awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 16:52:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(fips): fips validated JWT's

Browse Source
This commit is contained in:
Daniel Hougaard
2025-07-08 18:28:43 +04:00
parent ea708513ad
commit 2c50de28bd
44 changed files with 779 additions and 375 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-access-token/identity-access-token-service.ts
+5 -5
View File
@@ -1,7 +1,7 @@
import jwt, { JwtPayload } from "jsonwebtoken";
import { IdentityAuthMethod, TableName, TIdentityAccessTokens } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto";
import { JWTPayload } from "@app/lib/crypto/cryptography/types";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
@@ -81,7 +81,7 @@ export const identityAccessTokenServiceFactory = ({
const renewAccessToken = async ({ accessToken }: TRenewAccessTokenDTO) => {
const appCfg = getConfig();
const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as TIdentityAccessTokenJwtPayload;
const decodedToken = crypto.jwt().verify(accessToken, appCfg.AUTH_SECRET) as TIdentityAccessTokenJwtPayload;
if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {
throw new BadRequestError({ message: "Only identity access tokens can be renewed" });
}
@@ -145,7 +145,7 @@ export const identityAccessTokenServiceFactory = ({
expiresIn = undefined;
}
const renewedToken = jwt.sign(
const renewedToken = crypto.jwt().sign(
{
identityId: decodedToken.identityId,
clientSecretId: decodedToken.clientSecretId,
@@ -162,7 +162,7 @@ export const identityAccessTokenServiceFactory = ({
const revokeAccessToken = async (accessToken: string) => {
const appCfg = getConfig();
const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload & {
const decodedToken = crypto.jwt().verify(accessToken, appCfg.AUTH_SECRET) as JWTPayload & {
identityAccessTokenId: string;
};
if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {