awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 22:46:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add access approval requests to project permission cache logic

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-09-26 17:50:14 -03:00
parent a0dc051f6b
commit 2374182f75
10 changed files with 36 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/access-approval-request/access-approval-request-service.ts
+3 -1
View File
@@ -35,7 +35,7 @@ import { ApprovalStatus, TAccessApprovalRequestServiceFactory } from "./access-a
type TSecretApprovalRequestServiceFactoryDep = {
additionalPrivilegeDAL: Pick<TProjectUserAdditionalPrivilegeDALFactory, "create" | "findById">;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
accessApprovalPolicyApproverDAL: Pick<TAccessApprovalPolicyApproverDALFactory, "find">;
projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
projectDAL: Pick<
@@ -758,6 +758,8 @@ export const accessApprovalRequestServiceFactory = ({
{ privilegeId: privilegeIdToSet, status: ApprovalStatus.APPROVED },
tx
);
await permissionService.invalidateProjectPermissionCache(accessApprovalRequest.projectId, tx);
}
}
backend/src/ee/services/group/group-service.ts
+1 -10
View File
@@ -46,10 +46,7 @@ type TGroupServiceFactoryDep = {
projectKeyDAL: Pick<TProjectKeyDALFactory, "find" | "delete" | "findLatestProjectKey" | "insertMany">;
permissionService: Pick<
TPermissionServiceFactory,
| "getOrgPermission"
| "getOrgPermissionByRole"
| "invalidateUserProjectPermissionCache"
| "invalidateProjectPermissionCache"
"getOrgPermission" | "getOrgPermissionByRole" | "invalidateProjectPermissionCache"
>;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
oidcConfigDAL: Pick<TOidcConfigDALFactory, "findOne">;
@@ -232,10 +229,8 @@ export const groupServiceFactory = ({
});
if (role) {
const groupMembers = await userGroupMembershipDAL.find({ groupId: group.id });
const groupProjects = await groupProjectDAL.find({ groupId: group.id });
await Promise.allSettled([
...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
...groupProjects.map((groupProject) =>
permissionService.invalidateProjectPermissionCache(groupProject.projectId)
)
@@ -264,7 +259,6 @@ export const groupServiceFactory = ({
message: "Failed to delete group due to plan restriction. Upgrade plan to delete group."
});
const groupMembers = await userGroupMembershipDAL.find({ groupId: id });
const groupProjects = await groupProjectDAL.find({ groupId: id });
const [group] = await groupDAL.delete({
@@ -273,7 +267,6 @@ export const groupServiceFactory = ({
});
await Promise.allSettled([
...groupMembers.map((member) => permissionService.invalidateUserProjectPermissionCache(member.userId)),
...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
]);
@@ -425,7 +418,6 @@ export const groupServiceFactory = ({
const groupProjects = await groupProjectDAL.find({ groupId: group.id });
await Promise.allSettled([
permissionService.invalidateUserProjectPermissionCache(user.id),
...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
]);
@@ -512,7 +504,6 @@ export const groupServiceFactory = ({
const groupProjects = await groupProjectDAL.find({ groupId: group.id });
await Promise.allSettled([
permissionService.invalidateUserProjectPermissionCache(user.id),
...groupProjects.map((groupProject) => permissionService.invalidateProjectPermissionCache(groupProject.projectId))
]);
backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts
+6 -24
View File
@@ -28,10 +28,7 @@ type TIdentityProjectAdditionalPrivilegeV2ServiceFactoryDep = {
identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeV2DALFactory;
identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
permissionService: Pick<
TPermissionServiceFactory,
"getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
>;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
};
export type TIdentityProjectAdditionalPrivilegeV2ServiceFactory = ReturnType<
@@ -118,10 +115,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
permissions: packedPermission
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -141,10 +135,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -239,10 +230,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -260,10 +248,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
temporaryMode: null
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -321,10 +306,7 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityProjectMembership.identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...deletedPrivilege,
backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts
+6 -24
View File
@@ -31,10 +31,7 @@ type TIdentityProjectAdditionalPrivilegeServiceFactoryDep = {
identityProjectAdditionalPrivilegeDAL: TIdentityProjectAdditionalPrivilegeDALFactory;
identityProjectDAL: Pick<TIdentityProjectDALFactory, "findOne" | "findById">;
projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
permissionService: Pick<
TPermissionServiceFactory,
"getProjectPermission" | "invalidateProjectPermissionCache" | "invalidateIdentityProjectPermissionCache"
>;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
};
export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
@@ -133,10 +130,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
permissions: packedPermission
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -156,10 +150,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -266,10 +257,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -287,10 +275,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
temporaryMode: null
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...additionalPrivilege,
@@ -366,10 +351,7 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId),
permissionService.invalidateIdentityProjectPermissionCache(identityId)
]);
await permissionService.invalidateProjectPermissionCache(identityProjectMembership.projectId);
return {
...deletedPrivilege,
backend/src/ee/services/permission/permission-service-types.ts
-2
View File
@@ -285,6 +285,4 @@ export type TPermissionServiceFactory = {
checkPermissions: ProjectPermissionSet;
}) => Promise<boolean>;
invalidateProjectPermissionCache: (projectId: string, tx?: Knex) => Promise<void>;
invalidateUserProjectPermissionCache: (userId: string) => Promise<void>;
invalidateIdentityProjectPermissionCache: (identityId: string) => Promise<void>;
};
backend/src/ee/services/permission/permission-service.ts
+1 -13
View File
@@ -97,16 +97,6 @@ export const permissionServiceFactory = ({
});
};
const invalidateUserProjectPermissionCache = async (userId: string) => {
const pattern = KeyStorePrefixes.UserProjectPermissionPattern(userId);
await keyStore.deleteItems({ pattern });
};
const invalidateIdentityProjectPermissionCache = async (identityId: string) => {
const pattern = KeyStorePrefixes.IdentityProjectPermissionPattern(identityId);
await keyStore.deleteItems({ pattern });
};
const calculateProjectPermissionTtl = (membership: unknown): number => {
const now = new Date();
let minTtl = KeyStoreTtls.ProjectPermissionCacheInSeconds;
@@ -805,8 +795,6 @@ export const permissionServiceFactory = ({
buildOrgPermission,
buildProjectPermissionRules,
checkGroupProjectPermission,
invalidateProjectPermissionCache,
invalidateUserProjectPermissionCache,
invalidateIdentityProjectPermissionCache
invalidateProjectPermissionCache
};
};
backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts
+6 -24
View File
@@ -27,10 +27,7 @@ import {
type TProjectUserAdditionalPrivilegeServiceFactoryDep = {
projectUserAdditionalPrivilegeDAL: TProjectUserAdditionalPrivilegeDALFactory;
projectMembershipDAL: Pick<TProjectMembershipDALFactory, "findById" | "findOne">;
permissionService: Pick<
TPermissionServiceFactory,
"getProjectPermission" | "invalidateUserProjectPermissionCache" | "invalidateProjectPermissionCache"
>;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "invalidateProjectPermissionCache">;
accessApprovalRequestDAL: Pick<TAccessApprovalRequestDALFactory, "update">;
};
@@ -119,10 +116,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
permissions: packedPermission
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
]);
await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
return {
...additionalPrivilege,
@@ -143,10 +137,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
]);
await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
return {
...additionalPrivilege,
@@ -245,10 +236,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
]);
await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
return {
...additionalPrivilege,
@@ -266,10 +254,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
temporaryMode: null
});
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
]);
await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
return {
...additionalPrivilege,
@@ -318,10 +303,7 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
);
const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
await Promise.allSettled([
permissionService.invalidateProjectPermissionCache(projectMembership.projectId),
permissionService.invalidateUserProjectPermissionCache(projectMembership.userId)
]);
await permissionService.invalidateProjectPermissionCache(projectMembership.projectId);
return {
...deletedPrivilege,