From c55fe632dcd264c497339a0deaf6da37f0b2d265 Mon Sep 17 00:00:00 2001
From: Damodar Lohani <dlohani48@gmail.com>
Date: Wed, 20 Jul 2022 07:21:28 +0000
Subject: [PATCH] master encryption filter for project

---
 app/config/collections.php       | 34 ++------------------------------
 app/controllers/api/projects.php | 18 +++++++++++++++++
 app/init.php                     |  6 +++---
 3 files changed, 23 insertions(+), 35 deletions(-)

diff --git a/app/config/collections.php b/app/config/collections.php
index e65f1fe3b3..52d9e93bbf 100644
--- a/app/config/collections.php
+++ b/app/config/collections.php
@@ -741,29 +741,7 @@ $collections = [
         'name' => 'Secrets',
         'attributes' => [
             [
-                '$id' => 'projectInternalId',
-                'type' => Database::VAR_STRING,
-                'format' => '',
-                'size' => Database::LENGTH_KEY,
-                'signed' => true,
-                'required' => false,
-                'default' => null,
-                'array' => false,
-                'filters' => [],
-            ],
-            [
-                '$id' => 'projectId',
-                'type' => Database::VAR_STRING,
-                'format' => '',
-                'size' => Database::LENGTH_KEY,
-                'signed' => true,
-                'required' => false,
-                'default' => 0,
-                'array' => false,
-                'filters' => [],
-            ],
-            [
-                '$id' => 'secrets',
+                '$id' => 'secret',
                 'type' => Database::VAR_STRING,
                 'format' => '',
                 'size' => 16384,
@@ -774,15 +752,7 @@ $collections = [
                 'filters' => [],
             ],
         ],
-        'indexes' => [
-            [
-                '$id' => '_key_project',
-                'type' => Database::INDEX_KEY,
-                'attributes' => ['projectInternalId'],
-                'lengths' => [Database::LENGTH_KEY],
-                'orders' => [Database::ORDER_ASC],
-            ],
-        ],
+        'indexes' => [],
     ],
 
     'platforms' => [
diff --git a/app/controllers/api/projects.php b/app/controllers/api/projects.php
index 714b8c343e..5e1a7d1cd5 100644
--- a/app/controllers/api/projects.php
+++ b/app/controllers/api/projects.php
@@ -84,6 +84,23 @@ App::post('/v1/projects')
             throw new Exception("'console' is a reserved project.", 400, Exception::PROJECT_RESERVED_PROJECT);
         }
 
+        $secret = Authorization::skip(fn() => $dbForConsole->createDocument('secrets', new Document([
+            '$id' => $dbForConsole->getId(),
+            '$read' => [],
+            '$write' => [],
+            '$collection' => 'secrets',
+            'secret' => OpenSSL::secretString(),
+        ])));
+
+        // create new secret for the project
+        // project should save keyId
+        // need setFilter to set instance level filter in dbforconsole
+        // saving keyId in project doesn't make sense, as we only need the secret to
+        // read and write the project document
+
+        // The problem is we need to know the projectId to set the filter
+        // but when we get dbForConsole we will never know the project id to work with
+
         $project = $dbForConsole->createDocument('projects', new Document([
             '$id' => $projectId,
             '$read' => ['team:' . $teamId],
@@ -92,6 +109,7 @@ App::post('/v1/projects')
             'teamInternalId' => $team->getInternalId(),
             'teamId' => $team->getId(),
             'description' => $description,
+            'keyId' => $secret->getId(),
             'logo' => $logo,
             'url' => $url,
             'version' => APP_VERSION_STABLE,
diff --git a/app/init.php b/app/init.php
index 24a163f30c..fd0462cdce 100644
--- a/app/init.php
+++ b/app/init.php
@@ -380,9 +380,9 @@ Database::addFilter(
 Database::addFilter(
     'masterEncrypt',
     function(mixed $value, Document $document, Database $database) {
-        $keyId = $document->getAttribute('masterKeyId', '');
+        $keyId = $document->getAttribute('keyId', '');
         $database->setNamespace('_console');
-        $key = $database->getDocument('secrets', $keyId);
+        $key = Authorization::skip(fn() => $database->getDocument('secrets', $keyId));
         if($key->isEmpty()) {
             throw new Exception("Unable to find master key with ID ($keyId} to encrypt.");
         }
@@ -405,7 +405,7 @@ Database::addFilter(
         $value = json_decode($value, true);
         $keyId = $value['version'];
         $database->setNamespace('_console');
-        $key = $database->getDocument('secrets', $keyId);
+        $key = Authorization::skip(fn() => $database->getDocument('secrets', $keyId));
         if($key->isEmpty()) {
             throw new Exception("Unable to find master key with ID {$keyId} to decrypt.");
         }