requested changes

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -1,15 +1,9 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
-import {
+import { TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas";
-  TableName,
-  TSecretSnapshotFolders,
-  TSecretSnapshotSecretsV2,
-  TSecretTagJunctionInsert,
-  TSecretV2TagJunctionInsert
-} from "@app/db/schemas";
 import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
 import { InternalServerError, NotFoundError } from "@app/lib/errors";
-import { chunkArray, groupBy } from "@app/lib/fn";
+import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
@@ -247,14 +241,8 @@ export const secretSnapshotServiceFactory = ({
             tx
           );
 
-          const chunkedSnapshotSecrets = chunkArray(secretVersions, 2500);
+          const snapshotSecrets = await snapshotSecretV2BridgeDAL.batchInsert(
-          const chunkedSnapshotFolders = chunkArray(folderVersions, 2500);
+            secretVersions.map(({ id }) => ({
-          const snapshotSecrets: TSecretSnapshotSecretsV2[] = [];
-          const snapshotFolders: TSecretSnapshotFolders[] = [];
-
-          for await (const chunk of chunkedSnapshotSecrets) {
-            const result = await snapshotSecretV2BridgeDAL.insertMany(
-              chunk.map(({ id }) => ({
               secretVersionId: id,
               envId: folder.environment.envId,
               snapshotId: newSnapshot.id
@@ -262,12 +250,8 @@ export const secretSnapshotServiceFactory = ({
             tx
           );
 
-            snapshotSecrets.push(...result);
+          const snapshotFolders = await snapshotFolderDAL.batchInsert(
-          }
+            folderVersions.map(({ id }) => ({
-
-          for await (const chunk of chunkedSnapshotFolders) {
-            const result = await snapshotFolderDAL.insertMany(
-              chunk.map(({ id }) => ({
               folderVersionId: id,
               envId: folder.environment.envId,
               snapshotId: newSnapshot.id
@@ -275,9 +259,6 @@ export const secretSnapshotServiceFactory = ({
             tx
           );
 
-            snapshotFolders.push(...result);
-          }
-
           return { ...newSnapshot, secrets: snapshotSecrets, folder: snapshotFolders };
         });
         return snapshot;

backend/src/server/routes/index.ts

@@ -1206,8 +1206,16 @@ export const registerRoutes = async (
   const externalMigrationQueue = externalMigrationQueueFactory({
     orgService,
     projectEnvService,
+    projectDAL,
     projectService,
     smtpService,
+    kmsService,
+    projectEnvDAL,
+    secretVersionDAL: secretVersionV2BridgeDAL,
+    secretTagDAL,
+    secretVersionTagDAL: secretVersionTagV2BridgeDAL,
+    folderDAL,
+    secretDAL: secretV2BridgeDAL,
     queueService,
     secretV2BridgeService
   });

backend/src/services/external-migration/external-migration-fns.ts

@@ -4,19 +4,39 @@ import sjcl from "sjcl";
 import tweetnacl from "tweetnacl";
 import tweetnaclUtil from "tweetnacl-util";
 
-import { OrgMembershipRole, ProjectMembershipRole } from "@app/db/schemas";
+import { OrgMembershipRole, ProjectMembershipRole, SecretType } from "@app/db/schemas";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { chunkArray } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 
+import { TKmsServiceFactory } from "../kms/kms-service";
+import { KmsDataKey } from "../kms/kms-types";
 import { TOrgServiceFactory } from "../org/org-service";
+import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectServiceFactory } from "../project/project-service";
+import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
+import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
+import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
+import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
+import { fnSecretBulkInsert, getAllNestedSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
 import type { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
+import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
+import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
 import { InfisicalImportData, TEnvKeyExportJSON, TImportInfisicalDataCreate } from "./external-migration-types";
 
 export type TImportDataIntoInfisicalDTO = {
+  projectDAL: Pick<TProjectDALFactory, "transaction">;
+  projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findLastEnvPosition" | "create" | "findOne">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
+  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
+  secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
+
+  folderDAL: Pick<TSecretFolderDALFactory, "create" | "findBySecretPath">;
   projectService: Pick<TProjectServiceFactory, "createProject">;
   orgService: Pick<TOrgServiceFactory, "inviteUserToOrganization">;
   projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
@@ -91,9 +111,15 @@ export const parseEnvKeyDataFn = async (decryptedJson: string): Promise<Infisica
 
 export const importDataIntoInfisicalFn = async ({
   projectService,
+  projectEnvDAL,
+  projectDAL,
   orgService,
-  projectEnvService,
+  secretDAL,
-  secretV2BridgeService,
+  kmsService,
+  secretVersionDAL,
+  secretTagDAL,
+  secretVersionTagDAL,
+  folderDAL,
   input: { data, actor, actorId, actorOrgId, actorAuthMethod }
 }: TImportDataIntoInfisicalDTO) => {
   // Import data to infisical
@@ -104,6 +130,7 @@ export const importDataIntoInfisicalFn = async ({
   const originalToNewProjectId = new Map<string, string>();
   const originalToNewEnvironmentId = new Map<string, string>();
 
+  await projectDAL.transaction(async (tx) => {
     for await (const project of data.projects) {
       const newProject = await projectService
         .createProject({
@@ -112,10 +139,12 @@ export const importDataIntoInfisicalFn = async ({
           actorOrgId,
           actorAuthMethod,
           workspaceName: project.name,
-        createDefaultEnvs: false
+          createDefaultEnvs: false,
+          tx
         })
-      .catch(() => {
+        .catch((e) => {
-        throw new BadRequestError({ message: `Failed to import to project [name:${project.name}` });
+          logger.error(e, `Failed to import to project [name:${project.name}]`);
+          throw new BadRequestError({ message: `Failed to import to project [name:${project.name}]` });
         });
 
       originalToNewProjectId.set(project.id, newProject.id);
@@ -123,6 +152,7 @@ export const importDataIntoInfisicalFn = async ({
 
     // Invite user importing projects
     const invites = await orgService.inviteUserToOrganization({
+      verifyPermissions: false,
       actorAuthMethod,
       actorId,
       actorOrgId,
@@ -133,7 +163,8 @@ export const importDataIntoInfisicalFn = async ({
       projects: Array.from(originalToNewProjectId.values()).map((project) => ({
         id: project,
         projectRoleSlug: [ProjectMembershipRole.Member]
-    }))
+      })),
+      tx
     });
     if (!invites) {
       throw new BadRequestError({ message: `Failed to invite user to projects: [userId:${actorId}]` });
@@ -142,30 +173,23 @@ export const importDataIntoInfisicalFn = async ({
     // Import environments
     if (data.environments) {
       for await (const environment of data.environments) {
-      try {
+        const projectId = originalToNewProjectId.get(environment.projectId)!;
-        const newEnvironment = await projectEnvService.createEnvironment({
+        const slug = slugify(`${environment.name}-${alphaNumericNanoId(4)}`);
-          actor,
-          actorId,
-          actorOrgId,
-          actorAuthMethod,
-          name: environment.name,
-          projectId: originalToNewProjectId.get(environment.projectId)!,
-          slug: slugify(`${environment.name}-${alphaNumericNanoId(4)}`)
-        });
 
-        if (!newEnvironment) {
+        const existingEnv = await projectEnvDAL.findOne({ projectId, slug }, tx);
-          logger.error(`Failed to import environment: [name:${environment.name}]`);
+
+        if (existingEnv) {
           throw new BadRequestError({
-            message: `Failed to import environment: [name:${environment.name}]`
+            message: `Environment with slug '${slug}' already exist`,
-          });
+            name: "CreateEnvironment"
-        }
-        originalToNewEnvironmentId.set(environment.id, newEnvironment.slug);
-      } catch (error) {
-        throw new BadRequestError({
-          message: `Failed to import environment: ${environment.name}]`,
-          name: "EnvKeyMigrationImportEnvironment"
           });
         }
+
+        const lastPos = await projectEnvDAL.findLastEnvPosition(projectId, tx);
+        const doc = await projectEnvDAL.create({ slug, name: environment.name, projectId, position: lastPos + 1 }, tx);
+        await folderDAL.create({ name: "root", parentId: null, envId: doc.id, version: 1 }, tx);
+
+        originalToNewEnvironmentId.set(environment.id, doc.slug);
       }
     }
 
@@ -191,26 +215,67 @@ export const importDataIntoInfisicalFn = async ({
       // for each of the mappedEnvironmentId
       for await (const [envId, secrets] of mappedToEnvironmentId) {
         const environment = data.environments.find((env) => env.id === envId);
-      const projectId = environment?.projectId;
+        const projectId = originalToNewProjectId.get(environment?.projectId as string)!;
 
         if (!projectId) {
           throw new BadRequestError({ message: `Failed to import secret, project not found` });
         }
 
-      const secretBatches = chunkArray(secrets, 2500);
+        const { encryptor: secretManagerEncrypt } = await kmsService.createCipherPairWithDataKey(
+          {
+            type: KmsDataKey.SecretManager,
+            projectId
+          },
+          tx
+        );
 
+        const envSlug = originalToNewEnvironmentId.get(envId)!;
+        const folder = await folderDAL.findBySecretPath(projectId, envSlug, "/", tx);
+        if (!folder)
+          throw new NotFoundError({
+            message: `Folder not found for the given environment slug (${envSlug}) & secret path (/)`,
+            name: "Create secret"
+          });
+
+        const secretsByKeys = await secretDAL.findBySecretKeys(
+          folder.id,
+          secrets.map((el) => ({
+            key: el.secretKey,
+            type: SecretType.Shared
+          })),
+          tx
+        );
+        if (secretsByKeys.length) {
+          throw new BadRequestError({
+            message: `Secret already exist: ${secretsByKeys.map((el) => el.key).join(",")}`
+          });
+        }
+
+        const secretBatches = chunkArray(secrets, 2500);
         for await (const secretBatch of secretBatches) {
-        await secretV2BridgeService.createManySecret({
+          await fnSecretBulkInsert({
-          actorId,
+            inputSecrets: secretBatch.map((el) => {
-          actor,
+              const references = getAllNestedSecretReferences(el.secretValue);
-          actorOrgId,
+
-          environment: originalToNewEnvironmentId.get(envId)!,
+              return {
-          actorAuthMethod,
+                version: 1,
-          projectId: originalToNewProjectId.get(projectId)!,
+                encryptedValue: el.secretValue
-          secretPath: "/",
+                  ? secretManagerEncrypt({ plainText: Buffer.from(el.secretValue) }).cipherTextBlob
-          secrets: secretBatch
+                  : undefined,
+                key: el.secretKey,
+                references,
+                type: SecretType.Shared
+              };
+            }),
+            folderId: folder.id,
+            secretDAL,
+            secretVersionDAL,
+            secretTagDAL,
+            secretVersionTagDAL,
+            tx
           });
         }
       }
     }
+  });
 };

backend/src/services/external-migration/external-migration-queue.ts

@@ -3,22 +3,40 @@ import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 
+import { TKmsServiceFactory } from "../kms/kms-service";
 import { TOrgServiceFactory } from "../org/org-service";
+import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectServiceFactory } from "../project/project-service";
+import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
+import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
+import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
+import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
+import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
+import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { importDataIntoInfisicalFn } from "./external-migration-fns";
 import { ExternalPlatforms, TImportInfisicalDataCreate } from "./external-migration-types";
 
 export type TExternalMigrationQueueFactoryDep = {
+  smtpService: TSmtpService;
+  queueService: TQueueServiceFactory;
+
+  projectDAL: Pick<TProjectDALFactory, "transaction">;
+  projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findLastEnvPosition" | "create" | "findOne">;
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
+
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
+  secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
+  secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
+
+  folderDAL: Pick<TSecretFolderDALFactory, "create" | "findBySecretPath">;
   projectService: Pick<TProjectServiceFactory, "createProject">;
   orgService: Pick<TOrgServiceFactory, "inviteUserToOrganization">;
   projectEnvService: Pick<TProjectEnvServiceFactory, "createEnvironment">;
   secretV2BridgeService: Pick<TSecretV2BridgeServiceFactory, "createManySecret">;
-
-  smtpService: TSmtpService;
-  queueService: TQueueServiceFactory;
 };
 
 export type TExternalMigrationQueueFactory = ReturnType<typeof externalMigrationQueueFactory>;
@@ -28,8 +46,16 @@ export const externalMigrationQueueFactory = ({
   projectService,
   orgService,
   smtpService,
+  projectDAL,
   projectEnvService,
-  secretV2BridgeService
+  secretV2BridgeService,
+  kmsService,
+  projectEnvDAL,
+  secretDAL,
+  secretVersionDAL,
+  secretTagDAL,
+  secretVersionTagDAL,
+  folderDAL
 }: TExternalMigrationQueueFactoryDep) => {
   const startImport = async (dto: {
     actorEmail: string;
@@ -76,6 +102,14 @@ export const externalMigrationQueueFactory = ({
 
       await importDataIntoInfisicalFn({
         input: decryptedJson,
+        projectDAL,
+        projectEnvDAL,
+        secretDAL,
+        secretVersionDAL,
+        secretTagDAL,
+        secretVersionTagDAL,
+        folderDAL,
+        kmsService,
         projectService,
         orgService,
         projectEnvService,

backend/src/services/kms/kms-service.ts

@@ -160,8 +160,8 @@ export const kmsServiceFactory = ({
    * In mean time the rest of the request will wait until creation is finished followed by getting the created on
    * In real time this would be milliseconds
    */
-  const getOrgKmsKeyId = async (orgId: string) => {
+  const getOrgKmsKeyId = async (orgId: string, trx?: Knex) => {
-    let org = await orgDAL.findById(orgId);
+    let org = await orgDAL.findById(orgId, trx);
 
     if (!org) {
       throw new NotFoundError({ message: "Org not found" });
@@ -180,9 +180,9 @@ export const kmsServiceFactory = ({
             waitingCb: () => logger.info("KMS. Waiting for org key to be created")
           });
 
-          org = await orgDAL.findById(orgId);
+          org = await orgDAL.findById(orgId, trx);
         } else {
-          const keyId = await orgDAL.transaction(async (tx) => {
+          const keyId = await (trx || orgDAL).transaction(async (tx) => {
             org = await orgDAL.findById(orgId, tx);
             if (org.kmsDefaultKeyId) {
               return org.kmsDefaultKeyId;
@@ -240,11 +240,12 @@ export const kmsServiceFactory = ({
 
   const decryptWithKmsKey = async ({
     kmsId,
-    depth = 0
+    depth = 0,
-  }: Omit<TDecryptWithKmsDTO, "cipherTextBlob"> & { depth?: number }) => {
+    tx
+  }: Omit<TDecryptWithKmsDTO, "cipherTextBlob"> & { depth?: number; tx?: Knex }) => {
     if (depth > 2) throw new BadRequestError({ message: "KMS depth max limit" });
 
-    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId);
+    const kmsDoc = await kmsDAL.findByIdWithAssociatedKms(kmsId, tx);
     if (!kmsDoc) {
       throw new NotFoundError({ message: "KMS ID not found" });
     }
@@ -261,7 +262,8 @@ export const kmsServiceFactory = ({
       // we put a limit of depth to avoid too many cycles
       const orgKmsDecryptor = await decryptWithKmsKey({
         kmsId: kmsDoc.orgKms.id,
-        depth: depth + 1
+        depth: depth + 1,
+        tx
       });
 
       const orgKmsDataKey = await orgKmsDecryptor({
@@ -375,9 +377,9 @@ export const kmsServiceFactory = ({
     };
   };
 
-  const $getOrgKmsDataKey = async (orgId: string) => {
+  const $getOrgKmsDataKey = async (orgId: string, trx?: Knex) => {
-    const kmsKeyId = await getOrgKmsKeyId(orgId);
+    const kmsKeyId = await getOrgKmsKeyId(orgId, trx);
-    let org = await orgDAL.findById(orgId);
+    let org = await orgDAL.findById(orgId, trx);
 
     if (!org) {
       throw new NotFoundError({ message: "Org not found" });
@@ -396,9 +398,9 @@ export const kmsServiceFactory = ({
             waitingCb: () => logger.info("KMS. Waiting for org data key to be created")
           });
 
-          org = await orgDAL.findById(orgId);
+          org = await orgDAL.findById(orgId, trx);
         } else {
-          const orgDataKey = await orgDAL.transaction(async (tx) => {
+          const orgDataKey = await (trx || orgDAL).transaction(async (tx) => {
             org = await orgDAL.findById(orgId, tx);
             if (org.kmsEncryptedDataKey) {
               return;
@@ -455,8 +457,8 @@ export const kmsServiceFactory = ({
     });
   };
 
-  const getProjectSecretManagerKmsKeyId = async (projectId: string) => {
+  const getProjectSecretManagerKmsKeyId = async (projectId: string, trx?: Knex) => {
-    let project = await projectDAL.findById(projectId);
+    let project = await projectDAL.findById(projectId, trx);
     if (!project) {
       throw new NotFoundError({ message: "Project not found" });
     }
@@ -477,7 +479,7 @@ export const kmsServiceFactory = ({
 
           project = await projectDAL.findById(projectId);
         } else {
-          const kmsKeyId = await projectDAL.transaction(async (tx) => {
+          const kmsKeyId = await (trx || projectDAL).transaction(async (tx) => {
             project = await projectDAL.findById(projectId, tx);
             if (project.kmsSecretManagerKeyId) {
               return project.kmsSecretManagerKeyId;
@@ -520,9 +522,9 @@ export const kmsServiceFactory = ({
     return project.kmsSecretManagerKeyId;
   };
 
-  const $getProjectSecretManagerKmsDataKey = async (projectId: string) => {
+  const $getProjectSecretManagerKmsDataKey = async (projectId: string, trx?: Knex) => {
-    const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId);
+    const kmsKeyId = await getProjectSecretManagerKmsKeyId(projectId, trx);
-    let project = await projectDAL.findById(projectId);
+    let project = await projectDAL.findById(projectId, trx);
 
     if (!project.kmsSecretManagerEncryptedDataKey) {
       const lock = await keyStore
@@ -538,18 +540,21 @@ export const kmsServiceFactory = ({
             delay: 500
           });
 
-          project = await projectDAL.findById(projectId);
+          project = await projectDAL.findById(projectId, trx);
         } else {
-          const projectDataKey = await projectDAL.transaction(async (tx) => {
+          const projectDataKey = await (trx || projectDAL).transaction(async (tx) => {
             project = await projectDAL.findById(projectId, tx);
             if (project.kmsSecretManagerEncryptedDataKey) {
               return;
             }
 
             const dataKey = randomSecureBytes();
-            const kmsEncryptor = await encryptWithKmsKey({
+            const kmsEncryptor = await encryptWithKmsKey(
+              {
                 kmsId: kmsKeyId
-            });
+              },
+              tx
+            );
 
             const { cipherTextBlob } = await kmsEncryptor({
               plainText: dataKey
@@ -585,7 +590,8 @@ export const kmsServiceFactory = ({
     }
 
     const kmsDecryptor = await decryptWithKmsKey({
-      kmsId: kmsKeyId
+      kmsId: kmsKeyId,
+      tx: trx
     });
 
     return kmsDecryptor({
@@ -593,13 +599,13 @@ export const kmsServiceFactory = ({
     });
   };
 
-  const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO) => {
+  const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO, trx?: Knex) => {
     switch (dto.type) {
       case KmsDataKey.SecretManager: {
-        return $getProjectSecretManagerKmsDataKey(dto.projectId);
+        return $getProjectSecretManagerKmsDataKey(dto.projectId, trx);
       }
       default: {
-        return $getOrgKmsDataKey(dto.orgId);
+        return $getOrgKmsDataKey(dto.orgId, trx);
       }
     }
   };
@@ -607,8 +613,9 @@ export const kmsServiceFactory = ({
   // by keeping the decrypted data key in inner scope
   // none of the entities outside can interact directly or expose the data key
   // NOTICE: If changing here update migrations/utils/kms
-  const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => {
+  const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO, trx?: Knex) => {
-    const dataKey = await $getDataKey(encryptionContext);
+    const dataKey = await $getDataKey(encryptionContext, trx);
+
     const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
 
     return {

backend/src/services/org/org-service.ts

@@ -1,5 +1,6 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, MongoAbility } from "@casl/ability";
 import slugify from "@sindresorhus/slugify";
+import { MongoQuery } from "@ucast/mongo2js";
 import crypto from "crypto";
 import jwt from "jsonwebtoken";
 import { Knex } from "knex";
@@ -19,7 +20,11 @@ import { TProjects } from "@app/db/schemas/projects";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import {
+  OrgPermissionActions,
+  OrgPermissionSet,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -487,11 +492,17 @@ export const orgServiceFactory = ({
     organizationRoleSlug,
     projects: invitedProjects,
     actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    tx: trx,
+    verifyPermissions = true
   }: TInviteUserToOrgDTO) => {
     const appCfg = getConfig();
 
-    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
+    let permission: MongoAbility<OrgPermissionSet, MongoQuery> | undefined;
+    if (verifyPermissions) {
+      permission = (await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId))
+        .permission;
+    }
 
     const org = await orgDAL.findOrgById(orgId);
 
@@ -512,12 +523,15 @@ export const orgServiceFactory = ({
     }
 
     const projectsToInvite = invitedProjects?.length
-      ? await projectDAL.find({
+      ? await projectDAL.find(
+          {
             orgId,
             $in: {
               id: invitedProjects?.map(({ id }) => id)
             }
-        })
+          },
+          { tx: trx }
+        )
       : [];
     if (projectsToInvite.length !== invitedProjects?.length) {
       throw new ForbiddenRequestError({
@@ -534,7 +548,7 @@ export const orgServiceFactory = ({
     const mailsForOrgInvitation: { email: string; userId: string; firstName: string; lastName: string }[] = [];
     const mailsForProjectInvitation: { email: string[]; projectName: string }[] = [];
     const newProjectMemberships: TProjectMemberships[] = [];
-    await orgDAL.transaction(async (tx) => {
+    await (trx || orgDAL).transaction(async (tx) => {
       const users: Pick<TUsers, "id" | "firstName" | "lastName" | "email" | "username">[] = [];
 
       for await (const inviteeEmail of inviteeEmails) {
@@ -620,8 +634,16 @@ export const orgServiceFactory = ({
             });
           }
 
+          if (verifyPermissions) {
+            if (!permission) {
+              throw new ForbiddenRequestError({
+                name: "InviteUser",
+                message: "Failed to invite user because no permission was found"
+              });
+            }
             // as its used by project invite also
             ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Member);
+          }
           let roleId;
           const orgRole = isCustomOrgRole ? OrgMembershipRole.Custom : organizationRoleSlug;
           if (isCustomOrgRole) {
@@ -662,6 +684,7 @@ export const orgServiceFactory = ({
       // if there exist no project membership we set is as given by the request
       for await (const project of projectsToInvite) {
         const projectId = project.id;
+        if (verifyPermissions) {
           const { permission: projectPermission } = await permissionService.getProjectPermission(
             actor,
             actorId,
@@ -673,6 +696,7 @@ export const orgServiceFactory = ({
             ProjectPermissionActions.Create,
             ProjectPermissionSub.Member
           );
+        }
         const existingMembers = await projectMembershipDAL.find(
           {
             projectId: project.id,

backend/src/services/org/org-types.ts

@@ -1,3 +1,5 @@
+import { Knex } from "knex";
+
 import { TOrgPermission } from "@app/lib/types";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
@@ -26,18 +28,15 @@ export type TDeleteOrgMembershipDTO = {
 };
 
 export type TInviteUserToOrgDTO = {
-  actorId: string;
-  actor: ActorType;
-  orgId: string;
-  actorOrgId: string | undefined;
-  actorAuthMethod: ActorAuthMethod;
   inviteeEmails: string[];
   organizationRoleSlug: string;
+  tx?: Knex;
+  verifyPermissions?: boolean;
   projects?: {
     id: string;
     projectRoleSlug?: string[];
   }[];
-};
+} & TOrgPermission;
 
 export type TVerifyUserToOrgDTO = {
   email: string;

backend/src/services/project-env/project-env-service.ts

@@ -39,7 +39,8 @@ export const projectEnvServiceFactory = ({
     actorAuthMethod,
     position,
     name,
-    slug
+    slug,
+    tx: trx
   }: TCreateEnvDTO) => {
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -83,7 +84,7 @@ export const projectEnvServiceFactory = ({
         });
       }
 
-      const env = await projectEnvDAL.transaction(async (tx) => {
+      const env = await (trx || projectEnvDAL).transaction(async (tx) => {
         if (position !== undefined) {
           // Check if there's an environment at the specified position
           const existingEnvWithPosition = await projectEnvDAL.findOne({ projectId, position }, tx);

backend/src/services/project-env/project-env-types.ts

@@ -1,9 +1,12 @@
+import { Knex } from "knex";
+
 import { TProjectPermission } from "@app/lib/types";
 
 export type TCreateEnvDTO = {
   name: string;
   slug: string;
   position?: number;
+  tx?: Knex;
 } & TProjectPermission;
 
 export type TUpdateEnvDTO = {

backend/src/services/project/project-service.ts

@@ -147,6 +147,7 @@ export const projectServiceFactory = ({
     workspaceName,
     slug: projectSlug,
     kmsKeyId,
+    tx: trx,
     createDefaultEnvs = true
   }: TCreateProjectDTO) => {
     const organization = await orgDAL.findOne({ id: actorOrgId });
@@ -169,7 +170,7 @@ export const projectServiceFactory = ({
       });
     }
 
-    const results = await projectDAL.transaction(async (tx) => {
+    const results = await (trx || projectDAL).transaction(async (tx) => {
       const ghostUser = await orgService.addGhostUser(organization.id, tx);
 
       if (kmsKeyId) {

backend/src/services/project/project-types.ts

@@ -1,3 +1,5 @@
+import { Knex } from "knex";
+
 import { TProjectKeys } from "@app/db/schemas";
 import { TProjectPermission } from "@app/lib/types";
 
@@ -30,6 +32,7 @@ export type TCreateProjectDTO = {
   slug?: string;
   kmsKeyId?: string;
   createDefaultEnvs?: boolean;
+  tx?: Knex;
 };
 
 export type TDeleteProjectBySlugDTO = {

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -82,7 +82,10 @@ export const fnSecretBulkInsert = async ({
     })
   );
 
-  const newSecrets = await secretDAL.insertMany(sanitizedInputSecrets.map((el) => ({ ...el, folderId })));
+  const newSecrets = await secretDAL.insertMany(
+    sanitizedInputSecrets.map((el) => ({ ...el, folderId })),
+    tx
+  );
   const newSecretGroupedByKeyName = groupBy(newSecrets, (item) => item.key);
   const newSecretTags = inputSecrets.flatMap(({ tagIds: secretTags = [], key }) =>
     secretTags.map((tag) => ({

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -911,7 +911,8 @@ export const secretV2BridgeServiceFactory = ({
     actorOrgId,
     environment,
     projectId,
-    secrets: inputSecrets
+    secrets: inputSecrets,
+    tx: trx
   }: TCreateManySecretDTO) => {
     const { permission } = await permissionService.getProjectPermission(
       actor,
@@ -951,7 +952,7 @@ export const secretV2BridgeServiceFactory = ({
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId });
 
-    const newSecrets = await secretDAL.transaction(async (tx) =>
+    const newSecrets = await (trx || secretDAL).transaction(async (tx) =>
       fnSecretBulkInsert({
         inputSecrets: inputSecrets.map((el) => {
           const references = getAllNestedSecretReferences(el.secretValue);

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -81,6 +81,7 @@ export type TCreateManySecretDTO = Omit<TProjectPermission, "projectId"> & {
   secretPath: string;
   projectId: string;
   environment: string;
+  tx?: Knex;
   secrets: {
     secretKey: string;
     secretValue: string;

frontend/src/views/Settings/OrgSettingsPage/components/ImportTab/components/EnvKeyPlatformModal.tsx

@@ -54,8 +54,9 @@ export const EnvKeyPlatformModal = ({ onClose }: Props) => {
         decryptionKey: data.encryptionKey
       });
       createNotification({
-        text: "Data imported successfully.",
+        title: "Import started",
-        type: "success"
+        text: "Your data is being imported. You will receive an email when the import is complete or if the import fails. This may take up to 10 minutes.",
+        type: "info"
       });
 
       onClose();