Add workspaces v3 endpoints for blind-index naming/labeling

backend/src/helpers/secrets.ts

@@ -218,7 +218,7 @@ const validateClientForSecrets = async ({
 }
 
 /**
- * Create secret blind index data containing encrypted blind index salt 
+ * Create secret blind index data containing encrypted blind index [salt]
  * for workspace with id [workspaceId]
  * @param {Object} obj
  * @param {Types.ObjectId} obj.workspaceId
@@ -250,6 +250,64 @@ const createSecretBlindIndexDataHelper = async ({
     return secretBlindIndexData;
 }
 
+/**
+ * Get secret blind index salt for workspace with id [workspaceId]
+ * @param {Object} obj
+ * @param {Types.ObjectId} obj.workspaceId - id of workspace to get salt for
+ * @returns 
+ */
+const getSecretBlindIndexSaltHelper = async ({
+    workspaceId
+}: {
+    workspaceId: Types.ObjectId;
+}) => {
+    // check if workspace blind index data exists
+    const secretBlindIndexData = await SecretBlindIndexData.findOne({
+        workspace: workspaceId
+    });
+    
+    if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
+    
+    // decrypt workspace salt
+    const salt = decryptSymmetric({
+        ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
+        iv: secretBlindIndexData.saltIV,
+        tag: secretBlindIndexData.saltTag,
+        key: getEncryptionKey()
+    });
+    
+    return salt;
+}
+
+/**
+ * Generate blind index for secret with name [secretName]
+ * and salt [salt]
+ * @param {Object} obj
+ * @param {Object} obj.secretName - name of secret to generate blind index for
+ * @param {String} obj.salt - base64-salt
+ */
+ const generateSecretBlindIndexWithSaltHelper = async ({
+    secretName,
+    salt
+}: {
+    secretName: string;
+    salt: string;
+}) => {
+
+    // generate secret blind index
+    const secretBlindIndex = (await argon2.hash(secretName, {
+        type: argon2.argon2id,
+        salt: Buffer.from(salt, 'base64'),
+        saltLength: 16, // default 16 bytes
+        memoryCost: 65536, // default pool of 64 MiB per thread.
+        hashLength: 32,
+        parallelism: 1,
+        raw: true
+    })).toString('base64');
+
+    return secretBlindIndex;
+}
+
 /**
  * Generate blind index for secret with name [secretName] 
  * for workspace with id [workspaceId]
@@ -280,16 +338,10 @@ const generateSecretBlindIndexHelper = async ({
         key: getEncryptionKey()
     });
 
-    // generate secret blind index
-    const secretBlindIndex = (await argon2.hash(secretName, {
-        type: argon2.argon2id,
-        salt: Buffer.from(salt, 'base64'),
-        saltLength: 16, // default 16 bytes
-        memoryCost: 65536, // default pool of 64 MiB per thread.
-        hashLength: 32,
-        parallelism: 1,
-        raw: true
-    })).toString('base64');
+    const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
+        secretName,
+        salt
+    });
 
     return secretBlindIndex;
 }
@@ -858,6 +910,8 @@ export {
     validateClientForSecret,
     validateClientForSecrets,
     createSecretBlindIndexDataHelper,
+    getSecretBlindIndexSaltHelper,
+    generateSecretBlindIndexWithSaltHelper,
     generateSecretBlindIndexHelper,
     createSecretHelper,
     getSecretsHelper,

backend/src/helpers/workspace.ts

@@ -67,12 +67,16 @@ const validateClientForWorkspace = async ({
 		message: 'Failed to find workspace'
 	});
 
-	if (requireBlindIndicesEnabled && !workspace.isBlindedIndicesEnabled) {
+	if (requireBlindIndicesEnabled) {
 		// case: blind indices are not enabled for secrets in this workspace
 		// (i.e. workspace was created before blind indices were introduced
 		// and no admin has enabled it)
 		
-		throw UnauthorizedRequestError({
+		const secretBlindIndexData = await SecretBlindIndexData.exists({
+			workspace: new Types.ObjectId(workspaceId)
+		});
+		
+		if (!secretBlindIndexData) throw UnauthorizedRequestError({
 			message: 'Failed workspace authorization due to blind indices not being enabled'
 		});
 	}
@@ -148,8 +152,7 @@ const createWorkspace = async ({
 		workspace = await new Workspace({
 			name,
 			organization: organizationId,
-			autoCapitalization: true,
-			isBlindedIndicesEnabled: true
+			autoCapitalization: true
 		}).save();
 		
 		// initialize bot for workspace