Fix issues caused by the previous PR

Author: FluxCapacitor2

backend/src/db/crypto.ts

@@ -2,13 +2,13 @@ import crypto, { createCipheriv, createDecipheriv } from "node:crypto";
 
 const separator = "|";
 
-const unwrapKey = (masterKey: string, wrapped: string): Buffer => {
+const unwrapKey = (masterKey: Buffer, wrapped: string): Buffer => {
   const iv = Buffer.alloc(8, 0xa6); // Recommended default initial value
   const decipher = createDecipheriv("aes256-wrap", masterKey, iv);
   return Buffer.concat([decipher.update(wrapped, "base64"), decipher.final()]);
 };
 
-const wrapKey = (masterKey: string, key: Buffer): string => {
+const wrapKey = (masterKey: Buffer, key: Buffer): string => {
   const iv = Buffer.alloc(8, 0xa6);
   const cipher = createCipheriv("aes256-wrap", masterKey, iv);
   return cipher.update(key, undefined, "base64") + cipher.final("base64");
@@ -40,7 +40,7 @@ const genKey = (): Buffer => {
 };
 
 export const encryptEnv = (
-  masterKey: string,
+  masterKey: Buffer,
   plaintext: PrismaJson.EnvVar[],
   key: string,
 ) => {
@@ -52,7 +52,7 @@ export const encryptEnv = (
 };
 
 export const decryptEnv = (
-  masterKey: string,
+  masterKey: Buffer,
   ciphertext: PrismaJson.EnvVar[],
   key: string,
 ) => {
@@ -63,4 +63,4 @@ export const decryptEnv = (
   }));
 };
 
-export const generateKey = (masterKey: string) => wrapKey(masterKey, genKey());
+export const generateKey = (masterKey: Buffer) => wrapKey(masterKey, genKey());

backend/src/db/index.ts

@@ -55,17 +55,17 @@ export class PrismaDatabase extends Database {
   user: UserRepo;
   sessionStore: session.Store;
 
-  constructor(client: PrismaClientType, masterKey: string) {
+  constructor(client: PrismaClientType, masterKey: Buffer) {
     super();
     this.client = client;
-    this.app = new AppRepo(this.client, this.deployment);
     this.appGroup = new AppGroupRepo(this.client);
     this.cache = new CacheRepo(this.client);
     this.deployment = new DeploymentRepo(
       this.client,
       this.publish.bind(this),
       masterKey,
     );
+    this.app = new AppRepo(this.client, this.deployment);
     this.invitation = new InvitationRepo(this.client);
     this.org = new OrganizationRepo(this.client);
     this.repoImportState = new RepoImportStateRepo(this.client);
@@ -88,7 +88,7 @@ export class PrismaDatabase extends Database {
 export class PgDatabase extends PrismaDatabase {
   private pool: Pool;
 
-  constructor(connectionString: string, masterKey: string) {
+  constructor(connectionString: string, masterKey: Buffer) {
     const prismaPostgresAdapter = new PrismaPg({ connectionString });
 
     const client = new PrismaClient({

backend/src/db/repo/deployment.ts

@@ -28,12 +28,12 @@ type PrismaWorkloadConfigCreate = Omit<WorkloadConfigCreate, "appType">;
 export class DeploymentRepo {
   private client: PrismaClientType;
   private publish: (topic: string, payload: string) => Promise<void>;
-  private masterKey: string;
+  private masterKey: Buffer;
 
   constructor(
     client: PrismaClientType,
     publish: (topic: string, payload: string) => Promise<void>,
-    masterKey: string,
+    masterKey: Buffer,
   ) {
     this.client = client;
     this.publish = publish;

backend/src/service/auth.ts

@@ -30,7 +30,6 @@ export class AuthService {
   ) {
     this.userRepo = userRepo;
     this.rancherService = rancherService;
-    this.config = this.getOIDCConfig();
     this.usingRancherOIDC =
       this.rancherService.isRancherManaged() && useRancherOIDC;
     this.baseURL = baseURL;
@@ -39,6 +38,7 @@ export class AuthService {
     this.clientId = clientId;
     this.clientSecret = clientSecret;
     this.loginClaim = loginClaim;
+    this.config = this.getOIDCConfig();
   }
 
   usingCILogon() {

backend/src/service/index.ts

@@ -60,7 +60,7 @@ import { UpdateDeploymentService } from "./updateDeployment.ts";
 export const db: Database = new PgDatabase(
   env.DATABASE_URL ??
     `postgresql://${env.POSTGRES_USER}:${env.POSTGRES_PASSWORD}@${env.POSTGRES_HOSTNAME}/${env.POSTGRES_DB}`,
-  env.FIELD_ENCRYPTION_KEY,
+  Buffer.from(env.FIELD_ENCRYPTION_KEY, "base64"),
 );
 
 export const cacheService = new KVCacheService(db.cache);

backend/test/util/db.ts

@@ -17,7 +17,7 @@ class PgliteDatabase extends PrismaDatabase {
   constructor(client: PGlite) {
     const adapter = new PrismaPGlite(client);
     const db = new PrismaClient({ adapter }) satisfies PrismaClientType;
-    super(db, randomBytes(32).toString("base64"));
+    super(db, randomBytes(32));
     this.pglite = client;
   }
 

builders/dockerfile/Dockerfile

@@ -5,7 +5,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloa
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && \
-    apt-get install -y --no-install-recommends software-properties-common=0.99.49.4 wget=1.21.4-1ubuntu4.1 libssl3=3.0.13-0ubuntu3.7 ca-certificates=20240203 && \
+    apt-get install -y --no-install-recommends software-properties-common=0.99.49.4 wget=1.21.4-1ubuntu4.1 libssl3=3.0.13-0ubuntu3.9 ca-certificates=20240203 && \
     # ^ This package includes `add-apt-repository`
     add-apt-repository ppa:git-core/ppa && \
     apt-get update && \

builders/railpack/Dockerfile

@@ -7,7 +7,7 @@ RUN rm -f /etc/apt/apt.conf.d/docker-clean; echo 'Binary::apt::APT::Keep-Downloa
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
     --mount=type=cache,target=/var/lib/apt,sharing=locked \
     apt-get update && \
-    apt-get install -y --no-install-recommends software-properties-common=0.99.49.4 wget=1.21.4-1ubuntu4.1 libssl3=3.0.13-0ubuntu3.7 ca-certificates=20240203 jq=1.7.1-3ubuntu0.24.04.1 && \
+    apt-get install -y --no-install-recommends software-properties-common=0.99.49.4 wget=1.21.4-1ubuntu4.1 libssl3=3.0.13-0ubuntu3.9 ca-certificates=20240203 jq=1.7.1-3ubuntu0.24.04.1 && \
     # ^ This package includes `add-apt-repository`
     add-apt-repository ppa:git-core/ppa && \
     apt-get update && \