Merge pull request #4270 from Infisical/daniel/srp-removal-round-2

feat: srp removal

backend/src/lib/crypto/secret-encryption.ts

@@ -53,7 +53,7 @@ type DecryptedIntegrationAuths = z.infer<typeof DecryptedIntegrationAuthsSchema>
 
 type TLatestKey = TProjectKeys & {
   sender: {
-    publicKey: string;
+    publicKey?: string;
   };
 };
 
@@ -91,6 +91,10 @@ const getDecryptedValues = (data: Array<{ ciphertext: string; iv: string; tag: s
   return results;
 };
 export const decryptSecrets = (encryptedSecrets: TSecrets[], privateKey: string, latestKey: TLatestKey) => {
+  if (!latestKey.sender.publicKey) {
+    throw new Error("Latest key sender public key not found");
+  }
+
   const key = crypto.encryption().asymmetric().decrypt({
     ciphertext: latestKey.encryptedKey,
     nonce: latestKey.nonce,
@@ -143,6 +147,10 @@ export const decryptSecretVersions = (
   privateKey: string,
   latestKey: TLatestKey
 ) => {
+  if (!latestKey.sender.publicKey) {
+    throw new Error("Latest key sender public key not found");
+  }
+
   const key = crypto.encryption().asymmetric().decrypt({
     ciphertext: latestKey.encryptedKey,
     nonce: latestKey.nonce,
@@ -195,6 +203,10 @@ export const decryptSecretApprovals = (
   privateKey: string,
   latestKey: TLatestKey
 ) => {
+  if (!latestKey.sender.publicKey) {
+    throw new Error("Latest key sender public key not found");
+  }
+
   const key = crypto.encryption().asymmetric().decrypt({
     ciphertext: latestKey.encryptedKey,
     nonce: latestKey.nonce,
@@ -247,6 +259,10 @@ export const decryptIntegrationAuths = (
   privateKey: string,
   latestKey: TLatestKey
 ) => {
+  if (!latestKey.sender.publicKey) {
+    throw new Error("Latest key sender public key not found");
+  }
+
   const key = crypto.encryption().asymmetric().decrypt({
     ciphertext: latestKey.encryptedKey,
     nonce: latestKey.nonce,

backend/src/lib/crypto/srp.ts

@@ -4,6 +4,7 @@ import jsrp from "jsrp";
 import { TUserEncryptionKeys } from "@app/db/schemas";
 import { UserEncryption } from "@app/services/user/user-types";
 
+import { BadRequestError } from "../errors";
 import { crypto, SymmetricKeySize } from "./cryptography";
 
 export const generateSrpServerKey = async (salt: string, verifier: string) => {
@@ -127,6 +128,10 @@ export const getUserPrivateKey = async (
   >
 ) => {
   if (user.encryptionVersion === UserEncryption.V1) {
+    if (!user.encryptedPrivateKey || !user.iv || !user.tag || !user.salt) {
+      throw new BadRequestError({ message: "User encrypted private key not found" });
+    }
+
     return crypto
       .encryption()
       .symmetric()
@@ -138,12 +143,25 @@ export const getUserPrivateKey = async (
         keySize: SymmetricKeySize.Bits128
       });
   }
+  // still used for legacy things
   if (
     user.encryptionVersion === UserEncryption.V2 &&
     user.protectedKey &&
     user.protectedKeyIV &&
     user.protectedKeyTag
   ) {
+    if (
+      !user.salt ||
+      !user.protectedKey ||
+      !user.protectedKeyIV ||
+      !user.protectedKeyTag ||
+      !user.encryptedPrivateKey ||
+      !user.iv ||
+      !user.tag
+    ) {
+      throw new BadRequestError({ message: "User encrypted private key not found" });
+    }
+
     const derivedKey = await argon2.hash(password, {
       salt: Buffer.from(user.salt),
       memoryCost: 65536,