Patch support for ENCRYPTION_KEY and ROOT_ENCRYPTION_KEY in generateSecretBlindIndexHelper

backend/src/helpers/secrets.ts

@@ -185,18 +185,43 @@ const generateSecretBlindIndexHelper = async ({
   workspaceId: Types.ObjectId;
 }) => {
   // check if workspace blind index data exists
+  const encryptionKey = await getEncryptionKey();
+  const rootEncryptionKey = await getRootEncryptionKey();
+
   const secretBlindIndexData = await SecretBlindIndexData.findOne({
     workspace: workspaceId,
-  });
+  }).select('+algorithm +keyEncoding');
 
   if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
 
+  let salt;
+  if (
+    rootEncryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64
+  ) {
+    salt = client.decryptSymmetric(
+      secretBlindIndexData.encryptedSaltCiphertext,
+      rootEncryptionKey,
+      secretBlindIndexData.saltIV,
+      secretBlindIndexData.saltTag
+    );
+
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+      secretName,
+      salt,
+    });
+
+    return secretBlindIndex;
+  } else if (
+    encryptionKey &&
+    secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8
+  ) {
     // decrypt workspace salt
-  const salt = decryptSymmetric128BitHexKeyUTF8({
+    salt = decryptSymmetric128BitHexKeyUTF8({
       ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
       iv: secretBlindIndexData.saltIV,
       tag: secretBlindIndexData.saltTag,
-    key: await getEncryptionKey(),
+      key: encryptionKey,
     });
 
     const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
@@ -205,6 +230,11 @@ const generateSecretBlindIndexHelper = async ({
     });
 
     return secretBlindIndex;
+  }
+  
+  throw InternalServerError({
+    message: 'Failed to generate secret blind index'
+  });
 };
 
 /**

backend/src/validation/workspace.ts

@@ -51,7 +51,6 @@ export const validateClientForWorkspace = async ({
 	requiredPermissions?: string[];
 	requireBlindIndicesEnabled: boolean;
 }) => {
-	
 	const workspace = await Workspace.findById(workspaceId);
 
 	if (!workspace) throw WorkspaceNotFoundError({