Merge branch 'main' into feat/azureClientSecretsRotation

backend/src/services/auth/auth-login-service.ts

@@ -3,6 +3,8 @@ import jwt from "jsonwebtoken";
 import { Knex } from "knex";
 
 import { OrgMembershipRole, TUsers, UserDeviceSchema } from "@app/db/schemas";
+import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { isAuthMethodSaml } from "@app/ee/services/permission/permission-fns";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
@@ -11,6 +13,7 @@ import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { getUserPrivateKey } from "@app/lib/crypto/srp";
 import { BadRequestError, DatabaseError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
+import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
@@ -28,7 +31,15 @@ import {
   TOauthTokenExchangeDTO,
   TVerifyMfaTokenDTO
 } from "./auth-login-type";
-import { AuthMethod, AuthModeJwtTokenPayload, AuthModeMfaJwtTokenPayload, AuthTokenType, MfaMethod } from "./auth-type";
+import {
+  ActorType,
+  AuthMethod,
+  AuthModeJwtTokenPayload,
+  AuthModeMfaJwtTokenPayload,
+  AuthTokenType,
+  MfaMethod
+} from "./auth-type";
+import { removeTrailingSlash } from "@app/lib/fn";
 
 type TAuthLoginServiceFactoryDep = {
   userDAL: TUserDALFactory;
@@ -36,6 +47,7 @@ type TAuthLoginServiceFactoryDep = {
   tokenService: TAuthTokenServiceFactory;
   smtpService: TSmtpService;
   totpService: Pick<TTotpServiceFactory, "verifyUserTotp" | "verifyWithUserRecoveryCode">;
+  auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
 };
 
 export type TAuthLoginFactory = ReturnType<typeof authLoginServiceFactory>;
@@ -44,7 +56,8 @@ export const authLoginServiceFactory = ({
   tokenService,
   smtpService,
   orgDAL,
-  totpService
+  totpService,
+  auditLogService
 }: TAuthLoginServiceFactoryDep) => {
   /*
    * Private
@@ -412,6 +425,55 @@ export const authLoginServiceFactory = ({
       mfaMethod: decodedToken.mfaMethod
     });
 
+    // In the event of this being a break-glass request (non-saml / non-oidc, when either is enforced)
+    if (
+      selectedOrg.authEnforced &&
+      selectedOrg.bypassOrgAuthEnabled &&
+      !isAuthMethodSaml(decodedToken.authMethod) &&
+      decodedToken.authMethod !== AuthMethod.OIDC
+    ) {
+      await auditLogService.createAuditLog({
+        orgId: organizationId,
+        ipAddress,
+        userAgent,
+        userAgentType: getUserAgentType(userAgent),
+        actor: {
+          type: ActorType.USER,
+          metadata: {
+            email: user.email,
+            userId: user.id,
+            username: user.username
+          }
+        },
+        event: {
+          type: EventType.ORG_ADMIN_BYPASS_SSO,
+          metadata: {}
+        }
+      });
+
+      // Notify all admins via email (besides the actor)
+      const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin);
+      const adminEmails = orgAdmins
+        .filter((admin) => admin.user.id !== user.id)
+        .map((admin) => admin.user.email)
+        .filter(Boolean) as string[];
+
+      if (adminEmails.length > 0) {
+        await smtpService.sendMail({
+          recipients: adminEmails,
+          subjectLine: "Security Alert: Admin SSO Bypass",
+          substitutions: {
+            email: user.email,
+            timestamp: new Date().toISOString(),
+            ip: ipAddress,
+            userAgent,
+            siteUrl: removeTrailingSlash(cfg.SITE_URL || "https://app.infisical.com")
+          },
+          template: SmtpTemplates.OrgAdminBreakglassAccess
+        });
+      }
+    }
+
     return {
       ...tokens,
       isMfaEnabled: false

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -68,18 +68,15 @@ const awsRegionFromHeader = (authorizationHeader: string): string | null => {
   return null;
 };
 
-
-
-function isValidAwsRegion(region: (string | null)): boolean {
-  const validRegionPattern = new RE2('^[a-z0-9-]+$');
-  if (typeof region !== 'string' || region.length === 0 || region.length > 20) {
+function isValidAwsRegion(region: string | null): boolean {
+  const validRegionPattern = new RE2("^[a-z0-9-]+$");
+  if (typeof region !== "string" || region.length === 0 || region.length > 20) {
     return false;
   }
-  
+
   return validRegionPattern.test(region);
 }
 
-
 export const identityAwsAuthServiceFactory = ({
   identityAccessTokenDAL,
   identityAwsAuthDAL,
@@ -100,7 +97,7 @@ export const identityAwsAuthServiceFactory = ({
     const region = headers.Authorization ? awsRegionFromHeader(headers.Authorization) : null;
 
     if (!isValidAwsRegion(region)) {
-      throw new BadRequestError({message: "Invalid AWS region"});
+      throw new BadRequestError({ message: "Invalid AWS region" });
     }
 
     const url = region ? `https://sts.${region}.amazonaws.com` : identityAwsAuth.stsEndpoint;

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -435,12 +435,16 @@ export const identityKubernetesAuthServiceFactory = ({
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
 
+    const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
+    if (!identityKubernetesAuth) {
+      throw new NotFoundError({ message: `Failed to find Kubernetes Auth for identity with ID ${identityId}` });
+    }
+
     if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.KUBERNETES_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Kubernetes Auth attached"
       });
     }
-    const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
 
     const { permission } = await permissionService.getOrgPermission(
       actor,

backend/src/services/integration-auth/integration-delete-secret.ts

@@ -50,7 +50,7 @@ const getIntegrationSecretsV2 = async (
   }
 
   // process secrets in current folder
-  const secrets = await secretV2BridgeDAL.findByFolderId({ folderId: dto.folderId, projectId: dto.projectId });
+  const secrets = await secretV2BridgeDAL.findByFolderId({ folderId: dto.folderId });
 
   secrets.forEach((secret) => {
     const secretKey = secret.key;
@@ -63,7 +63,6 @@ const getIntegrationSecretsV2 = async (
   // if no imports then return secrets in the current folder
   if (!secretImports.length) return content;
   const importedSecrets = await fnSecretsV2FromImports({
-    projectId: dto.projectId,
     decryptor: dto.decryptor,
     folderDAL,
     secretDAL: secretV2BridgeDAL,

backend/src/services/kms/kms-service.ts

@@ -787,13 +787,19 @@ export const kmsServiceFactory = ({
             return projectDataKey;
           }
         }
+      } catch (error) {
+        logger.error(
+          error,
+          `getProjectSecretManagerKmsDataKey: Failed to get project data key for [projectId=${projectId}]`
+        );
+        throw error;
       } finally {
         await lock?.release();
       }
     }
 
     if (!project.kmsSecretManagerEncryptedDataKey) {
-      throw new Error("Missing project data key");
+      throw new BadRequestError({ message: "Missing project data key" });
     }
 
     const kmsDecryptor = await decryptWithKmsKey({

backend/src/services/org/org-dal.ts

@@ -2,6 +2,7 @@ import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
 import {
+  OrgMembershipRole,
   TableName,
   TOrganizations,
   TOrganizationsInsert,
@@ -216,9 +217,8 @@ export const orgDALFactory = (db: TDbClient) => {
 
   const findOrgMembersByUsername = async (orgId: string, usernames: string[], tx?: Knex) => {
     try {
-      const conn = tx || db;
+      const conn = tx || db.replicaNode();
       const members = await conn(TableName.OrgMembership)
-        // .replicaNode()(TableName.OrgMembership)
         .where(`${TableName.OrgMembership}.orgId`, orgId)
         .join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`)
         .leftJoin<TUserEncryptionKeys>(
@@ -251,6 +251,43 @@ export const orgDALFactory = (db: TDbClient) => {
     }
   };
 
+  const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => {
+    try {
+      const conn = tx || db.replicaNode();
+      const members = await conn(TableName.OrgMembership)
+        .where(`${TableName.OrgMembership}.orgId`, orgId)
+        .where(`${TableName.OrgMembership}.role`, role)
+        .join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`)
+        .leftJoin<TUserEncryptionKeys>(
+          TableName.UserEncryptionKey,
+          `${TableName.UserEncryptionKey}.userId`,
+          `${TableName.Users}.id`
+        )
+        .select(
+          conn.ref("id").withSchema(TableName.OrgMembership),
+          conn.ref("inviteEmail").withSchema(TableName.OrgMembership),
+          conn.ref("orgId").withSchema(TableName.OrgMembership),
+          conn.ref("role").withSchema(TableName.OrgMembership),
+          conn.ref("roleId").withSchema(TableName.OrgMembership),
+          conn.ref("status").withSchema(TableName.OrgMembership),
+          conn.ref("username").withSchema(TableName.Users),
+          conn.ref("email").withSchema(TableName.Users),
+          conn.ref("firstName").withSchema(TableName.Users),
+          conn.ref("lastName").withSchema(TableName.Users),
+          conn.ref("id").withSchema(TableName.Users).as("userId"),
+          conn.ref("publicKey").withSchema(TableName.UserEncryptionKey)
+        )
+        .where({ isGhost: false });
+
+      return members.map(({ username, email, firstName, lastName, userId, publicKey, ...data }) => ({
+        ...data,
+        user: { username, email, firstName, lastName, id: userId, publicKey }
+      }));
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find org members by role" });
+    }
+  };
+
   const findOrgGhostUser = async (orgId: string) => {
     try {
       const member = await db
@@ -472,6 +509,7 @@ export const orgDALFactory = (db: TDbClient) => {
     findAllOrgsByUserId,
     ghostUserExists,
     findOrgMembersByUsername,
+    findOrgMembersByRole,
     findOrgGhostUser,
     create,
     updateById,

backend/src/services/secret-import/secret-import-fns.ts

@@ -159,8 +159,7 @@ export const fnSecretsV2FromImports = async ({
   decryptor,
   expandSecretReferences,
   hasSecretAccess,
-  viewSecretValue,
-  projectId
+  viewSecretValue
 }: {
   secretImports: (Omit<TSecretImports, "importEnv"> & {
     importEnv: { id: string; slug: string; name: string };
@@ -177,7 +176,6 @@ export const fnSecretsV2FromImports = async ({
     environment: string;
   }) => Promise<string | undefined>;
   hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
-  projectId: string;
 }) => {
   const cyclicDetector = new Set();
   const stack: {
@@ -209,7 +207,10 @@ export const fnSecretsV2FromImports = async ({
     );
     if (!importedFolders.length) continue;
 
-    const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
+    const importedFolderIds = importedFolders.filter(Boolean).map((el) => el?.id) as string[];
+
+    if (!importedFolderIds.length) continue;
+
     const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
 
     const importedSecrets = await secretDAL.find(
@@ -218,8 +219,7 @@ export const fnSecretsV2FromImports = async ({
         type: SecretType.Shared
       },
       {
-        sort: [["id", "asc"]],
-        useCache: { projectId }
+        sort: [["id", "asc"]]
       }
     );
     const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);

backend/src/services/secret-import/secret-import-service.ts

@@ -698,7 +698,6 @@ export const secretImportServiceFactory = ({
         projectId
       });
       const importedSecrets = await fnSecretsV2FromImports({
-        projectId,
         secretImports,
         folderDAL,
         viewSecretValue: true,

backend/src/services/secret-sync/secret-sync-queue.ts

@@ -214,7 +214,7 @@ export const secretSyncQueueFactory = ({
       canExpandValue: () => true
     });
 
-    const secrets = await secretV2BridgeDAL.findByFolderId({ folderId, projectId });
+    const secrets = await secretV2BridgeDAL.findByFolderId({ folderId });
 
     await Promise.allSettled(
       secrets.map(async (secret) => {
@@ -244,7 +244,6 @@ export const secretSyncQueueFactory = ({
 
     if (secretImports.length) {
       const importedSecrets = await fnSecretsV2FromImports({
-        projectId,
         decryptor: decryptSecretValue,
         folderDAL,
         secretDAL: secretV2BridgeDAL,

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -1,3 +1,4 @@
+import { MongoAbility } from "@casl/ability";
 import { Knex } from "knex";
 import { validate as uuidValidate } from "uuid";
 
@@ -15,46 +16,29 @@ import {
   TFindFilter,
   TFindOpt
 } from "@app/lib/knex";
-import { BufferKeysToString, OrderByDirection } from "@app/lib/types";
+import { OrderByDirection } from "@app/lib/types";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
-import type { TFindSecretsByFolderIdsFilter } from "@app/services/secret-v2-bridge/secret-v2-bridge-types";
+import type {
+  TFindSecretsByFolderIdsFilter,
+  TGetSecretsDTO
+} from "@app/services/secret-v2-bridge/secret-v2-bridge-types";
 
-export const SecretDalCacheKeys = {
+export const SecretServiceCacheKeys = {
   get productKey() {
     const { INFISICAL_PLATFORM_VERSION } = getConfig();
     return `${ProjectType.SecretManager}:${INFISICAL_PLATFORM_VERSION || 0}`;
   },
   getSecretDalVersion: (projectId: string) => {
-    return `${SecretDalCacheKeys.productKey}:${projectId}:${TableName.SecretV2}-dal-version`;
+    return `${SecretServiceCacheKeys.productKey}:${projectId}:${TableName.SecretV2}-dal-version`;
   },
-  findByFolderIds: (
+  getSecretsOfServiceLayer: (
     projectId: string,
     version: number,
-    { useCache, tx, ...cacheKey }: Parameters<TSecretV2BridgeDALFactory["findByFolderIds"]>[0]
+    dto: TGetSecretsDTO & { permissionRules: MongoAbility["rules"] }
   ) => {
-    return `${SecretDalCacheKeys.productKey}:${projectId}:${
+    return `${SecretServiceCacheKeys.productKey}:${projectId}:${
       TableName.SecretV2
-    }-dal:v${version}:find-by-folder-ids:${generateCacheKeyFromData(cacheKey)}`;
-  },
-  findByFolderId: (
-    projectId: string,
-    version: number,
-    { useCache, tx, ...cacheKey }: Parameters<TSecretV2BridgeDALFactory["findByFolderId"]>[0]
-  ) => {
-    return `${SecretDalCacheKeys.productKey}:${projectId}:${
-      TableName.SecretV2
-    }-dal:v${version}:find-by-folder-id:${generateCacheKeyFromData(cacheKey)}`;
-  },
-  find: (projectId: string, version: number, ...args: Parameters<TSecretV2BridgeDALFactory["find"]>) => {
-    const [filter, opts] = args;
-    delete opts?.tx;
-    delete opts?.useCache;
-    return `${SecretDalCacheKeys.productKey}:${projectId}:${
-      TableName.SecretV2
-    }-dal:v${version}:find:${generateCacheKeyFromData({
-      filter,
-      opts
-    })}`;
+    }-dal:v${version}:get-secrets-service-layer:${dto.actorId}-${generateCacheKeyFromData(dto)}`;
   }
 };
 
@@ -64,14 +48,14 @@ interface TSecretV2DalArg {
   keyStore: TKeyStoreFactory;
 }
 
-const SECRET_DAL_TTL = 5 * 60;
-const SECRET_DAL_VERSION_TTL = 15 * 60;
-const MAX_SECRET_CACHE_BYTES = 25 * 1024 * 1024;
+export const SECRET_DAL_TTL = 5 * 60;
+export const SECRET_DAL_VERSION_TTL = 15 * 60;
+export const MAX_SECRET_CACHE_BYTES = 25 * 1024 * 1024;
 export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
   const secretOrm = ormify(db, TableName.SecretV2);
 
   const invalidateSecretCacheByProjectId = async (projectId: string) => {
-    const secretDalVersionKey = SecretDalCacheKeys.getSecretDalVersion(projectId);
+    const secretDalVersionKey = SecretServiceCacheKeys.getSecretDalVersion(projectId);
     await keyStore.incrementBy(secretDalVersionKey, 1);
     await keyStore.setExpiry(secretDalVersionKey, SECRET_DAL_VERSION_TTL);
   };
@@ -128,35 +112,9 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
     }
   };
 
-  const find = async (
-    filter: TFindFilter<TSecretsV2>,
-    opts: TFindOpt<TSecretsV2> & { useCache?: { projectId: string } } = {}
-  ) => {
-    const { offset, limit, sort, tx, useCache } = opts;
+  const find = async (filter: TFindFilter<TSecretsV2>, opts: TFindOpt<TSecretsV2> = {}) => {
+    const { offset, limit, sort, tx } = opts;
     try {
-      let secretDalVersion = 0;
-      if (useCache) {
-        const cachedSecretDalVersion = await keyStore.getItem(
-          SecretDalCacheKeys.getSecretDalVersion(useCache.projectId)
-        );
-        secretDalVersion = Number(cachedSecretDalVersion || 0);
-        const cacheKey = SecretDalCacheKeys.find(useCache.projectId, secretDalVersion, filter, opts);
-        const cachedSecrets = await keyStore.getItem(cacheKey);
-        if (cachedSecrets) {
-          await keyStore.setExpiry(cacheKey, SECRET_DAL_TTL);
-
-          const unsanitizedSecrets = JSON.parse(cachedSecrets) as BufferKeysToString<(typeof data)[number]>[];
-          const sanitizedSecrets = unsanitizedSecrets.map((el) => {
-            const encryptedValue = el.encryptedValue ? Buffer.from(el.encryptedValue, "base64") : null;
-            const encryptedComment = el.encryptedComment ? Buffer.from(el.encryptedComment, "base64") : null;
-            const createdAt = new Date(el.createdAt);
-            const updatedAt = new Date(el.updatedAt);
-            return { ...el, encryptedComment, encryptedValue, createdAt, updatedAt };
-          });
-          return sanitizedSecrets;
-        }
-      }
-
       const query = (tx || db)(TableName.SecretV2)
         // eslint-disable-next-line @typescript-eslint/no-misused-promises
         .where(buildFindFilter(filter))
@@ -225,22 +183,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
         ]
       });
 
-      if (useCache) {
-        const cachedSecrets = data.map((el) => {
-          const encryptedValue = el.encryptedValue ? el.encryptedValue.toString("base64") : null;
-          const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
-          return { ...el, encryptedValue, encryptedComment };
-        });
-        const cache = JSON.stringify(cachedSecrets);
-        if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
-          await keyStore.setItemWithExpiry(
-            SecretDalCacheKeys.find(useCache.projectId, secretDalVersion, filter, opts),
-            SECRET_DAL_TTL,
-            cache
-          );
-        }
-      }
-
       return data;
     } catch (error) {
       throw new DatabaseError({ error, name: `${TableName.SecretV2}: Find` });
@@ -345,15 +287,9 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
     }
   };
 
-  const findByFolderId = async (dto: {
-    folderId: string;
-    userId?: string;
-    tx?: Knex;
-    projectId: string;
-    useCache?: boolean;
-  }) => {
+  const findByFolderId = async (dto: { folderId: string; userId?: string; tx?: Knex }) => {
     try {
-      const { folderId, tx, projectId } = dto;
+      const { folderId, tx } = dto;
       let { userId } = dto;
       // check if not uui then userId id is null (corner case because service token's ID is not UUI in effort to keep backwards compatibility from mongo
       if (userId && !uuidValidate(userId)) {
@@ -361,27 +297,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
         userId = undefined;
       }
 
-      const cachedSecretDalVersion = await keyStore.getItem(SecretDalCacheKeys.getSecretDalVersion(projectId));
-      const secretDalVersion = Number(cachedSecretDalVersion || 0);
-
-      if (dto.useCache) {
-        const cacheKey = SecretDalCacheKeys.findByFolderId(projectId, secretDalVersion, dto);
-        const cachedSecrets = await keyStore.getItem(cacheKey);
-        if (cachedSecrets) {
-          await keyStore.setExpiry(cacheKey, SECRET_DAL_TTL);
-
-          const unsanitizedSecrets = JSON.parse(cachedSecrets) as BufferKeysToString<(typeof data)[number]>[];
-          const sanitizedSecrets = unsanitizedSecrets.map((el) => {
-            const encryptedValue = el.encryptedValue ? Buffer.from(el.encryptedValue, "base64") : null;
-            const encryptedComment = el.encryptedComment ? Buffer.from(el.encryptedComment, "base64") : null;
-            const createdAt = new Date(el.createdAt);
-            const updatedAt = new Date(el.updatedAt);
-            return { ...el, encryptedComment, encryptedValue, createdAt, updatedAt };
-          });
-          return sanitizedSecrets;
-        }
-      }
-
       const secs = await (tx || db.replicaNode())(TableName.SecretV2)
         .where({ folderId })
         .where((bd) => {
@@ -437,22 +352,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
           }
         ]
       });
-      if (dto.useCache) {
-        const newCachedSecrets = data.map((el) => {
-          const encryptedValue = el.encryptedValue ? el.encryptedValue.toString("base64") : null;
-          const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
-          return { ...el, encryptedValue, encryptedComment };
-        });
-        const cache = JSON.stringify(newCachedSecrets);
-
-        if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
-          await keyStore.setItemWithExpiry(
-            SecretDalCacheKeys.findByFolderId(projectId, secretDalVersion, dto),
-            SECRET_DAL_TTL,
-            cache
-          );
-        }
-      }
       return data;
     } catch (error) {
       throw new DatabaseError({ error, name: "get all secret" });
@@ -542,11 +441,9 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
     folderIds: string[];
     userId?: string;
     tx?: Knex;
-    projectId: string;
     filters?: TFindSecretsByFolderIdsFilter;
-    useCache?: boolean;
   }) => {
-    const { folderIds, tx, filters, useCache, projectId } = dto;
+    const { folderIds, tx, filters } = dto;
     let { userId } = dto;
     try {
       // check if not uui then userId id is null (corner case because service token's ID is not UUI in effort to keep backwards compatibility from mongo)
@@ -555,26 +452,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
         userId = undefined;
       }
 
-      const cachedSecretDalVersion = await keyStore.getItem(SecretDalCacheKeys.getSecretDalVersion(projectId));
-      const secretDalVersion = Number(cachedSecretDalVersion || 0);
-      if (useCache) {
-        const cacheKey = SecretDalCacheKeys.findByFolderIds(projectId, secretDalVersion, dto);
-        const cachedSecrets = await keyStore.getItem(cacheKey);
-        if (cachedSecrets) {
-          await keyStore.setExpiry(cacheKey, SECRET_DAL_TTL);
-
-          const unsanitizedSecrets = JSON.parse(cachedSecrets) as BufferKeysToString<(typeof data)[number]>[];
-          const sanitizedSecrets = unsanitizedSecrets.map((el) => {
-            const encryptedValue = el.encryptedValue ? Buffer.from(el.encryptedValue, "base64") : null;
-            const encryptedComment = el.encryptedComment ? Buffer.from(el.encryptedComment, "base64") : null;
-            const createdAt = new Date(el.createdAt);
-            const updatedAt = new Date(el.updatedAt);
-            return { ...el, encryptedComment, encryptedValue, createdAt, updatedAt };
-          });
-          return sanitizedSecrets;
-        }
-      }
-
       const query = (tx || db.replicaNode())(TableName.SecretV2)
         .whereIn(`${TableName.SecretV2}.folderId`, folderIds)
         .where((bd) => {
@@ -700,22 +577,6 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
           }
         ]
       });
-      if (useCache) {
-        const cachedSecrets = data.map((el) => {
-          const encryptedValue = el.encryptedValue ? el.encryptedValue.toString("base64") : null;
-          const encryptedComment = el.encryptedComment ? el.encryptedComment.toString("base64") : null;
-          return { ...el, encryptedValue, encryptedComment };
-        });
-        const cache = JSON.stringify(cachedSecrets);
-
-        if (Buffer.byteLength(cache, "utf8") < MAX_SECRET_CACHE_BYTES) {
-          await keyStore.setItemWithExpiry(
-            SecretDalCacheKeys.findByFolderIds(projectId, secretDalVersion, dto),
-            SECRET_DAL_TTL,
-            cache
-          );
-        }
-      }
 
       return data;
     } catch (error) {

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -509,7 +509,7 @@ export const expandSecretReferencesFactory = ({
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder) return { value: "", tags: [] };
-    const secrets = await secretDAL.findByFolderId({ folderId: folder.id, projectId, useCache: true });
+    const secrets = await secretDAL.findByFolderId({ folderId: folder.id });
 
     const decryptedSecret = secrets.reduce<Record<string, { value: string; tags: string[] }>>((prev, secret) => {
       // eslint-disable-next-line no-param-reassign

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -25,6 +25,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
+import { TKeyStoreFactory } from "@app/keystore/keystore";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { diff, groupBy } from "@app/lib/fn";
@@ -43,7 +44,12 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretImportDALFactory } from "../secret-import/secret-import-dal";
 import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
-import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
+import {
+  MAX_SECRET_CACHE_BYTES,
+  SECRET_DAL_TTL,
+  SecretServiceCacheKeys,
+  TSecretV2BridgeDALFactory
+} from "./secret-v2-bridge-dal";
 import {
   buildHierarchy,
   expandSecretReferencesFactory,
@@ -105,6 +111,7 @@ type TSecretV2BridgeServiceFactoryDep = {
   >;
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
+  keyStore: Pick<TKeyStoreFactory, "getItem" | "setExpiry" | "setItemWithExpiry" | "deleteItem">;
 };
 
 export type TSecretV2BridgeServiceFactory = ReturnType<typeof secretV2BridgeServiceFactory>;
@@ -127,7 +134,8 @@ export const secretV2BridgeServiceFactory = ({
   secretApprovalRequestDAL,
   secretApprovalRequestSecretDAL,
   kmsService,
-  resourceMetadataDAL
+  resourceMetadataDAL,
+  keyStore
 }: TSecretV2BridgeServiceFactoryDep) => {
   const $validateSecretReferences = async (
     projectId: string,
@@ -800,12 +808,10 @@ export const secretV2BridgeServiceFactory = ({
     const groupedFolderMappings = groupBy(folderMappings, (folderMapping) => folderMapping.folderId);
 
     const secrets = await secretDAL.findByFolderIds({
-      projectId,
       folderIds: folderMappings.map((folderMapping) => folderMapping.folderId),
       userId,
       tx: undefined,
-      filters,
-      useCache: true
+      filters
     });
 
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
@@ -909,21 +915,22 @@ export const secretV2BridgeServiceFactory = ({
     return decryptedSecrets;
   };
 
-  const getSecrets = async ({
-    actorId,
-    path,
-    environment,
-    projectId,
-    actor,
-    actorOrgId,
-    viewSecretValue,
-    actorAuthMethod,
-    includeImports,
-    recursive,
-    expandSecretReferences: shouldExpandSecretReferences,
-    throwOnMissingReadValuePermission = true,
-    ...params
-  }: TGetSecretsDTO) => {
+  const getSecrets = async (dto: TGetSecretsDTO) => {
+    const {
+      actorId,
+      path,
+      environment,
+      projectId,
+      actor,
+      actorOrgId,
+      viewSecretValue,
+      actorAuthMethod,
+      includeImports,
+      recursive,
+      expandSecretReferences: shouldExpandSecretReferences,
+      throwOnMissingReadValuePermission = true,
+      ...params
+    } = dto;
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
@@ -934,6 +941,42 @@ export const secretV2BridgeServiceFactory = ({
     });
     throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret);
 
+    const cachedSecretDalVersion = await keyStore.getItem(SecretServiceCacheKeys.getSecretDalVersion(projectId));
+    const secretDalVersion = Number(cachedSecretDalVersion || 0);
+    const cacheKey = SecretServiceCacheKeys.getSecretsOfServiceLayer(projectId, secretDalVersion, {
+      ...dto,
+      permissionRules: permission.rules
+    });
+
+    const { decryptor: secretManagerDecryptor, encryptor: secretManagerEncryptor } =
+      await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId
+      });
+
+    const encryptedCachedSecrets = await keyStore.getItem(cacheKey);
+    if (encryptedCachedSecrets) {
+      try {
+        await keyStore.setExpiry(cacheKey, SECRET_DAL_TTL);
+        const cachedSecrets = secretManagerDecryptor({ cipherTextBlob: Buffer.from(encryptedCachedSecrets, "base64") });
+        const { secrets, imports = [] } = JSON.parse(cachedSecrets.toString("utf8")) as {
+          secrets: typeof decryptedSecrets;
+          imports: typeof importedSecrets;
+        };
+        return {
+          secrets: secrets.map((el) => ({
+            ...el,
+            createdAt: new Date(el.createdAt),
+            updatedAt: new Date(el.updatedAt)
+          })),
+          imports
+        };
+      } catch (err) {
+        logger.error(err, "Secret service layer cache miss");
+        await keyStore.deleteItem(cacheKey);
+      }
+    }
+
     let paths: { folderId: string; path: string }[] = [];
 
     if (recursive) {
@@ -958,17 +1001,10 @@ export const secretV2BridgeServiceFactory = ({
     const groupedPaths = groupBy(paths, (p) => p.folderId);
 
     const secrets = await secretDAL.findByFolderIds({
-      projectId,
       folderIds: paths.map((p) => p.folderId),
       userId: actorId,
       tx: undefined,
-      filters: params,
-      useCache: true
-    });
-
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
+      filters: params
     });
 
     // scott: if any of this changes it also needs to be mirrored in secret rotation for getting dashboard secrets
@@ -1086,15 +1122,19 @@ export const secretV2BridgeServiceFactory = ({
     }
 
     if (!includeImports) {
-      return {
-        secrets: decryptedSecrets
-      };
+      const payload = { secrets: decryptedSecrets, imports: [] };
+      const encryptedUpdatedCachedSecrets = secretManagerEncryptor({
+        plainText: Buffer.from(JSON.stringify(payload))
+      }).cipherTextBlob;
+      if (encryptedUpdatedCachedSecrets.byteLength < MAX_SECRET_CACHE_BYTES) {
+        await keyStore.setItemWithExpiry(cacheKey, SECRET_DAL_TTL, encryptedUpdatedCachedSecrets.toString("base64"));
+      }
+      return payload;
     }
 
     const secretImports = await secretImportDAL.findByFolderIds(paths.map((p) => p.folderId));
     const allowedImports = secretImports.filter(({ isReplication }) => !isReplication);
     const importedSecrets = await fnSecretsV2FromImports({
-      projectId,
       viewSecretValue,
       secretImports: allowedImports,
       secretDAL,
@@ -1129,10 +1169,14 @@ export const secretV2BridgeServiceFactory = ({
       }
     });
 
-    return {
-      secrets: decryptedSecrets,
-      imports: importedSecrets
-    };
+    const payload = { secrets: decryptedSecrets, imports: importedSecrets };
+    const encryptedUpdatedCachedSecrets = secretManagerEncryptor({
+      plainText: Buffer.from(JSON.stringify(payload))
+    }).cipherTextBlob;
+    if (encryptedUpdatedCachedSecrets.byteLength < MAX_SECRET_CACHE_BYTES) {
+      await keyStore.setItemWithExpiry(cacheKey, SECRET_DAL_TTL, encryptedUpdatedCachedSecrets.toString("base64"));
+    }
+    return payload;
   };
 
   const getSecretById = async ({ actorId, actor, actorOrgId, actorAuthMethod, secretId }: TGetASecretByIdDTO) => {
@@ -1312,7 +1356,6 @@ export const secretV2BridgeServiceFactory = ({
     if (!secret && includeImports) {
       const secretImports = await secretImportDAL.find({ folderId, isReplication: false });
       const importedSecrets = await fnSecretsV2FromImports({
-        projectId,
         secretImports,
         viewSecretValue,
         secretDAL,
@@ -2729,7 +2772,7 @@ export const secretV2BridgeServiceFactory = ({
       generatePaths(folderMap).map(({ folderId, path }) => [folderId, path === "/" ? path : path.substring(1)])
     );
 
-    const secrets = await secretDAL.findByFolderIds({ folderIds: folders.map((f) => f.id), projectId, useCache: true });
+    const secrets = await secretDAL.findByFolderIds({ folderIds: folders.map((f) => f.id) });
 
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,

backend/src/services/secret/secret-queue.ts

@@ -367,7 +367,7 @@ export const secretQueueFactory = ({
       canExpandValue: () => true
     });
     // process secrets in current folder
-    const secrets = await secretV2BridgeDAL.findByFolderId({ folderId: dto.folderId, projectId: dto.projectId });
+    const secrets = await secretV2BridgeDAL.findByFolderId({ folderId: dto.folderId });
 
     await Promise.allSettled(
       secrets.map(async (secret) => {
@@ -397,7 +397,6 @@ export const secretQueueFactory = ({
     // if no imports then return secrets in the current folder
     if (!secretImports.length) return content;
     const importedSecrets = await fnSecretsV2FromImports({
-      projectId: dto.projectId,
       decryptor: dto.decryptor,
       folderDAL,
       secretDAL: secretV2BridgeDAL,

backend/src/services/smtp/smtp-service.ts

@@ -44,6 +44,7 @@ export enum SmtpTemplates {
   SecretRotationFailed = "secretRotationFailed.handlebars",
   ProjectAccessRequest = "projectAccess.handlebars",
   OrgAdminProjectDirectAccess = "orgAdminProjectGrantAccess.handlebars",
+  OrgAdminBreakglassAccess = "orgAdminBreakglassAccess.handlebars",
   ServiceTokenExpired = "serviceTokenExpired.handlebars"
 }
 

backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars

@@ -0,0 +1,20 @@
+<html>
+
+  <head>
+    <meta charset="utf-8" />
+    <meta http-equiv="x-ua-compatible" content="ie=edge" />
+    <title>Organization admin has bypassed SSO</title>
+  </head>
+
+  <body>
+    <h2>Infisical</h2>
+    <p>The organization admin {{email}} has bypassed enforced SSO login.</p>
+    <p><strong>Timestamp</strong>: {{timestamp}}</p>
+    <p><strong>IP address</strong>: {{ip}}</p>
+    <p><strong>User agent</strong>: {{userAgent}}</p>
+    <p>If you'd like to disable Admin SSO Bypass, please visit <a href="{{siteUrl}}/organization/settings">Organization Settings</a> > Security.</p>
+
+    {{emailFooter}}
+  </body>
+
+</html>