feat: added auto bot creator when bot is missing by taking the user old server encrypted private key

2026-10-15 12:38:36 +00:00 · 2024-07-30 23:19:31 +05:30
parent 6e7997b1bd
commit b37f780c4c
3 changed files with 102 additions and 8 deletions
@@ -1,5 +1,11 @@
 import { SecretKeyEncoding } from "@app/db/schemas";
-import { decryptAsymmetric, infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
+import {
+  decryptAsymmetric,
+  encryptAsymmetric,
+  generateAsymmetricKeyPair,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal";

@@ -27,11 +33,61 @@ export const getBotKeyFnFactory = (
    }

    const bot = await projectBotDAL.findOne({ projectId: project.id });
+    if (!bot || !bot.isActive || !bot.encryptedProjectKey || !bot.encryptedProjectKeyNonce) {
+      // trying to set bot automatically
+      const projectV1Keys = await projectBotDAL.findProjectUserWorkspaceKey(projectId);
+      if (!projectV1Keys)
+        throw new BadRequestError({ message: "Bot not found. [no-private-key]. Please ask admin user to login" });

-    if (!bot) throw new BadRequestError({ message: "Failed to find bot key", name: "bot_not_found_error" });
-    if (!bot.isActive) throw new BadRequestError({ message: "Bot is not active", name: "bot_not_found_error" });
-    if (!bot.encryptedProjectKeyNonce || !bot.encryptedProjectKey)
-      throw new BadRequestError({ message: "Encryption key missing", name: "bot_not_found_error" });
+      let userPrivateKey = "";
+      if (
+        projectV1Keys?.serverEncryptedPrivateKey &&
+        projectV1Keys.serverEncryptedPrivateKeyIV &&
+        projectV1Keys.serverEncryptedPrivateKeyTag &&
+        projectV1Keys.serverEncryptedPrivateKeyEncoding
+      ) {
+        userPrivateKey = infisicalSymmetricDecrypt({
+          iv: projectV1Keys.serverEncryptedPrivateKeyIV,
+          tag: projectV1Keys.serverEncryptedPrivateKeyTag,
+          ciphertext: projectV1Keys.serverEncryptedPrivateKey,
+          keyEncoding: projectV1Keys.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding
+        });
+      }
+      const workspaceKey = decryptAsymmetric({
+        ciphertext: projectV1Keys.projectEncryptedKey,
+        nonce: projectV1Keys.projectKeyNonce,
+        publicKey: projectV1Keys.senderPublicKey,
+        privateKey: userPrivateKey
+      });
+      const botKey = generateAsymmetricKeyPair();
+      const { iv, tag, ciphertext, encoding, algorithm } = infisicalSymmetricEncypt(botKey.privateKey);
+      const encryptedWorkspaceKey = encryptAsymmetric(workspaceKey, botKey.publicKey, userPrivateKey);
+
+      if (!bot) {
+        await projectBotDAL.create({
+          name: "Infisical Bot (Ghost)",
+          projectId,
+          tag,
+          iv,
+          encryptedPrivateKey: ciphertext,
+          isActive: true,
+          publicKey: botKey.publicKey,
+          algorithm,
+          keyEncoding: encoding,
+          encryptedProjectKey: encryptedWorkspaceKey.ciphertext,
+          encryptedProjectKeyNonce: encryptedWorkspaceKey.nonce,
+          senderId: projectV1Keys.userId
+        });
+      } else {
+        await projectBotDAL.updateById(bot.id, {
+          isActive: true,
+          encryptedProjectKey: encryptedWorkspaceKey.ciphertext,
+          encryptedProjectKeyNonce: encryptedWorkspaceKey.nonce,
+          senderId: projectV1Keys.userId
+        });
+      }
+      return { botKey: workspaceKey, project, shouldUseSecretV2Bridge: false };
+    }

    const botPrivateKey = getBotPrivateKey({ bot });