awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 09:28:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: addressed all review comments

Browse Source
This commit is contained in:
=
2025-09-04 22:29:16 +05:30
parent 035156bcc3
commit 0c26fcbb0f
6 changed files with 117 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/@types/fastify.d.ts
Vendored
+1 -1
View File
@@ -162,7 +162,7 @@ declare module "fastify" {
}; };
// identity injection. depending on which kinda of token the information is filled in auth // identity injection. depending on which kinda of token the information is filled in auth
auth: TAuthMode; auth: TAuthMode;
isPrimaryForwardingMode: boolean; shouldForwardWritesToPrimaryInstance: boolean;
permission: { permission: {
authMethod: ActorAuthMethod; authMethod: ActorAuthMethod;
type: ActorType; type: ActorType;
backend/src/lib/config/env.ts
+1 -1
View File
@@ -218,7 +218,7 @@ const envSchema = z
), ),
PARAMS_FOLDER_SECRET_DETECTION_ENTROPY: z.coerce.number().optional().default(3.7), PARAMS_FOLDER_SECRET_DETECTION_ENTROPY: z.coerce.number().optional().default(3.7),
INFISICAL_PRIMARY_URL: zpStr(z.string().optional()), INFISICAL_PRIMARY_INSTANCE_URL: zpStr(z.string().optional()),
// HSM // HSM
HSM_LIB_PATH: zpStr(z.string().optional()), HSM_LIB_PATH: zpStr(z.string().optional()),
backend/src/server/plugins/auth/inject-identity.ts
+6 -4
View File
@@ -107,13 +107,14 @@ export const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
}; };
// ! Important: You can only 100% count on the `req.permission.orgId` field being present when the auth method is Identity Access Token (Machine Identity). // ! Important: You can only 100% count on the `req.permission.orgId` field being present when the auth method is Identity Access Token (Machine Identity).
export const injectIdentity = fp(async (server: FastifyZodProvider, opt: { isPrimaryForwardingMode?: boolean }) => { export const injectIdentity = fp(
async (server: FastifyZodProvider, opt: { shouldForwardWritesToPrimaryInstance?: boolean }) => {
server.decorateRequest("auth", null); server.decorateRequest("auth", null);
server.decorateRequest("isPrimaryForwardingMode", Boolean(opt.isPrimaryForwardingMode)); server.decorateRequest("shouldForwardWritesToPrimaryInstance", Boolean(opt.shouldForwardWritesToPrimaryInstance));
server.addHook("onRequest", async (req) => { server.addHook("onRequest", async (req) => {
const appCfg = getConfig(); const appCfg = getConfig();
if (opt.isPrimaryForwardingMode && req.method !== "GET") { if (opt.shouldForwardWritesToPrimaryInstance && req.method !== "GET") {
return; return;
} }
@@ -218,4 +219,5 @@ export const injectIdentity = fp(async (server: FastifyZodProvider, opt: { isPri
throw new BadRequestError({ message: "Invalid token strategy provided" }); throw new BadRequestError({ message: "Invalid token strategy provided" });
} }
}); });
}); }
);
backend/src/server/plugins/auth/verify-auth.ts
+1 -1
View File
@@ -10,7 +10,7 @@ interface TAuthOptions {
export const verifyAuth = export const verifyAuth =
<T extends FastifyRequest>(authStrategies: AuthMode[], options: TAuthOptions = { requireOrg: true }) => <T extends FastifyRequest>(authStrategies: AuthMode[], options: TAuthOptions = { requireOrg: true }) =>
(req: T, _res: FastifyReply, done: HookHandlerDoneFunction) => { (req: T, _res: FastifyReply, done: HookHandlerDoneFunction) => {
if (req.isPrimaryForwardingMode && req.method !== "GET") { if (req.shouldForwardWritesToPrimaryInstance && req.method !== "GET") {
return done(); return done();
} }
backend/src/server/plugins/primary-forwarding-mode.ts
+1 -1
View File
@@ -1,7 +1,7 @@
import replyFrom from "@fastify/reply-from"; import replyFrom from "@fastify/reply-from";
import fp from "fastify-plugin"; import fp from "fastify-plugin";
export const primaryForwardingMode = fp(async (server, opt: { primaryUrl: string }) => { export const forwardWritesToPrimary = fp(async (server, opt: { primaryUrl: string }) => {
await server.register(replyFrom, { await server.register(replyFrom, {
base: opt.primaryUrl base: opt.primaryUrl
}); });
backend/src/server/routes/index.ts
+6 -6
View File
@@ -312,7 +312,7 @@ import { injectAssumePrivilege } from "../plugins/auth/inject-assume-privilege";
import { injectIdentity } from "../plugins/auth/inject-identity"; import { injectIdentity } from "../plugins/auth/inject-identity";
import { injectPermission } from "../plugins/auth/inject-permission"; import { injectPermission } from "../plugins/auth/inject-permission";
import { injectRateLimits } from "../plugins/inject-rate-limits"; import { injectRateLimits } from "../plugins/inject-rate-limits";
import { primaryForwardingMode } from "../plugins/primary-forwarding-mode"; import { forwardWritesToPrimary } from "../plugins/primary-forwarding-mode";
import { registerV1Routes } from "./v1"; import { registerV1Routes } from "./v1";
import { initializeOauthConfigSync } from "./v1/sso-router"; import { initializeOauthConfigSync } from "./v1/sso-router";
import { registerV2Routes } from "./v2"; import { registerV2Routes } from "./v2";
@@ -2147,14 +2147,14 @@ export const registerRoutes = async (
user: userDAL, user: userDAL,
kmipClient: kmipClientDAL kmipClient: kmipClientDAL
}); });
const isPrimaryForwardingMode = Boolean(envConfig.INFISICAL_PRIMARY_URL); const shouldForwardWritesToPrimaryInstance = Boolean(envConfig.INFISICAL_PRIMARY_INSTANCE_URL);
if (isPrimaryForwardingMode) { if (shouldForwardWritesToPrimaryInstance) {
logger.info(`Infisical primary instance is configured: ${envConfig.INFISICAL_PRIMARY_URL}`); logger.info(`Infisical primary instance is configured: ${envConfig.INFISICAL_PRIMARY_INSTANCE_URL}`);
await server.register(primaryForwardingMode, { primaryUrl: envConfig.INFISICAL_PRIMARY_URL as string }); await server.register(forwardWritesToPrimary, { primaryUrl: envConfig.INFISICAL_PRIMARY_INSTANCE_URL as string });
} }
await server.register(injectIdentity, { isPrimaryForwardingMode }); await server.register(injectIdentity, { shouldForwardWritesToPrimaryInstance });
await server.register(injectAssumePrivilege); await server.register(injectAssumePrivilege);
await server.register(injectPermission); await server.register(injectPermission);
await server.register(injectRateLimits); await server.register(injectRateLimits);