awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use thumbprint instead

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-10-31 10:04:00 -07:00
parent 1fe458e23b
commit 27e88d186d
2 changed files with 28 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
backend/src/ee/services/pki-acme/pki-acme-account-dal.ts
View File

@@ -20,19 +20,23 @@ export const pkiAcmeAccountDALFactory = (db: TDbClient) => {
}
};
const findByPublicKey = async (profileId: string, alg: string, publicKey: unknown, tx?: Knex) => {
const findByProfileIdAndPublicKeyThumbprintAndAlg = async (
profileId: string,
alg: string,
publicKeyThumbprint: string,
tx?: Knex
) => {
try {
const account = await (tx || db)(TableName.PkiAcmeAccount).where({ profileId, alg, publicKey }).first();
const account = await (tx || db)(TableName.PkiAcmeAccount).where({ profileId, alg, publicKeyThumbprint }).first();
return account || null;
} catch (error) {
throw new DatabaseError({ error, name: "Find PKI ACME account by public key and alg" });
throw new DatabaseError({ error, name: "Find PKI ACME account by profile id, public key thumbprint and alg" });
}
};
return {
...pkiAcmeAccountOrm,
findByProjectIdAndAccountId,
findByPublicKey
findByProfileIdAndPublicKeyThumbprintAndAlg
};
};

23
backend/src/ee/services/pki-acme/pki-acme-service.ts
View File

@@ -11,7 +11,14 @@ import {
EnrollmentType,
TCertificateProfileWithConfigs
} from "@app/services/certificate-profile/certificate-profile-types";
import { errors, flattenedVerify, FlattenedVerifyResult, importJWK, JWSHeaderParameters } from "jose";
import {
calculateJwkThumbprint,
errors,
flattenedVerify,
FlattenedVerifyResult,
importJWK,
JWSHeaderParameters
} from "jose";
import { z, ZodError } from "zod";
import { TPkiAcmeAccountDALFactory } from "./pki-acme-account-dal";
import { TPkiAcmeAuthDALFactory } from "./pki-acme-auth-dal";
@@ -57,7 +64,10 @@ import {
type TPkiAcmeServiceFactoryDep = {
certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findById">;
acmeAccountDAL: Pick<TPkiAcmeAccountDALFactory, "findByProjectIdAndAccountId" | "findByPublicKey" | "create">;
acmeAccountDAL: Pick<
TPkiAcmeAccountDALFactory,
"findByProjectIdAndAccountId" | "findByProfileIdAndPublicKeyThumbprintAndAlg" | "create"
>;
acmeOrderDAL: Pick<TPkiAcmeOrderDALFactory, "create" | "transaction" | "findByAccountAndOrderIdWithAuthorizations">;
acmeAuthDAL: Pick<TPkiAcmeAuthDALFactory, "create" | "findByAccountIdAndAuthIdWithChallenges">;
acmeOrderAuthDAL: Pick<TPkiAcmeOrderAuthDALFactory, "insertMany">;
@@ -286,8 +296,12 @@ export const pkiAcmeServiceFactory = ({
payload: TCreateAcmeAccountPayload;
}): Promise<TAcmeResponse<TCreateAcmeAccountResponse>> => {
const profile = await validateAcmeProfile(profileId);
// TODO: ensure unique account per public key
const existingAccount: TPkiAcmeAccounts | null = await acmeAccountDAL.findByPublicKey(profileId, alg, jwk);
const publicKeyThumbprint = await calculateJwkThumbprint(jwk, "sha256");
const existingAccount: TPkiAcmeAccounts | null = await acmeAccountDAL.findByProfileIdAndPublicKeyThumbprintAndAlg(
profileId,
alg,
publicKeyThumbprint
);
if (onlyReturnExisting && !existingAccount) {
throw new AcmeAccountDoesNotExistError({ message: "ACME account not found" });
}
@@ -311,6 +325,7 @@ export const pkiAcmeServiceFactory = ({
profileId: profile.id,
alg,
publicKey: jwk,
publicKeyThumbprint,
emails: contact ?? []
});
// TODO: create audit log here