fix: removed recovery

backend/src/services/kms/kms-service.ts

@@ -11,7 +11,7 @@ import {
 } from "@app/ee/services/external-kms/providers/model";
 import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
-import { randomSecureBytes, shamirsService } from "@app/lib/crypto";
+import { randomSecureBytes } from "@app/lib/crypto";
 import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher";
 import { generateHash } from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -667,31 +667,6 @@ export const kmsServiceFactory = ({
     throw new Error(`Invalid root key encryption strategy: ${strategy}`);
   };
 
-  const exportRootEncryptionKeyParts = () => {
-    if (!ROOT_ENCRYPTION_KEY) {
-      throw new Error("Root encryption key not set");
-    }
-
-    const parts = shamirsService().share(ROOT_ENCRYPTION_KEY, 8, 4);
-
-    return parts;
-  };
-
-  const importRootEncryptionKey = async (parts: string[]) => {
-    const decryptedRootKey = shamirsService().combine(parts);
-
-    const encryptedRootKey = symmetricCipherService(SymmetricEncryption.AES_GCM_256).encrypt(
-      decryptedRootKey,
-      $getBasicEncryptionKey()
-    );
-
-    await kmsRootConfigDAL.updateById(KMS_ROOT_CONFIG_UUID, {
-      encryptedRootKey,
-      encryptionStrategy: RootKeyEncryptionStrategy.Basic
-    });
-    ROOT_ENCRYPTION_KEY = decryptedRootKey;
-  };
-
   // by keeping the decrypted data key in inner scope
   // none of the entities outside can interact directly or expose the data key
   // NOTICE: If changing here update migrations/utils/kms
@@ -972,8 +947,6 @@ export const kmsServiceFactory = ({
     getProjectKeyBackup,
     loadProjectKeyBackup,
     getKmsById,
-    createCipherPairWithDataKey,
-    exportRootEncryptionKeyParts,
-    importRootEncryptionKey
+    createCipherPairWithDataKey
   };
 };

backend/src/services/super-admin/super-admin-service.ts

@@ -23,14 +23,7 @@ type TSuperAdminServiceFactoryDep = {
   serverCfgDAL: TSuperAdminDALFactory;
   userDAL: TUserDALFactory;
   authService: Pick<TAuthLoginFactory, "generateUserTokens">;
-  kmsService: Pick<
-    TKmsServiceFactory,
-    | "encryptWithRootKey"
-    | "decryptWithRootKey"
-    | "exportRootEncryptionKeyParts"
-    | "importRootEncryptionKey"
-    | "updateEncryptionStrategy"
-  >;
+  kmsService: Pick<TKmsServiceFactory, "encryptWithRootKey" | "decryptWithRootKey" | "updateEncryptionStrategy">;
   kmsRootConfigDAL: TKmsRootConfigDALFactory;
   orgService: Pick<TOrgServiceFactory, "createOrganization">;
   keyStore: Pick<TKeyStoreFactory, "getItem" | "setItemWithExpiry" | "deleteItem">;
@@ -162,35 +155,6 @@ export const superAdminServiceFactory = ({
     return updatedServerCfg;
   };
 
-  const exportPlainKmsKey = async () => {
-    const kmsRootConfig = await kmsRootConfigDAL.findById(KMS_ROOT_CONFIG_UUID);
-
-    if (!kmsRootConfig) {
-      throw new NotFoundError({ name: "KmsRootConfig", message: "KMS root configuration not found" });
-    }
-
-    if (kmsRootConfig.exported) {
-      throw new BadRequestError({ name: "KmsRootConfig", message: "KMS root configuration already exported" });
-    }
-
-    await kmsRootConfigDAL.updateById(KMS_ROOT_CONFIG_UUID, { exported: true });
-    return kmsService.exportRootEncryptionKeyParts();
-  };
-
-  const importPlainKmsKey = async (secretParts: string[]) => {
-    const kmsRootConfig = await kmsRootConfigDAL.findById(KMS_ROOT_CONFIG_UUID);
-
-    if (!kmsRootConfig) {
-      throw new NotFoundError({ name: "KmsRootConfig", message: "KMS root configuration not found" });
-    }
-
-    if (!kmsRootConfig.exported) {
-      throw new BadRequestError({ name: "KmsRootConfig", message: "KMS root configuration was never exported" });
-    }
-
-    await kmsService.importRootEncryptionKey(secretParts);
-  };
-
   const adminSignUp = async ({
     lastName,
     firstName,
@@ -361,12 +325,17 @@ export const superAdminServiceFactory = ({
     }
 
     return {
-      strategies: enabledStrategies,
-      keyExported: kmsRootCfg.exported
+      strategies: enabledStrategies
     };
   };
 
   const updateRootEncryptionStrategy = async (strategy: RootKeyEncryptionStrategy) => {
+    if (!licenseService.onPremFeatures.hsm) {
+      throw new BadRequestError({
+        message: "Failed to update encryption strategy due to plan restriction. Upgrade to Infisical's Enterprise plan."
+      });
+    }
+
     const configuredStrategies = await getConfiguredEncryptionStrategies();
 
     const foundStrategy = configuredStrategies.strategies.find((s) => s.strategy === strategy);
@@ -390,8 +359,6 @@ export const superAdminServiceFactory = ({
     deleteUser,
     getAdminSlackConfig,
     updateRootEncryptionStrategy,
-    getConfiguredEncryptionStrategies,
-    exportPlainKmsKey,
-    importPlainKmsKey
+    getConfiguredEncryptionStrategies
   };
 };