From 87f818866518c688353b51edfa4746e4dac4b312 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Fri, 6 May 2022 09:51:21 +0000
Subject: [PATCH] update project level encryption decryption filter

---
 app/controllers/api/projects.php |  5 +----
 app/init.php                     | 34 +++++++-------------------------
 2 files changed, 8 insertions(+), 31 deletions(-)

diff --git a/app/controllers/api/projects.php b/app/controllers/api/projects.php
index b123b62555..d6ee6b483b 100644
--- a/app/controllers/api/projects.php
+++ b/app/controllers/api/projects.php
@@ -101,10 +101,7 @@ App::post('/v1/projects')
             'keys' => null,
             'domains' => null,
             'auths' => $auths,
-            'storageSecrets' => [\bin2hex(OpenSSL::randomPseudoBytes(128))],
-            'storageSecretsDisplacement' => 0,
-            'databaseSecrets' => [\bin2hex(OpenSSL::randomPseudoBytes(128))],
-            'databaseSecretsDisplacement' => 0,
+            'databaseSecrets' => [\uniqid() => \bin2hex(OpenSSL::randomPseudoBytes(128))],
             'jwtSecret' => \bin2hex(OpenSSL::randomPseudoBytes(128)),
             'search' => implode(' ', [$projectId, $name]),
         ]));
diff --git a/app/init.php b/app/init.php
index f39124fb97..2a7d9ba590 100644
--- a/app/init.php
+++ b/app/init.php
@@ -781,28 +781,13 @@ App::setResource('console', function() {
 }, []);
 
 App::setResource('dbForProject', function($db, $cache, $project) {
-
     $filters = [];
-    if($project->getId() != 'console' && !$project->isEmpty()) {
+    if(!$project->isEmpty()) {
         $secrets = $project->getAttribute('databaseSecrets');
-        $displacement = $project->getAttribute('databaseSecretsDisplacement', 0);
-        $version = $displacement + \count($secrets);
-        
+        $version = array_key_last($secrets);        
         $filters['encrypt'] = [
             'encode' => function($value) use($version, $secrets) {
-    
-                $key = $secrets[\count($secrets)-1];
-                $iv = OpenSSL::randomPseudoBytes(OpenSSL::cipherIVLength(OpenSSL::CIPHER_AES_128_GCM));
-                $tag = null;
-                $value = json_encode([
-                    'data' => OpenSSL::encrypt($value, OpenSSL::CIPHER_AES_128_GCM, $key, 0, $iv, $tag),
-                    'method' => OpenSSL::CIPHER_AES_128_GCM,
-                    'iv' => \bin2hex($iv),
-                    'tag' => \bin2hex($tag ?? ''),
-                    'version' => $version,
-                ]);
-    
-                $key = App::getEnv('_APP_OPENSSL_KEY_V1');
+                $key = $secrets[$version];
                 $iv = OpenSSL::randomPseudoBytes(OpenSSL::cipherIVLength(OpenSSL::CIPHER_AES_128_GCM));
                 $tag = null;
                 return json_encode([
@@ -810,22 +795,17 @@ App::setResource('dbForProject', function($db, $cache, $project) {
                     'method' => OpenSSL::CIPHER_AES_128_GCM,
                     'iv' => \bin2hex($iv),
                     'tag' => \bin2hex($tag ?? ''),
-                    'version' => '1',
+                    'version' => $version,
                 ]);
             },
-            'decode' => function($value) use($secrets, $displacement) {
+            'decode' => function($value) use($secrets) {
                 if(is_null($value)) {
                     return null;
                 }
-                
-                $value = json_decode($value, true);
-                $key = App::getEnv('_APP_OPENSSL_KEY_V'.$value['version']);
-        
-                $value = OpenSSL::decrypt($value['data'], $value['method'], $key, 0, hex2bin($value['iv']), hex2bin($value['tag']));
     
                 $value = json_decode($value, true);
-                $version = ($value['version'] ?? 1) - $displacement;
-                $key = $secrets[$version - 1];
+                $version = $value['version'];
+                $key = $secrets[$version];
         
                 return OpenSSL::decrypt($value['data'], $value['method'], $key, 0, hex2bin($value['iv']), hex2bin($value['tag']));
             }