awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-13 14:29:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: approval policy org check

Browse Source
This commit is contained in:
x032205
2025-09-14 02:06:12 -04:00
parent ca877cb225
commit 342ba8f2f0
3 changed files with 74 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts
+34 -2
View File
@@ -162,7 +162,7 @@ export const accessApprovalPolicyServiceFactory = ({
if (invalidUsernames.length) {
throw new BadRequestError({
message: `Invalid approver user: ${invalidUsernames.join(", ")}`
message: `Invalid approver user: ${invalidUsernames.map((i) => i.username).join(", ")}`
});
}
@@ -173,6 +173,22 @@ export const accessApprovalPolicyServiceFactory = ({
}))
);
}
if (approverUserIds.length > 0) {
const allApproverUserIds = approverUserIds.map((au) => au.id);
const approverMembers = await orgMembershipDAL.find({
$in: { userId: allApproverUserIds },
orgId: actorOrgId
});
if (approverMembers.length !== allApproverUserIds.length) {
const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
const userIdsNotInOrg = allApproverUserIds.filter((id) => !approverMemberUserIds.has(id));
throw new BadRequestError({
message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
});
}
}
let groupBypassers: string[] = [];
let bypasserUserIds: string[] = [];
@@ -488,7 +504,7 @@ export const accessApprovalPolicyServiceFactory = ({
if (invalidUsernames.length) {
throw new BadRequestError({
message: `Invalid approver user: ${invalidUsernames.join(", ")}`
message: `Invalid approver user: ${invalidUsernames.map((i) => i.username).join(", ")}`
});
}
@@ -499,6 +515,22 @@ export const accessApprovalPolicyServiceFactory = ({
}))
);
}
if (approverUserIds.length > 0) {
const allApproverUserIds = approverUserIds.map((au) => au.id);
const approverMembers = await orgMembershipDAL.find({
$in: { userId: allApproverUserIds },
orgId: actorOrgId
});
if (approverMembers.length !== allApproverUserIds.length) {
const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
const userIdsNotInOrg = allApproverUserIds.filter((id) => !approverMemberUserIds.has(id));
throw new BadRequestError({
message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
});
}
}
await accessApprovalPolicyApproverDAL.insertMany(
approverUserIds.map((el) => ({
approverUserId: el.id,
backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts
+39
View File
@@ -7,6 +7,7 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { removeTrailingSlash } from "@app/lib/fn";
import { containsGlobPatterns } from "@app/lib/picomatch";
import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
import { TUserDALFactory } from "@app/services/user/user-dal";
@@ -39,6 +40,7 @@ type TSecretApprovalPolicyServiceFactoryDep = {
secretApprovalPolicyDAL: TSecretApprovalPolicyDALFactory;
projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "find">;
userDAL: Pick<TUserDALFactory, "find">;
orgMembershipDAL: Pick<TOrgMembershipDALFactory, "find">;
secretApprovalPolicyApproverDAL: TSecretApprovalPolicyApproverDALFactory;
secretApprovalPolicyBypasserDAL: TSecretApprovalPolicyBypasserDALFactory;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -56,6 +58,7 @@ export const secretApprovalPolicyServiceFactory = ({
secretApprovalPolicyEnvironmentDAL,
projectEnvDAL,
userDAL,
orgMembershipDAL,
licenseService,
secretApprovalRequestDAL
}: TSecretApprovalPolicyServiceFactoryDep) => {
@@ -233,6 +236,24 @@ export const secretApprovalPolicyServiceFactory = ({
userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
}
if (userApproverIds.length > 0) {
const approverMembers = await orgMembershipDAL.find(
{
$in: { userId: userApproverIds },
orgId: actorOrgId
},
{ tx }
);
if (approverMembers.length !== userApproverIds.length) {
const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
const userIdsNotInOrg = userApproverIds.filter((id) => !approverMemberUserIds.has(id));
throw new BadRequestError({
message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
});
}
}
await secretApprovalPolicyApproverDAL.insertMany(
userApproverIds.map((approverUserId) => ({
approverUserId,
@@ -425,6 +446,24 @@ export const secretApprovalPolicyServiceFactory = ({
userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
}
if (userApproverIds.length > 0) {
const approverMembers = await orgMembershipDAL.find(
{
$in: { userId: userApproverIds },
orgId: actorOrgId
},
{ tx }
);
if (approverMembers.length !== userApproverIds.length) {
const approverMemberUserIds = new Set(approverMembers.map((member) => member.userId as string));
const userIdsNotInOrg = userApproverIds.filter((id) => !approverMemberUserIds.has(id));
throw new BadRequestError({
message: `Some approvers are not in the organization: ${userIdsNotInOrg.join(", ")}`
});
}
}
await secretApprovalPolicyApproverDAL.insertMany(
userApproverIds.map((approverUserId) => ({
approverUserId,
backend/src/server/routes/index.ts
+1
View File
@@ -604,6 +604,7 @@ export const registerRoutes = async (
secretApprovalPolicyDAL,
licenseService,
userDAL,
orgMembershipDAL,
secretApprovalRequestDAL
});
const tokenService = tokenServiceFactory({ tokenDAL: authTokenDAL, userDAL, orgMembershipDAL });