awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-18 09:00:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: completed conditional rendering of identity for sub org

Browse Source
This commit is contained in:
=
2025-10-20 18:58:22 +05:30
parent b7644c9294
commit 03e4918362
20 changed files with 329 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-ua/identity-ua-service.ts
+34
View File
@@ -13,6 +13,7 @@ import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import {
BadRequestError,
ForbiddenRequestError,
NotFoundError,
PermissionBoundaryError,
RateLimitError,
@@ -315,6 +316,13 @@ export const identityUaServiceFactory = ({
message: "Failed to add universal auth to already configured identity"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -425,6 +433,10 @@ export const identityUaServiceFactory = ({
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
if (
(accessTokenMaxTTL || uaIdentityAuth.accessTokenMaxTTL) > 0 &&
(accessTokenTTL || uaIdentityAuth.accessTokenMaxTTL) > (accessTokenMaxTTL || uaIdentityAuth.accessTokenMaxTTL)
@@ -515,6 +527,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const { permission } = await permissionService.getOrgPermission({
scope: OrganizationActionScope.Any,
@@ -549,6 +564,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const { permission } = await permissionService.getOrgPermission({
scope: OrganizationActionScope.Any,
actor,
@@ -617,6 +635,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const { permission } = await permissionService.getOrgPermission({
scope: OrganizationActionScope.Any,
@@ -700,6 +721,10 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const { permission } = await permissionService.getOrgPermission({
scope: OrganizationActionScope.Any,
actor,
@@ -770,6 +795,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const identityUa = await identityUaDAL.findOne({ identityId });
if (!identityUa) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
@@ -839,6 +867,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const identityUa = await identityUaDAL.findOne({ identityId });
if (!identityUa) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
@@ -913,6 +944,9 @@ export const identityUaServiceFactory = ({
message: "The identity does not have universal auth"
});
}
if (identityMembershipOrg.identity.identityOrgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Sub organization not authorized to access this identity" });
}
const { permission } = await permissionService.getOrgPermission({
scope: OrganizationActionScope.Any,