awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

add check to make sure user can only create service token for secrets they have access to

Browse Source
This commit is contained in:
Maidul Islam
2024-01-17 15:34:39 -05:00
committed by Akhil Mohan
parent 33c3c5ecc5
commit 3213dafba9
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend-pg/src/services/service-token/service-token-service.ts
View File

@@ -1,6 +1,6 @@
import crypto from "node:crypto";
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import bcrypt from "bcrypt";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -51,6 +51,14 @@ export const serviceTokenServiceFactory = ({
ProjectPermissionActions.Create,
ProjectPermissionSub.ServiceTokens
);
scopes.forEach(({ environment, secretPath }) => {
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: secretPath })
);
})
const appCfg = getConfig();
// validates env