fix: fips + hsm mode, key requirements

backend/src/lib/config/env.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { THsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { crypto } from "@app/lib/crypto/cryptography";
 import { QueueWorkerProfile } from "@app/lib/types";
 import { TSuperAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
@@ -8,6 +9,7 @@ import { BadRequestError } from "../errors";
 import { removeTrailingSlash } from "../fn";
 import { CustomLogger } from "../logger/logger";
 import { zpStr } from "../zod";
+import { TKmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 
 export const GITLAB_URL = "https://gitlab.com";
 
@@ -448,7 +450,12 @@ export const getConfig = () => envCfg;
 export const getOriginalConfig = () => originalEnvConfig;
 
 // cannot import singleton logger directly as it needs config to load various transport
-export const initEnvConfig = async (superAdminDAL?: TSuperAdminDALFactory, logger?: CustomLogger) => {
+export const initEnvConfig = async (
+  hsmService: THsmServiceFactory,
+  kmsRootConfigDAL: TKmsRootConfigDALFactory,
+  superAdminDAL?: TSuperAdminDALFactory,
+  logger?: CustomLogger
+) => {
   const parsedEnv = envSchema.safeParse(process.env);
   if (!parsedEnv.success) {
     (logger ?? console).error("Invalid environment variables. Check the error below");
@@ -464,7 +471,7 @@ export const initEnvConfig = async (superAdminDAL?: TSuperAdminDALFactory, logge
   }
 
   if (superAdminDAL) {
-    const fipsEnabled = await crypto.initialize(superAdminDAL);
+    const fipsEnabled = await crypto.initialize(superAdminDAL, hsmService, kmsRootConfigDAL);
 
     if (fipsEnabled) {
       const newEnvCfg = {
@@ -527,6 +534,22 @@ export const getDatabaseCredentials = (logger?: CustomLogger) => {
   };
 };
 
+export const getHsmConfig = (logger?: CustomLogger) => {
+  const parsedEnv = envSchema.safeParse(process.env);
+  if (!parsedEnv.success) {
+    (logger ?? console).error("Invalid environment variables. Check the error below");
+    (logger ?? console).error(parsedEnv.error.issues);
+    process.exit(-1);
+  }
+  return {
+    isHsmConfigured: parsedEnv.data.isHsmConfigured,
+    HSM_PIN: parsedEnv.data.HSM_PIN,
+    HSM_SLOT: parsedEnv.data.HSM_SLOT,
+    HSM_LIB_PATH: parsedEnv.data.HSM_LIB_PATH,
+    HSM_KEY_LABEL: parsedEnv.data.HSM_KEY_LABEL
+  };
+};
+
 // A list of environment variables that can be overwritten
 export const overwriteSchema: {
   [key: string]: {

backend/src/lib/crypto/cryptography/crypto.ts

@@ -9,7 +9,11 @@ import nacl from "tweetnacl";
 import naclUtils from "tweetnacl-util";
 
 import { SecretEncryptionAlgo, SecretKeyEncoding } from "@app/db/schemas";
+import { isHsmActiveAndEnabled } from "@app/ee/services/hsm/hsm-fns";
+import { THsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
+import { TKmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
+import { RootKeyEncryptionStrategy } from "@app/services/kms/kms-types";
 import { TSuperAdminDALFactory } from "@app/services/super-admin/super-admin-dal";
 import { ADMIN_CONFIG_DB_UUID } from "@app/services/super-admin/super-admin-service";
 
@@ -106,7 +110,12 @@ const cryptographyFactory = () => {
     }
   };
 
-  const $setFipsModeEnabled = (enabled: boolean, envCfg?: Pick<TEnvConfig, "ENCRYPTION_KEY">) => {
+  const $setFipsModeEnabled = async (
+    enabled: boolean,
+    hsmService: THsmServiceFactory,
+    kmsRootConfigDAL: TKmsRootConfigDALFactory,
+    envCfg?: Pick<TEnvConfig, "ENCRYPTION_KEY">
+  ) => {
     // If FIPS is enabled, we need to validate that the ENCRYPTION_KEY is in a base64 format, and is a 256-bit key.
     if (enabled) {
       crypto.setFips(true);
@@ -131,24 +140,42 @@ const cryptographyFactory = () => {
           });
         }
       } else {
-        throw new CryptographyError({
-          message:
-            "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not set.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
+        const hsmStatus = await isHsmActiveAndEnabled({
+          hsmService,
+          kmsRootConfigDAL
         });
+
+        // if the encryption strategy is software - user needs to provide an encryption key
+        // if the encryption strategy is null AND the hsm is not configured - user needs to provide an encryption key
+        const needsEncryptionKey =
+          hsmStatus.rootKmsConfigEncryptionStrategy === RootKeyEncryptionStrategy.Software ||
+          (hsmStatus.rootKmsConfigEncryptionStrategy === null && !hsmStatus.isHsmConfigured);
+
+        if (needsEncryptionKey) {
+          throw new CryptographyError({
+            message:
+              "FIPS mode is enabled, but the ENCRYPTION_KEY environment variable is not set.\nYou can generate a 256-bit key using the following command: `openssl rand -base64 32`"
+          });
+        }
       }
     }
     $fipsEnabled = enabled;
     $isInitialized = true;
   };
 
-  const initialize = async (superAdminDAL: TSuperAdminDALFactory, envCfg?: Pick<TEnvConfig, "ENCRYPTION_KEY">) => {
+  const initialize = async (
+    superAdminDAL: TSuperAdminDALFactory,
+    hsmService: THsmServiceFactory,
+    kmsRootConfigDAL: TKmsRootConfigDALFactory,
+    envCfg?: Pick<TEnvConfig, "ENCRYPTION_KEY">
+  ) => {
     if ($isInitialized) {
       return isFipsModeEnabled();
     }
 
     if (process.env.FIPS_ENABLED !== "true") {
       logger.info("Cryptography module initialized in normal operation mode.");
-      $setFipsModeEnabled(false, envCfg);
+      await $setFipsModeEnabled(false, hsmService, kmsRootConfigDAL, envCfg);
       return false;
     }
 
@@ -158,11 +185,11 @@ const cryptographyFactory = () => {
     if (serverCfg) {
       if (serverCfg.fipsEnabled) {
         logger.info("[FIPS]: Instance is configured for FIPS mode of operation. Continuing startup with FIPS enabled.");
-        $setFipsModeEnabled(true, envCfg);
+        await $setFipsModeEnabled(true, hsmService, kmsRootConfigDAL, envCfg);
         return true;
       }
       logger.info("[FIPS]: Instance age predates FIPS mode inception date. Continuing without FIPS.");
-      $setFipsModeEnabled(false, envCfg);
+      await $setFipsModeEnabled(false, hsmService, kmsRootConfigDAL, envCfg);
       return false;
     }
 
@@ -171,7 +198,7 @@ const cryptographyFactory = () => {
     // TODO(daniel): check if it's an enterprise deployment
 
     // if there is no server cfg, and FIPS_MODE is `true`, its a fresh FIPS deployment. We need to set the fipsEnabled to true.
-    $setFipsModeEnabled(true, envCfg);
+    await $setFipsModeEnabled(true, hsmService, kmsRootConfigDAL, envCfg);
     return true;
   };