - tag: symmetricKeyTag, - keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding - }); - - const decryptedTokenReviewerJwt = - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - el.encryptedTokenReviewerJwt && el.tokenReviewerJwtIV && el.tokenReviewerJwtTag - ? decryptSymmetric({ - key, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - iv: el.tokenReviewerJwtIV, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - tag: el.tokenReviewerJwtTag, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - ciphertext: el.encryptedTokenReviewerJwt - }) - : ""; - - const decryptedCertificate = - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - el.encryptedCaCert && el.caCertIV && el.caCertTag - ? decryptSymmetric({ - key, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - iv: el.caCertIV, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - tag: el.caCertTag, - // eslint-disable-next-line @typescript-eslint/ban-ts-comment - // @ts-ignore This will be removed in next cycle so ignore the ts missing error - ciphertext: el.encryptedCaCert - }) - : ""; - - const encryptedKubernetesTokenReviewerJwt = orgKmsService.encryptor({ - plainText: Buffer.from(decryptedTokenReviewerJwt) - }).cipherTextBlob; - const encryptedKubernetesCaCertificate = orgKmsService.encryptor({ - plainText: Buffer.from(decryptedCertificate) - }).cipherTextBlob; - - updatedIdentityKubernetesConfigs.push({ - ...el, - accessTokenTrustedIps: JSON.stringify(el.accessTokenTrustedIps), - encryptedKubernetesCaCertificate, - encryptedKubernetesTokenReviewerJwt - }); + }, + knex + ); + orgEncryptionRingBuffer.push(orgId, orgKmsService); } + const key = infisicalSymmetricDecrypt({ + ciphertext: encryptedSymmetricKey, + iv: symmetricKeyIV, + tag: symmetricKeyTag, + keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding + }); + + const decryptedTokenReviewerJwt = + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + el.encryptedTokenReviewerJwt && el.tokenReviewerJwtIV && el.tokenReviewerJwtTag + ? decryptSymmetric({ + key, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + iv: el.tokenReviewerJwtIV, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + tag: el.tokenReviewerJwtTag, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + ciphertext: el.encryptedTokenReviewerJwt + }) + : ""; + + const decryptedCertificate = + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + el.encryptedCaCert && el.caCertIV && el.caCertTag + ? decryptSymmetric({ + key, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + iv: el.caCertIV, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + tag: el.caCertTag, + // eslint-disable-next-line @typescript-eslint/ban-ts-comment + // @ts-ignore This will be removed in next cycle so ignore the ts missing error + ciphertext: el.encryptedCaCert + }) + : ""; + + const encryptedKubernetesTokenReviewerJwt = orgKmsService.encryptor({ + plainText: Buffer.from(decryptedTokenReviewerJwt) + }).cipherTextBlob; + const encryptedKubernetesCaCertificate = orgKmsService.encryptor({ + plainText: Buffer.from(decryptedCertificate) + }).cipherTextBlob; + + updatedIdentityKubernetesConfigs.push({ + ...el, + accessTokenTrustedIps: JSON.stringify(el.accessTokenTrustedIps), + encryptedKubernetesCaCertificate, + encryptedKubernetesTokenReviewerJwt + }); + } + for (let i = 0; i < updatedIdentityKubernetesConfigs.length; i += BATCH_SIZE) { // eslint-disable-next-line no-await-in-loop await knex(TableName.IdentityKubernetesAuth) diff --git a/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts b/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts index dc87726a4..011585bda 100644 --- a/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts +++ b/backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts @@ -62,10 +62,13 @@ const reencryptIdentityOidcAuth = async (knex: Knex) => { async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, orgId, ...el }) => { let orgKmsService = orgEncryptionRingBuffer.getItem(orgId); if (!orgKmsService) { - orgKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.Organization, - orgId - }, knex); + orgKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.Organization, + orgId + }, + knex + ); orgEncryptionRingBuffer.push(orgId, orgKmsService); } const key = infisicalSymmetricDecrypt({ diff --git a/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts b/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts index 05db40958..f5107b301 100644 --- a/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts +++ b/backend/src/db/migrations/20250210101845_directory-config-to-kms.ts @@ -49,10 +49,13 @@ const reencryptSamlConfig = async (knex: Knex) => { async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => { let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId); if (!orgKmsService) { - orgKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.Organization, - orgId: el.orgId - }, knex); + orgKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.Organization, + orgId: el.orgId + }, + knex + ); orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } const key = infisicalSymmetricDecrypt({ @@ -204,10 +207,13 @@ const reencryptLdapConfig = async (knex: Knex) => { async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => { let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId); if (!orgKmsService) { - orgKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.Organization, - orgId: el.orgId - }, knex); + orgKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.Organization, + orgId: el.orgId + }, + knex + ); orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } const key = infisicalSymmetricDecrypt({ @@ -353,10 +359,13 @@ const reencryptOidcConfig = async (knex: Knex) => { async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => { let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId); if (!orgKmsService) { - orgKmsService = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.Organization, - orgId: el.orgId - }, knex); + orgKmsService = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.Organization, + orgId: el.orgId + }, + knex + ); orgEncryptionRingBuffer.push(el.orgId, orgKmsService); } const key = infisicalSymmetricDecrypt({