awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed review comments

Browse Source
This commit is contained in:
Sheen Capadngan
2025-05-19 20:08:43 +08:00
parent ba8fcb6891
commit 2b4a6ad907
16 changed files with 42 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/db/migrations/20250512133213_add-external-ca-pki.ts
View File

@@ -12,12 +12,8 @@ export async function up(knex: Knex): Promise<void> {
t.uuid("certificateAuthorityId").nullable();
});
const caRows = await knex(TableName.CertificateAuthority).select("*");
if (caRows.length > 0) {
// @ts-expect-error intentional: migration
await knex(TableName.InternalCertificateAuthority).insert(caRows);
}
// @ts-expect-error intentional: migration
await knex(TableName.InternalCertificateAuthority).insert(knex(TableName.CertificateAuthority).select("*"));
await knex(TableName.InternalCertificateAuthority).update("certificateAuthorityId", knex.ref("id"));
await knex.schema.alterTable(TableName.InternalCertificateAuthority, (t) => {
@@ -90,7 +86,7 @@ export async function up(knex: Knex): Promise<void> {
t.string("ttl").nullable().alter();
t.string("lastOperationStatus");
t.text("lastOperationMessage");
t.string("lastOperationAt");
t.dateTime("lastOperationAt");
});
}
}

2
backend/src/db/schemas/pki-subscribers.ts
View File

@@ -22,7 +22,7 @@ export const PkiSubscribersSchema = z.object({
status: z.string(),
lastOperationStatus: z.string().nullable().optional(),
lastOperationMessage: z.string().nullable().optional(),
lastOperationAt: z.string().nullable().optional()
lastOperationAt: z.date().nullable().optional()
});
export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

2
backend/src/server/routes/v1/certificate-authority-routers/certificate-authority-endpoints.ts
View File

@@ -204,7 +204,7 @@ export const registerCertificateAuthorityEndpoints = <
server.route({
method: "DELETE",
url: `/:certificateAuthorityId`,
url: "/:certificateAuthorityId",
config: {
rateLimit: writeLimit
},

1
backend/src/server/routes/v2/certificate-authority-router.ts
View File

@@ -1,4 +1,3 @@
/* eslint-disable @typescript-eslint/no-floating-promises */
import { z } from "zod";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";

3
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
View File

@@ -6,6 +6,7 @@ import { KeyObject } from "crypto";
import { TableName } from "@app/db/schemas";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { OrgServiceActor } from "@app/lib/types";
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
@@ -406,6 +407,8 @@ export const AcmeCertificateAuthorityFns = ({
);
}
await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
const acmeClient = new acme.Client({
directoryUrl: acmeCa.configuration.directoryUrl,
accountKey

4
backend/src/services/certificate-authority/acme/acme-certificate-authority-schemas.ts
View File

@@ -11,13 +11,13 @@ import {
import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
export const AcmeCertificateAuthorityConfigurationSchema = z.object({
dnsAppConnectionId: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
dnsAppConnectionId: z.string().uuid().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
// soon, differentiate via the provider property
dnsProviderConfig: z.object({
provider: z.nativeEnum(AcmeDnsProvider).describe(CertificateAuthorities.CONFIGURATIONS.ACME.provider),
hostedZoneId: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.hostedZoneId)
}),
directoryUrl: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
directoryUrl: z.string().url().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
accountEmail: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.accountEmail)
});

4
backend/src/services/certificate-authority/certificate-authority-queue.ts
View File

@@ -156,7 +156,7 @@ export const certificateAuthorityQueueFactory = ({
await pkiSubscriberDAL.updateById(subscriberId, {
lastOperationStatus: SubscriberOperationStatus.SUCCESS,
lastOperationMessage: "Certificate ordered successfully",
lastOperationAt: new Date().toISOString()
lastOperationAt: new Date()
});
}
} catch (e: unknown) {
@@ -164,7 +164,7 @@ export const certificateAuthorityQueueFactory = ({
await pkiSubscriberDAL.updateById(subscriberId, {
lastOperationStatus: SubscriberOperationStatus.FAILED,
lastOperationMessage: e.message,
lastOperationAt: new Date().toISOString()
lastOperationAt: new Date()
});
}
logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);

2
backend/src/services/certificate-authority/certificate-authority-service.ts
View File

@@ -140,7 +140,7 @@ export const certificateAuthorityServiceFactory = ({
type,
disableDirectIssuance: ca.disableDirectIssuance,
name: ca.internalCa?.friendlyName,
projectId,
projectId: finalProjectId,
status,
configuration: ca.internalCa
} as TCertificateAuthority;

18
backend/src/services/certificate/certificate-dal.ts
View File

@@ -11,14 +11,18 @@ export const certificateDALFactory = (db: TDbClient) => {
const certificateOrm = ormify(db, TableName.Certificate);
const findLatestActiveCertForSubscriber = async ({ subscriberId }: { subscriberId: string }) => {
const cert = await db
.replicaNode()(TableName.Certificate)
.where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
.where("notAfter", ">", new Date())
.orderBy("notBefore", "desc")
.first();
try {
const cert = await db
.replicaNode()(TableName.Certificate)
.where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
.where("notAfter", ">", new Date())
.orderBy("notBefore", "desc")
.first();
return cert;
return cert;
} catch (error) {
throw new DatabaseError({ error, name: "Find latest active certificate for subscriber" });
}
};
const countCertificatesInProject = async ({

4
backend/src/services/pki-subscriber/pki-subscriber-service.ts
View File

@@ -710,6 +710,10 @@ export const pkiSubscriberServiceFactory = ({
projectId
});
if (!subscriber) {
throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
}
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,

2
docs/api-reference/endpoints/pki/subscribers/issue-cert.mdx
View File

@@ -1,4 +1,4 @@
---
title: "Issue Certificate"
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/issue-cert"
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/issue-certificate"
---

4
docs/api-reference/endpoints/pki/subscribers/order-cert.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Order Certificate"
openapi: "POST /api/v1/pki/subscribers/{subscriberName}/order-certificate"
---

1
docs/mint.json
View File

@@ -1469,6 +1469,7 @@
"api-reference/endpoints/pki/subscribers/delete",
"api-reference/endpoints/pki/subscribers/issue-cert",
"api-reference/endpoints/pki/subscribers/sign-cert",
"api-reference/endpoints/pki/subscribers/order-cert",
"api-reference/endpoints/pki/subscribers/get-active-cert-bundle"
]
},

2
frontend/src/hooks/api/pkiSubscriber/types.ts
View File

@@ -17,7 +17,7 @@ export type TPkiSubscriber = {
name: string;
commonName: string;
status: PkiSubscriberStatus;
ttl: string;
ttl?: string;
subjectAlternativeNames: string[];
keyUsages: CertKeyUsage[];
extendedKeyUsages: CertExtendedKeyUsage[];

5
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaSection.tsx
View File

@@ -26,7 +26,7 @@ export const ExternalCaSection = () => {
const onRemoveCaSubmit = async (caId: string, type: CaType) => {
try {
if (!currentWorkspace?.slug) return;
if (!currentWorkspace?.id) return;
await deleteCa({ caId, type, projectId: currentWorkspace.id });
@@ -67,7 +67,7 @@ export const ExternalCaSection = () => {
} catch (err) {
console.error(err);
createNotification({
text: `Failed to ${status === CaStatus.ACTIVE ? "enabled" : "disabled"} CA`,
text: `Failed to ${status === CaStatus.ACTIVE ? "enable" : "disable"} CA`,
type: "error"
});
}
@@ -84,7 +84,6 @@ export const ExternalCaSection = () => {
{(isAllowed) => (
<Button
colorSchema="primary"
type="submit"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
onClick={() => handlePopUpOpen("ca")}
isDisabled={!isAllowed}

9
frontend/src/pages/cert-manager/PkiSubscriberDetailsByIDPage/components/PkiSubscriberDetailsSection.tsx
View File

@@ -66,7 +66,8 @@ export const PkiSubscriberDetailsSection = ({ subscriberName, handlePopUpOpen }:
const { mutateAsync: issuePkiSubscriberCert, isPending: isIssuingCert } =
useIssuePkiSubscriberCert();
const { mutateAsync: orderPkiSubscriberCert } = useOrderPkiSubscriberCert();
const { mutateAsync: orderPkiSubscriberCert, isPending: isOrderingCert } =
useOrderPkiSubscriberCert();
const onIssuePkiSubscriberCert = async () => {
try {
@@ -90,8 +91,8 @@ export const PkiSubscriberDetailsSection = ({ subscriberName, handlePopUpOpen }:
await orderPkiSubscriberCert({ subscriberName, projectId });
createNotification({
text: "Successfully ordered certificate. It will be issued after CA processing.",
type: "success"
text: "Successfully ordered certificate. It will be issued after CA processing which could take a few minutes.",
type: "info"
});
}
} catch (err) {
@@ -198,7 +199,7 @@ export const PkiSubscriberDetailsSection = ({ subscriberName, handlePopUpOpen }:
className="mt-2 w-full"
colorSchema="primary"
type="button"
isLoading={isIssuingCert}
isLoading={isIssuingCert || isOrderingCert}
onClick={() => {
onIssuePkiSubscriberCert();
}}