improvement: finish address changes

backend/src/services/cmek/cmek-service.ts

@@ -0,0 +1,169 @@
+import { ForbiddenError } from "@casl/ability";
+import { FastifyRequest } from "fastify";
+
+import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
+import { ProjectPermissionCmekActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import {
+  TCmekDecryptDTO,
+  TCmekEncryptDTO,
+  TCreateCmekDTO,
+  TListCmeksByProjectIdDTO,
+  TUpdabteCmekByIdDTO
+} from "@app/services/cmek/cmek-types";
+import { TKmsKeyDALFactory } from "@app/services/kms/kms-key-dal";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+type TCmekServiceFactoryDep = {
+  kmsService: TKmsServiceFactory;
+  kmsDAL: TKmsKeyDALFactory;
+  permissionService: TPermissionServiceFactory;
+};
+
+export type TCmekServiceFactory = ReturnType<typeof cmekServiceFactory>;
+
+export const cmekServiceFactory = ({ kmsService, kmsDAL, permissionService }: TCmekServiceFactoryDep) => {
+  const createCmek = async ({ projectId, ...dto }: TCreateCmekDTO, actor: FastifyRequest["permission"]) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Create, ProjectPermissionSub.Cmek);
+
+    const cmek = await kmsService.generateKmsKey({
+      ...dto,
+      projectId,
+      isReserved: false
+    });
+
+    return cmek;
+  };
+
+  const updateCmekById = async ({ keyId, ...data }: TUpdabteCmekByIdDTO, actor: FastifyRequest["permission"]) => {
+    const key = await kmsDAL.findById(keyId);
+
+    if (!key) throw new NotFoundError({ message: "Key not found" });
+
+    if (!key.projectId || key.isReserved) throw new BadRequestError({ message: "Key is not customer managed" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      key.projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Edit, ProjectPermissionSub.Cmek);
+
+    const cmek = await kmsDAL.updateById(keyId, data);
+
+    return cmek;
+  };
+
+  const deleteCmekById = async (keyId: string, actor: FastifyRequest["permission"]) => {
+    const key = await kmsDAL.findById(keyId);
+
+    if (!key) throw new NotFoundError({ message: "Key not found" });
+
+    if (!key.projectId || key.isReserved) throw new BadRequestError({ message: "Key is not customer managed" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      key.projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Delete, ProjectPermissionSub.Cmek);
+
+    const cmek = kmsDAL.deleteById(keyId);
+
+    return cmek;
+  };
+
+  const listCmeksByProjectId = async (
+    { projectId, ...filters }: TListCmeksByProjectIdDTO,
+    actor: FastifyRequest["permission"]
+  ) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
+
+    const { keys: cmeks, totalCount } = await kmsDAL.findKmsKeysByProjectId({ projectId, ...filters });
+
+    return { cmeks, totalCount };
+  };
+
+  const cmekEncrypt = async ({ keyId, plaintext }: TCmekEncryptDTO, actor: FastifyRequest["permission"]) => {
+    const key = await kmsDAL.findById(keyId);
+
+    if (!key) throw new NotFoundError({ message: "Key not found" });
+
+    if (!key.projectId || key.isReserved) throw new BadRequestError({ message: "Key is not customer managed" });
+
+    if (key.isDisabled) throw new BadRequestError({ message: "Key is disabled" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      key.projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Encrypt, ProjectPermissionSub.Cmek);
+
+    const encrypt = await kmsService.encryptWithKmsKey({ kmsId: keyId });
+
+    const { cipherTextBlob } = await encrypt({ plainText: Buffer.from(plaintext, "base64") });
+
+    return cipherTextBlob.toString("base64");
+  };
+
+  const cmekDecrypt = async ({ keyId, ciphertext }: TCmekDecryptDTO, actor: FastifyRequest["permission"]) => {
+    const key = await kmsDAL.findById(keyId);
+
+    if (!key) throw new NotFoundError({ message: "Key not found" });
+
+    if (!key.projectId || key.isReserved) throw new BadRequestError({ message: "Key is not customer managed" });
+
+    if (key.isDisabled) throw new BadRequestError({ message: "Key is disabled" });
+
+    const { permission } = await permissionService.getProjectPermission(
+      actor.type,
+      actor.id,
+      key.projectId,
+      actor.authMethod,
+      actor.orgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionCmekActions.Decrypt, ProjectPermissionSub.Cmek);
+
+    const decrypt = await kmsService.decryptWithKmsKey({ kmsId: keyId });
+
+    const plaintextBlob = await decrypt({ cipherTextBlob: Buffer.from(ciphertext, "base64") });
+
+    return plaintextBlob.toString("base64");
+  };
+
+  return {
+    createCmek,
+    updateCmekById,
+    deleteCmekById,
+    listCmeksByProjectId,
+    cmekEncrypt,
+    cmekDecrypt
+  };
+};

backend/src/services/cmek/cmek-types.ts

@@ -0,0 +1,40 @@
+import { SymmetricEncryption } from "@app/lib/crypto/cipher";
+import { OrderByDirection } from "@app/lib/types";
+
+export type TCreateCmekDTO = {
+  orgId: string;
+  projectId: string;
+  name: string;
+  description?: string;
+  encryptionAlgorithm: SymmetricEncryption;
+};
+
+export type TUpdabteCmekByIdDTO = {
+  keyId: string;
+  name?: string;
+  isDisabled?: boolean;
+  description?: string;
+};
+
+export type TListCmeksByProjectIdDTO = {
+  projectId: string;
+  offset?: number;
+  limit?: number;
+  orderBy?: CmekOrderBy;
+  orderDirection?: OrderByDirection;
+  search?: string;
+};
+
+export type TCmekEncryptDTO = {
+  keyId: string;
+  plaintext: string;
+};
+
+export type TCmekDecryptDTO = {
+  keyId: string;
+  ciphertext: string;
+};
+
+export enum CmekOrderBy {
+  Name = "name"
+}

backend/src/services/identity/identity-org-dal.ts

@@ -5,7 +5,7 @@ import { TableName, TIdentityOrgMemberships } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
-import { TListOrgIdentitiesByOrgIdDTO } from "@app/services/identity/identity-types";
+import { OrgIdentityOrderBy, TListOrgIdentitiesByOrgIdDTO } from "@app/services/identity/identity-types";
 
 export type TIdentityOrgDALFactory = ReturnType<typeof identityOrgDALFactory>;
 
@@ -33,7 +33,7 @@ export const identityOrgDALFactory = (db: TDbClient) => {
     {
       limit,
       offset = 0,
-      orderBy,
+      orderBy = OrgIdentityOrderBy.Name,
       orderDirection = OrderByDirection.ASC,
       search,
       ...filter
@@ -43,12 +43,16 @@ export const identityOrgDALFactory = (db: TDbClient) => {
   ) => {
     try {
       const paginatedFetchIdentity = (tx || db.replicaNode())(TableName.Identity)
-        .where((queryBuilder) => {
-          if (limit) {
-            void queryBuilder.offset(offset).limit(limit);
-          }
-        })
-        .as(TableName.Identity);
+        .as(TableName.Identity)
+        .orderBy(`${TableName.Identity}.${orderBy}`, orderDirection);
+
+      if (search?.length) {
+        void paginatedFetchIdentity.whereILike(`${TableName.Identity}.name`, `%${search}%`);
+      }
+
+      if (limit) {
+        void paginatedFetchIdentity.offset(offset).limit(limit);
+      }
 
       const query = (tx || db.replicaNode())(TableName.IdentityOrgMembership)
         .where(filter)
@@ -78,24 +82,8 @@ export const identityOrgDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.IdentityMetadata).as("metadataId"),
           db.ref("key").withSchema(TableName.IdentityMetadata).as("metadataKey"),
           db.ref("value").withSchema(TableName.IdentityMetadata).as("metadataValue")
-        );
-
-      if (orderBy) {
-        switch (orderBy) {
-          case "name":
-            void query.orderBy(`${TableName.Identity}.${orderBy}`, orderDirection);
-            break;
-          case "role":
-            void query.orderBy(`${TableName.IdentityOrgMembership}.${orderBy}`, orderDirection);
-            break;
-          default:
-          // do nothing
-        }
-      }
-
-      if (search?.length) {
-        void query.whereILike(`${TableName.Identity}.name`, `%${search}%`);
-      }
+        )
+        .orderBy(`${TableName.Identity}.${orderBy}`, orderDirection);
 
       const docs = await query;
       const formattedDocs = sqlNestRelationships({

backend/src/services/identity/identity-types.ts

@@ -41,6 +41,6 @@ export type TListOrgIdentitiesByOrgIdDTO = {
 } & TOrgPermission;
 
 export enum OrgIdentityOrderBy {
-  Name = "name",
-  Role = "role"
+  Name = "name"
+  // Role = "role"
 }

backend/src/services/kms/kms-fns.ts

@@ -0,0 +1,11 @@
+import { SymmetricEncryption } from "@app/lib/crypto/cipher";
+
+export const getByteLengthForAlgorithm = (encryptionAlgorithm: SymmetricEncryption) => {
+  switch (encryptionAlgorithm) {
+    case SymmetricEncryption.AES_GCM_128:
+      return 16;
+    case SymmetricEncryption.AES_GCM_256:
+    default:
+      return 32;
+  }
+};

backend/src/services/kms/kms-key-dal.ts

@@ -1,9 +1,11 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { KmsKeysSchema, TableName } from "@app/db/schemas";
+import { KmsKeysSchema, TableName, TInternalKms, TKmsKeys } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
+import { OrderByDirection } from "@app/lib/types";
+import { CmekOrderBy, TListCmeksByProjectIdDTO } from "@app/services/cmek/cmek-types";
 
 export type TKmsKeyDALFactory = ReturnType<typeof kmskeyDALFactory>;
 
@@ -71,5 +73,50 @@ export const kmskeyDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...kmsOrm, findByIdWithAssociatedKms };
+  const findKmsKeysByProjectId = async (
+    {
+      projectId,
+      offset = 0,
+      limit,
+      orderBy = CmekOrderBy.Name,
+      orderDirection = OrderByDirection.ASC,
+      search
+    }: TListCmeksByProjectIdDTO,
+    tx?: Knex
+  ) => {
+    try {
+      const query = (tx || db.replicaNode())(TableName.KmsKey)
+        .where("projectId", projectId)
+        .where((qb) => {
+          if (search) {
+            void qb.whereILike("name", `%${search}%`);
+          }
+        })
+        .join(TableName.InternalKms, `${TableName.InternalKms}.kmsKeyId`, `${TableName.KmsKey}.id`)
+        .select<
+          (TKmsKeys &
+            Pick<TInternalKms, "version" | "encryptionAlgorithm"> & {
+              total_count: number;
+            })[]
+        >(
+          selectAllTableCols(TableName.KmsKey),
+          db.raw(`count(*) OVER() as total_count`),
+          db.ref("encryptionAlgorithm").withSchema(TableName.InternalKms),
+          db.ref("version").withSchema(TableName.InternalKms)
+        )
+        .orderBy(orderBy, orderDirection);
+
+      if (limit) {
+        void query.limit(limit).offset(offset);
+      }
+
+      const data = await query;
+
+      return { keys: data, totalCount: Number(data?.[0]?.total_count ?? 0) };
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find kms keys by project id" });
+    }
+  };
+
+  return { ...kmsOrm, findByIdWithAssociatedKms, findKmsKeysByProjectId };
 };

backend/src/services/kms/kms-service.ts

@@ -17,6 +17,7 @@ import { generateHash } from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
+import { getByteLengthForAlgorithm } from "@app/services/kms/kms-fns";
 
 import { TOrgDALFactory } from "../org/org-dal";
 import { TProjectDALFactory } from "../project/project-dal";
@@ -66,22 +67,43 @@ export const kmsServiceFactory = ({
 }: TKmsServiceFactoryDep) => {
   let ROOT_ENCRYPTION_KEY = Buffer.alloc(0);
 
+  const $getRootEncryptionKey = (encryptionAlgorithm: SymmetricEncryption) => {
+    switch (encryptionAlgorithm) {
+      case SymmetricEncryption.AES_GCM_128:
+        return ROOT_ENCRYPTION_KEY.subarray(0, 16); // taking first 128bits
+      case SymmetricEncryption.AES_GCM_256:
+      default:
+        return ROOT_ENCRYPTION_KEY;
+    }
+  };
+
   /*
    * Generate KMS Key
    * This function is responsibile for generating the infisical internal KMS for various entities
    * Like for secret manager, cert manager or for organization
    */
-  const generateKmsKey = async ({ orgId, isReserved = true, tx, slug }: TGenerateKMSDTO) => {
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-    const kmsKeyMaterial = randomSecureBytes(32);
-    const encryptedKeyMaterial = cipher.encrypt(kmsKeyMaterial, ROOT_ENCRYPTION_KEY);
-    const sanitizedSlug = slug ? slugify(slug) : slugify(alphaNumericNanoId(8).toLowerCase());
+  const generateKmsKey = async ({
+    orgId,
+    isReserved = true,
+    tx,
+    name,
+    projectId,
+    encryptionAlgorithm = SymmetricEncryption.AES_GCM_256,
+    description
+  }: TGenerateKMSDTO) => {
+    const cipher = symmetricCipherService(encryptionAlgorithm);
+
+    const kmsKeyMaterial = randomSecureBytes(getByteLengthForAlgorithm(encryptionAlgorithm));
+    const encryptedKeyMaterial = cipher.encrypt(kmsKeyMaterial, $getRootEncryptionKey(encryptionAlgorithm));
+    const sanitizedName = name ? slugify(name) : slugify(alphaNumericNanoId(8).toLowerCase());
     const dbQuery = async (db: Knex) => {
       const kmsDoc = await kmsDAL.create(
         {
-          slug: sanitizedSlug,
+          name: sanitizedName,
           orgId,
-          isReserved
+          isReserved,
+          projectId,
+          description
         },
         db
       );
@@ -90,7 +112,7 @@ export const kmsServiceFactory = ({
         {
           version: 1,
           encryptedKey: encryptedKeyMaterial,
-          encryptionAlgorithm: SymmetricEncryption.AES_GCM_256,
+          encryptionAlgorithm,
           kmsKeyId: kmsDoc.id
         },
         db
@@ -286,8 +308,13 @@ export const kmsServiceFactory = ({
     }
 
     // internal KMS
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
-    const kmsKey = cipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+    const encryptionAlgorithm =
+      (kmsDoc.internalKms?.encryptionAlgorithm as SymmetricEncryption) ?? SymmetricEncryption.AES_GCM_256;
+    const cipher = symmetricCipherService(encryptionAlgorithm);
+    const kmsKey = cipher.decrypt(
+      kmsDoc.internalKms?.encryptedKey as Buffer,
+      $getRootEncryptionKey(encryptionAlgorithm)
+    );
 
     return ({ cipherTextBlob: versionedCipherTextBlob }: Pick<TDecryptWithKmsDTO, "cipherTextBlob">) => {
       const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH);
@@ -347,10 +374,14 @@ export const kmsServiceFactory = ({
     }
 
     // internal KMS
-    // akhilmhdh: as more encryption are added do a check here on kmsDoc.encryptionAlgorithm
-    const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+    const encryptionAlgorithm =
+      (kmsDoc.internalKms?.encryptionAlgorithm as SymmetricEncryption) ?? SymmetricEncryption.AES_GCM_256;
+    const cipher = symmetricCipherService(encryptionAlgorithm);
     return ({ plainText }: Pick<TEncryptWithKmsDTO, "plainText">) => {
-      const kmsKey = cipher.decrypt(kmsDoc.internalKms?.encryptedKey as Buffer, ROOT_ENCRYPTION_KEY);
+      const kmsKey = cipher.decrypt(
+        kmsDoc.internalKms?.encryptedKey as Buffer,
+        $getRootEncryptionKey(encryptionAlgorithm)
+      );
       const encryptedPlainTextBlob = cipher.encrypt(plainText, kmsKey);
 
       // Buffer#1 encrypted text + Buffer#2 version number
@@ -767,8 +798,8 @@ export const kmsServiceFactory = ({
         message: "KMS not found"
       });
     }
-    const { id, slug, orgId, isExternal } = kms;
-    return { id, slug, orgId, isExternal };
+    const { id, name, orgId, isExternal } = kms;
+    return { id, name, orgId, isExternal };
   };
 
   // akhilmhdh: a copy of this is made in migrations/utils/kms

backend/src/services/kms/kms-types.ts

@@ -1,5 +1,7 @@
 import { Knex } from "knex";
 
+import { SymmetricEncryption } from "@app/lib/crypto/cipher";
+
 export enum KmsDataKey {
   Organization,
   SecretManager
@@ -22,8 +24,11 @@ export type TEncryptWithKmsDataKeyDTO =
 
 export type TGenerateKMSDTO = {
   orgId: string;
+  projectId?: string;
+  encryptionAlgorithm?: SymmetricEncryption;
   isReserved?: boolean;
-  slug?: string;
+  name?: string;
+  description?: string;
   tx?: Knex;
 };