requested changes

backend/src/services/hsm/hsm-fns.ts

@@ -3,12 +3,9 @@ import * as grapheneLib from "graphene-pk11";
 import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 
-export type HsmModule = {
-  module: grapheneLib.Module | null;
-  graphene: typeof grapheneLib;
-};
+import { HsmModule } from "./hsm-types";
 
-export const initializePkcs11Module = () => {
+export const initializeHsmModule = () => {
   const appCfg = getConfig();
 
   let module: grapheneLib.Module | null = null;

backend/src/services/hsm/hsm-service.ts

@@ -3,21 +3,16 @@ import grapheneLib from "graphene-pk11";
 import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 
-import { HsmModule } from "./hsm-fns";
+import { HsmModule, RequiredMechanisms } from "./hsm-types";
 
 type THsmServiceFactoryDep = {
-  pkcs11Module: HsmModule;
+  hsmModule: HsmModule;
 };
 const SESSION_TIMEOUT = 5 * 60 * 1000; // 5 minutes
 const USER_ALREADY_LOGGED_IN_ERROR = "CKR_USER_ALREADY_LOGGED_IN";
 
 export type THsmServiceFactory = ReturnType<typeof hsmServiceFactory>;
 
-enum RequiredMechanisms {
-  AesGcm = "AES_GCM",
-  AesKeyWrap = "AES_KEY_WRAP"
-}
-
 class HsmSessionManager {
   private session: grapheneLib.Session | null = null;
 
@@ -114,7 +109,7 @@ class HsmSessionManager {
 }
 
 // eslint-disable-next-line no-empty-pattern
-export const hsmServiceFactory = ({ pkcs11Module: { module, graphene } }: THsmServiceFactoryDep) => {
+export const hsmServiceFactory = ({ hsmModule: { module, graphene } }: THsmServiceFactoryDep) => {
   const appCfg = getConfig();
 
   // Constants for buffer structure

backend/src/services/hsm/hsm-types.ts

@@ -0,0 +1,11 @@
+import * as grapheneLib from "graphene-pk11";
+
+export type HsmModule = {
+  module: grapheneLib.Module | null;
+  graphene: typeof grapheneLib;
+};
+
+export enum RequiredMechanisms {
+  AesGcm = "AES_GCM",
+  AesKeyWrap = "AES_KEY_WRAP"
+}

backend/src/services/kms/kms-service.ts

@@ -629,7 +629,7 @@ export const kmsServiceFactory = ({
 
   const $decryptRootKey = async (kmsRootConfig: TKmsRootConfig) => {
     // case 1: root key is encrypted with HSM
-    if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Hsm) {
+    if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.HSM) {
       if (!hsmService.isActive()) {
         throw new Error("Unable to decrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
       }
@@ -637,8 +637,8 @@ export const kmsServiceFactory = ({
       return hsmService.decrypt(kmsRootConfig.encryptedRootKey);
     }
 
-    // case 2: root key is encrypted with basic encryption
-    if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Basic) {
+    // case 2: root key is encrypted with software encryption
+    if (kmsRootConfig.encryptionStrategy === RootKeyEncryptionStrategy.Software) {
       const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
       const encryptionKeyBuffer = $getBasicEncryptionKey();
 
@@ -649,14 +649,14 @@ export const kmsServiceFactory = ({
   };
 
   const $encryptRootKey = async (plainKeyBuffer: Buffer, strategy: RootKeyEncryptionStrategy) => {
-    if (strategy === RootKeyEncryptionStrategy.Hsm) {
+    if (strategy === RootKeyEncryptionStrategy.HSM) {
       if (!hsmService.isActive()) {
         throw new Error("Unable to encrypt root KMS key. HSM service is inactive. Did you configure the HSM?");
       }
       return hsmService.encrypt(plainKeyBuffer);
     }
 
-    if (strategy === RootKeyEncryptionStrategy.Basic) {
+    if (strategy === RootKeyEncryptionStrategy.Software) {
       const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
       const encryptionKeyBuffer = $getBasicEncryptionKey();
 
@@ -870,9 +870,7 @@ export const kmsServiceFactory = ({
 
       const decryptedRootKey = await $decryptRootKey(kmsRootConfig).catch((err) => {
         logger.error(err, `KMS: Failed to decrypt ROOT Key [strategy=${kmsRootConfig.encryptionStrategy}]`);
-        // We do not want to throw on startup. If the HSM has issues, this will throw an error, causing the entire API to shut down.
-        // If the API shuts down, the user will have no way to do recovery by importing their backup decryption key and rolling back to basic encryption.
-        return Buffer.alloc(0);
+        throw err;
       });
 
       // set the flag so that other instance nodes can start
@@ -885,7 +883,7 @@ export const kmsServiceFactory = ({
     // case 2: no config is found, so we create a new root key with basic encryption
     logger.info("KMS: Generating new ROOT Key");
     const newRootKey = randomSecureBytes(32);
-    const encryptedRootKey = await $encryptRootKey(newRootKey, RootKeyEncryptionStrategy.Basic).catch((err) => {
+    const encryptedRootKey = await $encryptRootKey(newRootKey, RootKeyEncryptionStrategy.Software).catch((err) => {
       logger.error({ hsmEnabled: hsmService.isActive() }, "KMS: Failed to encrypt ROOT Key");
       throw err;
     });
@@ -894,7 +892,7 @@ export const kmsServiceFactory = ({
       // @ts-expect-error id is kept as fixed for idempotence and to avoid race condition
       id: KMS_ROOT_CONFIG_UUID,
       encryptedRootKey,
-      encryptionStrategy: RootKeyEncryptionStrategy.Basic
+      encryptionStrategy: RootKeyEncryptionStrategy.Software
     });
 
     // set the flag so that other instance nodes can start

backend/src/services/kms/kms-types.ts

@@ -58,6 +58,6 @@ export type TUpdateProjectSecretManagerKmsKeyDTO = {
 };
 
 export enum RootKeyEncryptionStrategy {
-  Basic = "BASIC",
-  Hsm = "HSM"
+  Software = "SOFTWARE",
+  HSM = "HSM"
 }

backend/src/services/super-admin/super-admin-service.ts

@@ -306,16 +306,16 @@ export const superAdminServiceFactory = ({
     const enabledStrategies: { enabled: boolean; strategy: RootKeyEncryptionStrategy; name: string }[] = [];
 
     if (appCfg.ROOT_ENCRYPTION_KEY || appCfg.ENCRYPTION_KEY) {
-      const basicStrategy = RootKeyEncryptionStrategy.Basic;
+      const basicStrategy = RootKeyEncryptionStrategy.Software;
 
       enabledStrategies.push({
-        name: "Regular Encryption",
+        name: "Software-based Encryption",
         enabled: selectedStrategy === basicStrategy,
         strategy: basicStrategy
       });
     }
     if (appCfg.isHsmConfigured) {
-      const hsmStrategy = RootKeyEncryptionStrategy.Hsm;
+      const hsmStrategy = RootKeyEncryptionStrategy.HSM;
 
       enabledStrategies.push({
         name: "Hardware Security Module (HSM)",