awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 22:51:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(kms): audit logs for sign/verify

Browse Source
This commit is contained in:
Daniel Hougaard
2025-04-03 09:30:51 +04:00
parent fda77fe464
commit fe172e39bf
4 changed files with 127 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/v1/cmek-router.ts
+75 -8
View File
@@ -433,6 +433,17 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const publicKey = await server.services.cmek.getPublicKey({ keyId }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_GET_PUBLIC_KEY,
metadata: {
keyId
}
}
});
return publicKey;
}
});
@@ -454,13 +465,23 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const result = await server.services.cmek.listSigningAlgorithms(
{
keyId: req.params.keyId
},
req.permission
);
const { keyId } = req.params;
const result = await server.services.cmek.listSigningAlgorithms({ keyId }, req.permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.CMEK_LIST_SIGNING_ALGORITHMS,
metadata: {
keyId
}
}
});
return result;
}
});
@@ -508,6 +529,18 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const result = await server.services.cmek.cmekSign({ keyId: inputKeyId, data, signingAlgorithm }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_SIGN,
metadata: {
keyId: inputKeyId,
signingAlgorithm,
signature: result.signature
}
}
});
return result;
}
});
@@ -524,8 +557,28 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
keyId: z.string().uuid().describe(KMS.VERIFY.keyId)
}),
body: z.object({
data: z.string().describe(KMS.VERIFY.data),
signature: z.string().describe(KMS.VERIFY.signature),
data: z
.string()
.superRefine((data, ctx) => {
if (!isBase64(data)) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message: "data must be base64 encoded"
});
}
})
.describe(KMS.VERIFY.data),
signature: z
.string()
.superRefine((data, ctx) => {
if (!isBase64(data)) {
ctx.addIssue({
code: z.ZodIssueCode.custom,
message: "signature must be base64 encoded"
});
}
})
.describe(KMS.VERIFY.signature),
signingAlgorithm: z.nativeEnum(SigningAlgorithm)
}),
response: {
@@ -546,6 +599,20 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
const result = await server.services.cmek.cmekVerify({ keyId, data, signature, signingAlgorithm }, permission);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: permission.orgId,
event: {
type: EventType.CMEK_VERIFY,
metadata: {
keyId,
signatureValid: result.signatureValid,
signingAlgorithm,
signature
}
}
});
return result;
}
});