Complete first iteration of CRUD secrets operations by name

backend/src/helpers/workspace.ts

@@ -1,4 +1,5 @@
 import * as Sentry from '@sentry/node';
+import crypto from 'crypto';
 import { Types } from 'mongoose';
 import {
 	Workspace,
@@ -13,6 +14,7 @@ import {
 	IServiceAccount,
 	ServiceTokenData,
 	IServiceTokenData,
+	SecretBlindIndexData
 } from '../models';
 import { createBot } from '../helpers/bot';
 import { validateUserClientForWorkspace } from '../helpers/user';
@@ -26,6 +28,8 @@ import {
 	AUTH_MODE_SERVICE_TOKEN,
 	AUTH_MODE_API_KEY
 } from '../variables';
+import { getEncryptionKey } from '../config';
+import { encryptSymmetric } from '../utils/crypto';
 
 /**
  * Validate authenticated clients for workspace with id [workspaceId] based
@@ -42,7 +46,8 @@ const validateClientForWorkspace = async ({
 	workspaceId,
 	environment,
 	acceptedRoles,
-	requiredPermissions
+	requiredPermissions,
+	requireBlindIndicesEnabled
 }: {
 	authData: {
 		authMode: string;
@@ -52,6 +57,7 @@ const validateClientForWorkspace = async ({
 	environment?: string;
 	acceptedRoles: Array<'admin' | 'member'>;
 	requiredPermissions?: string[];
+	requireBlindIndicesEnabled: boolean;
 }) => {
 	
 	const workspace = await Workspace.findById(workspaceId);
@@ -60,6 +66,16 @@ const validateClientForWorkspace = async ({
 		message: 'Failed to find workspace'
 	});
 
+	if (requireBlindIndicesEnabled && !workspace.isBlindedIndicesEnabled) {
+		// case: blind indices are not enabled for secrets in this workspace
+		// (i.e. workspace was created before blind indices were introduced
+		// and no admin has enabled it)
+		
+		throw UnauthorizedRequestError({
+			message: 'Failed workspace authorization due to blind indices not being enabled'
+		});
+	}
+
 	if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
 		const membership = await validateUserClientForWorkspace({
 			user: authData.authPayload,
@@ -130,13 +146,36 @@ const createWorkspace = async ({
 		// create workspace
 		workspace = await new Workspace({
 			name,
-			organization: organizationId
+			organization: organizationId,
+			autoCapitalization: true,
+			isBlindedIndicesEnabled: true
 		}).save();
 		
-		const bot = await createBot({
+		// initialize bot for workspace
+		await createBot({
 			name: 'Infisical Bot',
-			workspaceId: workspace._id.toString()
+			workspaceId: workspace._id
 		});
+		
+		// initialize blind index salt for workspace
+		const salt = crypto.randomBytes(16).toString('base64');
+		
+		const { 
+			ciphertext: encryptedSaltCiphertext,
+			iv: saltIV,
+			tag: saltTag
+		} = encryptSymmetric({
+			plaintext: salt,
+			key: getEncryptionKey()
+		});
+		
+		await new SecretBlindIndexData({
+			workspace: workspace._id,
+			encryptedSaltCiphertext,
+			saltIV,
+			saltTag
+		}).save();
+
 	} catch (err) {
 		Sentry.setUser(null);
 		Sentry.captureException(err);