v.1.7.1 (#335)

src/backend/utils/data-crypto.ts

@@ -147,7 +147,7 @@ class DataCrypto {
         if (needsUpdate) {
           const updateQuery = `
             UPDATE ssh_credentials
-            SET password = ?, key = ?, key_password = ?, private_key = ?, updated_at = CURRENT_TIMESTAMP
+            SET password = ?, key = ?, key_password = ?, private_key = ?, public_key = ?, updated_at = CURRENT_TIMESTAMP
             WHERE id = ?
           `;
           db.prepare(updateQuery).run(
@@ -155,6 +155,7 @@ class DataCrypto {
             updatedRecord.key || null,
             updatedRecord.key_password || null,
             updatedRecord.private_key || null,
+            updatedRecord.public_key || null,
             record.id,
           );
 
@@ -216,6 +217,165 @@ class DataCrypto {
     return this.userCrypto.getUserDataKey(userId);
   }
 
+  static async reencryptUserDataAfterPasswordReset(
+    userId: string,
+    newUserDataKey: Buffer,
+    db: any,
+  ): Promise<{
+    success: boolean;
+    reencryptedTables: string[];
+    reencryptedFieldsCount: number;
+    errors: string[];
+  }> {
+    const result = {
+      success: false,
+      reencryptedTables: [] as string[],
+      reencryptedFieldsCount: 0,
+      errors: [] as string[],
+    };
+
+    try {
+      const tablesToReencrypt = [
+        { table: "ssh_data", fields: ["password", "key", "key_password"] },
+        {
+          table: "ssh_credentials",
+          fields: [
+            "password",
+            "private_key",
+            "key_password",
+            "key",
+            "public_key",
+          ],
+        },
+        {
+          table: "users",
+          fields: [
+            "client_secret",
+            "totp_secret",
+            "totp_backup_codes",
+            "oidc_identifier",
+          ],
+        },
+      ];
+
+      for (const { table, fields } of tablesToReencrypt) {
+        try {
+          const records = db
+            .prepare(`SELECT * FROM ${table} WHERE user_id = ?`)
+            .all(userId);
+
+          for (const record of records) {
+            const recordId = record.id.toString();
+            let needsUpdate = false;
+            const updatedRecord = { ...record };
+
+            for (const fieldName of fields) {
+              const fieldValue = record[fieldName];
+
+              if (fieldValue && fieldValue.trim() !== "") {
+                try {
+                  const reencryptedValue = FieldCrypto.encryptField(
+                    fieldValue,
+                    newUserDataKey,
+                    recordId,
+                    fieldName,
+                  );
+
+                  updatedRecord[fieldName] = reencryptedValue;
+                  needsUpdate = true;
+                  result.reencryptedFieldsCount++;
+                } catch (error) {
+                  const errorMsg = `Failed to re-encrypt ${fieldName} for ${table} record ${recordId}: ${error instanceof Error ? error.message : "Unknown error"}`;
+                  result.errors.push(errorMsg);
+                  databaseLogger.warn(
+                    "Field re-encryption failed during password reset",
+                    {
+                      operation: "password_reset_reencrypt_failed",
+                      userId,
+                      table,
+                      recordId,
+                      fieldName,
+                      error:
+                        error instanceof Error
+                          ? error.message
+                          : "Unknown error",
+                    },
+                  );
+                }
+              }
+            }
+
+            if (needsUpdate) {
+              const updateFields = fields.filter(
+                (field) => updatedRecord[field] !== record[field],
+              );
+              if (updateFields.length > 0) {
+                const updateQuery = `UPDATE ${table} SET ${updateFields.map((f) => `${f} = ?`).join(", ")}, updated_at = CURRENT_TIMESTAMP WHERE id = ?`;
+                const updateValues = updateFields.map(
+                  (field) => updatedRecord[field],
+                );
+                updateValues.push(record.id);
+
+                db.prepare(updateQuery).run(...updateValues);
+
+                if (!result.reencryptedTables.includes(table)) {
+                  result.reencryptedTables.push(table);
+                }
+              }
+            }
+          }
+        } catch (tableError) {
+          const errorMsg = `Failed to re-encrypt table ${table}: ${tableError instanceof Error ? tableError.message : "Unknown error"}`;
+          result.errors.push(errorMsg);
+          databaseLogger.error(
+            "Table re-encryption failed during password reset",
+            tableError,
+            {
+              operation: "password_reset_table_reencrypt_failed",
+              userId,
+              table,
+              error:
+                tableError instanceof Error
+                  ? tableError.message
+                  : "Unknown error",
+            },
+          );
+        }
+      }
+
+      result.success = result.errors.length === 0;
+
+      databaseLogger.info(
+        "User data re-encryption completed after password reset",
+        {
+          operation: "password_reset_reencrypt_completed",
+          userId,
+          success: result.success,
+          reencryptedTables: result.reencryptedTables,
+          reencryptedFieldsCount: result.reencryptedFieldsCount,
+          errorsCount: result.errors.length,
+        },
+      );
+
+      return result;
+    } catch (error) {
+      databaseLogger.error(
+        "User data re-encryption failed after password reset",
+        error,
+        {
+          operation: "password_reset_reencrypt_failed",
+          userId,
+          error: error instanceof Error ? error.message : "Unknown error",
+        },
+      );
+
+      result.errors.push(
+        `Critical error during re-encryption: ${error instanceof Error ? error.message : "Unknown error"}`,
+      );
+      return result;
+    }
+  }
+
   static validateUserAccess(userId: string): Buffer {
     const userDataKey = this.getUserDataKey(userId);
     if (!userDataKey) {

src/backend/utils/field-crypto.ts

@@ -22,13 +22,13 @@ class FieldCrypto {
       "totp_backup_codes",
       "oidc_identifier",
     ]),
-    ssh_data: new Set(["password", "key", "keyPassword"]),
+    ssh_data: new Set(["password", "key", "key_password"]),
     ssh_credentials: new Set([
       "password",
-      "privateKey",
-      "keyPassword",
+      "private_key",
+      "key_password",
       "key",
-      "publicKey",
+      "public_key",
     ]),
   };
 

src/backend/utils/lazy-field-encryption.ts

@@ -2,6 +2,12 @@ import { FieldCrypto } from "./field-crypto.js";
 import { databaseLogger } from "./logger.js";
 
 export class LazyFieldEncryption {
+  private static readonly LEGACY_FIELD_NAME_MAP: Record<string, string> = {
+    key_password: "keyPassword",
+    private_key: "privateKey",
+    public_key: "publicKey",
+  };
+
   static isPlaintextField(value: string): boolean {
     if (!value) return false;
 
@@ -44,6 +50,35 @@ export class LazyFieldEncryption {
         );
         return decrypted;
       } catch (error) {
+        const legacyFieldName = this.LEGACY_FIELD_NAME_MAP[fieldName];
+        if (legacyFieldName) {
+          try {
+            const decrypted = FieldCrypto.decryptField(
+              fieldValue,
+              userKEK,
+              recordId,
+              legacyFieldName,
+            );
+            return decrypted;
+          } catch (legacyError) {}
+        }
+
+        const sensitiveFields = [
+          "totp_secret",
+          "totp_backup_codes",
+          "password",
+          "key",
+          "key_password",
+          "private_key",
+          "public_key",
+          "client_secret",
+          "oidc_identifier",
+        ];
+
+        if (sensitiveFields.includes(fieldName)) {
+          return "";
+        }
+
         databaseLogger.error("Failed to decrypt field", error, {
           operation: "lazy_encryption_decrypt_failed",
           recordId,
@@ -60,9 +95,13 @@ export class LazyFieldEncryption {
     userKEK: Buffer,
     recordId: string,
     fieldName: string,
-  ): { encrypted: string; wasPlaintext: boolean } {
+  ): {
+    encrypted: string;
+    wasPlaintext: boolean;
+    wasLegacyEncryption: boolean;
+  } {
     if (!fieldValue) {
-      return { encrypted: "", wasPlaintext: false };
+      return { encrypted: "", wasPlaintext: false, wasLegacyEncryption: false };
     }
 
     if (this.isPlaintextField(fieldValue)) {
@@ -74,7 +113,7 @@ export class LazyFieldEncryption {
           fieldName,
         );
 
-        return { encrypted, wasPlaintext: true };
+        return { encrypted, wasPlaintext: true, wasLegacyEncryption: false };
       } catch (error) {
         databaseLogger.error("Failed to encrypt plaintext field", error, {
           operation: "lazy_encryption_migrate_failed",
@@ -85,7 +124,42 @@ export class LazyFieldEncryption {
         throw error;
       }
     } else {
-      return { encrypted: fieldValue, wasPlaintext: false };
+      try {
+        FieldCrypto.decryptField(fieldValue, userKEK, recordId, fieldName);
+        return {
+          encrypted: fieldValue,
+          wasPlaintext: false,
+          wasLegacyEncryption: false,
+        };
+      } catch (error) {
+        const legacyFieldName = this.LEGACY_FIELD_NAME_MAP[fieldName];
+        if (legacyFieldName) {
+          try {
+            const decrypted = FieldCrypto.decryptField(
+              fieldValue,
+              userKEK,
+              recordId,
+              legacyFieldName,
+            );
+            const reencrypted = FieldCrypto.encryptField(
+              decrypted,
+              userKEK,
+              recordId,
+              fieldName,
+            );
+            return {
+              encrypted: reencrypted,
+              wasPlaintext: false,
+              wasLegacyEncryption: true,
+            };
+          } catch (legacyError) {}
+        }
+        return {
+          encrypted: fieldValue,
+          wasPlaintext: false,
+          wasLegacyEncryption: false,
+        };
+      }
     }
   }
 
@@ -106,18 +180,21 @@ export class LazyFieldEncryption {
     for (const fieldName of sensitiveFields) {
       const fieldValue = record[fieldName];
 
-      if (fieldValue && this.isPlaintextField(fieldValue)) {
+      if (fieldValue) {
         try {
-          const { encrypted } = this.migrateFieldToEncrypted(
-            fieldValue,
-            userKEK,
-            recordId,
-            fieldName,
-          );
+          const { encrypted, wasPlaintext, wasLegacyEncryption } =
+            this.migrateFieldToEncrypted(
+              fieldValue,
+              userKEK,
+              recordId,
+              fieldName,
+            );
 
-          updatedRecord[fieldName] = encrypted;
-          migratedFields.push(fieldName);
-          needsUpdate = true;
+          if (wasPlaintext || wasLegacyEncryption) {
+            updatedRecord[fieldName] = encrypted;
+            migratedFields.push(fieldName);
+            needsUpdate = true;
+          }
         } catch (error) {
           databaseLogger.error("Failed to migrate record field", error, {
             operation: "lazy_encryption_record_field_failed",
@@ -134,13 +211,53 @@ export class LazyFieldEncryption {
   static getSensitiveFieldsForTable(tableName: string): string[] {
     const sensitiveFieldsMap: Record<string, string[]> = {
       ssh_data: ["password", "key", "key_password"],
-      ssh_credentials: ["password", "key", "key_password", "private_key"],
+      ssh_credentials: [
+        "password",
+        "key",
+        "key_password",
+        "private_key",
+        "public_key",
+      ],
       users: ["totp_secret", "totp_backup_codes"],
     };
 
     return sensitiveFieldsMap[tableName] || [];
   }
 
+  static fieldNeedsMigration(
+    fieldValue: string,
+    userKEK: Buffer,
+    recordId: string,
+    fieldName: string,
+  ): boolean {
+    if (!fieldValue) return false;
+
+    if (this.isPlaintextField(fieldValue)) {
+      return true;
+    }
+
+    try {
+      FieldCrypto.decryptField(fieldValue, userKEK, recordId, fieldName);
+      return false;
+    } catch (error) {
+      const legacyFieldName = this.LEGACY_FIELD_NAME_MAP[fieldName];
+      if (legacyFieldName) {
+        try {
+          FieldCrypto.decryptField(
+            fieldValue,
+            userKEK,
+            recordId,
+            legacyFieldName,
+          );
+          return true;
+        } catch (legacyError) {
+          return false;
+        }
+      }
+      return false;
+    }
+  }
+
   static async checkUserNeedsMigration(
     userId: string,
     userKEK: Buffer,
@@ -169,7 +286,15 @@ export class LazyFieldEncryption {
         const hostPlaintextFields: string[] = [];
 
         for (const field of sensitiveFields) {
-          if (host[field] && this.isPlaintextField(host[field])) {
+          if (
+            host[field] &&
+            this.fieldNeedsMigration(
+              host[field],
+              userKEK,
+              host.id.toString(),
+              field,
+            )
+          ) {
             hostPlaintextFields.push(field);
             needsMigration = true;
           }
@@ -193,7 +318,15 @@ export class LazyFieldEncryption {
         const credentialPlaintextFields: string[] = [];
 
         for (const field of sensitiveFields) {
-          if (credential[field] && this.isPlaintextField(credential[field])) {
+          if (
+            credential[field] &&
+            this.fieldNeedsMigration(
+              credential[field],
+              userKEK,
+              credential.id.toString(),
+              field,
+            )
+          ) {
             credentialPlaintextFields.push(field);
             needsMigration = true;
           }
@@ -214,7 +347,10 @@ export class LazyFieldEncryption {
         const userPlaintextFields: string[] = [];
 
         for (const field of sensitiveFields) {
-          if (user[field] && this.isPlaintextField(user[field])) {
+          if (
+            user[field] &&
+            this.fieldNeedsMigration(user[field], userKEK, userId, field)
+          ) {
             userPlaintextFields.push(field);
             needsMigration = true;
           }