awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-21 08:28:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: added token based communications

Browse Source
This commit is contained in:
Akhil Mohan
2024-01-27 12:38:23 +05:30
parent daa94db874
commit 20fb99f042
65 changed files with 699 additions and 360 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend-pg/src/server/routes/index.ts
+9 -4
View File
@@ -169,7 +169,12 @@ export const registerRoutes = async (
const gitAppOrgDal = gitAppDalFactory(db);
const secretScanningDal = secretScanningDalFactory(db);
const permissionService = permissionServiceFactory({ permissionDal, orgRoleDal, projectRoleDal });
const permissionService = permissionServiceFactory({
permissionDal,
orgRoleDal,
projectRoleDal,
serviceTokenDal
});
const auditLogQueue = auditLogQueueServiceFactory({ auditLogDal, queueService });
const auditLogService = auditLogServiceFactory({ auditLogDal, permissionService, auditLogQueue });
const sapService = secretApprovalPolicyServiceFactory({
@@ -187,7 +192,7 @@ export const registerRoutes = async (
samlConfigDal
});
const tokenService = tokenServiceFactory({ tokenDal: authTokenDal });
const tokenService = tokenServiceFactory({ tokenDal: authTokenDal, userDal });
const userService = userServiceFactory({ userDal });
const loginService = authLoginServiceFactory({ userDal, smtpService, tokenService });
const passwordService = authPaswordServiceFactory({
@@ -220,7 +225,7 @@ export const registerRoutes = async (
authService: loginService,
serverCfgDal: superAdminDal
});
const apiKeyService = apiKeyServiceFactory({ apiKeyDal });
const apiKeyService = apiKeyServiceFactory({ apiKeyDal, userDal });
const secretScanningQueue = secretScanningQueueFactory({
userDal,
@@ -425,7 +430,7 @@ export const registerRoutes = async (
user: userDal
});
await server.register(injectIdentity);
await server.register(injectIdentity, { userDal, serviceTokenDal });
await server.register(injectPermission);
await server.register(injectAuditLogInfo);
backend-pg/src/server/routes/v1/auth-router.ts
+17 -1
View File
@@ -24,7 +24,9 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req, res) => {
const appCfg = getConfig();
await server.services.login.logout(req.auth.userId, req.auth.tokenVersionId);
if (req.auth.authMode === AuthMode.JWT) {
await server.services.login.logout(req.auth.userId, req.auth.tokenVersionId);
}
res.cookie("jid", "", {
httpOnly: true,
path: "/",
@@ -35,6 +37,20 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
}
});
server.route({
url: "/checkAuth",
method: "POST",
schema: {
response: {
200: z.object({
message: z.literal("Authenticated")
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: () => ({ message: "Authenticated" as const })
});
server.route({
url: "/token",
method: "POST",
backend-pg/src/server/routes/v1/project-env-router.ts
+3 -3
View File
@@ -25,7 +25,7 @@ export const registerProjectEnvRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const environment = await server.services.projectEnv.createEnvironment({
actorId: req.permission.id,
@@ -74,7 +74,7 @@ export const registerProjectEnvRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const { environment, old } = await server.services.projectEnv.updateEnvironment({
actorId: req.permission.id,
@@ -124,7 +124,7 @@ export const registerProjectEnvRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const environment = await server.services.projectEnv.deleteEnvironment({
actorId: req.permission.id,
backend-pg/src/server/routes/v1/project-membership-router.ts
+4 -6
View File
@@ -11,8 +11,6 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
export const registerProjectMembershipRouter = async (server: FastifyZodProvider) => {
// TODO(akhilmhdh-pg): missing adding multiple user workspace refer v2/membership
server.route({
url: "/:workspaceId/memberships",
method: "GET",
@@ -37,7 +35,7 @@ export const registerProjectMembershipRouter = async (server: FastifyZodProvider
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const memberships = await server.services.projectMembership.getProjectMemberships({
actorId: req.permission.id,
@@ -72,7 +70,7 @@ export const registerProjectMembershipRouter = async (server: FastifyZodProvider
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const data = await server.services.projectMembership.addUsersToProject({
actorId: req.permission.id,
@@ -114,7 +112,7 @@ export const registerProjectMembershipRouter = async (server: FastifyZodProvider
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const membership = await server.services.projectMembership.updateProjectMembership({
actorId: req.permission.id,
@@ -155,7 +153,7 @@ export const registerProjectMembershipRouter = async (server: FastifyZodProvider
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const membership = await server.services.projectMembership.deleteProjectMembership({
actorId: req.permission.id,
backend-pg/src/server/routes/v1/project-router.ts
+1
View File
@@ -17,6 +17,7 @@ import { sanitizedServiceTokenSchema } from "../v2/service-token-router";
const projectWithEnv = ProjectsSchema.merge(
z.object({
_id: z.string(),
environments: z.object({ name: z.string(), slug: z.string(), id: z.string() }).array()
})
);
backend-pg/src/server/routes/v1/secret-folder-router.ts
+63 -22
View File
@@ -11,10 +11,12 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
method: "POST",
schema: {
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
name: z.string().trim(),
path: z.string().trim().default("/")
path: z.string().trim().default("/"),
// backward compatiability with cli
directory: z.string().trim().default("/")
}),
response: {
200: z.object({
@@ -22,23 +24,31 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const path = req.body.path || req.body.directory;
const folder = await server.services.folder.createFolder({
actorId: req.permission.id,
actor: req.permission.type,
...req.body
...req.body,
projectId: req.body.workspaceId,
path
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.CREATE_FOLDER,
metadata: {
environment: req.body.environment,
folderId: folder.id,
folderName: folder.name,
folderPath: req.body.path
folderPath: path
}
}
});
@@ -51,13 +61,16 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
method: "PATCH",
schema: {
params: z.object({
// old way this was name
folderId: z.string()
}),
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
name: z.string().trim(),
path: z.string().trim().default("/")
path: z.string().trim().default("/"),
// backward compatiability with cli
directory: z.string().trim().default("/")
}),
response: {
200: z.object({
@@ -65,23 +78,31 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const path = req.body.path || req.body.directory;
const { folder, old } = await server.services.folder.updateFolder({
actorId: req.permission.id,
actor: req.permission.type,
...req.body,
id: req.params.folderId
projectId: req.body.workspaceId,
id: req.params.folderId,
path
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.UPDATE_FOLDER,
metadata: {
environment: req.body.environment,
folderId: folder.id,
folderPath: req.body.path,
folderPath: path,
newFolderName: folder.name,
oldFolderName: old.name
}
@@ -99,9 +120,11 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
folderId: z.string()
}),
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/")
path: z.string().trim().default("/"),
// keep this here as cli need directory
directory: z.string().trim().default("/")
}),
response: {
200: z.object({
@@ -109,23 +132,31 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const path = req.body.path || req.body.directory;
const folder = await server.services.folder.deleteFolder({
actorId: req.permission.id,
actor: req.permission.type,
...req.body,
id: req.params.folderId
projectId: req.body.workspaceId,
id: req.params.folderId,
path
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.DELETE_FOLDER,
metadata: {
environment: req.body.environment,
folderId: folder.id,
folderPath: req.body.path,
folderPath: path,
folderName: folder.name
}
}
@@ -139,9 +170,11 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
method: "GET",
schema: {
querystring: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/")
path: z.string().trim().default("/"),
// backward compatiability with cli
directory: z.string().trim().default("/")
}),
response: {
200: z.object({
@@ -149,12 +182,20 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const path = req.query.path || req.query.directory;
const folders = await server.services.folder.getFolders({
actorId: req.permission.id,
actor: req.permission.type,
...req.query
...req.query,
projectId: req.query.workspaceId,
path
});
return { folders };
}
backend-pg/src/server/routes/v1/secret-import-router.ts
+47 -17
View File
@@ -11,7 +11,7 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
method: "POST",
schema: {
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/"),
import: z.object({
@@ -30,18 +30,24 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secretImport = await server.services.secretImport.createImport({
actorId: req.permission.id,
actor: req.permission.type,
...req.body,
projectId: req.body.workspaceId,
data: req.body.import
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.CREATE_SECRET_IMPORT,
metadata: {
@@ -66,7 +72,7 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
secretImportId: z.string().trim()
}),
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/"),
import: z.object({
@@ -86,19 +92,25 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secretImport = await server.services.secretImport.updateImport({
actorId: req.permission.id,
actor: req.permission.type,
id: req.params.secretImportId,
...req.body,
projectId: req.body.workspaceId,
data: req.body.import
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.UPDATE_SECRET_IMPORT,
metadata: {
@@ -123,7 +135,7 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
secretImportId: z.string().trim()
}),
body: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/")
}),
@@ -138,18 +150,24 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secretImport = await server.services.secretImport.deleteImport({
actorId: req.permission.id,
actor: req.permission.type,
id: req.params.secretImportId,
...req.body
...req.body,
projectId: req.body.workspaceId
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.body.projectId,
projectId: req.body.workspaceId,
event: {
type: EventType.DELETE_SECRET_IMPORT,
metadata: {
@@ -171,7 +189,7 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
method: "GET",
schema: {
querystring: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/")
}),
@@ -188,17 +206,23 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secretImports = await server.services.secretImport.getImports({
actorId: req.permission.id,
actor: req.permission.type,
...req.query
...req.query,
projectId: req.query.workspaceId
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.query.projectId,
projectId: req.query.workspaceId,
event: {
type: EventType.GET_SECRET_IMPORTS,
metadata: {
@@ -217,7 +241,7 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
method: "GET",
schema: {
querystring: z.object({
projectId: z.string().trim(),
workspaceId: z.string().trim(),
environment: z.string().trim(),
path: z.string().trim().default("/")
}),
@@ -238,12 +262,18 @@ export const registerSecretImportRouter = async (server: FastifyZodProvider) =>
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const importedSecrets = await server.services.secretImport.getSecretsFromImports({
actorId: req.permission.id,
actor: req.permission.type,
...req.query
...req.query,
projectId: req.query.workspaceId
});
return { secrets: importedSecrets };
}
backend-pg/src/server/routes/v2/organization-router.ts
+3 -3
View File
@@ -34,7 +34,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const users = await server.services.org.findAllOrgMembers(
req.auth.userId,
@@ -58,7 +58,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const membership = await server.services.org.updateOrgMembership({
userId: req.auth.userId,
@@ -81,7 +81,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const membership = await server.services.org.deleteOrgMembership({
userId: req.auth.userId,
backend-pg/src/server/routes/v3/secret-router.ts
+48 -8
View File
@@ -42,7 +42,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secrets = await server.services.secret.getSecrets({
actorId: req.permission.id,
@@ -92,7 +97,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const secret = await server.services.secret.getASecret({
actorId: req.permission.id,
@@ -157,7 +167,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const {
workspaceId: projectId,
@@ -307,7 +322,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const {
secretValueCiphertext,
@@ -452,7 +472,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const { secretPath, type, workspaceId: projectId, secretId, environment } = req.body;
if (req.body.type !== SecretType.Personal && req.permission.type === ActorType.USER) {
@@ -564,7 +589,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {
@@ -672,7 +702,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {
@@ -768,7 +803,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
])
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
onRequest: verifyAuth([
AuthMode.JWT,
AuthMode.API_KEY,
AuthMode.SERVICE_TOKEN,
AuthMode.IDENTITY_ACCESS_TOKEN
]),
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {