awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: resolved personal secret breaking secret replication

Browse Source
This commit is contained in:
=
2024-05-29 14:47:16 +05:30
parent 2d0d90785f
commit 531d3751a8
2 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
backend/src/services/secret-replication/secret-replication-dal.ts
View File

@@ -1,7 +1,7 @@
import { Knex } from "knex";
import { TDbClient } from "@app/db";
import { TableName, TSecretVersions } from "@app/db/schemas";
import { SecretType, TableName, TSecretVersions } from "@app/db/schemas";
import { ormify, selectAllTableCols } from "@app/lib/knex";
export type TSecretReplicationDALFactory = ReturnType<typeof secretReplicationDALFactory>;
@@ -9,7 +9,10 @@ export type TSecretReplicationDALFactory = ReturnType<typeof secretReplicationDA
export const secretReplicationDALFactory = (db: TDbClient) => {
const orm = ormify(db, TableName.SecretVersion);
const findSecrets = async (filter: { folderId: string; secrets: { id: string; version: number }[] }, tx?: Knex) => {
const findSecretVersions = async (
filter: { folderId: string; secrets: { id: string; version: number }[] },
tx?: Knex
) => {
if (!filter.secrets) return [];
const sqlRawDocs = await (tx || db)(TableName.SecretVersion)
@@ -18,7 +21,8 @@ export const secretReplicationDALFactory = (db: TDbClient) => {
filter.secrets.forEach((el) => {
void bd.orWhere({
[`${TableName.SecretVersion}.secretId` as "secretId"]: el.id,
[`${TableName.SecretVersion}.version` as "version"]: el.version
[`${TableName.SecretVersion}.version` as "version"]: el.version,
[`${TableName.SecretVersion}.type` as "type"]: SecretType.Shared
});
});
})
@@ -39,7 +43,7 @@ export const secretReplicationDALFactory = (db: TDbClient) => {
};
return {
findSecrets,
findSecretVersions,
...orm
};
};

14
backend/src/services/secret-replication/secret-replication-service.ts
View File

@@ -80,13 +80,16 @@ export const secretReplicationServiceFactory = ({
if (!secretImports.length || !secrets.length) return;
// unfiltered secrets to be replicated
const toBeReplicatedSecrets = await secretReplicationDAL.findSecrets({ folderId, secrets });
const toBeReplicatedSecrets = await secretReplicationDAL.findSecretVersions({ folderId, secrets });
const replicatedSecrets = toBeReplicatedSecrets.filter(
({ version, latestReplicatedVersion, secretBlindIndex }) =>
secretBlindIndex && (version === 1 || latestReplicatedVersion <= version)
);
const replicatedSecretsGroupBySecretId = groupBy(replicatedSecrets, (i) => i.secretId);
// this is to filter out personal secrets
const sanitizedSecrets = secrets.filter(({ id }) => Object.hasOwn(replicatedSecretsGroupBySecretId, id));
if (!sanitizedSecrets.length) return;
const lock = await keyStore.acquireLock(
replicatedSecrets.map(({ id }) => id),
5000
@@ -118,20 +121,20 @@ export const secretReplicationServiceFactory = ({
});
const localSecretsGroupedByBlindIndex = groupBy(localSecrets, (i) => i.secretBlindIndex as string);
const locallyCreatedSecrets = secrets.filter(({ operation, id }) => {
const locallyCreatedSecrets = sanitizedSecrets.filter(({ operation, id }) => {
return (
(operation === SecretOperations.Create || operation === SecretOperations.Update) &&
!localSecretsGroupedByBlindIndex[replicatedSecretsGroupBySecretId[id][0].secretBlindIndex as string]?.[0]
);
});
const locallyUpdatedSecrets = secrets.filter(
const locallyUpdatedSecrets = sanitizedSecrets.filter(
({ operation, id }) =>
(operation === SecretOperations.Create || operation === SecretOperations.Update) &&
localSecretsGroupedByBlindIndex[replicatedSecretsGroupBySecretId[id][0].secretBlindIndex as string]?.[0]
);
const locallyDeletedSecrets = secrets.filter(
const locallyDeletedSecrets = sanitizedSecrets.filter(
({ operation, id }) =>
operation === SecretOperations.Delete &&
Boolean(replicatedSecretsGroupBySecretId[id]?.[0]?.secretBlindIndex) &&
@@ -333,6 +336,7 @@ export const secretReplicationServiceFactory = ({
/* eslint-enable no-await-in-loop */
} finally {
await lock.release();
logger.info(job.data, "Replication finished");
}
});