feat: fips inside support (checkpoint)

backend/src/services/external-migration/external-migration-fns.ts

@@ -1,10 +1,10 @@
 import slugify from "@sindresorhus/slugify";
-import { randomUUID } from "crypto";
 import sjcl from "sjcl";
 import tweetnacl from "tweetnacl";
 import tweetnaclUtil from "tweetnacl-util";
 
 import { SecretType, TSecretFolders } from "@app/db/schemas";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { chunkArray } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
@@ -228,7 +228,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
               }
 
               infisicalImportData.secrets.push({
-                id: randomUUID(),
+                id: crypto.rawCrypto.randomUUID(),
                 name: secretName,
                 environmentId: matchingAppEnv.id,
                 value: resolvedSecret.val || "",
@@ -261,7 +261,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
               }
 
               infisicalImportData.secrets.push({
-                id: randomUUID(),
+                id: crypto.rawCrypto.randomUUID(),
                 name: secretName,
                 environmentId: matchingAppEnv.id,
                 value: secretData.val || "",
@@ -348,7 +348,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
               }
 
               infisicalImportData.secrets.push({
-                id: randomUUID(),
+                id: crypto.rawCrypto.randomUUID(),
                 name: secret,
                 environmentId: matchingEnv.id,
                 value: resolvedSecret.val || "",
@@ -380,7 +380,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
               }
 
               infisicalImportData.secrets.push({
-                id: randomUUID(),
+                id: crypto.rawCrypto.randomUUID(),
                 name: secret,
                 environmentId: matchingEnv.id,
                 value: selectedSecret.val || "",
@@ -461,7 +461,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
         }
 
         infisicalImportData.secrets.push({
-          id: randomUUID(),
+          id: crypto.rawCrypto.randomUUID(),
           name: secretName,
           environmentId: subEnv ? subEnv.parentEnvironmentId : env,
           value: resolvedSecret.val || "",
@@ -487,7 +487,7 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
         const folderId = targetIdToFolderIdsMap.get(subEnv?.id || "") || subEnv?.id;
 
         infisicalImportData.secrets.push({
-          id: randomUUID(),
+          id: crypto.rawCrypto.randomUUID(),
           name: secretName,
           environmentId: subEnv ? subEnv.parentEnvironmentId : env,
           value: secretData.val || "",

backend/src/services/external-migration/external-migration-queue.ts

@@ -1,5 +1,5 @@
 import { SecretEncryptionAlgo, SecretKeyEncoding } from "@app/db/schemas";
-import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 
@@ -98,7 +98,7 @@ export const externalMigrationQueueFactory = ({
         template: SmtpTemplates.ExternalImportStarted
       });
 
-      const decrypted = infisicalSymmetricDecrypt({
+      const decrypted = crypto.encryption().decryptWithRootEncryptionKey({
         ciphertext: data.ciphertext,
         iv: data.iv,
         keyEncoding: data.encoding,

backend/src/services/external-migration/external-migration-service.ts

@@ -1,7 +1,7 @@
 import { OrgMembershipRole } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
-import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
-import { ForbiddenRequestError } from "@app/lib/errors";
+import { crypto } from "@app/lib/crypto/cryptography";
+import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
 
 import { TUserDALFactory } from "../user/user-dal";
 import { decryptEnvKeyDataFn, parseEnvKeyDataFn } from "./external-migration-fns";
@@ -29,6 +29,10 @@ export const externalMigrationServiceFactory = ({
     actorOrgId,
     actorAuthMethod
   }: TImportEnvKeyDataCreate) => {
+    if (crypto.isFipsModeEnabled()) {
+      throw new BadRequestError({ message: "EnvKey migration is not supported when running in FIPS mode." });
+    }
+
     const { membership } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -52,7 +56,7 @@ export const externalMigrationServiceFactory = ({
       actorAuthMethod
     });
 
-    const encrypted = infisicalSymmetricEncypt(stringifiedJson);
+    const encrypted = crypto.encryption().encryptWithRootEncryptionKey(stringifiedJson);
 
     await externalMigrationQueue.startImport({
       actorEmail: user.email!,