feat: sanitized project schema on routes to avoid exposing encrypted keys

backend/src/server/routes/sanitizedSchemas.ts

@@ -5,6 +5,7 @@ import {
   IdentityProjectAdditionalPrivilegeSchema,
   IntegrationAuthsSchema,
   ProjectRolesSchema,
+  ProjectsSchema,
   SecretApprovalPoliciesSchema,
   UsersSchema
 } from "@app/db/schemas";
@@ -141,3 +142,18 @@ export const SanitizedAuditLogStreamSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date()
 });
+
+export const SanitizedProjectSchema = ProjectsSchema.pick({
+  id: true,
+  name: true,
+  slug: true,
+  autoCapitalization: true,
+  orgId: true,
+  createdAt: true,
+  updatedAt: true,
+  version: true,
+  upgradeStatus: true,
+  pitVersionLimit: true,
+  kmsCertificateKeyId: true,
+  auditLogsRetentionDays: true
+});

backend/src/server/routes/v1/identity-router.ts

@@ -1,12 +1,6 @@
 import { z } from "zod";
 
-import {
-  IdentitiesSchema,
-  IdentityOrgMembershipsSchema,
-  OrgMembershipRole,
-  OrgRolesSchema,
-  ProjectsSchema
-} from "@app/db/schemas";
+import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { IDENTITIES } from "@app/lib/api-docs";
 import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -15,6 +9,8 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
+import { SanitizedProjectSchema } from "../sanitizedSchemas";
+
 export const registerIdentityRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -307,7 +303,7 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
                 })
               ),
               identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true }),
-              project: ProjectsSchema.pick({ name: true, id: true })
+              project: SanitizedProjectSchema.pick({ name: true, id: true })
             })
           )
         })

backend/src/server/routes/v1/project-router.ts

@@ -1,22 +1,16 @@
 import { z } from "zod";
 
-import {
-  IntegrationsSchema,
-  ProjectMembershipsSchema,
-  ProjectsSchema,
-  UserEncryptionKeysSchema,
-  UsersSchema
-} from "@app/db/schemas";
+import { IntegrationsSchema, ProjectMembershipsSchema, UserEncryptionKeysSchema, UsersSchema } from "@app/db/schemas";
 import { PROJECTS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { ProjectFilterType } from "@app/services/project/project-types";
 
-import { integrationAuthPubSchema } from "../sanitizedSchemas";
+import { integrationAuthPubSchema, SanitizedProjectSchema } from "../sanitizedSchemas";
 import { sanitizedServiceTokenSchema } from "../v2/service-token-router";
 
-const projectWithEnv = ProjectsSchema.merge(
+const projectWithEnv = SanitizedProjectSchema.merge(
   z.object({
     _id: z.string(),
     environments: z.object({ name: z.string(), slug: z.string(), id: z.string() }).array()
@@ -188,7 +182,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          workspace: ProjectsSchema.optional()
+          workspace: SanitizedProjectSchema.optional()
         })
       }
     },
@@ -224,7 +218,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           message: z.string(),
-          workspace: ProjectsSchema
+          workspace: SanitizedProjectSchema
         })
       }
     },
@@ -272,7 +266,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          workspace: ProjectsSchema
+          workspace: SanitizedProjectSchema
         })
       }
     },
@@ -314,7 +308,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           message: z.string(),
-          workspace: ProjectsSchema
+          workspace: SanitizedProjectSchema
         })
       }
     },
@@ -351,7 +345,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           message: z.string(),
-          workspace: ProjectsSchema
+          workspace: SanitizedProjectSchema
         })
       }
     },
@@ -389,7 +383,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           message: z.string(),
-          workspace: ProjectsSchema
+          workspace: SanitizedProjectSchema
         })
       }
     },

backend/src/server/routes/v2/identity-project-router.ts

@@ -5,7 +5,6 @@ import {
   IdentitiesSchema,
   IdentityProjectMembershipsSchema,
   ProjectMembershipRole,
-  ProjectsSchema,
   ProjectUserMembershipRolesSchema
 } from "@app/db/schemas";
 import { PROJECT_IDENTITIES } from "@app/lib/api-docs";
@@ -15,6 +14,8 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { ProjectUserMembershipTemporaryMode } from "@app/services/project-membership/project-membership-types";
 
+import { SanitizedProjectSchema } from "../sanitizedSchemas";
+
 export const registerIdentityProjectRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -236,7 +237,7 @@ export const registerIdentityProjectRouter = async (server: FastifyZodProvider)
                 })
               ),
               identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true }),
-              project: ProjectsSchema.pick({ name: true, id: true })
+              project: SanitizedProjectSchema.pick({ name: true, id: true })
             })
             .array()
         })
@@ -294,7 +295,7 @@ export const registerIdentityProjectRouter = async (server: FastifyZodProvider)
               })
             ),
             identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true }),
-            project: ProjectsSchema.pick({ name: true, id: true })
+            project: SanitizedProjectSchema.pick({ name: true, id: true })
           })
         })
       }

backend/src/server/routes/v2/project-router.ts

@@ -1,7 +1,7 @@
 import slugify from "@sindresorhus/slugify";
 import { z } from "zod";
 
-import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema, ProjectsSchema } from "@app/db/schemas";
+import { CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { PROJECTS } from "@app/lib/api-docs";
 import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -12,12 +12,12 @@ import { CaStatus } from "@app/services/certificate-authority/certificate-author
 import { ProjectFilterType } from "@app/services/project/project-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
-const projectWithEnv = ProjectsSchema.merge(
-  z.object({
-    _id: z.string(),
-    environments: z.object({ name: z.string(), slug: z.string(), id: z.string() }).array()
-  })
-);
+import { SanitizedProjectSchema } from "../sanitizedSchemas";
+
+const projectWithEnv = SanitizedProjectSchema.extend({
+  _id: z.string(),
+  environments: z.object({ name: z.string(), slug: z.string(), id: z.string() }).array()
+});
 
 const slugSchema = z
   .string()
@@ -214,7 +214,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         slug: slugSchema.describe("The slug of the project to delete.")
       }),
       response: {
-        200: ProjectsSchema
+        200: SanitizedProjectSchema
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
@@ -285,7 +285,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         autoCapitalization: z.boolean().optional().describe("The new auto-capitalization setting.")
       }),
       response: {
-        200: ProjectsSchema
+        200: SanitizedProjectSchema
       }
     },