awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

JWT_AUTH_SECRET => AUTH_SECRET

Browse Source
This commit is contained in:
Maidul Islam
2024-01-25 00:25:23 -05:00
committed by Akhil Mohan
parent cec14efe86
commit 30b959babb
12 changed files with 29 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend-pg/src/lib/config/env.ts
View File

@@ -36,7 +36,7 @@ const envSchema = z
.default("#5VihU%rbXHcHwWwCot5L3vyPsx$7dWYw^iGk!EJg2bC*f$PD$%KCqx^R@#^LSEf"),
SITE_URL: zpStr(z.string().optional()),
// jwt options
JWT_AUTH_SECRET: zpStr(z.string()),
AUTH_SECRET: zpStr(z.string()).default(process.env.JWT_AUTH_SECRET), // for those still using old JWT_AUTH_SECRET
JWT_AUTH_LIFETIME: zpStr(z.string().default("10d")),
JWT_SIGNUP_LIFETIME: zpStr(z.string().default("15m")),
JWT_REFRESH_LIFETIME: zpStr(z.string().default("90d")),
@@ -49,7 +49,7 @@ const envSchema = z
CLIENT_SECRET_GITHUB_LOGIN: zpStr(z.string().optional()),
CLIENT_ID_GITLAB_LOGIN: zpStr(z.string().optional()),
CLIENT_SECRET_GITLAB_LOGIN: zpStr(z.string().optional()),
CLIENT_GITLAB_LOGIN_URL: zpStr(z.string().optional().default(GITLAB_URL)),
CLIENT_GITLAB_LOGIN_URL: zpStr(z.string().optional().default(process.env.URL_GITLAB_LOGIN ?? GITLAB_URL)), // fallback since URL_GITLAB_LOGIN has been renamed
// integration client secrets
// heroku
CLIENT_ID_HEROKU: zpStr(z.string().optional()),
@@ -73,7 +73,7 @@ const envSchema = z
// azure
CLIENT_ID_AZURE: zpStr(z.string().optional()),
CLIENT_SECRET_AZURE: zpStr(z.string().optional()),
// google
// gitlab
CLIENT_ID_GITLAB: zpStr(z.string().optional()),
CLIENT_SECRET_GITLAB: zpStr(z.string().optional()),
URL_GITLAB_URL: zpStr(z.string().optional().default(GITLAB_URL)),
@@ -114,6 +114,7 @@ export const initEnvConfig = (logger: Logger) => {
logger.error(parsedEnv.error.issues);
process.exit(-1);
}
envCfg = Object.freeze(parsedEnv.data);
return envCfg;
};

11
backend-pg/src/lib/logger/logger.ts
View File

@@ -14,11 +14,12 @@ const logLevelToSeverityLookup: Record<string, string> = {
// eslint-disable-next-line import/no-mutable-exports
export let logger: Readonly<Logger>;
// akhilmhdh: why this instead of putting it in config right
// reason is to avoid a cyclical condition
// config needs logger to output error when invalid environment is provided
// logger needs config to get aws or other transport cred
// this would make logger independent package
// akhilmhdh:
// The logger is not placed in the main app config to avoid a circular dependency.
// The config requires the logger to display errors when an invalid environment is supplied.
// On the other hand, the logger needs the config to obtain credentials for AWS or other transports.
// By keeping the logger separate, it becomes an independent package.
const loggerConfig = z.object({
AWS_CLOUDWATCH_LOG_GROUP_NAME: z.string().default("infisical-log-stream"),
AWS_CLOUDWATCH_LOG_REGION: z.string().default("us-east-1"),

2
backend-pg/src/server/plugins/auth/inject-identity.ts
View File

@@ -82,7 +82,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
server.decorateRequest("auth", null);
server.addHook("onRequest", async (req) => {
const appCfg = getConfig();
const { authMode, token, actor } = await extractAuth(req, appCfg.JWT_AUTH_SECRET);
const { authMode, token, actor } = await extractAuth(req, appCfg.AUTH_SECRET);
if (!authMode) return;
switch (authMode) {

4
backend-pg/src/server/routes/v1/auth-router.ts
View File

@@ -76,7 +76,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
const decodedToken = jwt.verify(
refreshToken,
appCfg.JWT_AUTH_SECRET
appCfg.AUTH_SECRET
) as AuthModeRefreshJwtTokenPayload;
if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN)
throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" });
@@ -98,7 +98,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
tokenVersionId: tokenVersion.id,
accessVersion: tokenVersion.accessVersion
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_AUTH_LIFETIME }
);

2
backend-pg/src/server/routes/v2/mfa-router.ts
View File

@@ -21,7 +21,7 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => {
return res;
}
const decodedToken = jwt.verify(token, cfg.JWT_AUTH_SECRET) as JwtPayload;
const decodedToken = jwt.verify(token, cfg.AUTH_SECRET) as JwtPayload;
if (decodedToken.authTokenType !== AuthTokenType.MFA_TOKEN)
throw new Error("Unauthorized access");

4
backend-pg/src/services/auth/auth-fns.ts
View File

@@ -14,7 +14,7 @@ export const validateProviderAuthToken = (providerToken: string, email: string)
const appCfg = getConfig();
const decodedToken = jwt.verify(
providerToken,
appCfg.JWT_AUTH_SECRET
appCfg.AUTH_SECRET
) as AuthModeProviderJwtTokenPayload;
if (decodedToken.authTokenType !== AuthTokenType.PROVIDER_TOKEN) throw new UnauthorizedError();
@@ -43,7 +43,7 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid
const decodedToken = jwt.verify(
AUTH_TOKEN_VALUE,
appCfg.JWT_AUTH_SECRET
appCfg.AUTH_SECRET
) as AuthModeProviderSignUpTokenPayload;
if (!validate) return decodedToken;

8
backend-pg/src/services/auth/auth-login-service.ts
View File

@@ -98,7 +98,7 @@ export const authLoginServiceFactory = ({
tokenVersionId: tokenSession.id,
accessVersion: tokenSession.accessVersion
},
cfg.JWT_AUTH_SECRET,
cfg.AUTH_SECRET,
{ expiresIn: cfg.JWT_AUTH_LIFETIME }
);
@@ -109,7 +109,7 @@ export const authLoginServiceFactory = ({
tokenVersionId: tokenSession.id,
refreshVersion: tokenSession.refreshVersion
},
cfg.JWT_AUTH_SECRET,
cfg.AUTH_SECRET,
{ expiresIn: cfg.JWT_REFRESH_LIFETIME }
);
@@ -178,7 +178,7 @@ export const authLoginServiceFactory = ({
if (userEnc.isMfaEnabled) {
const mfaToken = jwt.sign(
{ authTokenType: AuthTokenType.MFA_TOKEN, userId: userEnc.userId },
cfg.JWT_AUTH_SECRET,
cfg.AUTH_SECRET,
{ expiresIn: cfg.JWT_MFA_LIFETIME }
);
await sendUserMfaCode(userEnc.userId, userEnc.email);
@@ -254,7 +254,7 @@ export const authLoginServiceFactory = ({
}
: {})
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{
expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME
}

2
backend-pg/src/services/auth/auth-password-service.ts
View File

@@ -148,7 +148,7 @@ export const authPaswordServiceFactory = ({
authTokenType: AuthTokenType.SIGNUP_TOKEN,
userId: user.id
},
cfg.JWT_AUTH_SECRET,
cfg.AUTH_SECRET,
{ expiresIn: cfg.JWT_SIGNUP_LIFETIME }
);

10
backend-pg/src/services/auth/auth-signup-service.ts
View File

@@ -88,7 +88,7 @@ export const authSignupServiceFactory = ({
authTokenType: AuthTokenType.SIGNUP_TOKEN,
userId: user.id.toString()
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_SIGNUP_LIFETIME }
);
@@ -181,7 +181,7 @@ export const authSignupServiceFactory = ({
tokenVersionId: tokenSession.id,
accessVersion: tokenSession.accessVersion
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_AUTH_LIFETIME }
);
@@ -192,7 +192,7 @@ export const authSignupServiceFactory = ({
tokenVersionId: tokenSession.id,
refreshVersion: tokenSession.refreshVersion
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_REFRESH_LIFETIME }
);
@@ -281,7 +281,7 @@ export const authSignupServiceFactory = ({
tokenVersionId: tokenSession.id,
accessVersion: tokenSession.accessVersion
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_SIGNUP_LIFETIME }
);
@@ -292,7 +292,7 @@ export const authSignupServiceFactory = ({
tokenVersionId: tokenSession.id,
refreshVersion: tokenSession.refreshVersion
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{ expiresIn: appCfg.JWT_SIGNUP_LIFETIME }
);

2
backend-pg/src/services/identity-access-token/identity-access-token-service.ts
View File

@@ -88,7 +88,7 @@ export const identityAccessTokenServiceFactory = ({
const renewAccessToken = async ({ accessToken }: TRenewAccessTokenDTO) => {
const appCfg = getConfig();
const decodedToken = jwt.verify(accessToken, appCfg.JWT_AUTH_SECRET) as JwtPayload;
const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload;
if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN)
throw new UnauthorizedError();

2
backend-pg/src/services/identity-ua/identity-ua-service.ts
View File

@@ -131,7 +131,7 @@ export const identityUaServiceFactory = ({
identityAccessTokenId: identityAccessToken.id,
authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
} as TIdentityAccessTokenJwtPayload,
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{
expiresIn:
identityAccessToken.accessTokenMaxTTL === 0

2
backend-pg/src/services/org/org-service.ts
View File

@@ -385,7 +385,7 @@ export const orgServiceFactory = ({
authTokenType: AuthTokenType.SIGNUP_TOKEN,
userId: user.id
},
appCfg.JWT_AUTH_SECRET,
appCfg.AUTH_SECRET,
{
expiresIn: appCfg.JWT_SIGNUP_LIFETIME
}