awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 14:34:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added bridge logic in secret replication, snapshot and approval for raw endpoint

Browse Source
This commit is contained in:
=
2024-07-30 23:11:04 +05:30
parent 9e314d7a09
commit ef2816b2ee
14 changed files with 2205 additions and 283 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/kms/kms-service.ts
+35 -1
View File
@@ -22,9 +22,11 @@ import { TInternalKmsDALFactory } from "./internal-kms-dal";
import { TKmsKeyDALFactory } from "./kms-key-dal";
import { TKmsRootConfigDALFactory } from "./kms-root-config-dal";
import {
KmsDataKey,
TDecryptWithKeyDTO,
TDecryptWithKmsDTO,
TEncryptionWithKeyDTO,
TEncryptWithKmsDataKeyDTO,
TEncryptWithKmsDTO,
TGenerateKMSDTO
} from "./kms-types";
@@ -678,6 +680,37 @@ export const kmsServiceFactory = ({
return kms;
};
const $getDataKey = async (dto: TEncryptWithKmsDataKeyDTO) => {
switch (dto.type) {
case KmsDataKey.SecretManager: {
return getProjectSecretManagerKmsDataKey(dto.projectId);
}
default: {
return getProjectSecretManagerKmsDataKey(dto.orgId);
}
}
};
const createCipherPairWithDataKey = async (encryptionContext: TEncryptWithKmsDataKeyDTO) => {
const dataKey = await $getDataKey(encryptionContext);
const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
return {
encryptor: ({ plainText }: Pick<TEncryptWithKmsDTO, "plainText">) => {
const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey);
// Buffer#1 encrypted text + Buffer#2 version number
const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3
const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]);
return { cipherTextBlob };
},
decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: Pick<TDecryptWithKeyDTO, "cipherTextBlob">) => {
const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH);
const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey);
return decryptedBlob;
}
};
};
const startService = async () => {
const appCfg = getConfig();
// This will switch to a seal process and HMS flow in future
@@ -738,6 +771,7 @@ export const kmsServiceFactory = ({
updateProjectSecretManagerKmsKey,
getProjectKeyBackup,
loadProjectKeyBackup,
getKmsById
getKmsById,
createCipherPairWithDataKey
};
};
backend/src/services/kms/kms-types.ts
+15
View File
@@ -26,3 +26,18 @@ export type TDecryptWithKeyDTO = {
key: Buffer;
cipherTextBlob: Buffer;
};
export enum KmsDataKey {
Organization,
SecretManager
// CertificateManager
}
export type TEncryptWithKmsDataKeyDTO =
| { type: KmsDataKey.Organization; orgId: string }
| { type: KmsDataKey.SecretManager; projectId: string };
// akhilmhdh: not implemented yet
// | {
// type: KmsDataKey.CertificateManager;
// projectId: string;
// };
backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+12
View File
@@ -8,6 +8,7 @@ import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types";
import { TKmsServiceFactory } from "../kms/kms-service";
const INTERPOLATION_SYNTAX_REG = /\${([^}]+)}/g;
@@ -551,3 +552,14 @@ export const reshapeBridgeSecret = (
createdAt: secret.createdAt,
updatedAt: secret.updatedAt
});
export const secretEncryptionHelper = {
encryptValue: (encryptor: Awaited<ReturnType<TKmsServiceFactory["encryptWithKmsKey"]>>, value?: string) => {
if (typeof value === "undefined") return;
return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob;
},
decryptValue: (decryptor: Awaited<ReturnType<TKmsServiceFactory["decryptWithInputKey"]>>, value?: Buffer | null) => {
if (!value) return;
return decryptor({ cipherTextBlob: value }).toString();
}
};
backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+34 -41
View File
@@ -22,6 +22,7 @@ import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns";
import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
import {
secretEncryptionHelper,
fnSecretBulkDelete,
fnSecretBulkInsert,
fnSecretBulkUpdate,
@@ -75,17 +76,6 @@ type TSecretV2BridgeServiceFactoryDep = {
export type TSecretV2BridgeServiceFactory = ReturnType<typeof secretV2BridgeServiceFactory>;
const encryptionHelper = {
encryptValue: (encryptor: Awaited<ReturnType<TKmsServiceFactory["encryptWithKmsKey"]>>, value?: string) => {
if (typeof value === "undefined") return;
return encryptor({ plainText: Buffer.from(value) }).cipherTextBlob;
},
decryptValue: (decryptor: Awaited<ReturnType<TKmsServiceFactory["decryptWithInputKey"]>>, value?: Buffer | null) => {
if (!value) return;
return decryptor({ cipherTextBlob: value }).toString();
}
};
/*
* This service is a bridge from our old architecture towards the new architecture
*/
@@ -171,8 +161,8 @@ export const secretV2BridgeServiceFactory = ({
version: 1,
type,
reminderRepeatDays: el.secretReminderRepeatDays,
encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue),
encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue),
reminderNote: el.secretReminderNote,
skipMultilineEncoding: el.skipMultilineEncoding,
key: secretName,
@@ -291,7 +281,7 @@ export const secretV2BridgeServiceFactory = ({
const encryptedValue =
typeof secretValue !== "undefined"
? {
encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer,
encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretValue) as Buffer,
references: getAllNestedSecretReferences(secretValue)
}
: {};
@@ -304,7 +294,7 @@ export const secretV2BridgeServiceFactory = ({
filter: { id: secretId },
data: {
reminderRepeatDays: inputSecret.secretReminderRepeatDays,
encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, secretComment),
encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, secretComment),
reminderNote: inputSecret.secretReminderNote,
skipMultilineEncoding: inputSecret.skipMultilineEncoding,
key: inputSecret.newSecretName || secretName,
@@ -408,8 +398,8 @@ export const secretV2BridgeServiceFactory = ({
const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey });
return reshapeBridgeSecret(projectId, environment, secretPath, {
...deletedSecret[0],
value: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, deletedSecret[0].encryptedComment)
});
};
@@ -496,15 +486,15 @@ export const secretV2BridgeServiceFactory = ({
secretDAL,
folderDAL,
secretImportDAL,
decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value)
decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value)
});
return {
secrets: secrets.map((secret) =>
reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, {
...secret,
value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
})
),
imports: importedSecrets
@@ -515,8 +505,8 @@ export const secretV2BridgeServiceFactory = ({
secrets: secrets.map((secret) =>
reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, {
...secret,
value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
})
)
};
@@ -583,7 +573,7 @@ export const secretV2BridgeServiceFactory = ({
.then((el) => SecretsV2Schema.parse({ ...el, id: el.secretId })));
const interpolateInlineSecretReference = interpolateSecrets({
projectId,
decryptSecret: (encryptedValue) => encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue),
decryptSecret: (encryptedValue) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue),
secretDAL,
folderDAL
});
@@ -610,14 +600,17 @@ export const secretV2BridgeServiceFactory = ({
secretDAL,
folderDAL,
secretImportDAL,
decryptor: (value) => encryptionHelper.decryptValue(secretManagerDecryptor, value)
decryptor: (value) => secretEncryptionHelper.decryptValue(secretManagerDecryptor, value)
});
for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) {
if (secretName === importedSecrets[i].secrets[j].key) {
const importedSecret = importedSecrets[i].secrets[j];
let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedValue);
let secretValue = secretEncryptionHelper.decryptValue(
secretManagerDecryptor,
importedSecret.encryptedValue
);
if (expandSecretReferences && secretValue) {
const secretReferenceExpandedString = {
[importedSecret.key]: { value: secretValue }
@@ -630,7 +623,7 @@ export const secretV2BridgeServiceFactory = ({
return reshapeBridgeSecret(projectId, importedSecrets[i].environment, importedSecrets[i].secretPath, {
...importedSecret,
value: secretValue,
comment: encryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment)
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, importedSecret.encryptedComment)
});
}
}
@@ -638,7 +631,7 @@ export const secretV2BridgeServiceFactory = ({
}
if (!secret) throw new BadRequestError({ message: "Secret not found" });
let secretValue = encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue);
let secretValue = secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue);
if (expandSecretReferences && secretValue) {
const secretReferenceExpandedString = {
[secret.key]: { value: secretValue }
@@ -651,7 +644,7 @@ export const secretV2BridgeServiceFactory = ({
return reshapeBridgeSecret(projectId, environment, path, {
...secret,
value: secretValue,
comment: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedComment)
});
};
@@ -707,8 +700,8 @@ export const secretV2BridgeServiceFactory = ({
fnSecretBulkInsert({
inputSecrets: inputSecrets.map((el) => ({
version: 1,
encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue),
encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue),
skipMultilineEncoding: el.skipMultilineEncoding,
key: el.secretKey,
tagIds: el.tagIds,
@@ -737,8 +730,8 @@ export const secretV2BridgeServiceFactory = ({
return newSecrets.map((el) =>
reshapeBridgeSecret(projectId, environment, secretPath, {
...el,
value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
})
);
};
@@ -814,7 +807,7 @@ export const secretV2BridgeServiceFactory = ({
const encryptedValue =
typeof el.secretValue !== "undefined"
? {
encryptedValue: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer,
encryptedValue: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretValue) as Buffer,
references: getAllNestedSecretReferences(el.secretValue)
}
: {};
@@ -822,7 +815,7 @@ export const secretV2BridgeServiceFactory = ({
filter: { key: el.secretKey, type: SecretType.Shared },
data: {
reminderRepeatDays: el.secretReminderRepeatDays,
encryptedComment: encryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
encryptedComment: secretEncryptionHelper.encryptValue(secretManagerEncryptor, el.secretComment),
reminderNote: el.secretReminderNote,
skipMultilineEncoding: el.skipMultilineEncoding,
key: el.newSecretName || el.secretKey,
@@ -850,8 +843,8 @@ export const secretV2BridgeServiceFactory = ({
return secrets.map((el) =>
reshapeBridgeSecret(projectId, environment, secretPath, {
...el,
value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
})
);
};
@@ -925,8 +918,8 @@ export const secretV2BridgeServiceFactory = ({
return secretsDeleted.map((el) =>
reshapeBridgeSecret(projectId, environment, secretPath, {
...el,
value: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: encryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedValue),
comment: secretEncryptionHelper.decryptValue(secretManagerDecryptor, el.encryptedComment)
})
);
};
@@ -991,7 +984,7 @@ export const secretV2BridgeServiceFactory = ({
secretId: id,
references: encryptedValue
? getAllNestedSecretReferences(
encryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string
secretEncryptionHelper.decryptValue(secretManagerDecryptor, encryptedValue) as string
)
: []
})),
@@ -1074,7 +1067,7 @@ export const secretV2BridgeServiceFactory = ({
const secretManagerDecryptor = await kmsService.decryptWithInputKey({ key: secretManagerDataKey });
const decryptedSourceSecrets = sourceSecrets.map((secret) => ({
...secret,
value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue)
}));
let isSourceUpdated = false;
@@ -1093,7 +1086,7 @@ export const secretV2BridgeServiceFactory = ({
const decryptedDestinationSecrets = destinationSecretsFromDB.map((secret) => {
return {
...secret,
value: encryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue)
value: secretEncryptionHelper.decryptValue(secretManagerDecryptor, secret.encryptedValue)
};
});
backend/src/services/secret/secret-fns.ts
+47
View File
@@ -887,3 +887,50 @@ export const updateManySecretsRawFnFactory = ({
return updateManySecretsRawFn;
};
export const decryptSecretWithBot = (
secret: Pick<
TSecrets,
| "secretKeyIV"
| "secretKeyTag"
| "secretKeyCiphertext"
| "secretValueIV"
| "secretValueTag"
| "secretValueCiphertext"
| "secretCommentIV"
| "secretCommentTag"
| "secretCommentCiphertext"
>,
key: string
) => {
const secretKey = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secret.secretKeyCiphertext,
iv: secret.secretKeyIV,
tag: secret.secretKeyTag,
key
});
const secretValue = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secret.secretValueCiphertext,
iv: secret.secretValueIV,
tag: secret.secretValueTag,
key
});
let secretComment = "";
if (secret.secretCommentCiphertext && secret.secretCommentIV && secret.secretCommentTag) {
secretComment = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secret.secretCommentCiphertext,
iv: secret.secretCommentIV,
tag: secret.secretCommentTag,
key
});
}
return {
secretKey,
secretValue,
secretComment
};
};
backend/src/services/secret/secret-service.ts
+348 -60
View File
@@ -73,6 +73,7 @@ import {
} from "./secret-types";
import { TSecretVersionDALFactory } from "./secret-version-dal";
import { TSecretVersionTagDALFactory } from "./secret-version-tag-dal";
import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
type TSecretServiceFactoryDep = {
secretDAL: TSecretDALFactory;
@@ -93,6 +94,10 @@ type TSecretServiceFactoryDep = {
secretImportDAL: Pick<TSecretImportDALFactory, "find" | "findByFolderIds">;
secretVersionTagDAL: Pick<TSecretVersionTagDALFactory, "insertMany">;
secretApprovalPolicyService: Pick<TSecretApprovalPolicyServiceFactory, "getSecretApprovalPolicy">;
secretApprovalRequestService: Pick<
TSecretApprovalRequestServiceFactory,
"generateSecretApprovalRequest" | "generateSecretApprovalRequestV2Bridge"
>;
secretApprovalRequestDAL: Pick<TSecretApprovalRequestDALFactory, "create" | "transaction">;
secretApprovalRequestSecretDAL: Pick<
TSecretApprovalRequestSecretDALFactory,
@@ -118,7 +123,8 @@ export const secretServiceFactory = ({
secretApprovalPolicyService,
secretApprovalRequestDAL,
secretApprovalRequestSecretDAL,
secretV2BridgeService
secretV2BridgeService,
secretApprovalRequestService
}: TSecretServiceFactoryDep) => {
const getSecretReference = async (projectId: string) => {
// if bot key missing means e2e still exist
@@ -1216,7 +1222,37 @@ export const secretServiceFactory = ({
secretReminderRepeatDays
}: TCreateSecretRawDTO) => {
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER && type === SecretType.Shared
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Create]: [
{
secretKey: secretName,
skipMultilineEncoding,
secretComment,
secretValue,
tagIds,
reminderNote: secretReminderNote,
reminderRepeatDays: secretReminderRepeatDays
}
]
}
});
}
const secret = await secretV2BridgeService.createSecret({
secretName,
type,
@@ -1241,6 +1277,36 @@ export const secretServiceFactory = ({
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretName, botKey);
const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey);
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Create]: [
{
secretName,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag,
skipMultilineEncoding,
tagIds
}
]
}
});
}
const secret = await createSecret({
secretName,
@@ -1290,7 +1356,37 @@ export const secretServiceFactory = ({
newSecretName
}: TUpdateSecretRawDTO) => {
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER && type === SecretType.Shared
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Update]: [
{
secretKey: secretName,
newSecretName,
skipMultilineEncoding,
secretComment,
secretValue,
tagIds,
reminderNote: secretReminderNote,
reminderRepeatDays: secretReminderRepeatDays
}
]
}
});
}
const secret = await secretV2BridgeService.updateSecret({
secretReminderRepeatDays,
skipMultilineEncoding,
@@ -1319,6 +1415,40 @@ export const secretServiceFactory = ({
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretName, botKey);
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Update]: [
{
secretName,
newSecretName,
skipMultilineEncoding,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag,
tagIds,
secretReminderNote,
secretReminderRepeatDays
}
]
}
});
}
const secret = await updateSecret({
secretName,
projectId,
@@ -1362,7 +1492,30 @@ export const secretServiceFactory = ({
secretPath
}: TDeleteSecretRawDTO) => {
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER && type === SecretType.Shared
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
actorAuthMethod,
actorOrgId,
actorId,
actor,
projectId,
environment,
secretPath,
data: {
[SecretOperations.Delete]: [
{
secretKey: secretName
}
]
}
});
}
const secret = await secretV2BridgeService.deleteSecret({
secretName,
type,
@@ -1377,7 +1530,25 @@ export const secretServiceFactory = ({
return secret;
}
if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" });
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
actorAuthMethod,
actorOrgId,
actorId,
actor,
projectId,
environment,
secretPath,
data: {
[SecretOperations.Delete]: [
{
secretName
}
]
}
});
}
const secret = await deleteSecret({
secretName,
projectId,
@@ -1416,7 +1587,33 @@ export const secretServiceFactory = ({
}
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Create]: inputSecrets.map((el) => ({
tagIds: el.tagIds,
secretValue: el.secretValue,
secretComment: el.secretComment,
metadata: el.metadata,
skipMultilineEncoding: el.skipMultilineEncoding,
secretKey: el.secretKey
}))
}
});
}
const secrets = await secretV2BridgeService.createManySecret({
secretPath,
environment,
@@ -1430,7 +1627,44 @@ export const secretServiceFactory = ({
return secrets;
}
if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" });
const sanitizedSecrets = inputSecrets.map(
({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => {
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey);
const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey);
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
return {
secretName: secretKey,
skipMultilineEncoding,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag,
tags: tagIds,
tagIds,
metadata
};
}
);
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Create]: sanitizedSecrets
}
});
}
const secrets = await createManySecret({
projectId,
environment,
@@ -1439,28 +1673,7 @@ export const secretServiceFactory = ({
actorId,
actorOrgId,
actorAuthMethod,
secrets: inputSecrets.map(
({ secretComment, secretKey, metadata, tagIds, secretValue, skipMultilineEncoding }) => {
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(secretKey, botKey);
const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey);
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
return {
secretName: secretKey,
skipMultilineEncoding,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag,
tags: tagIds,
metadata
};
}
)
secrets: sanitizedSecrets
});
return secrets.map((secret) =>
@@ -1490,7 +1703,32 @@ export const secretServiceFactory = ({
}
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Update]: inputSecrets.map((el) => ({
tagIds: el.tagIds,
secretValue: el.secretValue,
secretComment: el.secretComment,
skipMultilineEncoding: el.skipMultilineEncoding,
secretKey: el.secretKey
}))
}
});
}
const secrets = await secretV2BridgeService.updateManySecret({
secretPath,
environment,
@@ -1505,7 +1743,56 @@ export const secretServiceFactory = ({
}
if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" });
const sanitizedSecrets = inputSecrets.map(
({
secretComment,
secretKey,
secretValue,
skipMultilineEncoding,
tagIds: tags,
newSecretName,
secretReminderNote,
secretReminderRepeatDays
}) => {
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretKey, botKey);
const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey);
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
return {
secretName: secretKey,
newSecretName,
tags,
tagIds: tags,
secretReminderRepeatDays,
secretReminderNote,
type: SecretType.Shared,
skipMultilineEncoding,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag
};
}
);
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
secretPath,
environment,
projectId,
actor,
actorId,
actorOrgId,
actorAuthMethod,
data: {
[SecretOperations.Update]: sanitizedSecrets
}
});
}
const secrets = await updateManySecret({
projectId,
environment,
@@ -1514,40 +1801,7 @@ export const secretServiceFactory = ({
actorId,
actorOrgId,
actorAuthMethod,
secrets: inputSecrets.map(
({
secretComment,
secretKey,
secretValue,
skipMultilineEncoding,
tagIds: tags,
newSecretName,
secretReminderNote,
secretReminderRepeatDays
}) => {
const secretKeyEncrypted = encryptSymmetric128BitHexKeyUTF8(newSecretName || secretKey, botKey);
const secretValueEncrypted = encryptSymmetric128BitHexKeyUTF8(secretValue || "", botKey);
const secretCommentEncrypted = encryptSymmetric128BitHexKeyUTF8(secretComment || "", botKey);
return {
secretName: secretKey,
newSecretName,
tags,
secretReminderRepeatDays,
secretReminderNote,
type: SecretType.Shared,
skipMultilineEncoding,
secretKeyCiphertext: secretKeyEncrypted.ciphertext,
secretKeyIV: secretKeyEncrypted.iv,
secretKeyTag: secretKeyEncrypted.tag,
secretValueCiphertext: secretValueEncrypted.ciphertext,
secretValueIV: secretValueEncrypted.iv,
secretValueTag: secretValueEncrypted.tag,
secretCommentCiphertext: secretCommentEncrypted.ciphertext,
secretCommentIV: secretCommentEncrypted.iv,
secretCommentTag: secretCommentEncrypted.tag
};
}
)
secrets: sanitizedSecrets
});
return secrets.map((secret) =>
@@ -1577,7 +1831,26 @@ export const secretServiceFactory = ({
}
const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
const policy =
actor === ActorType.USER
? await secretApprovalPolicyService.getSecretApprovalPolicy(projectId, environment, secretPath)
: undefined;
if (shouldUseSecretV2Bridge) {
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequestV2Bridge({
policy,
actorAuthMethod,
actorOrgId,
actorId,
actor,
projectId,
environment,
secretPath,
data: {
[SecretOperations.Delete]: inputSecrets
}
});
}
const secrets = await secretV2BridgeService.deleteManySecret({
secretPath,
environment,
@@ -1593,6 +1866,21 @@ export const secretServiceFactory = ({
if (!botKey) throw new BadRequestError({ message: "Project bot not found", name: "bot_not_found_error" });
if (policy) {
return secretApprovalRequestService.generateSecretApprovalRequest({
policy,
actorAuthMethod,
actorOrgId,
actorId,
actor,
projectId,
environment,
secretPath,
data: {
[SecretOperations.Delete]: inputSecrets.map((el) => ({ secretName: el.secretKey }))
}
});
}
const secrets = await deleteManySecret({
projectId,
environment,