awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 15:40:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

add tenancy OCID requirement

Browse Source
This commit is contained in:
x032205
2025-05-09 22:33:02 -04:00
parent 578a0d7d93
commit 5742fc648b
12 changed files with 59 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/20250508210717_identity-oci-auth.ts
+1
View File
@@ -16,6 +16,7 @@ export async function up(knex: Knex): Promise<void> {
t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
t.string("type").notNullable();
t.string("tenancyOcid").notNullable();
t.string("allowedUsernames").notNullable();
});
}
backend/src/db/schemas/identity-oci-auths.ts
+1
View File
@@ -17,6 +17,7 @@ export const IdentityOciAuthsSchema = z.object({
updatedAt: z.date(),
identityId: z.string().uuid(),
type: z.string(),
tenancyOcid: z.string(),
allowedUsernames: z.string()
});
backend/src/ee/services/audit-log/audit-log-types.ts
+2
View File
@@ -1021,6 +1021,7 @@ interface AddIdentityOciAuthEvent {
type: EventType.ADD_IDENTITY_OCI_AUTH;
metadata: {
identityId: string;
tenancyOcid: string;
allowedUsernames: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
@@ -1040,6 +1041,7 @@ interface UpdateIdentityOciAuthEvent {
type: EventType.UPDATE_IDENTITY_OCI_AUTH;
metadata: {
identityId: string;
tenancyOcid?: string;
allowedUsernames?: string;
accessTokenTTL?: number;
accessTokenMaxTTL?: number;
backend/src/lib/api-docs/constants.ts
+2
View File
@@ -279,6 +279,7 @@ export const OCI_AUTH = {
},
ATTACH: {
identityId: "The ID of the identity to attach the configuration onto.",
tenancyOcid: "The OCID of your tenancy.",
allowedUsernames:
"The comma-separated list of trusted OCI account usernames that are allowed to authenticate with Infisical.",
accessTokenTTL: "The lifetime for an access token in seconds.",
@@ -288,6 +289,7 @@ export const OCI_AUTH = {
},
UPDATE: {
identityId: "The ID of the identity to update the auth method for.",
tenancyOcid: "The OCID of your tenancy.",
allowedUsernames:
"The comma-separated list of trusted OCI account usernames that are allowed to authenticate with Infisical.",
accessTokenTTL: "The new lifetime for an access token in seconds.",
backend/src/server/routes/v1/identity-oci-auth-router.ts
+5 -1
View File
@@ -7,7 +7,7 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
import { validateUsernames } from "@app/services/identity-oci-auth/identity-oci-auth-validators";
import { validateTenancy, validateUsernames } from "@app/services/identity-oci-auth/identity-oci-auth-validators";
import { isSuperAdmin } from "@app/services/super-admin/super-admin-fns";
export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider) => {
@@ -88,6 +88,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
}),
body: z
.object({
tenancyOcid: validateTenancy.describe(OCI_AUTH.ATTACH.tenancyOcid),
allowedUsernames: validateUsernames.describe(OCI_AUTH.ATTACH.allowedUsernames),
accessTokenTrustedIps: z
.object({
@@ -141,6 +142,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
type: EventType.ADD_IDENTITY_OCI_AUTH,
metadata: {
identityId: identityOciAuth.identityId,
tenancyOcid: identityOciAuth.tenancyOcid,
allowedUsernames: identityOciAuth.allowedUsernames,
accessTokenTTL: identityOciAuth.accessTokenTTL,
accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
@@ -175,6 +177,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
}),
body: z
.object({
tenancyOcid: validateTenancy.describe(OCI_AUTH.UPDATE.tenancyOcid),
allowedUsernames: validateUsernames.describe(OCI_AUTH.UPDATE.allowedUsernames),
accessTokenTrustedIps: z
.object({
@@ -221,6 +224,7 @@ export const registerIdentityOciAuthRouter = async (server: FastifyZodProvider)
type: EventType.UPDATE_IDENTITY_OCI_AUTH,
metadata: {
identityId: identityOciAuth.identityId,
tenancyOcid: identityOciAuth.tenancyOcid,
allowedUsernames: identityOciAuth.allowedUsernames,
accessTokenTTL: identityOciAuth.accessTokenTTL,
accessTokenMaxTTL: identityOciAuth.accessTokenMaxTTL,
backend/src/services/identity-oci-auth/identity-oci-auth-service.ts
+10
View File
@@ -70,6 +70,12 @@ export const identityOciAuthServiceFactory = ({
headers
});
if (data.compartmentId !== identityOciAuth.tenancyOcid) {
throw new UnauthorizedError({
message: "Access denied: OCI account isn't part of tenancy."
});
}
if (identityOciAuth.allowedUsernames) {
const isAccountAllowed = identityOciAuth.allowedUsernames.split(",").some((name) => name.trim() === data.name);
@@ -121,6 +127,7 @@ export const identityOciAuthServiceFactory = ({
const attachOciAuth = async ({
identityId,
tenancyOcid,
allowedUsernames,
accessTokenTTL,
accessTokenMaxTTL,
@@ -179,6 +186,7 @@ export const identityOciAuthServiceFactory = ({
{
identityId: identityMembershipOrg.identityId,
type: "iam",
tenancyOcid,
allowedUsernames,
accessTokenMaxTTL,
accessTokenTTL,
@@ -194,6 +202,7 @@ export const identityOciAuthServiceFactory = ({
const updateOciAuth = async ({
identityId,
tenancyOcid,
allowedUsernames,
accessTokenTTL,
accessTokenMaxTTL,
@@ -250,6 +259,7 @@ export const identityOciAuthServiceFactory = ({
});
const updatedOciAuth = await identityOciAuthDAL.updateById(identityOciAuth.id, {
tenancyOcid,
allowedUsernames,
accessTokenMaxTTL,
accessTokenTTL,
backend/src/services/identity-oci-auth/identity-oci-auth-types.ts
+2
View File
@@ -12,6 +12,7 @@ export type TLoginOciAuthDTO = {
export type TAttachOciAuthDTO = {
identityId: string;
tenancyOcid: string;
allowedUsernames: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
@@ -22,6 +23,7 @@ export type TAttachOciAuthDTO = {
export type TUpdateOciAuthDTO = {
identityId: string;
tenancyOcid?: string;
allowedUsernames?: string;
accessTokenTTL?: number;
accessTokenMaxTTL?: number;
backend/src/services/identity-oci-auth/identity-oci-auth-validators.ts
+9
View File
@@ -19,3 +19,12 @@ export const validateUsernames = z
message: "One or more usernames are invalid"
})
.transform((arr) => arr.join(", "));
export const validateTenancy = z
.string()
.trim()
.min(1, "Tenancy OCID cannot be empty.")
.refine(
(val) => new RE2("^ocid1\\.tenancy\\.oc1\\..+$").test(val),
"Invalid Tenancy OCID format. Must start with ocid1.tenancy.oc1."
);