awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 05:19:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated code by rabbit, reptile and maidul changes

Browse Source
This commit is contained in:
=
2025-04-21 18:43:21 +05:30
parent 649f7b560f
commit 2ee423174a
13 changed files with 83 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/assume-privilege-router.ts
+17 -10
View File
@@ -6,6 +6,7 @@ import { BadRequestError } from "@app/lib/errors";
import { writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { ActorType, AuthMode } from "@app/services/auth/auth-type";
import { requestContext } from "@fastify/request-context";
export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider) => {
server.route({
@@ -32,10 +33,10 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
handler: async (req, res) => {
if (req.auth.authMode === AuthMode.JWT) {
const payload = await server.services.assumePrivileges.assumeProjectPrivileges({
actorType: req.body.actorType,
actorId: req.body.actorId,
targetActorType: req.body.actorType,
targetActorId: req.body.actorId,
projectId: req.params.projectId,
projectPermission: req.permission,
actorPermissionDetails: req.permission,
tokenVersionId: req.auth.tokenVersionId
});
@@ -44,20 +45,22 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
httpOnly: true,
path: "/",
sameSite: "strict",
secure: appCfg.HTTPS_ENABLED
secure: appCfg.HTTPS_ENABLED,
maxAge: 3600 // 1 hour in seconds
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.PROJECT_ASSUME_PRIVILEGE,
type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_START,
metadata: {
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id,
targetActorType: req.body.actorType,
targetActorId: req.body.actorId
targetActorId: req.body.actorId,
duration: "1hr"
}
}
});
@@ -87,24 +90,28 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req, res) => {
if (req.auth.authMode === AuthMode.JWT) {
const assumePrivilege = requestContext.get("assumedProjectRole");
if (req.auth.authMode === AuthMode.JWT && assumePrivilege) {
const appCfg = getConfig();
void res.setCookie("infisical-project-assume-privileges", "", {
httpOnly: true,
path: "/",
sameSite: "strict",
secure: appCfg.HTTPS_ENABLED
secure: appCfg.HTTPS_ENABLED,
expires: new Date(0)
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
orgId: req.permission.orgId,
event: {
type: EventType.PROJECT_ASSUME_PRIVILEGE_EXIT,
type: EventType.PROJECT_ASSUME_PRIVILEGE_SESSION_END,
metadata: {
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id
requesterId: req.auth.user.id,
targetActorId: assumePrivilege.actorId,
targetActorType: assumePrivilege.actorType
}
}
});