awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 22:51:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ghost user!

Browse Source
This commit is contained in:
Daniel Hougaard
2024-02-22 04:59:11 +01:00
parent 80a802386c
commit fe21ba0e54
16 changed files with 332 additions and 125 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/v3/index.ts
+2
View File
@@ -1,4 +1,5 @@
import { registerLoginRouter } from "./login-router";
import { registerProjectRouter } from "./project-router";
import { registerSecretBlindIndexRouter } from "./secret-blind-index-router";
import { registerSecretRouter } from "./secret-router";
import { registerSignupRouter } from "./signup-router";
@@ -10,4 +11,5 @@ export const registerV3Routes = async (server: FastifyZodProvider) => {
await server.register(registerUserRouter, { prefix: "/users" });
await server.register(registerSecretRouter, { prefix: "/secrets" });
await server.register(registerSecretBlindIndexRouter, { prefix: "/workspaces" });
await server.register(registerProjectRouter, { prefix: "/projects" });
};
backend/src/server/routes/v3/project-router.ts
+126
View File
@@ -0,0 +1,126 @@
import crypto from "crypto";
import { z } from "zod";
import { ProjectMembershipRole, ProjectsSchema } from "@app/db/schemas";
import { encryptAsymmetric } from "@app/lib/crypto";
import { createWsMembers } from "@app/lib/project";
import { authRateLimit } from "@app/server/config/rateLimiter";
const projectWithEnv = ProjectsSchema.merge(
z.object({
_id: z.string(),
environments: z.object({ name: z.string(), slug: z.string(), id: z.string() }).array()
})
);
export const registerProjectRouter = async (server: FastifyZodProvider) => {
/* Create new project */
server.route({
method: "POST",
url: "/",
config: {
rateLimit: authRateLimit
},
schema: {
body: z.object({
projectName: z.string().trim(),
inviteAllOrgMembers: z.boolean(),
organizationId: z.string().trim()
}),
response: {
200: z.object({
workspace: projectWithEnv
})
}
},
handler: async (req) => {
// 1. create the ghost user and add it to the org as admin
const ghost = await server.services.org.addGhostUser(req.body.organizationId);
// 2. create the workspace
const workspace = await server.services.project.createProject({
actorId: ghost.user.id,
actor: req.permission.type,
orgId: req.body.organizationId,
workspaceName: req.body.projectName
});
// 3. create a random key that we'll use as the project key
const randomBytes = crypto.randomBytes(16).toString("hex");
const ghostPrivateKey = ghost.keys.plainPrivateKey;
const { ciphertext: encryptedProjectKey, nonce: encryptedProjectKeyIv } = encryptAsymmetric(
randomBytes,
ghost.keys.publicKey,
ghostPrivateKey
);
// 3. create workspace keys for the ghost user
await server.services.projectKey.uploadProjectKeys({
projectId: workspace.id,
actor: req.permission.type,
actorId: ghost.user.id,
nonce: encryptedProjectKeyIv,
receiverId: ghost.user.id,
encryptedKey: encryptedProjectKey
});
// 4. create a project bot
const bot = await server.services.projectBot.findBotByProjectId({
actorId: ghost.user.id,
actor: req.permission.type,
projectId: workspace.id
});
// 5. activate the bot
await server.services.projectBot.setBotActiveState({
botKey: {
encryptedKey: encryptedProjectKey,
nonce: encryptedProjectKeyIv
},
actorId: ghost.user.id,
isActive: true,
actor: req.permission.type,
botId: bot.id
});
// 6. get the current user & org membership
const user = await server.services.user.getMe(req.permission.id);
const userOrgMembership = await server.services.permission.getUserOrgPermission(user.id, req.body.organizationId);
// 7. Get the latest key from the ghost!
const latestKey = await server.services.projectKey.getLatestProjectKey({
actorId: ghost.user.id,
actor: req.permission.type,
projectId: workspace.id
});
if (!latestKey) throw new Error("Failed to get latest key");
// 8. Create workspace members for the current user
const projectAdmin = await createWsMembers({
decryptKey: latestKey,
members: [
{
userPublicKey: user.publicKey,
orgMembershipId: userOrgMembership.membership.id,
projectMembershipRole: ProjectMembershipRole.Admin // <-- Make the first user an admin
}
],
userPrivateKey: ghostPrivateKey
});
// 9. Add the current user to the workspace
await server.services.projectMembership.addUsersToProject({
projectId: workspace.id,
actorId: ghost.user.id,
actor: req.permission.type,
members: projectAdmin
});
return { workspace };
}
});
};
backend/src/services/auth/auth-login-service.ts
+1 -1
View File
@@ -275,7 +275,7 @@ export const authLoginServiceFactory = ({ userDAL, tokenService, smtpService }:
if (isOauthSignUpDisabled) throw new BadRequestError({ message: "User signup disabled", name: "Oauth 2 login" });
if (!user) {
user = await userDAL.create({ email, firstName, lastName, authMethods: [authMethod] });
user = await userDAL.create({ email, firstName, lastName, authMethods: [authMethod], ghost: false });
}
const isLinkingRequired = !user?.authMethods?.includes(authMethod);
const isUserCompleted = user.isAccepted;
backend/src/services/org/org-dal.ts
+41 -1
View File
@@ -76,7 +76,8 @@ export const orgDALFactory = (db: TDbClient) => {
db.ref("lastName").withSchema(TableName.Users),
db.ref("id").withSchema(TableName.Users).as("userId"),
db.ref("publicKey").withSchema(TableName.UserEncryptionKey)
);
)
.where({ ghost: false }); // MAKE SURE USER IS NOT A GHOST USER
return members.map(({ email, firstName, lastName, userId, publicKey, ...data }) => ({
...data,
user: { email, firstName, lastName, id: userId, publicKey }
@@ -86,6 +87,43 @@ export const orgDALFactory = (db: TDbClient) => {
}
};
const findOrgGhostUser = async (orgId: string) => {
try {
const [member] = await db(TableName.OrgMembership)
.where({ orgId })
.join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`)
.leftJoin(TableName.UserEncryptionKey, `${TableName.UserEncryptionKey}.userId`, `${TableName.Users}.id`)
.select(
db.ref("id").withSchema(TableName.OrgMembership),
db.ref("orgId").withSchema(TableName.OrgMembership),
db.ref("role").withSchema(TableName.OrgMembership),
db.ref("roleId").withSchema(TableName.OrgMembership),
db.ref("status").withSchema(TableName.OrgMembership),
db.ref("email").withSchema(TableName.Users),
db.ref("id").withSchema(TableName.Users).as("userId"),
db.ref("publicKey").withSchema(TableName.UserEncryptionKey)
)
.where({ ghost: true });
return member;
} catch (error) {
return null;
}
};
const ghostUserExists = async (orgId: string) => {
try {
const [member] = await db(TableName.OrgMembership)
.where({ orgId })
.join(TableName.Users, `${TableName.OrgMembership}.userId`, `${TableName.Users}.id`)
.leftJoin(TableName.UserEncryptionKey, `${TableName.UserEncryptionKey}.userId`, `${TableName.Users}.id`)
.select(db.ref("id").withSchema(TableName.Users).as("userId"))
.where({ ghost: true });
return !!member;
} catch (error) {
return false;
}
};
const create = async (dto: TOrganizationsInsert, tx?: Knex) => {
try {
const [organization] = await (tx || db)(TableName.Organization).insert(dto).returning("*");
@@ -191,6 +229,8 @@ export const orgDALFactory = (db: TDbClient) => {
findAllOrgMembers,
findOrgById,
findAllOrgsByUserId,
ghostUserExists,
findOrgGhostUser,
create,
updateById,
deleteById,
backend/src/services/org/org-service.ts
+48 -1
View File
@@ -1,5 +1,6 @@
import { ForbiddenError } from "@casl/ability";
import slugify from "@sindresorhus/slugify";
import crypto from "crypto";
import jwt from "jsonwebtoken";
import { OrgMembershipRole, OrgMembershipStatus } from "@app/db/schemas";
@@ -11,6 +12,7 @@ import { TSamlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-
import { getConfig } from "@app/lib/config/env";
import { generateAsymmetricKeyPair } from "@app/lib/crypto";
import { generateSymmetricKey, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
import { generateUserSrpKeys } from "@app/lib/crypto/srp";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";
import { isDisposableEmail } from "@app/lib/validator";
@@ -118,6 +120,49 @@ export const orgServiceFactory = ({
return workspaces.filter((workspace) => organizationWorkspaceIds.has(workspace.id));
};
const addGhostUser = async (orgId: string) => {
const email = `ghost@${orgId}.com`;
const password = crypto.randomBytes(128).toString("hex");
const user = await userDAL.create({
ghost: true,
authMethods: [AuthMethod.EMAIL],
email: `ghost@${orgId}.com`,
isAccepted: true
});
const encKeys = await generateUserSrpKeys(email, password);
await userDAL.upsertUserEncryptionKey(user.id, {
encryptionVersion: 2,
protectedKey: encKeys.protectedKey,
protectedKeyIV: encKeys.protectedKeyIV,
protectedKeyTag: encKeys.protectedKeyTag,
publicKey: encKeys.publicKey,
encryptedPrivateKey: encKeys.encryptedPrivateKey,
iv: encKeys.encryptedPrivateKeyIV,
tag: encKeys.encryptedPrivateKeyTag,
salt: encKeys.salt,
verifier: encKeys.verifier
});
const createMembershipData = {
orgId,
userId: user.id,
role: OrgMembershipRole.Admin,
status: OrgMembershipStatus.Accepted
};
console.log("createMembershipData", createMembershipData);
await orgDAL.createMembership(createMembershipData);
return {
user,
keys: encKeys
};
};
/*
* Update organization details
* */
@@ -338,7 +383,8 @@ export const orgServiceFactory = ({
{
email: inviteeEmail,
isAccepted: false,
authMethods: [AuthMethod.EMAIL]
authMethods: [AuthMethod.EMAIL],
ghost: false
},
tx
);
@@ -491,6 +537,7 @@ export const orgServiceFactory = ({
deleteOrganizationById,
deleteOrgMembership,
findAllWorkspaces,
addGhostUser,
updateOrgMembership,
// incident contacts
findIncidentContacts,
backend/src/services/project-bot/project-bot-service.ts
+35 -43
View File
@@ -1,4 +1,5 @@
import { ForbiddenError } from "@casl/ability";
import { Knex } from "knex";
import { SecretEncryptionAlgo, SecretKeyEncoding } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -6,17 +7,16 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services
import { getConfig } from "@app/lib/config/env";
import {
decryptAsymmetric,
decryptSymmetric,
decryptSymmetric128BitHexKeyUTF8,
encryptSymmetric,
encryptSymmetric128BitHexKeyUTF8,
generateAsymmetricKeyPair
} from "@app/lib/crypto";
import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
import { BadRequestError } from "@app/lib/errors";
import { TProjectPermission } from "@app/lib/types";
import { TProjectBotDALFactory } from "./project-bot-dal";
import { TSetActiveStateDTO } from "./project-bot-types";
import { TGetPrivateKeyDTO, TSetActiveStateDTO } from "./project-bot-types";
type TProjectBotServiceFactoryDep = {
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
@@ -26,48 +26,35 @@ type TProjectBotServiceFactoryDep = {
export type TProjectBotServiceFactory = ReturnType<typeof projectBotServiceFactory>;
export const projectBotServiceFactory = ({ projectBotDAL, permissionService }: TProjectBotServiceFactoryDep) => {
const getBotKey = async (projectId: string) => {
const appCfg = getConfig();
const encryptionKey = appCfg.ENCRYPTION_KEY;
const rootEncryptionKey = appCfg.ROOT_ENCRYPTION_KEY;
const getBotPrivateKey = async ({ encoding, nonce, tag, encryptedPrivateKey }: TGetPrivateKeyDTO) =>
infisicalSymmetricDecrypt({
keyEncoding: encoding,
iv: nonce,
tag,
ciphertext: encryptedPrivateKey
});
const getBotKey = async (projectId: string) => {
const bot = await projectBotDAL.findOne({ projectId });
if (!bot) throw new BadRequestError({ message: "failed to find bot key" });
if (!bot.isActive) throw new BadRequestError({ message: "Bot is not active" });
if (!bot.encryptedProjectKeyNonce || !bot.encryptedProjectKey)
throw new BadRequestError({ message: "Encryption key missing" });
if (rootEncryptionKey && (bot.keyEncoding as SecretKeyEncoding) === SecretKeyEncoding.BASE64) {
const privateKeyBot = decryptSymmetric({
iv: bot.iv,
tag: bot.tag,
ciphertext: bot.encryptedPrivateKey,
key: rootEncryptionKey
});
return decryptAsymmetric({
ciphertext: bot.encryptedProjectKey,
privateKey: privateKeyBot,
nonce: bot.encryptedProjectKeyNonce,
publicKey: bot.sender.publicKey
});
}
if (encryptionKey && (bot.keyEncoding as SecretKeyEncoding) === SecretKeyEncoding.UTF8) {
const privateKeyBot = decryptSymmetric128BitHexKeyUTF8({
iv: bot.iv,
tag: bot.tag,
ciphertext: bot.encryptedPrivateKey,
key: encryptionKey
});
return decryptAsymmetric({
ciphertext: bot.encryptedProjectKey,
privateKey: privateKeyBot,
nonce: bot.encryptedProjectKeyNonce,
publicKey: bot.sender.publicKey
});
}
const privateKeyBot = await getBotPrivateKey({
nonce: bot.iv,
tag: bot.tag,
encryptedPrivateKey: bot.encryptedPrivateKey,
encoding: bot.keyEncoding as SecretKeyEncoding
});
throw new BadRequestError({
message: "Failed to obtain bot copy of workspace key needed for operation"
console.log("privateKeyBot", privateKeyBot);
return decryptAsymmetric({
ciphertext: bot.encryptedProjectKey,
privateKey: privateKeyBot,
nonce: bot.encryptedProjectKeyNonce,
publicKey: bot.sender.publicKey
});
};
@@ -131,12 +118,16 @@ export const projectBotServiceFactory = ({ projectBotDAL, permissionService }: T
if (!botKey?.nonce || !botKey?.encryptedKey) {
throw new BadRequestError({ message: "Failed to set bot active - missing bot key" });
}
const doc = await projectBotDAL.updateById(botId, {
isActive: true,
encryptedProjectKey: botKey.encryptedKey,
encryptedProjectKeyNonce: botKey.nonce,
senderId: actorId
});
const doc = await projectBotDAL.updateById(
botId,
{
isActive: true,
encryptedProjectKey: botKey.encryptedKey,
encryptedProjectKeyNonce: botKey.nonce,
senderId: actorId
},
tx
);
if (!doc) throw new BadRequestError({ message: "Failed to update bot active state" });
return doc;
}
@@ -153,6 +144,7 @@ export const projectBotServiceFactory = ({ projectBotDAL, permissionService }: T
return {
findBotByProjectId,
setBotActiveState,
getBotPrivateKey,
getBotKey
};
};
backend/src/services/project-bot/project-bot-types.ts
+8
View File
@@ -1,3 +1,4 @@
import { SecretKeyEncoding } from "@app/db/schemas";
import { TProjectPermission } from "@app/lib/types";
export type TSetActiveStateDTO = {
@@ -8,3 +9,10 @@ export type TSetActiveStateDTO = {
};
botId: string;
} & Omit<TProjectPermission, "projectId">;
export type TGetPrivateKeyDTO = {
encoding: SecretKeyEncoding;
nonce: string;
tag: string;
encryptedPrivateKey: string;
};
backend/src/services/project-key/project-key-service.ts
+2 -1
View File
@@ -1,4 +1,5 @@
import { ForbiddenError } from "@casl/ability";
import { Knex } from "knex";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -43,7 +44,7 @@ export const projectKeyServiceFactory = ({
name: "Upload project keys"
});
await projectKeyDAL.create({ projectId, receiverId, encryptedKey, nonce, senderId: actorId });
await projectKeyDAL.create({ projectId, receiverId, encryptedKey, nonce, senderId: actorId }, tx);
};
const getLatestProjectKey = async ({ actorId, projectId, actor, actorOrgId }: TGetLatestProjectKeyDTO) => {
backend/src/services/project-membership/project-membership-dal.ts
+3 -2
View File
@@ -24,15 +24,16 @@ export const projectMembershipDALFactory = (db: TDbClient) => {
db.ref("projectId").withSchema(TableName.ProjectMembership),
db.ref("role").withSchema(TableName.ProjectMembership),
db.ref("roleId").withSchema(TableName.ProjectMembership),
db.ref("ghost").withSchema(TableName.Users),
db.ref("email").withSchema(TableName.Users),
db.ref("publicKey").withSchema(TableName.UserEncryptionKey),
db.ref("firstName").withSchema(TableName.Users),
db.ref("lastName").withSchema(TableName.Users),
db.ref("id").withSchema(TableName.Users).as("userId")
);
return members.map(({ email, firstName, lastName, publicKey, ...data }) => ({
return members.map(({ email, firstName, lastName, publicKey, ghost, ...data }) => ({
...data,
user: { email, firstName, lastName, id: data.userId, publicKey }
user: { email, firstName, lastName, id: data.userId, publicKey, ghost }
}));
} catch (error) {
throw new DatabaseError({ error, name: "Find all project members" });
backend/src/services/project-membership/project-membership-service.ts
+10 -5
View File
@@ -134,11 +134,16 @@ export const projectMembershipServiceFactory = ({
await projectMembershipDAL.transaction(async (tx) => {
await projectMembershipDAL.insertMany(
orgMembers.map(({ userId }) => ({
projectId,
userId: userId as string,
role: ProjectMembershipRole.Member
})),
orgMembers.map(({ userId, id: membershipId }) => {
const role =
members.find((i) => i.orgMembershipId === membershipId)?.projectRole || ProjectMembershipRole.Member;
return {
projectId,
userId: userId as string,
role
};
}),
tx
);
const encKeyGroupByOrgMembId = groupBy(members, (i) => i.orgMembershipId);
backend/src/services/project-membership/project-membership-types.ts
+2
View File
@@ -1,3 +1,4 @@
import { ProjectMembershipRole } from "@app/db/schemas";
import { TProjectPermission } from "@app/lib/types";
export type TGetProjectMembershipDTO = TProjectPermission;
@@ -20,5 +21,6 @@ export type TAddUsersToWorkspaceDTO = {
orgMembershipId: string;
workspaceEncryptedKey: string;
workspaceEncryptedNonce: string;
projectRole: ProjectMembershipRole;
}[];
} & TProjectPermission;
backend/src/services/project/project-service.ts
+8 -2
View File
@@ -66,10 +66,15 @@ export const projectServiceFactory = ({
const newProject = projectDAL.transaction(async (tx) => {
const project = await projectDAL.create(
{ name: workspaceName, orgId, slug: slugify(`${workspaceName}-${alphaNumericNanoId(4)}`) },
{
name: workspaceName,
orgId,
slug: slugify(`${workspaceName}-${alphaNumericNanoId(4)}`),
e2ee: false
},
tx
);
// set user as admin member for proeject
// set user as admin member for project
await projectMembershipDAL.create(
{
userId: actorId,
@@ -78,6 +83,7 @@ export const projectServiceFactory = ({
},
tx
);
// generate the blind index for project
await secretBlindIndexDAL.create(
{