awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: update with review changes

Browse Source
This commit is contained in:
=
2025-04-12 00:36:21 +05:30
parent 7107a1b225
commit 9565ef29d0
8 changed files with 59 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
View File

@@ -119,7 +119,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
| "bulkUpdate"
| "deleteMany"
| "find"
| "cacheInvalidateSecretByProjectId"
| "invalidateSecretCacheByProjectId"
>;
secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
@@ -870,7 +870,7 @@ export const secretApprovalRequestServiceFactory = ({
});
}
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folderId);
const [folder] = await folderDAL.findSecretPathByFolderIds(projectId, [folderId]);
if (!folder) {

4
backend/src/ee/services/secret-replication/secret-replication-service.ts
View File

@@ -52,7 +52,7 @@ type TSecretReplicationServiceFactoryDep = {
| "delete"
| "upsertSecretReferences"
| "transaction"
| "cacheInvalidateSecretByProjectId"
| "invalidateSecretCacheByProjectId"
>;
secretVersionV2BridgeDAL: Pick<
TSecretVersionV2DALFactory,
@@ -505,7 +505,7 @@ export const secretReplicationServiceFactory = ({
}
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await secretQueueService.syncSecrets({
projectId,
orgId,

10
backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts
View File

@@ -88,7 +88,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath" | "findBySecretPathMultiEnv">;
secretV2BridgeDAL: Pick<
TSecretV2BridgeDALFactory,
"bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "cacheInvalidateSecretByProjectId"
"bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "invalidateSecretCacheByProjectId"
>;
secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
@@ -515,7 +515,7 @@ export const secretRotationV2ServiceFactory = ({
});
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folder.id);
await secretQueueService.syncSecrets({
orgId: connection.orgId,
@@ -652,7 +652,7 @@ export const secretRotationV2ServiceFactory = ({
});
if (secretsMappingUpdated) {
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folder.id);
await secretQueueService.syncSecrets({
orgId: connection.orgId,
@@ -779,7 +779,7 @@ export const secretRotationV2ServiceFactory = ({
}
if (deleteSecrets) {
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folder.id);
await secretQueueService.syncSecrets({
orgId: connection.orgId,
@@ -938,7 +938,7 @@ export const secretRotationV2ServiceFactory = ({
}
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folder.id);
await secretQueueService.syncSecrets({
orgId: connection.orgId,

4
backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts
View File

@@ -48,7 +48,7 @@ type TSecretRotationQueueFactoryDep = {
secretRotationDAL: TSecretRotationDALFactory;
projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
secretDAL: Pick<TSecretDALFactory, "bulkUpdate" | "find">;
secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "find" | "cacheInvalidateSecretByProjectId">;
secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "find" | "invalidateSecretCacheByProjectId">;
secretVersionDAL: Pick<TSecretVersionDALFactory, "insertMany" | "findLatestVersionMany">;
secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
telemetryService: Pick<TTelemetryServiceFactory, "sendPostHogEvents">;
@@ -340,7 +340,7 @@ export const secretRotationQueueFactory = ({
);
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(secretRotation.projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(secretRotation.projectId);
} else {
if (!botKey)
throw new NotFoundError({

2
backend/src/lib/crypto/cache.ts
View File

@@ -1,6 +1,6 @@
import crypto from "node:crypto";
export const getCacheKey = (data: unknown) =>
export const generateCacheKeyFromData = (data: unknown) =>
crypto
.createHash("md5")
.update(JSON.stringify(data))

8
backend/src/services/secret-import/secret-import-service.ts
View File

@@ -43,7 +43,7 @@ type TSecretImportServiceFactoryDep = {
secretImportDAL: TSecretImportDALFactory;
folderDAL: TSecretFolderDALFactory;
secretDAL: Pick<TSecretDALFactory, "find">;
secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "find" | "cacheInvalidateSecretByProjectId">;
secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "find" | "invalidateSecretCacheByProjectId">;
projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
projectDAL: Pick<TProjectDALFactory, "checkProjectUpgradeStatus">;
projectEnvDAL: TProjectEnvDALFactory;
@@ -184,7 +184,7 @@ export const secretImportServiceFactory = ({
});
}
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
return { ...secImport, importEnv };
};
@@ -283,7 +283,7 @@ export const secretImportServiceFactory = ({
return doc;
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
return { ...updatedSecImport, importEnv: importedEnv };
};
@@ -358,7 +358,7 @@ export const secretImportServiceFactory = ({
actorId
});
await secretV2BridgeDAL.cacheInvalidateSecretByProjectId(projectId);
await secretV2BridgeDAL.invalidateSecretCacheByProjectId(projectId);
return secImport;
};

56
backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts
View File

@@ -5,7 +5,7 @@ import { TDbClient } from "@app/db";
import { ProjectType, SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas";
import { TKeyStoreFactory } from "@app/keystore/keystore";
import { getConfig } from "@app/lib/config/env";
import { getCacheKey } from "@app/lib/crypto/cache";
import { generateCacheKeyFromData } from "@app/lib/crypto/cache";
import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
import {
buildFindFilter,
@@ -34,7 +34,7 @@ export const SecretDalCacheKeys = {
) => {
return `${SecretDalCacheKeys.productKey}:${projectId}:${
TableName.SecretV2
}-dal:v${version}:find-by-folder-ids:${getCacheKey(cacheKey)}`;
}-dal:v${version}:find-by-folder-ids:${generateCacheKeyFromData(cacheKey)}`;
},
findByFolderId: (
projectId: string,
@@ -43,13 +43,15 @@ export const SecretDalCacheKeys = {
) => {
return `${SecretDalCacheKeys.productKey}:${projectId}:${
TableName.SecretV2
}-dal:v${version}:find-by-folder-id:${getCacheKey(cacheKey)}`;
}-dal:v${version}:find-by-folder-id:${generateCacheKeyFromData(cacheKey)}`;
},
find: (projectId: string, version: number, ...args: Parameters<TSecretV2BridgeDALFactory["find"]>) => {
const [filter, opts] = args;
delete opts?.tx;
delete opts?.useCache;
return `${SecretDalCacheKeys.productKey}:${projectId}:${TableName.SecretV2}-dal:v${version}:find:${getCacheKey({
return `${SecretDalCacheKeys.productKey}:${projectId}:${
TableName.SecretV2
}-dal:v${version}:find:${generateCacheKeyFromData({
filter,
opts
})}`;
@@ -64,10 +66,11 @@ interface TSecretV2DalArg {
const SECRET_DAL_TTL = 5 * 60;
const SECRET_DAL_VERSION_TTL = 15 * 60;
const MAX_SECRET_CACHE_BYTES = 25 * 1024 * 1024;
export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
const secretOrm = ormify(db, TableName.SecretV2);
const cacheInvalidateSecretByProjectId = async (projectId: string) => {
const invalidateSecretCacheByProjectId = async (projectId: string) => {
const secretDalVersionKey = SecretDalCacheKeys.getSecretDalVersion(projectId);
await keyStore.incrementBy(secretDalVersionKey, 1);
await keyStore.setExpiry(secretDalVersionKey, SECRET_DAL_VERSION_TTL);
@@ -228,11 +231,14 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
return { ...el, encryptedValue, encryptedComment };
});
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.find(useCache.projectId, secretDalVersion, filter, opts),
SECRET_DAL_TTL,
JSON.stringify(cachedSecrets)
);
const cache = JSON.stringify(cachedSecrets);
if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.find(useCache.projectId, secretDalVersion, filter, opts),
SECRET_DAL_TTL,
cache
);
}
}
return data;
@@ -437,11 +443,15 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
return { ...el, encryptedValue, encryptedComment };
});
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.findByFolderId(projectId, secretDalVersion, dto),
SECRET_DAL_TTL,
JSON.stringify(newCachedSecrets)
);
const cache = JSON.stringify(newCachedSecrets);
if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.findByFolderId(projectId, secretDalVersion, dto),
SECRET_DAL_TTL,
cache
);
}
}
return data;
} catch (error) {
@@ -696,11 +706,15 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
return { ...el, encryptedValue, encryptedComment };
});
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.findByFolderIds(projectId, secretDalVersion, dto),
SECRET_DAL_TTL,
JSON.stringify(cachedSecrets)
);
const cache = JSON.stringify(cachedSecrets);
if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
await keyStore.setItemWithExpiry(
SecretDalCacheKeys.findByFolderIds(projectId, secretDalVersion, dto),
SECRET_DAL_TTL,
cache
);
}
}
return data;
@@ -895,6 +909,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
countByFolderIds,
findOne,
find,
cacheInvalidateSecretByProjectId
invalidateSecretCacheByProjectId
};
};

16
backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
View File

@@ -331,7 +331,7 @@ export const secretV2BridgeServiceFactory = ({
return createdSecret;
});
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
if (inputSecret.type === SecretType.Shared) {
await snapshotService.performSnapshot(folderId);
await secretQueueService.syncSecrets({
@@ -540,7 +540,7 @@ export const secretV2BridgeServiceFactory = ({
projectId
});
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
if (inputSecret.type === SecretType.Shared) {
await snapshotService.performSnapshot(folderId);
await secretQueueService.syncSecrets({
@@ -649,7 +649,7 @@ export const secretV2BridgeServiceFactory = ({
})
);
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
if (inputSecret.type === SecretType.Shared) {
await snapshotService.performSnapshot(folderId);
await secretQueueService.syncSecrets({
@@ -1552,7 +1552,7 @@ export const secretV2BridgeServiceFactory = ({
tx
})
);
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folderId);
await secretQueueService.syncSecrets({
actor,
@@ -1892,7 +1892,7 @@ export const secretV2BridgeServiceFactory = ({
}
});
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
await Promise.allSettled(folders.map((el) => (el?.id ? snapshotService.performSnapshot(el.id) : undefined)));
await Promise.allSettled(
folders.map((el) =>
@@ -2024,7 +2024,7 @@ export const secretV2BridgeServiceFactory = ({
})
);
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
await snapshotService.performSnapshot(folderId);
await secretQueueService.syncSecrets({
actor,
@@ -2549,7 +2549,7 @@ export const secretV2BridgeServiceFactory = ({
});
if (isDestinationUpdated || isSourceUpdated) {
await secretDAL.cacheInvalidateSecretByProjectId(projectId);
await secretDAL.invalidateSecretCacheByProjectId(projectId);
}
if (isDestinationUpdated) {
await snapshotService.performSnapshot(destinationFolder.id);
@@ -2729,7 +2729,7 @@ export const secretV2BridgeServiceFactory = ({
generatePaths(folderMap).map(({ folderId, path }) => [folderId, path === "/" ? path : path.substring(1)])
);
const secrets = await secretDAL.findByFolderIds({ folderIds: folders.map((f) => f.id), projectId });
const secrets = await secretDAL.findByFolderIds({ folderIds: folders.map((f) => f.id), projectId, useCache: true });
const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.SecretManager,