Individual Vault Item Encryption Feature (#3256)

* [SG-966] [SG-967] Add new cipher properties, update DB objects and create migrations (#2681) * Updated cipher entity with two new columns * Added sqlserver mifgration and updated applicable stored procedures and table * Added EF Migrations * Made changes to response model to include new column properties * Fixed formatting * Modified scripts to reflect suggestions made on PR * Added column to cipher table using default * Include constraint in create cipher table script * Added key and forcerotatekey property to request model (#2716) * Added key update on the Cipher_UpdateWithCollection stored procedure, ef (#2855) * Added key and forceKeyRotation to BuildCiphersTable method (#2893) * [PM-2211] Remove forceKeyRotation column (#2921) * Removed forceKeyRotation column * Adjusted date for migrtaion file * Passed key column to update cipher script to update cipher key when it is rotated (#2967) * [PM-2448] Update CipherDetails_Update SP to update attachment column (#2992) * Updated the cipherdetails_update stored procedure to update the attachement column when encrypted with the cipher key * Moved migration and renamed old migration file * Fixed lint issues * Fixed lint issues * renamed sqlserver migration to have a more recent date * [PM-2548] Added validation to edit and add attachments methods (#3130) * PM-2548 Added validation to edit and add attachments methods * PM-2548 Moved the validation to a private method * PM-2548 Minor refactor * Bumped up minimum version * Bumped up minimum version * Changed version for tests purposes * Bumped up minimum version * Updated encryption minimum version to match clients for QA. * PM-3976 Passed Key column to update cipher on bulk edit (#3299) * Updated minimum client version in preparation for release. * Renamed migration with current date. (#3303) --------- Co-authored-by: SmithThe4th <gsmith@bitwarden.com> Co-authored-by: gbubemismith <gsmithwalter@gmail.com> Co-authored-by: Carlos Gonçalves <cgoncalves@bitwarden.com> Co-authored-by: Carlos Gonçalves <carlosmaccam@gmail.com>
2025-07-11 21:03:47 -05:00 · 2023-09-28 08:45:13 -04:00
parent 464dac8f4d
commit 7ede956c32
28 changed files with 6990 additions and 17 deletions
--- a/src/Sql/Vault/dbo/Functions/CipherDetails.sql
+++ b/src/Sql/Vault/dbo/Functions/CipherDetails.sql
@ -26,6 +26,7 @@ SELECT
        ELSE TRY_CONVERT(UNIQUEIDENTIFIER, JSON_VALUE(C.[Folders], CONCAT('$."', @UserId, '"')))
    END [FolderId],
    C.[DeletedDate],
-    C.[Reprompt]
+    C.[Reprompt],
+    C.[Key]
 FROM
    [dbo].[Cipher] C
--- a/Procedures/Cipher/CipherDetails_Create.sql
+++ b/Procedures/Cipher/CipherDetails_Create.sql
@ -15,7 +15,8 @@
    @ViewPassword BIT, -- not used
    @OrganizationUseTotp BIT, -- not used
    @DeletedDate DATETIME2(7),
-    @Reprompt TINYINT
+    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL
 AS
 BEGIN
    SET NOCOUNT ON
@ -35,7 +36,8 @@ BEGIN
        [CreationDate],
        [RevisionDate],
        [DeletedDate],
-        [Reprompt]
+        [Reprompt],
+        [Key]
    )
    VALUES
    (
@ -49,7 +51,8 @@ BEGIN
        @CreationDate,
        @RevisionDate,
        @DeletedDate,
-        @Reprompt
+        @Reprompt,
+        @Key
    )

    IF @OrganizationId IS NOT NULL
--- a/Procedures/Cipher/CipherDetails_CreateWithCollections.sql
+++ b/Procedures/Cipher/CipherDetails_CreateWithCollections.sql
@ -16,6 +16,7 @@
    @OrganizationUseTotp BIT, -- not used
    @DeletedDate DATETIME2(7),
    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL,
    @CollectionIds AS [dbo].[GuidIdArray] READONLY
 AS
 BEGIN
@ -23,7 +24,7 @@ BEGIN

    EXEC [dbo].[CipherDetails_Create] @Id, @UserId, @OrganizationId, @Type, @Data, @Favorites, @Folders,
        @Attachments, @CreationDate, @RevisionDate, @FolderId, @Favorite, @Edit, @ViewPassword,
-        @OrganizationUseTotp, @DeletedDate, @Reprompt
+        @OrganizationUseTotp, @DeletedDate, @Reprompt, @Key

    DECLARE @UpdateCollectionsSuccess INT
    EXEC @UpdateCollectionsSuccess = [dbo].[Cipher_UpdateCollections] @Id, @UserId, @OrganizationId, @CollectionIds
--- a/Procedures/Cipher/CipherDetails_Update.sql
+++ b/Procedures/Cipher/CipherDetails_Update.sql
@ -6,7 +6,7 @@
    @Data NVARCHAR(MAX),
    @Favorites NVARCHAR(MAX), -- not used
    @Folders NVARCHAR(MAX), -- not used
-    @Attachments NVARCHAR(MAX), -- not used
+    @Attachments NVARCHAR(MAX),
    @CreationDate DATETIME2(7),
    @RevisionDate DATETIME2(7),
    @FolderId UNIQUEIDENTIFIER,
@ -15,7 +15,8 @@
    @ViewPassword BIT, -- not used
    @OrganizationUseTotp BIT, -- not used
    @DeletedDate DATETIME2(2),
-    @Reprompt TINYINT
+    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL
 AS
 BEGIN
    SET NOCOUNT ON
@ -48,10 +49,12 @@ BEGIN
            ELSE
                JSON_MODIFY([Favorites], @UserIdPath, NULL)
            END,
+        [Attachments] = @Attachments,
        [Reprompt] = @Reprompt,
        [CreationDate] = @CreationDate,
        [RevisionDate] = @RevisionDate,
-        [DeletedDate] = @DeletedDate
+        [DeletedDate] = @DeletedDate,
+        [Key] = @Key
    WHERE
        [Id] = @Id

--- a/Procedures/Cipher/Cipher_Create.sql
+++ b/Procedures/Cipher/Cipher_Create.sql
@ -10,7 +10,8 @@
    @CreationDate DATETIME2(7),
    @RevisionDate DATETIME2(7),
    @DeletedDate DATETIME2(7),
-    @Reprompt TINYINT
+    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL
 AS
 BEGIN
    SET NOCOUNT ON
@ -28,7 +29,8 @@ BEGIN
        [CreationDate],
        [RevisionDate],
        [DeletedDate],
-        [Reprompt]
+        [Reprompt],
+        [Key]
    )
    VALUES
    (
@ -43,7 +45,8 @@ BEGIN
        @CreationDate,
        @RevisionDate,
        @DeletedDate,
-        @Reprompt
+        @Reprompt,
+        @Key
    )

    IF @OrganizationId IS NOT NULL
--- a/Procedures/Cipher/Cipher_CreateWithCollections.sql
+++ b/Procedures/Cipher/Cipher_CreateWithCollections.sql
@ -11,13 +11,14 @@
    @RevisionDate DATETIME2(7),
    @DeletedDate DATETIME2(7),
    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL,
    @CollectionIds AS [dbo].[GuidIdArray] READONLY
 AS
 BEGIN
    SET NOCOUNT ON

    EXEC [dbo].[Cipher_Create] @Id, @UserId, @OrganizationId, @Type, @Data, @Favorites, @Folders,
-        @Attachments, @CreationDate, @RevisionDate, @DeletedDate, @Reprompt
+        @Attachments, @CreationDate, @RevisionDate, @DeletedDate, @Reprompt, @Key

    DECLARE @UpdateCollectionsSuccess INT
    EXEC @UpdateCollectionsSuccess = [dbo].[Cipher_UpdateCollections] @Id, @UserId, @OrganizationId, @CollectionIds
--- a/Procedures/Cipher/Cipher_Update.sql
+++ b/Procedures/Cipher/Cipher_Update.sql
@ -10,7 +10,8 @@
    @CreationDate DATETIME2(7),
    @RevisionDate DATETIME2(7),
    @DeletedDate DATETIME2(7),
-    @Reprompt TINYINT
+    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL
 AS
 BEGIN
    SET NOCOUNT ON
@ -28,7 +29,8 @@ BEGIN
        [CreationDate] = @CreationDate,
        [RevisionDate] = @RevisionDate,
        [DeletedDate] = @DeletedDate,
-        [Reprompt] = @Reprompt
+        [Reprompt] = @Reprompt,
+        [Key] = @Key
    WHERE
        [Id] = @Id

--- a/Procedures/Cipher/Cipher_UpdateWithCollections.sql
+++ b/Procedures/Cipher/Cipher_UpdateWithCollections.sql
@ -11,6 +11,7 @@
    @RevisionDate DATETIME2(7),
    @DeletedDate DATETIME2(7),
    @Reprompt TINYINT,
+    @Key VARCHAR(MAX) = NULL,
    @CollectionIds AS [dbo].[GuidIdArray] READONLY
 AS
 BEGIN
@ -36,7 +37,8 @@ BEGIN
        [Data] = @Data,
        [Attachments] = @Attachments,
        [RevisionDate] = @RevisionDate,
-        [DeletedDate] = @DeletedDate
+        [DeletedDate] = @DeletedDate,
+        [Key] = @Key
        -- No need to update CreationDate, Favorites, Folders, or Type since that data will not change
    WHERE
        [Id] = @Id
--- a/src/Sql/Vault/dbo/Tables/Cipher.sql
+++ b/src/Sql/Vault/dbo/Tables/Cipher.sql
@ -12,6 +12,7 @@ CREATE TABLE [dbo].[Cipher] (
    [RevisionDate]   DATETIME2 (7)    NOT NULL,
    [DeletedDate]    DATETIME2 (7)    NULL,
    [Reprompt]       TINYINT          NULL,
+    [Key]            VARCHAR(MAX)     NULL,
    CONSTRAINT [PK_Cipher] PRIMARY KEY CLUSTERED ([Id] ASC),
    CONSTRAINT [FK_Cipher_Organization] FOREIGN KEY ([OrganizationId]) REFERENCES [dbo].[Organization] ([Id]),
    CONSTRAINT [FK_Cipher_User] FOREIGN KEY ([UserId]) REFERENCES [dbo].[User] ([Id])