From fe2f2f972e7755a187395bf5a28c2654be12508a Mon Sep 17 00:00:00 2001 From: Jon Insley <5669143+jinsley8@users.noreply.github.com> Date: Wed, 25 Oct 2023 13:54:09 -0400 Subject: [PATCH 001/178] fix(frontend): Remove max-width to match other views This commit removes the max-width constraint on the WebhooksTab.tsx component, aligning it with the full-width layout consistency seen in other views. The previous max-width of 1024px resulted in unused space on larger screens. --- .../ProjectSettingsPage/components/WebhooksTab/WebhooksTab.tsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/frontend/src/views/Settings/ProjectSettingsPage/components/WebhooksTab/WebhooksTab.tsx b/frontend/src/views/Settings/ProjectSettingsPage/components/WebhooksTab/WebhooksTab.tsx index 6fc6b230c..3f24d7c20 100644 --- a/frontend/src/views/Settings/ProjectSettingsPage/components/WebhooksTab/WebhooksTab.tsx +++ b/frontend/src/views/Settings/ProjectSettingsPage/components/WebhooksTab/WebhooksTab.tsx @@ -139,7 +139,7 @@ export const WebhooksTab = withProjectPermission( }; return ( -
+

{t("settings.webhooks.title")}

Date: Wed, 10 Jan 2024 22:33:38 +0000 Subject: [PATCH 002/178] docs: cover ansible forking error --- docs/integrations/platforms/ansible.mdx | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/integrations/platforms/ansible.mdx b/docs/integrations/platforms/ansible.mdx index efb9e4f63..93f1e5202 100644 --- a/docs/integrations/platforms/ansible.mdx +++ b/docs/integrations/platforms/ansible.mdx @@ -5,6 +5,20 @@ description: "How to use Infisical for secret management in Ansible" The documentation for using Infisical to manage secrets in Ansible is currently available [here](https://galaxy.ansible.com/ui/repo/published/infisical/vault/). + +If you get this Python error when you running the lookup plugin:- + +``` +objc[72832]: +[__NSCFConstantString initialize] may have been in progress in another thread when fork() was called. We cannot safely call it or ignore it in the fork() child process. Crashing instead. Set a breakpoint on objc_initializeAfterForkError to debug. +Fatal Python error: Aborted +``` + +You will need to add this to your shell environment or ansible wrapper script:- + +``` +export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES +``` + Have any questions? Join Infisical's [community Slack](https://infisical.com/slack) for quick support. From e18abc6e2248cfb038acecd8127b2e060f90e37f Mon Sep 17 00:00:00 2001 From: Tchoupinax Date: Wed, 17 Jan 2024 22:15:07 +0100 Subject: [PATCH 003/178] Update the path where managing service tokens I did not find anymore where to manage token and reading the doc did not help me. I found the MR which changes the section of the link and so I update the doc according it --- docs/documentation/platform/token.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/documentation/platform/token.mdx b/docs/documentation/platform/token.mdx index 31efdbce1..9e304de3d 100644 --- a/docs/documentation/platform/token.mdx +++ b/docs/documentation/platform/token.mdx @@ -8,7 +8,7 @@ Each service token can be provisioned scoped access to select environment(s) and ## Service Tokens -You can manage service tokens in Project Settings > Service Tokens. +You can manage service tokens in Access Control > Service Tokens (tab). ### Service Token (Current) @@ -25,7 +25,7 @@ of the token. ## Creating a service token -To create a service token, head to Project Settings > Service Tokens as shown below and press **Create token**. +To create a service token, head to Access Control > Service Tokens as shown below and press **Create token**. ![token add](../../images/project-token-old-add.png) From 202efce10db714e36efd743cac10fda895a99fd2 Mon Sep 17 00:00:00 2001 From: Ronan McCarter <63772591+rpmccarter@users.noreply.github.com> Date: Mon, 22 Jan 2024 15:50:31 -0800 Subject: [PATCH 004/178] remove deprecated basePath setting --- docs/mint.json | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/docs/mint.json b/docs/mint.json index 9e3701519..1f8dc618b 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -1,9 +1,8 @@ { "name": "Infisical", - "basePath": "/docs", "logo": { - "dark": "/docs/logo/dark.svg", - "light": "/docs/logo/light.svg", + "dark": "/logo/dark.svg", + "light": "/logo/light.svg", "href": "https://infisical.com" }, "favicon": "/favicon.png", From a91b6ebc0376f6cc11e7822dbf836a8e7f73c2d3 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 10:28:49 -0500 Subject: [PATCH 005/178] new workflow for releasing standalone --- ...tandalone-docker-img-postgres-offical.yml} | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) rename .github/workflows/{release-standalone-docker-img-postgres.yml => release-standalone-docker-img-postgres-offical.yml} (63%) diff --git a/.github/workflows/release-standalone-docker-img-postgres.yml b/.github/workflows/release-standalone-docker-img-postgres-offical.yml similarity index 63% rename from .github/workflows/release-standalone-docker-img-postgres.yml rename to .github/workflows/release-standalone-docker-img-postgres-offical.yml index 481b196c9..5aaeb714e 100644 --- a/.github/workflows/release-standalone-docker-img-postgres.yml +++ b/.github/workflows/release-standalone-docker-img-postgres-offical.yml @@ -1,4 +1,4 @@ -name: Release standalone postgres version +name: Release standalone docker image on: push: tags: @@ -30,28 +30,28 @@ jobs: - name: Save commit hashes for tag id: commit uses: pr-mpt/actions-commit-hash@v2 + - name: 🔧 Set up Docker Buildx + uses: docker/setup-buildx-action@v2 - name: 🐋 Login to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v2 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - name: Login to Docker Hub - uses: docker/login-action@v3 + - name: Set up Depot CLI + uses: depot/setup-action@v1 + - name: 📦 Build backend and export to Docker + uses: depot/build-push-action@v1 with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: . - platforms: linux/amd64 - file: Dockerfile.standalone-infisical + project: 64mmf0n610 + token: ${{ secrets.DEPOT_PROJECT_TOKEN }} push: true + context: . tags: | - akhilmhdh/destruction:latest - akhilmhdh/destruction:${{ steps.commit.outputs.short }} - akhilmhdh/destruction:${{ steps.extract_version.outputs.version }} + # infisical/infisical:latest-postgres + infisical/infisical:${{ steps.commit.outputs.short }} + infisical/infisical:${{ steps.extract_version.outputs.version }} + platforms: linux/amd64,linux/arm64 + file: Dockerfile.standalone-infisical + build-args: | + POSTHOG_API_KEY=${{ secrets.PUBLIC_POSTHOG_API_KEY }} + INFISICAL_PLATFORM_VERSION=${{ steps.extract_version.outputs.version }} From dd3790c995e9c505169d1172cda3fc84abc6689b Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 10:31:30 -0500 Subject: [PATCH 006/178] patch git workflow --- .../release-standalone-docker-img-postgres-offical.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release-standalone-docker-img-postgres-offical.yml b/.github/workflows/release-standalone-docker-img-postgres-offical.yml index 5aaeb714e..54f4f4fbe 100644 --- a/.github/workflows/release-standalone-docker-img-postgres-offical.yml +++ b/.github/workflows/release-standalone-docker-img-postgres-offical.yml @@ -47,7 +47,7 @@ jobs: push: true context: . tags: | - # infisical/infisical:latest-postgres + infisical/infisical:latest-postgres infisical/infisical:${{ steps.commit.outputs.short }} infisical/infisical:${{ steps.extract_version.outputs.version }} platforms: linux/amd64,linux/arm64 From dc8b64708a9fb6f13ed48cdfcc558feb2e9d8033 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 11:20:17 -0500 Subject: [PATCH 007/178] add debug logs --- backend/src/services/secret/secret-service.ts | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 029db815b..54fa7fe2f 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -239,6 +239,7 @@ export const secretServiceFactory = ({ userId, blindIndexCfg }: TFnSecretBlindIndexCheck) => { + console.log(`inputSecrets=[${JSON.stringify(inputSecrets, null, 4)}] folderId=[${folderId}] isNew=[${isNew}] userId=[${userId}] blindIndexCfg=[${JSON.stringify(blindIndexCfg, null, 4)}] `) const blindIndex2KeyName: Record = {}; // used at audit log point const keyName2BlindIndex = await Promise.all( inputSecrets.map(({ secretName }) => @@ -252,6 +253,9 @@ export const secretServiceFactory = ({ return prev; }, {}) ); + + console.log("keyName2BlindIndex:", JSON.stringify(keyName2BlindIndex, null, 4)) + if (inputSecrets.some(({ type }) => type === SecretType.Personal) && !userId) { throw new BadRequestError({ message: "Missing user id for personal secret" }); } @@ -265,10 +269,13 @@ export const secretServiceFactory = ({ userId ); + console.log("fnSecretBlindIndexCheck:", JSON.stringify(secrets, null, 4)) + + if (isNew) { if (secrets.length) throw new BadRequestError({ message: "Secret already exist" }); } else if (secrets.length !== inputSecrets.length) - throw new BadRequestError({ message: "Secret not found" }); + throw new BadRequestError({ message: `Secret not found: blind index ${JSON.stringify(keyName2BlindIndex)}` }); return { blindIndex2KeyName, keyName2BlindIndex, secrets }; }; From 81f3a6a7a8a1d5c5e5104360e8386ccbc45d0fb7 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 12:27:15 -0500 Subject: [PATCH 008/178] add loca host to docker prod --- backend/Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/backend/Dockerfile b/backend/Dockerfile index 422ffef6a..2153ba33a 100644 --- a/backend/Dockerfile +++ b/backend/Dockerfile @@ -28,6 +28,8 @@ RUN apk add --no-cache bash curl && curl -1sLf \ HEALTHCHECK --interval=10s --timeout=3s --start-period=10s \ CMD node healthcheck.js +ENV HOST=0.0.0.0 + EXPOSE 4000 CMD ["npm", "start"] From 1a375ec45b8eb7ea0cff156c4934207373e81446 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 12:35:53 -0500 Subject: [PATCH 009/178] patch import * --- backend/src/lib/crypto/encryption.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/lib/crypto/encryption.ts b/backend/src/lib/crypto/encryption.ts index 938db632c..ef1a7afe0 100644 --- a/backend/src/lib/crypto/encryption.ts +++ b/backend/src/lib/crypto/encryption.ts @@ -1,6 +1,6 @@ import crypto from "node:crypto"; -import * as argon2 from "argon2"; +import argon2 from "argon2"; import nacl from "tweetnacl"; import naclUtils from "tweetnacl-util"; From a191f437e945cdba5e522aa337162b9958d5d05e Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 17:03:16 -0500 Subject: [PATCH 010/178] patch blind index route --- backend/src/server/routes/v3/secret-blind-index-router.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/server/routes/v3/secret-blind-index-router.ts b/backend/src/server/routes/v3/secret-blind-index-router.ts index 643f63c81..17bf4c4eb 100644 --- a/backend/src/server/routes/v3/secret-blind-index-router.ts +++ b/backend/src/server/routes/v3/secret-blind-index-router.ts @@ -59,7 +59,7 @@ export const registerSecretBlindIndexRouter = async (server: FastifyZodProvider) }); server.route({ - url: "/:projectId/secrets/name", + url: "/:projectId/secrets/names", method: "POST", schema: { params: z.object({ From 3f5ab2a09ee5d5a9208401210b9b30803389f83f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 17:04:02 -0500 Subject: [PATCH 011/178] remove console.log --- backend/src/services/secret/secret-service.ts | 6 ------ 1 file changed, 6 deletions(-) diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 54fa7fe2f..dd5c8ea71 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -239,7 +239,6 @@ export const secretServiceFactory = ({ userId, blindIndexCfg }: TFnSecretBlindIndexCheck) => { - console.log(`inputSecrets=[${JSON.stringify(inputSecrets, null, 4)}] folderId=[${folderId}] isNew=[${isNew}] userId=[${userId}] blindIndexCfg=[${JSON.stringify(blindIndexCfg, null, 4)}] `) const blindIndex2KeyName: Record = {}; // used at audit log point const keyName2BlindIndex = await Promise.all( inputSecrets.map(({ secretName }) => @@ -254,8 +253,6 @@ export const secretServiceFactory = ({ }, {}) ); - console.log("keyName2BlindIndex:", JSON.stringify(keyName2BlindIndex, null, 4)) - if (inputSecrets.some(({ type }) => type === SecretType.Personal) && !userId) { throw new BadRequestError({ message: "Missing user id for personal secret" }); } @@ -269,9 +266,6 @@ export const secretServiceFactory = ({ userId ); - console.log("fnSecretBlindIndexCheck:", JSON.stringify(secrets, null, 4)) - - if (isNew) { if (secrets.length) throw new BadRequestError({ message: "Secret already exist" }); } else if (secrets.length !== inputSecrets.length) From d14099990f1678c6c46db3e04b0452f2eb3fd578 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 17:04:53 -0500 Subject: [PATCH 012/178] remove notice --- .../src/pages/org/[id]/overview/index.tsx | 24 ------------------- 1 file changed, 24 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index 50a7a335b..bb4a3e4ea 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -615,30 +615,6 @@ const OrganizationPage = withPermission(
)}
-
- -
- Scheduled maintenance on January 27th{" "} -
- We've planned a database upgrade and need to pause certain functionality for - approximately 3 hours on Saturday, January 27th, 10am EST. During these hours, read - operations will continue to function normally but no resources will be editable. No - action is required on your end — your applications can continue to fetch secrets. -
-
- -

Projects

Date: Sat, 27 Jan 2024 17:11:40 -0500 Subject: [PATCH 013/178] remove unused imports --- frontend/src/pages/org/[id]/overview/index.tsx | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/frontend/src/pages/org/[id]/overview/index.tsx b/frontend/src/pages/org/[id]/overview/index.tsx index bb4a3e4ea..43d36d06b 100644 --- a/frontend/src/pages/org/[id]/overview/index.tsx +++ b/frontend/src/pages/org/[id]/overview/index.tsx @@ -24,8 +24,6 @@ import { faPlug, faPlus, faUserPlus, - faWarning, - faXmark } from "@fortawesome/free-solid-svg-icons"; import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { yupResolver } from "@hookform/resolvers/yup"; @@ -58,7 +56,6 @@ import { fetchOrgUsers, useAddUserToWs, useCreateWorkspace, - useGetUserAction, useRegisterUserAction, useUploadWsKey } from "@app/hooks/api"; @@ -480,13 +477,6 @@ const OrganizationPage = withPermission( const { createNotification } = useNotificationContext(); const addWsUser = useAddUserToWs(); - const { data: updateClosed } = useGetUserAction("jan_2024_db_update_closed"); - - const registerUserAction = useRegisterUserAction(); - const closeUpdate = async () => { - await registerUserAction.mutateAsync("jan_2024_db_update_closed"); - }; - const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ "addNewWs", "upgradePlan" From b8a6f5dc5404005ec0ed1d150d38a24b3002bb02 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 18:15:12 -0500 Subject: [PATCH 014/178] add email templates and disposable_emails.text to build --- backend/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/package.json b/backend/package.json index eb31b647d..22311f7ae 100644 --- a/backend/package.json +++ b/backend/package.json @@ -7,7 +7,7 @@ "test": "echo \"Error: no test specified\" && exit 1", "dev": "tsx watch --clear-screen=false ./src/main.ts | pino-pretty --colorize --colorizeObjects --singleLine", "dev:docker": "nodemon", - "build": "rimraf dist && tsup", + "build": "rimraf dist && tsup && cp -R ./src/lib/validator/disposable_emails.txt ./dist && cp -R ./src/services/smtp/templates ./dist", "start": "node dist/main.mjs", "type:check": "tsc --noEmit", "lint:fix": "eslint --fix --ext js,ts ./src", From 6ecd289e6ceb650459f0d17400b4ec64cc527b3f Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 18:38:57 -0500 Subject: [PATCH 015/178] update rate limits --- backend/src/server/config/rateLimiter.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 031ef1fb5..297977e4f 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -11,7 +11,7 @@ export const globalRateLimiterCfg = (): RateLimitPluginOptions => { return { timeWindow: 60 * 1000, - max: 400, + max: 650, redis, allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", keyGenerator: (req) => req.realIp @@ -20,12 +20,12 @@ export const globalRateLimiterCfg = (): RateLimitPluginOptions => { export const authRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 300, + max: 650, keyGenerator: (req) => req.realIp }; export const passwordRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 300, + max: 650, keyGenerator: (req) => req.realIp }; From 1980f802fa06887c70f975b393f78adf91f604de Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 19:05:17 -0500 Subject: [PATCH 016/178] update rate limits --- backend/src/server/config/rateLimiter.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/server/config/rateLimiter.ts b/backend/src/server/config/rateLimiter.ts index 297977e4f..7982cff63 100644 --- a/backend/src/server/config/rateLimiter.ts +++ b/backend/src/server/config/rateLimiter.ts @@ -11,7 +11,7 @@ export const globalRateLimiterCfg = (): RateLimitPluginOptions => { return { timeWindow: 60 * 1000, - max: 650, + max: 600, redis, allowList: (req) => req.url === "/healthcheck" || req.url === "/api/status", keyGenerator: (req) => req.realIp @@ -20,12 +20,12 @@ export const globalRateLimiterCfg = (): RateLimitPluginOptions => { export const authRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 650, + max: 600, keyGenerator: (req) => req.realIp }; export const passwordRateLimit: RateLimitOptions = { timeWindow: 60 * 1000, - max: 650, + max: 600, keyGenerator: (req) => req.realIp }; From bbf2634e731e8372467c36db32215a57c0c64353 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Sat, 27 Jan 2024 20:20:02 -0500 Subject: [PATCH 017/178] prepend sso with site url --- backend/src/server/routes/v1/sso-router.ts | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/src/server/routes/v1/sso-router.ts b/backend/src/server/routes/v1/sso-router.ts index dfd1e9150..f3d5288b0 100644 --- a/backend/src/server/routes/v1/sso-router.ts +++ b/backend/src/server/routes/v1/sso-router.ts @@ -29,7 +29,7 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => { passReqToCallback: true, clientID: appCfg.CLIENT_ID_GOOGLE_LOGIN as string, clientSecret: appCfg.CLIENT_SECRET_GOOGLE_LOGIN as string, - callbackURL: "/api/v1/sso/google", + callbackURL: `${appCfg.SITE_URL}/api/v1/sso/google`, scope: ["profile", " email"] }, async (req, _accessToken, _refreshToken, profile, cb) => { @@ -71,7 +71,7 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => { passReqToCallback: true, clientID: appCfg.CLIENT_ID_GITHUB_LOGIN as string, clientSecret: appCfg.CLIENT_SECRET_GITHUB_LOGIN as string, - callbackURL: "/api/v1/sso/github", + callbackURL: `${appCfg.SITE_URL}/api/v1/sso/github`, scope: ["user:email"] }, async (req, accessToken, _refreshToken, profile, cb) => { @@ -110,7 +110,7 @@ export const registerSsoRouter = async (server: FastifyZodProvider) => { passReqToCallback: true, clientID: appCfg.CLIENT_ID_GITLAB_LOGIN, clientSecret: appCfg.CLIENT_SECRET_GITLAB_LOGIN, - callbackURL: "/api/v1/sso/gitlab", + callbackURL: `${appCfg.SITE_URL}/api/v1/sso/gitlab`, baseURL: appCfg.CLIENT_GITLAB_LOGIN_URL }, async (req: any, _accessToken: string, _refreshToken: string, profile: any, cb: any) => { From f010a3a932da8fdbee5610c9b56e144f92b6f822 Mon Sep 17 00:00:00 2001 From: Akhil Mohan Date: Sun, 28 Jan 2024 23:13:31 +0530 Subject: [PATCH 018/178] feat: changed blind index banner for everyone --- .../secret-blind-index-service.ts | 5 +---- .../permissions/ProjectPermissionCan.tsx | 2 +- .../ProjectPermissionContext.tsx | 6 +++++- .../withProjectPermission.tsx | 8 ++++---- frontend/src/hooks/api/roles/queries.tsx | 13 ++++++++----- frontend/src/hooks/api/users/types.ts | 9 +++++++++ .../CloudIntegrationSection.tsx | 4 ++-- .../SecretApprovalPolicyList.tsx | 2 +- .../components/SecretApprovalPolicyRow.tsx | 2 +- .../src/views/SecretMainPage/SecretMainPage.tsx | 2 +- .../SecretListView/SecretDetaiSidebar.tsx | 2 +- .../components/SecretListView/SecretItem.tsx | 2 +- .../ProjectIndexSecretsSection.tsx | 16 +++++++++++++--- .../SecretRotationPage/SecretRotationPage.tsx | 2 +- .../EnvironmentSection/EnvironmentSection.tsx | 4 ++-- .../SecretTagsSection/SecretTagsSection.tsx | 17 +++++++++++------ 16 files changed, 62 insertions(+), 34 deletions(-) diff --git a/backend/src/services/secret-blind-index/secret-blind-index-service.ts b/backend/src/services/secret-blind-index/secret-blind-index-service.ts index 215e54992..0c18ddedc 100644 --- a/backend/src/services/secret-blind-index/secret-blind-index-service.ts +++ b/backend/src/services/secret-blind-index/secret-blind-index-service.ts @@ -29,10 +29,7 @@ export const secretBlindIndexServiceFactory = ({ projectId, actorId }: TGetProjectBlindIndexStatusDTO) => { - const { membership } = await permissionService.getProjectPermission(actor, actorId, projectId); - if (membership?.role !== ProjectMembershipRole.Admin) { - throw new UnauthorizedError({ message: "User must be admin" }); - } + await permissionService.getProjectPermission(actor, actorId, projectId); const secretCount = await secretBlindIndexDAL.countOfSecretsWithNullSecretBlindIndex(projectId); return Number(secretCount); diff --git a/frontend/src/components/permissions/ProjectPermissionCan.tsx b/frontend/src/components/permissions/ProjectPermissionCan.tsx index aa64c33d7..f1af141f2 100644 --- a/frontend/src/components/permissions/ProjectPermissionCan.tsx +++ b/frontend/src/components/permissions/ProjectPermissionCan.tsx @@ -25,7 +25,7 @@ export const ProjectPermissionCan: FunctionComponent = ({ allowedLabel, ...props }) => { - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); return ( {(isAllowed, ability) => { diff --git a/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx b/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx index cb6ef9b97..a7023a867 100644 --- a/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx +++ b/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx @@ -1,6 +1,7 @@ import { createContext, ReactNode, useContext } from "react"; import { useGetUserProjectPermissions } from "@app/hooks/api"; +import { TProjectMembership } from "@app/hooks/api/users/types"; import { useWorkspace } from "../WorkspaceContext"; import { TProjectPermission } from "./types"; @@ -9,7 +10,10 @@ type Props = { children: ReactNode; }; -const ProjectPermissionContext = createContext(null); +const ProjectPermissionContext = createContext(null); export const ProjectPermissionProvider = ({ children }: Props): JSX.Element => { const { currentWorkspace, isLoading: isWsLoading } = useWorkspace(); diff --git a/frontend/src/hoc/withProjectPermission/withProjectPermission.tsx b/frontend/src/hoc/withProjectPermission/withProjectPermission.tsx index 911703973..103ff61b7 100644 --- a/frontend/src/hoc/withProjectPermission/withProjectPermission.tsx +++ b/frontend/src/hoc/withProjectPermission/withProjectPermission.tsx @@ -21,7 +21,7 @@ export const withProjectPermission = ["abilities"]> ) => { const HOC = (hocProps: T) => { - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); // akhilmhdh: Set as any due to casl/react ts type bug // REASON: casl due to its type checking can't seem to union even if union intersection is applied @@ -29,13 +29,13 @@ export const withProjectPermission =
@@ -43,7 +43,7 @@ export const withProjectPermission =
-
Permission Denied
+
Permission Denied
You do not have permission to this page.
Kindly contact your organization administrator diff --git a/frontend/src/hooks/api/roles/queries.tsx b/frontend/src/hooks/api/roles/queries.tsx index 38d020491..8647353cb 100644 --- a/frontend/src/hooks/api/roles/queries.tsx +++ b/frontend/src/hooks/api/roles/queries.tsx @@ -8,7 +8,7 @@ import { apiRequest } from "@app/config/request"; import { OrgPermissionSet } from "@app/context/OrgPermissionContext/types"; import { ProjectPermissionSet } from "@app/context/ProjectPermissionContext/types"; -import { OrgUser } from "../users/types"; +import { OrgUser, TProjectMembership } from "../users/types"; import { TGetUserOrgPermissionsDTO, TGetUserProjectPermissionDTO, @@ -104,10 +104,13 @@ export const useGetUserOrgPermissions = ({ orgId }: TGetUserOrgPermissionsDTO) = const getUserProjectPermissions = async ({ workspaceId }: TGetUserProjectPermissionDTO) => { const { data } = await apiRequest.get<{ - data: { permissions: PackRule>>[] }; + data: { + permissions: PackRule>>[]; + membership: TProjectMembership; + }; }>(`/api/v1/workspace/${workspaceId}/permissions`, {}); - return data.data.permissions; + return data.data; }; export const useGetUserProjectPermissions = ({ workspaceId }: TGetUserProjectPermissionDTO) => @@ -116,8 +119,8 @@ export const useGetUserProjectPermissions = ({ workspaceId }: TGetUserProjectPer queryFn: () => getUserProjectPermissions({ workspaceId }), enabled: Boolean(workspaceId), select: (data) => { - const rule = unpackRules>>(data); + const rule = unpackRules>>(data.permissions); const ability = createMongoAbility(rule, { conditionsMatcher }); - return ability; + return { permission: ability, membership: data.membership }; } }); diff --git a/frontend/src/hooks/api/users/types.ts b/frontend/src/hooks/api/users/types.ts index 47c733885..ebddefb14 100644 --- a/frontend/src/hooks/api/users/types.ts +++ b/frontend/src/hooks/api/users/types.ts @@ -52,6 +52,15 @@ export type OrgUser = { roleId: string; }; +export type TProjectMembership = { + id: string; + role: string; + createdAt: string; + updatedAt: string; + projectId: string; + roleId: string; +}; + export type TWorkspaceUser = OrgUser; export type AddUserToWsDTO = { diff --git a/frontend/src/views/IntegrationsPage/components/CloudIntegrationSection/CloudIntegrationSection.tsx b/frontend/src/views/IntegrationsPage/components/CloudIntegrationSection/CloudIntegrationSection.tsx index b0abc2603..a1b9787dd 100644 --- a/frontend/src/views/IntegrationsPage/components/CloudIntegrationSection/CloudIntegrationSection.tsx +++ b/frontend/src/views/IntegrationsPage/components/CloudIntegrationSection/CloudIntegrationSection.tsx @@ -30,7 +30,7 @@ export const CloudIntegrationSection = ({ const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([ "deleteConfirmation" ] as const); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); const { createNotification } = useNotificationContext(); const isEmpty = !isLoading && !cloudIntegrations?.length; @@ -43,7 +43,7 @@ export const CloudIntegrationSection = ({

{t("integrations.cloud-integrations")}

{t("integrations.click-to-start")}

-
+
{isLoading && Array.from({ length: 12 }).map((_, index) => ( diff --git a/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/SecretApprovalPolicyList.tsx b/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/SecretApprovalPolicyList.tsx index 27f649bdd..11927a2b1 100644 --- a/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/SecretApprovalPolicyList.tsx +++ b/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/SecretApprovalPolicyList.tsx @@ -44,7 +44,7 @@ export const SecretApprovalPolicyList = ({ workspaceId }: Props) => { "deletePolicy", "upgradePlan" ] as const); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); const { subscription } = useSubscription(); const { createNotification } = useNotificationContext(); diff --git a/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/components/SecretApprovalPolicyRow.tsx b/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/components/SecretApprovalPolicyRow.tsx index 072156b61..c256af1c7 100644 --- a/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/components/SecretApprovalPolicyRow.tsx +++ b/frontend/src/views/SecretApprovalPage/components/SecretApprovalPolicyList/components/SecretApprovalPolicyRow.tsx @@ -36,7 +36,7 @@ export const SecretApprovalPolicyRow = ({ }: Props) => { const [selectedApprovers, setSelectedApprovers] = useState([]); const { mutate: updateSecretApprovalPolicy, isLoading } = useUpdateSecretApprovalPolicy(); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); return ( diff --git a/frontend/src/views/SecretMainPage/SecretMainPage.tsx b/frontend/src/views/SecretMainPage/SecretMainPage.tsx index d3c1a5b93..f538a4c0a 100644 --- a/frontend/src/views/SecretMainPage/SecretMainPage.tsx +++ b/frontend/src/views/SecretMainPage/SecretMainPage.tsx @@ -48,7 +48,7 @@ export const SecretMainPage = () => { const { t } = useTranslation(); const { currentWorkspace } = useWorkspace(); const router = useRouter(); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); const [isVisible, setIsVisible] = useState(false); const [sortDir, setSortDir] = useState(SortDir.ASC); diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx index a86a6b096..1130c9d14 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx @@ -81,7 +81,7 @@ export const SecretDetailSidebar = ({ resolver: zodResolver(formSchema), values: secret }); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); const cannotEditSecret = permission.cannot( ProjectPermissionActions.Edit, subject(ProjectPermissionSub.Secrets, { environment, secretPath }) diff --git a/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx b/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx index aec0573ef..ecd35abf8 100644 --- a/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx +++ b/frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx @@ -85,7 +85,7 @@ export const SecretItem = memo( secretPath }: Props) => { const { currentWorkspace } = useWorkspace(); - const permission = useProjectPermission(); + const { permission } = useProjectPermission(); const isReadOnly = permission.can( ProjectPermissionActions.Read, diff --git a/frontend/src/views/SecretOverviewPage/components/ProjectIndexSecretsSection/ProjectIndexSecretsSection.tsx b/frontend/src/views/SecretOverviewPage/components/ProjectIndexSecretsSection/ProjectIndexSecretsSection.tsx index 2210171b0..bbc2fb49a 100644 --- a/frontend/src/views/SecretOverviewPage/components/ProjectIndexSecretsSection/ProjectIndexSecretsSection.tsx +++ b/frontend/src/views/SecretOverviewPage/components/ProjectIndexSecretsSection/ProjectIndexSecretsSection.tsx @@ -4,9 +4,15 @@ import { decryptSymmetric } from "@app/components/utilities/cryptography/crypto"; import { Button, Spinner } from "@app/components/v2"; -import { ProjectPermissionActions, ProjectPermissionSub, useWorkspace } from "@app/context"; +import { + ProjectPermissionActions, + ProjectPermissionSub, + useProjectPermission, + useWorkspace +} from "@app/context"; import { useToggle } from "@app/hooks"; import { useGetWorkspaceIndexStatus, useNameWorkspaceSecrets } from "@app/hooks/api"; +import { ProjectMembershipRole } from "@app/hooks/api/roles/types"; import { UserWsKeyPair } from "@app/hooks/api/types"; import { fetchWorkspaceSecrets } from "@app/hooks/api/workspace/queries"; @@ -18,6 +24,7 @@ type Props = { export const ProjectIndexSecretsSection = ({ decryptFileKey }: Props) => { const { currentWorkspace } = useWorkspace(); + const { membership } = useProjectPermission(); const { data: isBlindIndexed, isLoading: isBlindIndexedLoading } = useGetWorkspaceIndexStatus( currentWorkspace?.id ?? "" ); @@ -78,13 +85,16 @@ export const ProjectIndexSecretsSection = ({ decryptFileKey }: Props) => {

Your project was created before the introduction of blind indexing. To continue accessing secrets by name through the SDK, public API and web dashboard, please enable blind indexing.{" "} - This is a one time process. + + This is a one time process.{" "} + {membership.role !== ProjectMembershipRole.Admin && "Admin only operation"} +

{(isAllowed) => (