awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: review changes

Browse Source
This commit is contained in:
Piyush Gupta
2025-12-03 17:40:05 +05:30
parent 327ebfeb34
commit 54a6ed4f20
17 changed files with 124 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
backend/src/db/migrations/20251127192155_adds-scope-org-id-to-identity-access-tokens.ts
View File

@@ -1,22 +0,0 @@
import { Knex } from "knex";
import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
const hasScopeOrgIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "scopeOrgId");
if (!hasScopeOrgIdColumn) {
await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
t.uuid("scopeOrgId");
t.foreign("scopeOrgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
});
}
}
export async function down(knex: Knex): Promise<void> {
const hasScopeOrgIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "scopeOrgId");
if (hasScopeOrgIdColumn) {
await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
t.dropColumn("scopeOrgId");
});
}
}

22
backend/src/db/migrations/20251127192155_adds-sub-organization-id-to-identity-access-tokens.ts Normal file
View File

@@ -0,0 +1,22 @@
import { Knex } from "knex";
import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
const hasSubOrganizationIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "subOrganizationId");
if (!hasSubOrganizationIdColumn) {
await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
t.uuid("subOrganizationId").nullable();
t.foreign("subOrganizationId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
});
}
}
export async function down(knex: Knex): Promise<void> {
const hasSubOrganizationIdColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "subOrganizationId");
if (hasSubOrganizationIdColumn) {
await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
t.dropColumn("subOrganizationId");
});
}
}

2
backend/src/db/schemas/identity-access-tokens.ts
View File

@@ -23,7 +23,7 @@ export const IdentityAccessTokensSchema = z.object({
name: z.string().nullable().optional(), name: z.string().nullable().optional(),
authMethod: z.string(), authMethod: z.string(),
accessTokenPeriod: z.coerce.number().default(0), accessTokenPeriod: z.coerce.number().default(0),
scopeOrgId: z.string().uuid().nullable().optional() subOrganizationId: z.string().uuid().nullable().optional()
}); });
export type TIdentityAccessTokens = z.infer<typeof IdentityAccessTokensSchema>; export type TIdentityAccessTokens = z.infer<typeof IdentityAccessTokensSchema>;

2
backend/src/services/identity-access-token/identity-access-token-dal.ts
View File

@@ -19,7 +19,7 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
.join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.IdentityAccessToken}.identityId`) .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.IdentityAccessToken}.identityId`)
.select(selectAllTableCols(TableName.IdentityAccessToken)) .select(selectAllTableCols(TableName.IdentityAccessToken))
.select(db.ref("orgId").withSchema(TableName.Identity).as("identityOrgId")) .select(db.ref("orgId").withSchema(TableName.Identity).as("identityOrgId"))
.select(db.ref("scopeOrgId").withSchema(TableName.IdentityAccessToken).as("scopeOrgId")) .select(db.ref("subOrganizationId").withSchema(TableName.IdentityAccessToken).as("subOrganizationId"))
.first(); .first();
return doc; return doc;

2
backend/src/services/identity-access-token/identity-access-token-service.ts
View File

@@ -206,7 +206,7 @@ export const identityAccessTokenServiceFactory = ({
}); });
} }
const scopeOrgId = identityAccessToken.scopeOrgId || identityAccessToken.identityOrgId; const scopeOrgId = identityAccessToken.subOrganizationId || identityAccessToken.identityOrgId;
const identityOrgDetails = await orgDAL.findOne({ id: scopeOrgId }); const identityOrgDetails = await orgDAL.findOne({ id: scopeOrgId });

19
backend/src/services/identity-alicloud-auth/identity-alicloud-auth-service.ts
View File

@@ -80,26 +80,23 @@ export const identityAliCloudAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -157,7 +154,7 @@ export const identityAliCloudAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityAliCloudAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityAliCloudAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.ALICLOUD_AUTH, authMethod: IdentityAuthMethod.ALICLOUD_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

20
backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
View File

@@ -118,27 +118,23 @@ export const identityAwsAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrgIdentity = Boolean(org.rootOrgId);
const isSubOrg = Boolean(org.rootOrgId); // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -240,7 +236,7 @@ export const identityAwsAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.AWS_AUTH, authMethod: IdentityAuthMethod.AWS_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

21
backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
View File

@@ -74,28 +74,23 @@ export const identityAzureAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrgIdentity = Boolean(org.rootOrgId);
const isSubOrg = Boolean(org.rootOrgId); // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -153,7 +148,7 @@ export const identityAzureAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.AZURE_AUTH, authMethod: IdentityAuthMethod.AZURE_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
View File

@@ -72,26 +72,23 @@ export const identityGcpAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -192,7 +189,7 @@ export const identityGcpAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.GCP_AUTH, authMethod: IdentityAuthMethod.GCP_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
View File

@@ -86,26 +86,23 @@ export const identityJwtAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -271,7 +268,7 @@ export const identityJwtAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityJwtAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityJwtAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.JWT_AUTH, authMethod: IdentityAuthMethod.JWT_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
View File

@@ -198,26 +198,23 @@ export const identityKubernetesAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -512,7 +509,7 @@ export const identityKubernetesAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.KUBERNETES_AUTH, authMethod: IdentityAuthMethod.KUBERNETES_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

20
backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
View File

@@ -167,30 +167,28 @@ export const identityLdapAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
} }
const plan = await licenseService.getPlan(identity.orgId); const plan = await licenseService.getPlan(identity.orgId);
if (!plan.ldap) { if (!plan.ldap) {
throw new BadRequestError({ throw new BadRequestError({
@@ -229,7 +227,7 @@ export const identityLdapAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityLdapAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityLdapAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.LDAP_AUTH, authMethod: IdentityAuthMethod.LDAP_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

20
backend/src/services/identity-oci-auth/identity-oci-auth-service.ts
View File

@@ -76,30 +76,28 @@ export const identityOciAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
} }
try { try {
// Validate OCI host format. Ensures that the host is in "identity.<region>.oraclecloud.com" format. // Validate OCI host format. Ensures that the host is in "identity.<region>.oraclecloud.com" format.
if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) { if (!headers.host || !new RE2("^identity\\.([a-z]{2}-[a-z]+-[1-9])\\.oraclecloud\\.com$").test(headers.host)) {
@@ -162,7 +160,7 @@ export const identityOciAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityOciAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityOciAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.OCI_AUTH, authMethod: IdentityAuthMethod.OCI_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

20
backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
View File

@@ -87,30 +87,28 @@ export const identityOidcAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
} }
try { try {
const { decryptor } = await kmsService.createCipherPairWithDataKey({ const { decryptor } = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.Organization, type: KmsDataKey.Organization,
@@ -339,7 +337,7 @@ export const identityOidcAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.OIDC_AUTH, authMethod: IdentityAuthMethod.OIDC_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-tls-cert-auth/identity-tls-cert-auth-service.ts
View File

@@ -85,26 +85,23 @@ export const identityTlsCertAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -186,7 +183,7 @@ export const identityTlsCertAuthServiceFactory = ({
accessTokenNumUses: 0, accessTokenNumUses: 0,
accessTokenNumUsesLimit: identityTlsCertAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityTlsCertAuth.accessTokenNumUsesLimit,
authMethod: IdentityAuthMethod.TLS_CERT_AUTH, authMethod: IdentityAuthMethod.TLS_CERT_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-token-auth/identity-token-auth-service.ts
View File

@@ -505,26 +505,23 @@ export const identityTokenAuthServiceFactory = ({
if (!identity) throw new UnauthorizedError({ message: "Identity not found" }); if (!identity) throw new UnauthorizedError({ message: "Identity not found" });
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || org.id : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -557,7 +554,7 @@ export const identityTokenAuthServiceFactory = ({
accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit,
name, name,
authMethod: IdentityAuthMethod.TOKEN_AUTH, authMethod: IdentityAuthMethod.TOKEN_AUTH,
scopeOrgId subOrganizationId
}, },
tx tx
); );

19
backend/src/services/identity-ua/identity-ua-service.ts
View File

@@ -91,26 +91,23 @@ export const identityUaServiceFactory = ({
const identity = await identityDAL.findById(identityUa.identityId); const identity = await identityDAL.findById(identityUa.identityId);
const org = await orgDAL.findById(identity.orgId); const org = await orgDAL.findById(identity.orgId);
const isSubOrg = Boolean(org.rootOrgId); const isSubOrgIdentity = Boolean(org.rootOrgId);
const rootOrgId = isSubOrg ? org.rootOrgId || "" : org.id; // If the identity is a sub-org identity, then the scope is always the org.id, and if it's a root org identity, then we need to resolve the scope if a subOrganizationName is specified
let subOrganizationId = isSubOrgIdentity ? org.id : null;
// Resolve sub-organization if specified
let scopeOrgId = rootOrgId;
if (subOrganizationName) { if (subOrganizationName) {
const subOrg = await orgDAL.findOne({ slug: subOrganizationName }); if (!isSubOrgIdentity) {
const subOrg = await orgDAL.findOne({ rootOrgId: org.id, slug: subOrganizationName });
if (subOrg) { if (subOrg) {
if (subOrg.rootOrgId === rootOrgId) {
// Verify identity has membership in the sub-organization
const subOrgMembership = await membershipIdentityDAL.findOne({ const subOrgMembership = await membershipIdentityDAL.findOne({
scope: AccessScope.Organization, scope: AccessScope.Organization,
actorIdentityId: identity.id, actorIdentityId: identity.id,
scopeOrgId: subOrg.id scopeOrgId: subOrg.id
}); });
if (subOrgMembership) { if (subOrgMembership) {
scopeOrgId = subOrg.id; subOrganizationId = subOrg.id;
} }
} }
} }
@@ -284,7 +281,7 @@ export const identityUaServiceFactory = ({
accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit, accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit,
accessTokenPeriod: identityUa.accessTokenPeriod, accessTokenPeriod: identityUa.accessTokenPeriod,
authMethod: IdentityAuthMethod.UNIVERSAL_AUTH, authMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
scopeOrgId, subOrganizationId,
...accessTokenTTLParams ...accessTokenTTLParams
}, },
tx tx