awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 00:29:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add back hashed hex for secret sharing

Browse Source
This commit is contained in:
Tuan Dang
2024-07-30 07:16:03 -07:00
parent 0d4164ea81
commit 7cbd254f06
16 changed files with 100 additions and 322 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/20240728010334_secret-sharing-name.ts
-7
View File
@@ -17,13 +17,6 @@ export async function up(knex: Knex): Promise<void> {
t.timestamp("lastViewedAt").nullable();
});
}
const doesHashedHexExist = await knex.schema.hasColumn(TableName.SecretSharing, "hashedHex");
if (doesHashedHexExist) {
await knex.schema.alterTable(TableName.SecretSharing, (t) => {
t.dropColumn("hashedHex");
});
}
}
}
backend/src/db/schemas/secret-sharing.ts
+1
View File
@@ -12,6 +12,7 @@ export const SecretSharingSchema = z.object({
encryptedValue: z.string(),
iv: z.string(),
tag: z.string(),
hashedHex: z.string(),
expiresAt: z.date(),
userId: z.string().uuid().nullable().optional(),
orgId: z.string().uuid().nullable().optional(),
backend/src/server/routes/v1/secret-sharing-router.ts
+11 -10
View File
@@ -57,6 +57,9 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
params: z.object({
id: z.string().uuid()
}),
querystring: z.object({
hashedHex: z.string().min(1)
}),
response: {
200: SecretSharingSchema.pick({
encryptedValue: true,
@@ -71,10 +74,11 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
}
},
handler: async (req) => {
const sharedSecret = await req.server.services.secretSharing.getActiveSharedSecretById(
req.params.id,
req.permission?.orgId
);
const sharedSecret = await req.server.services.secretSharing.getActiveSharedSecretById({
sharedSecretId: req.params.id,
hashedHex: req.query.hashedHex,
orgId: req.permission?.orgId
});
if (!sharedSecret) return undefined;
return {
encryptedValue: sharedSecret.encryptedValue,
@@ -97,6 +101,7 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
schema: {
body: z.object({
encryptedValue: z.string(),
hashedHex: z.string(),
iv: z.string(),
tag: z.string(),
expiresAt: z.string(),
@@ -109,13 +114,8 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
}
},
handler: async (req) => {
const { encryptedValue, iv, tag, expiresAt, expiresAfterViews } = req.body;
const sharedSecret = await req.server.services.secretSharing.createPublicSharedSecret({
encryptedValue,
iv,
tag,
expiresAt,
expiresAfterViews,
...req.body,
accessType: SecretSharingAccessType.Anyone
});
return { id: sharedSecret.id };
@@ -132,6 +132,7 @@ export const registerSecretSharingRouter = async (server: FastifyZodProvider) =>
body: z.object({
name: z.string().max(50).optional(),
encryptedValue: z.string(),
hashedHex: z.string(),
iv: z.string(),
tag: z.string(),
expiresAt: z.string(),
backend/src/services/secret-sharing/secret-sharing-service.ts
+32 -19
View File
@@ -8,6 +8,7 @@ import {
TCreatePublicSharedSecretDTO,
TCreateSharedSecretDTO,
TDeleteSharedSecretDTO,
TGetActiveSharedSecretByIdDTO,
TGetSharedSecretsDTO
} from "./secret-sharing-types";
@@ -24,21 +25,21 @@ export const secretSharingServiceFactory = ({
secretSharingDAL,
orgDAL
}: TSecretSharingServiceFactoryDep) => {
const createSharedSecret = async (createSharedSecretInput: TCreateSharedSecretDTO) => {
const {
actor,
actorId,
orgId,
actorAuthMethod,
actorOrgId,
encryptedValue,
iv,
tag,
name,
accessType,
expiresAt,
expiresAfterViews
} = createSharedSecretInput;
const createSharedSecret = async ({
actor,
actorId,
orgId,
actorAuthMethod,
actorOrgId,
encryptedValue,
hashedHex,
iv,
tag,
name,
accessType,
expiresAt,
expiresAfterViews
}: TCreateSharedSecretDTO) => {
const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
if (!permission) throw new UnauthorizedError({ name: "User not in org" });
@@ -62,6 +63,7 @@ export const secretSharingServiceFactory = ({
const newSharedSecret = await secretSharingDAL.create({
name,
encryptedValue,
hashedHex,
iv,
tag,
expiresAt: new Date(expiresAt),
@@ -74,8 +76,15 @@ export const secretSharingServiceFactory = ({
return { id: newSharedSecret.id };
};
const createPublicSharedSecret = async (createSharedSecretInput: TCreatePublicSharedSecretDTO) => {
const { encryptedValue, iv, tag, expiresAt, expiresAfterViews, accessType } = createSharedSecretInput;
const createPublicSharedSecret = async ({
encryptedValue,
hashedHex,
iv,
tag,
expiresAt,
expiresAfterViews,
accessType
}: TCreatePublicSharedSecretDTO) => {
if (new Date(expiresAt) < new Date()) {
throw new BadRequestError({ message: "Expiration date cannot be in the past" });
}
@@ -95,6 +104,7 @@ export const secretSharingServiceFactory = ({
const newSharedSecret = await secretSharingDAL.create({
encryptedValue,
hashedHex,
iv,
tag,
expiresAt: new Date(expiresAt),
@@ -142,8 +152,11 @@ export const secretSharingServiceFactory = ({
};
};
const getActiveSharedSecretById = async (sharedSecretId: string, orgId?: string) => {
const sharedSecret = await secretSharingDAL.findOne({ id: sharedSecretId });
const getActiveSharedSecretById = async ({ sharedSecretId, hashedHex, orgId }: TGetActiveSharedSecretByIdDTO) => {
const sharedSecret = await secretSharingDAL.findOne({
id: sharedSecretId,
hashedHex
});
if (!sharedSecret)
throw new NotFoundError({
message: "Shared secret not found"
backend/src/services/secret-sharing/secret-sharing-types.ts
+7
View File
@@ -19,6 +19,7 @@ export type TSharedSecretPermission = {
export type TCreatePublicSharedSecretDTO = {
encryptedValue: string;
hashedHex: string;
iv: string;
tag: string;
expiresAt: string;
@@ -26,6 +27,12 @@ export type TCreatePublicSharedSecretDTO = {
accessType: SecretSharingAccessType;
};
export type TGetActiveSharedSecretByIdDTO = {
sharedSecretId: string;
hashedHex: string;
orgId?: string;
};
export type TCreateSharedSecretDTO = TSharedSecretPermission & TCreatePublicSharedSecretDTO;
export type TDeleteSharedSecretDTO = {