feat: fips inside support (checkpoint)

frontend/src/pages/admin/SignUpPage/SignUpPage.tsx

@@ -49,7 +49,20 @@ export const SignUpPage = () => {
     // avoid multi submission
     if (isSubmitting) return;
     try {
-      const { privateKey, ...userPass } = await generateUserPassKey(email, password);
+      console.log(
+        "Creating admin user...",
+        JSON.stringify({
+          email,
+          password,
+          fipsEnabled: config.fipsEnabled
+        })
+      );
+
+      const { privateKey, ...userPass } = await generateUserPassKey(
+        email,
+        password,
+        config.fipsEnabled
+      );
       const res = await createAdminUser({
         email,
         password,

frontend/src/pages/auth/SignUpInvitePage/SignUpInvitePage.tsx

@@ -8,17 +8,16 @@ import { faXmark } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { Link, useNavigate, useSearch } from "@tanstack/react-router";
 import jsrp from "jsrp";
-import nacl from "tweetnacl";
-import { encodeBase64 } from "tweetnacl-util";
 
 import { Mfa } from "@app/components/auth/Mfa";
 import InputField from "@app/components/basic/InputField";
 import checkPassword from "@app/components/utilities/checks/password/checkPassword";
 import Aes256Gcm from "@app/components/utilities/cryptography/aes-256-gcm";
-import { deriveArgonKey } from "@app/components/utilities/cryptography/crypto";
+import { deriveArgonKey, generateKeyPair } from "@app/components/utilities/cryptography/crypto";
 import { saveTokenToLocalStorage } from "@app/components/utilities/saveTokenToLocalStorage";
 import SecurityClient from "@app/components/utilities/SecurityClient";
 import { Button } from "@app/components/v2";
+import { useServerConfig } from "@app/context";
 import { useToggle } from "@app/hooks";
 import {
   completeAccountSignupInvite,
@@ -69,6 +68,7 @@ export const SignupInvitePage = () => {
   const metadata = queryParams.get("metadata") || undefined;
 
   const { mutateAsync: selectOrganization } = useSelectOrganization();
+  const { config } = useServerConfig();
 
   const loggedIn = isLoggedIn();
 
@@ -96,11 +96,7 @@ export const SignupInvitePage = () => {
 
     if (!errorCheck) {
       // Generate a random pair of a public and a private key
-      const pair = nacl.box.keyPair();
-      const secretKeyUint8Array = pair.secretKey;
-      const publicKeyUint8Array = pair.publicKey;
-      const privateKey = encodeBase64(secretKeyUint8Array);
-      const publicKey = encodeBase64(publicKeyUint8Array);
+      const { publicKey, privateKey } = await generateKeyPair(config.fipsEnabled);
 
       localStorage.setItem("PRIVATE_KEY", privateKey);
 

frontend/src/pages/auth/SignUpSsoPage/components/UserInfoSSOStep/UserInfoSSOStep.tsx

@@ -4,15 +4,14 @@ import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "@tanstack/react-router";
 import jsrp from "jsrp";
-import nacl from "tweetnacl";
-import { encodeBase64 } from "tweetnacl-util";
 
 import { Mfa } from "@app/components/auth/Mfa";
 import Aes256Gcm from "@app/components/utilities/cryptography/aes-256-gcm";
-import { deriveArgonKey } from "@app/components/utilities/cryptography/crypto";
+import { deriveArgonKey, generateKeyPair } from "@app/components/utilities/cryptography/crypto";
 import { saveTokenToLocalStorage } from "@app/components/utilities/saveTokenToLocalStorage";
 import SecurityClient from "@app/components/utilities/SecurityClient";
 import { Button, Input } from "@app/components/v2";
+import { useServerConfig } from "@app/context";
 import { initProjectHelper } from "@app/helpers/project";
 import { useToggle } from "@app/hooks";
 import { completeAccountSignup, useSelectOrganization } from "@app/hooks/api/auth/queries";
@@ -66,6 +65,7 @@ export const UserInfoSSOStep = ({
   const { mutateAsync: selectOrganization } = useSelectOrganization();
   const [mfaSuccessCallback, setMfaSuccessCallback] = useState<() => void>(() => {});
   const navigate = useNavigate();
+  const { config } = useServerConfig();
 
   useEffect(() => {
     const randomPassword = crypto.randomBytes(32).toString("hex");
@@ -95,12 +95,7 @@ export const UserInfoSSOStep = ({
 
     if (!errorCheck) {
       // Generate a random pair of a public and a private key
-      const pair = nacl.box.keyPair();
-      const secretKeyUint8Array = pair.secretKey;
-      const publicKeyUint8Array = pair.publicKey;
-      const privateKey = encodeBase64(secretKeyUint8Array);
-      const publicKey = encodeBase64(publicKeyUint8Array);
-      localStorage.setItem("PRIVATE_KEY", privateKey);
+      const { publicKey, privateKey } = await generateKeyPair(config.fipsEnabled);
 
       client.init(
         {

frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx

@@ -51,7 +51,7 @@ export const CaCertificatesTable = ({ caId }: Props) => {
         <TBody>
           {isPending && <TableSkeleton columns={4} innerKey="ca-certificates" />}
           {!isPending &&
-            caCerts?.map((caCert, index) => {
+            caCerts?.map?.((caCert, index) => {
               const isLastItem = index === caCerts.length - 1;
               const caCertObj = new x509.X509Certificate(caCert.certificate);
               return (

frontend/src/pages/kms/OverviewPage/components/CmekDecryptModal.tsx

@@ -3,10 +3,10 @@ import { useForm } from "react-hook-form";
 import { faCheckCircle, faCopy, faInfoCircle, faLockOpen } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { decodeBase64 } from "tweetnacl-util";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
+import { decodeBase64 } from "@app/components/utilities/cryptography/crypto";
 import {
   Button,
   FormControl,

frontend/src/pages/kms/OverviewPage/components/CmekVerifyModal.tsx

@@ -2,10 +2,10 @@ import { Controller, useForm } from "react-hook-form";
 import { faFileSignature, faInfoCircle } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { zodResolver } from "@hookform/resolvers/zod";
-import { decodeBase64 } from "tweetnacl-util";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
+import { decodeBase64 } from "@app/components/utilities/cryptography/crypto";
 import {
   Badge,
   Button,

frontend/src/pages/secret-manager/IntegrationsListPage/IntegrationsListPage.utils.tsx

@@ -3,35 +3,8 @@ import crypto from "crypto";
 import { NavigateFn } from "@tanstack/react-router";
 
 import { createNotification } from "@app/components/notifications";
-import {
-  decryptAssymmetric,
-  encryptAssymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { localStorageService } from "@app/helpers/localStorage";
-import { TCloudIntegration, UserWsKeyPair } from "@app/hooks/api/types";
-
-export const generateBotKey = (botPublicKey: string, latestKey: UserWsKeyPair) => {
-  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY");
-
-  if (!PRIVATE_KEY) {
-    throw new Error("Private Key missing");
-  }
-
-  const WORKSPACE_KEY = decryptAssymmetric({
-    ciphertext: latestKey.encryptedKey,
-    nonce: latestKey.nonce,
-    publicKey: latestKey.sender.publicKey,
-    privateKey: PRIVATE_KEY
-  });
-
-  const { ciphertext, nonce } = encryptAssymmetric({
-    plaintext: WORKSPACE_KEY,
-    publicKey: botPublicKey,
-    privateKey: PRIVATE_KEY
-  });
-
-  return { encryptedKey: ciphertext, nonce };
-};
+import { TCloudIntegration } from "@app/hooks/api/types";
 
 export const createIntegrationMissingEnvVarsNotification = (
   slug: string,

frontend/src/pages/secret-manager/SettingsPage/components/ProjectGeneralTab/ProjectGeneralTab.tsx

@@ -1,6 +1,6 @@
 import { ProjectOverviewChangeSection } from "@app/components/project/ProjectOverviewChangeSection";
 import { useWorkspace } from "@app/context";
-import { ProjectType, ProjectVersion } from "@app/hooks/api/workspace/types";
+import { ProjectType } from "@app/hooks/api/workspace/types";
 
 import { AuditLogsRetentionSection } from "../AuditLogsRetentionSection";
 import { AutoCapitalizationSection } from "../AutoCapitalizationSection";
@@ -9,7 +9,6 @@ import { DeleteProjectProtection } from "../DeleteProjectProtection";
 import { DeleteProjectSection } from "../DeleteProjectSection";
 import { EnvironmentSection } from "../EnvironmentSection";
 import { PointInTimeVersionLimitSection } from "../PointInTimeVersionLimitSection";
-import { RebuildSecretIndicesSection } from "../RebuildSecretIndicesSection/RebuildSecretIndicesSection";
 import { SecretSharingSection } from "../SecretSharingSection";
 import { SecretSnapshotsLegacySection } from "../SecretSnapshotsLegacySection";
 import { SecretTagsSection } from "../SecretTagsSection";
@@ -29,9 +28,6 @@ export const ProjectGeneralTab = () => {
       {isSecretManager && <PointInTimeVersionLimitSection />}
       <AuditLogsRetentionSection />
       {isSecretManager && <BackfillSecretReferenceSecretion />}
-      {currentWorkspace?.version !== ProjectVersion.V3 && isSecretManager && (
-        <RebuildSecretIndicesSection />
-      )}
       <DeleteProjectProtection />
       <DeleteProjectSection />
     </div>

frontend/src/pages/secret-manager/SettingsPage/components/RebuildSecretIndicesSection/RebuildSecretIndicesSection.tsx

@@ -1,93 +0,0 @@
-import { createNotification } from "@app/components/notifications";
-import {
-  decryptAssymmetric,
-  decryptSymmetric
-} from "@app/components/utilities/cryptography/crypto";
-import { Button } from "@app/components/v2";
-import { useProjectPermission, useWorkspace } from "@app/context";
-import { useToggle } from "@app/hooks";
-import { useGetUserWsKey, useNameWorkspaceSecrets } from "@app/hooks/api";
-import { ProjectMembershipRole } from "@app/hooks/api/roles/types";
-import { fetchWorkspaceSecrets } from "@app/hooks/api/workspace/queries";
-
-export const RebuildSecretIndicesSection = () => {
-  const { currentWorkspace } = useWorkspace();
-  const { membership } = useProjectPermission();
-  const nameWorkspaceSecrets = useNameWorkspaceSecrets();
-
-  const [isIndexing, setIsIndexing] = useToggle();
-  const { data: decryptFileKey } = useGetUserWsKey(currentWorkspace.id);
-
-  if (!currentWorkspace) return null;
-
-  const onRebuildIndices = async () => {
-    if (!currentWorkspace?.id) return;
-    setIsIndexing.on();
-    try {
-      const encryptedSecrets = await fetchWorkspaceSecrets(currentWorkspace.id);
-
-      if (!currentWorkspace || !decryptFileKey) {
-        return;
-      }
-
-      const key = decryptAssymmetric({
-        ciphertext: decryptFileKey.encryptedKey,
-        nonce: decryptFileKey.nonce,
-        publicKey: decryptFileKey.sender.publicKey,
-        privateKey: localStorage.getItem("PRIVATE_KEY") as string
-      });
-
-      const secretsToUpdate = encryptedSecrets.map((encryptedSecret) => {
-        const secretName = decryptSymmetric({
-          ciphertext: encryptedSecret.secretKeyCiphertext,
-          iv: encryptedSecret.secretKeyIV,
-          tag: encryptedSecret.secretKeyTag,
-          key
-        });
-
-        return {
-          secretName,
-          secretId: encryptedSecret.id
-        };
-      });
-      await nameWorkspaceSecrets.mutateAsync({
-        workspaceId: currentWorkspace.id,
-        secretsToUpdate
-      });
-
-      createNotification({
-        text: "Successfully rebuilt secret indices",
-        type: "success"
-      });
-    } catch (err) {
-      console.log(err);
-    } finally {
-      setIsIndexing.off();
-    }
-  };
-
-  const isAdmin = membership.roles.includes(ProjectMembershipRole.Admin);
-
-  if (!isAdmin) {
-    return null;
-  }
-
-  return (
-    <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="flex w-full items-center justify-between">
-        <p className="text-xl font-semibold">Rebuild Secret Indices</p>
-      </div>
-      <p className="mb-4 mt-2 max-w-2xl text-sm text-gray-400">
-        This will rebuild indices of all secrets in the project.
-      </p>
-      <Button
-        variant="outline_bg"
-        isLoading={isIndexing}
-        onClick={onRebuildIndices}
-        isDisabled={!isAdmin}
-      >
-        Rebuild Secret Indices
-      </Button>
-    </div>
-  );
-};