From 30b959babbdc069668490be946a838cd680a2b53 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Thu, 25 Jan 2024 00:25:23 -0500 Subject: [PATCH] JWT_AUTH_SECRET => AUTH_SECRET --- backend-pg/src/lib/config/env.ts | 7 ++++--- backend-pg/src/lib/logger/logger.ts | 11 ++++++----- backend-pg/src/server/plugins/auth/inject-identity.ts | 2 +- backend-pg/src/server/routes/v1/auth-router.ts | 4 ++-- backend-pg/src/server/routes/v2/mfa-router.ts | 2 +- backend-pg/src/services/auth/auth-fns.ts | 4 ++-- backend-pg/src/services/auth/auth-login-service.ts | 8 ++++---- backend-pg/src/services/auth/auth-password-service.ts | 2 +- backend-pg/src/services/auth/auth-signup-service.ts | 10 +++++----- .../identity-access-token-service.ts | 2 +- .../src/services/identity-ua/identity-ua-service.ts | 2 +- backend-pg/src/services/org/org-service.ts | 2 +- 12 files changed, 29 insertions(+), 27 deletions(-) diff --git a/backend-pg/src/lib/config/env.ts b/backend-pg/src/lib/config/env.ts index 6f8f2d478..eac9a187b 100644 --- a/backend-pg/src/lib/config/env.ts +++ b/backend-pg/src/lib/config/env.ts @@ -36,7 +36,7 @@ const envSchema = z .default("#5VihU%rbXHcHwWwCot5L3vyPsx$7dWYw^iGk!EJg2bC*f$PD$%KCqx^R@#^LSEf"), SITE_URL: zpStr(z.string().optional()), // jwt options - JWT_AUTH_SECRET: zpStr(z.string()), + AUTH_SECRET: zpStr(z.string()).default(process.env.JWT_AUTH_SECRET), // for those still using old JWT_AUTH_SECRET JWT_AUTH_LIFETIME: zpStr(z.string().default("10d")), JWT_SIGNUP_LIFETIME: zpStr(z.string().default("15m")), JWT_REFRESH_LIFETIME: zpStr(z.string().default("90d")), @@ -49,7 +49,7 @@ const envSchema = z CLIENT_SECRET_GITHUB_LOGIN: zpStr(z.string().optional()), CLIENT_ID_GITLAB_LOGIN: zpStr(z.string().optional()), CLIENT_SECRET_GITLAB_LOGIN: zpStr(z.string().optional()), - CLIENT_GITLAB_LOGIN_URL: zpStr(z.string().optional().default(GITLAB_URL)), + CLIENT_GITLAB_LOGIN_URL: zpStr(z.string().optional().default(process.env.URL_GITLAB_LOGIN ?? GITLAB_URL)), // fallback since URL_GITLAB_LOGIN has been renamed // integration client secrets // heroku CLIENT_ID_HEROKU: zpStr(z.string().optional()), @@ -73,7 +73,7 @@ const envSchema = z // azure CLIENT_ID_AZURE: zpStr(z.string().optional()), CLIENT_SECRET_AZURE: zpStr(z.string().optional()), - // google + // gitlab CLIENT_ID_GITLAB: zpStr(z.string().optional()), CLIENT_SECRET_GITLAB: zpStr(z.string().optional()), URL_GITLAB_URL: zpStr(z.string().optional().default(GITLAB_URL)), @@ -114,6 +114,7 @@ export const initEnvConfig = (logger: Logger) => { logger.error(parsedEnv.error.issues); process.exit(-1); } + envCfg = Object.freeze(parsedEnv.data); return envCfg; }; diff --git a/backend-pg/src/lib/logger/logger.ts b/backend-pg/src/lib/logger/logger.ts index e04f82cc7..82db1725c 100644 --- a/backend-pg/src/lib/logger/logger.ts +++ b/backend-pg/src/lib/logger/logger.ts @@ -14,11 +14,12 @@ const logLevelToSeverityLookup: Record = { // eslint-disable-next-line import/no-mutable-exports export let logger: Readonly; -// akhilmhdh: why this instead of putting it in config right -// reason is to avoid a cyclical condition -// config needs logger to output error when invalid environment is provided -// logger needs config to get aws or other transport cred -// this would make logger independent package +// akhilmhdh: +// The logger is not placed in the main app config to avoid a circular dependency. +// The config requires the logger to display errors when an invalid environment is supplied. +// On the other hand, the logger needs the config to obtain credentials for AWS or other transports. +// By keeping the logger separate, it becomes an independent package. + const loggerConfig = z.object({ AWS_CLOUDWATCH_LOG_GROUP_NAME: z.string().default("infisical-log-stream"), AWS_CLOUDWATCH_LOG_REGION: z.string().default("us-east-1"), diff --git a/backend-pg/src/server/plugins/auth/inject-identity.ts b/backend-pg/src/server/plugins/auth/inject-identity.ts index 98e6e4124..f60b9f4c5 100644 --- a/backend-pg/src/server/plugins/auth/inject-identity.ts +++ b/backend-pg/src/server/plugins/auth/inject-identity.ts @@ -82,7 +82,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => { server.decorateRequest("auth", null); server.addHook("onRequest", async (req) => { const appCfg = getConfig(); - const { authMode, token, actor } = await extractAuth(req, appCfg.JWT_AUTH_SECRET); + const { authMode, token, actor } = await extractAuth(req, appCfg.AUTH_SECRET); if (!authMode) return; switch (authMode) { diff --git a/backend-pg/src/server/routes/v1/auth-router.ts b/backend-pg/src/server/routes/v1/auth-router.ts index 47b8880dc..871b56c1f 100644 --- a/backend-pg/src/server/routes/v1/auth-router.ts +++ b/backend-pg/src/server/routes/v1/auth-router.ts @@ -76,7 +76,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => { const decodedToken = jwt.verify( refreshToken, - appCfg.JWT_AUTH_SECRET + appCfg.AUTH_SECRET ) as AuthModeRefreshJwtTokenPayload; if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN) throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" }); @@ -98,7 +98,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => { tokenVersionId: tokenVersion.id, accessVersion: tokenVersion.accessVersion }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_AUTH_LIFETIME } ); diff --git a/backend-pg/src/server/routes/v2/mfa-router.ts b/backend-pg/src/server/routes/v2/mfa-router.ts index 7b8c27204..6efda7221 100644 --- a/backend-pg/src/server/routes/v2/mfa-router.ts +++ b/backend-pg/src/server/routes/v2/mfa-router.ts @@ -21,7 +21,7 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => { return res; } - const decodedToken = jwt.verify(token, cfg.JWT_AUTH_SECRET) as JwtPayload; + const decodedToken = jwt.verify(token, cfg.AUTH_SECRET) as JwtPayload; if (decodedToken.authTokenType !== AuthTokenType.MFA_TOKEN) throw new Error("Unauthorized access"); diff --git a/backend-pg/src/services/auth/auth-fns.ts b/backend-pg/src/services/auth/auth-fns.ts index 6550251c0..91f34345c 100644 --- a/backend-pg/src/services/auth/auth-fns.ts +++ b/backend-pg/src/services/auth/auth-fns.ts @@ -14,7 +14,7 @@ export const validateProviderAuthToken = (providerToken: string, email: string) const appCfg = getConfig(); const decodedToken = jwt.verify( providerToken, - appCfg.JWT_AUTH_SECRET + appCfg.AUTH_SECRET ) as AuthModeProviderJwtTokenPayload; if (decodedToken.authTokenType !== AuthTokenType.PROVIDER_TOKEN) throw new UnauthorizedError(); @@ -43,7 +43,7 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid const decodedToken = jwt.verify( AUTH_TOKEN_VALUE, - appCfg.JWT_AUTH_SECRET + appCfg.AUTH_SECRET ) as AuthModeProviderSignUpTokenPayload; if (!validate) return decodedToken; diff --git a/backend-pg/src/services/auth/auth-login-service.ts b/backend-pg/src/services/auth/auth-login-service.ts index 622c7165a..e10fe6830 100644 --- a/backend-pg/src/services/auth/auth-login-service.ts +++ b/backend-pg/src/services/auth/auth-login-service.ts @@ -98,7 +98,7 @@ export const authLoginServiceFactory = ({ tokenVersionId: tokenSession.id, accessVersion: tokenSession.accessVersion }, - cfg.JWT_AUTH_SECRET, + cfg.AUTH_SECRET, { expiresIn: cfg.JWT_AUTH_LIFETIME } ); @@ -109,7 +109,7 @@ export const authLoginServiceFactory = ({ tokenVersionId: tokenSession.id, refreshVersion: tokenSession.refreshVersion }, - cfg.JWT_AUTH_SECRET, + cfg.AUTH_SECRET, { expiresIn: cfg.JWT_REFRESH_LIFETIME } ); @@ -178,7 +178,7 @@ export const authLoginServiceFactory = ({ if (userEnc.isMfaEnabled) { const mfaToken = jwt.sign( { authTokenType: AuthTokenType.MFA_TOKEN, userId: userEnc.userId }, - cfg.JWT_AUTH_SECRET, + cfg.AUTH_SECRET, { expiresIn: cfg.JWT_MFA_LIFETIME } ); await sendUserMfaCode(userEnc.userId, userEnc.email); @@ -254,7 +254,7 @@ export const authLoginServiceFactory = ({ } : {}) }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_PROVIDER_AUTH_LIFETIME } diff --git a/backend-pg/src/services/auth/auth-password-service.ts b/backend-pg/src/services/auth/auth-password-service.ts index d939f68da..3ea656184 100644 --- a/backend-pg/src/services/auth/auth-password-service.ts +++ b/backend-pg/src/services/auth/auth-password-service.ts @@ -148,7 +148,7 @@ export const authPaswordServiceFactory = ({ authTokenType: AuthTokenType.SIGNUP_TOKEN, userId: user.id }, - cfg.JWT_AUTH_SECRET, + cfg.AUTH_SECRET, { expiresIn: cfg.JWT_SIGNUP_LIFETIME } ); diff --git a/backend-pg/src/services/auth/auth-signup-service.ts b/backend-pg/src/services/auth/auth-signup-service.ts index 5db34e61d..17e45845f 100644 --- a/backend-pg/src/services/auth/auth-signup-service.ts +++ b/backend-pg/src/services/auth/auth-signup-service.ts @@ -88,7 +88,7 @@ export const authSignupServiceFactory = ({ authTokenType: AuthTokenType.SIGNUP_TOKEN, userId: user.id.toString() }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_SIGNUP_LIFETIME } ); @@ -181,7 +181,7 @@ export const authSignupServiceFactory = ({ tokenVersionId: tokenSession.id, accessVersion: tokenSession.accessVersion }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_AUTH_LIFETIME } ); @@ -192,7 +192,7 @@ export const authSignupServiceFactory = ({ tokenVersionId: tokenSession.id, refreshVersion: tokenSession.refreshVersion }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_REFRESH_LIFETIME } ); @@ -281,7 +281,7 @@ export const authSignupServiceFactory = ({ tokenVersionId: tokenSession.id, accessVersion: tokenSession.accessVersion }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_SIGNUP_LIFETIME } ); @@ -292,7 +292,7 @@ export const authSignupServiceFactory = ({ tokenVersionId: tokenSession.id, refreshVersion: tokenSession.refreshVersion }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_SIGNUP_LIFETIME } ); diff --git a/backend-pg/src/services/identity-access-token/identity-access-token-service.ts b/backend-pg/src/services/identity-access-token/identity-access-token-service.ts index 8704e6af1..5ed0e4b86 100644 --- a/backend-pg/src/services/identity-access-token/identity-access-token-service.ts +++ b/backend-pg/src/services/identity-access-token/identity-access-token-service.ts @@ -88,7 +88,7 @@ export const identityAccessTokenServiceFactory = ({ const renewAccessToken = async ({ accessToken }: TRenewAccessTokenDTO) => { const appCfg = getConfig(); - const decodedToken = jwt.verify(accessToken, appCfg.JWT_AUTH_SECRET) as JwtPayload; + const decodedToken = jwt.verify(accessToken, appCfg.AUTH_SECRET) as JwtPayload; if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) throw new UnauthorizedError(); diff --git a/backend-pg/src/services/identity-ua/identity-ua-service.ts b/backend-pg/src/services/identity-ua/identity-ua-service.ts index 528e26c3a..e5179db90 100644 --- a/backend-pg/src/services/identity-ua/identity-ua-service.ts +++ b/backend-pg/src/services/identity-ua/identity-ua-service.ts @@ -131,7 +131,7 @@ export const identityUaServiceFactory = ({ identityAccessTokenId: identityAccessToken.id, authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN } as TIdentityAccessTokenJwtPayload, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: identityAccessToken.accessTokenMaxTTL === 0 diff --git a/backend-pg/src/services/org/org-service.ts b/backend-pg/src/services/org/org-service.ts index 1c5aba54d..4587c3814 100644 --- a/backend-pg/src/services/org/org-service.ts +++ b/backend-pg/src/services/org/org-service.ts @@ -385,7 +385,7 @@ export const orgServiceFactory = ({ authTokenType: AuthTokenType.SIGNUP_TOKEN, userId: user.id }, - appCfg.JWT_AUTH_SECRET, + appCfg.AUTH_SECRET, { expiresIn: appCfg.JWT_SIGNUP_LIFETIME }