awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 01:52:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert "feat(api): better errors and documentation"

Browse Source
This commit is contained in:
Maidul Islam
2024-09-27 17:25:11 -04:00
committed by GitHub
parent d430293c66
commit 4090c894fc
107 changed files with 854 additions and 979 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/app.ts
-3
View File
@@ -20,7 +20,6 @@ import { TQueueServiceFactory } from "@app/queue";
import { TSmtpService } from "@app/services/smtp/smtp-service";
import { globalRateLimiterCfg } from "./config/rateLimiter";
import { addErrorsToResponseSchemas } from "./plugins/add-errors-to-response-schemas";
import { fastifyErrHandler } from "./plugins/error-handler";
import { registerExternalNextjs } from "./plugins/external-nextjs";
import { serializerCompiler, validatorCompiler, ZodTypeProvider } from "./plugins/fastify-zod";
@@ -76,8 +75,6 @@ export const main = async ({ db, smtp, logger, queue, keyStore }: TMain) => {
credentials: true,
origin: appCfg.SITE_URL || true
});
await server.register(addErrorsToResponseSchemas);
// pull ip based on various proxy headers
await server.register(fastifyIp);
backend/src/server/plugins/add-errors-to-response-schemas.ts
-15
View File
@@ -1,15 +0,0 @@
/* eslint-disable no-param-reassign */
import fp from "fastify-plugin";
import { DefaultResponseErrorsSchema } from "../routes/sanitizedSchemas";
export const addErrorsToResponseSchemas = fp(async (server) => {
server.addHook("onRoute", (routeOptions) => {
if (routeOptions.schema && routeOptions.schema.response) {
routeOptions.schema.response = {
...DefaultResponseErrorsSchema,
...routeOptions.schema.response
};
}
});
});
backend/src/server/plugins/audit-log.ts
+1 -1
View File
@@ -70,7 +70,7 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
metadata: {}
};
} else {
throw new BadRequestError({ message: "Invalid actor type provided" });
throw new BadRequestError({ message: "Missing logic for other actor" });
}
req.auditLogInfo = payload;
});
backend/src/server/plugins/auth/inject-identity.ts
+2 -2
View File
@@ -5,7 +5,7 @@ import jwt, { JwtPayload } from "jsonwebtoken";
import { TServiceTokens, TUsers } from "@app/db/schemas";
import { TScimTokenJwtPayload } from "@app/ee/services/scim/scim-types";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError } from "@app/lib/errors";
import { UnauthorizedError } from "@app/lib/errors";
import { ActorType, AuthMethod, AuthMode, AuthModeJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type";
import { TIdentityAccessTokenJwtPayload } from "@app/services/identity-access-token/identity-access-token-types";
@@ -167,7 +167,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
break;
}
default:
throw new BadRequestError({ message: "Invalid token strategy provided" });
throw new UnauthorizedError({ name: "Unknown token strategy" });
}
});
});
backend/src/server/plugins/auth/superAdmin.ts
+4 -3
View File
@@ -1,6 +1,6 @@
import { FastifyReply, FastifyRequest, HookHandlerDoneFunction } from "fastify";
import { ForbiddenRequestError } from "@app/lib/errors";
import { UnauthorizedError } from "@app/lib/errors";
import { ActorType } from "@app/services/auth/auth-type";
export const verifySuperAdmin = <T extends FastifyRequest>(
@@ -9,8 +9,9 @@ export const verifySuperAdmin = <T extends FastifyRequest>(
done: HookHandlerDoneFunction
) => {
if (req.auth.actor !== ActorType.USER || !req.auth.user.superAdmin)
throw new ForbiddenRequestError({
message: "Requires elevated super admin privileges"
throw new UnauthorizedError({
name: "Unauthorized access",
message: "Requires superadmin access"
});
done();
};
backend/src/server/plugins/auth/verify-auth.ts
+3 -3
View File
@@ -1,6 +1,6 @@
import { FastifyReply, FastifyRequest, HookHandlerDoneFunction } from "fastify";
import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
import { UnauthorizedError } from "@app/lib/errors";
import { AuthMode } from "@app/services/auth/auth-type";
interface TAuthOptions {
@@ -11,11 +11,11 @@ export const verifyAuth =
<T extends FastifyRequest>(authStrategies: AuthMode[], options: TAuthOptions = { requireOrg: true }) =>
(req: T, _res: FastifyReply, done: HookHandlerDoneFunction) => {
if (!Array.isArray(authStrategies)) throw new Error("Auth strategy must be array");
if (!req.auth) throw new UnauthorizedError({ message: "Token missing" });
if (!req.auth) throw new UnauthorizedError({ name: "Unauthorized access", message: "Token missing" });
const isAccessAllowed = authStrategies.some((strategy) => strategy === req.auth.authMode);
if (!isAccessAllowed) {
throw new ForbiddenRequestError({ name: `Forbidden access to ${req.url}` });
throw new UnauthorizedError({ name: `${req.url} Unauthorized Access` });
}
// New optional option. There are some routes which do not require an organization ID to be present on the request.
backend/src/server/plugins/error-handler.ts
+6 -13
View File
@@ -6,7 +6,6 @@ import { ZodError } from "zod";
import {
BadRequestError,
DatabaseError,
ForbiddenRequestError,
InternalServerError,
NotFoundError,
ScimRequestError,
@@ -27,23 +26,17 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
} else if (error instanceof NotFoundError) {
void res.status(404).send({ statusCode: 404, message: error.message, error: error.name });
} else if (error instanceof UnauthorizedError) {
void res.status(401).send({ statusCode: 401, message: error.message, error: error.name });
void res.status(403).send({ statusCode: 403, message: error.message, error: error.name });
} else if (error instanceof DatabaseError || error instanceof InternalServerError) {
void res.status(500).send({ statusCode: 500, message: "Something went wrong", error: error.name });
} else if (error instanceof ZodError) {
void res.status(401).send({ statusCode: 401, error: "ValidationFailure", message: error.issues });
void res.status(403).send({ statusCode: 403, error: "ValidationFailure", message: error.issues });
} else if (error instanceof ForbiddenError) {
void res.status(403).send({
statusCode: 403,
void res.status(401).send({
statusCode: 401,
error: "PermissionDenied",
message: `You are not allowed to ${error.action} on ${error.subjectType}`
});
} else if (error instanceof ForbiddenRequestError) {
void res.status(403).send({
statusCode: 403,
message: error.message,
error: error.name
});
} else if (error instanceof ScimRequestError) {
void res.status(error.status).send({
schemas: error.schemas,
@@ -66,8 +59,8 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
return error.message;
})();
void res.status(403).send({
statusCode: 403,
void res.status(401).send({
statusCode: 401,
error: "TokenError",
message
});
backend/src/server/routes/sanitizedSchemas.ts
-28
View File
@@ -27,34 +27,6 @@ export const integrationAuthPubSchema = IntegrationAuthsSchema.pick({
updatedAt: true
});
export const DefaultResponseErrorsSchema = {
400: z.object({
statusCode: z.literal(400),
message: z.string(),
error: z.string()
}),
404: z.object({
statusCode: z.literal(404),
message: z.string(),
error: z.string()
}),
401: z.object({
statusCode: z.literal(401),
message: z.string(),
error: z.string()
}),
403: z.object({
statusCode: z.literal(403),
message: z.any(),
error: z.string()
}),
500: z.object({
statusCode: z.literal(500),
message: z.string(),
error: z.string()
})
};
export const sapPubSchema = SecretApprovalPoliciesSchema.merge(
z.object({
environment: z.object({
backend/src/server/routes/v1/admin-router.ts
+3 -2
View File
@@ -2,7 +2,7 @@ import { z } from "zod";
import { OrganizationsSchema, SuperAdminSchema, UsersSchema } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError } from "@app/lib/errors";
import { UnauthorizedError } from "@app/lib/errors";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -227,7 +227,8 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
handler: async (req, res) => {
const appCfg = getConfig();
const serverCfg = await getServerCfg();
if (serverCfg.initialized) throw new BadRequestError({ message: "Admin account has already been set up" });
if (serverCfg.initialized)
throw new UnauthorizedError({ name: "Admin sign up", message: "Admin has been created" });
const { user, token, organization } = await server.services.superAdmin.adminSignUp({
...req.body,
ip: req.realIp,
backend/src/server/routes/v1/auth-router.ts
+8 -19
View File
@@ -2,7 +2,7 @@ import jwt from "jsonwebtoken";
import { z } from "zod";
import { getConfig } from "@app/lib/config/env";
import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { authRateLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode, AuthModeRefreshJwtTokenPayload, AuthTokenType } from "@app/services/auth/auth-type";
@@ -71,34 +71,23 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
const refreshToken = req.cookies.jid;
const appCfg = getConfig();
if (!refreshToken)
throw new NotFoundError({
name: "AuthTokenNotFound",
message: "Failed to find refresh token"
throw new BadRequestError({
name: "Auth token route",
message: "Failed to find refresh token"
});
const decodedToken = jwt.verify(refreshToken, appCfg.AUTH_SECRET) as AuthModeRefreshJwtTokenPayload;
if (decodedToken.authTokenType !== AuthTokenType.REFRESH_TOKEN)
throw new UnauthorizedError({
message: "The token provided is not a refresh token",
name: "InvalidToken"
});
throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" });
const tokenVersion = await server.services.authToken.getUserTokenSessionById(
decodedToken.tokenVersionId,
decodedToken.userId
);
if (!tokenVersion)
throw new UnauthorizedError({
message: "Valid token version not found",
name: "InvalidToken"
});
if (!tokenVersion) throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" });
if (decodedToken.refreshVersion !== tokenVersion.refreshVersion) {
throw new UnauthorizedError({
message: "Token version mismatch",
name: "InvalidToken"
});
}
if (decodedToken.refreshVersion !== tokenVersion.refreshVersion)
throw new UnauthorizedError({ message: "Invalid token", name: "Auth token route" });
const token = jwt.sign(
{
backend/src/server/routes/v1/identity-azure-auth-router.ts
-2
View File
@@ -9,8 +9,6 @@ import { AuthMode } from "@app/services/auth/auth-type";
import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
import { validateAzureAuthField } from "@app/services/identity-azure-auth/identity-azure-auth-validators";
import {} from "../sanitizedSchemas";
export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider) => {
server.route({
method: "POST",
backend/src/server/routes/v1/integration-router.ts
-2
View File
@@ -11,8 +11,6 @@ import { AuthMode } from "@app/services/auth/auth-type";
import { IntegrationMetadataSchema } from "@app/services/integration/integration-schema";
import { PostHogEventTypes, TIntegrationCreatedEvent } from "@app/services/telemetry/telemetry-types";
import {} from "../sanitizedSchemas";
export const registerIntegrationRouter = async (server: FastifyZodProvider) => {
server.route({
method: "POST",
backend/src/server/routes/v1/sso-router.ts
+3 -3
View File
@@ -14,7 +14,7 @@ import { Strategy as GoogleStrategy } from "passport-google-oauth20";
import { z } from "zod";
import { getConfig } from "@app/lib/config/env";
import { NotFoundError } from "@app/lib/errors";
import { BadRequestError } from "@app/lib/errors";
import { logger } from "@app/lib/logger";
import { fetchGithubEmails } from "@app/lib/requests/github";
import { AuthMethod } from "@app/services/auth/auth-type";
@@ -42,9 +42,9 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => {
try {
const email = profile?.emails?.[0]?.value;
if (!email)
throw new NotFoundError({
throw new BadRequestError({
message: "Email not found",
name: "OauthGoogleRegister"
name: "Oauth Google Register"
});
const { isUserCompleted, providerAuthToken } = await server.services.login.oauth2Login({
backend/src/server/routes/v2/organization-router.ts
+1 -1
View File
@@ -69,7 +69,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
rateLimit: readLimit
},
schema: {
description: "Return projects in organization that user is apart of",
description: "Return projects in organization that user is part of",
security: [
{
bearerAuth: []
backend/src/server/routes/v3/secret-router.ts
+2 -2
View File
@@ -10,7 +10,7 @@ import {
} from "@app/db/schemas";
import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
import { RAW_SECRETS, SECRETS } from "@app/lib/api-docs";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { BadRequestError } from "@app/lib/errors";
import { removeTrailingSlash } from "@app/lib/fn";
import { secretsLimit, writeLimit } from "@app/server/config/rateLimiter";
import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
@@ -240,7 +240,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
actorOrgId: req.permission.orgId
});
if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.query.workspaceSlug}` });
if (!workspace) throw new BadRequestError({ message: `No project found with slug ${req.query.workspaceSlug}` });
workspaceId = workspace.id;
}
backend/src/server/routes/v3/signup-router.ts
+9 -9
View File
@@ -2,7 +2,7 @@ import { z } from "zod";
import { UsersSchema } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { ForbiddenRequestError } from "@app/lib/errors";
import { BadRequestError } from "@app/lib/errors";
import { authRateLimit } from "@app/server/config/rateLimiter";
import { getServerCfg } from "@app/services/super-admin/super-admin-service";
import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
@@ -29,8 +29,8 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
const serverCfg = await getServerCfg();
if (!serverCfg.allowSignUp) {
throw new ForbiddenRequestError({
message: "Signup's are disabled"
throw new BadRequestError({
message: "Sign up is disabled"
});
}
@@ -38,7 +38,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
const domain = email.split("@")[1];
const allowedDomains = serverCfg.allowedSignUpDomain.split(",").map((e) => e.trim());
if (!allowedDomains.includes(domain)) {
throw new ForbiddenRequestError({
throw new BadRequestError({
message: `Email with a domain (@${domain}) is not supported`
});
}
@@ -70,13 +70,13 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const serverCfg = await getServerCfg();
if (!serverCfg.allowSignUp) {
throw new ForbiddenRequestError({
message: "Signup's are disabled"
throw new BadRequestError({
message: "Sign up is disabled"
});
}
const { token, user } = await server.services.signup.verifyEmailSignup(req.body.email, req.body.code);
return { message: "Successfully verified email", token, user };
return { message: "Successfuly verified email", token, user };
}
});
@@ -121,8 +121,8 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
const serverCfg = await getServerCfg();
if (!serverCfg.allowSignUp) {
throw new ForbiddenRequestError({
message: "Signup's are disabled"
throw new BadRequestError({
message: "Sign up is disabled"
});
}