feat: fips inside support (checkpoint)

backend/src/server/app.ts

@@ -22,6 +22,7 @@ import { CustomLogger } from "@app/lib/logger/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TQueueServiceFactory } from "@app/queue";
 import { TSmtpService } from "@app/services/smtp/smtp-service";
+import { TSuperAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 
 import { globalRateLimiterCfg } from "./config/rateLimiter";
 import { addErrorsToResponseSchemas } from "./plugins/add-errors-to-response-schemas";
@@ -44,10 +45,22 @@ type TMain = {
   hsmModule: HsmModule;
   redis: Redis;
   envConfig: TEnvConfig;
+  superAdminDAL: TSuperAdminDALFactory;
 };
 
 // Run the server!
-export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, keyStore, redis, envConfig }: TMain) => {
+export const main = async ({
+  db,
+  hsmModule,
+  auditLogDb,
+  smtp,
+  logger,
+  queue,
+  keyStore,
+  redis,
+  envConfig,
+  superAdminDAL
+}: TMain) => {
   const appCfg = getConfig();
 
   const server = fastify({
@@ -128,7 +141,16 @@ export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, key
       })
     });
 
-    await server.register(registerRoutes, { smtp, queue, db, auditLogDb, keyStore, hsmModule, envConfig });
+    await server.register(registerRoutes, {
+      smtp,
+      queue,
+      db,
+      auditLogDb,
+      keyStore,
+      hsmModule,
+      envConfig,
+      superAdminDAL
+    });
 
     await server.register(registerServeUI, {
       standaloneMode: appCfg.STANDALONE_MODE || IS_PACKAGED,

backend/src/server/routes/index.ts

@@ -278,7 +278,7 @@ import { slackIntegrationDALFactory } from "@app/services/slack/slack-integratio
 import { slackServiceFactory } from "@app/services/slack/slack-service";
 import { TSmtpService } from "@app/services/smtp/smtp-service";
 import { invalidateCacheQueueFactory } from "@app/services/super-admin/invalidate-cache-queue";
-import { superAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
+import { TSuperAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 import { getServerCfg, superAdminServiceFactory } from "@app/services/super-admin/super-admin-service";
 import { telemetryDALFactory } from "@app/services/telemetry/telemetry-dal";
 import { telemetryQueueServiceFactory } from "@app/services/telemetry/telemetry-queue";
@@ -310,6 +310,7 @@ export const registerRoutes = async (
   server: FastifyZodProvider,
   {
     auditLogDb,
+    superAdminDAL,
     db,
     hsmModule,
     smtp: smtpService,
@@ -318,6 +319,7 @@ export const registerRoutes = async (
     envConfig
   }: {
     auditLogDb?: Knex;
+    superAdminDAL: TSuperAdminDALFactory;
     db: Knex;
     hsmModule: HsmModule;
     smtp: TSmtpService;
@@ -341,7 +343,6 @@ export const registerRoutes = async (
   const orgBotDAL = orgBotDALFactory(db);
   const incidentContactDAL = incidentContactDALFactory(db);
   const orgRoleDAL = orgRoleDALFactory(db);
-  const superAdminDAL = superAdminDALFactory(db);
   const rateLimitDAL = rateLimitDALFactory(db);
   const apiKeyDAL = apiKeyDALFactory(db);
 

backend/src/server/routes/v1/admin-router.ts

@@ -9,6 +9,7 @@ import {
   UsersSchema
 } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError } from "@app/lib/errors";
 import { invalidateCacheLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
@@ -56,9 +57,11 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
     handler: async () => {
       const config = await getServerCfg();
       const serverEnvs = getConfig();
+
       return {
         config: {
           ...config,
+          fipsEnabled: crypto.isFipsModeEnabled(),
           isMigrationModeOn: serverEnvs.MAINTENANCE_MODE,
           isSecretScanningDisabled: serverEnvs.DISABLE_SECRET_SCANNING
         }

backend/src/server/routes/v1/identity-tls-cert-auth-router.ts

@@ -1,11 +1,10 @@
-import crypto from "node:crypto";
-
 import { z } from "zod";
 
 import { IdentityTlsCertAuthsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, TLS_CERT_AUTH } from "@app/lib/api-docs";
 import { getConfig } from "@app/lib/config/env";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError } from "@app/lib/errors";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -28,9 +27,9 @@ const validateCaCertificate = (caCert: string) => {
   if (!caCert) return true;
   try {
     // eslint-disable-next-line no-new
-    new crypto.X509Certificate(caCert);
+    new crypto.rawCrypto.X509Certificate(caCert);
     return true;
-  } catch (err) {
+  } catch {
     return false;
   }
 };