awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kms): audit logs for sign/verify

Browse Source
This commit is contained in:
Daniel Hougaard
2025-04-03 09:30:51 +04:00
parent fda77fe464
commit fe172e39bf
4 changed files with 127 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -1,3 +1,5 @@
import { SigningAlgorithm } from "aws-sdk/clients/acmpca";
import {
TCreateProjectTemplateDTO,
TUpdateProjectTemplateDTO
@@ -240,6 +242,11 @@ export enum EventType {
GET_CMEK = "get-cmek",
CMEK_ENCRYPT = "cmek-encrypt",
CMEK_DECRYPT = "cmek-decrypt",
CMEK_SIGN = "cmek-sign",
CMEK_VERIFY = "cmek-verify",
CMEK_LIST_SIGNING_ALGORITHMS = "cmek-list-signing-algorithms",
CMEK_GET_PUBLIC_KEY = "cmek-get-public-key",
UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "get-external-group-org-role-mapping",
GET_PROJECT_TEMPLATES = "get-project-templates",
@@ -1946,6 +1953,39 @@ interface CmekDecryptEvent {
};
}
interface CmekSignEvent {
type: EventType.CMEK_SIGN;
metadata: {
keyId: string;
signingAlgorithm: SigningAlgorithm;
signature: string;
};
}
interface CmekVerifyEvent {
type: EventType.CMEK_VERIFY;
metadata: {
keyId: string;
signingAlgorithm: SigningAlgorithm;
signature: string;
signatureValid: boolean;
};
}
interface CmekListSigningAlgorithmsEvent {
type: EventType.CMEK_LIST_SIGNING_ALGORITHMS;
metadata: {
keyId: string;
};
}
interface CmekGetPublicKeyEvent {
type: EventType.CMEK_GET_PUBLIC_KEY;
metadata: {
keyId: string;
};
}
interface GetExternalGroupOrgRoleMappingsEvent {
type: EventType.GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS;
metadata?: Record<string, never>; // not needed, based off orgId
@@ -2468,6 +2508,10 @@ export type Event =
| GetCmeksEvent
| CmekEncryptEvent
| CmekDecryptEvent
| CmekSignEvent
| CmekVerifyEvent
| CmekListSigningAlgorithmsEvent
| CmekGetPublicKeyEvent
| GetExternalGroupOrgRoleMappingsEvent
| UpdateExternalGroupOrgRoleMappingsEvent
| GetProjectTemplatesEvent

83
backend/src/server/routes/v1/cmek-router.ts
View File

@@ -433,6 +433,17 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const publicKey = await server.services.cmek.getPublicKey({ keyId }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_GET_PUBLIC_KEY,
metadata: {
keyId
}
}
});
return publicKey;
}
});
@@ -454,13 +465,23 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const result = await server.services.cmek.listSigningAlgorithms(
{
keyId: req.params.keyId
},
req.permission
);
const { keyId } = req.params;
const result = await server.services.cmek.listSigningAlgorithms({ keyId }, req.permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.CMEK_LIST_SIGNING_ALGORITHMS,
metadata: {
keyId
}
}
});
return result;
}
});
@@ -508,6 +529,18 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const result = await server.services.cmek.cmekSign({ keyId: inputKeyId, data, signingAlgorithm }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_SIGN,
metadata: {
keyId: inputKeyId,
signingAlgorithm,
signature: result.signature
}
}
});
return result;
}
});
@@ -524,8 +557,28 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
keyId: z.string().uuid().describe(KMS.VERIFY.keyId)
}),
body: z.object({
data: z.string().describe(KMS.VERIFY.data),
signature: z.string().describe(KMS.VERIFY.signature),
data: z
.string()
.superRefine((data, ctx) => {
if (!isBase64(data)) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message: "data must be base64 encoded"
});
}
})
.describe(KMS.VERIFY.data),
signature: z
.string()
.superRefine((data, ctx) => {
if (!isBase64(data)) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message: "signature must be base64 encoded"
});
}
})
.describe(KMS.VERIFY.signature),
signingAlgorithm: z.nativeEnum(SigningAlgorithm)
}),
response: {
@@ -546,6 +599,20 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const result = await server.services.cmek.cmekVerify({ keyId, data, signature, signingAlgorithm }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_VERIFY,
metadata: {
keyId,
signatureValid: result.signatureValid,
signingAlgorithm,
signature
}
}
});
return result;
}
});

4
frontend/src/hooks/api/auditLogs/constants.tsx
View File

@@ -106,6 +106,10 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.GET_CMEK]: "Get KMS key",
[EventType.CMEK_ENCRYPT]: "Encrypt with KMS key",
[EventType.CMEK_DECRYPT]: "Decrypt with KMS key",
[EventType.CMEK_SIGN]: "Sign with KMS key",
[EventType.CMEK_VERIFY]: "Verify with KMS key",
[EventType.CMEK_LIST_SIGNING_ALGORITHMS]: "List signing algorithms for KMS key",
[EventType.CMEK_GET_PUBLIC_KEY]: "Get public key for KMS key",
[EventType.UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]:
"Update SSO group to organization role mapping",
[EventType.GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS]: "List SSO group to organization role mapping",

4
frontend/src/hooks/api/auditLogs/enums.tsx
View File

@@ -110,6 +110,10 @@ export enum EventType {
GET_CMEK = "get-cmek",
CMEK_ENCRYPT = "cmek-encrypt",
CMEK_DECRYPT = "cmek-decrypt",
CMEK_SIGN = "cmek-sign",
CMEK_VERIFY = "cmek-verify",
CMEK_LIST_SIGNING_ALGORITHMS = "cmek-list-signing-algorithms",
CMEK_GET_PUBLIC_KEY = "cmek-get-public-key",
UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
GET_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "get-external-group-org-role-mapping",
GET_PROJECT_TEMPLATES = "get-project-templates",