+ 
-
+
@@ -55,7 +55,7 @@ We're on a mission to make secret management more accessible to everyone, not ju
- **[Audit logs](https://infisical.com/docs/documentation/platform/audit-logs)** to record every action taken in a project
- **Role-based Access Controls** per environment
- [**Simple on-premise deployments** to AWS and Digital Ocean](https://infisical.com/docs/self-hosting/overview)
-- [**2FA**](https://infisical.com/docs/documentation/platform/mfa) with more options coming soon
+- [**Secret Scanning**](https://infisical.com/docs/cli/scanning-overview)
And much more.
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 1662929e7..063999c60 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -33,7 +33,7 @@
"express-validator": "^6.14.2",
"handlebars": "^4.7.7",
"helmet": "^5.1.1",
- "infisical-node": "^1.1.3",
+ "infisical-node": "^1.2.1",
"js-yaml": "^4.1.0",
"jsonwebtoken": "^9.0.0",
"jsrp": "^0.2.4",
@@ -6808,13 +6808,12 @@
}
},
"node_modules/infisical-node": {
- "version": "1.1.3",
- "resolved": "https://registry.npmjs.org/infisical-node/-/infisical-node-1.1.3.tgz",
- "integrity": "sha512-MLcZQ/zdpCYFRbj50Tn4Qm58wSKPQfKc3xX4I0c3NnFZvMGd50wnoG1jkkNKjKiYU5h7QDpOg0XZSvlU7yuG6g==",
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/infisical-node/-/infisical-node-1.2.1.tgz",
+ "integrity": "sha512-zEB0w5+1O0mv9qc68bq4f9jDjrtwdbqjJebnwodgy8U1XZElDXeMDQgSMCtgYan7JRmVlH6s/LM8X7kUF+67ZA==",
"dependencies": {
"axios": "^1.3.3",
"dotenv": "^16.0.3",
- "node-cache": "^5.1.2",
"tweetnacl": "^1.0.3",
"tweetnacl-util": "^0.15.1"
}
@@ -18432,13 +18431,12 @@
"dev": true
},
"infisical-node": {
- "version": "1.1.3",
- "resolved": "https://registry.npmjs.org/infisical-node/-/infisical-node-1.1.3.tgz",
- "integrity": "sha512-MLcZQ/zdpCYFRbj50Tn4Qm58wSKPQfKc3xX4I0c3NnFZvMGd50wnoG1jkkNKjKiYU5h7QDpOg0XZSvlU7yuG6g==",
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/infisical-node/-/infisical-node-1.2.1.tgz",
+ "integrity": "sha512-zEB0w5+1O0mv9qc68bq4f9jDjrtwdbqjJebnwodgy8U1XZElDXeMDQgSMCtgYan7JRmVlH6s/LM8X7kUF+67ZA==",
"requires": {
"axios": "^1.3.3",
"dotenv": "^16.0.3",
- "node-cache": "^5.1.2",
"tweetnacl": "^1.0.3",
"tweetnacl-util": "^0.15.1"
}
diff --git a/backend/package.json b/backend/package.json
index bb4be61c1..b8f91e6c9 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -24,7 +24,7 @@
"express-validator": "^6.14.2",
"handlebars": "^4.7.7",
"helmet": "^5.1.1",
- "infisical-node": "^1.1.3",
+ "infisical-node": "^1.2.1",
"js-yaml": "^4.1.0",
"jsonwebtoken": "^9.0.0",
"jsrp": "^0.2.4",
diff --git a/backend/src/config/index.ts b/backend/src/config/index.ts
index 394154fea..4613a05c9 100644
--- a/backend/src/config/index.ts
+++ b/backend/src/config/index.ts
@@ -1,12 +1,19 @@
import InfisicalClient from 'infisical-node';
-const client = new InfisicalClient({
+export const client = new InfisicalClient({
token: process.env.INFISICAL_TOKEN!
});
export const getPort = async () => (await client.getSecret('PORT')).secretValue || 4000;
+export const getEncryptionKey = async () => {
+ const secretValue = (await client.getSecret('ENCRYPTION_KEY')).secretValue;
+ return secretValue === '' ? undefined : secretValue;
+}
+export const getRootEncryptionKey = async () => {
+ const secretValue = (await client.getSecret('ROOT_ENCRYPTION_KEY')).secretValue;
+ return secretValue === '' ? undefined : secretValue;
+}
export const getInviteOnlySignup = async () => (await client.getSecret('INVITE_ONLY_SIGNUP')).secretValue === 'true'
-export const getEncryptionKey = async () => (await client.getSecret('ENCRYPTION_KEY')).secretValue;
export const getSaltRounds = async () => parseInt((await client.getSecret('SALT_ROUNDS')).secretValue) || 10;
export const getJwtAuthLifetime = async () => (await client.getSecret('JWT_AUTH_LIFETIME')).secretValue || '10d';
export const getJwtAuthSecret = async () => (await client.getSecret('JWT_AUTH_SECRET')).secretValue;
@@ -50,8 +57,14 @@ export const getSmtpPassword = async () => (await client.getSecret('SMTP_PASSWOR
export const getSmtpFromAddress = async () => (await client.getSecret('SMTP_FROM_ADDRESS')).secretValue;
export const getSmtpFromName = async () => (await client.getSecret('SMTP_FROM_NAME')).secretValue || 'Infisical';
-export const getLicenseKey = async () => (await client.getSecret('LICENSE_KEY')).secretValue;
-export const getLicenseServerKey = async () => (await client.getSecret('LICENSE_SERVER_KEY')).secretValue;
+export const getLicenseKey = async () => {
+ const secretValue = (await client.getSecret('LICENSE_KEY')).secretValue;
+ return secretValue === '' ? undefined : secretValue;
+}
+export const getLicenseServerKey = async () => {
+ const secretValue = (await client.getSecret('LICENSE_SERVER_KEY')).secretValue;
+ return secretValue === '' ? undefined : secretValue;
+}
export const getLicenseServerUrl = async () => (await client.getSecret('LICENSE_SERVER_URL')).secretValue || 'https://portal.infisical.com';
// TODO: deprecate from here
diff --git a/backend/src/controllers/v1/integrationAuthController.ts b/backend/src/controllers/v1/integrationAuthController.ts
index 0d5947a4f..97032aaa4 100644
--- a/backend/src/controllers/v1/integrationAuthController.ts
+++ b/backend/src/controllers/v1/integrationAuthController.ts
@@ -5,7 +5,7 @@ import {
IntegrationAuth,
Bot
} from '../../models';
-import { INTEGRATION_SET, getIntegrationOptions as getIntegrationOptionsFunc } from '../../variables';
+import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_UTF8, INTEGRATION_SET, getIntegrationOptions as getIntegrationOptionsFunc } from '../../variables';
import { IntegrationService } from '../../services';
import {
getApps,
@@ -129,7 +129,9 @@ export const saveIntegrationAccessToken = async (
integration
}, {
workspace: new Types.ObjectId(workspaceId),
- integration
+ integration,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
}, {
new: true,
upsert: true
diff --git a/backend/src/controllers/v1/signupController.ts b/backend/src/controllers/v1/signupController.ts
index e5af676b3..681b65459 100644
--- a/backend/src/controllers/v1/signupController.ts
+++ b/backend/src/controllers/v1/signupController.ts
@@ -39,7 +39,7 @@ export const beginEmailSignup = async (req: Request, res: Response) => {
error: 'Failed to send email verification code'
});
}
-
+
return res.status(200).send({
message: `Sent an email verification code to ${email}`
});
diff --git a/backend/src/controllers/v2/secretController.ts b/backend/src/controllers/v2/secretController.ts
index 75eff3127..fecba43d6 100644
--- a/backend/src/controllers/v2/secretController.ts
+++ b/backend/src/controllers/v2/secretController.ts
@@ -6,7 +6,7 @@ import { CreateSecretRequestBody, ModifySecretRequestBody, SanitizedSecretForCre
const { ValidationError } = mongoose.Error;
import { BadRequestError, InternalServerError, UnauthorizedRequestError, ValidationError as RouteValidationError } from '../../utils/errors';
import { AnyBulkWriteOperation } from 'mongodb';
-import { SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
+import { ALGORITHM_AES_256_GCM, ENCODING_SCHEME_UTF8, SECRET_PERSONAL, SECRET_SHARED } from "../../variables";
import { TelemetryService } from '../../services';
import { User } from "../../models";
import { AccountNotFoundError } from '../../utils/errors';
@@ -36,7 +36,9 @@ export const createSecret = async (req: Request, res: Response) => {
workspace: new Types.ObjectId(workspaceId),
environment,
type: secretToCreate.type,
- user: new Types.ObjectId(req.user._id)
+ user: new Types.ObjectId(req.user._id),
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
}
@@ -92,7 +94,9 @@ export const createSecrets = async (req: Request, res: Response) => {
workspace: new Types.ObjectId(workspaceId),
environment,
type: rawSecret.type,
- user: new Types.ObjectId(req.user._id)
+ user: new Types.ObjectId(req.user._id),
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
}
sanitizedSecretesToCreate.push(safeUpdateFields)
diff --git a/backend/src/controllers/v2/secretsController.ts b/backend/src/controllers/v2/secretsController.ts
index 4e0bd0488..4a5618454 100644
--- a/backend/src/controllers/v2/secretsController.ts
+++ b/backend/src/controllers/v2/secretsController.ts
@@ -7,7 +7,9 @@ import {
ACTION_ADD_SECRETS,
ACTION_READ_SECRETS,
ACTION_UPDATE_SECRETS,
- ACTION_DELETE_SECRETS
+ ACTION_DELETE_SECRETS,
+ ALGORITHM_AES_256_GCM,
+ ENCODING_SCHEME_UTF8
} from '../../variables';
import { UnauthorizedRequestError, WorkspaceNotFoundError } from '../../utils/errors';
import { EventService } from '../../services';
@@ -51,7 +53,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
if (!workspace) throw WorkspaceNotFoundError();
const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
- const isPaid = orgPlan.tier < 1;
+ const isPaid = orgPlan.tier >= 1;
const createSecrets: BatchSecret[] = [];
const updateSecrets: BatchSecret[] = [];
@@ -85,7 +87,9 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspace: new Types.ObjectId(workspaceId),
path: fullFolderPath,
folder: folderId,
- secretBlindIndex
+ secretBlindIndex,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
break;
case 'PATCH':
@@ -100,6 +104,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
secretBlindIndex,
folder: folderId,
path: fullFolderPath,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
break;
case 'DELETE':
@@ -144,7 +150,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: req.user.email
}
});
}
@@ -201,6 +208,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext: u.secretCommentCiphertext,
secretCommentIV: u.secretCommentIV,
secretCommentTag: u.secretCommentTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8,
tags: u.tags
}));
@@ -232,7 +241,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: req.user.email
}
});
}
@@ -268,7 +278,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
channel: channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: req.user.email
}
});
}
@@ -387,7 +398,7 @@ export const createSecrets = async (req: Request, res: Response) => {
if (!workspace) throw WorkspaceNotFoundError();
const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
- const isPaid = orgPlan.tier < 1;
+ const isPaid = orgPlan.tier >= 1;
let listOfSecretsToCreate;
if (Array.isArray(req.body.secrets)) {
@@ -457,6 +468,8 @@ export const createSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext,
secretCommentIV,
secretCommentTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8,
tags
});
})
@@ -503,7 +516,9 @@ export const createSecrets = async (req: Request, res: Response) => {
secretKeyTag,
secretValueCiphertext,
secretValueIV,
- secretValueTag
+ secretValueTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8
}))
});
@@ -545,7 +560,10 @@ export const createSecrets = async (req: Request, res: Response) => {
workspaceId,
channel: channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: await TelemetryService.getDistinctId({
+ authData: req.authData
+ })
}
});
}
@@ -613,7 +631,7 @@ export const getSecrets = async (req: Request, res: Response) => {
if (!workspace) throw WorkspaceNotFoundError();
const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
- const isPaid = orgPlan.tier < 1;
+ const isPaid = orgPlan.tier >= 1;
// secrets to return
let secrets: ISecret[] = [];
@@ -748,7 +766,10 @@ export const getSecrets = async (req: Request, res: Response) => {
workspaceId,
channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: await TelemetryService.getDistinctId({
+ authData: req.authData
+ })
}
});
}
@@ -852,6 +873,8 @@ export const updateSecrets = async (req: Request, res: Response) => {
secretValueCiphertext,
secretValueIV,
secretValueTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8,
tags,
...((
secretCommentCiphertext !== undefined &&
@@ -905,6 +928,8 @@ export const updateSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext: secretCommentCiphertext ? secretCommentCiphertext : secret.secretCommentCiphertext,
secretCommentIV: secretCommentIV ? secretCommentIV : secret.secretCommentIV,
secretCommentTag: secretCommentTag ? secretCommentTag : secret.secretCommentTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8,
tags: tags ? tags : secret.tags
});
})
@@ -963,7 +988,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
if (!workspace) throw WorkspaceNotFoundError();
const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
- const isPaid = orgPlan.tier < 1;
+ const isPaid = orgPlan.tier >= 1;
const postHogClient = await TelemetryService.getPostHogClient();
if (postHogClient) {
@@ -978,7 +1003,10 @@ export const updateSecrets = async (req: Request, res: Response) => {
workspaceId: key,
channel: channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: await TelemetryService.getDistinctId({
+ authData: req.authData
+ })
}
});
}
@@ -1100,13 +1128,11 @@ export const deleteSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(key)
});
- const organizationId = (
- await Workspace.findOne({
- _id: key
- })
- )?.organization?.toString();
- const orgPlan = await EELicenseService.getOrganizationPlan(organizationId || '');
- const isPaid = orgPlan.slug != 'starter';
+ const workspace = await Workspace.findById(key);
+ if (!workspace) throw WorkspaceNotFoundError();
+
+ const orgPlan = await EELicenseService.getOrganizationPlan(workspace.organization.toString());
+ const isPaid = orgPlan.tier >= 1;
const postHogClient = await TelemetryService.getPostHogClient();
if (postHogClient) {
@@ -1121,7 +1147,10 @@ export const deleteSecrets = async (req: Request, res: Response) => {
workspaceId: key,
channel: channel,
userAgent: req.headers?.['user-agent'],
- isPaid
+ isPaid,
+ email: await TelemetryService.getDistinctId({
+ authData: req.authData
+ })
}
});
}
diff --git a/backend/src/ee/controllers/v1/organizationsController.ts b/backend/src/ee/controllers/v1/organizationsController.ts
index 0bdf6e435..2dd212e77 100644
--- a/backend/src/ee/controllers/v1/organizationsController.ts
+++ b/backend/src/ee/controllers/v1/organizationsController.ts
@@ -7,13 +7,12 @@ import { EELicenseService } from '../../services';
* Return the organization's current plan and allowed feature set
*/
export const getOrganizationPlan = async (req: Request, res: Response) => {
- const plan = await EELicenseService.getOrganizationPlan(req.organization._id.toString());
+ const { organizationId } = req.params;
- // cache fetched plan for organization
- EELicenseService.localFeatureSet.set(req.organization._id.toString(), plan);
+ const plan = await EELicenseService.getOrganizationPlan(organizationId);
return res.status(200).send({
- plan
+ plan,
});
}
diff --git a/backend/src/ee/controllers/v1/secretController.ts b/backend/src/ee/controllers/v1/secretController.ts
index cfdd93cf3..8e3b39b54 100644
--- a/backend/src/ee/controllers/v1/secretController.ts
+++ b/backend/src/ee/controllers/v1/secretController.ts
@@ -162,6 +162,8 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
secretValueCiphertext,
secretValueIV,
secretValueTag,
+ algorithm,
+ keyEncoding
} = oldSecretVersion;
// update secret
@@ -182,6 +184,8 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
secretValueCiphertext,
secretValueIV,
secretValueTag,
+ algorithm,
+ keyEncoding
},
{
new: true
@@ -205,7 +209,9 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
secretKeyTag,
secretValueCiphertext,
secretValueIV,
- secretValueTag
+ secretValueTag,
+ algorithm,
+ keyEncoding
}).save();
// take secret snapshot
diff --git a/backend/src/ee/helpers/secret.ts b/backend/src/ee/helpers/secret.ts
index 0bf172581..c60b1a18c 100644
--- a/backend/src/ee/helpers/secret.ts
+++ b/backend/src/ee/helpers/secret.ts
@@ -93,52 +93,8 @@ const markDeletedSecretVersionsHelper = async ({
);
};
-/**
- * Initialize secret versioning by setting previously unversioned
- * secrets to version 1 and begin populating secret versions.
- */
-const initSecretVersioningHelper = async () => {
- await Secret.updateMany(
- { version: { $exists: false } },
- { $set: { version: 1 } }
- );
-
- const unversionedSecrets: ISecret[] = await Secret.aggregate([
- {
- $lookup: {
- from: "secretversions",
- localField: "_id",
- foreignField: "secret",
- as: "versions",
- },
- },
- {
- $match: {
- versions: { $size: 0 },
- },
- },
- ]);
-
- if (unversionedSecrets.length > 0) {
- await addSecretVersionsHelper({
- secretVersions: unversionedSecrets.map(
- (s, idx) =>
- new SecretVersion({
- ...s,
- secret: s._id,
- version: s.version ? s.version : 1,
- isDeleted: false,
- workspace: s.workspace,
- environment: s.environment,
- })
- ),
- });
- }
-};
-
export {
takeSecretSnapshotHelper,
addSecretVersionsHelper,
- markDeletedSecretVersionsHelper,
- initSecretVersioningHelper,
+ markDeletedSecretVersionsHelper
};
diff --git a/backend/src/ee/models/secretVersion.ts b/backend/src/ee/models/secretVersion.ts
index a430834a9..9aca6af1c 100644
--- a/backend/src/ee/models/secretVersion.ts
+++ b/backend/src/ee/models/secretVersion.ts
@@ -2,6 +2,9 @@ import { Schema, model, Types } from 'mongoose';
import {
SECRET_SHARED,
SECRET_PERSONAL,
+ ALGORITHM_AES_256_GCM,
+ ENCODING_SCHEME_UTF8,
+ ENCODING_SCHEME_BASE64
} from '../../variables';
export interface ISecretVersion {
@@ -20,6 +23,8 @@ export interface ISecretVersion {
secretValueCiphertext: string;
secretValueIV: string;
secretValueTag: string;
+ algorithm: 'aes-256-gcm';
+ keyEncoding: 'utf8' | 'base64';
}
const secretVersionSchema = new Schema