awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 04:14:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address PR comments for Azure Client Secret Rotation

Browse Source
This commit is contained in:
carlosmonastyrski
2025-04-29 20:19:30 -03:00
parent 511becabd8
commit 2a28d74bde
16 changed files with 54 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-fns.ts
+25 -18
View File
@@ -1,3 +1,5 @@
import { AxiosError } from "axios";
import {
AzureAddPasswordResponse,
TAzureClientSecretRotationGeneratedCredentials,
@@ -11,7 +13,7 @@ import {
TRotationFactoryRotateCredentials
} from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
import { request } from "@app/lib/config/request";
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
import { BadRequestError } from "@app/lib/errors";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-client-secrets";
const GRAPH_API_BASE = "https://graph.microsoft.com/v1.0";
@@ -23,8 +25,7 @@ export const azureClientSecretRotationFactory: TRotationFactory<
const {
connection,
parameters: { appId },
secretsMapping,
rotationInterval
secretsMapping
} = secretRotation;
/**
@@ -34,11 +35,6 @@ export const azureClientSecretRotationFactory: TRotationFactory<
const accessToken = await getAzureConnectionAccessToken(connection.id, appConnectionDAL, kmsService);
const endpoint = `${GRAPH_API_BASE}/applications/${appId}/addPassword`;
await blockLocalAndPrivateIpAddresses(endpoint);
const endDateTime = new Date();
endDateTime.setDate(endDateTime.getDate() + rotationInterval);
const now = new Date();
const formattedDate = `${String(now.getMonth() + 1).padStart(2, "0")}-${String(now.getDate()).padStart(
2,
@@ -50,8 +46,7 @@ export const azureClientSecretRotationFactory: TRotationFactory<
endpoint,
{
passwordCredential: {
displayName: `Infisical Rotated Secret (${formattedDate})`,
endDateTime: endDateTime.toISOString()
displayName: `Infisical Rotated Secret (${formattedDate})`
}
},
{
@@ -70,9 +65,15 @@ export const azureClientSecretRotationFactory: TRotationFactory<
clientSecret: data.secretText,
clientId: data.keyId
};
} catch (err: unknown) {
const message = err instanceof Error ? err.message : String(err);
throw new Error(`Failed to add client secret to Azure app ${appId}: ${message}`);
} catch (error: unknown) {
if (error instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to add client secret to Azure app ${appId}: ${error.message || "Unknown error"}`
});
}
throw new BadRequestError({
message: "Unable to validate connection: verify credentials"
});
}
};
@@ -83,8 +84,6 @@ export const azureClientSecretRotationFactory: TRotationFactory<
const accessToken = await getAzureConnectionAccessToken(connection.id, appConnectionDAL, kmsService);
const endpoint = `${GRAPH_API_BASE}/applications/${appId}/removePassword`;
await blockLocalAndPrivateIpAddresses(endpoint);
try {
await request.post(
endpoint,
@@ -96,9 +95,17 @@ export const azureClientSecretRotationFactory: TRotationFactory<
}
}
);
} catch (err: unknown) {
const message = err instanceof Error ? err.message : String(err);
throw new Error(`Failed to remove client secret with keyId ${clientId} from app ${appId}: ${message}`);
} catch (error: unknown) {
if (error instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to remove client secret with keyId ${clientId} from app ${appId}: ${
error.message || "Unknown error"
}`
});
}
throw new BadRequestError({
message: "Unable to validate connection: verify credentials"
});
}
};
backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts
+1 -5
View File
@@ -21,11 +21,7 @@ export const AzureClientSecretRotationGeneratedCredentialsSchema = z
const AzureClientSecretRotationParametersSchema = z.object({
appId: z.string().trim().min(1, "App ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId),
appName: z
.string()
.trim()
.min(1, "App Name Required")
.describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appName)
appName: z.string().trim().describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appName).optional()
});
const AzureClientSecretRotationSecretsMappingSchema = z.object({