awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 07:27:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kms/signing): better error handling

Browse Source
This commit is contained in:
Daniel Hougaard
2025-04-13 23:17:50 +04:00
parent 966ca1a3c6
commit b9bfe19b64
1 changed files with 29 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/lib/crypto/sign/signing.ts
+29 -4
View File
@@ -118,7 +118,12 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} }
}; };
const $signRsaDigest = async (digest: Buffer, privateKey: Buffer, hashAlgorithm: SupportedHashAlgorithm) => { const $signRsaDigest = async (
digest: Buffer,
privateKey: Buffer,
hashAlgorithm: SupportedHashAlgorithm,
signingAlgorithm: SigningAlgorithm
) => {
const tempDir = await createTemporaryDirectory("kms-rsa-sign"); const tempDir = await createTemporaryDirectory("kms-rsa-sign");
const digestPath = path.join(tempDir, "digest.bin"); const digestPath = path.join(tempDir, "digest.bin");
const sigPath = path.join(tempDir, "signature.bin"); const sigPath = path.join(tempDir, "signature.bin");
@@ -164,12 +169,22 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} }
return signature; return signature;
} catch (err) {
logger.error(err, "KMS: Failed to sign RSA digest");
throw new BadRequestError({
message: `Failed to sign RSA digest with ${signingAlgorithm} due to signing error. Ensure that your digest is hashed with ${hashAlgorithm.toUpperCase()}.`
});
} finally { } finally {
await cleanTemporaryDirectory(tempDir); await cleanTemporaryDirectory(tempDir);
} }
}; };
const $signEccDigest = async (digest: Buffer, privateKey: Buffer, hashAlgorithm: SupportedHashAlgorithm) => { const $signEccDigest = async (
digest: Buffer,
privateKey: Buffer,
hashAlgorithm: SupportedHashAlgorithm,
signingAlgorithm: SigningAlgorithm
) => {
const tempDir = await createTemporaryDirectory("ecc-sign"); const tempDir = await createTemporaryDirectory("ecc-sign");
const digestPath = path.join(tempDir, "digest.bin"); const digestPath = path.join(tempDir, "digest.bin");
const keyPath = path.join(tempDir, "key.pem"); const keyPath = path.join(tempDir, "key.pem");
@@ -216,6 +231,11 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
} }
return signature; return signature;
} catch (err) {
logger.error(err, "KMS: Failed to sign ECC digest");
throw new BadRequestError({
message: `Failed to sign ECC digest with ${signingAlgorithm} due to signing error. Ensure that your digest is hashed with ${hashAlgorithm.toUpperCase()}.`
});
} finally { } finally {
await cleanTemporaryDirectory(tempDir); await cleanTemporaryDirectory(tempDir);
} }
@@ -329,7 +349,12 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
const signDigestFunctionsMap: Record< const signDigestFunctionsMap: Record<
AsymmetricKeyAlgorithm, AsymmetricKeyAlgorithm,
(data: Buffer, privateKey: Buffer, hashAlgorithm: SupportedHashAlgorithm) => Promise<Buffer> (
data: Buffer,
privateKey: Buffer,
hashAlgorithm: SupportedHashAlgorithm,
signingAlgorithm: SigningAlgorithm
) => Promise<Buffer>
> = { > = {
[AsymmetricKeyAlgorithm.ECC_NIST_P256]: $signEccDigest, [AsymmetricKeyAlgorithm.ECC_NIST_P256]: $signEccDigest,
[AsymmetricKeyAlgorithm.RSA_4096]: $signRsaDigest [AsymmetricKeyAlgorithm.RSA_4096]: $signRsaDigest
@@ -360,7 +385,7 @@ export const signingService = (algorithm: AsymmetricKeyAlgorithm): TAsymmetricSi
}); });
} }
const signature = await signFunction(data, privateKey, hashAlgorithm); const signature = await signFunction(data, privateKey, hashAlgorithm, signingAlgorithm);
return signature; return signature;
} }