feat: srp removal

backend/src/services/project/project-fns.ts

@@ -10,6 +10,10 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { AddUserToWsDTO, TBootstrapSshProjectDTO } from "./project-types";
 
 export const assignWorkspaceKeysToMembers = ({ members, decryptKey, userPrivateKey }: AddUserToWsDTO) => {
+  if (!decryptKey.sender.publicKey) {
+    throw new Error("Decrypt key sender public key not found");
+  }
+
   const plaintextProjectKey = crypto.encryption().asymmetric().decrypt({
     ciphertext: decryptKey.encryptedKey,
     nonce: decryptKey.nonce,

backend/src/services/project/project-queue.ts

@@ -121,6 +121,10 @@ export const projectQueueFactory = ({
         tag: data.encryptedPrivateKey.encryptedKeyTag
       });
 
+      if (!oldProjectKey.sender.publicKey) {
+        throw new Error("Old project key sender public key not found");
+      }
+
       const decryptedPlainProjectKey = crypto.encryption().asymmetric().decrypt({
         ciphertext: oldProjectKey.encryptedKey,
         nonce: oldProjectKey.nonce,
@@ -187,6 +191,10 @@ export const projectQueueFactory = ({
         approvalSecrets.push(...secretApprovals);
       }
 
+      if (!oldProjectKey.sender.publicKey) {
+        throw new Error("Old project key is not valid");
+      }
+
       const decryptedSecrets = decryptSecrets(secrets, userPrivateKey, oldProjectKey);
       const decryptedSecretVersions = decryptSecretVersions(secretVersions, userPrivateKey, oldProjectKey);
       const decryptedApprovalSecrets = decryptSecretApprovals(approvalSecrets, userPrivateKey, oldProjectKey);
@@ -290,6 +298,10 @@ export const projectQueueFactory = ({
             continue;
           }
 
+          if (!user.publicKey) {
+            throw new Error(`User with ID ${key.receiverId} has no public key during upgrade.`);
+          }
+
           const [newMember] = assignWorkspaceKeysToMembers({
             decryptKey: ghostUserLatestKey,
             userPrivateKey: ghostUser.keys.plainPrivateKey,

backend/src/services/project/project-service.ts

@@ -55,13 +55,10 @@ import { validateMicrosoftTeamsChannelsSchema } from "../microsoft-teams/microso
 import { TMicrosoftTeamsIntegrationDALFactory } from "../microsoft-teams/microsoft-teams-integration-dal";
 import { TProjectMicrosoftTeamsConfigDALFactory } from "../microsoft-teams/project-microsoft-teams-config-dal";
 import { TOrgDALFactory } from "../org/org-dal";
-import { TOrgServiceFactory } from "../org/org-service";
 import { TPkiAlertDALFactory } from "../pki-alert/pki-alert-dal";
 import { TPkiCollectionDALFactory } from "../pki-collection/pki-collection-dal";
-import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
 import { TProjectBotServiceFactory } from "../project-bot/project-bot-service";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
-import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
 import { TProjectMembershipDALFactory } from "../project-membership/project-membership-dal";
 import { TProjectUserMembershipRoleDALFactory } from "../project-membership/project-user-membership-role-dal";
 import { TProjectRoleDALFactory } from "../project-role/project-role-dal";
@@ -78,7 +75,7 @@ import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { WorkflowIntegration, WorkflowIntegrationStatus } from "../workflow-integration/workflow-integration-types";
 import { TProjectDALFactory } from "./project-dal";
-import { assignWorkspaceKeysToMembers, bootstrapSshProject, createProjectKey } from "./project-fns";
+import { bootstrapSshProject } from "./project-fns";
 import { TProjectQueueFactory } from "./project-queue";
 import { TProjectSshConfigDALFactory } from "./project-ssh-config-dal";
 import {
@@ -123,6 +120,7 @@ export const DEFAULT_PROJECT_ENVS = [
 
 type TProjectServiceFactoryDep = {
   projectDAL: TProjectDALFactory;
+  identityProjectDAL: Pick<TIdentityProjectDALFactory, "create">;
   projectSshConfigDAL: Pick<TProjectSshConfigDALFactory, "transaction" | "create" | "findOne" | "updateById">;
   projectQueue: TProjectQueueFactory;
   userDAL: TUserDALFactory;
@@ -132,9 +130,7 @@ type TProjectServiceFactoryDep = {
   secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "find">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "insertMany" | "find">;
   identityOrgMembershipDAL: TIdentityOrgDALFactory;
-  identityProjectDAL: TIdentityProjectDALFactory;
   identityProjectMembershipRoleDAL: Pick<TIdentityProjectMembershipRoleDALFactory, "create">;
-  projectKeyDAL: Pick<TProjectKeyDALFactory, "create" | "findLatestProjectKey" | "delete" | "find" | "insertMany">;
   projectMembershipDAL: Pick<
     TProjectMembershipDALFactory,
     "create" | "findProjectGhostUser" | "findOne" | "delete" | "findAllProjectMembers"
@@ -167,12 +163,10 @@ type TProjectServiceFactoryDep = {
   sshHostDAL: Pick<TSshHostDALFactory, "find" | "findSshHostsWithLoginMappings">;
   sshHostGroupDAL: Pick<TSshHostGroupDALFactory, "find" | "findSshHostGroupsWithLoginMappings">;
   permissionService: TPermissionServiceFactory;
-  orgService: Pick<TOrgServiceFactory, "addGhostUser">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "invalidateGetPlan">;
   smtpService: Pick<TSmtpService, "sendMail">;
   orgDAL: Pick<TOrgDALFactory, "findOne">;
   keyStore: Pick<TKeyStoreFactory, "deleteItem">;
-  projectBotDAL: Pick<TProjectBotDALFactory, "create">;
   projectRoleDAL: Pick<TProjectRoleDALFactory, "find" | "insertMany" | "delete">;
   kmsService: Pick<
     TKmsServiceFactory,
@@ -196,27 +190,25 @@ export const projectServiceFactory = ({
   secretDAL,
   secretV2BridgeDAL,
   projectQueue,
-  projectKeyDAL,
   permissionService,
   projectBotService,
   orgDAL,
   userDAL,
   folderDAL,
-  orgService,
-  identityProjectDAL,
   identityOrgMembershipDAL,
   projectMembershipDAL,
   projectEnvDAL,
   licenseService,
   projectUserMembershipRoleDAL,
   projectRoleDAL,
-  identityProjectMembershipRoleDAL,
   certificateAuthorityDAL,
   certificateDAL,
   certificateTemplateDAL,
   pkiCollectionDAL,
   pkiAlertDAL,
   pkiSubscriberDAL,
+  identityProjectDAL,
+  identityProjectMembershipRoleDAL,
   sshCertificateAuthorityDAL,
   sshCertificateAuthoritySecretDAL,
   sshCertificateDAL,
@@ -225,7 +217,6 @@ export const projectServiceFactory = ({
   sshHostGroupDAL,
   keyStore,
   kmsService,
-  projectBotDAL,
   projectSlackConfigDAL,
   projectMicrosoftTeamsConfigDAL,
   slackIntegrationDAL,
@@ -253,7 +244,7 @@ export const projectServiceFactory = ({
     type = ProjectType.SecretManager
   }: TCreateProjectDTO) => {
     const organization = await orgDAL.findOne({ id: actorOrgId });
-    const { permission, membership: orgMembership } = await permissionService.getOrgPermission(
+    const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
       organization.id,
@@ -277,7 +268,6 @@ export const projectServiceFactory = ({
           message: "Failed to create workspace due to plan limit reached. Upgrade plan to add more workspaces."
         });
       }
-      const ghostUser = await orgService.addGhostUser(organization.id, tx);
 
       if (kmsKeyId) {
         const kms = await kmsService.getKmsById(kmsKeyId, tx);
@@ -329,19 +319,6 @@ export const projectServiceFactory = ({
         });
       }
 
-      // set ghost user as admin of project
-      const projectMembership = await projectMembershipDAL.create(
-        {
-          userId: ghostUser.user.id,
-          projectId: project.id
-        },
-        tx
-      );
-      await projectUserMembershipRoleDAL.create(
-        { projectMembershipId: projectMembership.id, role: ProjectMembershipRole.Admin },
-        tx
-      );
-
       // set default environments and root folder for provided environments
       let envs: TProjectEnvironments[] = [];
       if (projectTemplate) {
@@ -374,55 +351,6 @@ export const projectServiceFactory = ({
         );
       }
 
-      // 3. Create a random key that we'll use as the project key.
-      const { key: encryptedProjectKey, iv: encryptedProjectKeyIv } = createProjectKey({
-        publicKey: ghostUser.keys.publicKey,
-        privateKey: ghostUser.keys.plainPrivateKey
-      });
-
-      // 4. Save the project key for the ghost user.
-      await projectKeyDAL.create(
-        {
-          projectId: project.id,
-          receiverId: ghostUser.user.id,
-          encryptedKey: encryptedProjectKey,
-          nonce: encryptedProjectKeyIv,
-          senderId: ghostUser.user.id
-        },
-        tx
-      );
-
-      const { iv, tag, ciphertext, encoding, algorithm } = crypto
-        .encryption()
-        .symmetric()
-        .encryptWithRootEncryptionKey(ghostUser.keys.plainPrivateKey);
-
-      // 5. Create & a bot for the project
-      await projectBotDAL.create(
-        {
-          name: "Infisical Bot (Ghost)",
-          projectId: project.id,
-          tag,
-          iv,
-          encryptedProjectKey,
-          encryptedProjectKeyNonce: encryptedProjectKeyIv,
-          encryptedPrivateKey: ciphertext,
-          isActive: true,
-          publicKey: ghostUser.keys.publicKey,
-          senderId: ghostUser.user.id,
-          algorithm,
-          keyEncoding: encoding
-        },
-        tx
-      );
-
-      // Find the ghost users latest key
-      const latestKey = await projectKeyDAL.findLatestProjectKey(ghostUser.user.id, project.id, tx);
-
-      if (!latestKey) {
-        throw new Error("Latest key not found for user");
-      }
-
       // If the project is being created by a user, add the user to the project as an admin
       if (actor === ActorType.USER) {
         // Find public key of user
@@ -432,17 +360,6 @@ export const projectServiceFactory = ({
           throw new Error("User not found");
         }
 
-        const [projectAdmin] = assignWorkspaceKeysToMembers({
-          decryptKey: latestKey,
-          userPrivateKey: ghostUser.keys.plainPrivateKey,
-          members: [
-            {
-              userPublicKey: user.publicKey,
-              orgMembershipId: orgMembership.id
-            }
-          ]
-        });
-
         // Create a membership for the user
         const userProjectMembership = await projectMembershipDAL.create(
           {
@@ -455,18 +372,6 @@ export const projectServiceFactory = ({
           { projectMembershipId: userProjectMembership.id, role: ProjectMembershipRole.Admin },
           tx
         );
-
-        // Create a project key for the user
-        await projectKeyDAL.create(
-          {
-            encryptedKey: projectAdmin.workspaceEncryptedKey,
-            nonce: projectAdmin.workspaceEncryptedNonce,
-            senderId: ghostUser.user.id,
-            receiverId: user.id,
-            projectId: project.id
-          },
-          tx
-        );
       }
 
       // If the project is being created by an identity, add the identity to the project as an admin

backend/src/services/project/project-types.ts

@@ -116,7 +116,7 @@ export type TUpgradeProjectDTO = {
 } & TProjectPermission;
 
 export type AddUserToWsDTO = {
-  decryptKey: TProjectKeys & { sender: { publicKey: string } };
+  decryptKey: TProjectKeys & { sender: { publicKey?: string } };
   userPrivateKey: string;
   members: {
     orgMembershipId: string;