awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 16:40:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

More gohst user

Browse Source
This commit is contained in:
Daniel Hougaard
2024-02-22 05:00:14 +01:00
parent 84cab17f5c
commit 3b1fc4b156
15 changed files with 413 additions and 275 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/index.ts
+6
View File
@@ -286,6 +286,7 @@ export const registerRoutes = async (
projectMembershipDAL,
projectDAL,
permissionService,
projectBotDAL,
orgDAL,
userDAL,
smtpService,
@@ -302,6 +303,11 @@ export const registerRoutes = async (
permissionService,
projectDAL,
secretBlindIndexDAL,
identityProjectDAL,
identityOrgMembershipDAL,
projectBotDAL,
projectKeyDAL,
userDAL,
projectEnvDAL,
orgService,
projectMembershipDAL,
backend/src/server/routes/v1/project-router.ts
+1
View File
@@ -249,6 +249,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
}
});
// Is this actually used..?
server.route({
url: "/:workspaceId/invite-signup",
method: "POST",
backend/src/server/routes/v3/project-router.ts
+22 -174
View File
@@ -1,15 +1,8 @@
import { ForbiddenError } from "@casl/ability";
import crypto from "crypto";
import { z } from "zod";
import { ProjectMembershipRole, ProjectsSchema } from "@app/db/schemas";
import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { encryptAsymmetric } from "@app/lib/crypto";
import { BadRequestError } from "@app/lib/errors";
import { createWsMembers } from "@app/lib/project";
import { ProjectMembershipsSchema, ProjectsSchema } from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { authRateLimit } from "@app/server/config/rateLimiter";
import { ActorType } from "@app/services/auth/auth-type";
const projectWithEnv = ProjectsSchema.merge(
z.object({
@@ -29,7 +22,6 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
schema: {
body: z.object({
projectName: z.string().trim(),
inviteMemberEmails: z.array(z.string().email()).optional(),
organizationId: z.string().trim()
}),
response: {
@@ -39,110 +31,13 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
}
},
handler: async (req) => {
const { permission } = await server.services.permission.getOrgPermission(
req.permission.type,
req.permission.id,
req.body.organizationId
);
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Workspace);
// 2. Create a new project (will set the e2ee db field to false).
const { project, ghostUser } = await server.services.project.createProject({
const project = await server.services.project.createProject({
actorId: req.permission.id,
actor: req.permission.type,
orgId: req.body.organizationId,
workspaceName: req.body.projectName
});
// 3. Create a random key that we'll use as the project key.
const randomBytes = crypto.randomBytes(16).toString("hex");
// 4. Encrypt the project key with the users key pair.
const { ciphertext: encryptedProjectKey, nonce: encryptedProjectKeyIv } = encryptAsymmetric(
randomBytes,
ghostUser.keys.publicKey,
ghostUser.keys.plainPrivateKey
);
// 4. Save the project key for the ghost user.
await server.services.projectKey.uploadProjectKeys({
projectId: project.id,
actor: req.permission.type,
actorId: ghostUser.user.id,
nonce: encryptedProjectKeyIv,
receiverId: ghostUser.user.id,
encryptedKey: encryptedProjectKey
});
// 5. Create a bot for the project.
const bot = await server.services.projectBot.findBotByProjectId({
actorId: ghostUser.user.id,
actor: req.permission.type,
projectId: project.id,
// We set the publicKey and privateKey of the bot to the same as the ghost user.
// We do this because we'll need to access the private key again later, when adding new members to the project.
publicKey: ghostUser.keys.publicKey,
privateKey: ghostUser.keys.plainPrivateKey
});
// 6. Activate the bot.
await server.services.projectBot.setBotActiveState({
botKey: {
encryptedKey: encryptedProjectKey,
nonce: encryptedProjectKeyIv
},
actorId: ghostUser.user.id,
isActive: true,
actor: req.permission.type,
botId: bot.id
});
// 7. get the current user & org membership
const user = await server.services.user.getMe(req.permission.id);
const userOrgMembership = await server.services.permission.getUserOrgPermission(user.id, req.body.organizationId);
// 7. Get the latest key from the ghost!
const latestKey = await server.services.projectKey.getLatestProjectKey({
actorId: ghostUser.user.id,
actor: req.permission.type,
projectId: project.id
});
if (!latestKey) throw new Error("Failed to get latest key");
// If the project is being created by a user, add the user to the project as an admin
if (req.permission.type === ActorType.USER) {
const projectAdmin = createWsMembers({
decryptKey: latestKey,
members: [
{
userPublicKey: user.publicKey,
orgMembershipId: userOrgMembership.membership.id,
projectMembershipRole: ProjectMembershipRole.Admin // <-- Make the first user an admin
}
],
userPrivateKey: ghostUser.keys.plainPrivateKey
});
await server.services.projectMembership.addUsersToProject({
projectId: project.id,
actorId: ghostUser.user.id,
actor: req.permission.type,
members: projectAdmin
});
}
// If the project is being created by an identity, add the identity to the project as an admin
else if (req.permission.type === ActorType.IDENTITY) {
await server.services.identityProject.createProjectIdentity({
actor: ActorType.IDENTITY,
actorId: ghostUser.user.id,
identityId: req.permission.id,
projectId: project.id,
role: ProjectMembershipRole.Admin
});
}
return { project };
}
});
@@ -159,82 +54,35 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
}),
body: z.object({
emails: z.string().email().array()
})
}),
response: {
200: z.object({
memberships: ProjectMembershipsSchema.array()
})
}
},
handler: async (req) => {
const { permission } = await server.services.permission.getProjectPermission(
req.permission.type,
req.permission.id,
req.params.projectId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Member);
const project = await server.services.project.getAProject({
const memberships = await server.services.projectMembership.addUsersToProjectNonE2EE({
projectId: req.params.projectId,
actorId: req.permission.id,
actor: req.permission.type,
projectId: req.params.projectId
});
const ghostUser = await server.services.project.findProjectGhostUser(req.params.projectId);
if (!ghostUser) {
throw new BadRequestError({
message: "Failed" // TODO: Add a message
});
}
const latestKey = await server.services.projectKey.getLatestProjectKey({
actorId: ghostUser.id,
actor: ActorType.USER,
projectId: req.params.projectId
});
if (!latestKey) {
throw new BadRequestError({
message: "Failed to find project key"
});
}
const bot = await server.services.projectBot.findBotByProjectId({
actor: req.permission.type,
actorId: req.permission.id,
projectId: req.params.projectId
});
// We get the bot private key, because the bot private key is the same as the ghost user's private key.
const botPrivateKey = server.services.projectBot.getBotPrivateKey({ bot });
const members = await server.services.org.findOrgMembersByEmail({
actor: req.permission.type,
actorId: req.permission.id,
orgId: project.orgId,
emails: req.body.emails
});
if (members.length !== req.body.emails.length) {
throw new BadRequestError({
message: "Some users are not part of the organization"
});
}
const wsMembers = createWsMembers({
members: members.map((membership) => ({
orgMembershipId: membership.id,
projectMembershipRole: ProjectMembershipRole.Member,
userPublicKey: membership.user.publicKey
})),
decryptKey: latestKey,
userPrivateKey: botPrivateKey
});
await server.services.projectMembership.addUsersToProject({
await server.services.auditLog.createAuditLog({
projectId: req.params.projectId,
actorId: ghostUser.id, // We set the actor ID to the ghost user, because this is used as senderId in the project key sharing
actor: ActorType.USER,
members: wsMembers
...req.auditLogInfo,
event: {
type: EventType.ADD_BATCH_WORKSPACE_MEMBER,
metadata: memberships.map(({ userId, id }) => ({
userId: userId || "",
membershipId: id,
email: ""
}))
}
});
return {};
return { memberships };
}
});
};