awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-13 21:29:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added pki collection table, pki alert modal

Browse Source
This commit is contained in:
Tuan Dang
2024-08-07 17:09:07 -07:00
parent 1690a9429c
commit 556e4d62c4
44 changed files with 1442 additions and 244 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/@types/fastify.d.ts
Vendored
+2
View File
@@ -52,6 +52,7 @@ import { TIntegrationAuthServiceFactory } from "@app/services/integration-auth/i
import { TOrgRoleServiceFactory } from "@app/services/org/org-role-service";
import { TOrgServiceFactory } from "@app/services/org/org-service";
import { TOrgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
import { TPkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
import { TProjectServiceFactory } from "@app/services/project/project-service";
import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
import { TProjectEnvServiceFactory } from "@app/services/project-env/project-env-service";
@@ -155,6 +156,7 @@ declare module "fastify" {
certificate: TCertificateServiceFactory;
certificateAuthority: TCertificateAuthorityServiceFactory;
certificateAuthorityCrl: TCertificateAuthorityCrlServiceFactory;
pkiCollection: TPkiCollectionServiceFactory;
secretScanning: TSecretScanningServiceFactory;
license: TLicenseServiceFactory;
trustedIp: TTrustedIpServiceFactory;
backend/src/@types/knex.d.ts
Vendored
+8
View File
@@ -164,6 +164,9 @@ import {
TOrgRoles,
TOrgRolesInsert,
TOrgRolesUpdate,
TPkiCollections,
TPkiCollectionsInsert,
TPkiCollectionsUpdate,
TProjectBots,
TProjectBotsInsert,
TProjectBotsUpdate,
@@ -368,6 +371,11 @@ declare module "knex/types/tables" {
TCertificateSecretsInsert,
TCertificateSecretsUpdate
>;
[TableName.PkiCollection]: KnexOriginal.CompositeTableType<
TPkiCollections,
TPkiCollectionsInsert,
TPkiCollectionsUpdate
>;
[TableName.UserGroupMembership]: KnexOriginal.CompositeTableType<
TUserGroupMembership,
TUserGroupMembershipInsert,
backend/src/db/migrations/20240802181855_ca-cert-version.ts
+6 -6
View File
@@ -22,7 +22,7 @@ export async function up(knex: Knex): Promise<void> {
if (!hasVersionColumn) {
await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
t.integer("version").nullable();
t.dropUnique(["caId"]);
// t.dropUnique(["caId"]);
});
await knex(TableName.CertificateAuthorityCert).update({ version: 1 }).whereNull("version");
@@ -54,11 +54,11 @@ export async function up(knex: Knex): Promise<void> {
}
}
if (await knex.schema.hasTable(TableName.CertificateAuthoritySecret)) {
await knex.schema.alterTable(TableName.CertificateAuthoritySecret, (t) => {
t.dropUnique(["caId"]);
});
}
// if (await knex.schema.hasTable(TableName.CertificateAuthoritySecret)) {
// await knex.schema.alterTable(TableName.CertificateAuthoritySecret, (t) => {
// t.dropUnique(["caId"]);
// });
// }
}
export async function down(knex: Knex): Promise<void> {
backend/src/db/migrations/20240806173521_cert-alerting.ts
+17 -1
View File
@@ -4,23 +4,39 @@ import { TableName } from "../schemas";
import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
export async function up(knex: Knex): Promise<void> {
if (!(await knex.schema.hasTable(TableName.PkiCollection))) {
await knex.schema.createTable(TableName.PkiCollection, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.timestamps(true, true, true);
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.string("name").notNullable();
});
}
if (!(await knex.schema.hasTable(TableName.Alert))) {
// TODO: rename to pki alert
await knex.schema.createTable(TableName.Alert, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.timestamps(true, true, true);
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("pkiCollectionId").notNullable();
t.foreign("pkiCollectionId").references("id").inTable(TableName.PkiCollection).onDelete("CASCADE");
t.string("name").notNullable();
t.integer("alertBeforeDays").notNullable();
t.string("recipientEmails").notNullable();
});
}
await createOnUpdateTrigger(knex, TableName.PkiCollection);
await createOnUpdateTrigger(knex, TableName.Alert);
}
export async function down(knex: Knex): Promise<void> {
// certificates
await knex.schema.dropTableIfExists(TableName.PkiCollection);
await dropOnUpdateTrigger(knex, TableName.PkiCollection);
await knex.schema.dropTableIfExists(TableName.Alert);
await dropOnUpdateTrigger(knex, TableName.Alert);
}
backend/src/db/schemas/alerts.ts
+1
View File
@@ -12,6 +12,7 @@ export const AlertsSchema = z.object({
createdAt: z.date(),
updatedAt: z.date(),
projectId: z.string(),
pkiCollectionId: z.string().uuid(),
name: z.string(),
alertBeforeDays: z.number(),
recipientEmails: z.string()
backend/src/db/schemas/index.ts
+1
View File
@@ -53,6 +53,7 @@ export * from "./org-bots";
export * from "./org-memberships";
export * from "./org-roles";
export * from "./organizations";
export * from "./pki-collections";
export * from "./project-bots";
export * from "./project-environments";
export * from "./project-keys";
backend/src/db/schemas/models.ts
+2 -1
View File
@@ -9,7 +9,8 @@ export enum TableName {
Certificate = "certificates",
CertificateBody = "certificate_bodies",
CertificateSecret = "certificate_secrets",
Alert = "alerts",
Alert = "alerts", // TODO: rename
PkiCollection = "pki_collections",
Groups = "groups",
GroupProjectMembership = "group_project_memberships",
GroupProjectMembershipRole = "group_project_membership_roles",
backend/src/db/schemas/pki-collections.ts
+20
View File
@@ -0,0 +1,20 @@
// Code generated by automation script, DO NOT EDIT.
// Automated by pulling database and generating zod schema
// To update. Just run npm run generate:schema
// Written by akhilmhdh.
import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const PkiCollectionsSchema = z.object({
id: z.string().uuid(),
createdAt: z.date(),
updatedAt: z.date(),
projectId: z.string(),
name: z.string()
});
export type TPkiCollections = z.infer<typeof PkiCollectionsSchema>;
export type TPkiCollectionsInsert = Omit<z.input<typeof PkiCollectionsSchema>, TImmutableDBKeys>;
export type TPkiCollectionsUpdate = Partial<Omit<z.input<typeof PkiCollectionsSchema>, TImmutableDBKeys>>;
backend/src/ee/services/permission/project-permission.ts
+16 -8
View File
@@ -10,7 +10,6 @@ export enum ProjectPermissionActions {
}
export enum ProjectPermissionSub {
Alerts = "alerts",
Role = "role",
Member = "member",
Groups = "groups",
@@ -31,6 +30,8 @@ export enum ProjectPermissionSub {
Identity = "identity",
CertificateAuthorities = "certificate-authorities",
Certificates = "certificates",
PkiAlerts = "pki-alerts",
PkiCollections = "pki-collections",
Kms = "kms"
}
@@ -64,7 +65,8 @@ export type ProjectPermissionSet =
| [ProjectPermissionActions, ProjectPermissionSub.Identity]
| [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
| [ProjectPermissionActions, ProjectPermissionSub.Certificates]
| [ProjectPermissionActions, ProjectPermissionSub.Alerts]
| [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
| [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
| [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
| [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
| [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
@@ -74,11 +76,6 @@ export type ProjectPermissionSet =
const buildAdminPermissionRules = () => {
const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
can(ProjectPermissionActions.Read, ProjectPermissionSub.Alerts);
can(ProjectPermissionActions.Create, ProjectPermissionSub.Alerts);
can(ProjectPermissionActions.Edit, ProjectPermissionSub.Alerts);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.Alerts);
can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
can(ProjectPermissionActions.Create, ProjectPermissionSub.Secrets);
can(ProjectPermissionActions.Edit, ProjectPermissionSub.Secrets);
@@ -168,6 +165,16 @@ const buildAdminPermissionRules = () => {
can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
can(ProjectPermissionActions.Create, ProjectPermissionSub.PkiAlerts);
can(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiAlerts);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiAlerts);
can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
can(ProjectPermissionActions.Create, ProjectPermissionSub.PkiCollections);
can(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiCollections);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiCollections);
can(ProjectPermissionActions.Edit, ProjectPermissionSub.Project);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.Project);
@@ -244,7 +251,8 @@ const buildMemberPermissionRules = () => {
can(ProjectPermissionActions.Edit, ProjectPermissionSub.Certificates);
can(ProjectPermissionActions.Delete, ProjectPermissionSub.Certificates);
can(ProjectPermissionActions.Read, ProjectPermissionSub.Alerts);
can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
can(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
return rules;
};
backend/src/server/routes/index.ts
+17 -4
View File
@@ -133,6 +133,8 @@ import { orgRoleServiceFactory } from "@app/services/org/org-role-service";
import { orgServiceFactory } from "@app/services/org/org-service";
import { orgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
import { orgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
import { pkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
import { pkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
import { projectDALFactory } from "@app/services/project/project-dal";
import { projectQueueFactory } from "@app/services/project/project-queue";
import { projectServiceFactory } from "@app/services/project/project-service";
@@ -517,10 +519,6 @@ export const registerRoutes = async (
licenseService
});
const apiKeyService = apiKeyServiceFactory({ apiKeyDAL, userDAL });
const alertService = alertServiceFactory({
alertDAL,
permissionService
});
const secretScanningQueue = secretScanningQueueFactory({
telemetryService,
@@ -590,6 +588,8 @@ export const registerRoutes = async (
const certificateDAL = certificateDALFactory(db);
const certificateBodyDAL = certificateBodyDALFactory(db);
const pkiCollectionDAL = pkiCollectionDALFactory(db);
const certificateService = certificateServiceFactory({
certificateDAL,
certificateBodyDAL,
@@ -634,6 +634,17 @@ export const registerRoutes = async (
licenseService
});
const alertService = alertServiceFactory({
alertDAL,
pkiCollectionDAL,
permissionService
});
const pkiCollectionService = pkiCollectionServiceFactory({
pkiCollectionDAL,
permissionService
});
const projectService = projectServiceFactory({
permissionService,
projectDAL,
@@ -651,6 +662,7 @@ export const registerRoutes = async (
certificateAuthorityDAL,
certificateDAL,
alertDAL,
pkiCollectionDAL,
projectUserMembershipRoleDAL,
identityProjectMembershipRoleDAL,
keyStore,
@@ -1123,6 +1135,7 @@ export const registerRoutes = async (
certificate: certificateService,
certificateAuthority: certificateAuthorityService,
certificateAuthorityCrl: certificateAuthorityCrlService,
pkiCollection: pkiCollectionService,
secretScanning: secretScanningService,
license: licenseService,
trustedIp: trustedIpService,
backend/src/server/routes/v1/index.ts
+4 -2
View File
@@ -1,5 +1,4 @@
import { registerAdminRouter } from "./admin-router";
import { registerAlertRouter } from "./alert-router";
import { registerAuthRoutes } from "./auth-router";
import { registerProjectBotRouter } from "./bot-router";
import { registerCaRouter } from "./certificate-authority-router";
@@ -19,6 +18,8 @@ import { registerInviteOrgRouter } from "./invite-org-router";
import { registerOrgAdminRouter } from "./org-admin-router";
import { registerOrgRouter } from "./organization-router";
import { registerPasswordRouter } from "./password-router";
import { registerPkiAlertRouter } from "./pki-alert-router";
import { registerPkiCollectionRouter } from "./pki-collection-router";
import { registerProjectEnvRouter } from "./project-env-router";
import { registerProjectKeyRouter } from "./project-key-router";
import { registerProjectMembershipRouter } from "./project-membership-router";
@@ -49,7 +50,6 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
},
{ prefix: "/auth" }
);
await server.register(registerAlertRouter, { prefix: "/alerts" });
await server.register(registerPasswordRouter, { prefix: "/password" });
await server.register(registerOrgRouter, { prefix: "/organization" });
await server.register(registerAdminRouter, { prefix: "/admin" });
@@ -76,6 +76,8 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
async (pkiRouter) => {
await pkiRouter.register(registerCaRouter, { prefix: "/ca" });
await pkiRouter.register(registerCertRouter, { prefix: "/certificates" });
await server.register(registerPkiAlertRouter, { prefix: "/alerts" });
await server.register(registerPkiCollectionRouter, { prefix: "/collections" });
},
{ prefix: "/pki" }
);
backend/src/server/routes/v1/alert-router.ts → backend/src/server/routes/v1/pki-alert-router.ts
+11 -9
View File
@@ -5,7 +5,7 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
export const registerAlertRouter = async (server: FastifyZodProvider) => {
export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
server.route({
method: "POST",
url: "/",
@@ -14,9 +14,10 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Create alert",
description: "Create PKI alert",
body: z.object({
projectId: z.string().trim(),
pkiCollectionId: z.string().trim(),
name: z.string().trim(),
alertBeforeDays: z.number(),
emails: z.array(z.string())
@@ -26,7 +27,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
}
},
handler: async (req) => {
const alert = await server.services.alert.createAlert({
const alert = await server.services.alert.createPkiAlert({
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
@@ -61,7 +62,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Get alert",
description: "Get PKI alert",
params: z.object({
alertId: z.string().trim()
}),
@@ -70,7 +71,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
}
},
handler: async (req) => {
const alert = await server.services.alert.getAlertById({
const alert = await server.services.alert.getPkiAlertById({
alertId: req.params.alertId,
actor: req.permission.type,
actorId: req.permission.id,
@@ -104,13 +105,14 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Update alert",
description: "Update PKI alert",
params: z.object({
alertId: z.string().trim()
}),
body: z.object({
name: z.string().trim().optional(),
alertBeforeDays: z.number().optional(),
pkiCollectionId: z.string().trim().optional(),
emails: z.array(z.string()).optional()
}),
response: {
@@ -118,7 +120,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
}
},
handler: async (req) => {
const alert = await server.services.alert.updateAlert({
const alert = await server.services.alert.updatePkiAlert({
alertId: req.params.alertId,
actor: req.permission.type,
actorId: req.permission.id,
@@ -153,7 +155,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Delete alert",
description: "Delete PKI alert",
params: z.object({
alertId: z.string().trim()
}),
@@ -162,7 +164,7 @@ export const registerAlertRouter = async (server: FastifyZodProvider) => {
}
},
handler: async (req) => {
const alert = await server.services.alert.deleteAlert({
const alert = await server.services.alert.deletePkiAlert({
alertId: req.params.alertId,
actor: req.permission.type,
actorId: req.permission.id,
backend/src/server/routes/v1/pki-collection-router.ts
+187
View File
@@ -0,0 +1,187 @@
import { z } from "zod";
import { PkiCollectionsSchema } from "@app/db/schemas";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
export const registerPkiCollectionRouter = async (server: FastifyZodProvider) => {
server.route({
method: "POST",
url: "/",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Create PKI collection",
body: z.object({
projectId: z.string().trim(),
name: z.string().trim()
}),
response: {
200: PkiCollectionsSchema
}
},
handler: async (req) => {
const pkiCollection = await server.services.pkiCollection.createPkiCollection({
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.REVOKE_CERT,
// metadata: {
// certId: cert.id,
// cn: cert.commonName,
// serialNumber: cert.serialNumber
// }
// }
// });
return pkiCollection;
}
});
server.route({
method: "GET",
url: "/:collectionId",
config: {
rateLimit: readLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Get PKI collection",
params: z.object({
collectionId: z.string().trim()
}),
response: {
200: PkiCollectionsSchema
}
},
handler: async (req) => {
const pkiCollection = await server.services.pkiCollection.getPkiCollectionById({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
return pkiCollection;
}
});
server.route({
method: "PATCH",
url: "/:collectionId",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Update PKI collection",
params: z.object({
collectionId: z.string().trim()
}),
body: z.object({
name: z.string().trim().optional()
}),
response: {
200: PkiCollectionsSchema
}
},
handler: async (req) => {
const pkiCollection = await server.services.pkiCollection.updatePkiCollection({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId,
...req.body
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.GET_CA,
// metadata: {
// caId: ca.id,
// dn: ca.dn
// }
// }
// });
return pkiCollection;
}
});
server.route({
method: "DELETE",
url: "/:collectionId",
config: {
rateLimit: writeLimit
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
schema: {
description: "Delete PKI collection",
params: z.object({
collectionId: z.string().trim()
}),
response: {
200: PkiCollectionsSchema
}
},
handler: async (req) => {
const pkiCollection = await server.services.pkiCollection.deletePkiCollection({
collectionId: req.params.collectionId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
// TODO: audit logging
// await server.services.auditLog.createAuditLog({
// ...req.auditLogInfo,
// projectId: ca.projectId,
// event: {
// type: EventType.DELETE_CERT,
// metadata: {
// certId: deletedCert.id,
// cn: deletedCert.commonName,
// serialNumber: deletedCert.serialNumber
// }
// }
// });
return pkiCollection;
}
});
};
backend/src/server/routes/v2/project-router.ts
+38 -2
View File
@@ -1,7 +1,13 @@
import slugify from "@sindresorhus/slugify";
import { z } from "zod";
import { AlertsSchema, CertificateAuthoritiesSchema, CertificatesSchema, ProjectKeysSchema } from "@app/db/schemas";
import {
AlertsSchema,
CertificateAuthoritiesSchema,
CertificatesSchema,
PkiCollectionsSchema,
ProjectKeysSchema
} from "@app/db/schemas";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { PROJECTS } from "@app/lib/api-docs";
import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -395,7 +401,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
server.route({
method: "GET",
url: "/:projectId/alerts",
url: "/:projectId/pki-alerts",
config: {
rateLimit: readLimit
},
@@ -422,4 +428,34 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
return { alerts };
}
});
server.route({
method: "GET",
url: "/:projectId/pki-collections",
config: {
rateLimit: readLimit
},
schema: {
params: z.object({
projectId: z.string().trim()
}),
response: {
200: z.object({
collections: z.array(PkiCollectionsSchema)
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const { pkiCollections } = await server.services.project.listProjectPkiCollections({
projectId: req.params.projectId,
actorId: req.permission.id,
actorOrgId: req.permission.orgId,
actorAuthMethod: req.permission.authMethod,
actor: req.permission.type
});
return { collections: pkiCollections };
}
});
};
backend/src/services/alert/alert-service.ts
+34 -15
View File
@@ -2,22 +2,25 @@ import { ForbiddenError } from "@casl/ability";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { NotFoundError } from "@app/lib/errors";
import { NotFoundError, UnauthorizedError } from "@app/lib/errors";
import { TPkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
import { TAlertDALFactory } from "./alert-dal";
import { TCreateAlertDTO, TDeleteAlertDTO, TGetAlertByIdDTO, TUpdateAlertDTO } from "./alert-types";
type TAlertServiceFactoryDep = {
alertDAL: TAlertDALFactory;
pkiCollectionDAL: TPkiCollectionDALFactory;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
};
export type TAlertServiceFactory = ReturnType<typeof alertServiceFactory>;
export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServiceFactoryDep) => {
const createAlert = async ({
export const alertServiceFactory = ({ alertDAL, pkiCollectionDAL, permissionService }: TAlertServiceFactoryDep) => {
const createPkiAlert = async ({
projectId,
name,
pkiCollectionId,
alertBeforeDays,
emails,
actorId,
@@ -33,10 +36,16 @@ export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServi
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Alerts);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.PkiAlerts);
const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId);
if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
if (pkiCollection.projectId !== projectId)
throw new UnauthorizedError({ message: "PKI collection not found in project" });
const alert = await alertDAL.create({
projectId,
pkiCollectionId,
name,
alertBeforeDays,
recipientEmails: emails.join(",")
@@ -44,7 +53,7 @@ export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServi
return alert;
};
const getAlertById = async ({ alertId, actorId, actorAuthMethod, actor, actorOrgId }: TGetAlertByIdDTO) => {
const getPkiAlertById = async ({ alertId, actorId, actorAuthMethod, actor, actorOrgId }: TGetAlertByIdDTO) => {
const alert = await alertDAL.findById(alertId);
if (!alert) throw new NotFoundError({ message: "Alert not found" });
@@ -56,13 +65,14 @@ export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServi
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Alerts);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
return alert;
};
const updateAlert = async ({
const updatePkiAlert = async ({
alertId,
name,
pkiCollectionId,
alertBeforeDays,
emails,
actorId,
@@ -81,17 +91,26 @@ export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServi
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Alerts);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiAlerts);
if (pkiCollectionId) {
const pkiCollection = await pkiCollectionDAL.findById(pkiCollectionId);
if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
if (pkiCollection.projectId !== alert.projectId)
throw new UnauthorizedError({ message: "PKI collection not found in project" });
}
alert = await alertDAL.updateById(alertId, {
name,
alertBeforeDays,
recipientEmails: emails ? emails.join(",") : undefined
...(pkiCollectionId && { pkiCollectionId }),
...(emails && { recipientEmails: emails.join(",") }) // TODO: standardize recipient emails
});
return alert;
};
const deleteAlert = async ({ alertId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteAlertDTO) => {
const deletePkiAlert = async ({ alertId, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteAlertDTO) => {
let alert = await alertDAL.findById(alertId);
if (!alert) throw new NotFoundError({ message: "Alert not found" });
@@ -103,15 +122,15 @@ export const alertServiceFactory = ({ alertDAL, permissionService }: TAlertServi
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Alerts);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.PkiAlerts);
alert = await alertDAL.deleteById(alertId);
return alert;
};
return {
createAlert,
getAlertById,
updateAlert,
deleteAlert
createPkiAlert,
getPkiAlertById,
updatePkiAlert,
deletePkiAlert
};
};
backend/src/services/alert/alert-types.ts
+2
View File
@@ -2,6 +2,7 @@ import { TProjectPermission } from "@app/lib/types";
export type TCreateAlertDTO = {
name: string;
pkiCollectionId: string;
alertBeforeDays: number;
emails: string[];
} & TProjectPermission;
@@ -13,6 +14,7 @@ export type TGetAlertByIdDTO = {
export type TUpdateAlertDTO = {
alertId: string;
name?: string;
pkiCollectionId?: string;
alertBeforeDays?: number;
emails?: string[];
} & Omit<TProjectPermission, "projectId">;
backend/src/services/pki-collection/pki-collection-dal.ts
+13
View File
@@ -0,0 +1,13 @@
import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { ormify } from "@app/lib/knex";
export type TPkiCollectionDALFactory = ReturnType<typeof pkiCollectionDALFactory>;
export const pkiCollectionDALFactory = (db: TDbClient) => {
const pkiCollectionOrm = ormify(db, TableName.PkiCollection);
return {
...pkiCollectionOrm
};
};
backend/src/services/pki-collection/pki-collection-service.ts
+138
View File
@@ -0,0 +1,138 @@
import { ForbiddenError } from "@casl/ability";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { NotFoundError } from "@app/lib/errors";
import { TPkiCollectionDALFactory } from "./pki-collection-dal";
import {
TCreatePkiCollectionDTO,
TDeletePkiCollectionDTO,
TGetPkiCollectionByIdDTO,
TUpdatePkiCollectionDTO
} from "./pki-collection-types";
type TPkiCollectionServiceFactoryDep = {
pkiCollectionDAL: TPkiCollectionDALFactory;
permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
};
export type TPkiCollectionServiceFactory = ReturnType<typeof pkiCollectionServiceFactory>;
export const pkiCollectionServiceFactory = ({
pkiCollectionDAL,
permissionService
}: TPkiCollectionServiceFactoryDep) => {
const createPkiCollection = async ({
name,
projectId,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TCreatePkiCollectionDTO) => {
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.PkiCollections
);
const pkiCollection = await pkiCollectionDAL.create({
projectId,
name
});
return pkiCollection;
};
const getPkiCollectionById = async ({
collectionId,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TGetPkiCollectionByIdDTO) => {
const pkiCollection = await pkiCollectionDAL.findById(collectionId);
if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
pkiCollection.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
return pkiCollection;
};
const updatePkiCollection = async ({
collectionId,
name,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TUpdatePkiCollectionDTO) => {
let pkiCollection = await pkiCollectionDAL.findById(collectionId);
if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
pkiCollection.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.PkiCollections);
pkiCollection = await pkiCollectionDAL.updateById(collectionId, {
name
});
return pkiCollection;
};
const deletePkiCollection = async ({
collectionId,
actorId,
actorAuthMethod,
actor,
actorOrgId
}: TDeletePkiCollectionDTO) => {
let pkiCollection = await pkiCollectionDAL.findById(collectionId);
if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
pkiCollection.projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.PkiCollections
);
pkiCollection = await pkiCollectionDAL.deleteById(collectionId);
return pkiCollection;
};
// TODO: add/remove pki collection items
return {
createPkiCollection,
getPkiCollectionById,
updatePkiCollection,
deletePkiCollection
};
};
backend/src/services/pki-collection/pki-collection-types.ts
+18
View File
@@ -0,0 +1,18 @@
import { TProjectPermission } from "@app/lib/types";
export type TCreatePkiCollectionDTO = {
name: string;
} & TProjectPermission;
export type TGetPkiCollectionByIdDTO = {
collectionId: string;
} & Omit<TProjectPermission, "projectId">;
export type TUpdatePkiCollectionDTO = {
collectionId: string;
name?: string;
} & Omit<TProjectPermission, "projectId">;
export type TDeletePkiCollectionDTO = {
collectionId: string;
} & Omit<TProjectPermission, "projectId">;
backend/src/services/project/project-service.ts
+32 -1
View File
@@ -23,6 +23,7 @@ import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/id
import { TKmsServiceFactory } from "../kms/kms-service";
import { TOrgDALFactory } from "../org/org-dal";
import { TOrgServiceFactory } from "../org/org-service";
import { TPkiCollectionDALFactory } from "../pki-collection/pki-collection-dal";
import { TProjectBotDALFactory } from "../project-bot/project-bot-dal";
import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
import { TProjectKeyDALFactory } from "../project-key/project-key-dal";
@@ -73,6 +74,7 @@ type TProjectServiceFactoryDep = {
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "find">;
certificateDAL: Pick<TCertificateDALFactory, "find" | "countCertificatesInProject">;
alertDAL: Pick<TAlertDALFactory, "find">;
pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "find">;
permissionService: TPermissionServiceFactory;
orgService: Pick<TOrgServiceFactory, "addGhostUser">;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -110,6 +112,7 @@ export const projectServiceFactory = ({
identityProjectMembershipRoleDAL,
certificateAuthorityDAL,
certificateDAL,
pkiCollectionDAL,
alertDAL,
keyStore,
kmsService,
@@ -698,7 +701,7 @@ export const projectServiceFactory = ({
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Alerts);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiAlerts);
const alerts = await alertDAL.find({ projectId });
@@ -707,6 +710,33 @@ export const projectServiceFactory = ({
};
};
/**
* Return list of PKI collections for project
*/
const listProjectPkiCollections = async ({
projectId,
actor,
actorId,
actorAuthMethod,
actorOrgId
}: TListProjectAlertsDTO) => {
const { permission } = await permissionService.getProjectPermission(
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId
);
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.PkiCollections);
const pkiCollections = await pkiCollectionDAL.find({ projectId });
return {
pkiCollections
};
};
const updateProjectKmsKey = async ({
projectId,
kms,
@@ -826,6 +856,7 @@ export const projectServiceFactory = ({
listProjectCas,
listProjectCertificates,
listProjectAlerts,
listProjectPkiCollections,
updateVersionLimit,
updateAuditLogsRetention,
updateProjectKmsKey,