awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 10:27:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update for review

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-07 09:20:52 -08:00
parent 582f0bc067
commit 5218195ed4
3 changed files with 7 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/pki-acme-router.ts
+2 -8
View File
@@ -71,7 +71,6 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
done(null, undefined); done(null, undefined);
} }
const json: unknown = JSON.parse(strBody as string); const json: unknown = JSON.parse(strBody as string);
// TODO: deal with JWS payload here
done(null, json); done(null, json);
} catch (err) { } catch (err) {
const error = err as Error; const error = err as Error;
@@ -97,10 +96,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
200: GetAcmeDirectoryResponseSchema 200: GetAcmeDirectoryResponseSchema
} }
}, },
handler: async (req) => { handler: async (req) => server.services.pkiAcme.getAcmeDirectory(req.params.profileId)
const directory = await server.services.pkiAcme.getAcmeDirectory(req.params.profileId);
return directory;
}
}); });
// HEAD /api/v1/pki/acme/profiles/<profile_id>/new-nonce // HEAD /api/v1/pki/acme/profiles/<profile_id>/new-nonce
@@ -109,7 +105,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
method: "HEAD", method: "HEAD",
url: "/profiles/:profileId/new-nonce", url: "/profiles/:profileId/new-nonce",
config: { config: {
// TODO: probably a different rate limit for nonce creation // TODO: probably a different rate limit for nonce creation?
rateLimit: readLimit rateLimit: readLimit
}, },
schema: { schema: {
@@ -335,8 +331,6 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
200: ListAcmeOrdersResponseSchema 200: ListAcmeOrdersResponseSchema
} }
}, },
// TODO: replace with verify ACME signature here instead
// onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req, res) => { handler: async (req, res) => {
const { profileId, accountId } = await validateExistingAccount({ const { profileId, accountId } = await validateExistingAccount({
req, req,
backend/src/ee/services/pki-acme/pki-acme-errors.ts
+2 -2
View File
@@ -1,6 +1,6 @@
/** /**
* ACME Error Classes based on RFC 8555 Section 6.2 * ACME Error Classes based on RFC 8555 Section 6.7
* https://datatracker.ietf.org/doc/html/rfc8555#section-6.2 * https://datatracker.ietf.org/doc/html/rfc8555#section-6.7
*/ */
// RFC 8555 Section 6.7 - Error Types // RFC 8555 Section 6.7 - Error Types
backend/src/ee/services/pki-acme/pki-acme-service.ts
+3 -1
View File
@@ -478,6 +478,8 @@ export const pkiAcmeServiceFactory = ({
}): Promise<TAcmeResponse<TAcmeOrderResource>> => { }): Promise<TAcmeResponse<TAcmeOrderResource>> => {
// TODO: check and see if we have existing orders for this account that meet the criteria // TODO: check and see if we have existing orders for this account that meet the criteria
// if we do, return the existing order // if we do, return the existing order
// TODO: check the identifiers and see if are they even allowed for this profile.
// if not, we may be able to reject it early with an unsupportedIdentifier error.
const order = await acmeOrderDAL.transaction(async (tx) => { const order = await acmeOrderDAL.transaction(async (tx) => {
const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!; const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
@@ -592,7 +594,7 @@ export const pkiAcmeServiceFactory = ({
if (order.status === AcmeOrderStatus.Ready) { if (order.status === AcmeOrderStatus.Ready) {
const { order: updatedOrder, error } = await acmeOrderDAL.transaction(async (tx) => { const { order: updatedOrder, error } = await acmeOrderDAL.transaction(async (tx) => {
const order = (await acmeOrderDAL.findByIdForFinalization(orderId, tx))!; const order = (await acmeOrderDAL.findByIdForFinalization(orderId, tx))!;
// TODO: ideally, this should be doen with onRequest: verifyAuth([AuthMode.ACME_JWS_SIGNATURE]), instead // TODO: ideally, this should be doen with onRequest: verifyAuth([AuthMode.ACME_JWS_SIGNATURE]), instead?
const { ownerOrgId: actorOrgId } = (await certificateProfileDAL.findByIdWithOwnerOrgId(profileId, tx))!; const { ownerOrgId: actorOrgId } = (await certificateProfileDAL.findByIdWithOwnerOrgId(profileId, tx))!;
if (order.status !== AcmeOrderStatus.Ready) { if (order.status !== AcmeOrderStatus.Ready) {
throw new AcmeOrderNotReadyError({ message: "ACME order is not ready" }); throw new AcmeOrderNotReadyError({ message: "ACME order is not ready" });