mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-15 20:25:43 +00:00
670 lines
16 KiB
TypeScript
670 lines
16 KiB
TypeScript
import * as Sentry from '@sentry/node';
|
|
import { Types } from 'mongoose';
|
|
import {
|
|
Secret,
|
|
ISecret,
|
|
Membership
|
|
} from '../models';
|
|
import {
|
|
EESecretService,
|
|
EELogService
|
|
} from '../ee/services';
|
|
import {
|
|
IAction
|
|
} from '../ee/models';
|
|
import {
|
|
SECRET_SHARED,
|
|
SECRET_PERSONAL,
|
|
ACTION_ADD_SECRETS,
|
|
ACTION_UPDATE_SECRETS,
|
|
ACTION_DELETE_SECRETS,
|
|
ACTION_READ_SECRETS
|
|
} from '../variables';
|
|
import _ from 'lodash';
|
|
import { BadRequestError, UnauthorizedRequestError } from '../utils/errors';
|
|
|
|
interface V1PushSecret {
|
|
ciphertextKey: string;
|
|
ivKey: string;
|
|
tagKey: string;
|
|
hashKey: string;
|
|
ciphertextValue: string;
|
|
ivValue: string;
|
|
tagValue: string;
|
|
hashValue: string;
|
|
ciphertextComment: string;
|
|
ivComment: string;
|
|
tagComment: string;
|
|
hashComment: string;
|
|
type: 'shared' | 'personal';
|
|
}
|
|
|
|
interface V2PushSecret {
|
|
type: string; // personal or shared
|
|
secretKeyCiphertext: string;
|
|
secretKeyIV: string;
|
|
secretKeyTag: string;
|
|
secretKeyHash: string;
|
|
secretValueCiphertext: string;
|
|
secretValueIV: string;
|
|
secretValueTag: string;
|
|
secretValueHash: string;
|
|
secretCommentCiphertext?: string;
|
|
secretCommentIV?: string;
|
|
secretCommentTag?: string;
|
|
secretCommentHash?: string;
|
|
}
|
|
|
|
interface Update {
|
|
[index: string]: any;
|
|
}
|
|
|
|
/**
|
|
* Push secrets for user with id [userId] to workspace
|
|
* with id [workspaceId] with environment [environment]. Follow steps:
|
|
* 1. Handle shared secrets (insert, delete)
|
|
* 2. handle personal secrets (insert, delete)
|
|
* @param {Object} obj
|
|
* @param {String} obj.userId - id of user to push secrets for
|
|
* @param {String} obj.workspaceId - id of workspace to push to
|
|
* @param {String} obj.environment - environment for secrets
|
|
* @param {Object[]} obj.secrets - secrets to push
|
|
*/
|
|
const v1PushSecrets = async ({
|
|
userId,
|
|
workspaceId,
|
|
environment,
|
|
secrets,
|
|
}: {
|
|
userId: string;
|
|
workspaceId: string;
|
|
environment: string;
|
|
secrets: V1PushSecret[];
|
|
}): Promise<void> => {
|
|
// TODO: clean up function and fix up types
|
|
try {
|
|
// construct useful data structures
|
|
const oldSecrets = await getSecrets({
|
|
userId,
|
|
workspaceId,
|
|
environment
|
|
});
|
|
|
|
const oldSecretsObj: any = oldSecrets.reduce((accumulator, s: any) =>
|
|
({ ...accumulator, [`${s.type}-${s.secretKeyHash}`]: s })
|
|
, {});
|
|
const newSecretsObj: any = secrets.reduce((accumulator, s) =>
|
|
({ ...accumulator, [`${s.type}-${s.hashKey}`]: s })
|
|
, {});
|
|
|
|
// handle deleting secrets
|
|
const toDelete = oldSecrets
|
|
.filter(
|
|
(s: ISecret) => !(`${s.type}-${s.secretKeyHash}` in newSecretsObj)
|
|
)
|
|
.map((s) => s._id);
|
|
if (toDelete.length > 0) {
|
|
await Secret.deleteMany({
|
|
_id: { $in: toDelete }
|
|
});
|
|
|
|
await EESecretService.markDeletedSecretVersions({
|
|
secretIds: toDelete
|
|
});
|
|
}
|
|
|
|
const toUpdate = oldSecrets
|
|
.filter((s) => {
|
|
if (`${s.type}-${s.secretKeyHash}` in newSecretsObj) {
|
|
if (s.secretValueHash !== newSecretsObj[`${s.type}-${s.secretKeyHash}`].hashValue
|
|
|| s.secretCommentHash !== newSecretsObj[`${s.type}-${s.secretKeyHash}`].hashComment) {
|
|
// case: filter secrets where value or comment changed
|
|
return true;
|
|
}
|
|
|
|
if (!s.version) {
|
|
// case: filter (legacy) secrets that were not versioned
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
});
|
|
|
|
const operations = toUpdate
|
|
.map((s) => {
|
|
const {
|
|
ciphertextValue,
|
|
ivValue,
|
|
tagValue,
|
|
hashValue,
|
|
ciphertextComment,
|
|
ivComment,
|
|
tagComment,
|
|
hashComment
|
|
} = newSecretsObj[`${s.type}-${s.secretKeyHash}`];
|
|
|
|
const update: Update = {
|
|
secretValueCiphertext: ciphertextValue,
|
|
secretValueIV: ivValue,
|
|
secretValueTag: tagValue,
|
|
secretValueHash: hashValue,
|
|
secretCommentCiphertext: ciphertextComment,
|
|
secretCommentIV: ivComment,
|
|
secretCommentTag: tagComment,
|
|
secretCommentHash: hashComment,
|
|
}
|
|
|
|
if (!s.version) {
|
|
// case: (legacy) secret was not versioned
|
|
update.version = 1;
|
|
} else {
|
|
update['$inc'] = {
|
|
version: 1
|
|
}
|
|
}
|
|
|
|
if (s.type === SECRET_PERSONAL) {
|
|
// attach user associated with the personal secret
|
|
update['user'] = userId;
|
|
}
|
|
|
|
return {
|
|
updateOne: {
|
|
filter: {
|
|
_id: oldSecretsObj[`${s.type}-${s.secretKeyHash}`]._id
|
|
},
|
|
update
|
|
}
|
|
};
|
|
});
|
|
await Secret.bulkWrite(operations as any);
|
|
|
|
// (EE) add secret versions for updated secrets
|
|
await EESecretService.addSecretVersions({
|
|
secretVersions: toUpdate.map(({
|
|
_id,
|
|
version,
|
|
type,
|
|
secretKeyHash,
|
|
}) => {
|
|
const newSecret = newSecretsObj[`${type}-${secretKeyHash}`];
|
|
return ({
|
|
_id: new Types.ObjectId(),
|
|
secret: _id,
|
|
version: version ? version + 1 : 1,
|
|
workspace: new Types.ObjectId(workspaceId),
|
|
type: newSecret.type,
|
|
user: new Types.ObjectId(userId),
|
|
environment,
|
|
isDeleted: false,
|
|
secretKeyCiphertext: newSecret.ciphertextKey,
|
|
secretKeyIV: newSecret.ivKey,
|
|
secretKeyTag: newSecret.tagKey,
|
|
secretKeyHash: newSecret.hashKey,
|
|
secretValueCiphertext: newSecret.ciphertextValue,
|
|
secretValueIV: newSecret.ivValue,
|
|
secretValueTag: newSecret.tagValue,
|
|
secretValueHash: newSecret.hashValue
|
|
})
|
|
})
|
|
});
|
|
|
|
// handle adding new secrets
|
|
const toAdd = secrets.filter((s) => !(`${s.type}-${s.hashKey}` in oldSecretsObj));
|
|
|
|
if (toAdd.length > 0) {
|
|
// add secrets
|
|
const newSecrets: ISecret[] = (await Secret.insertMany(
|
|
toAdd.map((s, idx) => {
|
|
const obj: any = {
|
|
version: 1,
|
|
workspace: workspaceId,
|
|
type: toAdd[idx].type,
|
|
environment,
|
|
secretKeyCiphertext: s.ciphertextKey,
|
|
secretKeyIV: s.ivKey,
|
|
secretKeyTag: s.tagKey,
|
|
secretKeyHash: s.hashKey,
|
|
secretValueCiphertext: s.ciphertextValue,
|
|
secretValueIV: s.ivValue,
|
|
secretValueTag: s.tagValue,
|
|
secretValueHash: s.hashValue,
|
|
secretCommentCiphertext: s.ciphertextComment,
|
|
secretCommentIV: s.ivComment,
|
|
secretCommentTag: s.tagComment,
|
|
secretCommentHash: s.hashComment
|
|
};
|
|
|
|
if (toAdd[idx].type === 'personal') {
|
|
obj['user' as keyof typeof obj] = userId;
|
|
}
|
|
|
|
return obj;
|
|
})
|
|
)).map((insertedSecret) => insertedSecret.toObject());
|
|
|
|
// (EE) add secret versions for new secrets
|
|
EESecretService.addSecretVersions({
|
|
secretVersions: newSecrets.map(({
|
|
_id,
|
|
version,
|
|
workspace,
|
|
type,
|
|
user,
|
|
environment,
|
|
secretKeyCiphertext,
|
|
secretKeyIV,
|
|
secretKeyTag,
|
|
secretKeyHash,
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretValueHash
|
|
}) => ({
|
|
_id: new Types.ObjectId(),
|
|
secret: _id,
|
|
version,
|
|
workspace,
|
|
type,
|
|
user,
|
|
environment,
|
|
isDeleted: false,
|
|
secretKeyCiphertext,
|
|
secretKeyIV,
|
|
secretKeyTag,
|
|
secretKeyHash,
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretValueHash
|
|
}))
|
|
});
|
|
}
|
|
|
|
// (EE) take a secret snapshot
|
|
await EESecretService.takeSecretSnapshot({
|
|
workspaceId
|
|
});
|
|
} catch (err) {
|
|
Sentry.setUser(null);
|
|
Sentry.captureException(err);
|
|
throw new Error('Failed to push shared and personal secrets');
|
|
}
|
|
};
|
|
|
|
/**
|
|
* Push secrets for user with id [userId] to workspace
|
|
* with id [workspaceId] with environment [environment]. Follow steps:
|
|
* 1. Handle shared secrets (insert, delete)
|
|
* 2. handle personal secrets (insert, delete)
|
|
* @param {Object} obj
|
|
* @param {String} obj.userId - id of user to push secrets for
|
|
* @param {String} obj.workspaceId - id of workspace to push to
|
|
* @param {String} obj.environment - environment for secrets
|
|
* @param {Object[]} obj.secrets - secrets to push
|
|
* @param {String} obj.channel - channel (web/cli/auto)
|
|
* @param {String} obj.ipAddress - ip address of request to push secrets
|
|
*/
|
|
const v2PushSecrets = async ({
|
|
userId,
|
|
workspaceId,
|
|
environment,
|
|
secrets,
|
|
channel,
|
|
ipAddress
|
|
}: {
|
|
userId: string;
|
|
workspaceId: string;
|
|
environment: string;
|
|
secrets: V2PushSecret[];
|
|
channel: string;
|
|
ipAddress: string;
|
|
}): Promise<void> => {
|
|
// TODO: clean up function and fix up types
|
|
try {
|
|
const actions: IAction[] = [];
|
|
|
|
// construct useful data structures
|
|
const oldSecrets = await getSecrets({
|
|
userId,
|
|
workspaceId,
|
|
environment
|
|
});
|
|
|
|
const oldSecretsObj: any = oldSecrets.reduce((accumulator, s: any) =>
|
|
({ ...accumulator, [`${s.type}-${s.secretKeyHash}`]: s })
|
|
, {});
|
|
const newSecretsObj: any = secrets.reduce((accumulator, s) =>
|
|
({ ...accumulator, [`${s.type}-${s.secretKeyHash}`]: s })
|
|
, {});
|
|
|
|
// handle deleting secrets
|
|
const toDelete = oldSecrets
|
|
.filter(
|
|
(s: ISecret) => !(`${s.type}-${s.secretKeyHash}` in newSecretsObj)
|
|
)
|
|
.map((s) => s._id);
|
|
if (toDelete.length > 0) {
|
|
await Secret.deleteMany({
|
|
_id: { $in: toDelete }
|
|
});
|
|
|
|
await EESecretService.markDeletedSecretVersions({
|
|
secretIds: toDelete
|
|
});
|
|
|
|
const deleteAction = await EELogService.createAction({
|
|
name: ACTION_DELETE_SECRETS,
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(userId),
|
|
secretIds: toDelete
|
|
});
|
|
|
|
deleteAction && actions.push(deleteAction);
|
|
}
|
|
|
|
const toUpdate = oldSecrets
|
|
.filter((s) => {
|
|
if (`${s.type}-${s.secretKeyHash}` in newSecretsObj) {
|
|
if (s.secretValueHash !== newSecretsObj[`${s.type}-${s.secretKeyHash}`].secretValueHash
|
|
|| s.secretCommentHash !== newSecretsObj[`${s.type}-${s.secretKeyHash}`].secretCommentHash) {
|
|
// case: filter secrets where value or comment changed
|
|
return true;
|
|
}
|
|
|
|
if (!s.version) {
|
|
// case: filter (legacy) secrets that were not versioned
|
|
return true;
|
|
}
|
|
}
|
|
|
|
return false;
|
|
});
|
|
|
|
if (toUpdate.length > 0) {
|
|
const operations = toUpdate
|
|
.map((s) => {
|
|
const {
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretValueHash,
|
|
secretCommentCiphertext,
|
|
secretCommentIV,
|
|
secretCommentTag,
|
|
secretCommentHash,
|
|
} = newSecretsObj[`${s.type}-${s.secretKeyHash}`];
|
|
|
|
const update: Update = {
|
|
secretValueCiphertext,
|
|
secretValueIV,
|
|
secretValueTag,
|
|
secretValueHash,
|
|
secretCommentCiphertext,
|
|
secretCommentIV,
|
|
secretCommentTag,
|
|
secretCommentHash,
|
|
}
|
|
|
|
if (!s.version) {
|
|
// case: (legacy) secret was not versioned
|
|
update.version = 1;
|
|
} else {
|
|
update['$inc'] = {
|
|
version: 1
|
|
}
|
|
}
|
|
|
|
if (s.type === SECRET_PERSONAL) {
|
|
// attach user associated with the personal secret
|
|
update['user'] = userId;
|
|
}
|
|
|
|
return {
|
|
updateOne: {
|
|
filter: {
|
|
_id: oldSecretsObj[`${s.type}-${s.secretKeyHash}`]._id
|
|
},
|
|
update
|
|
}
|
|
};
|
|
});
|
|
await Secret.bulkWrite(operations as any);
|
|
|
|
// (EE) add secret versions for updated secrets
|
|
await EESecretService.addSecretVersions({
|
|
secretVersions: toUpdate.map((s) => {
|
|
return ({
|
|
...newSecretsObj[`${s.type}-${s.secretKeyHash}`],
|
|
secret: s._id,
|
|
version: s.version ? s.version + 1 : 1,
|
|
workspace: new Types.ObjectId(workspaceId),
|
|
user: s.user,
|
|
environment: s.environment,
|
|
isDeleted: false
|
|
})
|
|
})
|
|
});
|
|
|
|
const updateAction = await EELogService.createAction({
|
|
name: ACTION_UPDATE_SECRETS,
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(workspaceId),
|
|
secretIds: toUpdate.map((u) => u._id)
|
|
});
|
|
|
|
updateAction && actions.push(updateAction);
|
|
}
|
|
|
|
// handle adding new secrets
|
|
const toAdd = secrets.filter((s) => !(`${s.type}-${s.secretKeyHash}` in oldSecretsObj));
|
|
|
|
if (toAdd.length > 0) {
|
|
// add secrets
|
|
const newSecrets = await Secret.insertMany(
|
|
toAdd.map((s, idx) => ({
|
|
...s,
|
|
version: 1,
|
|
workspace: workspaceId,
|
|
type: toAdd[idx].type,
|
|
environment,
|
|
...(toAdd[idx].type === 'personal' ? { user: userId } : {})
|
|
}))
|
|
);
|
|
|
|
// (EE) add secret versions for new secrets
|
|
EESecretService.addSecretVersions({
|
|
secretVersions: newSecrets.map((secretDocument) => {
|
|
return {
|
|
...secretDocument.toObject(),
|
|
secret: secretDocument._id,
|
|
isDeleted: false
|
|
}
|
|
})
|
|
});
|
|
|
|
const addAction = await EELogService.createAction({
|
|
name: ACTION_ADD_SECRETS,
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(workspaceId),
|
|
secretIds: newSecrets.map((n) => n._id)
|
|
});
|
|
addAction && actions.push(addAction);
|
|
}
|
|
|
|
// (EE) take a secret snapshot
|
|
await EESecretService.takeSecretSnapshot({
|
|
workspaceId
|
|
})
|
|
|
|
// (EE) create (audit) log
|
|
if (actions.length > 0) {
|
|
await EELogService.createLog({
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(workspaceId),
|
|
actions,
|
|
channel,
|
|
ipAddress
|
|
});
|
|
}
|
|
} catch (err) {
|
|
Sentry.setUser(null);
|
|
Sentry.captureException(err);
|
|
throw new Error('Failed to push shared and personal secrets');
|
|
}
|
|
};
|
|
|
|
/**
|
|
* Get secrets for user with id [userId] for workspace
|
|
* with id [workspaceId] with environment [environment]
|
|
* @param {Object} obj
|
|
* @param {String} obj.userId -id of user to pull secrets for
|
|
* @param {String} obj.workspaceId - id of workspace to pull from
|
|
* @param {String} obj.environment - environment for secrets
|
|
*/
|
|
const getSecrets = async ({
|
|
userId,
|
|
workspaceId,
|
|
environment
|
|
}: {
|
|
userId: string;
|
|
workspaceId: string;
|
|
environment: string;
|
|
}): Promise<ISecret[]> => {
|
|
let secrets: any; // TODO: FIX any
|
|
|
|
try {
|
|
// get shared workspace secrets
|
|
const sharedSecrets = await Secret.find({
|
|
workspace: workspaceId,
|
|
environment,
|
|
type: SECRET_SHARED
|
|
});
|
|
|
|
// get personal workspace secrets
|
|
const personalSecrets = await Secret.find({
|
|
workspace: workspaceId,
|
|
environment,
|
|
type: SECRET_PERSONAL,
|
|
user: userId
|
|
});
|
|
|
|
// concat shared and personal workspace secrets
|
|
secrets = personalSecrets.concat(sharedSecrets);
|
|
} catch (err) {
|
|
Sentry.setUser(null);
|
|
Sentry.captureException(err);
|
|
throw new Error('Failed to pull shared and personal secrets');
|
|
}
|
|
|
|
return secrets;
|
|
};
|
|
|
|
/**
|
|
* Pull secrets for user with id [userId] for workspace
|
|
* with id [workspaceId] with environment [environment]
|
|
* @param {Object} obj
|
|
* @param {String} obj.userId -id of user to pull secrets for
|
|
* @param {String} obj.workspaceId - id of workspace to pull from
|
|
* @param {String} obj.environment - environment for secrets
|
|
* @param {String} obj.channel - channel (web/cli/auto)
|
|
* @param {String} obj.ipAddress - ip address of request to push secrets
|
|
*/
|
|
const pullSecrets = async ({
|
|
userId,
|
|
workspaceId,
|
|
environment,
|
|
channel,
|
|
ipAddress
|
|
}: {
|
|
userId: string;
|
|
workspaceId: string;
|
|
environment: string;
|
|
channel: string;
|
|
ipAddress: string;
|
|
}): Promise<ISecret[]> => {
|
|
let secrets: any;
|
|
|
|
try {
|
|
secrets = await getSecrets({
|
|
userId,
|
|
workspaceId,
|
|
environment
|
|
})
|
|
|
|
const readAction = await EELogService.createAction({
|
|
name: ACTION_READ_SECRETS,
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(workspaceId),
|
|
secretIds: secrets.map((n: any) => n._id)
|
|
});
|
|
|
|
readAction && await EELogService.createLog({
|
|
userId: new Types.ObjectId(userId),
|
|
workspaceId: new Types.ObjectId(workspaceId),
|
|
actions: [readAction],
|
|
channel,
|
|
ipAddress
|
|
});
|
|
} catch (err) {
|
|
Sentry.setUser(null);
|
|
Sentry.captureException(err);
|
|
throw new Error('Failed to pull shared and personal secrets');
|
|
}
|
|
|
|
return secrets;
|
|
};
|
|
|
|
/**
|
|
* Reformat output of pullSecrets() to be compatible with how existing
|
|
* web client handle secrets
|
|
* @param {Object} obj
|
|
* @param {Object} obj.secrets
|
|
*/
|
|
const reformatPullSecrets = ({ secrets }: { secrets: ISecret[] }) => {
|
|
let reformatedSecrets;
|
|
try {
|
|
reformatedSecrets = secrets.map((s) => ({
|
|
_id: s._id,
|
|
workspace: s.workspace,
|
|
type: s.type,
|
|
environment: s.environment,
|
|
secretKey: {
|
|
workspace: s.workspace,
|
|
ciphertext: s.secretKeyCiphertext,
|
|
iv: s.secretKeyIV,
|
|
tag: s.secretKeyTag,
|
|
hash: s.secretKeyHash
|
|
},
|
|
secretValue: {
|
|
workspace: s.workspace,
|
|
ciphertext: s.secretValueCiphertext,
|
|
iv: s.secretValueIV,
|
|
tag: s.secretValueTag,
|
|
hash: s.secretValueHash
|
|
},
|
|
secretComment: {
|
|
workspace: s.workspace,
|
|
ciphertext: s.secretCommentCiphertext,
|
|
iv: s.secretCommentIV,
|
|
tag: s.secretCommentTag,
|
|
hash: s.secretCommentHash
|
|
}
|
|
}));
|
|
} catch (err) {
|
|
Sentry.setUser(null);
|
|
Sentry.captureException(err);
|
|
throw new Error('Failed to reformat pulled secrets');
|
|
}
|
|
|
|
return reformatedSecrets;
|
|
};
|
|
|
|
export {
|
|
v1PushSecrets,
|
|
v2PushSecrets,
|
|
pullSecrets,
|
|
reformatPullSecrets
|
|
};
|