add missing transactions

backend/src/db/migrations/20250210101840_webhook-to-kms.ts

@@ -31,7 +31,6 @@ export async function up(knex: Knex): Promise<void> {
   const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
   const projectEncryptionRingBuffer =
     createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
     const webhooks = await knex(TableName.Webhook)
     .where({})
     .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.Webhook}.envId`)
@@ -57,7 +56,7 @@ export async function up(knex: Knex): Promise<void> {
         projectKmsService = await kmsService.createCipherPairWithDataKey({
           type: KmsDataKey.SecretManager,
           projectId: el.projectId
-        });
+        }, knex);
         projectEncryptionRingBuffer.push(el.projectId, projectKmsService);
       }
 

backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts

@@ -49,7 +49,7 @@ export async function up(knex: Knex): Promise<void> {
         projectKmsService = await kmsService.createCipherPairWithDataKey({
           type: KmsDataKey.SecretManager,
           projectId
-        });
+        }, knex);
         projectEncryptionRingBuffer.push(projectId, projectKmsService);
       }
 

backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts

@@ -42,7 +42,7 @@ export async function up(knex: Knex): Promise<void> {
         projectKmsService = await kmsService.createCipherPairWithDataKey({
           type: KmsDataKey.SecretManager,
           projectId
-        });
+        }, knex);
         projectEncryptionRingBuffer.push(projectId, projectKmsService);
       }
 

backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts

@@ -59,7 +59,6 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => {
   const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
   const orgEncryptionRingBuffer =
     createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
   const identityKubernetesConfigs = await knex(TableName.IdentityKubernetesAuth)
     .join(
       TableName.IdentityOrgMembership,
@@ -77,17 +76,19 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => {
     )
     .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
 
-  const updatedIdentityKubernetesConfigs = await Promise.all(
+    const updatedIdentityKubernetesConfigs = [];
-    identityKubernetesConfigs.map(
+
-      async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, orgId, ...el }) => {
+    for (const { encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, orgId, ...el } of identityKubernetesConfigs) {
       let orgKmsService = orgEncryptionRingBuffer.getItem(orgId);
+      
       if (!orgKmsService) {
         orgKmsService = await kmsService.createCipherPairWithDataKey({
           type: KmsDataKey.Organization,
           orgId
-          });
+        }, knex);
         orgEncryptionRingBuffer.push(orgId, orgKmsService);
       }
+    
       const key = infisicalSymmetricDecrypt({
         ciphertext: encryptedSymmetricKey,
         iv: symmetricKeyIV,
@@ -138,15 +139,13 @@ const reencryptIdentityK8sAuth = async (knex: Knex) => {
         plainText: Buffer.from(decryptedCertificate)
       }).cipherTextBlob;
       
-        return {
+      updatedIdentityKubernetesConfigs.push({
         ...el,
         accessTokenTrustedIps: JSON.stringify(el.accessTokenTrustedIps),
         encryptedKubernetesCaCertificate,
         encryptedKubernetesTokenReviewerJwt
-        };
+      });
     }
-    )
-  );
 
   for (let i = 0; i < updatedIdentityKubernetesConfigs.length; i += BATCH_SIZE) {
     // eslint-disable-next-line no-await-in-loop

backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts

@@ -65,7 +65,7 @@ const reencryptIdentityOidcAuth = async (knex: Knex) => {
           orgKmsService = await kmsService.createCipherPairWithDataKey({
             type: KmsDataKey.Organization,
             orgId
-          });
+          }, knex);
           orgEncryptionRingBuffer.push(orgId, orgKmsService);
         }
         const key = infisicalSymmetricDecrypt({

backend/src/db/migrations/20250210101845_directory-config-to-kms.ts

@@ -52,7 +52,7 @@ const reencryptSamlConfig = async (knex: Knex) => {
           orgKmsService = await kmsService.createCipherPairWithDataKey({
             type: KmsDataKey.Organization,
             orgId: el.orgId
-          });
+          }, knex);
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
         const key = infisicalSymmetricDecrypt({
@@ -207,7 +207,7 @@ const reencryptLdapConfig = async (knex: Knex) => {
           orgKmsService = await kmsService.createCipherPairWithDataKey({
             type: KmsDataKey.Organization,
             orgId: el.orgId
-          });
+          }, knex);
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
         const key = infisicalSymmetricDecrypt({
@@ -356,7 +356,7 @@ const reencryptOidcConfig = async (knex: Knex) => {
           orgKmsService = await kmsService.createCipherPairWithDataKey({
             type: KmsDataKey.Organization,
             orgId: el.orgId
-          });
+          }, knex);
           orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
         }
         const key = infisicalSymmetricDecrypt({

backend/src/services/kms/kms-service.ts

@@ -472,7 +472,8 @@ export const kmsServiceFactory = ({
     }
 
     const kmsDecryptor = await decryptWithKmsKey({
-      kmsId: kmsKeyId
+      kmsId: kmsKeyId,
+      tx: trx
     });
 
     return kmsDecryptor({