From aaca66e5a46d9d7a084be475419eaed9ad906cf2 Mon Sep 17 00:00:00 2001
From: Tuan Dang <dangtony98@gmail.com>
Date: Tue, 6 Jun 2023 14:24:06 +0100
Subject: [PATCH] Patch support for ENCRYPTION_KEY and ROOT_ENCRYPTION_KEY in
 generateSecretBlindIndexHelper

---
 backend/src/helpers/secrets.ts      | 56 ++++++++++++++++++++++-------
 backend/src/validation/workspace.ts |  1 -
 2 files changed, 43 insertions(+), 14 deletions(-)

diff --git a/backend/src/helpers/secrets.ts b/backend/src/helpers/secrets.ts
index 193c82698..69ca78e7e 100644
--- a/backend/src/helpers/secrets.ts
+++ b/backend/src/helpers/secrets.ts
@@ -185,26 +185,56 @@ const generateSecretBlindIndexHelper = async ({
   workspaceId: Types.ObjectId;
 }) => {
   // check if workspace blind index data exists
+  const encryptionKey = await getEncryptionKey();
+  const rootEncryptionKey = await getRootEncryptionKey();
+
   const secretBlindIndexData = await SecretBlindIndexData.findOne({
     workspace: workspaceId,
-  });
+  }).select('+algorithm +keyEncoding');
 
   if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
 
-  // decrypt workspace salt
-  const salt = decryptSymmetric128BitHexKeyUTF8({
-    ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
-    iv: secretBlindIndexData.saltIV,
-    tag: secretBlindIndexData.saltTag,
-    key: await getEncryptionKey(),
-  });
+  let salt;
+  if (
+    rootEncryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64
+  ) {
+    salt = client.decryptSymmetric(
+      secretBlindIndexData.encryptedSaltCiphertext,
+      rootEncryptionKey,
+      secretBlindIndexData.saltIV,
+      secretBlindIndexData.saltTag
+    );
 
-  const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
-    secretName,
-    salt,
-  });
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+      secretName,
+      salt,
+    });
 
-  return secretBlindIndex;
+    return secretBlindIndex;
+  } else if (
+    encryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8
+  ) {
+    // decrypt workspace salt
+    salt = decryptSymmetric128BitHexKeyUTF8({
+      ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+      iv: secretBlindIndexData.saltIV,
+      tag: secretBlindIndexData.saltTag,
+      key: encryptionKey,
+    });
+
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+      secretName,
+      salt,
+    });
+
+    return secretBlindIndex;
+  }
+  
+  throw InternalServerError({
+    message: 'Failed to generate secret blind index'
+  });
 };
 
 /**
diff --git a/backend/src/validation/workspace.ts b/backend/src/validation/workspace.ts
index 1cbdca420..b7a04634f 100644
--- a/backend/src/validation/workspace.ts
+++ b/backend/src/validation/workspace.ts
@@ -51,7 +51,6 @@ export const validateClientForWorkspace = async ({
 	requiredPermissions?: string[];
 	requireBlindIndicesEnabled: boolean;
 }) => {
-	
 	const workspace = await Workspace.findById(workspaceId);
 
 	if (!workspace) throw WorkspaceNotFoundError({