misc: made improvements to wording

.env.example

@@ -92,24 +92,20 @@ ENABLE_MSSQL_SECRET_ROTATION_ENCRYPT=true
 
 # App Connections
 
-# aws assume-role connection
+# aws assume-role
 INF_APP_CONNECTION_AWS_ACCESS_KEY_ID=
 INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY=
 
-# github oauth connection
+# github oauth
 INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_ID=
 INF_APP_CONNECTION_GITHUB_OAUTH_CLIENT_SECRET=
 
-#github app connection
+#github app
 INF_APP_CONNECTION_GITHUB_APP_CLIENT_ID=
 INF_APP_CONNECTION_GITHUB_APP_CLIENT_SECRET=
 INF_APP_CONNECTION_GITHUB_APP_PRIVATE_KEY=
 INF_APP_CONNECTION_GITHUB_APP_SLUG=
 INF_APP_CONNECTION_GITHUB_APP_ID=
 
-#gcp app connection
+#gcp app
 INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL=
-
-# azure app connection
-INF_APP_CONNECTION_AZURE_CLIENT_ID=
-INF_APP_CONNECTION_AZURE_CLIENT_SECRET=

.github/workflows/helm_chart_release.yml

@@ -1,4 +1,4 @@
-name: Release Infisical Core Helm chart
+name: Release Helm Charts
 
 on: [workflow_dispatch]
 
@@ -17,6 +17,6 @@ jobs:
       - name: Install Cloudsmith CLI
         run: pip install --upgrade cloudsmith-cli
       - name: Build and push helm package to Cloudsmith
-        run: cd helm-charts && sh upload-infisical-core-helm-cloudsmith.sh
+        run: cd helm-charts && sh upload-to-cloudsmith.sh
         env:
           CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}

.github/workflows/release_docker_k8_operator.yaml

@@ -1,4 +1,4 @@
-name: Release image + Helm chart K8s Operator
+name: Release Docker image for K8 operator
 on:
   push:
     tags:
@@ -35,18 +35,3 @@ jobs:
           tags: |
             infisical/kubernetes-operator:latest
             infisical/kubernetes-operator:${{ steps.extract_version.outputs.version }}
-
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: Install Helm
-        uses: azure/setup-helm@v3
-        with:
-          version: v3.10.0
-      - name: Install python
-        uses: actions/setup-python@v4
-      - name: Install Cloudsmith CLI
-        run: pip install --upgrade cloudsmith-cli
-      - name: Build and push helm package to Cloudsmith
-        run: cd helm-charts && sh upload-k8s-operator-cloudsmith.sh
-        env:
-          CLOUDSMITH_API_KEY: ${{ secrets.CLOUDSMITH_API_KEY }}

Makefile

@@ -30,6 +30,3 @@ reviewable-api:
 	npm run type:check
 
 reviewable: reviewable-ui reviewable-api
-
-up-dev-sso:
-	docker compose -f docker-compose.dev.yml --profile sso up --build

README.md

@@ -125,7 +125,7 @@ Install pre commit hook to scan each commit before you push to your repository
 infisical scan install --pre-commit-hook
 ```
 
-Learn about Infisical's code scanning feature [here](https://infisical.com/docs/cli/scanning-overview)
+Lean about Infisical's code scanning feature [here](https://infisical.com/docs/cli/scanning-overview)
 
 ## Open-source vs. paid
 

backend/e2e-test/vitest-environment-knex.ts

@@ -23,14 +23,14 @@ export default {
   name: "knex-env",
   transformMode: "ssr",
   async setup() {
-    const logger = initLogger();
-    const envConfig = initEnvConfig(logger);
+    const logger = await initLogger();
+    const cfg = initEnvConfig(logger);
     const db = initDbConnection({
-      dbConnectionUri: envConfig.DB_CONNECTION_URI,
-      dbRootCert: envConfig.DB_ROOT_CERT
+      dbConnectionUri: cfg.DB_CONNECTION_URI,
+      dbRootCert: cfg.DB_ROOT_CERT
     });
 
-    const redis = new Redis(envConfig.REDIS_URL);
+    const redis = new Redis(cfg.REDIS_URL);
     await redis.flushdb("SYNC");
 
     try {
@@ -42,7 +42,6 @@ export default {
         },
         true
       );
-
       await db.migrate.latest({
         directory: path.join(__dirname, "../src/db/migrations"),
         extension: "ts",
@@ -53,24 +52,14 @@ export default {
         directory: path.join(__dirname, "../src/db/seeds"),
         extension: "ts"
       });
-
       const smtp = mockSmtpServer();
-      const queue = queueServiceFactory(envConfig.REDIS_URL, { dbConnectionUrl: envConfig.DB_CONNECTION_URI });
-      const keyStore = keyStoreFactory(envConfig.REDIS_URL);
+      const queue = queueServiceFactory(cfg.REDIS_URL, { dbConnectionUrl: cfg.DB_CONNECTION_URI });
+      const keyStore = keyStoreFactory(cfg.REDIS_URL);
 
-      const hsmModule = initializeHsmModule(envConfig);
+      const hsmModule = initializeHsmModule();
       hsmModule.initialize();
 
-      const server = await main({
-        db,
-        smtp,
-        logger,
-        queue,
-        keyStore,
-        hsmModule: hsmModule.getModule(),
-        redis,
-        envConfig
-      });
+      const server = await main({ db, smtp, logger, queue, keyStore, hsmModule: hsmModule.getModule(), redis });
 
       // @ts-expect-error type
       globalThis.testServer = server;
@@ -84,8 +73,8 @@ export default {
           organizationId: seedData1.organization.id,
           accessVersion: 1
         },
-        envConfig.AUTH_SECRET,
-        { expiresIn: envConfig.JWT_AUTH_LIFETIME }
+        cfg.AUTH_SECRET,
+        { expiresIn: cfg.JWT_AUTH_LIFETIME }
       );
     } catch (error) {
       // eslint-disable-next-line
@@ -120,4 +109,3 @@ export default {
     };
   }
 };
-

backend/package.json

@@ -45,24 +45,24 @@
     "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.ts",
     "generate:component": "tsx ./scripts/create-backend-file.ts",
     "generate:schema": "tsx ./scripts/generate-schema-types.ts && eslint --fix --ext ts ./src/db/schemas",
-    "auditlog-migration:latest": "node ./dist/db/rename-migrations-to-mjs.mjs && knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:latest",
-    "auditlog-migration:up": "knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:up",
-    "auditlog-migration:down": "knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:down",
-    "auditlog-migration:list": "knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:list",
-    "auditlog-migration:status": "knex --knexfile ./dist/db/auditlog-knexfile.mjs --client pg migrate:status",
-    "auditlog-migration:unlock": "knex --knexfile ./dist/db/auditlog-knexfile.mjs migrate:unlock",
-    "auditlog-migration:rollback": "knex --knexfile ./dist/db/auditlog-knexfile.mjs migrate:rollback",
+    "auditlog-migration:latest": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:latest",
+    "auditlog-migration:up": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:up",
+    "auditlog-migration:down": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:down",
+    "auditlog-migration:list": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:list",
+    "auditlog-migration:status": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:status",
+    "auditlog-migration:unlock": "knex --knexfile ./src/db/auditlog-knexfile.ts migrate:unlock",
+    "auditlog-migration:rollback": "knex --knexfile ./src/db/auditlog-knexfile.ts migrate:rollback",
     "migration:new": "tsx ./scripts/create-migration.ts",
-    "migration:up": "npm run auditlog-migration:up && knex --knexfile ./dist/db/knexfile.mjs --client pg migrate:up",
-    "migration:down": "npm run auditlog-migration:down && knex --knexfile ./dist/db/knexfile.mjs --client pg migrate:down",
-    "migration:list": "npm run auditlog-migration:list && knex --knexfile ./dist/db/knexfile.mjs --client pg migrate:list",
-    "migration:latest": "node ./dist/db/rename-migrations-to-mjs.mjs && npm run auditlog-migration:latest && knex --knexfile ./dist/db/knexfile.mjs --client pg migrate:latest",
-    "migration:status": "npm run auditlog-migration:status && knex --knexfile ./dist/db/knexfile.mjs --client pg migrate:status",
-    "migration:rollback": "npm run auditlog-migration:rollback && knex --knexfile ./dist/db/knexfile.mjs migrate:rollback",
-    "migration:unlock": "npm run auditlog-migration:unlock && knex --knexfile ./dist/db/knexfile.mjs migrate:unlock",
+    "migration:up": "npm run auditlog-migration:up && knex --knexfile ./src/db/knexfile.ts --client pg migrate:up",
+    "migration:down": "npm run auditlog-migration:down && knex --knexfile ./src/db/knexfile.ts --client pg migrate:down",
+    "migration:list": "npm run auditlog-migration:list && knex --knexfile ./src/db/knexfile.ts --client pg migrate:list",
+    "migration:latest": "npm run auditlog-migration:latest && knex --knexfile ./src/db/knexfile.ts --client pg migrate:latest",
+    "migration:status": "npm run auditlog-migration:status && knex --knexfile ./src/db/knexfile.ts --client pg migrate:status",
+    "migration:rollback": "npm run auditlog-migration:rollback && knex --knexfile ./src/db/knexfile.ts migrate:rollback",
+    "migration:unlock": "npm run auditlog-migration:unlock && knex --knexfile ./src/db/knexfile.ts migrate:unlock",
     "migrate:org": "tsx ./scripts/migrate-organization.ts",
     "seed:new": "tsx ./scripts/create-seed-file.ts",
-    "seed": "knex --knexfile ./dist/db/knexfile.ts --client pg seed:run",
+    "seed": "knex --knexfile ./src/db/knexfile.ts --client pg seed:run",
     "db:reset": "npm run migration:rollback -- --all && npm run migration:latest"
   },
   "keywords": [],

backend/src/@types/fastify.d.ts

@@ -93,12 +93,6 @@ import { TUserEngagementServiceFactory } from "@app/services/user-engagement/use
 import { TWebhookServiceFactory } from "@app/services/webhook/webhook-service";
 import { TWorkflowIntegrationServiceFactory } from "@app/services/workflow-integration/workflow-integration-service";
 
-declare module "@fastify/request-context" {
-  interface RequestContextData {
-    reqId: string;
-  }
-}
-
 declare module "fastify" {
   interface Session {
     callbackPort: string;

backend/src/auto-start-migrations.ts

@@ -1,105 +0,0 @@
-import path from "node:path";
-
-import dotenv from "dotenv";
-import { Knex } from "knex";
-import { Logger } from "pino";
-
-import { PgSqlLock } from "./keystore/keystore";
-
-dotenv.config();
-
-type TArgs = {
-  auditLogDb?: Knex;
-  applicationDb: Knex;
-  logger: Logger;
-};
-
-const isProduction = process.env.NODE_ENV === "production";
-const migrationConfig = {
-  directory: path.join(__dirname, "./db/migrations"),
-  loadExtensions: [".mjs", ".ts"],
-  tableName: "infisical_migrations"
-};
-
-const migrationStatusCheckErrorHandler = (err: Error) => {
-  // happens for first time  in which the migration table itself is not created yet
-  //    error: select * from "infisical_migrations" - relation "infisical_migrations" does not exist
-  if (err?.message?.includes("does not exist")) {
-    return true;
-  }
-  throw err;
-};
-
-export const runMigrations = async ({ applicationDb, auditLogDb, logger }: TArgs) => {
-  try {
-    // akhilmhdh(Feb 10 2025): 2 years  from now remove this
-    if (isProduction) {
-      const migrationTable = migrationConfig.tableName;
-      const hasMigrationTable = await applicationDb.schema.hasTable(migrationTable);
-      if (hasMigrationTable) {
-        const firstFile = (await applicationDb(migrationTable).where({}).first()) as { name: string };
-        if (firstFile?.name?.includes(".ts")) {
-          await applicationDb(migrationTable).update({
-            name: applicationDb.raw("REPLACE(name, '.ts', '.mjs')")
-          });
-        }
-      }
-      if (auditLogDb) {
-        const hasMigrationTableInAuditLog = await auditLogDb.schema.hasTable(migrationTable);
-        if (hasMigrationTableInAuditLog) {
-          const firstFile = (await auditLogDb(migrationTable).where({}).first()) as { name: string };
-          if (firstFile?.name?.includes(".ts")) {
-            await auditLogDb(migrationTable).update({
-              name: auditLogDb.raw("REPLACE(name, '.ts', '.mjs')")
-            });
-          }
-        }
-      }
-    }
-
-    const shouldRunMigration = Boolean(
-      await applicationDb.migrate.status(migrationConfig).catch(migrationStatusCheckErrorHandler)
-    ); // db.length - code.length
-    if (!shouldRunMigration) {
-      logger.info("No migrations pending: Skipping migration process.");
-      return;
-    }
-
-    if (auditLogDb) {
-      await auditLogDb.transaction(async (tx) => {
-        await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.BootUpMigration]);
-        logger.info("Running audit log migrations.");
-
-        const didPreviousInstanceRunMigration = !(await auditLogDb.migrate
-          .status(migrationConfig)
-          .catch(migrationStatusCheckErrorHandler));
-        if (didPreviousInstanceRunMigration) {
-          logger.info("No audit log migrations pending: Applied by previous instance. Skipping migration process.");
-          return;
-        }
-
-        await auditLogDb.migrate.latest(migrationConfig);
-        logger.info("Finished audit log migrations.");
-      });
-    }
-
-    await applicationDb.transaction(async (tx) => {
-      await tx.raw("SELECT pg_advisory_xact_lock(?)", [PgSqlLock.BootUpMigration]);
-      logger.info("Running application migrations.");
-
-      const didPreviousInstanceRunMigration = !(await applicationDb.migrate
-        .status(migrationConfig)
-        .catch(migrationStatusCheckErrorHandler));
-      if (didPreviousInstanceRunMigration) {
-        logger.info("No application migrations pending: Applied by previous instance. Skipping migration process.");
-        return;
-      }
-
-      await applicationDb.migrate.latest(migrationConfig);
-      logger.info("Finished application migrations.");
-    });
-  } catch (err) {
-    logger.error(err, "Boot up migration failed");
-    process.exit(1);
-  }
-};

backend/src/db/instance.ts

@@ -49,9 +49,6 @@ export const initDbConnection = ({
             ca: Buffer.from(dbRootCert, "base64").toString("ascii")
           }
         : false
-    },
-    migrations: {
-      tableName: "infisical_migrations"
     }
   });
 
@@ -67,9 +64,6 @@ export const initDbConnection = ({
               ca: Buffer.from(replicaDbCertificate, "base64").toString("ascii")
             }
           : false
-      },
-      migrations: {
-        tableName: "infisical_migrations"
       }
     });
   });
@@ -104,9 +98,6 @@ export const initAuditLogDbConnection = ({
             ca: Buffer.from(dbRootCert, "base64").toString("ascii")
           }
         : false
-    },
-    migrations: {
-      tableName: "infisical_migrations"
     }
   });
 

backend/src/db/knexfile.ts

@@ -38,8 +38,7 @@ export default {
       directory: "./seeds"
     },
     migrations: {
-      tableName: "infisical_migrations",
-      loadExtensions: [".mjs"]
+      tableName: "infisical_migrations"
     }
   },
   production: {
@@ -63,8 +62,7 @@ export default {
       max: 10
     },
     migrations: {
-      tableName: "infisical_migrations",
-      loadExtensions: [".mjs"]
+      tableName: "infisical_migrations"
     }
   }
 } as Knex.Config;

backend/src/db/migrations/20250129214629_oidc-configs-manage-group-memberships-col.ts

@@ -1,23 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasManageGroupMembershipsCol = await knex.schema.hasColumn(TableName.OidcConfig, "manageGroupMemberships");
-
-  await knex.schema.alterTable(TableName.OidcConfig, (tb) => {
-    if (!hasManageGroupMembershipsCol) {
-      tb.boolean("manageGroupMemberships").notNullable().defaultTo(false);
-    }
-  });
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasManageGroupMembershipsCol = await knex.schema.hasColumn(TableName.OidcConfig, "manageGroupMemberships");
-
-  await knex.schema.alterTable(TableName.OidcConfig, (t) => {
-    if (hasManageGroupMembershipsCol) {
-      t.dropColumn("manageGroupMemberships");
-    }
-  });
-}

backend/src/db/migrations/20250204025010_app-connections-and-secret-syncs-unique-constraint.ts

@@ -1,23 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  await knex.schema.alterTable(TableName.AppConnection, (t) => {
-    t.unique(["orgId", "name"]);
-  });
-
-  await knex.schema.alterTable(TableName.SecretSync, (t) => {
-    t.unique(["projectId", "name"]);
-  });
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.alterTable(TableName.AppConnection, (t) => {
-    t.dropUnique(["orgId", "name"]);
-  });
-
-  await knex.schema.alterTable(TableName.SecretSync, (t) => {
-    t.dropUnique(["projectId", "name"]);
-  });
-}

backend/src/db/migrations/20250205045509_increase-gcp-auth-limit.ts

@@ -1,37 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasTable = await knex.schema.hasTable(TableName.IdentityGcpAuth);
-  const hasAllowedProjectsColumn = await knex.schema.hasColumn(TableName.IdentityGcpAuth, "allowedProjects");
-  const hasAllowedServiceAccountsColumn = await knex.schema.hasColumn(
-    TableName.IdentityGcpAuth,
-    "allowedServiceAccounts"
-  );
-  const hasAllowedZones = await knex.schema.hasColumn(TableName.IdentityGcpAuth, "allowedZones");
-  if (hasTable) {
-    await knex.schema.alterTable(TableName.IdentityGcpAuth, (t) => {
-      if (hasAllowedProjectsColumn) t.string("allowedProjects", 2500).alter();
-      if (hasAllowedServiceAccountsColumn) t.string("allowedServiceAccounts", 5000).alter();
-      if (hasAllowedZones) t.string("allowedZones", 2500).alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasTable = await knex.schema.hasTable(TableName.IdentityGcpAuth);
-  const hasAllowedProjectsColumn = await knex.schema.hasColumn(TableName.IdentityGcpAuth, "allowedProjects");
-  const hasAllowedServiceAccountsColumn = await knex.schema.hasColumn(
-    TableName.IdentityGcpAuth,
-    "allowedServiceAccounts"
-  );
-  const hasAllowedZones = await knex.schema.hasColumn(TableName.IdentityGcpAuth, "allowedZones");
-  if (hasTable) {
-    await knex.schema.alterTable(TableName.IdentityGcpAuth, (t) => {
-      if (hasAllowedProjectsColumn) t.string("allowedProjects").alter();
-      if (hasAllowedServiceAccountsColumn) t.string("allowedServiceAccounts").alter();
-      if (hasAllowedZones) t.string("allowedZones").alter();
-    });
-  }
-}

backend/src/db/migrations/20250205220952_kms-keys-drop-slug-col.ts

@@ -1,27 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.KmsKey)) {
-    const hasSlugCol = await knex.schema.hasColumn(TableName.KmsKey, "slug");
-
-    if (hasSlugCol) {
-      await knex.schema.alterTable(TableName.KmsKey, (t) => {
-        t.dropColumn("slug");
-      });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.KmsKey)) {
-    const hasSlugCol = await knex.schema.hasColumn(TableName.KmsKey, "slug");
-
-    if (!hasSlugCol) {
-      await knex.schema.alterTable(TableName.KmsKey, (t) => {
-        t.string("slug", 32);
-      });
-    }
-  }
-}

backend/src/db/migrations/20250207002643_secret-syncs-increase-message-length.ts

@@ -1,31 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretSync)) {
-    const hasLastSyncMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastSyncMessage");
-    const hasLastImportMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastImportMessage");
-    const hasLastRemoveMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastRemoveMessage");
-
-    await knex.schema.alterTable(TableName.SecretSync, (t) => {
-      if (hasLastSyncMessage) t.string("lastSyncMessage", 1024).alter();
-      if (hasLastImportMessage) t.string("lastImportMessage", 1024).alter();
-      if (hasLastRemoveMessage) t.string("lastRemoveMessage", 1024).alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretSync)) {
-    const hasLastSyncMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastSyncMessage");
-    const hasLastImportMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastImportMessage");
-    const hasLastRemoveMessage = await knex.schema.hasColumn(TableName.SecretSync, "lastRemoveMessage");
-
-    await knex.schema.alterTable(TableName.SecretSync, (t) => {
-      if (hasLastSyncMessage) t.string("lastSyncMessage").alter();
-      if (hasLastImportMessage) t.string("lastImportMessage").alter();
-      if (hasLastRemoveMessage) t.string("lastRemoveMessage").alter();
-    });
-  }
-}

backend/src/db/migrations/20250210101840_webhook-to-kms.ts

@@ -1,130 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-export async function up(knex: Knex): Promise<void> {
-  const hasEncryptedKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedPassKey");
-  const hasEncryptedUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl");
-  const hasUrl = await knex.schema.hasColumn(TableName.Webhook, "url");
-
-  const hasWebhookTable = await knex.schema.hasTable(TableName.Webhook);
-  if (hasWebhookTable) {
-    await knex.schema.alterTable(TableName.Webhook, (t) => {
-      if (!hasEncryptedKey) t.binary("encryptedPassKey");
-      if (!hasEncryptedUrl) t.binary("encryptedUrl");
-      if (hasUrl) t.string("url").nullable().alter();
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const projectEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-  const webhooks = await knex(TableName.Webhook)
-    .where({})
-    .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.Webhook}.envId`)
-    .select(
-      "url",
-      "encryptedSecretKey",
-      "iv",
-      "tag",
-      "keyEncoding",
-      "urlCipherText",
-      "urlIV",
-      "urlTag",
-      knex.ref("id").withSchema(TableName.Webhook),
-      "envId"
-    )
-    .select(knex.ref("projectId").withSchema(TableName.Environment))
-    .orderBy(`${TableName.Environment}.projectId` as "projectId");
-
-  const updatedWebhooks = await Promise.all(
-    webhooks.map(async (el) => {
-      let projectKmsService = projectEncryptionRingBuffer.getItem(el.projectId);
-      if (!projectKmsService) {
-        projectKmsService = await kmsService.createCipherPairWithDataKey(
-          {
-            type: KmsDataKey.SecretManager,
-            projectId: el.projectId
-          },
-          knex
-        );
-        projectEncryptionRingBuffer.push(el.projectId, projectKmsService);
-      }
-
-      let encryptedSecretKey = null;
-      if (el.encryptedSecretKey && el.iv && el.tag && el.keyEncoding) {
-        const decyptedSecretKey = infisicalSymmetricDecrypt({
-          keyEncoding: el.keyEncoding as SecretKeyEncoding,
-          iv: el.iv,
-          tag: el.tag,
-          ciphertext: el.encryptedSecretKey
-        });
-        encryptedSecretKey = projectKmsService.encryptor({
-          plainText: Buffer.from(decyptedSecretKey, "utf8")
-        }).cipherTextBlob;
-      }
-
-      const decryptedUrl =
-        el.urlIV && el.urlTag && el.urlCipherText && el.keyEncoding
-          ? infisicalSymmetricDecrypt({
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              iv: el.urlIV,
-              tag: el.urlTag,
-              ciphertext: el.urlCipherText
-            })
-          : null;
-
-      const encryptedUrl = projectKmsService.encryptor({
-        plainText: Buffer.from(decryptedUrl || el.url || "")
-      }).cipherTextBlob;
-      return { id: el.id, encryptedUrl, encryptedSecretKey, envId: el.envId };
-    })
-  );
-
-  for (let i = 0; i < updatedWebhooks.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.Webhook)
-      .insert(
-        updatedWebhooks.slice(i, i + BATCH_SIZE).map((el) => ({
-          id: el.id,
-          envId: el.envId,
-          url: "",
-          encryptedUrl: el.encryptedUrl,
-          encryptedPassKey: el.encryptedSecretKey
-        }))
-      )
-      .onConflict("id")
-      .merge();
-  }
-
-  if (hasWebhookTable) {
-    await knex.schema.alterTable(TableName.Webhook, (t) => {
-      if (!hasEncryptedUrl) t.binary("encryptedUrl").notNullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasEncryptedKey = await knex.schema.hasColumn(TableName.Webhook, "encryptedPassKey");
-  const hasEncryptedUrl = await knex.schema.hasColumn(TableName.Webhook, "encryptedUrl");
-
-  const hasWebhookTable = await knex.schema.hasTable(TableName.Webhook);
-  if (hasWebhookTable) {
-    await knex.schema.alterTable(TableName.Webhook, (t) => {
-      if (hasEncryptedKey) t.dropColumn("encryptedPassKey");
-      if (hasEncryptedUrl) t.dropColumn("encryptedUrl");
-    });
-  }
-}

backend/src/db/migrations/20250210101841_dynamic-secret-root-to-kms.ts

@@ -1,111 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { selectAllTableCols } from "@app/lib/knex";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-export async function up(knex: Knex): Promise<void> {
-  const hasEncryptedInputColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedInput");
-  const hasInputCiphertextColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "inputCiphertext");
-  const hasInputIVColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "inputIV");
-  const hasInputTagColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "inputTag");
-
-  const hasDynamicSecretTable = await knex.schema.hasTable(TableName.DynamicSecret);
-  if (hasDynamicSecretTable) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      if (!hasEncryptedInputColumn) t.binary("encryptedInput");
-      if (hasInputCiphertextColumn) t.text("inputCiphertext").nullable().alter();
-      if (hasInputIVColumn) t.string("inputIV").nullable().alter();
-      if (hasInputTagColumn) t.string("inputTag").nullable().alter();
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const projectEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const dynamicSecretRootCredentials = await knex(TableName.DynamicSecret)
-    .join(TableName.SecretFolder, `${TableName.SecretFolder}.id`, `${TableName.DynamicSecret}.folderId`)
-    .join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
-    .select(selectAllTableCols(TableName.DynamicSecret))
-    .select(knex.ref("projectId").withSchema(TableName.Environment))
-    .orderBy(`${TableName.Environment}.projectId` as "projectId");
-
-  const updatedDynamicSecrets = await Promise.all(
-    dynamicSecretRootCredentials.map(async ({ projectId, ...el }) => {
-      let projectKmsService = projectEncryptionRingBuffer.getItem(projectId);
-      if (!projectKmsService) {
-        projectKmsService = await kmsService.createCipherPairWithDataKey(
-          {
-            type: KmsDataKey.SecretManager,
-            projectId
-          },
-          knex
-        );
-        projectEncryptionRingBuffer.push(projectId, projectKmsService);
-      }
-
-      const decryptedInputData =
-        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-        // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-        el.inputIV && el.inputTag && el.inputCiphertext && el.keyEncoding
-          ? infisicalSymmetricDecrypt({
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              iv: el.inputIV,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              tag: el.inputTag,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              ciphertext: el.inputCiphertext
-            })
-          : "";
-
-      const encryptedInput = projectKmsService.encryptor({
-        plainText: Buffer.from(decryptedInputData)
-      }).cipherTextBlob;
-
-      return { ...el, encryptedInput };
-    })
-  );
-
-  for (let i = 0; i < updatedDynamicSecrets.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.DynamicSecret)
-      .insert(updatedDynamicSecrets.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-
-  if (hasDynamicSecretTable) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      if (!hasEncryptedInputColumn) t.binary("encryptedInput").notNullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasEncryptedInputColumn = await knex.schema.hasColumn(TableName.DynamicSecret, "encryptedInput");
-
-  const hasDynamicSecretTable = await knex.schema.hasTable(TableName.DynamicSecret);
-  if (hasDynamicSecretTable) {
-    await knex.schema.alterTable(TableName.DynamicSecret, (t) => {
-      if (hasEncryptedInputColumn) t.dropColumn("encryptedInput");
-    });
-  }
-}

backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts

@@ -1,103 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { selectAllTableCols } from "@app/lib/knex";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-export async function up(knex: Knex): Promise<void> {
-  const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
-
-  const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
-  if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
-      if (!hasEncryptedRotationData) t.binary("encryptedRotationData");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const projectEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const secretRotations = await knex(TableName.SecretRotation)
-    .join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.SecretRotation}.envId`)
-    .select(selectAllTableCols(TableName.SecretRotation))
-    .select(knex.ref("projectId").withSchema(TableName.Environment))
-    .orderBy(`${TableName.Environment}.projectId` as "projectId");
-
-  const updatedRotationData = await Promise.all(
-    secretRotations.map(async ({ projectId, ...el }) => {
-      let projectKmsService = projectEncryptionRingBuffer.getItem(projectId);
-      if (!projectKmsService) {
-        projectKmsService = await kmsService.createCipherPairWithDataKey(
-          {
-            type: KmsDataKey.SecretManager,
-            projectId
-          },
-          knex
-        );
-        projectEncryptionRingBuffer.push(projectId, projectKmsService);
-      }
-
-      const decryptedRotationData =
-        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-        // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-        el.encryptedDataTag && el.encryptedDataIV && el.encryptedData && el.keyEncoding
-          ? infisicalSymmetricDecrypt({
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              keyEncoding: el.keyEncoding as SecretKeyEncoding,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              iv: el.encryptedDataIV,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              tag: el.encryptedDataTag,
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-              // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-              ciphertext: el.encryptedData
-            })
-          : "";
-
-      const encryptedRotationData = projectKmsService.encryptor({
-        plainText: Buffer.from(decryptedRotationData)
-      }).cipherTextBlob;
-      return { ...el, encryptedRotationData };
-    })
-  );
-
-  for (let i = 0; i < updatedRotationData.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.SecretRotation)
-      .insert(updatedRotationData.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-
-  if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
-      if (!hasEncryptedRotationData) t.binary("encryptedRotationData").notNullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
-
-  const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
-  if (hasRotationTable) {
-    await knex.schema.alterTable(TableName.SecretRotation, (t) => {
-      if (hasEncryptedRotationData) t.dropColumn("encryptedRotationData");
-    });
-  }
-}

backend/src/db/migrations/20250210101842_identity-k8-auth-to-kms.ts

@@ -1,200 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { decryptSymmetric, infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { selectAllTableCols } from "@app/lib/knex";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName, TOrgBots } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-const reencryptIdentityK8sAuth = async (knex: Knex) => {
-  const hasEncryptedKubernetesTokenReviewerJwt = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "encryptedKubernetesTokenReviewerJwt"
-  );
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "encryptedKubernetesCaCertificate"
-  );
-  const hasidentityKubernetesAuthTable = await knex.schema.hasTable(TableName.IdentityKubernetesAuth);
-
-  const hasEncryptedCaCertColumn = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "encryptedCaCert");
-  const hasCaCertIVColumn = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "caCertIV");
-  const hasCaCertTagColumn = await knex.schema.hasColumn(TableName.IdentityKubernetesAuth, "caCertTag");
-  const hasEncryptedTokenReviewerJwtColumn = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "encryptedTokenReviewerJwt"
-  );
-  const hasTokenReviewerJwtIVColumn = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "tokenReviewerJwtIV"
-  );
-  const hasTokenReviewerJwtTagColumn = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "tokenReviewerJwtTag"
-  );
-
-  if (hasidentityKubernetesAuthTable) {
-    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (t) => {
-      if (hasEncryptedCaCertColumn) t.text("encryptedCaCert").nullable().alter();
-      if (hasCaCertIVColumn) t.string("caCertIV").nullable().alter();
-      if (hasCaCertTagColumn) t.string("caCertTag").nullable().alter();
-      if (hasEncryptedTokenReviewerJwtColumn) t.text("encryptedTokenReviewerJwt").nullable().alter();
-      if (hasTokenReviewerJwtIVColumn) t.string("tokenReviewerJwtIV").nullable().alter();
-      if (hasTokenReviewerJwtTagColumn) t.string("tokenReviewerJwtTag").nullable().alter();
-
-      if (!hasEncryptedKubernetesTokenReviewerJwt) t.binary("encryptedKubernetesTokenReviewerJwt");
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedKubernetesCaCertificate");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const orgEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-  const identityKubernetesConfigs = await knex(TableName.IdentityKubernetesAuth)
-    .join(
-      TableName.IdentityOrgMembership,
-      `${TableName.IdentityOrgMembership}.identityId`,
-      `${TableName.IdentityKubernetesAuth}.identityId`
-    )
-    .join<TOrgBots>(TableName.OrgBot, `${TableName.OrgBot}.orgId`, `${TableName.IdentityOrgMembership}.orgId`)
-    .select(selectAllTableCols(TableName.IdentityKubernetesAuth))
-    .select(
-      knex.ref("encryptedSymmetricKey").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyIV").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyTag").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyKeyEncoding").withSchema(TableName.OrgBot),
-      knex.ref("orgId").withSchema(TableName.OrgBot)
-    )
-    .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
-
-  const updatedIdentityKubernetesConfigs = [];
-
-  for await (const {
-    encryptedSymmetricKey,
-    symmetricKeyKeyEncoding,
-    symmetricKeyTag,
-    symmetricKeyIV,
-    orgId,
-    ...el
-  } of identityKubernetesConfigs) {
-    let orgKmsService = orgEncryptionRingBuffer.getItem(orgId);
-
-    if (!orgKmsService) {
-      orgKmsService = await kmsService.createCipherPairWithDataKey(
-        {
-          type: KmsDataKey.Organization,
-          orgId
-        },
-        knex
-      );
-      orgEncryptionRingBuffer.push(orgId, orgKmsService);
-    }
-
-    const key = infisicalSymmetricDecrypt({
-      ciphertext: encryptedSymmetricKey,
-      iv: symmetricKeyIV,
-      tag: symmetricKeyTag,
-      keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-    });
-
-    const decryptedTokenReviewerJwt =
-      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-      // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-      el.encryptedTokenReviewerJwt && el.tokenReviewerJwtIV && el.tokenReviewerJwtTag
-        ? decryptSymmetric({
-            key,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            iv: el.tokenReviewerJwtIV,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            tag: el.tokenReviewerJwtTag,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            ciphertext: el.encryptedTokenReviewerJwt
-          })
-        : "";
-
-    const decryptedCertificate =
-      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-      // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-      el.encryptedCaCert && el.caCertIV && el.caCertTag
-        ? decryptSymmetric({
-            key,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            iv: el.caCertIV,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            tag: el.caCertTag,
-            // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-            ciphertext: el.encryptedCaCert
-          })
-        : "";
-
-    const encryptedKubernetesTokenReviewerJwt = orgKmsService.encryptor({
-      plainText: Buffer.from(decryptedTokenReviewerJwt)
-    }).cipherTextBlob;
-    const encryptedKubernetesCaCertificate = orgKmsService.encryptor({
-      plainText: Buffer.from(decryptedCertificate)
-    }).cipherTextBlob;
-
-    updatedIdentityKubernetesConfigs.push({
-      ...el,
-      accessTokenTrustedIps: JSON.stringify(el.accessTokenTrustedIps),
-      encryptedKubernetesCaCertificate,
-      encryptedKubernetesTokenReviewerJwt
-    });
-  }
-
-  for (let i = 0; i < updatedIdentityKubernetesConfigs.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.IdentityKubernetesAuth)
-      .insert(updatedIdentityKubernetesConfigs.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-  if (hasidentityKubernetesAuthTable) {
-    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (t) => {
-      if (!hasEncryptedKubernetesTokenReviewerJwt)
-        t.binary("encryptedKubernetesTokenReviewerJwt").notNullable().alter();
-    });
-  }
-};
-
-export async function up(knex: Knex): Promise<void> {
-  await reencryptIdentityK8sAuth(knex);
-}
-
-const dropIdentityK8sColumns = async (knex: Knex) => {
-  const hasEncryptedKubernetesTokenReviewerJwt = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "encryptedKubernetesTokenReviewerJwt"
-  );
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(
-    TableName.IdentityKubernetesAuth,
-    "encryptedKubernetesCaCertificate"
-  );
-  const hasidentityKubernetesAuthTable = await knex.schema.hasTable(TableName.IdentityKubernetesAuth);
-
-  if (hasidentityKubernetesAuthTable) {
-    await knex.schema.alterTable(TableName.IdentityKubernetesAuth, (t) => {
-      if (hasEncryptedKubernetesTokenReviewerJwt) t.dropColumn("encryptedKubernetesTokenReviewerJwt");
-      if (hasEncryptedCertificateColumn) t.dropColumn("encryptedKubernetesCaCertificate");
-    });
-  }
-};
-
-export async function down(knex: Knex): Promise<void> {
-  await dropIdentityK8sColumns(knex);
-}

backend/src/db/migrations/20250210101842_identity-oidc-auth-to-kms.ts

@@ -1,141 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { decryptSymmetric, infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { selectAllTableCols } from "@app/lib/knex";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName, TOrgBots } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-const reencryptIdentityOidcAuth = async (knex: Knex) => {
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(
-    TableName.IdentityOidcAuth,
-    "encryptedCaCertificate"
-  );
-  const hasidentityOidcAuthTable = await knex.schema.hasTable(TableName.IdentityOidcAuth);
-
-  const hasEncryptedCaCertColumn = await knex.schema.hasColumn(TableName.IdentityOidcAuth, "encryptedCaCert");
-  const hasCaCertIVColumn = await knex.schema.hasColumn(TableName.IdentityOidcAuth, "caCertIV");
-  const hasCaCertTagColumn = await knex.schema.hasColumn(TableName.IdentityOidcAuth, "caCertTag");
-
-  if (hasidentityOidcAuthTable) {
-    await knex.schema.alterTable(TableName.IdentityOidcAuth, (t) => {
-      if (hasEncryptedCaCertColumn) t.text("encryptedCaCert").nullable().alter();
-      if (hasCaCertIVColumn) t.string("caCertIV").nullable().alter();
-      if (hasCaCertTagColumn) t.string("caCertTag").nullable().alter();
-
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedCaCertificate");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const orgEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const identityOidcConfig = await knex(TableName.IdentityOidcAuth)
-    .join(
-      TableName.IdentityOrgMembership,
-      `${TableName.IdentityOrgMembership}.identityId`,
-      `${TableName.IdentityOidcAuth}.identityId`
-    )
-    .join<TOrgBots>(TableName.OrgBot, `${TableName.OrgBot}.orgId`, `${TableName.IdentityOrgMembership}.orgId`)
-    .select(selectAllTableCols(TableName.IdentityOidcAuth))
-    .select(
-      knex.ref("encryptedSymmetricKey").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyIV").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyTag").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyKeyEncoding").withSchema(TableName.OrgBot),
-      knex.ref("orgId").withSchema(TableName.OrgBot)
-    )
-    .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
-
-  const updatedIdentityOidcConfigs = await Promise.all(
-    identityOidcConfig.map(
-      async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, orgId, ...el }) => {
-        let orgKmsService = orgEncryptionRingBuffer.getItem(orgId);
-        if (!orgKmsService) {
-          orgKmsService = await kmsService.createCipherPairWithDataKey(
-            {
-              type: KmsDataKey.Organization,
-              orgId
-            },
-            knex
-          );
-          orgEncryptionRingBuffer.push(orgId, orgKmsService);
-        }
-        const key = infisicalSymmetricDecrypt({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
-
-        const decryptedCertificate =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedCaCert && el.caCertIV && el.caCertTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.caCertIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.caCertTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedCaCert
-              })
-            : "";
-
-        const encryptedCaCertificate = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedCertificate)
-        }).cipherTextBlob;
-
-        return {
-          ...el,
-          accessTokenTrustedIps: JSON.stringify(el.accessTokenTrustedIps),
-          encryptedCaCertificate
-        };
-      }
-    )
-  );
-
-  for (let i = 0; i < updatedIdentityOidcConfigs.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.IdentityOidcAuth)
-      .insert(updatedIdentityOidcConfigs.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-};
-
-export async function up(knex: Knex): Promise<void> {
-  await reencryptIdentityOidcAuth(knex);
-}
-
-const dropIdentityOidcColumns = async (knex: Knex) => {
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(
-    TableName.IdentityOidcAuth,
-    "encryptedCaCertificate"
-  );
-  const hasidentityOidcTable = await knex.schema.hasTable(TableName.IdentityOidcAuth);
-
-  if (hasidentityOidcTable) {
-    await knex.schema.alterTable(TableName.IdentityOidcAuth, (t) => {
-      if (hasEncryptedCertificateColumn) t.dropColumn("encryptedCaCertificate");
-    });
-  }
-};
-
-export async function down(knex: Knex): Promise<void> {
-  await dropIdentityOidcColumns(knex);
-}

backend/src/db/migrations/20250210101845_directory-config-to-kms.ts

@@ -1,493 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-import { decryptSymmetric, infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
-import { selectAllTableCols } from "@app/lib/knex";
-import { initLogger } from "@app/lib/logger";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-
-import { SecretKeyEncoding, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { createCircularCache } from "./utils/ring-buffer";
-import { getMigrationEncryptionServices } from "./utils/services";
-
-const BATCH_SIZE = 500;
-const reencryptSamlConfig = async (knex: Knex) => {
-  const hasEncryptedEntrypointColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlEntryPoint");
-  const hasEncryptedIssuerColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlIssuer");
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlCertificate");
-  const hasSamlConfigTable = await knex.schema.hasTable(TableName.SamlConfig);
-
-  if (hasSamlConfigTable) {
-    await knex.schema.alterTable(TableName.SamlConfig, (t) => {
-      if (!hasEncryptedEntrypointColumn) t.binary("encryptedSamlEntryPoint");
-      if (!hasEncryptedIssuerColumn) t.binary("encryptedSamlIssuer");
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedSamlCertificate");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const orgEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const samlConfigs = await knex(TableName.SamlConfig)
-    .join(TableName.OrgBot, `${TableName.OrgBot}.orgId`, `${TableName.SamlConfig}.orgId`)
-    .select(selectAllTableCols(TableName.SamlConfig))
-    .select(
-      knex.ref("encryptedSymmetricKey").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyIV").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyTag").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyKeyEncoding").withSchema(TableName.OrgBot)
-    )
-    .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
-
-  const updatedSamlConfigs = await Promise.all(
-    samlConfigs.map(
-      async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => {
-        let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId);
-        if (!orgKmsService) {
-          orgKmsService = await kmsService.createCipherPairWithDataKey(
-            {
-              type: KmsDataKey.Organization,
-              orgId: el.orgId
-            },
-            knex
-          );
-          orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
-        }
-        const key = infisicalSymmetricDecrypt({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
-
-        const decryptedEntryPoint =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedEntryPoint && el.entryPointIV && el.entryPointTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.entryPointIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.entryPointTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedEntryPoint
-              })
-            : "";
-
-        const decryptedIssuer =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedIssuer && el.issuerIV && el.issuerTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.issuerIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.issuerTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedIssuer
-              })
-            : "";
-
-        const decryptedCertificate =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedCert && el.certIV && el.certTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.certIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.certTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedCert
-              })
-            : "";
-
-        const encryptedSamlIssuer = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedIssuer)
-        }).cipherTextBlob;
-        const encryptedSamlCertificate = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedCertificate)
-        }).cipherTextBlob;
-        const encryptedSamlEntryPoint = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedEntryPoint)
-        }).cipherTextBlob;
-        return { ...el, encryptedSamlCertificate, encryptedSamlEntryPoint, encryptedSamlIssuer };
-      }
-    )
-  );
-
-  for (let i = 0; i < updatedSamlConfigs.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.SamlConfig)
-      .insert(updatedSamlConfigs.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-
-  if (hasSamlConfigTable) {
-    await knex.schema.alterTable(TableName.SamlConfig, (t) => {
-      if (!hasEncryptedEntrypointColumn) t.binary("encryptedSamlEntryPoint").notNullable().alter();
-      if (!hasEncryptedIssuerColumn) t.binary("encryptedSamlIssuer").notNullable().alter();
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedSamlCertificate").notNullable().alter();
-    });
-  }
-};
-
-const reencryptLdapConfig = async (knex: Knex) => {
-  const hasEncryptedLdapBindDNColum = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapBindDN");
-  const hasEncryptedLdapBindPassColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapBindPass");
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapCaCertificate");
-  const hasLdapConfigTable = await knex.schema.hasTable(TableName.LdapConfig);
-
-  const hasEncryptedCACertColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedCACert");
-  const hasCaCertIVColumn = await knex.schema.hasColumn(TableName.LdapConfig, "caCertIV");
-  const hasCaCertTagColumn = await knex.schema.hasColumn(TableName.LdapConfig, "caCertTag");
-  const hasEncryptedBindPassColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedBindPass");
-  const hasBindPassIVColumn = await knex.schema.hasColumn(TableName.LdapConfig, "bindPassIV");
-  const hasBindPassTagColumn = await knex.schema.hasColumn(TableName.LdapConfig, "bindPassTag");
-  const hasEncryptedBindDNColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedBindDN");
-  const hasBindDNIVColumn = await knex.schema.hasColumn(TableName.LdapConfig, "bindDNIV");
-  const hasBindDNTagColumn = await knex.schema.hasColumn(TableName.LdapConfig, "bindDNTag");
-
-  if (hasLdapConfigTable) {
-    await knex.schema.alterTable(TableName.LdapConfig, (t) => {
-      if (hasEncryptedCACertColumn) t.text("encryptedCACert").nullable().alter();
-      if (hasCaCertIVColumn) t.string("caCertIV").nullable().alter();
-      if (hasCaCertTagColumn) t.string("caCertTag").nullable().alter();
-      if (hasEncryptedBindPassColumn) t.string("encryptedBindPass").nullable().alter();
-      if (hasBindPassIVColumn) t.string("bindPassIV").nullable().alter();
-      if (hasBindPassTagColumn) t.string("bindPassTag").nullable().alter();
-      if (hasEncryptedBindDNColumn) t.string("encryptedBindDN").nullable().alter();
-      if (hasBindDNIVColumn) t.string("bindDNIV").nullable().alter();
-      if (hasBindDNTagColumn) t.string("bindDNTag").nullable().alter();
-
-      if (!hasEncryptedLdapBindDNColum) t.binary("encryptedLdapBindDN");
-      if (!hasEncryptedLdapBindPassColumn) t.binary("encryptedLdapBindPass");
-      if (!hasEncryptedCertificateColumn) t.binary("encryptedLdapCaCertificate");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const orgEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const ldapConfigs = await knex(TableName.LdapConfig)
-    .join(TableName.OrgBot, `${TableName.OrgBot}.orgId`, `${TableName.LdapConfig}.orgId`)
-    .select(selectAllTableCols(TableName.LdapConfig))
-    .select(
-      knex.ref("encryptedSymmetricKey").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyIV").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyTag").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyKeyEncoding").withSchema(TableName.OrgBot)
-    )
-    .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
-
-  const updatedLdapConfigs = await Promise.all(
-    ldapConfigs.map(
-      async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => {
-        let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId);
-        if (!orgKmsService) {
-          orgKmsService = await kmsService.createCipherPairWithDataKey(
-            {
-              type: KmsDataKey.Organization,
-              orgId: el.orgId
-            },
-            knex
-          );
-          orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
-        }
-        const key = infisicalSymmetricDecrypt({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
-
-        const decryptedBindDN =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedBindDN && el.bindDNIV && el.bindDNTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.bindDNIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.bindDNTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedBindDN
-              })
-            : "";
-
-        const decryptedBindPass =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedBindPass && el.bindPassIV && el.bindPassTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.bindPassIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.bindPassTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedBindPass
-              })
-            : "";
-
-        const decryptedCertificate =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedCACert && el.caCertIV && el.caCertTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.caCertIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.caCertTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedCACert
-              })
-            : "";
-
-        const encryptedLdapBindDN = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedBindDN)
-        }).cipherTextBlob;
-        const encryptedLdapBindPass = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedBindPass)
-        }).cipherTextBlob;
-        const encryptedLdapCaCertificate = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedCertificate)
-        }).cipherTextBlob;
-        return { ...el, encryptedLdapBindPass, encryptedLdapBindDN, encryptedLdapCaCertificate };
-      }
-    )
-  );
-
-  for (let i = 0; i < updatedLdapConfigs.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.LdapConfig)
-      .insert(updatedLdapConfigs.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-  if (hasLdapConfigTable) {
-    await knex.schema.alterTable(TableName.LdapConfig, (t) => {
-      if (!hasEncryptedLdapBindPassColumn) t.binary("encryptedLdapBindPass").notNullable().alter();
-      if (!hasEncryptedLdapBindDNColum) t.binary("encryptedLdapBindDN").notNullable().alter();
-    });
-  }
-};
-
-const reencryptOidcConfig = async (knex: Knex) => {
-  const hasEncryptedOidcClientIdColumn = await knex.schema.hasColumn(TableName.OidcConfig, "encryptedOidcClientId");
-  const hasEncryptedOidcClientSecretColumn = await knex.schema.hasColumn(
-    TableName.OidcConfig,
-    "encryptedOidcClientSecret"
-  );
-
-  const hasEncryptedClientIdColumn = await knex.schema.hasColumn(TableName.OidcConfig, "encryptedClientId");
-  const hasClientIdIVColumn = await knex.schema.hasColumn(TableName.OidcConfig, "clientIdIV");
-  const hasClientIdTagColumn = await knex.schema.hasColumn(TableName.OidcConfig, "clientIdTag");
-  const hasEncryptedClientSecretColumn = await knex.schema.hasColumn(TableName.OidcConfig, "encryptedClientSecret");
-  const hasClientSecretIVColumn = await knex.schema.hasColumn(TableName.OidcConfig, "clientSecretIV");
-  const hasClientSecretTagColumn = await knex.schema.hasColumn(TableName.OidcConfig, "clientSecretTag");
-
-  const hasOidcConfigTable = await knex.schema.hasTable(TableName.OidcConfig);
-
-  if (hasOidcConfigTable) {
-    await knex.schema.alterTable(TableName.OidcConfig, (t) => {
-      if (hasEncryptedClientIdColumn) t.text("encryptedClientId").nullable().alter();
-      if (hasClientIdIVColumn) t.string("clientIdIV").nullable().alter();
-      if (hasClientIdTagColumn) t.string("clientIdTag").nullable().alter();
-      if (hasEncryptedClientSecretColumn) t.text("encryptedClientSecret").nullable().alter();
-      if (hasClientSecretIVColumn) t.string("clientSecretIV").nullable().alter();
-      if (hasClientSecretTagColumn) t.string("clientSecretTag").nullable().alter();
-
-      if (!hasEncryptedOidcClientIdColumn) t.binary("encryptedOidcClientId");
-      if (!hasEncryptedOidcClientSecretColumn) t.binary("encryptedOidcClientSecret");
-    });
-  }
-
-  initLogger();
-  const envConfig = getMigrationEnvConfig();
-  const keyStore = inMemoryKeyStore();
-  const { kmsService } = await getMigrationEncryptionServices({ envConfig, keyStore, db: knex });
-  const orgEncryptionRingBuffer =
-    createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);
-
-  const oidcConfigs = await knex(TableName.OidcConfig)
-    .join(TableName.OrgBot, `${TableName.OrgBot}.orgId`, `${TableName.OidcConfig}.orgId`)
-    .select(selectAllTableCols(TableName.OidcConfig))
-    .select(
-      knex.ref("encryptedSymmetricKey").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyIV").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyTag").withSchema(TableName.OrgBot),
-      knex.ref("symmetricKeyKeyEncoding").withSchema(TableName.OrgBot)
-    )
-    .orderBy(`${TableName.OrgBot}.orgId` as "orgId");
-
-  const updatedOidcConfigs = await Promise.all(
-    oidcConfigs.map(
-      async ({ encryptedSymmetricKey, symmetricKeyKeyEncoding, symmetricKeyTag, symmetricKeyIV, ...el }) => {
-        let orgKmsService = orgEncryptionRingBuffer.getItem(el.orgId);
-        if (!orgKmsService) {
-          orgKmsService = await kmsService.createCipherPairWithDataKey(
-            {
-              type: KmsDataKey.Organization,
-              orgId: el.orgId
-            },
-            knex
-          );
-          orgEncryptionRingBuffer.push(el.orgId, orgKmsService);
-        }
-        const key = infisicalSymmetricDecrypt({
-          ciphertext: encryptedSymmetricKey,
-          iv: symmetricKeyIV,
-          tag: symmetricKeyTag,
-          keyEncoding: symmetricKeyKeyEncoding as SecretKeyEncoding
-        });
-
-        const decryptedClientId =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedClientId && el.clientIdIV && el.clientIdTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.clientIdIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.clientIdTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedClientId
-              })
-            : "";
-
-        const decryptedClientSecret =
-          // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-          // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-          el.encryptedClientSecret && el.clientSecretIV && el.clientSecretTag
-            ? decryptSymmetric({
-                key,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                iv: el.clientSecretIV,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                tag: el.clientSecretTag,
-                // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-                // @ts-ignore This will be removed in next cycle so ignore the ts missing error
-                ciphertext: el.encryptedClientSecret
-              })
-            : "";
-
-        const encryptedOidcClientId = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedClientId)
-        }).cipherTextBlob;
-        const encryptedOidcClientSecret = orgKmsService.encryptor({
-          plainText: Buffer.from(decryptedClientSecret)
-        }).cipherTextBlob;
-        return { ...el, encryptedOidcClientId, encryptedOidcClientSecret };
-      }
-    )
-  );
-
-  for (let i = 0; i < updatedOidcConfigs.length; i += BATCH_SIZE) {
-    // eslint-disable-next-line no-await-in-loop
-    await knex(TableName.OidcConfig)
-      .insert(updatedOidcConfigs.slice(i, i + BATCH_SIZE))
-      .onConflict("id")
-      .merge();
-  }
-  if (hasOidcConfigTable) {
-    await knex.schema.alterTable(TableName.OidcConfig, (t) => {
-      if (!hasEncryptedOidcClientIdColumn) t.binary("encryptedOidcClientId").notNullable().alter();
-      if (!hasEncryptedOidcClientSecretColumn) t.binary("encryptedOidcClientSecret").notNullable().alter();
-    });
-  }
-};
-
-export async function up(knex: Knex): Promise<void> {
-  await reencryptSamlConfig(knex);
-  await reencryptLdapConfig(knex);
-  await reencryptOidcConfig(knex);
-}
-
-const dropSamlConfigColumns = async (knex: Knex) => {
-  const hasEncryptedEntrypointColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlEntryPoint");
-  const hasEncryptedIssuerColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlIssuer");
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(TableName.SamlConfig, "encryptedSamlCertificate");
-  const hasSamlConfigTable = await knex.schema.hasTable(TableName.SamlConfig);
-
-  if (hasSamlConfigTable) {
-    await knex.schema.alterTable(TableName.SamlConfig, (t) => {
-      if (hasEncryptedEntrypointColumn) t.dropColumn("encryptedSamlEntryPoint");
-      if (hasEncryptedIssuerColumn) t.dropColumn("encryptedSamlIssuer");
-      if (hasEncryptedCertificateColumn) t.dropColumn("encryptedSamlCertificate");
-    });
-  }
-};
-
-const dropLdapConfigColumns = async (knex: Knex) => {
-  const hasEncryptedBindDN = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapBindDN");
-  const hasEncryptedBindPass = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapBindPass");
-  const hasEncryptedCertificateColumn = await knex.schema.hasColumn(TableName.LdapConfig, "encryptedLdapCaCertificate");
-  const hasLdapConfigTable = await knex.schema.hasTable(TableName.LdapConfig);
-
-  if (hasLdapConfigTable) {
-    await knex.schema.alterTable(TableName.LdapConfig, (t) => {
-      if (hasEncryptedBindDN) t.dropColumn("encryptedLdapBindDN");
-      if (hasEncryptedBindPass) t.dropColumn("encryptedLdapBindPass");
-      if (hasEncryptedCertificateColumn) t.dropColumn("encryptedLdapCaCertificate");
-    });
-  }
-};
-
-const dropOidcConfigColumns = async (knex: Knex) => {
-  const hasEncryptedClientId = await knex.schema.hasColumn(TableName.OidcConfig, "encryptedOidcClientId");
-  const hasEncryptedClientSecret = await knex.schema.hasColumn(TableName.OidcConfig, "encryptedOidcClientSecret");
-  const hasOidcConfigTable = await knex.schema.hasTable(TableName.OidcConfig);
-
-  if (hasOidcConfigTable) {
-    await knex.schema.alterTable(TableName.OidcConfig, (t) => {
-      if (hasEncryptedClientId) t.dropColumn("encryptedOidcClientId");
-      if (hasEncryptedClientSecret) t.dropColumn("encryptedOidcClientSecret");
-    });
-  }
-};
-
-export async function down(knex: Knex): Promise<void> {
-  await dropSamlConfigColumns(knex);
-  await dropLdapConfigColumns(knex);
-  await dropOidcConfigColumns(knex);
-}

backend/src/db/migrations/utils/env-config.ts

@@ -1,53 +0,0 @@
-import { z } from "zod";
-
-import { zpStr } from "@app/lib/zod";
-
-const envSchema = z
-  .object({
-    DB_CONNECTION_URI: zpStr(z.string().describe("Postgres database connection string")).default(
-      `postgresql://${process.env.DB_USER}:${process.env.DB_PASSWORD}@${process.env.DB_HOST}:${process.env.DB_PORT}/${process.env.DB_NAME}`
-    ),
-    DB_ROOT_CERT: zpStr(z.string().describe("Postgres database base64-encoded CA cert").optional()),
-    DB_HOST: zpStr(z.string().describe("Postgres database host").optional()),
-    DB_PORT: zpStr(z.string().describe("Postgres database port").optional()).default("5432"),
-    DB_USER: zpStr(z.string().describe("Postgres database username").optional()),
-    DB_PASSWORD: zpStr(z.string().describe("Postgres database password").optional()),
-    DB_NAME: zpStr(z.string().describe("Postgres database name").optional()),
-    // TODO(akhilmhdh): will be changed to one
-    ENCRYPTION_KEY: zpStr(z.string().optional()),
-    ROOT_ENCRYPTION_KEY: zpStr(z.string().optional()),
-    // HSM
-    HSM_LIB_PATH: zpStr(z.string().optional()),
-    HSM_PIN: zpStr(z.string().optional()),
-    HSM_KEY_LABEL: zpStr(z.string().optional()),
-    HSM_SLOT: z.coerce.number().optional().default(0)
-  })
-  // To ensure that basic encryption is always possible.
-  .refine(
-    (data) => Boolean(data.ENCRYPTION_KEY) || Boolean(data.ROOT_ENCRYPTION_KEY),
-    "Either ENCRYPTION_KEY or ROOT_ENCRYPTION_KEY must be defined."
-  )
-  .transform((data) => ({
-    ...data,
-    isHsmConfigured:
-      Boolean(data.HSM_LIB_PATH) && Boolean(data.HSM_PIN) && Boolean(data.HSM_KEY_LABEL) && data.HSM_SLOT !== undefined
-  }));
-
-export type TMigrationEnvConfig = z.infer<typeof envSchema>;
-
-export const getMigrationEnvConfig = () => {
-  const parsedEnv = envSchema.safeParse(process.env);
-  if (!parsedEnv.success) {
-    // eslint-disable-next-line no-console
-    console.error("Invalid environment variables. Check the error below");
-    // eslint-disable-next-line no-console
-    console.error(
-      "Migration is now automatic at startup. Please remove this step from your workflow and start the application as normal."
-    );
-    // eslint-disable-next-line no-console
-    console.error(parsedEnv.error.issues);
-    process.exit(-1);
-  }
-
-  return Object.freeze(parsedEnv.data);
-};

backend/src/db/migrations/utils/kms.ts

@@ -0,0 +1,105 @@
+import slugify from "@sindresorhus/slugify";
+import { Knex } from "knex";
+
+import { TableName } from "@app/db/schemas";
+import { randomSecureBytes } from "@app/lib/crypto";
+import { symmetricCipherService, SymmetricEncryption } from "@app/lib/crypto/cipher";
+import { alphaNumericNanoId } from "@app/lib/nanoid";
+
+const getInstanceRootKey = async (knex: Knex) => {
+  const encryptionKey = process.env.ENCRYPTION_KEY || process.env.ROOT_ENCRYPTION_KEY;
+  // if root key its base64 encoded
+  const isBase64 = !process.env.ENCRYPTION_KEY;
+  if (!encryptionKey) throw new Error("ENCRYPTION_KEY variable needed for migration");
+  const encryptionKeyBuffer = Buffer.from(encryptionKey, isBase64 ? "base64" : "utf8");
+
+  const KMS_ROOT_CONFIG_UUID = "00000000-0000-0000-0000-000000000000";
+  const kmsRootConfig = await knex(TableName.KmsServerRootConfig).where({ id: KMS_ROOT_CONFIG_UUID }).first();
+  const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+  if (kmsRootConfig) {
+    const decryptedRootKey = cipher.decrypt(kmsRootConfig.encryptedRootKey, encryptionKeyBuffer);
+    // set the flag so that other instancen nodes can start
+    return decryptedRootKey;
+  }
+
+  const newRootKey = randomSecureBytes(32);
+  const encryptedRootKey = cipher.encrypt(newRootKey, encryptionKeyBuffer);
+  await knex(TableName.KmsServerRootConfig).insert({
+    encryptedRootKey,
+    // eslint-disable-next-line
+    // @ts-ignore id is kept as fixed for idempotence and to avoid race condition
+    id: KMS_ROOT_CONFIG_UUID
+  });
+  return encryptedRootKey;
+};
+
+export const getSecretManagerDataKey = async (knex: Knex, projectId: string) => {
+  const KMS_VERSION = "v01";
+  const KMS_VERSION_BLOB_LENGTH = 3;
+  const cipher = symmetricCipherService(SymmetricEncryption.AES_GCM_256);
+  const project = await knex(TableName.Project).where({ id: projectId }).first();
+  if (!project) throw new Error("Missing project id");
+
+  const ROOT_ENCRYPTION_KEY = await getInstanceRootKey(knex);
+
+  let secretManagerKmsKey;
+  const projectSecretManagerKmsId = project?.kmsSecretManagerKeyId;
+  if (projectSecretManagerKmsId) {
+    const kmsDoc = await knex(TableName.KmsKey)
+      .leftJoin(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`)
+      .where({ [`${TableName.KmsKey}.id` as "id"]: projectSecretManagerKmsId })
+      .first();
+    if (!kmsDoc) throw new Error("missing kms");
+    secretManagerKmsKey = cipher.decrypt(kmsDoc.encryptedKey, ROOT_ENCRYPTION_KEY);
+  } else {
+    const [kmsDoc] = await knex(TableName.KmsKey)
+      .insert({
+        name: slugify(alphaNumericNanoId(8).toLowerCase()),
+        orgId: project.orgId,
+        isReserved: false
+      })
+      .returning("*");
+
+    secretManagerKmsKey = randomSecureBytes(32);
+    const encryptedKeyMaterial = cipher.encrypt(secretManagerKmsKey, ROOT_ENCRYPTION_KEY);
+    await knex(TableName.InternalKms).insert({
+      version: 1,
+      encryptedKey: encryptedKeyMaterial,
+      encryptionAlgorithm: SymmetricEncryption.AES_GCM_256,
+      kmsKeyId: kmsDoc.id
+    });
+  }
+
+  const encryptedSecretManagerDataKey = project?.kmsSecretManagerEncryptedDataKey;
+  let dataKey: Buffer;
+  if (!encryptedSecretManagerDataKey) {
+    dataKey = randomSecureBytes();
+    // the below versioning we do it automatically in kms service
+    const unversionedDataKey = cipher.encrypt(dataKey, secretManagerKmsKey);
+    const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3
+    await knex(TableName.Project)
+      .where({ id: projectId })
+      .update({
+        kmsSecretManagerEncryptedDataKey: Buffer.concat([unversionedDataKey, versionBlob])
+      });
+  } else {
+    const cipherTextBlob = encryptedSecretManagerDataKey.subarray(0, -KMS_VERSION_BLOB_LENGTH);
+    dataKey = cipher.decrypt(cipherTextBlob, secretManagerKmsKey);
+  }
+
+  return {
+    encryptor: ({ plainText }: { plainText: Buffer }) => {
+      const encryptedPlainTextBlob = cipher.encrypt(plainText, dataKey);
+
+      // Buffer#1 encrypted text + Buffer#2 version number
+      const versionBlob = Buffer.from(KMS_VERSION, "utf8"); // length is 3
+      const cipherTextBlob = Buffer.concat([encryptedPlainTextBlob, versionBlob]);
+      return { cipherTextBlob };
+    },
+    decryptor: ({ cipherTextBlob: versionedCipherTextBlob }: { cipherTextBlob: Buffer }) => {
+      const cipherTextBlob = versionedCipherTextBlob.subarray(0, -KMS_VERSION_BLOB_LENGTH);
+      const decryptedBlob = cipher.decrypt(cipherTextBlob, dataKey);
+      return decryptedBlob;
+    }
+  };
+};

backend/src/db/migrations/utils/ring-buffer.ts

@@ -1,19 +0,0 @@
-export const createCircularCache = <T>(bufferSize = 10) => {
-  const bufferItems: { id: string; item: T }[] = [];
-  let bufferIndex = 0;
-
-  const push = (id: string, item: T) => {
-    if (bufferItems.length < bufferSize) {
-      bufferItems.push({ id, item });
-    } else {
-      bufferItems[bufferIndex] = { id, item };
-    }
-    bufferIndex = (bufferIndex + 1) % bufferSize;
-  };
-
-  const getItem = (id: string) => {
-    return bufferItems.find((i) => i.id === id)?.item;
-  };
-
-  return { push, getItem };
-};

backend/src/db/migrations/utils/services.ts

@@ -1,52 +0,0 @@
-import { Knex } from "knex";
-
-import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
-import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
-import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { internalKmsDALFactory } from "@app/services/kms/internal-kms-dal";
-import { kmskeyDALFactory } from "@app/services/kms/kms-key-dal";
-import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
-import { kmsServiceFactory } from "@app/services/kms/kms-service";
-import { orgDALFactory } from "@app/services/org/org-dal";
-import { projectDALFactory } from "@app/services/project/project-dal";
-
-import { TMigrationEnvConfig } from "./env-config";
-
-type TDependencies = {
-  envConfig: TMigrationEnvConfig;
-  db: Knex;
-  keyStore: TKeyStoreFactory;
-};
-
-export const getMigrationEncryptionServices = async ({ envConfig, db, keyStore }: TDependencies) => {
-  // eslint-disable-next-line no-param-reassign
-  const hsmModule = initializeHsmModule(envConfig);
-  hsmModule.initialize();
-
-  const hsmService = hsmServiceFactory({
-    hsmModule: hsmModule.getModule(),
-    envConfig
-  });
-
-  const orgDAL = orgDALFactory(db);
-  const kmsRootConfigDAL = kmsRootConfigDALFactory(db);
-  const kmsDAL = kmskeyDALFactory(db);
-  const internalKmsDAL = internalKmsDALFactory(db);
-  const projectDAL = projectDALFactory(db);
-
-  const kmsService = kmsServiceFactory({
-    kmsRootConfigDAL,
-    keyStore,
-    kmsDAL,
-    internalKmsDAL,
-    orgDAL,
-    projectDAL,
-    hsmService,
-    envConfig
-  });
-
-  await hsmService.startService();
-  await kmsService.startService();
-
-  return { kmsService };
-};

backend/src/db/rename-migrations-to-mjs.ts

@@ -1,56 +0,0 @@
-import path from "node:path";
-
-import dotenv from "dotenv";
-
-import { initAuditLogDbConnection, initDbConnection } from "./instance";
-
-const isProduction = process.env.NODE_ENV === "production";
-
-// Update with your config settings. .
-dotenv.config({
-  path: path.join(__dirname, "../../../.env.migration")
-});
-dotenv.config({
-  path: path.join(__dirname, "../../../.env")
-});
-
-const runRename = async () => {
-  if (!isProduction) return;
-  const migrationTable = "infisical_migrations";
-  const applicationDb = initDbConnection({
-    dbConnectionUri: process.env.DB_CONNECTION_URI as string,
-    dbRootCert: process.env.DB_ROOT_CERT
-  });
-
-  const auditLogDb = process.env.AUDIT_LOGS_DB_CONNECTION_URI
-    ? initAuditLogDbConnection({
-        dbConnectionUri: process.env.AUDIT_LOGS_DB_CONNECTION_URI,
-        dbRootCert: process.env.AUDIT_LOGS_DB_ROOT_CERT
-      })
-    : undefined;
-
-  const hasMigrationTable = await applicationDb.schema.hasTable(migrationTable);
-  if (hasMigrationTable) {
-    const firstFile = (await applicationDb(migrationTable).where({}).first()) as { name: string };
-    if (firstFile?.name?.includes(".ts")) {
-      await applicationDb(migrationTable).update({
-        name: applicationDb.raw("REPLACE(name, '.ts', '.mjs')")
-      });
-    }
-  }
-  if (auditLogDb) {
-    const hasMigrationTableInAuditLog = await auditLogDb.schema.hasTable(migrationTable);
-    if (hasMigrationTableInAuditLog) {
-      const firstFile = (await auditLogDb(migrationTable).where({}).first()) as { name: string };
-      if (firstFile?.name?.includes(".ts")) {
-        await auditLogDb(migrationTable).update({
-          name: auditLogDb.raw("REPLACE(name, '.ts', '.mjs')")
-        });
-      }
-    }
-  }
-  await applicationDb.destroy();
-  await auditLogDb?.destroy();
-};
-
-void runRename();

backend/src/db/schemas/dynamic-secrets.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const DynamicSecretsSchema = z.object({
@@ -16,17 +14,16 @@ export const DynamicSecretsSchema = z.object({
   type: z.string(),
   defaultTTL: z.string(),
   maxTTL: z.string().nullable().optional(),
-  inputIV: z.string().nullable().optional(),
-  inputCiphertext: z.string().nullable().optional(),
-  inputTag: z.string().nullable().optional(),
+  inputIV: z.string(),
+  inputCiphertext: z.string(),
+  inputTag: z.string(),
   algorithm: z.string().default("aes-256-gcm"),
   keyEncoding: z.string().default("utf8"),
   folderId: z.string().uuid(),
   status: z.string().nullable().optional(),
   statusDetails: z.string().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  encryptedInput: zodBuffer
+  updatedAt: z.date()
 });
 
 export type TDynamicSecrets = z.infer<typeof DynamicSecretsSchema>;

backend/src/db/schemas/identity-gcp-auths.ts

@@ -17,9 +17,9 @@ export const IdentityGcpAuthsSchema = z.object({
   updatedAt: z.date(),
   identityId: z.string().uuid(),
   type: z.string(),
-  allowedServiceAccounts: z.string().nullable().optional(),
-  allowedProjects: z.string().nullable().optional(),
-  allowedZones: z.string().nullable().optional()
+  allowedServiceAccounts: z.string(),
+  allowedProjects: z.string(),
+  allowedZones: z.string()
 });
 
 export type TIdentityGcpAuths = z.infer<typeof IdentityGcpAuthsSchema>;

backend/src/db/schemas/identity-kubernetes-auths.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const IdentityKubernetesAuthsSchema = z.object({
@@ -19,17 +17,15 @@ export const IdentityKubernetesAuthsSchema = z.object({
   updatedAt: z.date(),
   identityId: z.string().uuid(),
   kubernetesHost: z.string(),
-  encryptedCaCert: z.string().nullable().optional(),
-  caCertIV: z.string().nullable().optional(),
-  caCertTag: z.string().nullable().optional(),
-  encryptedTokenReviewerJwt: z.string().nullable().optional(),
-  tokenReviewerJwtIV: z.string().nullable().optional(),
-  tokenReviewerJwtTag: z.string().nullable().optional(),
+  encryptedCaCert: z.string(),
+  caCertIV: z.string(),
+  caCertTag: z.string(),
+  encryptedTokenReviewerJwt: z.string(),
+  tokenReviewerJwtIV: z.string(),
+  tokenReviewerJwtTag: z.string(),
   allowedNamespaces: z.string(),
   allowedNames: z.string(),
-  allowedAudience: z.string(),
-  encryptedKubernetesTokenReviewerJwt: zodBuffer,
-  encryptedKubernetesCaCertificate: zodBuffer.nullable().optional()
+  allowedAudience: z.string()
 });
 
 export type TIdentityKubernetesAuths = z.infer<typeof IdentityKubernetesAuthsSchema>;

backend/src/db/schemas/identity-oidc-auths.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const IdentityOidcAuthsSchema = z.object({
@@ -17,16 +15,15 @@ export const IdentityOidcAuthsSchema = z.object({
   accessTokenTrustedIps: z.unknown(),
   identityId: z.string().uuid(),
   oidcDiscoveryUrl: z.string(),
-  encryptedCaCert: z.string().nullable().optional(),
-  caCertIV: z.string().nullable().optional(),
-  caCertTag: z.string().nullable().optional(),
+  encryptedCaCert: z.string(),
+  caCertIV: z.string(),
+  caCertTag: z.string(),
   boundIssuer: z.string(),
   boundAudiences: z.string(),
   boundClaims: z.unknown(),
   boundSubject: z.string().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  encryptedCaCertificate: zodBuffer.nullable().optional()
+  updatedAt: z.date()
 });
 
 export type TIdentityOidcAuths = z.infer<typeof IdentityOidcAuthsSchema>;

backend/src/db/schemas/kms-keys.ts

@@ -16,7 +16,8 @@ export const KmsKeysSchema = z.object({
   name: z.string(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  projectId: z.string().nullable().optional()
+  projectId: z.string().nullable().optional(),
+  slug: z.string().nullable().optional()
 });
 
 export type TKmsKeys = z.infer<typeof KmsKeysSchema>;

backend/src/db/schemas/ldap-configs.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const LdapConfigsSchema = z.object({
@@ -14,25 +12,22 @@ export const LdapConfigsSchema = z.object({
   orgId: z.string().uuid(),
   isActive: z.boolean(),
   url: z.string(),
-  encryptedBindDN: z.string().nullable().optional(),
-  bindDNIV: z.string().nullable().optional(),
-  bindDNTag: z.string().nullable().optional(),
-  encryptedBindPass: z.string().nullable().optional(),
-  bindPassIV: z.string().nullable().optional(),
-  bindPassTag: z.string().nullable().optional(),
+  encryptedBindDN: z.string(),
+  bindDNIV: z.string(),
+  bindDNTag: z.string(),
+  encryptedBindPass: z.string(),
+  bindPassIV: z.string(),
+  bindPassTag: z.string(),
   searchBase: z.string(),
-  encryptedCACert: z.string().nullable().optional(),
-  caCertIV: z.string().nullable().optional(),
-  caCertTag: z.string().nullable().optional(),
+  encryptedCACert: z.string(),
+  caCertIV: z.string(),
+  caCertTag: z.string(),
   createdAt: z.date(),
   updatedAt: z.date(),
   groupSearchBase: z.string().default(""),
   groupSearchFilter: z.string().default(""),
   searchFilter: z.string().default(""),
-  uniqueUserAttribute: z.string().default(""),
-  encryptedLdapBindDN: zodBuffer,
-  encryptedLdapBindPass: zodBuffer,
-  encryptedLdapCaCertificate: zodBuffer.nullable().optional()
+  uniqueUserAttribute: z.string().default("")
 });
 
 export type TLdapConfigs = z.infer<typeof LdapConfigsSchema>;

backend/src/db/schemas/oidc-configs.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const OidcConfigsSchema = z.object({
@@ -17,22 +15,19 @@ export const OidcConfigsSchema = z.object({
   jwksUri: z.string().nullable().optional(),
   tokenEndpoint: z.string().nullable().optional(),
   userinfoEndpoint: z.string().nullable().optional(),
-  encryptedClientId: z.string().nullable().optional(),
+  encryptedClientId: z.string(),
   configurationType: z.string(),
-  clientIdIV: z.string().nullable().optional(),
-  clientIdTag: z.string().nullable().optional(),
-  encryptedClientSecret: z.string().nullable().optional(),
-  clientSecretIV: z.string().nullable().optional(),
-  clientSecretTag: z.string().nullable().optional(),
+  clientIdIV: z.string(),
+  clientIdTag: z.string(),
+  encryptedClientSecret: z.string(),
+  clientSecretIV: z.string(),
+  clientSecretTag: z.string(),
   allowedEmailDomains: z.string().nullable().optional(),
   isActive: z.boolean(),
   createdAt: z.date(),
   updatedAt: z.date(),
   orgId: z.string().uuid(),
-  lastUsed: z.date().nullable().optional(),
-  manageGroupMemberships: z.boolean().default(false),
-  encryptedOidcClientId: zodBuffer,
-  encryptedOidcClientSecret: zodBuffer
+  lastUsed: z.date().nullable().optional()
 });
 
 export type TOidcConfigs = z.infer<typeof OidcConfigsSchema>;

backend/src/db/schemas/saml-configs.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const SamlConfigsSchema = z.object({
@@ -25,10 +23,7 @@ export const SamlConfigsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   orgId: z.string().uuid(),
-  lastUsed: z.date().nullable().optional(),
-  encryptedSamlEntryPoint: zodBuffer,
-  encryptedSamlIssuer: zodBuffer,
-  encryptedSamlCertificate: zodBuffer
+  lastUsed: z.date().nullable().optional()
 });
 
 export type TSamlConfigs = z.infer<typeof SamlConfigsSchema>;

backend/src/db/schemas/secret-rotations.ts

@@ -5,8 +5,6 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const SecretRotationsSchema = z.object({
@@ -24,8 +22,7 @@ export const SecretRotationsSchema = z.object({
   keyEncoding: z.string().nullable().optional(),
   envId: z.string().uuid(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  encryptedRotationData: zodBuffer
+  updatedAt: z.date()
 });
 
 export type TSecretRotations = z.infer<typeof SecretRotationsSchema>;

backend/src/db/schemas/webhooks.ts

@@ -5,14 +5,12 @@
 
 import { z } from "zod";
 
-import { zodBuffer } from "@app/lib/zod";
-
 import { TImmutableDBKeys } from "./models";
 
 export const WebhooksSchema = z.object({
   id: z.string().uuid(),
   secretPath: z.string().default("/"),
-  url: z.string().nullable().optional(),
+  url: z.string(),
   lastStatus: z.string().nullable().optional(),
   lastRunErrorMessage: z.string().nullable().optional(),
   isDisabled: z.boolean().default(false),
@@ -27,9 +25,7 @@ export const WebhooksSchema = z.object({
   urlCipherText: z.string().nullable().optional(),
   urlIV: z.string().nullable().optional(),
   urlTag: z.string().nullable().optional(),
-  type: z.string().default("general").nullable().optional(),
-  encryptedPassKey: zodBuffer.nullable().optional(),
-  encryptedUrl: zodBuffer
+  type: z.string().default("general").nullable().optional()
 });
 
 export type TWebhooks = z.infer<typeof WebhooksSchema>;

backend/src/ee/routes/v1/ldap-router.ts

@@ -14,7 +14,7 @@ import { FastifyRequest } from "fastify";
 import LdapStrategy from "passport-ldapauth";
 import { z } from "zod";
 
-import { LdapGroupMapsSchema } from "@app/db/schemas";
+import { LdapConfigsSchema, LdapGroupMapsSchema } from "@app/db/schemas";
 import { TLDAPConfig } from "@app/ee/services/ldap-config/ldap-config-types";
 import { isValidLdapFilter, searchGroups } from "@app/ee/services/ldap-config/ldap-fns";
 import { getConfig } from "@app/lib/config/env";
@@ -22,7 +22,6 @@ import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedLdapConfigSchema } from "@app/server/routes/sanitizedSchema/directory-config";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerLdapRouter = async (server: FastifyZodProvider) => {
@@ -188,7 +187,7 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
         caCert: z.string().trim().default("")
       }),
       response: {
-        200: SanitizedLdapConfigSchema
+        200: LdapConfigsSchema
       }
     },
     handler: async (req) => {
@@ -229,7 +228,7 @@ export const registerLdapRouter = async (server: FastifyZodProvider) => {
         .partial()
         .merge(z.object({ organizationId: z.string() })),
       response: {
-        200: SanitizedLdapConfigSchema
+        200: LdapConfigsSchema
       }
     },
     handler: async (req) => {

backend/src/ee/routes/v1/oidc-router.ts

@@ -11,28 +11,13 @@ import fastifySession from "@fastify/session";
 import RedisStore from "connect-redis";
 import { z } from "zod";
 
-import { OidcConfigsSchema } from "@app/db/schemas";
+import { OidcConfigsSchema } from "@app/db/schemas/oidc-configs";
 import { OIDCConfigurationType } from "@app/ee/services/oidc/oidc-config-types";
 import { getConfig } from "@app/lib/config/env";
 import { authRateLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 
-const SanitizedOidcConfigSchema = OidcConfigsSchema.pick({
-  id: true,
-  issuer: true,
-  authorizationEndpoint: true,
-  configurationType: true,
-  discoveryURL: true,
-  jwksUri: true,
-  tokenEndpoint: true,
-  userinfoEndpoint: true,
-  orgId: true,
-  isActive: true,
-  allowedEmailDomains: true,
-  manageGroupMemberships: true
-});
-
 export const registerOidcRouter = async (server: FastifyZodProvider) => {
   const appCfg = getConfig();
   const passport = new Authenticator({ key: "oidc", userProperty: "passportUser" });
@@ -157,7 +142,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
         orgSlug: z.string().trim()
       }),
       response: {
-        200: SanitizedOidcConfigSchema.pick({
+        200: OidcConfigsSchema.pick({
           id: true,
           issuer: true,
           authorizationEndpoint: true,
@@ -168,8 +153,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           discoveryURL: true,
           isActive: true,
           orgId: true,
-          allowedEmailDomains: true,
-          manageGroupMemberships: true
+          allowedEmailDomains: true
         }).extend({
           clientId: z.string(),
           clientSecret: z.string()
@@ -223,13 +207,12 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           userinfoEndpoint: z.string().trim(),
           clientId: z.string().trim(),
           clientSecret: z.string().trim(),
-          isActive: z.boolean(),
-          manageGroupMemberships: z.boolean().optional()
+          isActive: z.boolean()
         })
         .partial()
         .merge(z.object({ orgSlug: z.string() })),
       response: {
-        200: SanitizedOidcConfigSchema.pick({
+        200: OidcConfigsSchema.pick({
           id: true,
           issuer: true,
           authorizationEndpoint: true,
@@ -240,8 +223,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           userinfoEndpoint: true,
           orgId: true,
           allowedEmailDomains: true,
-          isActive: true,
-          manageGroupMemberships: true
+          isActive: true
         })
       }
     },
@@ -290,8 +272,7 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           clientId: z.string().trim(),
           clientSecret: z.string().trim(),
           isActive: z.boolean(),
-          orgSlug: z.string().trim(),
-          manageGroupMemberships: z.boolean().optional().default(false)
+          orgSlug: z.string().trim()
         })
         .superRefine((data, ctx) => {
           if (data.configurationType === OIDCConfigurationType.CUSTOM) {
@@ -342,7 +323,19 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
           }
         }),
       response: {
-        200: SanitizedOidcConfigSchema
+        200: OidcConfigsSchema.pick({
+          id: true,
+          issuer: true,
+          authorizationEndpoint: true,
+          configurationType: true,
+          discoveryURL: true,
+          jwksUri: true,
+          tokenEndpoint: true,
+          userinfoEndpoint: true,
+          orgId: true,
+          isActive: true,
+          allowedEmailDomains: true
+        })
       }
     },
 
@@ -357,25 +350,4 @@ export const registerOidcRouter = async (server: FastifyZodProvider) => {
       return oidc;
     }
   });
-
-  server.route({
-    method: "GET",
-    url: "/manage-group-memberships",
-    schema: {
-      querystring: z.object({
-        orgId: z.string().trim().min(1, "Org ID is required")
-      }),
-      response: {
-        200: z.object({
-          isEnabled: z.boolean()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const isEnabled = await server.services.oidc.isOidcManageGroupMembershipsEnabled(req.query.orgId, req.permission);
-
-      return { isEnabled };
-    }
-  });
 };

backend/src/ee/routes/v1/project-template-router.ts

@@ -9,7 +9,7 @@ import { ProjectTemplates } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 const MAX_JSON_SIZE_LIMIT_IN_BYTES = 32_768;

backend/src/ee/routes/v1/saml-router.ts

@@ -12,13 +12,13 @@ import { MultiSamlStrategy } from "@node-saml/passport-saml";
 import { FastifyRequest } from "fastify";
 import { z } from "zod";
 
+import { SamlConfigsSchema } from "@app/db/schemas";
 import { SamlProviders, TGetSamlCfgDTO } from "@app/ee/services/saml-config/saml-config-types";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedSamlConfigSchema } from "@app/server/routes/sanitizedSchema/directory-config";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 type TSAMLConfig = {
@@ -298,7 +298,7 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => {
         cert: z.string()
       }),
       response: {
-        200: SanitizedSamlConfigSchema
+        200: SamlConfigsSchema
       }
     },
     handler: async (req) => {
@@ -333,7 +333,7 @@ export const registerSamlRouter = async (server: FastifyZodProvider) => {
         .partial()
         .merge(z.object({ organizationId: z.string() })),
       response: {
-        200: SanitizedSamlConfigSchema
+        200: SamlConfigsSchema
       }
     },
     handler: async (req) => {

backend/src/ee/routes/v1/user-additional-privilege-router.ts

@@ -9,7 +9,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedUserProjectAdditionalPrivilegeSchema } from "@app/server/routes/sanitizedSchema/user-additional-privilege";
+import { SanitizedUserProjectAdditionalPrivilegeSchema } from "@app/server/routes/santizedSchemas/user-additional-privilege";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodProvider) => {

backend/src/ee/routes/v2/identity-project-additional-privilege-router.ts

@@ -9,7 +9,7 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedIdentityPrivilegeSchema } from "@app/server/routes/sanitizedSchema/identitiy-additional-privilege";
+import { SanitizedIdentityPrivilegeSchema } from "@app/server/routes/santizedSchemas/identitiy-additional-privilege";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: FastifyZodProvider) => {

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -223,7 +223,6 @@ export enum EventType {
   UPDATE_CMEK = "update-cmek",
   DELETE_CMEK = "delete-cmek",
   GET_CMEKS = "get-cmeks",
-  GET_CMEK = "get-cmek",
   CMEK_ENCRYPT = "cmek-encrypt",
   CMEK_DECRYPT = "cmek-decrypt",
   UPDATE_EXTERNAL_GROUP_ORG_ROLE_MAPPINGS = "update-external-group-org-role-mapping",
@@ -250,9 +249,7 @@ export enum EventType {
   DELETE_SECRET_SYNC = "delete-secret-sync",
   SECRET_SYNC_SYNC_SECRETS = "secret-sync-sync-secrets",
   SECRET_SYNC_IMPORT_SECRETS = "secret-sync-import-secrets",
-  SECRET_SYNC_REMOVE_SECRETS = "secret-sync-remove-secrets",
-  OIDC_GROUP_MEMBERSHIP_MAPPING_ASSIGN_USER = "oidc-group-membership-mapping-assign-user",
-  OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER = "oidc-group-membership-mapping-remove-user"
+  SECRET_SYNC_REMOVE_SECRETS = "secret-sync-remove-secrets"
 }
 
 interface UserActorMetadata {
@@ -318,8 +315,6 @@ interface GetSecretsEvent {
   };
 }
 
-type TSecretMetadata = { key: string; value: string }[];
-
 interface GetSecretEvent {
   type: EventType.GET_SECRET;
   metadata: {
@@ -328,7 +323,6 @@ interface GetSecretEvent {
     secretId: string;
     secretKey: string;
     secretVersion: number;
-    secretMetadata?: TSecretMetadata;
   };
 }
 
@@ -340,7 +334,6 @@ interface CreateSecretEvent {
     secretId: string;
     secretKey: string;
     secretVersion: number;
-    secretMetadata?: TSecretMetadata;
   };
 }
 
@@ -349,12 +342,7 @@ interface CreateSecretBatchEvent {
   metadata: {
     environment: string;
     secretPath: string;
-    secrets: Array<{
-      secretId: string;
-      secretKey: string;
-      secretVersion: number;
-      secretMetadata?: TSecretMetadata;
-    }>;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
   };
 }
 
@@ -366,7 +354,6 @@ interface UpdateSecretEvent {
     secretId: string;
     secretKey: string;
     secretVersion: number;
-    secretMetadata?: TSecretMetadata;
   };
 }
 
@@ -375,7 +362,7 @@ interface UpdateSecretBatchEvent {
   metadata: {
     environment: string;
     secretPath: string;
-    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number; secretMetadata?: TSecretMetadata }>;
+    secrets: Array<{ secretId: string; secretKey: string; secretVersion: number }>;
   };
 }
 
@@ -773,9 +760,9 @@ interface AddIdentityGcpAuthEvent {
   metadata: {
     identityId: string;
     type: string;
-    allowedServiceAccounts?: string | null;
-    allowedProjects?: string | null;
-    allowedZones?: string | null;
+    allowedServiceAccounts: string;
+    allowedProjects: string;
+    allowedZones: string;
     accessTokenTTL: number;
     accessTokenMaxTTL: number;
     accessTokenNumUsesLimit: number;
@@ -795,9 +782,9 @@ interface UpdateIdentityGcpAuthEvent {
   metadata: {
     identityId: string;
     type?: string;
-    allowedServiceAccounts?: string | null;
-    allowedProjects?: string | null;
-    allowedZones?: string | null;
+    allowedServiceAccounts?: string;
+    allowedProjects?: string;
+    allowedZones?: string;
     accessTokenTTL?: number;
     accessTokenMaxTTL?: number;
     accessTokenNumUsesLimit?: number;
@@ -1848,13 +1835,6 @@ interface GetCmeksEvent {
   };
 }
 
-interface GetCmekEvent {
-  type: EventType.GET_CMEK;
-  metadata: {
-    keyId: string;
-  };
-}
-
 interface CmekEncryptEvent {
   type: EventType.CMEK_ENCRYPT;
   metadata: {
@@ -2064,26 +2044,6 @@ interface SecretSyncRemoveSecretsEvent {
   };
 }
 
-interface OidcGroupMembershipMappingAssignUserEvent {
-  type: EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_ASSIGN_USER;
-  metadata: {
-    assignedToGroups: { id: string; name: string }[];
-    userId: string;
-    userEmail: string;
-    userGroupsClaim: string[];
-  };
-}
-
-interface OidcGroupMembershipMappingRemoveUserEvent {
-  type: EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER;
-  metadata: {
-    removedFromGroups: { id: string; name: string }[];
-    userId: string;
-    userEmail: string;
-    userGroupsClaim: string[];
-  };
-}
-
 export type Event =
   | GetSecretsEvent
   | GetSecretEvent
@@ -2245,7 +2205,6 @@ export type Event =
   | CreateCmekEvent
   | UpdateCmekEvent
   | DeleteCmekEvent
-  | GetCmekEvent
   | GetCmeksEvent
   | CmekEncryptEvent
   | CmekDecryptEvent
@@ -2273,6 +2232,4 @@ export type Event =
   | DeleteSecretSyncEvent
   | SecretSyncSyncSecretsEvent
   | SecretSyncImportSecretsEvent
-  | SecretSyncRemoveSecretsEvent
-  | OidcGroupMembershipMappingAssignUserEvent
-  | OidcGroupMembershipMappingRemoveUserEvent;
+  | SecretSyncRemoveSecretsEvent;

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts

@@ -37,7 +37,11 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
           db.ref("type").withSchema(TableName.DynamicSecret).as("dynType"),
           db.ref("defaultTTL").withSchema(TableName.DynamicSecret).as("dynDefaultTTL"),
           db.ref("maxTTL").withSchema(TableName.DynamicSecret).as("dynMaxTTL"),
-          db.ref("encryptedInput").withSchema(TableName.DynamicSecret).as("dynEncryptedInput"),
+          db.ref("inputIV").withSchema(TableName.DynamicSecret).as("dynInputIV"),
+          db.ref("inputTag").withSchema(TableName.DynamicSecret).as("dynInputTag"),
+          db.ref("inputCiphertext").withSchema(TableName.DynamicSecret).as("dynInputCiphertext"),
+          db.ref("algorithm").withSchema(TableName.DynamicSecret).as("dynAlgorithm"),
+          db.ref("keyEncoding").withSchema(TableName.DynamicSecret).as("dynKeyEncoding"),
           db.ref("folderId").withSchema(TableName.DynamicSecret).as("dynFolderId"),
           db.ref("status").withSchema(TableName.DynamicSecret).as("dynStatus"),
           db.ref("statusDetails").withSchema(TableName.DynamicSecret).as("dynStatusDetails"),
@@ -55,7 +59,11 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
           type: doc.dynType,
           defaultTTL: doc.dynDefaultTTL,
           maxTTL: doc.dynMaxTTL,
-          encryptedInput: doc.dynEncryptedInput,
+          inputIV: doc.dynInputIV,
+          inputTag: doc.dynInputTag,
+          inputCiphertext: doc.dynInputCiphertext,
+          algorithm: doc.dynAlgorithm,
+          keyEncoding: doc.dynKeyEncoding,
           folderId: doc.dynFolderId,
           status: doc.dynStatus,
           statusDetails: doc.dynStatusDetails,

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts

@@ -1,10 +1,8 @@
+import { SecretKeyEncoding } from "@app/db/schemas";
 import { DisableRotationErrors } from "@app/ee/services/secret-rotation/secret-rotation-queue";
-import { NotFoundError } from "@app/lib/errors";
+import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
-import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
 import { TDynamicSecretDALFactory } from "../dynamic-secret/dynamic-secret-dal";
 import { DynamicSecretStatus } from "../dynamic-secret/dynamic-secret-types";
@@ -16,8 +14,6 @@ type TDynamicSecretLeaseQueueServiceFactoryDep = {
   dynamicSecretLeaseDAL: Pick<TDynamicSecretLeaseDALFactory, "findById" | "deleteById" | "find" | "updateById">;
   dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findById" | "deleteById" | "updateById">;
   dynamicSecretProviders: Record<DynamicSecretProviders, TDynamicProviderFns>;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderDAL: Pick<TSecretFolderDALFactory, "findById">;
 };
 
 export type TDynamicSecretLeaseQueueServiceFactory = ReturnType<typeof dynamicSecretLeaseQueueServiceFactory>;
@@ -26,9 +22,7 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
   queueService,
   dynamicSecretDAL,
   dynamicSecretProviders,
-  dynamicSecretLeaseDAL,
-  kmsService,
-  folderDAL
+  dynamicSecretLeaseDAL
 }: TDynamicSecretLeaseQueueServiceFactoryDep) => {
   const pruneDynamicSecret = async (dynamicSecretCfgId: string) => {
     await queueService.queue(
@@ -82,21 +76,15 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
         const dynamicSecretLease = await dynamicSecretLeaseDAL.findById(leaseId);
         if (!dynamicSecretLease) throw new DisableRotationErrors({ message: "Dynamic secret lease not found" });
 
-        const folder = await folderDAL.findById(dynamicSecretLease.dynamicSecret.folderId);
-        if (!folder)
-          throw new NotFoundError({
-            message: `Failed to find folder with ${dynamicSecretLease.dynamicSecret.folderId}`
-          });
-
-        const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-          type: KmsDataKey.SecretManager,
-          projectId: folder.projectId
-        });
-
         const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
         const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
         const decryptedStoredInput = JSON.parse(
-          secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
+          infisicalSymmetricDecrypt({
+            keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+            ciphertext: dynamicSecretCfg.inputCiphertext,
+            tag: dynamicSecretCfg.inputTag,
+            iv: dynamicSecretCfg.inputIV
+          })
         ) as object;
 
         await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId);
@@ -112,22 +100,16 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
         if ((dynamicSecretCfg.status as DynamicSecretStatus) !== DynamicSecretStatus.Deleting)
           throw new DisableRotationErrors({ message: "Document not deleted" });
 
-        const folder = await folderDAL.findById(dynamicSecretCfg.folderId);
-        if (!folder)
-          throw new NotFoundError({
-            message: `Failed to find folder with ${dynamicSecretCfg.folderId}`
-          });
-
-        const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-          type: KmsDataKey.SecretManager,
-          projectId: folder.projectId
-        });
-
         const dynamicSecretLeases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfgId });
         if (dynamicSecretLeases.length) {
           const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
           const decryptedStoredInput = JSON.parse(
-            secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
+            infisicalSymmetricDecrypt({
+              keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+              ciphertext: dynamicSecretCfg.inputCiphertext,
+              tag: dynamicSecretCfg.inputTag,
+              iv: dynamicSecretCfg.inputIV
+            })
           ) as object;
 
           await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id)));

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import ms from "ms";
 
-import { ActionProjectType } from "@app/db/schemas";
+import { ActionProjectType, SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
@@ -9,10 +9,9 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
+import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
@@ -38,7 +37,6 @@ type TDynamicSecretLeaseServiceFactoryDep = {
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TDynamicSecretLeaseServiceFactory = ReturnType<typeof dynamicSecretLeaseServiceFactory>;
@@ -51,8 +49,7 @@ export const dynamicSecretLeaseServiceFactory = ({
   permissionService,
   dynamicSecretQueueService,
   projectDAL,
-  licenseService,
-  kmsService
+  licenseService
 }: TDynamicSecretLeaseServiceFactoryDep) => {
   const create = async ({
     environmentSlug,
@@ -107,14 +104,13 @@ export const dynamicSecretLeaseServiceFactory = ({
       throw new BadRequestError({ message: `Max lease limit reached. Limit: ${appCfg.MAX_LEASE_LIMIT}` });
 
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
-
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
     const decryptedStoredInput = JSON.parse(
-      secretManagerDecryptor({ cipherTextBlob: Buffer.from(dynamicSecretCfg.encryptedInput) }).toString()
+      infisicalSymmetricDecrypt({
+        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+        ciphertext: dynamicSecretCfg.inputCiphertext,
+        tag: dynamicSecretCfg.inputTag,
+        iv: dynamicSecretCfg.inputIV
+      })
     ) as object;
 
     const selectedTTL = ttl || dynamicSecretCfg.defaultTTL;
@@ -164,11 +160,6 @@ export const dynamicSecretLeaseServiceFactory = ({
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
     const plan = await licenseService.getPlan(actorOrgId);
     if (!plan?.dynamicSecret) {
       throw new BadRequestError({
@@ -190,7 +181,12 @@ export const dynamicSecretLeaseServiceFactory = ({
     const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const decryptedStoredInput = JSON.parse(
-      secretManagerDecryptor({ cipherTextBlob: Buffer.from(dynamicSecretCfg.encryptedInput) }).toString()
+      infisicalSymmetricDecrypt({
+        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+        ciphertext: dynamicSecretCfg.inputCiphertext,
+        tag: dynamicSecretCfg.inputTag,
+        iv: dynamicSecretCfg.inputIV
+      })
     ) as object;
 
     const selectedTTL = ttl || dynamicSecretCfg.defaultTTL;
@@ -244,11 +240,6 @@ export const dynamicSecretLeaseServiceFactory = ({
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
     if (!folder)
       throw new NotFoundError({
@@ -262,7 +253,12 @@ export const dynamicSecretLeaseServiceFactory = ({
     const dynamicSecretCfg = dynamicSecretLease.dynamicSecret;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const decryptedStoredInput = JSON.parse(
-      secretManagerDecryptor({ cipherTextBlob: Buffer.from(dynamicSecretCfg.encryptedInput) }).toString()
+      infisicalSymmetricDecrypt({
+        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+        ciphertext: dynamicSecretCfg.inputCiphertext,
+        tag: dynamicSecretCfg.inputTag,
+        iv: dynamicSecretCfg.inputIV
+      })
     ) as object;
 
     const revokeResponse = await selectedProvider

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -1,16 +1,15 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
-import { ActionProjectType } from "@app/db/schemas";
+import { ActionProjectType, SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
+import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 
@@ -43,7 +42,6 @@ type TDynamicSecretServiceFactoryDep = {
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath" | "findBySecretPathMultiEnv">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TDynamicSecretServiceFactory = ReturnType<typeof dynamicSecretServiceFactory>;
@@ -56,8 +54,7 @@ export const dynamicSecretServiceFactory = ({
   dynamicSecretProviders,
   permissionService,
   dynamicSecretQueueService,
-  projectDAL,
-  kmsService
+  projectDAL
 }: TDynamicSecretServiceFactoryDep) => {
   const create = async ({
     path,
@@ -111,15 +108,16 @@ export const dynamicSecretServiceFactory = ({
     const isConnected = await selectedProvider.validateConnection(provider.inputs);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
 
-    const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
+    const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(inputs));
 
     const dynamicSecretCfg = await dynamicSecretDAL.create({
       type: provider.type,
       version: 1,
-      encryptedInput: secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(inputs)) }).cipherTextBlob,
+      inputIV: encryptedInput.iv,
+      inputTag: encryptedInput.tag,
+      inputCiphertext: encryptedInput.ciphertext,
+      algorithm: encryptedInput.algorithm,
+      keyEncoding: encryptedInput.encoding,
       maxTTL,
       defaultTTL,
       folderId: folder.id,
@@ -182,15 +180,15 @@ export const dynamicSecretServiceFactory = ({
       if (existingDynamicSecret)
         throw new BadRequestError({ message: "Provided dynamic secret already exist under the folder" });
     }
-    const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
-      await kmsService.createCipherPairWithDataKey({
-        type: KmsDataKey.SecretManager,
-        projectId
-      });
 
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const decryptedStoredInput = JSON.parse(
-      secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
+      infisicalSymmetricDecrypt({
+        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+        ciphertext: dynamicSecretCfg.inputCiphertext,
+        tag: dynamicSecretCfg.inputTag,
+        iv: dynamicSecretCfg.inputIV
+      })
     ) as object;
     const newInput = { ...decryptedStoredInput, ...(inputs || {}) };
     const updatedInput = await selectedProvider.validateProviderInputs(newInput);
@@ -198,8 +196,13 @@ export const dynamicSecretServiceFactory = ({
     const isConnected = await selectedProvider.validateConnection(newInput);
     if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
 
+    const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(updatedInput));
     const updatedDynamicCfg = await dynamicSecretDAL.updateById(dynamicSecretCfg.id, {
-      encryptedInput: secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(updatedInput)) }).cipherTextBlob,
+      inputIV: encryptedInput.iv,
+      inputTag: encryptedInput.tag,
+      inputCiphertext: encryptedInput.ciphertext,
+      algorithm: encryptedInput.algorithm,
+      keyEncoding: encryptedInput.encoding,
       maxTTL,
       defaultTTL,
       name: newName ?? name,
@@ -312,13 +315,13 @@ export const dynamicSecretServiceFactory = ({
     if (!dynamicSecretCfg) {
       throw new NotFoundError({ message: `Dynamic secret with name '${name} in folder '${path}' not found` });
     }
-    const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
     const decryptedStoredInput = JSON.parse(
-      secretManagerDecryptor({ cipherTextBlob: dynamicSecretCfg.encryptedInput }).toString()
+      infisicalSymmetricDecrypt({
+        keyEncoding: dynamicSecretCfg.keyEncoding as SecretKeyEncoding,
+        ciphertext: dynamicSecretCfg.inputCiphertext,
+        tag: dynamicSecretCfg.inputTag,
+        iv: dynamicSecretCfg.inputIV
+      })
     ) as object;
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const providerInputs = (await selectedProvider.validateProviderInputs(decryptedStoredInput)) as object;

backend/src/ee/services/group/group-dal.ts

@@ -111,7 +111,7 @@ export const groupDALFactory = (db: TDbClient) => {
       }
 
       if (search) {
-        // void query.andWhereRaw(`CONCAT_WS(' ', "firstName", "lastName", "username") ilike '%${search}%'`);
+        void query.andWhereRaw(`CONCAT_WS(' ', "firstName", "lastName", "username") ilike '%${search}%'`);
       } else if (username) {
         void query.andWhere(`${TableName.Users}.username`, "ilike", `%${username}%`);
       }

backend/src/ee/services/group/group-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError } from "@casl/ability";
 import slugify from "@sindresorhus/slugify";
 
 import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
-import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -46,7 +45,6 @@ type TGroupServiceFactoryDep = {
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "findLatestProjectKey" | "insertMany">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getOrgPermissionByRole">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-  oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
 };
 
 export type TGroupServiceFactory = ReturnType<typeof groupServiceFactory>;
@@ -61,8 +59,7 @@ export const groupServiceFactory = ({
   projectBotDAL,
   projectKeyDAL,
   permissionService,
-  licenseService,
-  oidcConfigDAL
+  licenseService
 }: TGroupServiceFactoryDep) => {
   const createGroup = async ({ name, slug, role, actor, actorId, actorAuthMethod, actorOrgId }: TCreateGroupDTO) => {
     if (!actorOrgId) throw new UnauthorizedError({ message: "No organization ID provided in request" });
@@ -314,18 +311,6 @@ export const groupServiceFactory = ({
         message: `Failed to find group with ID ${id}`
       });
 
-    const oidcConfig = await oidcConfigDAL.findOne({
-      orgId: group.orgId,
-      isActive: true
-    });
-
-    if (oidcConfig?.manageGroupMemberships) {
-      throw new BadRequestError({
-        message:
-          "Cannot add user to group: OIDC group membership mapping is enabled - user must be assigned to this group in your OIDC provider."
-      });
-    }
-
     const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, actorOrgId);
 
     // check if user has broader or equal to privileges than group
@@ -381,18 +366,6 @@ export const groupServiceFactory = ({
         message: `Failed to find group with ID ${id}`
       });
 
-    const oidcConfig = await oidcConfigDAL.findOne({
-      orgId: group.orgId,
-      isActive: true
-    });
-
-    if (oidcConfig?.manageGroupMemberships) {
-      throw new BadRequestError({
-        message:
-          "Cannot remove user from group: OIDC group membership mapping is enabled - user must be removed from this group in your OIDC provider."
-      });
-    }
-
     const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, actorOrgId);
 
     // check if user has broader or equal to privileges than group

backend/src/ee/services/hsm/hsm-fns.ts

@@ -1,23 +1,25 @@
 import * as pkcs11js from "pkcs11js";
 
-import { TEnvConfig } from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 
 import { HsmModule } from "./hsm-types";
 
-export const initializeHsmModule = (envConfig: Pick<TEnvConfig, "isHsmConfigured" | "HSM_LIB_PATH">) => {
+export const initializeHsmModule = () => {
+  const appCfg = getConfig();
+
   // Create a new instance of PKCS11 module
   const pkcs11 = new pkcs11js.PKCS11();
   let isInitialized = false;
 
   const initialize = () => {
-    if (!envConfig.isHsmConfigured) {
+    if (!appCfg.isHsmConfigured) {
       return;
     }
 
     try {
       // Load the PKCS#11 module
-      pkcs11.load(envConfig.HSM_LIB_PATH!);
+      pkcs11.load(appCfg.HSM_LIB_PATH!);
 
       // Initialize the module
       pkcs11.C_Initialize();

backend/src/ee/services/hsm/hsm-service.ts

@@ -1,13 +1,12 @@
 import pkcs11js from "pkcs11js";
 
-import { TEnvConfig } from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
 
 import { HsmKeyType, HsmModule } from "./hsm-types";
 
 type THsmServiceFactoryDep = {
   hsmModule: HsmModule;
-  envConfig: Pick<TEnvConfig, "HSM_PIN" | "HSM_SLOT" | "HSM_LIB_PATH" | "HSM_KEY_LABEL" | "isHsmConfigured">;
 };
 
 export type THsmServiceFactory = ReturnType<typeof hsmServiceFactory>;
@@ -16,7 +15,9 @@ type SyncOrAsync<T> = T | Promise<T>;
 type SessionCallback<T> = (session: pkcs11js.Handle) => SyncOrAsync<T>;
 
 // eslint-disable-next-line no-empty-pattern
-export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envConfig }: THsmServiceFactoryDep) => {
+export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 } }: THsmServiceFactoryDep) => {
+  const appCfg = getConfig();
+
   // Constants for buffer structures
   const IV_LENGTH = 16; // Luna HSM typically expects 16-byte IV for cbc
   const BLOCK_SIZE = 16;
@@ -62,11 +63,11 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
         throw new Error("No slots available");
       }
 
-      if (envConfig.HSM_SLOT >= slots.length) {
-        throw new Error(`HSM slot ${envConfig.HSM_SLOT} not found or not initialized`);
+      if (appCfg.HSM_SLOT >= slots.length) {
+        throw new Error(`HSM slot ${appCfg.HSM_SLOT} not found or not initialized`);
       }
 
-      const slotId = slots[envConfig.HSM_SLOT];
+      const slotId = slots[appCfg.HSM_SLOT];
 
       const startTime = Date.now();
       while (Date.now() - startTime < MAX_TIMEOUT) {
@@ -77,7 +78,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
 
           // Login
           try {
-            pkcs11.C_Login(sessionHandle, pkcs11js.CKU_USER, envConfig.HSM_PIN);
+            pkcs11.C_Login(sessionHandle, pkcs11js.CKU_USER, appCfg.HSM_PIN);
             logger.info("HSM: Successfully authenticated");
             break;
           } catch (error) {
@@ -85,7 +86,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
             if (error instanceof pkcs11js.Pkcs11Error) {
               if (error.code === pkcs11js.CKR_PIN_INCORRECT) {
                 // We throw instantly here to prevent further attempts, because if too many attempts are made, the HSM will potentially wipe all key material
-                logger.error(error, `HSM: Incorrect PIN detected for HSM slot ${envConfig.HSM_SLOT}`);
+                logger.error(error, `HSM: Incorrect PIN detected for HSM slot ${appCfg.HSM_SLOT}`);
                 throw new Error("HSM: Incorrect HSM Pin detected. Please check the HSM configuration.");
               }
               if (error.code === pkcs11js.CKR_USER_ALREADY_LOGGED_IN) {
@@ -132,7 +133,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
   };
 
   const $findKey = (sessionHandle: pkcs11js.Handle, type: HsmKeyType) => {
-    const label = type === HsmKeyType.HMAC ? `${envConfig.HSM_KEY_LABEL}_HMAC` : envConfig.HSM_KEY_LABEL;
+    const label = type === HsmKeyType.HMAC ? `${appCfg.HSM_KEY_LABEL}_HMAC` : appCfg.HSM_KEY_LABEL;
     const keyType = type === HsmKeyType.HMAC ? pkcs11js.CKK_GENERIC_SECRET : pkcs11js.CKK_AES;
 
     const template = [
@@ -359,7 +360,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
   };
 
   const isActive = async () => {
-    if (!isInitialized || !envConfig.isHsmConfigured) {
+    if (!isInitialized || !appCfg.isHsmConfigured) {
       return false;
     }
 
@@ -371,11 +372,11 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
       logger.error(err, "HSM: Error testing PKCS#11 module");
     }
 
-    return envConfig.isHsmConfigured && isInitialized && pkcs11TestPassed;
+    return appCfg.isHsmConfigured && isInitialized && pkcs11TestPassed;
   };
 
   const startService = async () => {
-    if (!envConfig.isHsmConfigured || !pkcs11 || !isInitialized) return;
+    if (!appCfg.isHsmConfigured || !pkcs11 || !isInitialized) return;
 
     try {
       await $withSession(async (sessionHandle) => {
@@ -394,7 +395,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
             { type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_SECRET_KEY },
             { type: pkcs11js.CKA_KEY_TYPE, value: pkcs11js.CKK_AES },
             { type: pkcs11js.CKA_VALUE_LEN, value: AES_KEY_SIZE / 8 },
-            { type: pkcs11js.CKA_LABEL, value: envConfig.HSM_KEY_LABEL! },
+            { type: pkcs11js.CKA_LABEL, value: appCfg.HSM_KEY_LABEL! },
             { type: pkcs11js.CKA_ENCRYPT, value: true }, // Allow encryption
             { type: pkcs11js.CKA_DECRYPT, value: true }, // Allow decryption
             ...genericAttributes
@@ -409,7 +410,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
             keyTemplate
           );
 
-          logger.info(`HSM: Master key created successfully with label: ${envConfig.HSM_KEY_LABEL}`);
+          logger.info(`HSM: Master key created successfully with label: ${appCfg.HSM_KEY_LABEL}`);
         }
 
         // Check if HMAC key exists, create if not
@@ -418,7 +419,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
             { type: pkcs11js.CKA_CLASS, value: pkcs11js.CKO_SECRET_KEY },
             { type: pkcs11js.CKA_KEY_TYPE, value: pkcs11js.CKK_GENERIC_SECRET },
             { type: pkcs11js.CKA_VALUE_LEN, value: HMAC_KEY_SIZE / 8 }, // 256-bit key
-            { type: pkcs11js.CKA_LABEL, value: `${envConfig.HSM_KEY_LABEL!}_HMAC` },
+            { type: pkcs11js.CKA_LABEL, value: `${appCfg.HSM_KEY_LABEL!}_HMAC` },
             { type: pkcs11js.CKA_SIGN, value: true }, // Allow signing
             { type: pkcs11js.CKA_VERIFY, value: true }, // Allow verification
             ...genericAttributes
@@ -433,7 +434,7 @@ export const hsmServiceFactory = ({ hsmModule: { isInitialized, pkcs11 }, envCon
             hmacKeyTemplate
           );
 
-          logger.info(`HSM: HMAC key created successfully with label: ${envConfig.HSM_KEY_LABEL}_HMAC`);
+          logger.info(`HSM: HMAC key created successfully with label: ${appCfg.HSM_KEY_LABEL}_HMAC`);
         }
 
         // Get slot info to check supported mechanisms

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -5,7 +5,7 @@ import ms from "ms";
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
+import { unpackPermissions } from "@app/server/routes/santizedSchemas/permission";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -5,7 +5,7 @@ import ms from "ms";
 import { ActionProjectType } from "@app/db/schemas";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";

backend/src/ee/services/ldap-config/ldap-config-service.ts

@@ -1,18 +1,25 @@
 import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
 
-import { OrgMembershipStatus, TableName, TLdapConfigsUpdate, TUsers } from "@app/db/schemas";
+import { OrgMembershipStatus, SecretKeyEncoding, TableName, TLdapConfigsUpdate, TUsers } from "@app/db/schemas";
 import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
 import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee/services/group/group-fns";
 import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { getConfig } from "@app/lib/config/env";
+import {
+  decryptSymmetric,
+  encryptSymmetric,
+  generateAsymmetricKeyPair,
+  generateSymmetricKey,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { getDefaultOrgMembershipRole } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
@@ -52,6 +59,7 @@ type TLdapConfigServiceFactoryDep = {
     TOrgDALFactory,
     "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById" | "findOne" | "updateById"
   >;
+  orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "create" | "transaction">;
   groupDAL: Pick<TGroupDALFactory, "find" | "findOne">;
   groupProjectDAL: Pick<TGroupProjectDALFactory, "find">;
   projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "findLatestProjectKey" | "insertMany" | "delete">;
@@ -76,7 +84,6 @@ type TLdapConfigServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
   tokenService: Pick<TAuthTokenServiceFactory, "createTokenForUser">;
   smtpService: Pick<TSmtpService, "sendMail">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TLdapConfigServiceFactory = ReturnType<typeof ldapConfigServiceFactory>;
@@ -86,6 +93,7 @@ export const ldapConfigServiceFactory = ({
   ldapGroupMapDAL,
   orgDAL,
   orgMembershipDAL,
+  orgBotDAL,
   groupDAL,
   groupProjectDAL,
   projectKeyDAL,
@@ -97,8 +105,7 @@ export const ldapConfigServiceFactory = ({
   permissionService,
   licenseService,
   tokenService,
-  smtpService,
-  kmsService
+  smtpService
 }: TLdapConfigServiceFactoryDep) => {
   const createLdapCfg = async ({
     actor,
@@ -126,23 +133,77 @@ export const ldapConfigServiceFactory = ({
         message:
           "Failed to create LDAP configuration due to plan restriction. Upgrade plan to create LDAP configuration."
       });
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+
+    const orgBot = await orgBotDAL.transaction(async (tx) => {
+      const doc = await orgBotDAL.findOne({ orgId }, tx);
+      if (doc) return doc;
+
+      const { privateKey, publicKey } = generateAsymmetricKeyPair();
+      const key = generateSymmetricKey();
+      const {
+        ciphertext: encryptedPrivateKey,
+        iv: privateKeyIV,
+        tag: privateKeyTag,
+        encoding: privateKeyKeyEncoding,
+        algorithm: privateKeyAlgorithm
+      } = infisicalSymmetricEncypt(privateKey);
+      const {
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        encoding: symmetricKeyKeyEncoding,
+        algorithm: symmetricKeyAlgorithm
+      } = infisicalSymmetricEncypt(key);
+
+      return orgBotDAL.create(
+        {
+          name: "Infisical org bot",
+          publicKey,
+          privateKeyIV,
+          encryptedPrivateKey,
+          symmetricKeyIV,
+          symmetricKeyTag,
+          encryptedSymmetricKey,
+          symmetricKeyAlgorithm,
+          orgId,
+          privateKeyTag,
+          privateKeyAlgorithm,
+          privateKeyKeyEncoding,
+          symmetricKeyKeyEncoding
+        },
+        tx
+      );
     });
 
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    const { ciphertext: encryptedBindDN, iv: bindDNIV, tag: bindDNTag } = encryptSymmetric(bindDN, key);
+    const { ciphertext: encryptedBindPass, iv: bindPassIV, tag: bindPassTag } = encryptSymmetric(bindPass, key);
+    const { ciphertext: encryptedCACert, iv: caCertIV, tag: caCertTag } = encryptSymmetric(caCert, key);
+
     const ldapConfig = await ldapConfigDAL.create({
       orgId,
       isActive,
       url,
+      encryptedBindDN,
+      bindDNIV,
+      bindDNTag,
+      encryptedBindPass,
+      bindPassIV,
+      bindPassTag,
       uniqueUserAttribute,
       searchBase,
       searchFilter,
       groupSearchBase,
       groupSearchFilter,
-      encryptedLdapCaCertificate: encryptor({ plainText: Buffer.from(caCert) }).cipherTextBlob,
-      encryptedLdapBindDN: encryptor({ plainText: Buffer.from(bindDN) }).cipherTextBlob,
-      encryptedLdapBindPass: encryptor({ plainText: Buffer.from(bindPass) }).cipherTextBlob
+      encryptedCACert,
+      caCertIV,
+      caCertTag
     });
 
     return ldapConfig;
@@ -185,21 +246,38 @@ export const ldapConfigServiceFactory = ({
       uniqueUserAttribute
     };
 
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+    const orgBot = await orgBotDAL.findOne({ orgId });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot in organization with ID '${orgId}' not found`,
+        name: "OrgBotNotFound"
+      });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
     if (bindDN !== undefined) {
-      updateQuery.encryptedLdapBindDN = encryptor({ plainText: Buffer.from(bindDN) }).cipherTextBlob;
+      const { ciphertext: encryptedBindDN, iv: bindDNIV, tag: bindDNTag } = encryptSymmetric(bindDN, key);
+      updateQuery.encryptedBindDN = encryptedBindDN;
+      updateQuery.bindDNIV = bindDNIV;
+      updateQuery.bindDNTag = bindDNTag;
     }
 
     if (bindPass !== undefined) {
-      updateQuery.encryptedLdapBindPass = encryptor({ plainText: Buffer.from(bindPass) }).cipherTextBlob;
+      const { ciphertext: encryptedBindPass, iv: bindPassIV, tag: bindPassTag } = encryptSymmetric(bindPass, key);
+      updateQuery.encryptedBindPass = encryptedBindPass;
+      updateQuery.bindPassIV = bindPassIV;
+      updateQuery.bindPassTag = bindPassTag;
     }
 
     if (caCert !== undefined) {
-      updateQuery.encryptedLdapCaCertificate = encryptor({ plainText: Buffer.from(caCert) }).cipherTextBlob;
+      const { ciphertext: encryptedCACert, iv: caCertIV, tag: caCertTag } = encryptSymmetric(caCert, key);
+      updateQuery.encryptedCACert = encryptedCACert;
+      updateQuery.caCertIV = caCertIV;
+      updateQuery.caCertTag = caCertTag;
     }
 
     const [ldapConfig] = await ldapConfigDAL.update({ orgId }, updateQuery);
@@ -215,24 +293,61 @@ export const ldapConfigServiceFactory = ({
       });
     }
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: ldapConfig.orgId
+    const orgBot = await orgBotDAL.findOne({ orgId: ldapConfig.orgId });
+    if (!orgBot) {
+      throw new NotFoundError({
+        message: `Organization bot not found in organization with ID ${ldapConfig.orgId}`,
+        name: "OrgBotNotFound"
+      });
+    }
+
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
+    const {
+      encryptedBindDN,
+      bindDNIV,
+      bindDNTag,
+      encryptedBindPass,
+      bindPassIV,
+      bindPassTag,
+      encryptedCACert,
+      caCertIV,
+      caCertTag
+    } = ldapConfig;
+
     let bindDN = "";
-    if (ldapConfig.encryptedLdapBindDN) {
-      bindDN = decryptor({ cipherTextBlob: ldapConfig.encryptedLdapBindDN }).toString();
+    if (encryptedBindDN && bindDNIV && bindDNTag) {
+      bindDN = decryptSymmetric({
+        ciphertext: encryptedBindDN,
+        key,
+        tag: bindDNTag,
+        iv: bindDNIV
+      });
     }
 
     let bindPass = "";
-    if (ldapConfig.encryptedLdapBindPass) {
-      bindPass = decryptor({ cipherTextBlob: ldapConfig.encryptedLdapBindPass }).toString();
+    if (encryptedBindPass && bindPassIV && bindPassTag) {
+      bindPass = decryptSymmetric({
+        ciphertext: encryptedBindPass,
+        key,
+        tag: bindPassTag,
+        iv: bindPassIV
+      });
     }
 
     let caCert = "";
-    if (ldapConfig.encryptedLdapCaCertificate) {
-      caCert = decryptor({ cipherTextBlob: ldapConfig.encryptedLdapCaCertificate }).toString();
+    if (encryptedCACert && caCertIV && caCertTag) {
+      caCert = decryptSymmetric({
+        ciphertext: encryptedCACert,
+        key,
+        tag: caCertTag,
+        iv: caCertIV
+      });
     }
 
     return {

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -3,31 +3,28 @@ import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
 import { Issuer, Issuer as OpenIdIssuer, Strategy as OpenIdStrategy, TokenSet } from "openid-client";
 
-import { OrgMembershipStatus, TableName, TUsers } from "@app/db/schemas";
+import { OrgMembershipStatus, SecretKeyEncoding, TableName, TUsers } from "@app/db/schemas";
 import { TOidcConfigsUpdate } from "@app/db/schemas/oidc-configs";
-import { TAuditLogServiceFactory } from "@app/ee/services/audit-log/audit-log-service";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { TGroupDALFactory } from "@app/ee/services/group/group-dal";
-import { addUsersToGroupByUserIds, removeUsersFromGroupByUserIds } from "@app/ee/services/group/group-fns";
-import { TUserGroupMembershipDALFactory } from "@app/ee/services/group/user-group-membership-dal";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
+import {
+  decryptSymmetric,
+  encryptSymmetric,
+  generateAsymmetricKeyPair,
+  generateSymmetricKey,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, OidcAuthError } from "@app/lib/errors";
-import { OrgServiceActor } from "@app/lib/types";
-import { ActorType, AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
+import { AuthMethod, AuthTokenType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
-import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { getDefaultOrgMembershipRole } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal";
-import { TProjectKeyDALFactory } from "@app/services/project-key/project-key-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 import { LoginMethod } from "@app/services/super-admin/super-admin-types";
@@ -48,14 +45,7 @@ import {
 type TOidcConfigServiceFactoryDep = {
   userDAL: Pick<
     TUserDALFactory,
-    | "create"
-    | "findOne"
-    | "updateById"
-    | "findById"
-    | "findUserEncKeyByUserId"
-    | "findUserEncKeyByUserIdsBatch"
-    | "find"
-    | "transaction"
+    "create" | "findOne" | "transaction" | "updateById" | "findById" | "findUserEncKeyByUserId"
   >;
   userAliasDAL: Pick<TUserAliasDALFactory, "create" | "findOne">;
   orgDAL: Pick<
@@ -63,27 +53,12 @@ type TOidcConfigServiceFactoryDep = {
     "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById" | "findOne" | "updateById"
   >;
   orgMembershipDAL: Pick<TOrgMembershipDALFactory, "create">;
+  orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "create" | "transaction">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
   tokenService: Pick<TAuthTokenServiceFactory, "createTokenForUser">;
   smtpService: Pick<TSmtpService, "sendMail" | "verify">;
-  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getUserOrgPermission">;
+  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne" | "update" | "create">;
-  groupDAL: Pick<TGroupDALFactory, "findByOrgId">;
-  userGroupMembershipDAL: Pick<
-    TUserGroupMembershipDALFactory,
-    | "find"
-    | "transaction"
-    | "insertMany"
-    | "findGroupMembershipsByUserIdInOrg"
-    | "delete"
-    | "filterProjectsByUserMembership"
-  >;
-  groupProjectDAL: Pick<TGroupProjectDALFactory, "find">;
-  projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "findLatestProjectKey" | "insertMany" | "delete">;
-  projectDAL: Pick<TProjectDALFactory, "findProjectGhostUser">;
-  projectBotDAL: Pick<TProjectBotDALFactory, "findOne">;
-  auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TOidcConfigServiceFactory = ReturnType<typeof oidcConfigServiceFactory>;
@@ -96,16 +71,9 @@ export const oidcConfigServiceFactory = ({
   licenseService,
   permissionService,
   tokenService,
+  orgBotDAL,
   smtpService,
-  oidcConfigDAL,
-  userGroupMembershipDAL,
-  groupDAL,
-  groupProjectDAL,
-  projectKeyDAL,
-  projectDAL,
-  projectBotDAL,
-  auditLogService,
-  kmsService
+  oidcConfigDAL
 }: TOidcConfigServiceFactoryDep) => {
   const getOidc = async (dto: TGetOidcCfgDTO) => {
     const org = await orgDAL.findOne({ slug: dto.orgSlug });
@@ -136,19 +104,43 @@ export const oidcConfigServiceFactory = ({
       });
     }
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: oidcCfg.orgId
+    // decrypt and return cfg
+    const orgBot = await orgBotDAL.findOne({ orgId: oidcCfg.orgId });
+    if (!orgBot) {
+      throw new NotFoundError({
+        message: `Organization bot for organization with ID '${oidcCfg.orgId}' not found`,
+        name: "OrgBotNotFound"
+      });
+    }
+
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
+    const { encryptedClientId, clientIdIV, clientIdTag, encryptedClientSecret, clientSecretIV, clientSecretTag } =
+      oidcCfg;
+
     let clientId = "";
-    if (oidcCfg.encryptedOidcClientId) {
-      clientId = decryptor({ cipherTextBlob: oidcCfg.encryptedOidcClientId }).toString();
+    if (encryptedClientId && clientIdIV && clientIdTag) {
+      clientId = decryptSymmetric({
+        ciphertext: encryptedClientId,
+        key,
+        tag: clientIdTag,
+        iv: clientIdIV
+      });
     }
 
     let clientSecret = "";
-    if (oidcCfg.encryptedOidcClientSecret) {
-      clientSecret = decryptor({ cipherTextBlob: oidcCfg.encryptedOidcClientSecret }).toString();
+    if (encryptedClientSecret && clientSecretIV && clientSecretTag) {
+      clientSecret = decryptSymmetric({
+        key,
+        tag: clientSecretTag,
+        iv: clientSecretIV,
+        ciphertext: encryptedClientSecret
+      });
     }
 
     return {
@@ -164,21 +156,11 @@ export const oidcConfigServiceFactory = ({
       isActive: oidcCfg.isActive,
       allowedEmailDomains: oidcCfg.allowedEmailDomains,
       clientId,
-      clientSecret,
-      manageGroupMemberships: oidcCfg.manageGroupMemberships
+      clientSecret
     };
   };
 
-  const oidcLogin = async ({
-    externalId,
-    email,
-    firstName,
-    lastName,
-    orgId,
-    callbackPort,
-    groups = [],
-    manageGroupMemberships
-  }: TOidcLoginDTO) => {
+  const oidcLogin = async ({ externalId, email, firstName, lastName, orgId, callbackPort }: TOidcLoginDTO) => {
     const serverCfg = await getServerCfg();
 
     if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.OIDC)) {
@@ -333,83 +315,6 @@ export const oidcConfigServiceFactory = ({
       });
     }
 
-    if (manageGroupMemberships) {
-      const userGroups = await userGroupMembershipDAL.findGroupMembershipsByUserIdInOrg(user.id, orgId);
-      const orgGroups = await groupDAL.findByOrgId(orgId);
-
-      const userGroupsNames = userGroups.map((membership) => membership.groupName);
-      const missingGroupsMemberships = groups.filter((groupName) => !userGroupsNames.includes(groupName));
-      const groupsToAddUserTo = orgGroups.filter((group) => missingGroupsMemberships.includes(group.name));
-
-      for await (const group of groupsToAddUserTo) {
-        await addUsersToGroupByUserIds({
-          userIds: [user.id],
-          group,
-          userDAL,
-          userGroupMembershipDAL,
-          orgDAL,
-          groupProjectDAL,
-          projectKeyDAL,
-          projectDAL,
-          projectBotDAL
-        });
-      }
-
-      if (groupsToAddUserTo.length) {
-        await auditLogService.createAuditLog({
-          actor: {
-            type: ActorType.PLATFORM,
-            metadata: {}
-          },
-          orgId,
-          event: {
-            type: EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_ASSIGN_USER,
-            metadata: {
-              userId: user.id,
-              userEmail: user.email ?? user.username,
-              assignedToGroups: groupsToAddUserTo.map(({ id, name }) => ({ id, name })),
-              userGroupsClaim: groups
-            }
-          }
-        });
-      }
-
-      const membershipsToRemove = userGroups
-        .filter((membership) => !groups.includes(membership.groupName))
-        .map((membership) => membership.groupId);
-      const groupsToRemoveUserFrom = orgGroups.filter((group) => membershipsToRemove.includes(group.id));
-
-      for await (const group of groupsToRemoveUserFrom) {
-        await removeUsersFromGroupByUserIds({
-          userIds: [user.id],
-          group,
-          userDAL,
-          userGroupMembershipDAL,
-          groupProjectDAL,
-          projectKeyDAL
-        });
-      }
-
-      if (groupsToRemoveUserFrom.length) {
-        await auditLogService.createAuditLog({
-          actor: {
-            type: ActorType.PLATFORM,
-            metadata: {}
-          },
-          orgId,
-          event: {
-            type: EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER,
-            metadata: {
-              userId: user.id,
-              userEmail: user.email ?? user.username,
-              removedFromGroups: groupsToRemoveUserFrom.map(({ id, name }) => ({ id, name })),
-              userGroupsClaim: groups
-            }
-          }
-        });
-      }
-    }
-
     await licenseService.updateSubscriptionOrgMemberCount(organization.id);
 
     const userEnc = await userDAL.findUserEncKeyByUserId(user.id);
@@ -480,8 +385,7 @@ export const oidcConfigServiceFactory = ({
     tokenEndpoint,
     userinfoEndpoint,
     clientId,
-    clientSecret,
-    manageGroupMemberships
+    clientSecret
   }: TUpdateOidcCfgDTO) => {
     const org = await orgDAL.findOne({
       slug: orgSlug
@@ -509,10 +413,12 @@ export const oidcConfigServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Sso);
 
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: org.id
-    });
+    const orgBot = await orgBotDAL.findOne({ orgId: org.id });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot for organization with ID '${org.id}' not found`,
+        name: "OrgBotNotFound"
+      });
 
     const serverCfg = await getServerCfg();
     if (isActive && !serverCfg.trustOidcEmails) {
@@ -525,6 +431,13 @@ export const oidcConfigServiceFactory = ({
       }
     }
 
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
     const updateQuery: TOidcConfigsUpdate = {
       allowedEmailDomains,
       configurationType,
@@ -535,16 +448,26 @@ export const oidcConfigServiceFactory = ({
       userinfoEndpoint,
       jwksUri,
       isActive,
-      lastUsed: null,
-      manageGroupMemberships
+      lastUsed: null
     };
 
     if (clientId !== undefined) {
-      updateQuery.encryptedOidcClientId = encryptor({ plainText: Buffer.from(clientId) }).cipherTextBlob;
+      const { ciphertext: encryptedClientId, iv: clientIdIV, tag: clientIdTag } = encryptSymmetric(clientId, key);
+      updateQuery.encryptedClientId = encryptedClientId;
+      updateQuery.clientIdIV = clientIdIV;
+      updateQuery.clientIdTag = clientIdTag;
     }
 
     if (clientSecret !== undefined) {
-      updateQuery.encryptedOidcClientSecret = encryptor({ plainText: Buffer.from(clientSecret) }).cipherTextBlob;
+      const {
+        ciphertext: encryptedClientSecret,
+        iv: clientSecretIV,
+        tag: clientSecretTag
+      } = encryptSymmetric(clientSecret, key);
+
+      updateQuery.encryptedClientSecret = encryptedClientSecret;
+      updateQuery.clientSecretIV = clientSecretIV;
+      updateQuery.clientSecretTag = clientSecretTag;
     }
 
     const [ssoConfig] = await oidcConfigDAL.update({ orgId: org.id }, updateQuery);
@@ -568,8 +491,7 @@ export const oidcConfigServiceFactory = ({
     tokenEndpoint,
     userinfoEndpoint,
     clientId,
-    clientSecret,
-    manageGroupMemberships
+    clientSecret
   }: TCreateOidcCfgDTO) => {
     const org = await orgDAL.findOne({
       slug: orgSlug
@@ -596,11 +518,61 @@ export const oidcConfigServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Sso);
 
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: org.id
+    const orgBot = await orgBotDAL.transaction(async (tx) => {
+      const doc = await orgBotDAL.findOne({ orgId: org.id }, tx);
+      if (doc) return doc;
+
+      const { privateKey, publicKey } = generateAsymmetricKeyPair();
+      const key = generateSymmetricKey();
+      const {
+        ciphertext: encryptedPrivateKey,
+        iv: privateKeyIV,
+        tag: privateKeyTag,
+        encoding: privateKeyKeyEncoding,
+        algorithm: privateKeyAlgorithm
+      } = infisicalSymmetricEncypt(privateKey);
+      const {
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        encoding: symmetricKeyKeyEncoding,
+        algorithm: symmetricKeyAlgorithm
+      } = infisicalSymmetricEncypt(key);
+
+      return orgBotDAL.create(
+        {
+          name: "Infisical org bot",
+          publicKey,
+          privateKeyIV,
+          encryptedPrivateKey,
+          symmetricKeyIV,
+          symmetricKeyTag,
+          encryptedSymmetricKey,
+          symmetricKeyAlgorithm,
+          orgId: org.id,
+          privateKeyTag,
+          privateKeyAlgorithm,
+          privateKeyKeyEncoding,
+          symmetricKeyKeyEncoding
+        },
+        tx
+      );
     });
 
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    const { ciphertext: encryptedClientId, iv: clientIdIV, tag: clientIdTag } = encryptSymmetric(clientId, key);
+    const {
+      ciphertext: encryptedClientSecret,
+      iv: clientSecretIV,
+      tag: clientSecretTag
+    } = encryptSymmetric(clientSecret, key);
+
     const oidcCfg = await oidcConfigDAL.create({
       issuer,
       isActive,
@@ -612,9 +584,12 @@ export const oidcConfigServiceFactory = ({
       tokenEndpoint,
       userinfoEndpoint,
       orgId: org.id,
-      manageGroupMemberships,
-      encryptedOidcClientId: encryptor({ plainText: Buffer.from(clientId) }).cipherTextBlob,
-      encryptedOidcClientSecret: encryptor({ plainText: Buffer.from(clientSecret) }).cipherTextBlob
+      encryptedClientId,
+      clientIdIV,
+      clientIdTag,
+      encryptedClientSecret,
+      clientSecretIV,
+      clientSecretTag
     });
 
     return oidcCfg;
@@ -708,9 +683,7 @@ export const oidcConfigServiceFactory = ({
           firstName: claims.given_name ?? "",
           lastName: claims.family_name ?? "",
           orgId: org.id,
-          groups: claims.groups as string[] | undefined,
-          callbackPort,
-          manageGroupMemberships: oidcCfg.manageGroupMemberships
+          callbackPort
         })
           .then(({ isUserCompleted, providerAuthToken }) => {
             cb(null, { isUserCompleted, providerAuthToken });
@@ -724,16 +697,5 @@ export const oidcConfigServiceFactory = ({
     return strategy;
   };
 
-  const isOidcManageGroupMembershipsEnabled = async (orgId: string, actor: OrgServiceActor) => {
-    await permissionService.getUserOrgPermission(actor.id, orgId, actor.authMethod, actor.orgId);
-
-    const oidcConfig = await oidcConfigDAL.findOne({
-      orgId,
-      isActive: true
-    });
-
-    return Boolean(oidcConfig?.manageGroupMemberships);
-  };
-
-  return { oidcLogin, getOrgAuthStrategy, getOidc, updateOidcCfg, createOidcCfg, isOidcManageGroupMembershipsEnabled };
+  return { oidcLogin, getOrgAuthStrategy, getOidc, updateOidcCfg, createOidcCfg };
 };

backend/src/ee/services/oidc/oidc-config-types.ts

@@ -12,8 +12,6 @@ export type TOidcLoginDTO = {
   lastName?: string;
   orgId: string;
   callbackPort?: string;
-  groups?: string[];
-  manageGroupMemberships?: boolean | null;
 };
 
 export type TGetOidcCfgDTO =
@@ -39,7 +37,6 @@ export type TCreateOidcCfgDTO = {
   clientSecret: string;
   isActive: boolean;
   orgSlug: string;
-  manageGroupMemberships: boolean;
 } & TGenericPermission;
 
 export type TUpdateOidcCfgDTO = Partial<{
@@ -55,6 +52,5 @@ export type TUpdateOidcCfgDTO = Partial<{
   clientSecret: string;
   isActive: boolean;
   orgSlug: string;
-  manageGroupMemberships: boolean;
 }> &
   TGenericPermission;

backend/src/ee/services/permission/project-permission.ts

@@ -6,7 +6,7 @@ import {
   CASL_ACTION_SCHEMA_NATIVE_ENUM
 } from "@app/ee/services/permission/permission-schemas";
 import { conditionsMatcher, PermissionConditionOperators } from "@app/lib/casl";
-import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 
 import { PermissionConditionSchema } from "./permission-types";
 

backend/src/ee/services/project-template/project-template-service.ts

@@ -15,7 +15,7 @@ import {
 } from "@app/ee/services/project-template/project-template-types";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
-import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
+import { unpackPermissions } from "@app/server/routes/santizedSchemas/permission";
 import { getPredefinedRoles } from "@app/services/project-role/project-role-fns";
 
 import { TProjectTemplateDALFactory } from "./project-template-dal";

backend/src/ee/services/project-template/project-template-types.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 
 import { TProjectEnvironments } from "@app/db/schemas";
 import { TProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
-import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 
 export type TProjectTemplateEnvironment = Pick<TProjectEnvironments, "name" | "slug" | "position">;
 

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -5,7 +5,7 @@ import ms from "ms";
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
-import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -1,15 +1,29 @@
 import { ForbiddenError } from "@casl/ability";
 import jwt from "jsonwebtoken";
 
-import { OrgMembershipStatus, TableName, TSamlConfigs, TSamlConfigsUpdate, TUsers } from "@app/db/schemas";
+import {
+  OrgMembershipStatus,
+  SecretKeyEncoding,
+  TableName,
+  TSamlConfigs,
+  TSamlConfigsUpdate,
+  TUsers
+} from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
+import {
+  decryptSymmetric,
+  encryptSymmetric,
+  generateAsymmetricKeyPair,
+  generateSymmetricKey,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { AuthTokenType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TokenType } from "@app/services/auth-token/auth-token-types";
 import { TIdentityMetadataDALFactory } from "@app/services/identity/identity-metadata-dal";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
+import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { getDefaultOrgMembershipRole } from "@app/services/org/org-role-fns";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
@@ -38,19 +52,21 @@ type TSamlConfigServiceFactoryDep = {
     TOrgDALFactory,
     "createMembership" | "updateMembershipById" | "findMembership" | "findOrgById" | "findOne" | "updateById"
   >;
+
   identityMetadataDAL: Pick<TIdentityMetadataDALFactory, "delete" | "insertMany" | "transaction">;
   orgMembershipDAL: Pick<TOrgMembershipDALFactory, "create">;
+  orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "create" | "transaction">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
   tokenService: Pick<TAuthTokenServiceFactory, "createTokenForUser">;
   smtpService: Pick<TSmtpService, "sendMail">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TSamlConfigServiceFactory = ReturnType<typeof samlConfigServiceFactory>;
 
 export const samlConfigServiceFactory = ({
   samlConfigDAL,
+  orgBotDAL,
   orgDAL,
   orgMembershipDAL,
   userDAL,
@@ -59,8 +75,7 @@ export const samlConfigServiceFactory = ({
   licenseService,
   tokenService,
   smtpService,
-  identityMetadataDAL,
-  kmsService
+  identityMetadataDAL
 }: TSamlConfigServiceFactoryDep) => {
   const createSamlCfg = async ({
     cert,
@@ -84,18 +99,70 @@ export const samlConfigServiceFactory = ({
           "Failed to create SAML SSO configuration due to plan restriction. Upgrade plan to create SSO configuration."
       });
 
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+    const orgBot = await orgBotDAL.transaction(async (tx) => {
+      const doc = await orgBotDAL.findOne({ orgId }, tx);
+      if (doc) return doc;
+
+      const { privateKey, publicKey } = generateAsymmetricKeyPair();
+      const key = generateSymmetricKey();
+      const {
+        ciphertext: encryptedPrivateKey,
+        iv: privateKeyIV,
+        tag: privateKeyTag,
+        encoding: privateKeyKeyEncoding,
+        algorithm: privateKeyAlgorithm
+      } = infisicalSymmetricEncypt(privateKey);
+      const {
+        ciphertext: encryptedSymmetricKey,
+        iv: symmetricKeyIV,
+        tag: symmetricKeyTag,
+        encoding: symmetricKeyKeyEncoding,
+        algorithm: symmetricKeyAlgorithm
+      } = infisicalSymmetricEncypt(key);
+
+      return orgBotDAL.create(
+        {
+          name: "Infisical org bot",
+          publicKey,
+          privateKeyIV,
+          encryptedPrivateKey,
+          symmetricKeyIV,
+          symmetricKeyTag,
+          encryptedSymmetricKey,
+          symmetricKeyAlgorithm,
+          orgId,
+          privateKeyTag,
+          privateKeyAlgorithm,
+          privateKeyKeyEncoding,
+          symmetricKeyKeyEncoding
+        },
+        tx
+      );
     });
 
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
+    });
+
+    const { ciphertext: encryptedEntryPoint, iv: entryPointIV, tag: entryPointTag } = encryptSymmetric(entryPoint, key);
+    const { ciphertext: encryptedIssuer, iv: issuerIV, tag: issuerTag } = encryptSymmetric(issuer, key);
+    const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
     const samlConfig = await samlConfigDAL.create({
       orgId,
       authProvider,
       isActive,
-      encryptedSamlIssuer: encryptor({ plainText: Buffer.from(issuer) }).cipherTextBlob,
-      encryptedSamlEntryPoint: encryptor({ plainText: Buffer.from(entryPoint) }).cipherTextBlob,
-      encryptedSamlCertificate: encryptor({ plainText: Buffer.from(cert) }).cipherTextBlob
+      encryptedEntryPoint,
+      entryPointIV,
+      entryPointTag,
+      encryptedIssuer,
+      issuerIV,
+      issuerTag,
+      encryptedCert,
+      certIV,
+      certTag
     });
 
     return samlConfig;
@@ -123,21 +190,40 @@ export const samlConfigServiceFactory = ({
       });
 
     const updateQuery: TSamlConfigsUpdate = { authProvider, isActive, lastUsed: null };
-    const { encryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId
+    const orgBot = await orgBotDAL.findOne({ orgId });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot not found for organization with ID '${orgId}'`,
+        name: "OrgBotNotFound"
+      });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
     if (entryPoint !== undefined) {
-      updateQuery.encryptedSamlEntryPoint = encryptor({ plainText: Buffer.from(entryPoint) }).cipherTextBlob;
+      const {
+        ciphertext: encryptedEntryPoint,
+        iv: entryPointIV,
+        tag: entryPointTag
+      } = encryptSymmetric(entryPoint, key);
+      updateQuery.encryptedEntryPoint = encryptedEntryPoint;
+      updateQuery.entryPointIV = entryPointIV;
+      updateQuery.entryPointTag = entryPointTag;
     }
-
     if (issuer !== undefined) {
-      updateQuery.encryptedSamlIssuer = encryptor({ plainText: Buffer.from(issuer) }).cipherTextBlob;
+      const { ciphertext: encryptedIssuer, iv: issuerIV, tag: issuerTag } = encryptSymmetric(issuer, key);
+      updateQuery.encryptedIssuer = encryptedIssuer;
+      updateQuery.issuerIV = issuerIV;
+      updateQuery.issuerTag = issuerTag;
     }
-
     if (cert !== undefined) {
-      updateQuery.encryptedSamlCertificate = encryptor({ plainText: Buffer.from(cert) }).cipherTextBlob;
+      const { ciphertext: encryptedCert, iv: certIV, tag: certTag } = encryptSymmetric(cert, key);
+      updateQuery.encryptedCert = encryptedCert;
+      updateQuery.certIV = certIV;
+      updateQuery.certTag = certTag;
     }
 
     const [ssoConfig] = await samlConfigDAL.update({ orgId }, updateQuery);
@@ -147,14 +233,14 @@ export const samlConfigServiceFactory = ({
   };
 
   const getSaml = async (dto: TGetSamlCfgDTO) => {
-    let samlConfig: TSamlConfigs | undefined;
+    let ssoConfig: TSamlConfigs | undefined;
     if (dto.type === "org") {
-      samlConfig = await samlConfigDAL.findOne({ orgId: dto.orgId });
-      if (!samlConfig) return;
+      ssoConfig = await samlConfigDAL.findOne({ orgId: dto.orgId });
+      if (!ssoConfig) return;
     } else if (dto.type === "orgSlug") {
       const org = await orgDAL.findOne({ slug: dto.orgSlug });
       if (!org) return;
-      samlConfig = await samlConfigDAL.findOne({ orgId: org.id });
+      ssoConfig = await samlConfigDAL.findOne({ orgId: org.id });
     } else if (dto.type === "ssoId") {
       // TODO:
       // We made this change because saml config ids were not moved over during the migration
@@ -173,51 +259,81 @@ export const samlConfigServiceFactory = ({
 
       const id = UUIDToMongoId[dto.id] ?? dto.id;
 
-      samlConfig = await samlConfigDAL.findById(id);
+      ssoConfig = await samlConfigDAL.findById(id);
     }
-    if (!samlConfig) throw new NotFoundError({ message: `Failed to find SSO data` });
+    if (!ssoConfig) throw new NotFoundError({ message: `Failed to find SSO data` });
 
     // when dto is type id means it's internally used
     if (dto.type === "org") {
       const { permission } = await permissionService.getOrgPermission(
         dto.actor,
         dto.actorId,
-        samlConfig.orgId,
+        ssoConfig.orgId,
         dto.actorAuthMethod,
         dto.actorOrgId
       );
       ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Sso);
     }
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: samlConfig.orgId
+    const {
+      entryPointTag,
+      entryPointIV,
+      encryptedEntryPoint,
+      certTag,
+      certIV,
+      encryptedCert,
+      issuerTag,
+      issuerIV,
+      encryptedIssuer
+    } = ssoConfig;
+
+    const orgBot = await orgBotDAL.findOne({ orgId: ssoConfig.orgId });
+    if (!orgBot)
+      throw new NotFoundError({
+        message: `Organization bot not found in organization with ID '${ssoConfig.orgId}'`,
+        name: "OrgBotNotFound"
+      });
+    const key = infisicalSymmetricDecrypt({
+      ciphertext: orgBot.encryptedSymmetricKey,
+      iv: orgBot.symmetricKeyIV,
+      tag: orgBot.symmetricKeyTag,
+      keyEncoding: orgBot.symmetricKeyKeyEncoding as SecretKeyEncoding
     });
 
     let entryPoint = "";
-    if (samlConfig.encryptedSamlEntryPoint) {
-      entryPoint = decryptor({ cipherTextBlob: samlConfig.encryptedSamlEntryPoint }).toString();
+    if (encryptedEntryPoint && entryPointIV && entryPointTag) {
+      entryPoint = decryptSymmetric({
+        ciphertext: encryptedEntryPoint,
+        key,
+        tag: entryPointTag,
+        iv: entryPointIV
+      });
     }
 
     let issuer = "";
-    if (samlConfig.encryptedSamlIssuer) {
-      issuer = decryptor({ cipherTextBlob: samlConfig.encryptedSamlIssuer }).toString();
+    if (encryptedIssuer && issuerTag && issuerIV) {
+      issuer = decryptSymmetric({
+        key,
+        tag: issuerTag,
+        iv: issuerIV,
+        ciphertext: encryptedIssuer
+      });
     }
 
     let cert = "";
-    if (samlConfig.encryptedSamlCertificate) {
-      cert = decryptor({ cipherTextBlob: samlConfig.encryptedSamlCertificate }).toString();
+    if (encryptedCert && certTag && certIV) {
+      cert = decryptSymmetric({ key, tag: certTag, iv: certIV, ciphertext: encryptedCert });
     }
 
     return {
-      id: samlConfig.id,
-      organization: samlConfig.orgId,
-      orgId: samlConfig.orgId,
-      authProvider: samlConfig.authProvider,
-      isActive: samlConfig.isActive,
+      id: ssoConfig.id,
+      organization: ssoConfig.orgId,
+      orgId: ssoConfig.orgId,
+      authProvider: ssoConfig.authProvider,
+      isActive: ssoConfig.isActive,
       entryPoint,
       issuer,
       cert,
-      lastUsed: samlConfig.lastUsed
+      lastUsed: ssoConfig.lastUsed
     };
   };
 

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -5,9 +5,13 @@ import {
   IAMClient
 } from "@aws-sdk/client-iam";
 
-import { SecretType } from "@app/db/schemas";
+import { SecretKeyEncoding, SecretType } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
-import { encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto/encryption";
+import {
+  encryptSymmetric128BitHexKeyUTF8,
+  infisicalSymmetricDecrypt,
+  infisicalSymmetricEncypt
+} from "@app/lib/crypto/encryption";
 import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
 import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
@@ -131,15 +135,20 @@ export const secretRotationQueueFactory = ({
 
       // deep copy
       const provider = JSON.parse(JSON.stringify(rotationProvider)) as TSecretRotationProviderTemplate;
-      const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
-        await kmsService.createCipherPairWithDataKey({
-          type: KmsDataKey.SecretManager,
-          projectId: secretRotation.projectId
-        });
 
-      const decryptedData = secretManagerDecryptor({
-        cipherTextBlob: secretRotation.encryptedRotationData
-      }).toString();
+      // now get the encrypted variable values
+      // in includes the inputs, the previous outputs
+      // internal mapping variables etc
+      const { encryptedDataTag, encryptedDataIV, encryptedData, keyEncoding } = secretRotation;
+      if (!encryptedDataTag || !encryptedDataIV || !encryptedData || !keyEncoding) {
+        throw new DisableRotationErrors({ message: "No inputs found" });
+      }
+      const decryptedData = infisicalSymmetricDecrypt({
+        keyEncoding: keyEncoding as SecretKeyEncoding,
+        ciphertext: encryptedData,
+        iv: encryptedDataIV,
+        tag: encryptedDataTag
+      });
 
       const variables = JSON.parse(decryptedData) as TSecretRotationEncData;
       // rotation set cycle
@@ -294,9 +303,11 @@ export const secretRotationQueueFactory = ({
         outputs: newCredential.outputs,
         internal: newCredential.internal
       });
-      const encryptedRotationData = secretManagerEncryptor({
-        plainText: Buffer.from(JSON.stringify(variables))
-      }).cipherTextBlob;
+      const encVarData = infisicalSymmetricEncypt(JSON.stringify(variables));
+      const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
+        type: KmsDataKey.SecretManager,
+        projectId: secretRotation.projectId
+      });
 
       const numberOfSecretsRotated = rotationOutputs.length;
       if (shouldUseSecretV2Bridge) {
@@ -312,7 +323,11 @@ export const secretRotationQueueFactory = ({
           await secretRotationDAL.updateById(
             rotationId,
             {
-              encryptedRotationData,
+              encryptedData: encVarData.ciphertext,
+              encryptedDataIV: encVarData.iv,
+              encryptedDataTag: encVarData.tag,
+              keyEncoding: encVarData.encoding,
+              algorithm: encVarData.algorithm,
               lastRotatedAt: new Date(),
               statusMessage: "Rotated successfull",
               status: "success"
@@ -356,7 +371,11 @@ export const secretRotationQueueFactory = ({
           await secretRotationDAL.updateById(
             rotationId,
             {
-              encryptedRotationData,
+              encryptedData: encVarData.ciphertext,
+              encryptedDataIV: encVarData.iv,
+              encryptedDataTag: encVarData.tag,
+              keyEncoding: encVarData.encoding,
+              algorithm: encVarData.algorithm,
               lastRotatedAt: new Date(),
               statusMessage: "Rotated successfull",
               status: "success"

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -2,11 +2,9 @@ import { ForbiddenError, subject } from "@casl/ability";
 import Ajv from "ajv";
 
 import { ActionProjectType, ProjectVersion, TableName } from "@app/db/schemas";
-import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto/encryption";
+import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TSecretDALFactory } from "@app/services/secret/secret-dal";
@@ -32,7 +30,6 @@ type TSecretRotationServiceFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   secretRotationQueue: TSecretRotationQueueFactory;
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 };
 
 export type TSecretRotationServiceFactory = ReturnType<typeof secretRotationServiceFactory>;
@@ -47,8 +44,7 @@ export const secretRotationServiceFactory = ({
   folderDAL,
   secretDAL,
   projectBotService,
-  secretV2BridgeDAL,
-  kmsService
+  secretV2BridgeDAL
 }: TSecretRotationServiceFactoryDep) => {
   const getProviderTemplates = async ({
     actor,
@@ -160,11 +156,7 @@ export const secretRotationServiceFactory = ({
       inputs: formattedInputs,
       creds: []
     };
-    const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.SecretManager,
-      projectId
-    });
-
+    const encData = infisicalSymmetricEncypt(JSON.stringify(unencryptedData));
     const secretRotation = await secretRotationDAL.transaction(async (tx) => {
       const doc = await secretRotationDAL.create(
         {
@@ -172,8 +164,11 @@ export const secretRotationServiceFactory = ({
           secretPath,
           interval,
           envId: folder.envId,
-          encryptedRotationData: secretManagerEncryptor({ plainText: Buffer.from(JSON.stringify(unencryptedData)) })
-            .cipherTextBlob
+          encryptedDataTag: encData.tag,
+          encryptedDataIV: encData.iv,
+          encryptedData: encData.ciphertext,
+          algorithm: encData.algorithm,
+          keyEncoding: encData.encoding
         },
         tx
       );

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -1,5 +1,3 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access,@typescript-eslint/no-unsafe-argument */
-// akhilmhdh: I did this, quite strange bug with eslint. Everything do have a type stil has this error
 import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas";

backend/src/ee/services/secret-snapshot/snapshot-dal.ts

@@ -1,4 +1,4 @@
-/* eslint-disable no-await-in-loop,@typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access,@typescript-eslint/no-unsafe-argument */
+/* eslint-disable no-await-in-loop */
 import { Knex } from "knex";
 import { z } from "zod";
 

backend/src/keystore/keystore.ts

@@ -2,12 +2,6 @@ import { Redis } from "ioredis";
 
 import { Redlock, Settings } from "@app/lib/red-lock";
 
-export enum PgSqlLock {
-  BootUpMigration = 2023,
-  SuperAdminInit = 2024,
-  KmsRootKeyInit = 2025
-}
-
 export type TKeyStoreFactory = ReturnType<typeof keyStoreFactory>;
 
 // all the key prefixes used must be set here to avoid conflict

backend/src/keystore/memory.ts

@@ -1,38 +0,0 @@
-import { Lock } from "@app/lib/red-lock";
-
-import { TKeyStoreFactory } from "./keystore";
-
-export const inMemoryKeyStore = (): TKeyStoreFactory => {
-  const store: Record<string, string | number | Buffer> = {};
-
-  return {
-    setItem: async (key, value) => {
-      store[key] = value;
-      return "OK";
-    },
-    setItemWithExpiry: async (key, value) => {
-      store[key] = value;
-      return "OK";
-    },
-    deleteItem: async (key) => {
-      delete store[key];
-      return 1;
-    },
-    getItem: async (key) => {
-      const value = store[key];
-      if (typeof value === "string") {
-        return value;
-      }
-      return null;
-    },
-    incrementBy: async () => {
-      return 1;
-    },
-    acquireLock: () => {
-      return Promise.resolve({
-        release: () => {}
-      }) as Promise<Lock>;
-    },
-    waitTillReady: async () => {}
-  };
-};

backend/src/lib/api-docs/constants.ts

@@ -688,9 +688,7 @@ export const RAW_SECRETS = {
     environment: "The slug of the environment to list secrets from.",
     secretPath: "The secret path to list secrets from.",
     includeImports: "Weather to include imported secrets or not.",
-    tagSlugs: "The comma separated tag slugs to filter secrets.",
-    metadataFilter:
-      "The secret metadata key-value pairs to filter secrets by. When querying for multiple metadata pairs, the query is treated as an AND operation. Secret metadata format is key=value1,value=value2|key=value3,value=value4."
+    tagSlugs: "The comma separated tag slugs to filter secrets."
   },
   CREATE: {
     secretName: "The name of the secret to create.",
@@ -1593,13 +1591,6 @@ export const KMS = {
     orderDirection: "The direction to order keys in.",
     search: "The text string to filter key names by."
   },
-  GET_KEY_BY_ID: {
-    keyId: "The ID of the KMS key to retrieve."
-  },
-  GET_KEY_BY_NAME: {
-    keyName: "The name of the KMS key to retrieve.",
-    projectId: "The ID of the project the key belongs to."
-  },
   ENCRYPT: {
     keyId: "The ID of the key to encrypt the data with.",
     plaintext: "The plaintext to be encrypted (base64 encoded)."
@@ -1728,26 +1719,11 @@ export const SecretSyncs = {
       REGION: "The AWS region to sync secrets to.",
       PATH: "The Parameter Store path to sync secrets to."
     },
-    AWS_SECRETS_MANAGER: {
-      REGION: "The AWS region to sync secrets to.",
-      MAPPING_BEHAVIOR:
-        "How secrets from Infisical should be mapped to AWS Secrets Manager; one-to-one or many-to-one.",
-      SECRET_NAME: "The secret name in AWS Secrets Manager to sync to when using mapping behavior many-to-one."
-    },
     GITHUB: {
       ORG: "The name of the GitHub organization.",
       OWNER: "The name of the GitHub account owner of the repository.",
       REPO: "The name of the GitHub repository.",
       ENV: "The name of the GitHub environment."
-    },
-    AZURE_KEY_VAULT: {
-      VAULT_BASE_URL:
-        "The base URL of the Azure Key Vault to sync secrets to. Example: https://example.vault.azure.net/"
-    },
-    AZURE_APP_CONFIGURATION: {
-      CONFIGURATION_URL:
-        "The URL of the Azure App Configuration to sync secrets to. Example: https://example.azconfig.io/",
-      LABEL: "An optional label to assign to secrets created in Azure App Configuration."
     }
   }
 };

backend/src/lib/config/env.ts

@@ -204,10 +204,6 @@ const envSchema = z
     // gcp app
     INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL: zpStr(z.string().optional()),
 
-    // azure app
-    INF_APP_CONNECTION_AZURE_CLIENT_ID: zpStr(z.string().optional()),
-    INF_APP_CONNECTION_AZURE_CLIENT_SECRET: zpStr(z.string().optional()),
-
     /* CORS ----------------------------------------------------------------------------- */
 
     CORS_ALLOWED_ORIGINS: zpStr(
@@ -258,8 +254,7 @@ const envSchema = z
     SECRET_SCANNING_ORG_WHITELIST: data.SECRET_SCANNING_ORG_WHITELIST?.split(",")
   }));
 
-export type TEnvConfig = Readonly<z.infer<typeof envSchema>>;
-let envCfg: TEnvConfig;
+let envCfg: Readonly<z.infer<typeof envSchema>>;
 
 export const getConfig = () => envCfg;
 // cannot import singleton logger directly as it needs config to load various transport

backend/src/lib/error-codes/database.ts

@@ -1,4 +0,0 @@
-export enum DatabaseErrorCode {
-  ForeignKeyViolation = "23503",
-  UniqueViolation = "23505"
-}

backend/src/lib/error-codes/index.ts

@@ -1 +0,0 @@
-export * from "./database";

backend/src/lib/knex/index.ts

@@ -7,7 +7,6 @@ import { buildDynamicKnexQuery, TKnexDynamicOperator } from "./dynamic";
 
 export * from "./connection";
 export * from "./join";
-export * from "./prependTableNameToFindFilter";
 export * from "./select";
 
 export const withTransaction = <K extends object>(db: Knex, dal: K) => ({

backend/src/lib/knex/prependTableNameToFindFilter.ts

@@ -1,13 +0,0 @@
-import { TableName } from "@app/db/schemas";
-import { buildFindFilter } from "@app/lib/knex/index";
-
-type TFindFilterParameters = Parameters<typeof buildFindFilter<object>>[0];
-
-export const prependTableNameToFindFilter = (tableName: TableName, filterObj: object): TFindFilterParameters =>
-  Object.fromEntries(
-    Object.entries(filterObj).map(([key, value]) =>
-      key.startsWith("$")
-        ? [key, prependTableNameToFindFilter(tableName, value as object)]
-        : [`${tableName}.${key}`, value]
-    )
-  );

backend/src/lib/logger/logger.ts

@@ -98,7 +98,7 @@ const extractReqId = () => {
   }
 };
 
-export const initLogger = () => {
+export const initLogger = async () => {
   const cfg = loggerConfig.parse(process.env);
   const targets: pino.TransportMultiOptions["targets"][number][] = [
     {

backend/src/main.ts

@@ -2,13 +2,14 @@ import "./lib/telemetry/instrumentation";
 
 import dotenv from "dotenv";
 import { Redis } from "ioredis";
+import path from "path";
 
 import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 
-import { runMigrations } from "./auto-start-migrations";
 import { initAuditLogDbConnection, initDbConnection } from "./db";
 import { keyStoreFactory } from "./keystore/keystore";
-import { formatSmtpConfig, initEnvConfig } from "./lib/config/env";
+import { formatSmtpConfig, initEnvConfig, IS_PACKAGED } from "./lib/config/env";
+import { isMigrationMode } from "./lib/fn";
 import { initLogger } from "./lib/logger";
 import { queueServiceFactory } from "./queue";
 import { main } from "./server/app";
@@ -18,53 +19,58 @@ import { smtpServiceFactory } from "./services/smtp/smtp-service";
 dotenv.config();
 
 const run = async () => {
-  const logger = initLogger();
-  const envConfig = initEnvConfig(logger);
+  const logger = await initLogger();
+  const appCfg = initEnvConfig(logger);
 
   const db = initDbConnection({
-    dbConnectionUri: envConfig.DB_CONNECTION_URI,
-    dbRootCert: envConfig.DB_ROOT_CERT,
-    readReplicas: envConfig.DB_READ_REPLICAS?.map((el) => ({
+    dbConnectionUri: appCfg.DB_CONNECTION_URI,
+    dbRootCert: appCfg.DB_ROOT_CERT,
+    readReplicas: appCfg.DB_READ_REPLICAS?.map((el) => ({
       dbRootCert: el.DB_ROOT_CERT,
       dbConnectionUri: el.DB_CONNECTION_URI
     }))
   });
 
-  const auditLogDb = envConfig.AUDIT_LOGS_DB_CONNECTION_URI
+  const auditLogDb = appCfg.AUDIT_LOGS_DB_CONNECTION_URI
     ? initAuditLogDbConnection({
-        dbConnectionUri: envConfig.AUDIT_LOGS_DB_CONNECTION_URI,
-        dbRootCert: envConfig.AUDIT_LOGS_DB_ROOT_CERT
+        dbConnectionUri: appCfg.AUDIT_LOGS_DB_CONNECTION_URI,
+        dbRootCert: appCfg.AUDIT_LOGS_DB_ROOT_CERT
       })
     : undefined;
 
-  await runMigrations({ applicationDb: db, auditLogDb, logger });
+  // Case: App is running in packaged mode (binary), and migration mode is enabled.
+  // Run the migrations and exit the process after completion.
+  if (IS_PACKAGED && isMigrationMode()) {
+    try {
+      logger.info("Running Postgres migrations..");
+      await db.migrate.latest({
+        directory: path.join(__dirname, "./db/migrations")
+      });
+      logger.info("Postgres migrations completed");
+    } catch (err) {
+      logger.error(err, "Failed to run migrations");
+      process.exit(1);
+    }
+
+    process.exit(0);
+  }
 
   const smtp = smtpServiceFactory(formatSmtpConfig());
 
-  const queue = queueServiceFactory(envConfig.REDIS_URL, {
-    dbConnectionUrl: envConfig.DB_CONNECTION_URI,
-    dbRootCert: envConfig.DB_ROOT_CERT
+  const queue = queueServiceFactory(appCfg.REDIS_URL, {
+    dbConnectionUrl: appCfg.DB_CONNECTION_URI,
+    dbRootCert: appCfg.DB_ROOT_CERT
   });
 
   await queue.initialize();
 
-  const keyStore = keyStoreFactory(envConfig.REDIS_URL);
-  const redis = new Redis(envConfig.REDIS_URL);
+  const keyStore = keyStoreFactory(appCfg.REDIS_URL);
+  const redis = new Redis(appCfg.REDIS_URL);
 
-  const hsmModule = initializeHsmModule(envConfig);
+  const hsmModule = initializeHsmModule();
   hsmModule.initialize();
 
-  const server = await main({
-    db,
-    auditLogDb,
-    hsmModule: hsmModule.getModule(),
-    smtp,
-    logger,
-    queue,
-    keyStore,
-    redis,
-    envConfig
-  });
+  const server = await main({ db, auditLogDb, hsmModule: hsmModule.getModule(), smtp, logger, queue, keyStore, redis });
   const bootstrap = await bootstrapCheck({ db });
 
   // eslint-disable-next-line
@@ -84,8 +90,8 @@ const run = async () => {
   });
 
   await server.listen({
-    port: envConfig.PORT,
-    host: envConfig.HOST,
+    port: appCfg.PORT,
+    host: appCfg.HOST,
     listenTextResolver: (address) => {
       void bootstrap();
       return address;

backend/src/server/app.ts

@@ -17,7 +17,7 @@ import { Knex } from "knex";
 
 import { HsmModule } from "@app/ee/services/hsm/hsm-types";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { getConfig, IS_PACKAGED, TEnvConfig } from "@app/lib/config/env";
+import { getConfig, IS_PACKAGED } from "@app/lib/config/env";
 import { CustomLogger } from "@app/lib/logger/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TQueueServiceFactory } from "@app/queue";
@@ -43,11 +43,10 @@ type TMain = {
   keyStore: TKeyStoreFactory;
   hsmModule: HsmModule;
   redis: Redis;
-  envConfig: TEnvConfig;
 };
 
 // Run the server!
-export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, keyStore, redis, envConfig }: TMain) => {
+export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, keyStore, redis }: TMain) => {
   const appCfg = getConfig();
 
   const server = fastify({
@@ -128,7 +127,7 @@ export const main = async ({ db, hsmModule, auditLogDb, smtp, logger, queue, key
       })
     });
 
-    await server.register(registerRoutes, { smtp, queue, db, auditLogDb, keyStore, hsmModule, envConfig });
+    await server.register(registerRoutes, { smtp, queue, db, auditLogDb, keyStore, hsmModule });
 
     await server.register(registerServeUI, {
       standaloneMode: appCfg.STANDALONE_MODE || IS_PACKAGED,

backend/src/server/routes/index.ts

@@ -85,7 +85,7 @@ import { sshCertificateTemplateServiceFactory } from "@app/ee/services/ssh-certi
 import { trustedIpDALFactory } from "@app/ee/services/trusted-ip/trusted-ip-dal";
 import { trustedIpServiceFactory } from "@app/ee/services/trusted-ip/trusted-ip-service";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { getConfig, TEnvConfig } from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { TQueueServiceFactory } from "@app/queue";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { accessTokenQueueServiceFactory } from "@app/services/access-token-queue/access-token-queue";
@@ -244,8 +244,7 @@ export const registerRoutes = async (
     hsmModule,
     smtp: smtpService,
     queue: queueService,
-    keyStore,
-    envConfig
+    keyStore
   }: {
     auditLogDb?: Knex;
     db: Knex;
@@ -253,7 +252,6 @@ export const registerRoutes = async (
     smtp: TSmtpService;
     queue: TQueueServiceFactory;
     keyStore: TKeyStoreFactory;
-    envConfig: TEnvConfig;
   }
 ) => {
   const appCfg = getConfig();
@@ -393,8 +391,7 @@ export const registerRoutes = async (
   const licenseService = licenseServiceFactory({ permissionService, orgDAL, licenseDAL, keyStore });
 
   const hsmService = hsmServiceFactory({
-    hsmModule,
-    envConfig
+    hsmModule
   });
 
   const kmsService = kmsServiceFactory({
@@ -404,8 +401,7 @@ export const registerRoutes = async (
     internalKmsDAL,
     orgDAL,
     projectDAL,
-    hsmService,
-    envConfig
+    hsmService
   });
 
   const externalKmsService = externalKmsServiceFactory({
@@ -451,6 +447,7 @@ export const registerRoutes = async (
   const samlService = samlConfigServiceFactory({
     identityMetadataDAL,
     permissionService,
+    orgBotDAL,
     orgDAL,
     orgMembershipDAL,
     userDAL,
@@ -458,8 +455,7 @@ export const registerRoutes = async (
     samlConfigDAL,
     licenseService,
     tokenService,
-    smtpService,
-    kmsService
+    smtpService
   });
   const groupService = groupServiceFactory({
     userDAL,
@@ -471,8 +467,7 @@ export const registerRoutes = async (
     projectBotDAL,
     projectKeyDAL,
     permissionService,
-    licenseService,
-    oidcConfigDAL
+    licenseService
   });
   const groupProjectService = groupProjectServiceFactory({
     groupDAL,
@@ -510,6 +505,7 @@ export const registerRoutes = async (
     ldapGroupMapDAL,
     orgDAL,
     orgMembershipDAL,
+    orgBotDAL,
     groupDAL,
     groupProjectDAL,
     projectKeyDAL,
@@ -521,8 +517,7 @@ export const registerRoutes = async (
     permissionService,
     licenseService,
     tokenService,
-    smtpService,
-    kmsService
+    smtpService
   });
 
   const telemetryService = telemetryServiceFactory({
@@ -853,8 +848,7 @@ export const registerRoutes = async (
     secretVersionTagDAL,
     secretVersionV2BridgeDAL,
     secretVersionTagV2BridgeDAL,
-    resourceMetadataDAL,
-    appConnectionDAL
+    resourceMetadataDAL
   });
 
   const secretQueueService = secretQueueFactory({
@@ -973,8 +967,7 @@ export const registerRoutes = async (
     permissionService,
     webhookDAL,
     projectEnvDAL,
-    projectDAL,
-    kmsService
+    projectDAL
   });
 
   const secretTagService = secretTagServiceFactory({ secretTagDAL, permissionService });
@@ -1154,8 +1147,7 @@ export const registerRoutes = async (
     secretDAL,
     folderDAL,
     projectBotService,
-    secretV2BridgeDAL,
-    kmsService
+    secretV2BridgeDAL
   });
 
   const integrationService = integrationServiceFactory({
@@ -1244,9 +1236,9 @@ export const registerRoutes = async (
     identityKubernetesAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
+    orgBotDAL,
     permissionService,
-    licenseService,
-    kmsService
+    licenseService
   });
   const identityGcpAuthService = identityGcpAuthServiceFactory({
     identityGcpAuthDAL,
@@ -1278,7 +1270,7 @@ export const registerRoutes = async (
     identityAccessTokenDAL,
     permissionService,
     licenseService,
-    kmsService
+    orgBotDAL
   });
 
   const identityJwtAuthService = identityJwtAuthServiceFactory({
@@ -1295,9 +1287,7 @@ export const registerRoutes = async (
     queueService,
     dynamicSecretLeaseDAL,
     dynamicSecretProviders,
-    dynamicSecretDAL,
-    folderDAL,
-    kmsService
+    dynamicSecretDAL
   });
   const dynamicSecretService = dynamicSecretServiceFactory({
     projectDAL,
@@ -1307,8 +1297,7 @@ export const registerRoutes = async (
     dynamicSecretProviders,
     folderDAL,
     permissionService,
-    licenseService,
-    kmsService
+    licenseService
   });
   const dynamicSecretLeaseService = dynamicSecretLeaseServiceFactory({
     projectDAL,
@@ -1318,8 +1307,7 @@ export const registerRoutes = async (
     dynamicSecretLeaseDAL,
     dynamicSecretProviders,
     folderDAL,
-    licenseService,
-    kmsService
+    licenseService
   });
   const dailyResourceCleanUp = dailyResourceCleanUpQueueServiceFactory({
     auditLogDAL,
@@ -1347,16 +1335,9 @@ export const registerRoutes = async (
     licenseService,
     tokenService,
     smtpService,
-    kmsService,
+    orgBotDAL,
     permissionService,
-    oidcConfigDAL,
-    projectBotDAL,
-    projectKeyDAL,
-    projectDAL,
-    userGroupMembershipDAL,
-    groupProjectDAL,
-    groupDAL,
-    auditLogService
+    oidcConfigDAL
   });
 
   const userEngagementService = userEngagementServiceFactory({

backend/src/server/routes/sanitizedSchema/directory-config.ts

@@ -1,42 +0,0 @@
-import { LdapConfigsSchema, OidcConfigsSchema, SamlConfigsSchema } from "@app/db/schemas";
-
-export const SanitizedSamlConfigSchema = SamlConfigsSchema.pick({
-  id: true,
-  orgId: true,
-  isActive: true,
-  lastUsed: true,
-  createdAt: true,
-  updatedAt: true,
-  authProvider: true
-});
-
-export const SanitizedLdapConfigSchema = LdapConfigsSchema.pick({
-  updatedAt: true,
-  createdAt: true,
-  isActive: true,
-  orgId: true,
-  id: true,
-  url: true,
-  searchBase: true,
-  searchFilter: true,
-  groupSearchBase: true,
-  uniqueUserAttribute: true,
-  groupSearchFilter: true
-});
-
-export const SanitizedOidcConfigSchema = OidcConfigsSchema.pick({
-  id: true,
-  orgId: true,
-  isActive: true,
-  createdAt: true,
-  updatedAt: true,
-  lastUsed: true,
-  issuer: true,
-  jwksUri: true,
-  discoveryURL: true,
-  tokenEndpoint: true,
-  userinfoEndpoint: true,
-  configurationType: true,
-  allowedEmailDomains: true,
-  authorizationEndpoint: true
-});

backend/src/server/routes/sanitizedSchemas.ts

@@ -11,7 +11,7 @@ import {
 } from "@app/db/schemas";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 
-import { UnpackedPermissionSchema } from "./sanitizedSchema/permission";
+import { UnpackedPermissionSchema } from "./santizedSchemas/permission";
 
 // sometimes the return data must be santizied to avoid leaking important values
 // always prefer pick over omit in zod
@@ -110,6 +110,7 @@ export const secretRawSchema = z.object({
   secretReminderNote: z.string().nullable().optional(),
   secretReminderRepeatDays: z.number().nullable().optional(),
   skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
+  metadata: z.unknown().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date()
 });
@@ -201,11 +202,10 @@ export const SanitizedRoleSchemaV1 = ProjectRolesSchema.extend({
 });
 
 export const SanitizedDynamicSecretSchema = DynamicSecretsSchema.omit({
-  encryptedInput: true,
-  keyEncoding: true,
-  inputCiphertext: true,
   inputIV: true,
   inputTag: true,
+  inputCiphertext: true,
+  keyEncoding: true,
   algorithm: true
 });
 

backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts

@@ -73,13 +73,7 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
       description: `List the ${appName} Connections the current user has permission to establish connections with.`,
       response: {
         200: z.object({
-          appConnections: z
-            .object({
-              app: z.literal(app),
-              name: z.string(),
-              id: z.string().uuid()
-            })
-            .array()
+          appConnections: z.object({ app: z.literal(app), name: z.string(), id: z.string().uuid() }).array()
         })
       }
     },

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -4,14 +4,6 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
-import {
-  AzureAppConfigurationConnectionListItemSchema,
-  SanitizedAzureAppConfigurationConnectionSchema
-} from "@app/services/app-connection/azure-app-configuration";
-import {
-  AzureKeyVaultConnectionListItemSchema,
-  SanitizedAzureKeyVaultConnectionSchema
-} from "@app/services/app-connection/azure-key-vault";
 import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
 import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -20,17 +12,13 @@ import { AuthMode } from "@app/services/auth/auth-type";
 const SanitizedAppConnectionSchema = z.union([
   ...SanitizedAwsConnectionSchema.options,
   ...SanitizedGitHubConnectionSchema.options,
-  ...SanitizedGcpConnectionSchema.options,
-  ...SanitizedAzureKeyVaultConnectionSchema.options,
-  ...SanitizedAzureAppConfigurationConnectionSchema.options
+  ...SanitizedGcpConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   AwsConnectionListItemSchema,
   GitHubConnectionListItemSchema,
-  GcpConnectionListItemSchema,
-  AzureKeyVaultConnectionListItemSchema,
-  AzureAppConfigurationConnectionListItemSchema
+  GcpConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/azure-app-configuration-connection-router.ts

@@ -1,18 +0,0 @@
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  CreateAzureAppConfigurationConnectionSchema,
-  SanitizedAzureAppConfigurationConnectionSchema,
-  UpdateAzureAppConfigurationConnectionSchema
-} from "@app/services/app-connection/azure-app-configuration";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerAzureAppConfigurationConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.AzureAppConfiguration,
-    server,
-    sanitizedResponseSchema: SanitizedAzureAppConfigurationConnectionSchema,
-    createSchema: CreateAzureAppConfigurationConnectionSchema,
-    updateSchema: UpdateAzureAppConfigurationConnectionSchema
-  });
-};

backend/src/server/routes/v1/app-connection-routers/azure-key-vault-connection-router.ts

@@ -1,18 +0,0 @@
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  CreateAzureKeyVaultConnectionSchema,
-  SanitizedAzureKeyVaultConnectionSchema,
-  UpdateAzureKeyVaultConnectionSchema
-} from "@app/services/app-connection/azure-key-vault";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerAzureKeyVaultConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.AzureKeyVault,
-    server,
-    sanitizedResponseSchema: SanitizedAzureKeyVaultConnectionSchema,
-    createSchema: CreateAzureKeyVaultConnectionSchema,
-    updateSchema: UpdateAzureKeyVaultConnectionSchema
-  });
-};

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -1,8 +1,6 @@
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 
 import { registerAwsConnectionRouter } from "./aws-connection-router";
-import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
-import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
 import { registerGcpConnectionRouter } from "./gcp-connection-router";
 import { registerGitHubConnectionRouter } from "./github-connection-router";
 
@@ -12,7 +10,5 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
   {
     [AppConnection.AWS]: registerAwsConnectionRouter,
     [AppConnection.GitHub]: registerGitHubConnectionRouter,
-    [AppConnection.GCP]: registerGcpConnectionRouter,
-    [AppConnection.AzureKeyVault]: registerAzureKeyVaultConnectionRouter,
-    [AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter
+    [AppConnection.GCP]: registerGcpConnectionRouter
   };

backend/src/server/routes/v1/cmek-router.ts

@@ -15,10 +15,6 @@ import { CmekOrderBy } from "@app/services/cmek/cmek-types";
 const keyNameSchema = slugSchema({ min: 1, max: 32, field: "Name" });
 const keyDescriptionSchema = z.string().trim().max(500).optional();
 
-const CmekSchema = KmsKeysSchema.merge(InternalKmsSchema.pick({ version: true, encryptionAlgorithm: true })).omit({
-  isReserved: true
-});
-
 const base64Schema = z.string().superRefine((val, ctx) => {
   if (!isBase64(val)) {
     ctx.addIssue({
@@ -57,7 +53,7 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          key: CmekSchema
+          key: KmsKeysSchema
         })
       }
     },
@@ -110,7 +106,7 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          key: CmekSchema
+          key: KmsKeysSchema
         })
       }
     },
@@ -154,7 +150,7 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          key: CmekSchema
+          key: KmsKeysSchema
         })
       }
     },
@@ -205,7 +201,7 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          keys: CmekSchema.array(),
+          keys: KmsKeysSchema.merge(InternalKmsSchema.pick({ version: true, encryptionAlgorithm: true })).array(),
           totalCount: z.number()
         })
       }
@@ -234,92 +230,6 @@ export const registerCmekRouter = async (server: FastifyZodProvider) => {
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/keys/:keyId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      description: "Get KMS key by ID",
-      params: z.object({
-        keyId: z.string().uuid().describe(KMS.GET_KEY_BY_ID.keyId)
-      }),
-      response: {
-        200: z.object({
-          key: CmekSchema
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        params: { keyId },
-        permission
-      } = req;
-
-      const key = await server.services.cmek.findCmekById(keyId, permission);
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: key.projectId!,
-        event: {
-          type: EventType.GET_CMEK,
-          metadata: {
-            keyId: key.id
-          }
-        }
-      });
-
-      return { key };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/keys/key-name/:keyName",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      description: "Get KMS key by Name",
-      params: z.object({
-        keyName: slugSchema({ field: "Key name" }).describe(KMS.GET_KEY_BY_NAME.keyName)
-      }),
-      querystring: z.object({
-        projectId: z.string().min(1, "Project ID is required").describe(KMS.GET_KEY_BY_NAME.projectId)
-      }),
-      response: {
-        200: z.object({
-          key: CmekSchema
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        params: { keyName },
-        query: { projectId },
-        permission
-      } = req;
-
-      const key = await server.services.cmek.findCmekByName(keyName, projectId, permission);
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: key.projectId!,
-        event: {
-          type: EventType.GET_CMEK,
-          metadata: {
-            keyId: key.id
-          }
-        }
-      });
-
-      return { key };
-    }
-  });
-
   // encrypt data
   server.route({
     method: "POST",

backend/src/server/routes/v1/identity-kubernetes-auth-router.ts

@@ -8,19 +8,13 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
 
-const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.pick({
-  id: true,
-  accessTokenTTL: true,
-  accessTokenMaxTTL: true,
-  accessTokenNumUsesLimit: true,
-  accessTokenTrustedIps: true,
-  createdAt: true,
-  updatedAt: true,
-  identityId: true,
-  kubernetesHost: true,
-  allowedNamespaces: true,
-  allowedNames: true,
-  allowedAudience: true
+const IdentityKubernetesAuthResponseSchema = IdentityKubernetesAuthsSchema.omit({
+  encryptedCaCert: true,
+  caCertIV: true,
+  caCertTag: true,
+  encryptedTokenReviewerJwt: true,
+  tokenReviewerJwtIV: true,
+  tokenReviewerJwtTag: true
 }).extend({
   caCert: z.string(),
   tokenReviewerJwt: z.string()

backend/src/server/routes/v1/identity-oidc-auth-router.ts

@@ -12,20 +12,10 @@ import {
   validateOidcBoundClaimsField
 } from "@app/services/identity-oidc-auth/identity-oidc-auth-validators";
 
-const IdentityOidcAuthResponseSchema = IdentityOidcAuthsSchema.pick({
-  id: true,
-  accessTokenTTL: true,
-  accessTokenMaxTTL: true,
-  accessTokenNumUsesLimit: true,
-  accessTokenTrustedIps: true,
-  identityId: true,
-  oidcDiscoveryUrl: true,
-  boundIssuer: true,
-  boundAudiences: true,
-  boundClaims: true,
-  boundSubject: true,
-  createdAt: true,
-  updatedAt: true
+const IdentityOidcAuthResponseSchema = IdentityOidcAuthsSchema.omit({
+  encryptedCaCert: true,
+  caCertIV: true,
+  caCertTag: true
 }).extend({
   caCert: z.string()
 });

backend/src/server/routes/v1/secret-sync-routers/aws-secrets-manager-sync-router.ts

@@ -1,17 +0,0 @@
-import {
-  AwsSecretsManagerSyncSchema,
-  CreateAwsSecretsManagerSyncSchema,
-  UpdateAwsSecretsManagerSyncSchema
-} from "@app/services/secret-sync/aws-secrets-manager";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerAwsSecretsManagerSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.AWSSecretsManager,
-    server,
-    responseSchema: AwsSecretsManagerSyncSchema,
-    createSchema: CreateAwsSecretsManagerSyncSchema,
-    updateSchema: UpdateAwsSecretsManagerSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/azure-app-configuration-sync-router.ts

@@ -1,17 +0,0 @@
-import {
-  AzureAppConfigurationSyncSchema,
-  CreateAzureAppConfigurationSyncSchema,
-  UpdateAzureAppConfigurationSyncSchema
-} from "@app/services/secret-sync/azure-app-configuration";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerAzureAppConfigurationSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.AzureAppConfiguration,
-    server,
-    responseSchema: AzureAppConfigurationSyncSchema,
-    createSchema: CreateAzureAppConfigurationSyncSchema,
-    updateSchema: UpdateAzureAppConfigurationSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/azure-key-vault-sync-router.ts

@@ -1,17 +0,0 @@
-import {
-  AzureKeyVaultSyncSchema,
-  CreateAzureKeyVaultSyncSchema,
-  UpdateAzureKeyVaultSyncSchema
-} from "@app/services/secret-sync/azure-key-vault";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerAzureKeyVaultSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.AzureKeyVault,
-    server,
-    responseSchema: AzureKeyVaultSyncSchema,
-    createSchema: CreateAzureKeyVaultSyncSchema,
-    updateSchema: UpdateAzureKeyVaultSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -1,9 +1,6 @@
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
 import { registerAwsParameterStoreSyncRouter } from "./aws-parameter-store-sync-router";
-import { registerAwsSecretsManagerSyncRouter } from "./aws-secrets-manager-sync-router";
-import { registerAzureAppConfigurationSyncRouter } from "./azure-app-configuration-sync-router";
-import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
 import { registerGcpSyncRouter } from "./gcp-sync-router";
 import { registerGitHubSyncRouter } from "./github-sync-router";
 
@@ -11,9 +8,6 @@ export * from "./secret-sync-router";
 
 export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: FastifyZodProvider) => Promise<void>> = {
   [SecretSync.AWSParameterStore]: registerAwsParameterStoreSyncRouter,
-  [SecretSync.AWSSecretsManager]: registerAwsSecretsManagerSyncRouter,
   [SecretSync.GitHub]: registerGitHubSyncRouter,
-  [SecretSync.GCPSecretManager]: registerGcpSyncRouter,
-  [SecretSync.AzureKeyVault]: registerAzureKeyVaultSyncRouter,
-  [SecretSync.AzureAppConfiguration]: registerAzureAppConfigurationSyncRouter
+  [SecretSync.GCPSecretManager]: registerGcpSyncRouter
 };

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -9,34 +9,19 @@ import {
   AwsParameterStoreSyncListItemSchema,
   AwsParameterStoreSyncSchema
 } from "@app/services/secret-sync/aws-parameter-store";
-import {
-  AwsSecretsManagerSyncListItemSchema,
-  AwsSecretsManagerSyncSchema
-} from "@app/services/secret-sync/aws-secrets-manager";
-import {
-  AzureAppConfigurationSyncListItemSchema,
-  AzureAppConfigurationSyncSchema
-} from "@app/services/secret-sync/azure-app-configuration";
-import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/services/secret-sync/azure-key-vault";
 import { GcpSyncListItemSchema, GcpSyncSchema } from "@app/services/secret-sync/gcp";
 import { GitHubSyncListItemSchema, GitHubSyncSchema } from "@app/services/secret-sync/github";
 
 const SecretSyncSchema = z.discriminatedUnion("destination", [
   AwsParameterStoreSyncSchema,
-  AwsSecretsManagerSyncSchema,
   GitHubSyncSchema,
-  GcpSyncSchema,
-  AzureKeyVaultSyncSchema,
-  AzureAppConfigurationSyncSchema
+  GcpSyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   AwsParameterStoreSyncListItemSchema,
-  AwsSecretsManagerSyncListItemSchema,
   GitHubSyncListItemSchema,
-  GcpSyncListItemSchema,
-  AzureKeyVaultSyncListItemSchema,
-  AzureAppConfigurationSyncListItemSchema
+  GcpSyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v3/secret-router.ts

@@ -36,12 +36,11 @@ const SecretReferenceNodeTree: z.ZodType<TSecretReferenceNode> = SecretReference
   children: z.lazy(() => SecretReferenceNodeTree.array())
 });
 
-const BaseSecretNameSchema = z.string().trim().min(1);
-
-const SecretNameSchema = BaseSecretNameSchema.refine(
-  (el) => !el.includes(" "),
-  "Secret name cannot contain spaces."
-).refine((el) => !el.includes(":"), "Secret name cannot contain colon.");
+const SecretNameSchema = z
+  .string()
+  .trim()
+  .min(1)
+  .refine((el) => !el.includes(" "), "Secret name cannot contain spaces.");
 
 export const registerSecretRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -182,66 +181,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         }
       ],
       querystring: z.object({
-        metadataFilter: z
-          .string()
-          .optional()
-          .transform((val) => {
-            if (!val) return undefined;
-
-            const result: { key?: string; value?: string }[] = [];
-            const pairs = val.split("|");
-
-            for (const pair of pairs) {
-              const keyValuePair: { key?: string; value?: string } = {};
-              const parts = pair.split(/[,=]/);
-
-              for (let i = 0; i < parts.length; i += 2) {
-                const identifier = parts[i].trim().toLowerCase();
-                const value = parts[i + 1]?.trim();
-
-                if (identifier === "key" && value) {
-                  keyValuePair.key = value;
-                } else if (identifier === "value" && value) {
-                  keyValuePair.value = value;
-                }
-              }
-
-              if (keyValuePair.key && keyValuePair.value) {
-                result.push(keyValuePair);
-              }
-            }
-
-            return result.length ? result : undefined;
-          })
-          .superRefine((metadata, ctx) => {
-            if (metadata && !Array.isArray(metadata)) {
-              ctx.addIssue({
-                code: z.ZodIssueCode.custom,
-                message:
-                  "Invalid secretMetadata format. Correct format is key=value1,value=value2|key=value3,value=value4."
-              });
-            }
-
-            if (metadata) {
-              if (metadata.length > 10) {
-                ctx.addIssue({
-                  code: z.ZodIssueCode.custom,
-                  message: "You can only filter by up to 10 metadata fields"
-                });
-              }
-
-              for (const item of metadata) {
-                if (!item.key && !item.value) {
-                  ctx.addIssue({
-                    code: z.ZodIssueCode.custom,
-                    message:
-                      "Invalid secretMetadata format, key or value must be provided. Correct format is key=value1,value=value2|key=value3,value=value4."
-                  });
-                }
-              }
-            }
-          })
-          .describe(RAW_SECRETS.LIST.metadataFilter),
         workspaceId: z.string().trim().optional().describe(RAW_SECRETS.LIST.workspaceId),
         workspaceSlug: z.string().trim().optional().describe(RAW_SECRETS.LIST.workspaceSlug),
         environment: z.string().trim().optional().describe(RAW_SECRETS.LIST.environment),
@@ -342,7 +281,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         actorAuthMethod: req.permission.authMethod,
         projectId: workspaceId,
         path: secretPath,
-        metadataFilter: req.query.metadataFilter,
         includeImports: req.query.include_imports,
         recursive: req.query.recursive,
         tagSlugs: req.query.tagSlugs
@@ -473,8 +411,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
             secretPath: req.query.secretPath,
             secretId: secret.id,
             secretKey: req.params.secretName,
-            secretVersion: secret.version,
-            secretMetadata: secret.secretMetadata
+            secretVersion: secret.version
           }
         }
       });
@@ -582,8 +519,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
             secretPath: req.body.secretPath,
             secretId: secret.id,
             secretKey: req.params.secretName,
-            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretVersion: secret.version
           }
         }
       });
@@ -619,7 +555,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         }
       ],
       params: z.object({
-        secretName: BaseSecretNameSchema.describe(RAW_SECRETS.UPDATE.secretName)
+        secretName: SecretNameSchema.describe(RAW_SECRETS.UPDATE.secretName)
       }),
       body: z.object({
         workspaceId: z.string().trim().describe(RAW_SECRETS.UPDATE.workspaceId),
@@ -695,8 +631,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
             secretPath: req.body.secretPath,
             secretId: secret.id,
             secretKey: req.params.secretName,
-            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretVersion: secret.version
           }
         }
       });
@@ -1969,10 +1904,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       }
       const { secrets } = secretOperation;
 
-      const secretMetadataMap = new Map(
-        inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata])
-      );
-
       await server.services.auditLog.createAuditLog({
         projectId: secrets[0].workspace,
         ...req.auditLogInfo,
@@ -1984,8 +1915,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
             secrets: secrets.map((secret) => ({
               secretId: secret.id,
               secretKey: secret.secretKey,
-              secretVersion: secret.version,
-              secretMetadata: secretMetadataMap.get(secret.secretKey)
+              secretVersion: secret.version
             }))
           }
         }
@@ -2080,10 +2010,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       }
       const { secrets } = secretOperation;
 
-      const secretMetadataMap = new Map(
-        inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata])
-      );
-
       await server.services.auditLog.createAuditLog({
         projectId: secrets[0].workspace,
         ...req.auditLogInfo,
@@ -2095,8 +2021,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
             secrets: secrets.map((secret) => ({
               secretId: secret.id,
               secretKey: secret.secretKey,
-              secretVersion: secret.version,
-              secretMetadata: secretMetadataMap.get(secret.secretKey)
+              secretVersion: secret.version
             }))
           }
         }

backend/src/services/app-connection/app-connection-enums.ts

@@ -1,9 +1,7 @@
 export enum AppConnection {
   GitHub = "github",
   AWS = "aws",
-  GCP = "gcp",
-  AzureKeyVault = "azure-key-vault",
-  AzureAppConfiguration = "azure-app-configuration"
+  GCP = "gcp"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -20,25 +20,10 @@ import {
 } from "@app/services/app-connection/github";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
-import {
-  AzureAppConfigurationConnectionMethod,
-  getAzureAppConfigurationConnectionListItem,
-  validateAzureAppConfigurationConnectionCredentials
-} from "./azure-app-configuration";
-import {
-  AzureKeyVaultConnectionMethod,
-  getAzureKeyVaultConnectionListItem,
-  validateAzureKeyVaultConnectionCredentials
-} from "./azure-key-vault";
-
 export const listAppConnectionOptions = () => {
-  return [
-    getAwsAppConnectionListItem(),
-    getGitHubConnectionListItem(),
-    getGcpAppConnectionListItem(),
-    getAzureKeyVaultConnectionListItem(),
-    getAzureAppConfigurationConnectionListItem()
-  ].sort((a, b) => a.name.localeCompare(b.name));
+  return [getAwsAppConnectionListItem(), getGitHubConnectionListItem(), getGcpAppConnectionListItem()].sort((a, b) =>
+    a.name.localeCompare(b.name)
+  );
 };
 
 export const encryptAppConnectionCredentials = async ({
@@ -94,10 +79,6 @@ export const validateAppConnectionCredentials = async (
       return validateGitHubConnectionCredentials(appConnection);
     case AppConnection.GCP:
       return validateGcpConnectionCredentials(appConnection);
-    case AppConnection.AzureKeyVault:
-      return validateAzureKeyVaultConnectionCredentials(appConnection);
-    case AppConnection.AzureAppConfiguration:
-      return validateAzureAppConfigurationConnectionCredentials(appConnection);
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection ${app}`);
@@ -108,8 +89,6 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
   switch (method) {
     case GitHubConnectionMethod.App:
       return "GitHub App";
-    case AzureKeyVaultConnectionMethod.OAuth:
-    case AzureAppConfigurationConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
       return "OAuth";
     case AwsConnectionMethod.AccessKey:

backend/src/services/app-connection/app-connection-maps.ts

@@ -3,7 +3,5 @@ import { AppConnection } from "./app-connection-enums";
 export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AWS]: "AWS",
   [AppConnection.GitHub]: "GitHub",
-  [AppConnection.GCP]: "GCP",
-  [AppConnection.AzureKeyVault]: "Azure Key Vault",
-  [AppConnection.AzureAppConfiguration]: "Azure App Configuration"
+  [AppConnection.GCP]: "GCP"
 };