awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 16:52:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

PKI revamp EST improvements and fixes

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-18 03:16:36 -03:00
parent ebac93e500
commit 0df3181308
29 changed files with 1994 additions and 839 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/est/certificate-est-router.ts
+11 -57
View File
@@ -4,41 +4,22 @@ import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
export const registerCertificateEstRouter = async (server: FastifyZodProvider) => {
const appCfg = getConfig();
const getIdentifierType = async ({
identifier,
actor,
actorId,
actorAuthMethod,
actorOrgId
}: {
identifier: string;
actor: ActorType;
actorId: string;
actorAuthMethod: ActorAuthMethod;
actorOrgId: string;
}): Promise<"template" | "profile" | null> => {
const getIdentifierType = async (identifier: string): Promise<"template" | "profile" | null> => {
try {
// Try to find as profile first using internal access
await server.services.certificateProfile.getEstConfigurationByProfile({
actor,
actorId,
actorAuthMethod,
actorOrgId,
profileId: identifier
profileId: identifier,
isInternal: true
});
return "profile";
} catch (profileError) {
try {
await server.services.certificateTemplate.getEstConfiguration({
isInternal: false,
actor,
actorId,
actorAuthMethod,
actorOrgId,
isInternal: true,
certificateTemplateId: identifier
});
return "template";
@@ -109,13 +90,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
const identifier = urlFragments.slice(-2)[0];
const identifierType = await getIdentifierType({
identifier,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
const identifierType = await getIdentifierType(identifier);
if (!identifierType) {
res.raw.statusCode = 404;
res.raw.setHeader("Content-Type", "text/plain");
@@ -127,11 +102,8 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
let estConfig;
if (identifierType === "profile") {
estConfig = await server.services.certificateProfile.getEstConfigurationByProfile({
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
profileId: identifier
profileId: identifier,
isInternal: true
});
} else {
estConfig = await server.services.certificateTemplate.getEstConfiguration({
@@ -188,13 +160,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
void res.header("Content-Transfer-Encoding", "base64");
const { identifier } = req.params;
const identifierType = await getIdentifierType({
identifier,
actor: req.permission.type,
actorId: req.permission.id,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod
});
const identifierType = await getIdentifierType(identifier);
if (!identifierType) {
throw new BadRequestError({ message: "Certificate template or profile not found" });
@@ -235,13 +201,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
void res.header("Content-Transfer-Encoding", "base64");
const { identifier } = req.params;
const identifierType = await getIdentifierType({
identifier,
actor: req.permission.type,
actorId: req.permission.id,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod
});
const identifierType = await getIdentifierType(identifier);
if (!identifierType) {
throw new BadRequestError({ message: "Certificate template or profile not found" });
@@ -281,13 +241,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
void res.header("Content-Transfer-Encoding", "base64");
const { identifier } = req.params;
const identifierType = await getIdentifierType({
identifier,
actor: req.permission.type,
actorId: req.permission.id,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod
});
const identifierType = await getIdentifierType(identifier);
if (!identifierType) {
throw new BadRequestError({ message: "Certificate template or profile not found" });