Merge pull request #1341 from akhilmhdh/feat/add-cloudwatch

feat: added cloudwatch support and removed parsed secret blindindex

backend/package.json

@@ -81,6 +81,7 @@
     "@node-saml/passport-saml": "^4.0.4",
     "@octokit/rest": "^20.0.2",
     "@octokit/webhooks-types": "^7.3.1",
+    "@serdnam/pino-cloudwatch-transport": "^1.0.4",
     "@sindresorhus/slugify": "^2.2.1",
     "@ucast/mongo2js": "^1.3.4",
     "ajv": "^8.12.0",

backend/src/db/schemas/secret-versions.ts

@@ -10,8 +10,8 @@ import { TImmutableDBKeys } from "./models";
 export const SecretVersionsSchema = z.object({
   id: z.string().uuid(),
   version: z.number().default(1),
-  type: z.string().default('shared'),
-  secretBlindIndex: z.string(),
+  type: z.string().default("shared"),
+  secretBlindIndex: z.string().nullable().optional(),
   secretKeyCiphertext: z.string(),
   secretKeyIV: z.string(),
   secretKeyTag: z.string(),
@@ -24,15 +24,15 @@ export const SecretVersionsSchema = z.object({
   secretReminderNote: z.string().nullable().optional(),
   secretReminderRepeatDays: z.number().nullable().optional(),
   skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
-  algorithm: z.string().default('aes-256-gcm'),
-  keyEncoding: z.string().default('utf8'),
+  algorithm: z.string().default("aes-256-gcm"),
+  keyEncoding: z.string().default("utf8"),
   metadata: z.unknown().nullable().optional(),
   envId: z.string().uuid().nullable().optional(),
   secretId: z.string().uuid(),
   folderId: z.string().uuid(),
   userId: z.string().uuid().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
+  updatedAt: z.date()
 });
 
 export type TSecretVersions = z.infer<typeof SecretVersionsSchema>;

backend/src/db/schemas/secrets.ts

@@ -10,8 +10,8 @@ import { TImmutableDBKeys } from "./models";
 export const SecretsSchema = z.object({
   id: z.string().uuid(),
   version: z.number().default(1),
-  type: z.string().default('shared'),
-  secretBlindIndex: z.string(),
+  type: z.string().default("shared"),
+  secretBlindIndex: z.string().nullable().optional(),
   secretKeyCiphertext: z.string(),
   secretKeyIV: z.string(),
   secretKeyTag: z.string(),
@@ -24,13 +24,13 @@ export const SecretsSchema = z.object({
   secretReminderNote: z.string().nullable().optional(),
   secretReminderRepeatDays: z.number().nullable().optional(),
   skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
-  algorithm: z.string().default('aes-256-gcm'),
-  keyEncoding: z.string().default('utf8'),
+  algorithm: z.string().default("aes-256-gcm"),
+  keyEncoding: z.string().default("utf8"),
   metadata: z.unknown().nullable().optional(),
   userId: z.string().uuid().nullable().optional(),
   folderId: z.string().uuid(),
   createdAt: z.date(),
-  updatedAt: z.date(),
+  updatedAt: z.date()
 });
 
 export type TSecrets = z.infer<typeof SecretsSchema>;

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -499,7 +499,10 @@ export const secretApprovalRequestServiceFactory = ({
           blindIndexCfg
         });
 
-      const secsGroupedByBlindIndex = groupBy(secretsToBeUpdated, (el) => el.secretBlindIndex);
+      const secsGroupedByBlindIndex = groupBy(
+        secretsToBeUpdated,
+        (el) => el.secretBlindIndex as string
+      );
       const updatedSecretIds = updatedSecrets.map(
         (el) => secsGroupedByBlindIndex[keyName2BlindIndex[el.secretName]][0].id
       );
@@ -540,7 +543,11 @@ export const secretApprovalRequestServiceFactory = ({
         isNew: false,
         blindIndexCfg
       });
-      const secretsGroupedByBlindIndex = groupBy(secrets, (i) => i.secretBlindIndex);
+      const secretsGroupedByBlindIndex = groupBy(secrets, (i) => {
+        if (!i.secretBlindIndex)
+          throw new BadRequestError({ message: "Missing secret blind index" });
+        return i.secretBlindIndex;
+      });
       const deletedSecretIds = deletedSecrets.map(
         (el) => secretsGroupedByBlindIndex[keyName2BlindIndex[el.secretName]][0].id
       );
@@ -551,9 +558,12 @@ export const secretApprovalRequestServiceFactory = ({
       commits.push(
         ...deletedSecrets.map((el) => {
           const secretId = secretsGroupedByBlindIndex[keyName2BlindIndex[el.secretName]][0].id;
+          if (!latestSecretVersions[secretId].secretBlindIndex)
+            throw new BadRequestError({ message: "Failed to find secret blind index" });
           return {
             op: CommitType.Delete as const,
             ...latestSecretVersions[secretId],
+            secretBlindIndex: latestSecretVersions[secretId].secretBlindIndex as string,
             secret: secretId,
             secretVersion: latestSecretVersions[secretId].id
           };

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -34,6 +34,7 @@ import {
   TSecretRotationDbFn,
   TSecretRotationEncData
 } from "./secret-rotation-queue-types";
+import { BadRequestError } from "@app/lib/errors";
 
 export type TSecretRotationQueueFactory = ReturnType<typeof secretRotationQueueFactory>;
 
@@ -259,10 +260,14 @@ export const secretRotationQueueFactory = ({
           tx
         );
         await secretVersionDAL.insertMany(
-          updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
-            ...el,
-            secretId: id
-          })),
+          updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => {
+            if (!el.secretBlindIndex) throw new BadRequestError({ message: "Missing blind index" });
+            return {
+              ...el,
+              secretId: id,
+              secretBlindIndex: el.secretBlindIndex as string
+            };
+          }),
           tx
         );
       });

backend/src/services/secret/secret-service.ts

@@ -116,18 +116,22 @@ export const secretServiceFactory = ({
       inputSecrets.map(({ tags, ...el }) => ({ ...el, folderId })),
       tx
     );
-    const newSecretGroupByBlindIndex = groupBy(newSecrets, (item) => item.secretBlindIndex);
+    const newSecretGroupByBlindIndex = groupBy(
+      newSecrets,
+      (item) => item.secretBlindIndex as string
+    );
     const newSecretTags = inputSecrets.flatMap(({ tags: secretTags = [], secretBlindIndex }) =>
       secretTags.map((tag) => ({
         [`${TableName.SecretTag}Id` as const]: tag,
-        [`${TableName.Secret}Id` as const]: newSecretGroupByBlindIndex[secretBlindIndex][0].id
+        [`${TableName.Secret}Id` as const]:
+          newSecretGroupByBlindIndex[secretBlindIndex as string][0].id
       }))
     );
     const secretVersions = await secretVersionDAL.insertMany(
       inputSecrets.map(({ tags, ...el }) => ({
         ...el,
         folderId,
-        secretId: newSecretGroupByBlindIndex[el.secretBlindIndex][0].id
+        secretId: newSecretGroupByBlindIndex[el.secretBlindIndex as string][0].id
       })),
       tx
     );
@@ -269,7 +273,9 @@ export const secretServiceFactory = ({
     if (isNew) {
       if (secrets.length) throw new BadRequestError({ message: "Secret already exist" });
     } else if (secrets.length !== inputSecrets.length)
-      throw new BadRequestError({ message: `Secret not found: blind index ${JSON.stringify(keyName2BlindIndex)}` });
+      throw new BadRequestError({
+        message: `Secret not found: blind index ${JSON.stringify(keyName2BlindIndex)}`
+      });
 
     return { blindIndex2KeyName, keyName2BlindIndex, secrets };
   };
@@ -292,7 +298,7 @@ export const secretServiceFactory = ({
       })),
       userId
     );
-    const secsGroupedByBlindIndex = groupBy(secrets, (i) => i.secretBlindIndex);
+    const secsGroupedByBlindIndex = groupBy(secrets, (i) => i.secretBlindIndex as string);
 
     return { secsGroupedByBlindIndex, secrets };
   };