feat: fips inside support (checkpoint)

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -7,7 +7,7 @@ import {
 
 import { SecretType } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
-import { encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto/encryption";
+import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
 import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
 import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
@@ -117,6 +117,7 @@ export const secretRotationQueueFactory = ({
   queue.start(QueueName.SecretRotation, async (job) => {
     const { rotationId } = job.data;
     const appCfg = getConfig();
+
     logger.info(`secretRotationQueue.process: [rotationDocument=${rotationId}]`);
     const secretRotation = await secretRotationDAL.findById(rotationId);
     const rotationProvider = rotationTemplates.find(({ name }) => name === secretRotation?.provider);
@@ -365,15 +366,19 @@ export const secretRotationQueueFactory = ({
           throw new NotFoundError({
             message: `Project bot not found for project with ID '${secretRotation.projectId}'`
           });
+
         const encryptedSecrets = rotationOutputs.map(({ key: outputKey, secretId }) => ({
           secretId,
-          value: encryptSymmetric128BitHexKeyUTF8(
-            typeof newCredential.outputs[outputKey] === "object"
-              ? JSON.stringify(newCredential.outputs[outputKey])
-              : String(newCredential.outputs[outputKey]),
-            botKey
-          )
+          value: crypto.encryption().encryptSymmetric({
+            plaintext:
+              typeof newCredential.outputs[outputKey] === "object"
+                ? JSON.stringify(newCredential.outputs[outputKey])
+                : String(newCredential.outputs[outputKey]),
+            key: botKey,
+            keySize: SymmetricKeySize.Bits128
+          })
         }));
+
         // map the final values to output keys in the board
         await secretRotationDAL.transaction(async (tx) => {
           await secretRotationDAL.updateById(

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 import Ajv from "ajv";
 
 import { ActionProjectType, ProjectVersion, TableName } from "@app/db/schemas";
-import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto/encryption";
+import { crypto, SymmetricKeySize } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
@@ -230,6 +230,7 @@ export const secretRotationServiceFactory = ({
 
     if (!botKey) throw new NotFoundError({ message: `Project bot not found for project with ID '${projectId}'` });
     const docs = await secretRotationDAL.find({ projectId });
+
     return docs.map((el) => ({
       ...el,
       outputs: el.outputs.map((output) => ({
@@ -237,11 +238,12 @@ export const secretRotationServiceFactory = ({
         secret: {
           id: output.secret.id,
           version: output.secret.version,
-          secretKey: decryptSymmetric128BitHexKeyUTF8({
+          secretKey: crypto.encryption().decryptSymmetric({
             ciphertext: output.secret.secretKeyCiphertext,
             iv: output.secret.secretKeyIV,
             tag: output.secret.secretKeyTag,
-            key: botKey
+            key: botKey,
+            keySize: SymmetricKeySize.Bits128
           })
         }
       }))