Merge pull request #3973 from Infisical/daniel/fips-initative

feat(fips): native FIPS support

frontend/src/hooks/api/admin/types.ts

@@ -49,6 +49,7 @@ export type TServerConfig = {
   authConsentContent?: string;
   pageFrameContent?: string;
   invalidatingCache: boolean;
+  fipsEnabled: boolean;
   envOverrides?: Record<string, string>;
 };
 

frontend/src/hooks/api/cmeks/mutations.tsx

@@ -1,6 +1,6 @@
 import { useMutation, useQueryClient } from "@tanstack/react-query";
-import { encodeBase64 } from "tweetnacl-util";
 
+import { encodeBase64 } from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 import { cmekKeys } from "@app/hooks/api/cmeks/queries";
 import {

frontend/src/hooks/api/secretApprovalRequest/queries.tsx

@@ -1,15 +1,9 @@
 /* eslint-disable no-param-reassign */
 import { useQuery, UseQueryOptions } from "@tanstack/react-query";
 
-import {
-  decryptAssymmetric,
-  decryptSymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 import { TReactQueryOptions } from "@app/types/reactQuery";
 
-import { UserWsKeyPair } from "../keys/types";
-import { EncryptedSecret, SecretType, SecretV3RawSanitized } from "../secrets/types";
 import {
   TGetSecretApprovalRequestCount,
   TGetSecretApprovalRequestDetails,
@@ -41,79 +35,6 @@ export const secretApprovalRequestKeys = {
   ]
 };
 
-export const decryptSecrets = (
-  encryptedSecrets: EncryptedSecret[],
-  decryptFileKey: UserWsKeyPair
-) => {
-  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-  const key = decryptAssymmetric({
-    ciphertext: decryptFileKey.encryptedKey,
-    nonce: decryptFileKey.nonce,
-    publicKey: decryptFileKey.sender.publicKey,
-    privateKey: PRIVATE_KEY
-  });
-
-  const personalSecrets: Record<string, { id: string; value: string }> = {};
-  const secrets: SecretV3RawSanitized[] = [];
-  encryptedSecrets.forEach((encSecret) => {
-    const secretKey = decryptSymmetric({
-      ciphertext: encSecret.secretKeyCiphertext,
-      iv: encSecret.secretKeyIV,
-      tag: encSecret.secretKeyTag,
-      key
-    });
-
-    const secretValue = decryptSymmetric({
-      ciphertext: encSecret.secretValueCiphertext,
-      iv: encSecret.secretValueIV,
-      tag: encSecret.secretValueTag,
-      key
-    });
-
-    const secretComment = decryptSymmetric({
-      ciphertext: encSecret.secretCommentCiphertext,
-      iv: encSecret.secretCommentIV,
-      tag: encSecret.secretCommentTag,
-      key
-    });
-
-    const decryptedSecret: SecretV3RawSanitized = {
-      id: encSecret.id,
-      env: encSecret.environment,
-      key: secretKey,
-      secretValueHidden: encSecret.secretValueHidden,
-      value: secretValue,
-      tags: encSecret.tags,
-      comment: secretComment,
-      reminderRepeatDays: encSecret.secretReminderRepeatDays,
-      reminderNote: encSecret.secretReminderNote,
-      createdAt: encSecret.createdAt,
-      updatedAt: encSecret.updatedAt,
-      version: encSecret.version,
-      skipMultilineEncoding: encSecret.skipMultilineEncoding
-    };
-
-    if (encSecret.type === SecretType.Personal) {
-      personalSecrets[decryptedSecret.key] = {
-        id: encSecret.id,
-        value: secretValue
-      };
-    } else {
-      secrets.push(decryptedSecret);
-    }
-  });
-
-  secrets.forEach((sec) => {
-    if (personalSecrets?.[sec.key]) {
-      sec.idOverride = personalSecrets[sec.key].id;
-      sec.valueOverride = personalSecrets[sec.key].value;
-      sec.overrideAction = "modified";
-    }
-  });
-
-  return secrets;
-};
-
 const fetchSecretApprovalRequestList = async ({
   workspaceId,
   environment,

frontend/src/hooks/api/types.ts

@@ -27,7 +27,7 @@ export * from "./secrets/types";
 export type { CreateServiceTokenDTO, ServiceToken } from "./serviceTokens/types";
 export type { SubscriptionPlan } from "./subscriptions/types";
 export type { WsTag } from "./tags/types";
-export type { AddUserToWsDTOE2EE, OrgUser, TWorkspaceUser, User, UserEnc } from "./users/types";
+export type { OrgUser, TWorkspaceUser, User, UserEnc } from "./users/types";
 export type { TWebhook } from "./webhooks/types";
 export type {
   CreateEnvironmentDTO,

frontend/src/hooks/api/users/index.tsx

@@ -1,5 +1,4 @@
 export {
-  useAddUserToWsE2EE,
   useAddUserToWsNonE2EE,
   useRemoveMyDuplicateAccounts,
   useRevokeMySessionById,

frontend/src/hooks/api/users/mutation.tsx

@@ -1,51 +1,10 @@
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 
-import {
-  decryptAssymmetric,
-  encryptAssymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
 import { workspaceKeys } from "../workspace";
 import { userKeys } from "./query-keys";
-import { AddUserToWsDTOE2EE, AddUserToWsDTONonE2EE } from "./types";
-
-export const useAddUserToWsE2EE = () => {
-  const queryClient = useQueryClient();
-
-  return useMutation<object, object, AddUserToWsDTOE2EE>({
-    mutationFn: async ({ workspaceId, members, decryptKey, userPrivateKey }) => {
-      // assymmetrically decrypt symmetric key with local private key
-      const key = decryptAssymmetric({
-        ciphertext: decryptKey.encryptedKey,
-        nonce: decryptKey.nonce,
-        publicKey: decryptKey.sender.publicKey,
-        privateKey: userPrivateKey
-      });
-
-      const newWsMembers = members.map(({ orgMembershipId, userPublicKey }) => {
-        const { ciphertext: inviteeCipherText, nonce: inviteeNonce } = encryptAssymmetric({
-          plaintext: key,
-          publicKey: userPublicKey,
-          privateKey: userPrivateKey
-        });
-
-        return {
-          orgMembershipId,
-          workspaceEncryptedKey: inviteeCipherText,
-          workspaceEncryptedNonce: inviteeNonce
-        };
-      });
-      const { data } = await apiRequest.post(`/api/v1/workspace/${workspaceId}/memberships`, {
-        members: newWsMembers
-      });
-      return data;
-    },
-    onSuccess: (_, { workspaceId }) => {
-      queryClient.invalidateQueries({ queryKey: workspaceKeys.getWorkspaceUsers(workspaceId) });
-    }
-  });
-};
+import { AddUserToWsDTONonE2EE } from "./types";
 
 export const useAddUserToWsNonE2EE = () => {
   const queryClient = useQueryClient();

frontend/src/hooks/api/users/types.ts

@@ -1,5 +1,4 @@
 import { MfaMethod } from "../auth/types";
-import { UserWsKeyPair } from "../keys/types";
 import { ProjectType, ProjectUserMembershipTemporaryMode } from "../workspace/types";
 
 export enum AuthMethod {
@@ -129,16 +128,6 @@ export type TWorkspaceUser = {
   deniedPermissions: any[];
 };
 
-export type AddUserToWsDTOE2EE = {
-  workspaceId: string;
-  decryptKey: UserWsKeyPair;
-  userPrivateKey: string;
-  members: {
-    orgMembershipId: string;
-    userPublicKey: string;
-  }[];
-};
-
 export type AddUserToWsDTONonE2EE = {
   projectId: string;
   usernames: string[];