mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-14 09:30:09 +00:00
Merge branch 'main' into ENG-3041
This commit is contained in:
x032205
@@ -28,7 +28,8 @@ export enum AppConnection {
|
||||
Flyio = "flyio",
|
||||
GitLab = "gitlab",
|
||||
Cloudflare = "cloudflare",
|
||||
Bitbucket = "bitbucket"
|
||||
Bitbucket = "bitbucket",
|
||||
Zabbix = "zabbix"
|
||||
}
|
||||
|
||||
export enum AWSRegion {
|
||||
|
||||
@@ -110,6 +110,7 @@ import {
|
||||
validateWindmillConnectionCredentials,
|
||||
WindmillConnectionMethod
|
||||
} from "./windmill";
|
||||
import { getZabbixConnectionListItem, validateZabbixConnectionCredentials, ZabbixConnectionMethod } from "./zabbix";
|
||||
|
||||
export const listAppConnectionOptions = () => {
|
||||
return [
|
||||
@@ -142,7 +143,8 @@ export const listAppConnectionOptions = () => {
|
||||
getFlyioConnectionListItem(),
|
||||
getGitLabConnectionListItem(),
|
||||
getCloudflareConnectionListItem(),
|
||||
getBitbucketConnectionListItem()
|
||||
getBitbucketConnectionListItem(),
|
||||
getZabbixConnectionListItem()
|
||||
].sort((a, b) => a.name.localeCompare(b.name));
|
||||
};
|
||||
|
||||
@@ -223,7 +225,8 @@ export const validateAppConnectionCredentials = async (
|
||||
[AppConnection.Flyio]: validateFlyioConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.GitLab]: validateGitLabConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Cloudflare]: validateCloudflareConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Bitbucket]: validateBitbucketConnectionCredentials as TAppConnectionCredentialsValidator
|
||||
[AppConnection.Bitbucket]: validateBitbucketConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Zabbix]: validateZabbixConnectionCredentials as TAppConnectionCredentialsValidator
|
||||
};
|
||||
|
||||
return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
|
||||
@@ -261,6 +264,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
|
||||
case OnePassConnectionMethod.ApiToken:
|
||||
case CloudflareConnectionMethod.APIToken:
|
||||
case BitbucketConnectionMethod.ApiToken:
|
||||
case ZabbixConnectionMethod.ApiToken:
|
||||
return "API Token";
|
||||
case PostgresConnectionMethod.UsernameAndPassword:
|
||||
case MsSqlConnectionMethod.UsernameAndPassword:
|
||||
@@ -341,7 +345,8 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
|
||||
[AppConnection.Flyio]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.GitLab]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Cloudflare]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Bitbucket]: platformManagedCredentialsNotSupported
|
||||
[AppConnection.Bitbucket]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Zabbix]: platformManagedCredentialsNotSupported
|
||||
};
|
||||
|
||||
export const enterpriseAppCheck = async (
|
||||
|
||||
@@ -30,7 +30,8 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
|
||||
[AppConnection.Flyio]: "Fly.io",
|
||||
[AppConnection.GitLab]: "GitLab",
|
||||
[AppConnection.Cloudflare]: "Cloudflare",
|
||||
[AppConnection.Bitbucket]: "Bitbucket"
|
||||
[AppConnection.Bitbucket]: "Bitbucket",
|
||||
[AppConnection.Zabbix]: "Zabbix"
|
||||
};
|
||||
|
||||
export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
|
||||
@@ -63,5 +64,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
|
||||
[AppConnection.Flyio]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.GitLab]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Cloudflare]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Bitbucket]: AppConnectionPlanType.Regular
|
||||
[AppConnection.Bitbucket]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Zabbix]: AppConnectionPlanType.Regular
|
||||
};
|
||||
|
||||
@@ -82,6 +82,8 @@ import { ValidateVercelConnectionCredentialsSchema } from "./vercel";
|
||||
import { vercelConnectionService } from "./vercel/vercel-connection-service";
|
||||
import { ValidateWindmillConnectionCredentialsSchema } from "./windmill";
|
||||
import { windmillConnectionService } from "./windmill/windmill-connection-service";
|
||||
import { ValidateZabbixConnectionCredentialsSchema } from "./zabbix";
|
||||
import { zabbixConnectionService } from "./zabbix/zabbix-connection-service";
|
||||
|
||||
export type TAppConnectionServiceFactoryDep = {
|
||||
appConnectionDAL: TAppConnectionDALFactory;
|
||||
@@ -122,7 +124,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
|
||||
[AppConnection.Flyio]: ValidateFlyioConnectionCredentialsSchema,
|
||||
[AppConnection.GitLab]: ValidateGitLabConnectionCredentialsSchema,
|
||||
[AppConnection.Cloudflare]: ValidateCloudflareConnectionCredentialsSchema,
|
||||
[AppConnection.Bitbucket]: ValidateBitbucketConnectionCredentialsSchema
|
||||
[AppConnection.Bitbucket]: ValidateBitbucketConnectionCredentialsSchema,
|
||||
[AppConnection.Zabbix]: ValidateZabbixConnectionCredentialsSchema
|
||||
};
|
||||
|
||||
export const appConnectionServiceFactory = ({
|
||||
@@ -533,6 +536,7 @@ export const appConnectionServiceFactory = ({
|
||||
flyio: flyioConnectionService(connectAppConnectionById),
|
||||
gitlab: gitlabConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
|
||||
cloudflare: cloudflareConnectionService(connectAppConnectionById),
|
||||
bitbucket: bitBucketConnectionService(connectAppConnectionById)
|
||||
bitbucket: bitBucketConnectionService(connectAppConnectionById),
|
||||
zabbix: zabbixConnectionService(connectAppConnectionById)
|
||||
};
|
||||
};
|
||||
|
||||
@@ -171,6 +171,12 @@ import {
|
||||
TWindmillConnectionConfig,
|
||||
TWindmillConnectionInput
|
||||
} from "./windmill";
|
||||
import {
|
||||
TValidateZabbixConnectionCredentialsSchema,
|
||||
TZabbixConnection,
|
||||
TZabbixConnectionConfig,
|
||||
TZabbixConnectionInput
|
||||
} from "./zabbix";
|
||||
|
||||
export type TAppConnection = { id: string } & (
|
||||
| TAwsConnection
|
||||
@@ -203,6 +209,7 @@ export type TAppConnection = { id: string } & (
|
||||
| TGitLabConnection
|
||||
| TCloudflareConnection
|
||||
| TBitbucketConnection
|
||||
| TZabbixConnection
|
||||
);
|
||||
|
||||
export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
|
||||
@@ -240,6 +247,7 @@ export type TAppConnectionInput = { id: string } & (
|
||||
| TGitLabConnectionInput
|
||||
| TCloudflareConnectionInput
|
||||
| TBitbucketConnectionInput
|
||||
| TZabbixConnectionInput
|
||||
);
|
||||
|
||||
export type TSqlConnectionInput =
|
||||
@@ -285,6 +293,7 @@ export type TAppConnectionConfig =
|
||||
| TGitLabConnectionConfig
|
||||
| TCloudflareConnectionConfig
|
||||
| TBitbucketConnectionConfig;
|
||||
| TZabbixConnectionConfig;
|
||||
|
||||
export type TValidateAppConnectionCredentialsSchema =
|
||||
| TValidateAwsConnectionCredentialsSchema
|
||||
@@ -316,7 +325,8 @@ export type TValidateAppConnectionCredentialsSchema =
|
||||
| TValidateFlyioConnectionCredentialsSchema
|
||||
| TValidateGitLabConnectionCredentialsSchema
|
||||
| TValidateCloudflareConnectionCredentialsSchema
|
||||
| TValidateBitbucketConnectionCredentialsSchema;
|
||||
| TValidateBitbucketConnectionCredentialsSchema
|
||||
| TValidateZabbixConnectionCredentialsSchema;
|
||||
|
||||
export type TListAwsConnectionKmsKeys = {
|
||||
connectionId: string;
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./zabbix-connection-enums";
|
||||
export * from "./zabbix-connection-fns";
|
||||
export * from "./zabbix-connection-schemas";
|
||||
export * from "./zabbix-connection-types";
|
||||
@@ -0,0 +1,3 @@
|
||||
export enum ZabbixConnectionMethod {
|
||||
ApiToken = "api-token"
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
import { AxiosError } from "axios";
|
||||
import RE2 from "re2";
|
||||
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { BadRequestError } from "@app/lib/errors";
|
||||
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
|
||||
import { ZabbixConnectionMethod } from "./zabbix-connection-enums";
|
||||
import {
|
||||
TZabbixConnection,
|
||||
TZabbixConnectionConfig,
|
||||
TZabbixHost,
|
||||
TZabbixHostListResponse
|
||||
} from "./zabbix-connection-types";
|
||||
|
||||
const TRAILING_SLASH_REGEX = new RE2("/+$");
|
||||
|
||||
export const getZabbixConnectionListItem = () => {
|
||||
return {
|
||||
name: "Zabbix" as const,
|
||||
app: AppConnection.Zabbix as const,
|
||||
methods: Object.values(ZabbixConnectionMethod) as [ZabbixConnectionMethod.ApiToken]
|
||||
};
|
||||
};
|
||||
|
||||
export const validateZabbixConnectionCredentials = async (config: TZabbixConnectionConfig) => {
|
||||
const { apiToken, instanceUrl } = config.credentials;
|
||||
await blockLocalAndPrivateIpAddresses(instanceUrl);
|
||||
|
||||
try {
|
||||
const apiUrl = `${instanceUrl.replace(TRAILING_SLASH_REGEX, "")}/api_jsonrpc.php`;
|
||||
|
||||
const payload = {
|
||||
jsonrpc: "2.0",
|
||||
method: "authentication.get",
|
||||
params: {
|
||||
output: "extend"
|
||||
},
|
||||
id: 1
|
||||
};
|
||||
|
||||
const response: { data: { error?: { message: string }; result?: string } } = await request.post(apiUrl, payload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
if (response.data.error) {
|
||||
throw new BadRequestError({
|
||||
message: response.data.error.message
|
||||
});
|
||||
}
|
||||
|
||||
return config.credentials;
|
||||
} catch (error) {
|
||||
if (error instanceof AxiosError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to connect to Zabbix instance: ${error.message}`
|
||||
});
|
||||
}
|
||||
throw error;
|
||||
}
|
||||
};
|
||||
|
||||
export const listZabbixHosts = async (appConnection: TZabbixConnection): Promise<TZabbixHost[]> => {
|
||||
const { apiToken, instanceUrl } = appConnection.credentials;
|
||||
await blockLocalAndPrivateIpAddresses(instanceUrl);
|
||||
|
||||
try {
|
||||
const apiUrl = `${instanceUrl.replace(TRAILING_SLASH_REGEX, "")}/api_jsonrpc.php`;
|
||||
|
||||
const payload = {
|
||||
jsonrpc: "2.0",
|
||||
method: "host.get",
|
||||
params: {
|
||||
output: ["hostid", "host"],
|
||||
sortfield: "host",
|
||||
sortorder: "ASC"
|
||||
},
|
||||
id: 1
|
||||
};
|
||||
|
||||
const response: { data: TZabbixHostListResponse } = await request.post(apiUrl, payload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
return response.data.result
|
||||
? response.data.result.map((host) => ({
|
||||
hostId: host.hostid,
|
||||
host: host.host
|
||||
}))
|
||||
: [];
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof AxiosError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to validate credentials: ${error.message || "Unknown error"}`
|
||||
});
|
||||
}
|
||||
throw new BadRequestError({
|
||||
message: "Unable to validate connection: verify credentials"
|
||||
});
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,62 @@
|
||||
import z from "zod";
|
||||
|
||||
import { AppConnections } from "@app/lib/api-docs";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import {
|
||||
BaseAppConnectionSchema,
|
||||
GenericCreateAppConnectionFieldsSchema,
|
||||
GenericUpdateAppConnectionFieldsSchema
|
||||
} from "@app/services/app-connection/app-connection-schemas";
|
||||
|
||||
import { ZabbixConnectionMethod } from "./zabbix-connection-enums";
|
||||
|
||||
export const ZabbixConnectionApiTokenCredentialsSchema = z.object({
|
||||
apiToken: z
|
||||
.string()
|
||||
.trim()
|
||||
.min(1, "API Token required")
|
||||
.max(1000)
|
||||
.describe(AppConnections.CREDENTIALS.ZABBIX.apiToken),
|
||||
instanceUrl: z.string().trim().url("Invalid Instance URL").describe(AppConnections.CREDENTIALS.ZABBIX.instanceUrl)
|
||||
});
|
||||
|
||||
const BaseZabbixConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Zabbix) });
|
||||
|
||||
export const ZabbixConnectionSchema = BaseZabbixConnectionSchema.extend({
|
||||
method: z.literal(ZabbixConnectionMethod.ApiToken),
|
||||
credentials: ZabbixConnectionApiTokenCredentialsSchema
|
||||
});
|
||||
|
||||
export const SanitizedZabbixConnectionSchema = z.discriminatedUnion("method", [
|
||||
BaseZabbixConnectionSchema.extend({
|
||||
method: z.literal(ZabbixConnectionMethod.ApiToken),
|
||||
credentials: ZabbixConnectionApiTokenCredentialsSchema.pick({ instanceUrl: true })
|
||||
})
|
||||
]);
|
||||
|
||||
export const ValidateZabbixConnectionCredentialsSchema = z.discriminatedUnion("method", [
|
||||
z.object({
|
||||
method: z.literal(ZabbixConnectionMethod.ApiToken).describe(AppConnections.CREATE(AppConnection.Zabbix).method),
|
||||
credentials: ZabbixConnectionApiTokenCredentialsSchema.describe(
|
||||
AppConnections.CREATE(AppConnection.Zabbix).credentials
|
||||
)
|
||||
})
|
||||
]);
|
||||
|
||||
export const CreateZabbixConnectionSchema = ValidateZabbixConnectionCredentialsSchema.and(
|
||||
GenericCreateAppConnectionFieldsSchema(AppConnection.Zabbix)
|
||||
);
|
||||
|
||||
export const UpdateZabbixConnectionSchema = z
|
||||
.object({
|
||||
credentials: ZabbixConnectionApiTokenCredentialsSchema.optional().describe(
|
||||
AppConnections.UPDATE(AppConnection.Zabbix).credentials
|
||||
)
|
||||
})
|
||||
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Zabbix));
|
||||
|
||||
export const ZabbixConnectionListItemSchema = z.object({
|
||||
name: z.literal("Zabbix"),
|
||||
app: z.literal(AppConnection.Zabbix),
|
||||
methods: z.nativeEnum(ZabbixConnectionMethod).array()
|
||||
});
|
||||
@@ -0,0 +1,30 @@
|
||||
import { logger } from "@app/lib/logger";
|
||||
import { OrgServiceActor } from "@app/lib/types";
|
||||
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import { listZabbixHosts } from "./zabbix-connection-fns";
|
||||
import { TZabbixConnection } from "./zabbix-connection-types";
|
||||
|
||||
type TGetAppConnectionFunc = (
|
||||
app: AppConnection,
|
||||
connectionId: string,
|
||||
actor: OrgServiceActor
|
||||
) => Promise<TZabbixConnection>;
|
||||
|
||||
export const zabbixConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
|
||||
const listHosts = async (connectionId: string, actor: OrgServiceActor) => {
|
||||
const appConnection = await getAppConnection(AppConnection.Zabbix, connectionId, actor);
|
||||
|
||||
try {
|
||||
const hosts = await listZabbixHosts(appConnection);
|
||||
return hosts;
|
||||
} catch (error) {
|
||||
logger.error(error, "Failed to establish connection with zabbix");
|
||||
return [];
|
||||
}
|
||||
};
|
||||
|
||||
return {
|
||||
listHosts
|
||||
};
|
||||
};
|
||||
@@ -0,0 +1,33 @@
|
||||
import z from "zod";
|
||||
|
||||
import { DiscriminativePick } from "@app/lib/types";
|
||||
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import {
|
||||
CreateZabbixConnectionSchema,
|
||||
ValidateZabbixConnectionCredentialsSchema,
|
||||
ZabbixConnectionSchema
|
||||
} from "./zabbix-connection-schemas";
|
||||
|
||||
export type TZabbixConnection = z.infer<typeof ZabbixConnectionSchema>;
|
||||
|
||||
export type TZabbixConnectionInput = z.infer<typeof CreateZabbixConnectionSchema> & {
|
||||
app: AppConnection.Zabbix;
|
||||
};
|
||||
|
||||
export type TValidateZabbixConnectionCredentialsSchema = typeof ValidateZabbixConnectionCredentialsSchema;
|
||||
|
||||
export type TZabbixConnectionConfig = DiscriminativePick<TZabbixConnectionInput, "method" | "app" | "credentials"> & {
|
||||
orgId: string;
|
||||
};
|
||||
|
||||
export type TZabbixHost = {
|
||||
hostId: string;
|
||||
host: string;
|
||||
};
|
||||
|
||||
export type TZabbixHostListResponse = {
|
||||
jsonrpc: string;
|
||||
result: { hostid: string; host: string }[];
|
||||
error?: { message: string };
|
||||
};
|
||||
@@ -47,7 +47,6 @@ export const dailyResourceCleanUpQueueServiceFactory = ({
|
||||
queueService.start(QueueName.DailyResourceCleanUp, async () => {
|
||||
logger.info(`${QueueName.DailyResourceCleanUp}: queue task started`);
|
||||
await secretDAL.pruneSecretReminders(queueService);
|
||||
await auditLogDAL.pruneAuditLog();
|
||||
await identityAccessTokenDAL.removeExpiredTokens();
|
||||
await identityUniversalAuthClientSecretDAL.removeExpiredClientSecrets();
|
||||
await secretSharingDAL.pruneExpiredSharedSecrets();
|
||||
@@ -58,6 +57,7 @@ export const dailyResourceCleanUpQueueServiceFactory = ({
|
||||
await secretFolderVersionDAL.pruneExcessVersions();
|
||||
await serviceTokenService.notifyExpiringTokens();
|
||||
await orgService.notifyInvitedUsers();
|
||||
await auditLogDAL.pruneAuditLog();
|
||||
logger.info(`${QueueName.DailyResourceCleanUp}: queue task completed`);
|
||||
});
|
||||
|
||||
|
||||
@@ -2,7 +2,7 @@ import { ForbiddenError, subject } from "@casl/ability";
|
||||
import path from "path";
|
||||
import { v4 as uuidv4, validate as uuidValidate } from "uuid";
|
||||
|
||||
import { TSecretFolders, TSecretFoldersInsert } from "@app/db/schemas";
|
||||
import { TProjectEnvironments, TSecretFolders, TSecretFoldersInsert } from "@app/db/schemas";
|
||||
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
|
||||
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
|
||||
import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
|
||||
@@ -469,15 +469,41 @@ export const secretFolderServiceFactory = ({
|
||||
|
||||
const $checkFolderPolicy = async ({
|
||||
projectId,
|
||||
environment,
|
||||
parentId
|
||||
env,
|
||||
parentId,
|
||||
idOrName
|
||||
}: {
|
||||
projectId: string;
|
||||
environment: string;
|
||||
env: TProjectEnvironments;
|
||||
parentId: string;
|
||||
idOrName: string;
|
||||
}) => {
|
||||
let targetFolder = await folderDAL
|
||||
.findOne({
|
||||
envId: env.id,
|
||||
name: idOrName,
|
||||
parentId,
|
||||
isReserved: false
|
||||
})
|
||||
.catch(() => null);
|
||||
|
||||
if (!targetFolder && uuidValidate(idOrName)) {
|
||||
targetFolder = await folderDAL
|
||||
.findOne({
|
||||
envId: env.id,
|
||||
id: idOrName,
|
||||
parentId,
|
||||
isReserved: false
|
||||
})
|
||||
.catch(() => null);
|
||||
}
|
||||
|
||||
if (!targetFolder) {
|
||||
throw new NotFoundError({ message: `Target folder not found` });
|
||||
}
|
||||
|
||||
// get environment root folder (as it's needed to get all folders under it)
|
||||
const rootFolder = await folderDAL.findBySecretPath(projectId, environment, "/");
|
||||
const rootFolder = await folderDAL.findBySecretPath(projectId, env.slug, "/");
|
||||
if (!rootFolder) throw new NotFoundError({ message: `Root folder not found` });
|
||||
// get all folders under environment root folder
|
||||
const folderPaths = await folderDAL.findByEnvsDeep({ parentIds: [rootFolder.id] });
|
||||
@@ -492,7 +518,13 @@ export const secretFolderServiceFactory = ({
|
||||
folderMap.get(normalizeKey(folder.parentId))?.push(folder);
|
||||
}
|
||||
|
||||
// Recursively collect all folders under the given parentId
|
||||
// Find the target folder in the folderPaths to get its full details
|
||||
const targetFolderWithPath = folderPaths.find((f) => f.id === targetFolder!.id);
|
||||
if (!targetFolderWithPath) {
|
||||
throw new NotFoundError({ message: `Target folder path not found` });
|
||||
}
|
||||
|
||||
// Recursively collect all folders under the target folder (descendants only)
|
||||
const collectDescendants = (
|
||||
id: string
|
||||
): (TSecretFolders & { path: string; depth: number; environment: string })[] => {
|
||||
@@ -500,23 +532,31 @@ export const secretFolderServiceFactory = ({
|
||||
return [...children, ...children.flatMap((child) => collectDescendants(child.id))];
|
||||
};
|
||||
|
||||
const foldersUnderParent = collectDescendants(parentId);
|
||||
const targetFolderDescendants = collectDescendants(targetFolder.id);
|
||||
|
||||
const folderPolicyPaths = foldersUnderParent.map((folder) => ({
|
||||
// Include the target folder itself plus all its descendants
|
||||
const foldersToCheck = [targetFolderWithPath, ...targetFolderDescendants];
|
||||
|
||||
const folderPolicyPaths = foldersToCheck.map((folder) => ({
|
||||
path: folder.path,
|
||||
id: folder.id
|
||||
}));
|
||||
|
||||
// get secrets under the given folders
|
||||
const secrets = await secretV2BridgeDAL.findByFolderIds({ folderIds: folderPolicyPaths.map((p) => p.id) });
|
||||
const secrets = await secretV2BridgeDAL.findByFolderIds({
|
||||
folderIds: folderPolicyPaths.map((p) => p.id)
|
||||
});
|
||||
|
||||
for await (const folderPolicyPath of folderPolicyPaths) {
|
||||
// eslint-disable-next-line no-continue
|
||||
if (!secrets.some((s) => s.folderId === folderPolicyPath.id)) continue;
|
||||
|
||||
const policy = await secretApprovalPolicyService.getSecretApprovalPolicy(
|
||||
projectId,
|
||||
environment,
|
||||
env.slug,
|
||||
folderPolicyPath.path
|
||||
);
|
||||
|
||||
// if there is a policy and there are secrets under the given folder, throw error
|
||||
if (policy) {
|
||||
throw new BadRequestError({
|
||||
@@ -560,20 +600,42 @@ export const secretFolderServiceFactory = ({
|
||||
message: `Folder with path '${secretPath}' in environment with slug '${environment}' not found`
|
||||
});
|
||||
|
||||
await $checkFolderPolicy({ projectId, environment, parentId: parentFolder.id });
|
||||
await $checkFolderPolicy({ projectId, env, parentId: parentFolder.id, idOrName });
|
||||
|
||||
let folderToDelete = await folderDAL
|
||||
.findOne({
|
||||
envId: env.id,
|
||||
name: idOrName,
|
||||
parentId: parentFolder.id,
|
||||
isReserved: false
|
||||
})
|
||||
.catch(() => null);
|
||||
|
||||
if (!folderToDelete && uuidValidate(idOrName)) {
|
||||
folderToDelete = await folderDAL
|
||||
.findOne({
|
||||
envId: env.id,
|
||||
id: idOrName,
|
||||
parentId: parentFolder.id,
|
||||
isReserved: false
|
||||
})
|
||||
.catch(() => null);
|
||||
}
|
||||
|
||||
if (!folderToDelete) {
|
||||
throw new NotFoundError({ message: `Folder with ID '${idOrName}' not found` });
|
||||
}
|
||||
|
||||
const [doc] = await folderDAL.delete(
|
||||
{
|
||||
envId: env.id,
|
||||
[uuidValidate(idOrName) ? "id" : "name"]: idOrName,
|
||||
id: folderToDelete.id,
|
||||
parentId: parentFolder.id,
|
||||
isReserved: false
|
||||
},
|
||||
tx
|
||||
);
|
||||
|
||||
if (!doc) throw new NotFoundError({ message: `Failed to delete folder with ID '${idOrName}', not found` });
|
||||
|
||||
const folderVersions = await folderVersionDAL.findLatestFolderVersions([doc.id], tx);
|
||||
|
||||
await folderCommitService.createCommit(
|
||||
|
||||
@@ -20,7 +20,8 @@ export enum SecretSync {
|
||||
Render = "render",
|
||||
Flyio = "flyio",
|
||||
GitLab = "gitlab",
|
||||
CloudflarePages = "cloudflare-pages"
|
||||
CloudflarePages = "cloudflare-pages",
|
||||
Zabbix = "zabbix"
|
||||
}
|
||||
|
||||
export enum SecretSyncInitialSyncBehavior {
|
||||
|
||||
@@ -45,6 +45,7 @@ import { TEAMCITY_SYNC_LIST_OPTION, TeamCitySyncFns } from "./teamcity";
|
||||
import { TERRAFORM_CLOUD_SYNC_LIST_OPTION, TerraformCloudSyncFns } from "./terraform-cloud";
|
||||
import { VERCEL_SYNC_LIST_OPTION, VercelSyncFns } from "./vercel";
|
||||
import { WINDMILL_SYNC_LIST_OPTION, WindmillSyncFns } from "./windmill";
|
||||
import { ZABBIX_SYNC_LIST_OPTION, ZabbixSyncFns } from "./zabbix";
|
||||
|
||||
const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
|
||||
[SecretSync.AWSParameterStore]: AWS_PARAMETER_STORE_SYNC_LIST_OPTION,
|
||||
@@ -68,7 +69,8 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
|
||||
[SecretSync.Render]: RENDER_SYNC_LIST_OPTION,
|
||||
[SecretSync.Flyio]: FLYIO_SYNC_LIST_OPTION,
|
||||
[SecretSync.GitLab]: GITLAB_SYNC_LIST_OPTION,
|
||||
[SecretSync.CloudflarePages]: CLOUDFLARE_PAGES_SYNC_LIST_OPTION
|
||||
[SecretSync.CloudflarePages]: CLOUDFLARE_PAGES_SYNC_LIST_OPTION,
|
||||
[SecretSync.Zabbix]: ZABBIX_SYNC_LIST_OPTION
|
||||
};
|
||||
|
||||
export const listSecretSyncOptions = () => {
|
||||
@@ -236,6 +238,8 @@ export const SecretSyncFns = {
|
||||
return GitLabSyncFns.syncSecrets(secretSync, schemaSecretMap, { appConnectionDAL, kmsService });
|
||||
case SecretSync.CloudflarePages:
|
||||
return CloudflarePagesSyncFns.syncSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.Zabbix:
|
||||
return ZabbixSyncFns.syncSecrets(secretSync, schemaSecretMap);
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
@@ -328,6 +332,9 @@ export const SecretSyncFns = {
|
||||
case SecretSync.CloudflarePages:
|
||||
secretMap = await CloudflarePagesSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
case SecretSync.Zabbix:
|
||||
secretMap = await ZabbixSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
@@ -405,6 +412,8 @@ export const SecretSyncFns = {
|
||||
return GitLabSyncFns.removeSecrets(secretSync, schemaSecretMap, { appConnectionDAL, kmsService });
|
||||
case SecretSync.CloudflarePages:
|
||||
return CloudflarePagesSyncFns.removeSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.Zabbix:
|
||||
return ZabbixSyncFns.removeSecrets(secretSync, schemaSecretMap);
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
|
||||
@@ -23,7 +23,8 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
|
||||
[SecretSync.Render]: "Render",
|
||||
[SecretSync.Flyio]: "Fly.io",
|
||||
[SecretSync.GitLab]: "GitLab",
|
||||
[SecretSync.CloudflarePages]: "Cloudflare Pages"
|
||||
[SecretSync.CloudflarePages]: "Cloudflare Pages",
|
||||
[SecretSync.Zabbix]: "Zabbix"
|
||||
};
|
||||
|
||||
export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
|
||||
@@ -48,7 +49,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
|
||||
[SecretSync.Render]: AppConnection.Render,
|
||||
[SecretSync.Flyio]: AppConnection.Flyio,
|
||||
[SecretSync.GitLab]: AppConnection.GitLab,
|
||||
[SecretSync.CloudflarePages]: AppConnection.Cloudflare
|
||||
[SecretSync.CloudflarePages]: AppConnection.Cloudflare,
|
||||
[SecretSync.Zabbix]: AppConnection.Zabbix
|
||||
};
|
||||
|
||||
export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
|
||||
@@ -73,5 +75,6 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
|
||||
[SecretSync.Render]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.Flyio]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.GitLab]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.CloudflarePages]: SecretSyncPlanType.Regular
|
||||
[SecretSync.CloudflarePages]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.Zabbix]: SecretSyncPlanType.Regular
|
||||
};
|
||||
|
||||
@@ -113,6 +113,7 @@ import {
|
||||
TTerraformCloudSyncWithCredentials
|
||||
} from "./terraform-cloud";
|
||||
import { TVercelSync, TVercelSyncInput, TVercelSyncListItem, TVercelSyncWithCredentials } from "./vercel";
|
||||
import { TZabbixSync, TZabbixSyncInput, TZabbixSyncListItem, TZabbixSyncWithCredentials } from "./zabbix";
|
||||
|
||||
export type TSecretSync =
|
||||
| TAwsParameterStoreSync
|
||||
@@ -136,7 +137,8 @@ export type TSecretSync =
|
||||
| TRenderSync
|
||||
| TFlyioSync
|
||||
| TGitLabSync
|
||||
| TCloudflarePagesSync;
|
||||
| TCloudflarePagesSync
|
||||
| TZabbixSync;
|
||||
|
||||
export type TSecretSyncWithCredentials =
|
||||
| TAwsParameterStoreSyncWithCredentials
|
||||
@@ -160,7 +162,8 @@ export type TSecretSyncWithCredentials =
|
||||
| TRenderSyncWithCredentials
|
||||
| TFlyioSyncWithCredentials
|
||||
| TGitLabSyncWithCredentials
|
||||
| TCloudflarePagesSyncWithCredentials;
|
||||
| TCloudflarePagesSyncWithCredentials
|
||||
| TZabbixSyncWithCredentials;
|
||||
|
||||
export type TSecretSyncInput =
|
||||
| TAwsParameterStoreSyncInput
|
||||
@@ -184,7 +187,8 @@ export type TSecretSyncInput =
|
||||
| TRenderSyncInput
|
||||
| TFlyioSyncInput
|
||||
| TGitLabSyncInput
|
||||
| TCloudflarePagesSyncInput;
|
||||
| TCloudflarePagesSyncInput
|
||||
| TZabbixSyncInput;
|
||||
|
||||
export type TSecretSyncListItem =
|
||||
| TAwsParameterStoreSyncListItem
|
||||
@@ -208,7 +212,8 @@ export type TSecretSyncListItem =
|
||||
| TRenderSyncListItem
|
||||
| TFlyioSyncListItem
|
||||
| TGitLabSyncListItem
|
||||
| TCloudflarePagesSyncListItem;
|
||||
| TCloudflarePagesSyncListItem
|
||||
| TZabbixSyncListItem;
|
||||
|
||||
export type TSyncOptionsConfig = {
|
||||
canImportSecrets: boolean;
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
export * from "./zabbix-sync-constants";
|
||||
export * from "./zabbix-sync-enums";
|
||||
export * from "./zabbix-sync-fns";
|
||||
export * from "./zabbix-sync-schemas";
|
||||
export * from "./zabbix-sync-types";
|
||||
@@ -0,0 +1,10 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
export const ZABBIX_SYNC_LIST_OPTION: TSecretSyncListItem = {
|
||||
name: "Zabbix",
|
||||
destination: SecretSync.Zabbix,
|
||||
connection: AppConnection.Zabbix,
|
||||
canImportSecrets: true
|
||||
};
|
||||
@@ -0,0 +1,4 @@
|
||||
export enum ZabbixSyncScope {
|
||||
Global = "global",
|
||||
Host = "host"
|
||||
}
|
||||
@@ -0,0 +1,285 @@
|
||||
import RE2 from "re2";
|
||||
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
|
||||
import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
|
||||
import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
|
||||
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
|
||||
import {
|
||||
TZabbixSecret,
|
||||
TZabbixSyncWithCredentials,
|
||||
ZabbixApiResponse,
|
||||
ZabbixMacroCreateResponse,
|
||||
ZabbixMacroDeleteResponse
|
||||
} from "@app/services/secret-sync/zabbix/zabbix-sync-types";
|
||||
|
||||
import { ZabbixSyncScope } from "./zabbix-sync-enums";
|
||||
|
||||
const TRAILING_SLASH_REGEX = new RE2("/+$");
|
||||
const MACRO_START_REGEX = new RE2("^\\{\\$");
|
||||
const MACRO_END_REGEX = new RE2("\\}$");
|
||||
|
||||
const extractMacroKey = (macro: string): string => {
|
||||
return macro.replace(MACRO_START_REGEX, "").replace(MACRO_END_REGEX, "");
|
||||
};
|
||||
|
||||
// Helper function to handle Zabbix API responses and errors
|
||||
const handleZabbixResponse = <T>(response: ZabbixApiResponse<T>): T => {
|
||||
if (response.data.error) {
|
||||
const errorMessage = response.data.error.data
|
||||
? `${response.data.error.message}: ${response.data.error.data}`
|
||||
: response.data.error.message;
|
||||
throw new SecretSyncError({
|
||||
error: new Error(`Zabbix API Error (${response.data.error.code}): ${errorMessage}`)
|
||||
});
|
||||
}
|
||||
|
||||
if (response.data.result === undefined) {
|
||||
throw new SecretSyncError({
|
||||
error: new Error("Zabbix API returned no result")
|
||||
});
|
||||
}
|
||||
|
||||
return response.data.result;
|
||||
};
|
||||
|
||||
const listZabbixSecrets = async (apiToken: string, instanceUrl: string, hostId?: string): Promise<TZabbixSecret[]> => {
|
||||
const apiUrl = `${instanceUrl.replace(TRAILING_SLASH_REGEX, "")}/api_jsonrpc.php`;
|
||||
|
||||
// - jsonrpc: Specifies the JSON-RPC protocol version.
|
||||
// - method: The API method to call, in this case "usermacro.get" for retrieving user macros.
|
||||
// - id: A unique identifier for the request. Required by JSON-RPC but not used by the API for logic. Typically set to any integer.
|
||||
const payload = {
|
||||
jsonrpc: "2.0" as const,
|
||||
method: "usermacro.get",
|
||||
params: hostId ? { output: "extend", hostids: hostId } : { output: "extend", globalmacro: true },
|
||||
id: 1
|
||||
};
|
||||
|
||||
try {
|
||||
const response: ZabbixApiResponse<TZabbixSecret[]> = await request.post(apiUrl, payload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
return handleZabbixResponse(response) || [];
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to list Zabbix secrets")
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const putZabbixSecrets = async (
|
||||
apiToken: string,
|
||||
instanceUrl: string,
|
||||
secretMap: TSecretMap,
|
||||
destinationConfig: TZabbixSyncWithCredentials["destinationConfig"],
|
||||
existingSecrets: TZabbixSecret[]
|
||||
): Promise<void> => {
|
||||
const apiUrl = `${instanceUrl.replace(TRAILING_SLASH_REGEX, "")}/api_jsonrpc.php`;
|
||||
const hostId = destinationConfig.scope === ZabbixSyncScope.Host ? destinationConfig.hostId : undefined;
|
||||
|
||||
const existingMacroMap = new Map(existingSecrets.map((secret) => [secret.macro, secret]));
|
||||
|
||||
for (const [key, secret] of Object.entries(secretMap)) {
|
||||
const macroKey = `{$${key.toUpperCase()}}`;
|
||||
const existingMacro = existingMacroMap.get(macroKey);
|
||||
|
||||
try {
|
||||
if (existingMacro) {
|
||||
// Update existing macro
|
||||
const updatePayload = {
|
||||
jsonrpc: "2.0" as const,
|
||||
method: hostId ? "usermacro.update" : "usermacro.updateglobal",
|
||||
params: {
|
||||
[hostId ? "hostmacroid" : "globalmacroid"]: existingMacro[hostId ? "hostmacroid" : "globalmacroid"],
|
||||
value: secret.value,
|
||||
type: destinationConfig.macroType,
|
||||
description: secret.comment
|
||||
},
|
||||
id: 1
|
||||
};
|
||||
|
||||
// eslint-disable-next-line no-await-in-loop
|
||||
const response: ZabbixApiResponse<ZabbixMacroCreateResponse> = await request.post(apiUrl, updatePayload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
handleZabbixResponse(response);
|
||||
} else {
|
||||
// Create new macro
|
||||
const createPayload = {
|
||||
jsonrpc: "2.0" as const,
|
||||
method: hostId ? "usermacro.create" : "usermacro.createglobal",
|
||||
params: hostId
|
||||
? {
|
||||
hostid: hostId,
|
||||
macro: macroKey,
|
||||
value: secret.value,
|
||||
type: destinationConfig.macroType,
|
||||
description: secret.comment
|
||||
}
|
||||
: {
|
||||
macro: macroKey,
|
||||
value: secret.value,
|
||||
type: destinationConfig.macroType,
|
||||
description: secret.comment
|
||||
},
|
||||
id: 1
|
||||
};
|
||||
|
||||
// eslint-disable-next-line no-await-in-loop
|
||||
const response: ZabbixApiResponse<ZabbixMacroCreateResponse> = await request.post(apiUrl, createPayload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
handleZabbixResponse(response);
|
||||
}
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error(`Failed to sync secret ${key}`)
|
||||
});
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const deleteZabbixSecrets = async (
|
||||
apiToken: string,
|
||||
instanceUrl: string,
|
||||
keys: string[],
|
||||
hostId?: string
|
||||
): Promise<void> => {
|
||||
if (keys.length === 0) return;
|
||||
|
||||
const apiUrl = `${instanceUrl.replace(TRAILING_SLASH_REGEX, "")}/api_jsonrpc.php`;
|
||||
|
||||
try {
|
||||
// Get existing macros to find their IDs
|
||||
const existingSecrets = await listZabbixSecrets(apiToken, instanceUrl, hostId);
|
||||
const macroIds = existingSecrets
|
||||
.filter((secret) => keys.includes(secret.macro))
|
||||
.map((secret) => secret[hostId ? "hostmacroid" : "globalmacroid"])
|
||||
.filter(Boolean);
|
||||
|
||||
if (macroIds.length === 0) return;
|
||||
|
||||
const payload = {
|
||||
jsonrpc: "2.0" as const,
|
||||
method: hostId ? "usermacro.delete" : "usermacro.deleteglobal",
|
||||
params: macroIds,
|
||||
id: 1
|
||||
};
|
||||
|
||||
const response: ZabbixApiResponse<ZabbixMacroDeleteResponse> = await request.post(apiUrl, payload, {
|
||||
headers: {
|
||||
"Content-Type": "application/json",
|
||||
Authorization: `Bearer ${apiToken}`
|
||||
}
|
||||
});
|
||||
|
||||
handleZabbixResponse(response);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to delete Zabbix secrets")
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const ZabbixSyncFns = {
|
||||
syncSecrets: async (secretSync: TZabbixSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
const { connection, environment, destinationConfig } = secretSync;
|
||||
const { apiToken, instanceUrl } = connection.credentials;
|
||||
await blockLocalAndPrivateIpAddresses(instanceUrl);
|
||||
|
||||
const hostId = destinationConfig.scope === ZabbixSyncScope.Host ? destinationConfig.hostId : undefined;
|
||||
let secrets: TZabbixSecret[] = [];
|
||||
try {
|
||||
secrets = await listZabbixSecrets(apiToken, instanceUrl, hostId);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to list Zabbix secrets")
|
||||
});
|
||||
}
|
||||
|
||||
try {
|
||||
await putZabbixSecrets(apiToken, instanceUrl, secretMap, destinationConfig, secrets);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to sync secrets")
|
||||
});
|
||||
}
|
||||
|
||||
if (secretSync.syncOptions.disableSecretDeletion) return;
|
||||
|
||||
try {
|
||||
const shapedSecretMapKeys = Object.keys(secretMap).map((key) => key.toUpperCase());
|
||||
|
||||
const keys = secrets
|
||||
.filter(
|
||||
(secret) =>
|
||||
matchesSchema(secret.macro, environment?.slug || "", secretSync.syncOptions.keySchema) &&
|
||||
!shapedSecretMapKeys.includes(extractMacroKey(secret.macro))
|
||||
)
|
||||
.map((secret) => secret.macro);
|
||||
|
||||
await deleteZabbixSecrets(apiToken, instanceUrl, keys, hostId);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to delete orphaned secrets")
|
||||
});
|
||||
}
|
||||
},
|
||||
|
||||
removeSecrets: async (secretSync: TZabbixSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
const { connection, destinationConfig } = secretSync;
|
||||
const { apiToken, instanceUrl } = connection.credentials;
|
||||
await blockLocalAndPrivateIpAddresses(instanceUrl);
|
||||
|
||||
const hostId = destinationConfig.scope === ZabbixSyncScope.Host ? destinationConfig.hostId : undefined;
|
||||
|
||||
try {
|
||||
const secrets = await listZabbixSecrets(apiToken, instanceUrl, hostId);
|
||||
|
||||
const shapedSecretMapKeys = Object.keys(secretMap).map((key) => key.toUpperCase());
|
||||
const keys = secrets
|
||||
.filter((secret) => shapedSecretMapKeys.includes(extractMacroKey(secret.macro)))
|
||||
.map((secret) => secret.macro);
|
||||
|
||||
await deleteZabbixSecrets(apiToken, instanceUrl, keys, hostId);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to remove secrets")
|
||||
});
|
||||
}
|
||||
},
|
||||
|
||||
getSecrets: async (secretSync: TZabbixSyncWithCredentials) => {
|
||||
const { connection, destinationConfig } = secretSync;
|
||||
const { apiToken, instanceUrl } = connection.credentials;
|
||||
await blockLocalAndPrivateIpAddresses(instanceUrl);
|
||||
const hostId = destinationConfig.scope === ZabbixSyncScope.Host ? destinationConfig.hostId : undefined;
|
||||
|
||||
try {
|
||||
const secrets = await listZabbixSecrets(apiToken, instanceUrl, hostId);
|
||||
return Object.fromEntries(
|
||||
secrets.map((secret) => [
|
||||
extractMacroKey(secret.macro),
|
||||
{ value: secret.value ?? "", comment: secret.description }
|
||||
])
|
||||
);
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error: error instanceof Error ? error : new Error("Failed to get secrets")
|
||||
});
|
||||
}
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,67 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { SecretSyncs } from "@app/lib/api-docs";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import {
|
||||
BaseSecretSyncSchema,
|
||||
GenericCreateSecretSyncFieldsSchema,
|
||||
GenericUpdateSecretSyncFieldsSchema
|
||||
} from "@app/services/secret-sync/secret-sync-schemas";
|
||||
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { ZabbixSyncScope } from "./zabbix-sync-enums";
|
||||
|
||||
const ZabbixSyncDestinationConfigSchema = z.discriminatedUnion("scope", [
|
||||
z.object({
|
||||
scope: z.literal(ZabbixSyncScope.Host).describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.scope),
|
||||
hostId: z.string().trim().min(1, "Host required").max(255).describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.hostId),
|
||||
hostName: z
|
||||
.string()
|
||||
.trim()
|
||||
.min(1, "Host name required")
|
||||
.max(255)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.hostName),
|
||||
macroType: z
|
||||
.number()
|
||||
.min(0, "Macro type required")
|
||||
.max(1, "Macro type required")
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.macroType)
|
||||
}),
|
||||
z.object({
|
||||
scope: z.literal(ZabbixSyncScope.Global).describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.scope),
|
||||
macroType: z
|
||||
.number()
|
||||
.min(0, "Macro type required")
|
||||
.max(1, "Macro type required")
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.ZABBIX.macroType)
|
||||
})
|
||||
]);
|
||||
|
||||
const ZabbixSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
|
||||
|
||||
export const ZabbixSyncSchema = BaseSecretSyncSchema(SecretSync.Zabbix, ZabbixSyncOptionsConfig).extend({
|
||||
destination: z.literal(SecretSync.Zabbix),
|
||||
destinationConfig: ZabbixSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const CreateZabbixSyncSchema = GenericCreateSecretSyncFieldsSchema(
|
||||
SecretSync.Zabbix,
|
||||
ZabbixSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: ZabbixSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const UpdateZabbixSyncSchema = GenericUpdateSecretSyncFieldsSchema(
|
||||
SecretSync.Zabbix,
|
||||
ZabbixSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: ZabbixSyncDestinationConfigSchema.optional()
|
||||
});
|
||||
|
||||
export const ZabbixSyncListItemSchema = z.object({
|
||||
name: z.literal("Zabbix"),
|
||||
connection: z.literal(AppConnection.Zabbix),
|
||||
destination: z.literal(SecretSync.Zabbix),
|
||||
canImportSecrets: z.literal(true)
|
||||
});
|
||||
@@ -0,0 +1,75 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { TZabbixConnection } from "@app/services/app-connection/zabbix";
|
||||
|
||||
import { CreateZabbixSyncSchema, ZabbixSyncListItemSchema, ZabbixSyncSchema } from "./zabbix-sync-schemas";
|
||||
|
||||
export type TZabbixSync = z.infer<typeof ZabbixSyncSchema>;
|
||||
export type TZabbixSyncInput = z.infer<typeof CreateZabbixSyncSchema>;
|
||||
export type TZabbixSyncListItem = z.infer<typeof ZabbixSyncListItemSchema>;
|
||||
|
||||
export type TZabbixSyncWithCredentials = TZabbixSync & {
|
||||
connection: TZabbixConnection;
|
||||
};
|
||||
|
||||
export type TZabbixSecret = {
|
||||
macro: string;
|
||||
value: string;
|
||||
description?: string;
|
||||
globalmacroid?: string;
|
||||
hostmacroid?: string;
|
||||
hostid?: string;
|
||||
type: number;
|
||||
automatic?: string;
|
||||
};
|
||||
|
||||
export interface ZabbixApiResponse<T = unknown> {
|
||||
data: {
|
||||
jsonrpc: "2.0";
|
||||
result?: T;
|
||||
error?: {
|
||||
code: number;
|
||||
message: string;
|
||||
data?: string;
|
||||
};
|
||||
id: number;
|
||||
};
|
||||
}
|
||||
|
||||
export interface ZabbixMacroCreateResponse {
|
||||
hostmacroids?: string[];
|
||||
globalmacroids?: string[];
|
||||
}
|
||||
|
||||
export interface ZabbixMacroUpdateResponse {
|
||||
hostmacroids?: string[];
|
||||
globalmacroids?: string[];
|
||||
}
|
||||
|
||||
export interface ZabbixMacroDeleteResponse {
|
||||
hostmacroids?: string[];
|
||||
globalmacroids?: string[];
|
||||
}
|
||||
|
||||
export enum ZabbixMacroType {
|
||||
TEXT = 0,
|
||||
SECRET = 1
|
||||
}
|
||||
|
||||
export interface ZabbixMacroInput {
|
||||
hostid?: string;
|
||||
macro: string;
|
||||
value: string;
|
||||
description?: string;
|
||||
type?: ZabbixMacroType;
|
||||
automatic?: "0" | "1";
|
||||
}
|
||||
|
||||
export interface ZabbixMacroUpdate {
|
||||
hostmacroid?: string;
|
||||
globalmacroid?: string;
|
||||
value?: string;
|
||||
description?: string;
|
||||
type?: ZabbixMacroType;
|
||||
automatic?: "0" | "1";
|
||||
}
|
||||
@@ -5,7 +5,13 @@ import jwt from "jsonwebtoken";
|
||||
import { IdentityAuthMethod, OrgMembershipRole, TSuperAdmin, TSuperAdminUpdate } from "@app/db/schemas";
|
||||
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
|
||||
import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import {
|
||||
getConfig,
|
||||
getOriginalConfig,
|
||||
overrideEnvConfig,
|
||||
overwriteSchema,
|
||||
validateOverrides
|
||||
} from "@app/lib/config/env";
|
||||
import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
|
||||
import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp";
|
||||
import { BadRequestError, NotFoundError } from "@app/lib/errors";
|
||||
@@ -33,6 +39,7 @@ import { TInvalidateCacheQueueFactory } from "./invalidate-cache-queue";
|
||||
import { TSuperAdminDALFactory } from "./super-admin-dal";
|
||||
import {
|
||||
CacheType,
|
||||
EnvOverrides,
|
||||
LoginMethod,
|
||||
TAdminBootstrapInstanceDTO,
|
||||
TAdminGetIdentitiesDTO,
|
||||
@@ -234,6 +241,45 @@ export const superAdminServiceFactory = ({
|
||||
adminIntegrationsConfig = config;
|
||||
};
|
||||
|
||||
const getEnvOverrides = async () => {
|
||||
const serverCfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
|
||||
|
||||
if (!serverCfg || !serverCfg.encryptedEnvOverrides) {
|
||||
return {};
|
||||
}
|
||||
|
||||
const decrypt = kmsService.decryptWithRootKey();
|
||||
|
||||
const overrides = JSON.parse(decrypt(serverCfg.encryptedEnvOverrides).toString()) as Record<string, string>;
|
||||
|
||||
return overrides;
|
||||
};
|
||||
|
||||
const getEnvOverridesOrganized = async (): Promise<EnvOverrides> => {
|
||||
const overrides = await getEnvOverrides();
|
||||
const ogConfig = getOriginalConfig();
|
||||
|
||||
return Object.fromEntries(
|
||||
Object.entries(overwriteSchema).map(([groupKey, groupDef]) => [
|
||||
groupKey,
|
||||
{
|
||||
name: groupDef.name,
|
||||
fields: groupDef.fields.map(({ key, description }) => ({
|
||||
key,
|
||||
description,
|
||||
value: overrides[key] || "",
|
||||
hasEnvEntry: !!(ogConfig as unknown as Record<string, string | undefined>)[key]
|
||||
}))
|
||||
}
|
||||
])
|
||||
);
|
||||
};
|
||||
|
||||
const $syncEnvConfig = async () => {
|
||||
const config = await getEnvOverrides();
|
||||
overrideEnvConfig(config);
|
||||
};
|
||||
|
||||
const updateServerCfg = async (
|
||||
data: TSuperAdminUpdate & {
|
||||
slackClientId?: string;
|
||||
@@ -246,6 +292,7 @@ export const superAdminServiceFactory = ({
|
||||
gitHubAppConnectionSlug?: string;
|
||||
gitHubAppConnectionId?: string;
|
||||
gitHubAppConnectionPrivateKey?: string;
|
||||
envOverrides?: Record<string, string>;
|
||||
},
|
||||
userId: string
|
||||
) => {
|
||||
@@ -374,6 +421,17 @@ export const superAdminServiceFactory = ({
|
||||
gitHubAppConnectionSettingsUpdated = true;
|
||||
}
|
||||
|
||||
let envOverridesUpdated = false;
|
||||
if (data.envOverrides !== undefined) {
|
||||
// Verify input format
|
||||
validateOverrides(data.envOverrides);
|
||||
|
||||
const encryptedEnvOverrides = encryptWithRoot(Buffer.from(JSON.stringify(data.envOverrides)));
|
||||
updatedData.encryptedEnvOverrides = encryptedEnvOverrides;
|
||||
updatedData.envOverrides = undefined;
|
||||
envOverridesUpdated = true;
|
||||
}
|
||||
|
||||
const updatedServerCfg = await serverCfgDAL.updateById(ADMIN_CONFIG_DB_UUID, updatedData);
|
||||
|
||||
await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(updatedServerCfg));
|
||||
@@ -382,6 +440,10 @@ export const superAdminServiceFactory = ({
|
||||
await $syncAdminIntegrationConfig();
|
||||
}
|
||||
|
||||
if (envOverridesUpdated) {
|
||||
await $syncEnvConfig();
|
||||
}
|
||||
|
||||
if (
|
||||
updatedServerCfg.encryptedMicrosoftTeamsAppId &&
|
||||
updatedServerCfg.encryptedMicrosoftTeamsClientSecret &&
|
||||
@@ -814,6 +876,18 @@ export const superAdminServiceFactory = ({
|
||||
return job;
|
||||
};
|
||||
|
||||
const initializeEnvConfigSync = async () => {
|
||||
logger.info("Setting up background sync process for environment overrides");
|
||||
|
||||
await $syncEnvConfig();
|
||||
|
||||
// sync every 5 minutes
|
||||
const job = new CronJob("*/5 * * * *", $syncEnvConfig);
|
||||
job.start();
|
||||
|
||||
return job;
|
||||
};
|
||||
|
||||
return {
|
||||
initServerCfg,
|
||||
updateServerCfg,
|
||||
@@ -833,6 +907,9 @@ export const superAdminServiceFactory = ({
|
||||
getOrganizations,
|
||||
deleteOrganization,
|
||||
deleteOrganizationMembership,
|
||||
initializeAdminIntegrationConfigSync
|
||||
initializeAdminIntegrationConfigSync,
|
||||
initializeEnvConfigSync,
|
||||
getEnvOverrides,
|
||||
getEnvOverridesOrganized
|
||||
};
|
||||
};
|
||||
|
||||
@@ -1,3 +1,5 @@
|
||||
import { TEnvConfig } from "@app/lib/config/env";
|
||||
|
||||
export type TAdminSignUpDTO = {
|
||||
email: string;
|
||||
password: string;
|
||||
@@ -74,3 +76,10 @@ export type TAdminIntegrationConfig = {
|
||||
privateKey: string;
|
||||
};
|
||||
};
|
||||
|
||||
export interface EnvOverrides {
|
||||
[key: string]: {
|
||||
name: string;
|
||||
fields: { key: keyof TEnvConfig; value: string; hasEnvEntry: boolean; description?: string }[];
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user