Ethica/Termix
1
0
Fork 0
mirror of https://github.com/Termix-SSH/Termix.git synced 2026-08-30 02:41:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove the unwired field encryption boundary (#1136)

Browse Source 
FieldEncryptionBoundary declared a full sensitive/plaintext policy for six
tables and was referenced only by its own test. Nothing in production used it.

Its policy is byte-for-byte the same as FieldCrypto.ENCRYPTED_FIELDS, which is
the copy that actually runs, so nothing is lost by deleting it. Keeping a second
list is the real risk: someone adds a field to this one, sees it classified as
sensitive, and ships something that was never encrypted.

The one apparent improvement it had — requiring an explicit recordId instead of
DataCrypto's temp-${Date.now()} fallback — turns out to guard against nothing.
decryptField derives its context from the recordId stored inside the ciphertext,
not from the argument, so a temporary id at encryption time still decrypts.
This commit is contained in:
ZacharyZcR
2026-07-28 22:30:43 +08:00
committed by GitHub
parent 0c0161a244
commit e3205ec7ed
2 changed files with 0 additions and 261 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/backend/database/repositories/field-encryption-boundary.ts
-158
View File
@@ -1,158 +0,0 @@
import { FieldCrypto } from "../../utils/field-crypto.js";
import { LazyFieldEncryption } from "../../utils/lazy-field-encryption.js";
const FIELD_ENCRYPTION_POLICY = {
users: {
sensitive: new Set([
"passwordHash",
"clientSecret",
"totpSecret",
"totpBackupCodes",
"oidcIdentifier",
]),
plaintext: new Set(["id", "username", "isAdmin", "isOidc"]),
},
ssh_data: {
sensitive: new Set([
"password",
"key",
"keyPassword",
"sudoPassword",
"autostartPassword",
"autostartKey",
"autostartKeyPassword",
"socks5Password",
"rdpPassword",
"vncPassword",
"telnetPassword",
]),
plaintext: new Set([
"id",
"userId",
"connectionType",
"name",
"ip",
"port",
"username",
"folder",
"tags",
"authType",
"credentialId",
]),
},
ssh_credentials: {
sensitive: new Set([
"password",
"key",
"privateKey",
"publicKey",
"keyPassword",
]),
plaintext: new Set([
"id",
"userId",
"name",
"description",
"folder",
"tags",
"authType",
"username",
"keyType",
"detectedKeyType",
"usageCount",
"lastUsed",
]),
},
opkssh_tokens: {
sensitive: new Set(["sshCert", "privateKey"]),
plaintext: new Set(["id", "userId", "hostId", "createdAt", "expiresAt"]),
},
termix_identity_ca: {
sensitive: new Set(["privateKey"]),
plaintext: new Set(["id", "publicKey", "createdAt", "updatedAt"]),
},
vault_tokens: {
sensitive: new Set(["sshCert", "privateKey"]),
plaintext: new Set(["id", "userId", "profileId", "expiresAt"]),
},
} as const;
type PolicyTable = keyof typeof FIELD_ENCRYPTION_POLICY;
export type FieldClassification = "sensitive" | "plaintext" | "unknown";
export class FieldEncryptionBoundary {
static classifyField(
tableName: string,
fieldName: string,
): FieldClassification {
const policy = this.getPolicy(tableName);
if (!policy) return "unknown";
if (policy.sensitive.has(fieldName)) return "sensitive";
if (policy.plaintext.has(fieldName)) return "plaintext";
return "unknown";
}
static getSensitiveFields(tableName: string): string[] {
const policy = this.getPolicy(tableName);
return policy ? [...policy.sensitive].sort() : [];
}
static encryptRecord<T extends Record<string, unknown>>(
tableName: string,
record: T,
userDataKey: Buffer,
recordId = record.id,
): T {
const id = this.requireRecordId(recordId);
const encryptedRecord: Record<string, unknown> = { ...record };
for (const fieldName of this.getSensitiveFields(tableName)) {
const value = encryptedRecord[fieldName];
if (typeof value === "string" && value) {
encryptedRecord[fieldName] = FieldCrypto.encryptField(
value,
userDataKey,
id,
fieldName,
);
}
}
return encryptedRecord as T;
}
static decryptRecord<T extends Record<string, unknown>>(
tableName: string,
record: T,
userDataKey: Buffer,
recordId = record.id,
): T {
const id = this.requireRecordId(recordId);
const decryptedRecord: Record<string, unknown> = { ...record };
for (const fieldName of this.getSensitiveFields(tableName)) {
const value = decryptedRecord[fieldName];
if (typeof value === "string" && value) {
decryptedRecord[fieldName] = LazyFieldEncryption.safeGetFieldValue(
value,
userDataKey,
id,
fieldName,
);
}
}
return decryptedRecord as T;
}
private static getPolicy(tableName: string) {
return FIELD_ENCRYPTION_POLICY[tableName as PolicyTable];
}
private static requireRecordId(recordId: unknown): string {
if (recordId === null || recordId === undefined || recordId === "") {
throw new Error("Field encryption requires a stable record id.");
}
return String(recordId);
}
}