awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(infisical-pg): removed short form names in secret approval to long form

Browse Source
This commit is contained in:
Akhil Mohan
2024-01-19 15:29:32 +05:30
parent f7e1da65d5
commit 32a1a0a9e5
26 changed files with 192 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
backend-pg/src/@types/knex.d.ts vendored
View File

@@ -324,7 +324,7 @@ declare module "knex/types/tables" {
TSecretApprovalPoliciesInsert,
TSecretApprovalPoliciesUpdate
>;
[TableName.SapApprover]: Knex.CompositeTableType<
[TableName.SecretApprovalPolicyApprover]: Knex.CompositeTableType<
TSapApprovers,
TSapApproversInsert,
TSapApproversUpdate
@@ -334,17 +334,17 @@ declare module "knex/types/tables" {
TSecretApprovalRequestsInsert,
TSecretApprovalRequestsUpdate
>;
[TableName.SarReviewer]: Knex.CompositeTableType<
[TableName.SecretApprovalRequestReviewer]: Knex.CompositeTableType<
TSarReviewers,
TSarReviewersInsert,
TSarReviewersUpdate
>;
[TableName.SarSecret]: Knex.CompositeTableType<
[TableName.SecretApprovalRequestSecret]: Knex.CompositeTableType<
TSaRequestSecrets,
TSaRequestSecretsInsert,
TSaRequestSecretsUpdate
>;
[TableName.SarSecretTag]: Knex.CompositeTableType<
[TableName.SecretApprovalRequestSecretTag]: Knex.CompositeTableType<
TSaRequestSecretTags,
TSaRequestSecretTagsInsert,
TSaRequestSecretTagsUpdate

10
backend-pg/src/db/migrations/20240101054849_secret-approval-policy.ts
View File

@@ -17,8 +17,8 @@ export async function up(knex: Knex): Promise<void> {
}
await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
if (!(await knex.schema.hasTable(TableName.SapApprover))) {
await knex.schema.createTable(TableName.SapApprover, (t) => {
if (!(await knex.schema.hasTable(TableName.SecretApprovalPolicyApprover))) {
await knex.schema.createTable(TableName.SecretApprovalPolicyApprover, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.uuid("approverId").notNullable();
t.foreign("approverId")
@@ -34,12 +34,12 @@ export async function up(knex: Knex): Promise<void> {
});
}
await createOnUpdateTrigger(knex, TableName.SapApprover);
await createOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
}
export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.SapApprover);
await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicyApprover);
await knex.schema.dropTableIfExists(TableName.SecretApprovalPolicy);
await dropOnUpdateTrigger(knex, TableName.SapApprover);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicyApprover);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalPolicy);
}

35
backend-pg/src/db/migrations/20240101104907_secret-approval-request.ts
View File

@@ -33,8 +33,8 @@ export async function up(knex: Knex): Promise<void> {
}
await createOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
if (!(await knex.schema.hasTable(TableName.SarReviewer))) {
await knex.schema.createTable(TableName.SarReviewer, (t) => {
if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestReviewer))) {
await knex.schema.createTable(TableName.SecretApprovalRequestReviewer, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.uuid("member").notNullable();
t.foreign("member").references("id").inTable(TableName.ProjectMembership).onDelete("CASCADE");
@@ -47,10 +47,10 @@ export async function up(knex: Knex): Promise<void> {
t.timestamps(true, true, true);
});
}
await createOnUpdateTrigger(knex, TableName.SarReviewer);
await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
if (!(await knex.schema.hasTable(TableName.SarSecret))) {
await knex.schema.createTable(TableName.SarSecret, (t) => {
if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecret))) {
await knex.schema.createTable(TableName.SecretApprovalRequestSecret, (t) => {
// everything related to secret
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.integer("version").defaultTo(1);
@@ -87,29 +87,32 @@ export async function up(knex: Knex): Promise<void> {
.onDelete("SET NULL");
});
}
await createOnUpdateTrigger(knex, TableName.SarSecret);
await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
if (!(await knex.schema.hasTable(TableName.SarSecretTag))) {
await knex.schema.createTable(TableName.SarSecretTag, (t) => {
if (!(await knex.schema.hasTable(TableName.SecretApprovalRequestSecretTag))) {
await knex.schema.createTable(TableName.SecretApprovalRequestSecretTag, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.uuid("secretId").notNullable();
t.foreign("secretId").references("id").inTable(TableName.SarSecret).onDelete("CASCADE");
t.foreign("secretId")
.references("id")
.inTable(TableName.SecretApprovalRequestSecret)
.onDelete("CASCADE");
t.uuid("tagId").notNullable();
t.foreign("tagId").references("id").inTable(TableName.SecretTag).onDelete("CASCADE");
t.timestamps(true, true, true);
});
}
await createOnUpdateTrigger(knex, TableName.SarSecretTag);
await createOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
}
export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.SarSecretTag);
await knex.schema.dropTableIfExists(TableName.SarSecret);
await knex.schema.dropTableIfExists(TableName.SarReviewer);
await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecretTag);
await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestSecret);
await knex.schema.dropTableIfExists(TableName.SecretApprovalRequestReviewer);
await knex.schema.dropTableIfExists(TableName.SecretApprovalRequest);
await dropOnUpdateTrigger(knex, TableName.SarSecretTag);
await dropOnUpdateTrigger(knex, TableName.SarSecret);
await dropOnUpdateTrigger(knex, TableName.SarReviewer);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecretTag);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestSecret);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequestReviewer);
await dropOnUpdateTrigger(knex, TableName.SecretApprovalRequest);
}

8
backend-pg/src/db/schemas/index.ts
View File

@@ -25,13 +25,13 @@ export * from "./project-keys";
export * from "./project-memberships";
export * from "./project-roles";
export * from "./projects";
export * from "./sa-request-secret-tags";
export * from "./sa-request-secrets";
export * from "./saml-configs";
export * from "./sap-approvers";
export * from "./sar-reviewers";
export * from "./secret-approval-policies";
export * from "./secret-approval-policies-approvers";
export * from "./secret-approval-request-secret-tags";
export * from "./secret-approval-requests";
export * from "./secret-approval-requests-reviewers";
export * from "./secret-approval-requests-secrets";
export * from "./secret-blind-indexes";
export * from "./secret-folder-versions";
export * from "./secret-folders";

8
backend-pg/src/db/schemas/models.ts
View File

@@ -41,11 +41,11 @@ export enum TableName {
IdentityOrgMembership = "identity_org_memberships",
IdentityProjectMembership = "identity_project_memberships",
SecretApprovalPolicy = "secret_approval_policies",
SapApprover = "sap_approvers", // sap: secret approval policy
SecretApprovalPolicyApprover = "secret_approval_policies_approvers",
SecretApprovalRequest = "secret_approval_requests",
SarReviewer = "sar_reviewers",
SarSecret = "sa_request_secrets",
SarSecretTag = "sa_request_secret_tags",
SecretApprovalRequestReviewer = "secret_approval_requests_reviewers",
SecretApprovalRequestSecret = "secret_approval_requests_secrets",
SecretApprovalRequestSecretTag = "secret_approval_request_secret_tags",
SecretRotation = "secret_rotations",
SecretRotationOutput = "secret_rotation_outputs",
SamlConfig = "saml_configs",

20
backend-pg/src/db/schemas/sa-request-secret-tags.ts
View File

@@ -1,20 +0,0 @@
// Code generated by automation script, DO NOT EDIT.
// Automated by pulling database and generating zod schema
// To update. Just run npm run generate:schema
// Written by akhilmhdh.
import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const SaRequestSecretTagsSchema = z.object({
id: z.string().uuid(),
secretId: z.string().uuid(),
tagId: z.string().uuid(),
createdAt: z.date(),
updatedAt: z.date(),
});
export type TSaRequestSecretTags = z.infer<typeof SaRequestSecretTagsSchema>;
export type TSaRequestSecretTagsInsert = Omit<TSaRequestSecretTags, TImmutableDBKeys>;
export type TSaRequestSecretTagsUpdate = Partial<Omit<TSaRequestSecretTags, TImmutableDBKeys>>;

8
backend-pg/src/db/schemas/sap-approvers.ts → backend-pg/src/db/schemas/secret-approval-policies-approvers.ts
View File

@@ -7,7 +7,7 @@ import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const SapApproversSchema = z.object({
export const SecretApprovalPoliciesApproversSchema = z.object({
id: z.string().uuid(),
approverId: z.string().uuid(),
policyId: z.string().uuid(),
@@ -15,6 +15,6 @@ export const SapApproversSchema = z.object({
updatedAt: z.date(),
});
export type TSapApprovers = z.infer<typeof SapApproversSchema>;
export type TSapApproversInsert = Omit<TSapApprovers, TImmutableDBKeys>;
export type TSapApproversUpdate = Partial<Omit<TSapApprovers, TImmutableDBKeys>>;
export type TSecretApprovalPoliciesApprovers = z.infer<typeof SecretApprovalPoliciesApproversSchema>;
export type TSecretApprovalPoliciesApproversInsert = Omit<TSecretApprovalPoliciesApprovers, TImmutableDBKeys>;
export type TSecretApprovalPoliciesApproversUpdate = Partial<Omit<TSecretApprovalPoliciesApprovers, TImmutableDBKeys>>;

20
backend-pg/src/db/schemas/secret-approval-request-secret-tags.ts Normal file
View File

@@ -0,0 +1,20 @@
// Code generated by automation script, DO NOT EDIT.
// Automated by pulling database and generating zod schema
// To update. Just run npm run generate:schema
// Written by akhilmhdh.
import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const SecretApprovalRequestSecretTagsSchema = z.object({
id: z.string().uuid(),
secretId: z.string().uuid(),
tagId: z.string().uuid(),
createdAt: z.date(),
updatedAt: z.date(),
});
export type TSecretApprovalRequestSecretTags = z.infer<typeof SecretApprovalRequestSecretTagsSchema>;
export type TSecretApprovalRequestSecretTagsInsert = Omit<TSecretApprovalRequestSecretTags, TImmutableDBKeys>;
export type TSecretApprovalRequestSecretTagsUpdate = Partial<Omit<TSecretApprovalRequestSecretTags, TImmutableDBKeys>>;

8
backend-pg/src/db/schemas/sar-reviewers.ts → backend-pg/src/db/schemas/secret-approval-requests-reviewers.ts
View File

@@ -7,7 +7,7 @@ import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const SarReviewersSchema = z.object({
export const SecretApprovalRequestsReviewersSchema = z.object({
id: z.string().uuid(),
member: z.string().uuid(),
status: z.string(),
@@ -16,6 +16,6 @@ export const SarReviewersSchema = z.object({
updatedAt: z.date(),
});
export type TSarReviewers = z.infer<typeof SarReviewersSchema>;
export type TSarReviewersInsert = Omit<TSarReviewers, TImmutableDBKeys>;
export type TSarReviewersUpdate = Partial<Omit<TSarReviewers, TImmutableDBKeys>>;
export type TSecretApprovalRequestsReviewers = z.infer<typeof SecretApprovalRequestsReviewersSchema>;
export type TSecretApprovalRequestsReviewersInsert = Omit<TSecretApprovalRequestsReviewers, TImmutableDBKeys>;
export type TSecretApprovalRequestsReviewersUpdate = Partial<Omit<TSecretApprovalRequestsReviewers, TImmutableDBKeys>>;

8
backend-pg/src/db/schemas/sa-request-secrets.ts → backend-pg/src/db/schemas/secret-approval-requests-secrets.ts
View File

@@ -7,7 +7,7 @@ import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const SaRequestSecretsSchema = z.object({
export const SecretApprovalRequestsSecretsSchema = z.object({
id: z.string().uuid(),
version: z.number().default(1).nullable().optional(),
secretBlindIndex: z.string(),
@@ -34,6 +34,6 @@ export const SaRequestSecretsSchema = z.object({
secretVersion: z.string().uuid().nullable().optional(),
});
export type TSaRequestSecrets = z.infer<typeof SaRequestSecretsSchema>;
export type TSaRequestSecretsInsert = Omit<TSaRequestSecrets, TImmutableDBKeys>;
export type TSaRequestSecretsUpdate = Partial<Omit<TSaRequestSecrets, TImmutableDBKeys>>;
export type TSecretApprovalRequestsSecrets = z.infer<typeof SecretApprovalRequestsSecretsSchema>;
export type TSecretApprovalRequestsSecretsInsert = Omit<TSecretApprovalRequestsSecrets, TImmutableDBKeys>;
export type TSecretApprovalRequestsSecretsUpdate = Partial<Omit<TSecretApprovalRequestsSecrets, TImmutableDBKeys>>;

10
backend-pg/src/ee/routes/v1/secret-approval-policy-router.ts
View File

@@ -31,7 +31,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const approval = await server.services.secretApprovalPolicy.createSap({
const approval = await server.services.secretApprovalPolicy.createSecretApprovalPolicy({
actor: req.permission.type,
actorId: req.permission.id,
projectId: req.body.workspaceId,
@@ -68,7 +68,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const approval = await server.services.secretApprovalPolicy.updateSap({
const approval = await server.services.secretApprovalPolicy.updateSecretApprovalPolicy({
actor: req.permission.type,
actorId: req.permission.id,
...req.body,
@@ -93,7 +93,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const approval = await server.services.secretApprovalPolicy.deleteSap({
const approval = await server.services.secretApprovalPolicy.deleteSecretApprovalPolicy({
actor: req.permission.type,
actorId: req.permission.id,
secretPolicyId: req.params.sapId
@@ -117,7 +117,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const approvals = await server.services.secretApprovalPolicy.getSapByProjectId({
const approvals = await server.services.secretApprovalPolicy.getSecretApprovalPolicyByProjectId({
actor: req.permission.type,
actorId: req.permission.id,
projectId: req.query.workspaceId
@@ -143,7 +143,7 @@ export const registerSecretApprovalPolicyRouter = async (server: FastifyZodProvi
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actor: req.permission.type,
actorId: req.permission.id,
projectId: req.query.workspaceId,

8
backend-pg/src/ee/routes/v1/secret-approval-request-router.ts
View File

@@ -1,9 +1,9 @@
import { z } from "zod";
import {
SaRequestSecretsSchema,
SarReviewersSchema,
SecretApprovalRequestsReviewersSchema,
SecretApprovalRequestsSchema,
SecretApprovalRequestsSecretsSchema,
SecretsSchema,
SecretVersionsSchema
} from "@app/db/schemas";
@@ -113,7 +113,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
reviewers: z.object({ member: z.string(), status: z.string() }).array(),
approvers: z.string().array(),
secretPath: z.string(),
commits: SaRequestSecretsSchema.omit({ secretBlindIndex: true })
commits: SecretApprovalRequestsSecretsSchema.omit({ secretBlindIndex: true })
.merge(
z.object({
secret: SecretsSchema.pick({
@@ -197,7 +197,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
}),
response: {
200: z.object({
review: SarReviewersSchema
review: SecretApprovalRequestsReviewersSchema
})
}
},

2
backend-pg/src/ee/services/license/licence-fns.ts
View File

@@ -27,7 +27,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
status: null,
trial_end: null,
has_used_trial: true,
secretApproval: false,
secretApproval: true,
secretRotation: true
});

10
backend-pg/src/ee/services/secret-approval-policy/sap-approver-dal.ts
View File

@@ -1,10 +0,0 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TSapApproverDALFactory = ReturnType<typeof sapApproverDALFactory>;
export const sapApproverDALFactory = (db: TDbClient) => {
const sapApproverOrm = ormify(db, TableName.SapApprover);
return sapApproverOrm;
};

12
backend-pg/src/ee/services/secret-approval-policy/secret-approval-policy-approver-dal.ts Normal file
View File

@@ -0,0 +1,12 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TSecretApprovalPolicyApproverDALFactory = ReturnType<
typeof secretApprovalPolicyApproverDALFactory
>;
export const secretApprovalPolicyApproverDALFactory = (db: TDbClient) => {
const sapApproverOrm = ormify(db, TableName.SecretApprovalPolicyApprover);
return sapApproverOrm;
};

11
backend-pg/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts
View File

@@ -1,14 +1,15 @@
import { Knex } from "knex";
import { TDbClient } from "@app/db";
import { TableName,TSecretApprovalPolicies } from "@app/db/schemas";
import { TableName, TSecretApprovalPolicies } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import {
buildFindFilter,
mergeOneToManyRelation,
ormify,
selectAllTableCols,
TFindFilter} from "@app/lib/knex";
TFindFilter
} from "@app/lib/knex";
export type TSecretApprovalPolicyDALFactory = ReturnType<typeof secretApprovalPolicyDALFactory>;
@@ -24,11 +25,11 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
`${TableName.Environment}.id`
)
.join(
TableName.SapApprover,
TableName.SecretApprovalPolicyApprover,
`${TableName.SecretApprovalPolicy}.id`,
`${TableName.SapApprover}.policyId`
`${TableName.SecretApprovalPolicyApprover}.policyId`
)
.select(tx.ref("approverId").withSchema(TableName.SapApprover))
.select(tx.ref("approverId").withSchema(TableName.SecretApprovalPolicyApprover))
.select(tx.ref("name").withSchema(TableName.Environment).as("envName"))
.select(tx.ref("slug").withSchema(TableName.Environment).as("envSlug"))
.select(tx.ref("id").withSchema(TableName.Environment).as("envId"))

42
backend-pg/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
View File

@@ -11,7 +11,7 @@ import { containsGlobPatterns } from "@app/lib/picomatch";
import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
import { TSapApproverDALFactory } from "./sap-approver-dal";
import { TSecretApprovalPolicyApproverDALFactory } from "./secret-approval-policy-approver-dal";
import { TSecretApprovalPolicyDALFactory } from "./secret-approval-policy-dal";
import {
TCreateSapDTO,
@@ -30,7 +30,7 @@ type TSecretApprovalPolicyServiceFactoryDep = {
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
sapApproverDAL: TSapApproverDALFactory;
secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
projectMembershipDAL: Pick<TProjectMembershipDALFactory, "find">;
};
@@ -41,11 +41,11 @@ export type TSecretApprovalPolicyServiceFactory = ReturnType<
export const secretApprovalPolicyServiceFactory = ({
secretApprovalPolicyDAL,
permissionService,
sapApproverDAL,
secretApprovalPolicyApproverDAL,
projectEnvDAL,
projectMembershipDAL
}: TSecretApprovalPolicyServiceFactoryDep) => {
const createSap = async ({
const createSecretApprovalPolicy = async ({
name,
actor,
actorId,
@@ -83,7 +83,7 @@ export const secretApprovalPolicyServiceFactory = ({
},
tx
);
await sapApproverDAL.insertMany(
await secretApprovalPolicyApproverDAL.insertMany(
secretApprovers.map(({ id }) => ({
approverId: id,
policyId: doc.id
@@ -95,7 +95,7 @@ export const secretApprovalPolicyServiceFactory = ({
return { ...secretApproval, environment: env, projectId };
};
const updateSap = async ({
const updateSecretApprovalPolicy = async ({
approvers,
secretPath,
name,
@@ -140,8 +140,8 @@ export const secretApprovalPolicyServiceFactory = ({
throw new BadRequestError({ message: "Approver not found in project" });
if (doc.approvals > secretApprovers.length)
throw new BadRequestError({ message: "Approvals cannot be greater than approvers" });
await sapApproverDAL.delete({ policyId: doc.id }, tx);
await sapApproverDAL.insertMany(
await secretApprovalPolicyApproverDAL.delete({ policyId: doc.id }, tx);
await secretApprovalPolicyApproverDAL.insertMany(
secretApprovers.map(({ id }) => ({
approverId: id,
policyId: doc.id
@@ -158,7 +158,7 @@ export const secretApprovalPolicyServiceFactory = ({
};
};
const deleteSap = async ({ secretPolicyId, actor, actorId }: TDeleteSapDTO) => {
const deleteSecretApprovalPolicy = async ({ secretPolicyId, actor, actorId }: TDeleteSapDTO) => {
const sapPolicy = await secretApprovalPolicyDAL.findById(secretPolicyId);
if (!sapPolicy) throw new BadRequestError({ message: "Secret approval policy not found" });
@@ -176,7 +176,7 @@ export const secretApprovalPolicyServiceFactory = ({
return sapPolicy;
};
const getSapByProjectId = async ({ actorId, actor, projectId }: TListSapDTO) => {
const getSecretApprovalPolicyByProjectId = async ({ actorId, actor, projectId }: TListSapDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
@@ -187,7 +187,11 @@ export const secretApprovalPolicyServiceFactory = ({
return sapPolicies;
};
const getSapPolicy = async (projectId: string, environment: string, secretPath: string) => {
const getSecretApprovalPolicy = async (
projectId: string,
environment: string,
secretPath: string
) => {
const env = await projectEnvDAL.findOne({ slug: environment, projectId });
if (!env) throw new BadRequestError({ message: "Environment not found" });
@@ -207,7 +211,7 @@ export const secretApprovalPolicyServiceFactory = ({
return finalPolicy;
};
const getSapOfFolder = async ({
const getSecretApprovalPolicyOfFolder = async ({
projectId,
actor,
actorId,
@@ -219,15 +223,15 @@ export const secretApprovalPolicyServiceFactory = ({
ProjectPermissionActions.Read,
subject(ProjectPermissionSub.Secrets, { secretPath, environment })
);
return getSapPolicy(projectId, environment, secretPath);
return getSecretApprovalPolicy(projectId, environment, secretPath);
};
return {
createSap,
updateSap,
deleteSap,
getSapPolicy,
getSapByProjectId,
getSapOfFolder
createSecretApprovalPolicy,
updateSecretApprovalPolicy,
deleteSecretApprovalPolicy,
getSecretApprovalPolicy,
getSecretApprovalPolicyByProjectId,
getSecretApprovalPolicyOfFolder
};
};

10
backend-pg/src/ee/services/secret-approval-request/sar-reviewer-dal.ts
View File

@@ -1,10 +0,0 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TSarReviewerDALFactory = ReturnType<typeof sarReviewerDALFactory>;
export const sarReviewerDALFactory = (db: TDbClient) => {
const sarReviewerOrm = ormify(db, TableName.SarReviewer);
return sarReviewerOrm;
};

46
backend-pg/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
View File

@@ -43,26 +43,26 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
`${TableName.SecretApprovalPolicy}.id`
)
.join(
TableName.SapApprover,
TableName.SecretApprovalPolicyApprover,
`${TableName.SecretApprovalPolicy}.id`,
`${TableName.SapApprover}.policyId`
`${TableName.SecretApprovalPolicyApprover}.policyId`
)
.leftJoin(
TableName.SarReviewer,
TableName.SecretApprovalRequestReviewer,
`${TableName.SecretApprovalRequest}.id`,
`${TableName.SarReviewer}.requestId`
`${TableName.SecretApprovalRequestReviewer}.requestId`
)
.select(selectAllTableCols(TableName.SecretApprovalRequest))
.select(
tx.ref("member").withSchema(TableName.SarReviewer).as("reviewerMemberId"),
tx.ref("status").withSchema(TableName.SarReviewer).as("reviewerStatus"),
tx.ref("member").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerMemberId"),
tx.ref("status").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerStatus"),
tx.ref("id").withSchema(TableName.SecretApprovalPolicy).as("policyId"),
tx.ref("name").withSchema(TableName.SecretApprovalPolicy).as("policyName"),
tx.ref("projectId").withSchema(TableName.Environment),
tx.ref("slug").withSchema(TableName.Environment).as("environment"),
tx.ref("secretPath").withSchema(TableName.SecretApprovalPolicy).as("policySecretPath"),
tx.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
tx.ref("approverId").withSchema(TableName.SapApprover)
tx.ref("approverId").withSchema(TableName.SecretApprovalPolicyApprover)
);
const findById = async (id: string, tx?: Knex) => {
@@ -120,14 +120,14 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
`${TableName.Environment}.id`
)
.join(
TableName.SapApprover,
TableName.SecretApprovalPolicyApprover,
`${TableName.SecretApprovalRequest}.policyId`,
`${TableName.SapApprover}.policyId`
`${TableName.SecretApprovalPolicyApprover}.policyId`
)
.where({ projectId })
.andWhere((bd) =>
bd
.where(`${TableName.SapApprover}.approverId`, membershipId)
.where(`${TableName.SecretApprovalPolicyApprover}.approverId`, membershipId)
.orWhere(`${TableName.SecretApprovalRequest}.committerId`, membershipId)
)
.select("status", `${TableName.SecretApprovalRequest}.id`)
@@ -186,18 +186,18 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
`${TableName.SecretApprovalPolicy}.id`
)
.join(
TableName.SapApprover,
TableName.SecretApprovalPolicyApprover,
`${TableName.SecretApprovalPolicy}.id`,
`${TableName.SapApprover}.policyId`
`${TableName.SecretApprovalPolicyApprover}.policyId`
)
.leftJoin(
TableName.SarReviewer,
TableName.SecretApprovalRequestReviewer,
`${TableName.SecretApprovalRequest}.id`,
`${TableName.SarReviewer}.requestId`
`${TableName.SecretApprovalRequestReviewer}.requestId`
)
.leftJoin(
TableName.SarSecret,
`${TableName.SarSecret}.requestId`,
TableName.SecretApprovalRequestSecret,
`${TableName.SecretApprovalRequestSecret}.requestId`,
`${TableName.SecretApprovalRequest}.id`
)
.where(
@@ -210,26 +210,26 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
)
.andWhere((bd) =>
bd
.where(`${TableName.SapApprover}.approverId`, membershipId)
.where(`${TableName.SecretApprovalPolicyApprover}.approverId`, membershipId)
.orWhere(`${TableName.SecretApprovalRequest}.committerId`, membershipId)
)
.select(selectAllTableCols(TableName.SecretApprovalRequest))
.select(
db.ref("projectId").withSchema(TableName.Environment),
db.ref("slug").withSchema(TableName.Environment).as("environment"),
db.ref("id").withSchema(TableName.SarReviewer).as("reviewerMemberId"),
db.ref("status").withSchema(TableName.SarReviewer).as("reviewerStatus"),
db.ref("id").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerMemberId"),
db.ref("status").withSchema(TableName.SecretApprovalRequestReviewer).as("reviewerStatus"),
db.ref("id").withSchema(TableName.SecretApprovalPolicy).as("policyId"),
db.ref("name").withSchema(TableName.SecretApprovalPolicy).as("policyName"),
db.ref("op").withSchema(TableName.SarSecret).as("commitOp"),
db.ref("secretId").withSchema(TableName.SarSecret).as("commitSecretId"),
db.ref("id").withSchema(TableName.SarSecret).as("commitId"),
db.ref("op").withSchema(TableName.SecretApprovalRequestSecret).as("commitOp"),
db.ref("secretId").withSchema(TableName.SecretApprovalRequestSecret).as("commitSecretId"),
db.ref("id").withSchema(TableName.SecretApprovalRequestSecret).as("commitId"),
db.raw(
`DENSE_RANK() OVER (partition by ${TableName.Environment}."projectId" ORDER BY ${TableName.SecretApprovalRequest}."id" DESC) as rank`
),
db.ref("secretPath").withSchema(TableName.SecretApprovalPolicy).as("policySecretPath"),
db.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
db.ref("approverId").withSchema(TableName.SapApprover)
db.ref("approverId").withSchema(TableName.SecretApprovalPolicyApprover)
)
.orderBy("createdAt", "desc");

12
backend-pg/src/ee/services/secret-approval-request/secret-approval-request-reviewer-dal.ts Normal file
View File

@@ -0,0 +1,12 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TSecretApprovalRequestReviewerDALFactory = ReturnType<
typeof secretApprovalRequestReviewerDALFactory
>;
export const secretApprovalRequestReviewerDALFactory = (db: TDbClient) => {
const secretApprovalRequestReviewerOrm = ormify(db, TableName.SecretApprovalRequestReviewer);
return secretApprovalRequestReviewerOrm;
};

18
backend-pg/src/ee/services/secret-approval-request/sar-secret-dal.ts → backend-pg/src/ee/services/secret-approval-request/secret-approval-request-secret-dal.ts
View File

@@ -5,22 +5,26 @@ import { TableName } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import { ormify, selectAllTableCols } from "@app/lib/knex";
export type TSarSecretDALFactory = ReturnType<typeof sarSecretDALFactory>;
export type TSecretApprovalRequestSecretDALFactory = ReturnType<typeof secretApprovalRequestSecretDALFactory>;
export const sarSecretDALFactory = (db: TDbClient) => {
const sarSecretOrm = ormify(db, TableName.SarSecret);
export const secretApprovalRequestSecretDALFactory = (db: TDbClient) => {
const sarSecretOrm = ormify(db, TableName.SecretApprovalRequestSecret);
const findByRequestId = async (requestId: string, tx?: Knex) => {
try {
const doc = await (tx || db)(TableName.SarSecret)
const doc = await (tx || db)(TableName.SecretApprovalRequestSecret)
.where({ requestId })
.leftJoin(TableName.Secret, `${TableName.SarSecret}.secretId`, `${TableName.Secret}.id`)
.leftJoin(
TableName.Secret,
`${TableName.SecretApprovalRequestSecret}.secretId`,
`${TableName.Secret}.id`
)
.leftJoin(
TableName.SecretVersion,
`${TableName.SecretVersion}.id`,
`${TableName.SarSecret}.secretVersion`
`${TableName.SecretApprovalRequestSecret}.secretVersion`
)
.select(selectAllTableCols(TableName.SarSecret))
.select(selectAllTableCols(TableName.SecretApprovalRequestSecret))
.select(
db.ref("secretBlindIndex").withSchema(TableName.Secret).as("orgSecBlindIndex"),
db.ref("version").withSchema(TableName.Secret).as("orgSecVersion"),

12
backend-pg/src/ee/services/secret-approval-request/secret-approval-request-service.ts
View File

@@ -5,7 +5,7 @@ import {
SecretEncryptionAlgo,
SecretKeyEncoding,
SecretType,
TSaRequestSecretsInsert
TSecretApprovalRequestsSecretsInsert
} from "@app/db/schemas";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { groupBy, pick } from "@app/lib/fn";
@@ -20,9 +20,9 @@ import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-fold
import { TPermissionServiceFactory } from "../permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";
import { TSarReviewerDALFactory } from "./sar-reviewer-dal";
import { TSarSecretDALFactory } from "./sar-secret-dal";
import { TSecretApprovalRequestDALFactory } from "./secret-approval-request-dal";
import { TSecretApprovalRequestReviewerDALFactory } from "./secret-approval-request-reviewer-dal";
import { TSecretApprovalRequestSecretDALFactory } from "./secret-approval-request-secret-dal";
import {
ApprovalStatus,
CommitType,
@@ -39,8 +39,8 @@ import {
type TSecretApprovalRequestServiceFactoryDep = {
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
secretApprovalRequestDAL: TSecretApprovalRequestDALFactory;
sarSecretDAL: TSarSecretDALFactory;
sarReviewerDAL: TSarReviewerDALFactory;
sarSecretDAL: TSecretApprovalRequestSecretDALFactory;
sarReviewerDAL: TSecretApprovalRequestReviewerDALFactory;
folderDAL: Pick<
TSecretFolderDALFactory,
"findBySecretPath" | "findById" | "findSecretPathByFolderIds"
@@ -437,7 +437,7 @@ export const secretApprovalRequestServiceFactory = ({
if (!blindIndexCfg)
throw new BadRequestError({ message: "Blind index not found", name: "Update secret" });
const commits: Omit<TSaRequestSecretsInsert, "requestId">[] = [];
const commits: Omit<TSecretApprovalRequestsSecretsInsert, "requestId">[] = [];
// for created secret approval change
const createdSecrets = data[CommitType.Create];
if (createdSecrets && createdSecrets?.length) {

8
backend-pg/src/ee/services/secret-approval-request/secret-approval-request-types.ts
View File

@@ -1,4 +1,8 @@
import { TImmutableDBKeys, TSaRequestSecrets, TSecretApprovalPolicies } from "@app/db/schemas";
import {
TImmutableDBKeys,
TSecretApprovalPolicies,
TSecretApprovalRequestsSecrets
} from "@app/db/schemas";
import { TProjectPermission } from "@app/lib/types";
export enum CommitType {
@@ -19,7 +23,7 @@ export enum ApprovalStatus {
}
type TApprovalCreateSecret = Omit<
TSaRequestSecrets,
TSecretApprovalRequestsSecrets,
| TImmutableDBKeys
| "version"
| "algorithm"

14
backend-pg/src/server/routes/index.ts
View File

@@ -11,12 +11,12 @@ import { permissionDALFactory } from "@app/ee/services/permission/permission-dal
import { permissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { samlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-dal";
import { samlConfigServiceFactory } from "@app/ee/services/saml-config/saml-config-service";
import { sapApproverDALFactory } from "@app/ee/services/secret-approval-policy/sap-approver-dal";
import { secretApprovalPolicyApproverDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-approver-dal";
import { secretApprovalPolicyDALFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-dal";
import { secretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
import { sarReviewerDALFactory } from "@app/ee/services/secret-approval-request/sar-reviewer-dal";
import { sarSecretDALFactory } from "@app/ee/services/secret-approval-request/sar-secret-dal";
import { secretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
import { secretApprovalRequestReviewerDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-reviewer-dal";
import { secretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
import { secretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
import { secretRotationDALFactory } from "@app/ee/services/secret-rotation/secret-rotation-dal";
import { secretRotationQueueFactory } from "@app/ee/services/secret-rotation/secret-rotation-queue";
@@ -159,11 +159,11 @@ export const registerRoutes = async (
// ee db layer ops
const permissionDAL = permissionDALFactory(db);
const samlConfigDAL = samlConfigDALFactory(db);
const sapApproverDAL = sapApproverDALFactory(db);
const sapApproverDAL = secretApprovalPolicyApproverDALFactory(db);
const secretApprovalPolicyDAL = secretApprovalPolicyDALFactory(db);
const secretApprovalRequestDAL = secretApprovalRequestDALFactory(db);
const sarReviewerDAL = sarReviewerDALFactory(db);
const sarSecretDAL = sarSecretDALFactory(db);
const sarReviewerDAL = secretApprovalRequestReviewerDALFactory(db);
const sarSecretDAL = secretApprovalRequestSecretDALFactory(db);
const secretRotationDAL = secretRotationDALFactory(db);
const snapshotDAL = snapshotDALFactory(db);
@@ -198,7 +198,7 @@ export const registerRoutes = async (
const sapService = secretApprovalPolicyServiceFactory({
projectMembershipDAL,
projectEnvDAL,
sapApproverDAL,
secretApprovalPolicyApproverDAL: sapApproverDAL,
permissionService,
secretApprovalPolicyDAL
});

12
backend-pg/src/server/routes/v3/secret-router.ts
View File

@@ -536,7 +536,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
skipMultilineEncoding
} = req.body;
if (req.body.type !== SecretType.Personal && req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,
@@ -696,7 +696,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
} = req.body;
if (req.body.type !== SecretType.Personal && req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,
@@ -825,7 +825,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const { secretPath, type, workspaceId: projectId, secretId, environment } = req.body;
if (req.body.type !== SecretType.Personal && req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,
@@ -942,7 +942,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,
@@ -1055,7 +1055,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,
@@ -1156,7 +1156,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const { environment, workspaceId: projectId, secretPath, secrets: inputSecrets } = req.body;
if (req.permission.type === ActorType.USER) {
const policy = await server.services.secretApprovalPolicy.getSapOfFolder({
const policy = await server.services.secretApprovalPolicy.getSecretApprovalPolicyOfFolder({
actorId: req.permission.id,
actor: req.permission.type,
secretPath,

3
backend-pg/src/services/super-admin/super-admin-service.ts
View File

@@ -42,7 +42,8 @@ export const superAdminServiceFactory = ({
const updateServerCfg = async (data: TSuperAdminUpdate) => {
const cfg = await serverCfgDAL.updateById(serverCfg.id, data);
serverCfg = Object.freeze(cfg);
serverCfg = cfg;
Object.freeze(serverCfg);
return cfg;
};