awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update for review

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-04 12:14:52 -08:00
parent 582f0bc067
commit 5218195ed4
3 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
backend/src/ee/routes/v1/pki-acme-router.ts
View File

@@ -71,7 +71,6 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
done(null, undefined);
}
const json: unknown = JSON.parse(strBody as string);
// TODO: deal with JWS payload here
done(null, json);
} catch (err) {
const error = err as Error;
@@ -97,10 +96,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
200: GetAcmeDirectoryResponseSchema
}
},
handler: async (req) => {
const directory = await server.services.pkiAcme.getAcmeDirectory(req.params.profileId);
return directory;
}
handler: async (req) => server.services.pkiAcme.getAcmeDirectory(req.params.profileId)
});
// HEAD /api/v1/pki/acme/profiles/<profile_id>/new-nonce
@@ -109,7 +105,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
method: "HEAD",
url: "/profiles/:profileId/new-nonce",
config: {
// TODO: probably a different rate limit for nonce creation
// TODO: probably a different rate limit for nonce creation?
rateLimit: readLimit
},
schema: {
@@ -335,8 +331,6 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
200: ListAcmeOrdersResponseSchema
}
},
// TODO: replace with verify ACME signature here instead
// onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req, res) => {
const { profileId, accountId } = await validateExistingAccount({
req,

4
backend/src/ee/services/pki-acme/pki-acme-errors.ts
View File

@@ -1,6 +1,6 @@
/**
* ACME Error Classes based on RFC 8555 Section 6.2
* https://datatracker.ietf.org/doc/html/rfc8555#section-6.2
* ACME Error Classes based on RFC 8555 Section 6.7
* https://datatracker.ietf.org/doc/html/rfc8555#section-6.7
*/
// RFC 8555 Section 6.7 - Error Types

4
backend/src/ee/services/pki-acme/pki-acme-service.ts
View File

@@ -478,6 +478,8 @@ export const pkiAcmeServiceFactory = ({
}): Promise<TAcmeResponse<TAcmeOrderResource>> => {
// TODO: check and see if we have existing orders for this account that meet the criteria
// if we do, return the existing order
// TODO: check the identifiers and see if are they even allowed for this profile.
// if not, we may be able to reject it early with an unsupportedIdentifier error.
const order = await acmeOrderDAL.transaction(async (tx) => {
const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
@@ -592,7 +594,7 @@ export const pkiAcmeServiceFactory = ({
if (order.status === AcmeOrderStatus.Ready) {
const { order: updatedOrder, error } = await acmeOrderDAL.transaction(async (tx) => {
const order = (await acmeOrderDAL.findByIdForFinalization(orderId, tx))!;
// TODO: ideally, this should be doen with onRequest: verifyAuth([AuthMode.ACME_JWS_SIGNATURE]), instead
// TODO: ideally, this should be doen with onRequest: verifyAuth([AuthMode.ACME_JWS_SIGNATURE]), instead?
const { ownerOrgId: actorOrgId } = (await certificateProfileDAL.findByIdWithOwnerOrgId(profileId, tx))!;
if (order.status !== AcmeOrderStatus.Ready) {
throw new AcmeOrderNotReadyError({ message: "ACME order is not ready" });