awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-12 00:29:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

- Swap database column names to include "seconds" - Use MS for frontend

Browse Source 
time display
This commit is contained in:
x032205
2025-08-26 20:55:02 -04:00
parent 6c214e6e99
commit 598a026482
12 changed files with 107 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/20250819081226_identity-lockouts-ldap.ts
+14 -8
View File
@@ -6,8 +6,11 @@ export async function up(knex: Knex): Promise<void> {
if (await knex.schema.hasTable(TableName.IdentityLdapAuth)) {
const hasLockoutEnabled = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutEnabled");
const hasLockoutThreshold = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutThreshold");
const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutDuration");
const hasLockoutCounterReset = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutCounterReset");
const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutDurationSeconds");
const hasLockoutCounterReset = await knex.schema.hasColumn(
TableName.IdentityLdapAuth,
"lockoutCounterResetSeconds"
);
await knex.schema.alterTable(TableName.IdentityLdapAuth, (t) => {
if (!hasLockoutEnabled) {
@@ -17,10 +20,10 @@ export async function up(knex: Knex): Promise<void> {
t.integer("lockoutThreshold").notNullable().defaultTo(3);
}
if (!hasLockoutDuration) {
t.integer("lockoutDuration").notNullable().defaultTo(300); // 5 minutes (in seconds)
t.integer("lockoutDurationSeconds").notNullable().defaultTo(300); // 5 minutes
}
if (!hasLockoutCounterReset) {
t.integer("lockoutCounterReset").notNullable().defaultTo(30); // 30 seconds
t.integer("lockoutCounterResetSeconds").notNullable().defaultTo(30); // 30 seconds
}
});
}
@@ -30,8 +33,11 @@ export async function down(knex: Knex): Promise<void> {
if (await knex.schema.hasTable(TableName.IdentityLdapAuth)) {
const hasLockoutEnabled = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutEnabled");
const hasLockoutThreshold = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutThreshold");
const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutDuration");
const hasLockoutCounterReset = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutCounterReset");
const hasLockoutDuration = await knex.schema.hasColumn(TableName.IdentityLdapAuth, "lockoutDurationSeconds");
const hasLockoutCounterReset = await knex.schema.hasColumn(
TableName.IdentityLdapAuth,
"lockoutCounterResetSeconds"
);
await knex.schema.alterTable(TableName.IdentityLdapAuth, (t) => {
if (hasLockoutEnabled) {
@@ -41,10 +47,10 @@ export async function down(knex: Knex): Promise<void> {
t.dropColumn("lockoutThreshold");
}
if (hasLockoutDuration) {
t.dropColumn("lockoutDuration");
t.dropColumn("lockoutDurationSeconds");
}
if (hasLockoutCounterReset) {
t.dropColumn("lockoutCounterReset");
t.dropColumn("lockoutCounterResetSeconds");
}
});
}
backend/src/db/schemas/identity-ldap-auths.ts
+2 -2
View File
@@ -29,8 +29,8 @@ export const IdentityLdapAuthsSchema = z.object({
templateId: z.string().uuid().nullable().optional(),
lockoutEnabled: z.boolean().default(true),
lockoutThreshold: z.number().default(3),
lockoutDuration: z.number().default(300),
lockoutCounterReset: z.number().default(30)
lockoutDurationSeconds: z.number().default(300),
lockoutCounterResetSeconds: z.number().default(30)
});
export type TIdentityLdapAuths = z.infer<typeof IdentityLdapAuthsSchema>;
backend/src/ee/services/audit-log/audit-log-types.ts
+4 -4
View File
@@ -1372,8 +1372,8 @@ interface AddIdentityLdapAuthEvent {
templateId?: string | null;
lockoutEnabled: boolean;
lockoutThreshold: number;
lockoutDuration: number;
lockoutCounterReset: number;
lockoutDurationSeconds: number;
lockoutCounterResetSeconds: number;
};
}
@@ -1390,8 +1390,8 @@ interface UpdateIdentityLdapAuthEvent {
templateId?: string | null;
lockoutEnabled?: boolean;
lockoutThreshold?: number;
lockoutDuration?: number;
lockoutCounterReset?: number;
lockoutDurationSeconds?: number;
lockoutCounterResetSeconds?: number;
};
}
backend/src/lib/api-docs/constants.ts
+6 -4
View File
@@ -245,8 +245,9 @@ export const LDAP_AUTH = {
accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
lockoutEnabled: "Whether the lockout feature is enabled.",
lockoutThreshold: "The amount of times login must fail before locking the identity auth method.",
lockoutDuration: "How long an identity auth method lockout lasts.",
lockoutCounterReset: "How long to wait from the most recent failed login until resetting the lockout counter."
lockoutDurationSeconds: "How long an identity auth method lockout lasts.",
lockoutCounterResetSeconds:
"How long to wait from the most recent failed login until resetting the lockout counter."
},
UPDATE: {
identityId: "The ID of the identity to update the configuration for.",
@@ -264,8 +265,9 @@ export const LDAP_AUTH = {
templateId: "The ID of the identity auth template to update the configuration to.",
lockoutEnabled: "Whether the lockout feature is enabled.",
lockoutThreshold: "The amount of times login must fail before locking the identity auth method.",
lockoutDuration: "How long an identity auth method lockout lasts.",
lockoutCounterReset: "How long to wait from the most recent failed login until resetting the lockout counter."
lockoutDurationSeconds: "How long an identity auth method lockout lasts.",
lockoutCounterResetSeconds:
"How long to wait from the most recent failed login until resetting the lockout counter."
},
RETRIEVE: {
identityId: "The ID of the identity to retrieve the configuration for."
backend/src/server/routes/v1/identity-ldap-auth-router.ts
+40 -10
View File
@@ -266,8 +266,18 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
.describe(LDAP_AUTH.ATTACH.accessTokenNumUsesLimit),
lockoutEnabled: z.boolean().default(true).describe(LDAP_AUTH.ATTACH.lockoutEnabled),
lockoutThreshold: z.number().min(1).max(30).default(3).describe(LDAP_AUTH.ATTACH.lockoutThreshold),
lockoutDuration: z.number().min(30).max(86400).default(300).describe(LDAP_AUTH.ATTACH.lockoutDuration),
lockoutCounterReset: z.number().min(5).max(3600).default(30).describe(LDAP_AUTH.ATTACH.lockoutCounterReset)
lockoutDurationSeconds: z
.number()
.min(30)
.max(86400)
.default(300)
.describe(LDAP_AUTH.ATTACH.lockoutDurationSeconds),
lockoutCounterResetSeconds: z
.number()
.min(5)
.max(3600)
.default(30)
.describe(LDAP_AUTH.ATTACH.lockoutCounterResetSeconds)
})
.refine(
(val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
@@ -320,8 +330,18 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
.describe(LDAP_AUTH.ATTACH.accessTokenNumUsesLimit),
lockoutEnabled: z.boolean().default(true).describe(LDAP_AUTH.ATTACH.lockoutEnabled),
lockoutThreshold: z.number().min(1).max(30).default(3).describe(LDAP_AUTH.ATTACH.lockoutThreshold),
lockoutDuration: z.number().min(30).max(86400).default(300).describe(LDAP_AUTH.ATTACH.lockoutDuration),
lockoutCounterReset: z.number().min(5).max(3600).default(30).describe(LDAP_AUTH.ATTACH.lockoutCounterReset)
lockoutDurationSeconds: z
.number()
.min(30)
.max(86400)
.default(300)
.describe(LDAP_AUTH.ATTACH.lockoutDurationSeconds),
lockoutCounterResetSeconds: z
.number()
.min(5)
.max(3600)
.default(30)
.describe(LDAP_AUTH.ATTACH.lockoutCounterResetSeconds)
})
.refine(
(val) => val.accessTokenTTL <= val.accessTokenMaxTTL,
@@ -364,8 +384,8 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
templateId: identityLdapAuth.templateId,
lockoutEnabled: identityLdapAuth.lockoutEnabled,
lockoutThreshold: identityLdapAuth.lockoutThreshold,
lockoutDuration: identityLdapAuth.lockoutDuration,
lockoutCounterReset: identityLdapAuth.lockoutCounterReset
lockoutDurationSeconds: identityLdapAuth.lockoutDurationSeconds,
lockoutCounterResetSeconds: identityLdapAuth.lockoutCounterResetSeconds
}
}
});
@@ -432,8 +452,18 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
.describe(LDAP_AUTH.UPDATE.accessTokenMaxTTL),
lockoutEnabled: z.boolean().optional().describe(LDAP_AUTH.UPDATE.lockoutEnabled),
lockoutThreshold: z.number().min(1).max(30).optional().describe(LDAP_AUTH.UPDATE.lockoutThreshold),
lockoutDuration: z.number().min(30).max(86400).optional().describe(LDAP_AUTH.UPDATE.lockoutDuration),
lockoutCounterReset: z.number().min(5).max(3600).optional().describe(LDAP_AUTH.UPDATE.lockoutCounterReset)
lockoutDurationSeconds: z
.number()
.min(30)
.max(86400)
.optional()
.describe(LDAP_AUTH.UPDATE.lockoutDurationSeconds),
lockoutCounterResetSeconds: z
.number()
.min(5)
.max(3600)
.optional()
.describe(LDAP_AUTH.UPDATE.lockoutCounterResetSeconds)
})
.refine(
(val) => (val.accessTokenMaxTTL && val.accessTokenTTL ? val.accessTokenTTL <= val.accessTokenMaxTTL : true),
@@ -475,8 +505,8 @@ export const registerIdentityLdapAuthRouter = async (server: FastifyZodProvider)
templateId: identityLdapAuth.templateId,
lockoutEnabled: identityLdapAuth.lockoutEnabled,
lockoutThreshold: identityLdapAuth.lockoutThreshold,
lockoutDuration: identityLdapAuth.lockoutDuration,
lockoutCounterReset: identityLdapAuth.lockoutCounterReset
lockoutDurationSeconds: identityLdapAuth.lockoutDurationSeconds,
lockoutCounterResetSeconds: identityLdapAuth.lockoutCounterResetSeconds
}
}
});
backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
+9 -9
View File
@@ -223,8 +223,8 @@ export const identityLdapAuthServiceFactory = ({
allowedFields,
lockoutEnabled,
lockoutThreshold,
lockoutDuration,
lockoutCounterReset
lockoutDurationSeconds,
lockoutCounterResetSeconds
}: TAttachLdapAuthDTO) => {
await validateIdentityUpdateForSuperAdminPrivileges(identityId, isActorSuperAdmin);
@@ -360,8 +360,8 @@ export const identityLdapAuthServiceFactory = ({
templateId,
lockoutEnabled,
lockoutThreshold,
lockoutDuration,
lockoutCounterReset
lockoutDurationSeconds,
lockoutCounterResetSeconds
},
tx
);
@@ -390,8 +390,8 @@ export const identityLdapAuthServiceFactory = ({
actorOrgId,
lockoutEnabled,
lockoutThreshold,
lockoutDuration,
lockoutCounterReset
lockoutDurationSeconds,
lockoutCounterResetSeconds
}: TUpdateLdapAuthDTO) => {
const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
@@ -542,8 +542,8 @@ export const identityLdapAuthServiceFactory = ({
: undefined,
lockoutEnabled,
lockoutThreshold,
lockoutDuration,
lockoutCounterReset
lockoutDurationSeconds,
lockoutCounterResetSeconds
});
return { ...updatedLdapAuth, orgId: identityMembershipOrg.orgId };
@@ -687,7 +687,7 @@ export const identityLdapAuthServiceFactory = ({
await keyStore.setItemWithExpiry(
LOCKOUT_KEY,
lockout.lockedOut ? identityLdapAuth.lockoutDuration : identityLdapAuth.lockoutCounterReset,
lockout.lockedOut ? identityLdapAuth.lockoutDurationSeconds : identityLdapAuth.lockoutCounterResetSeconds,
JSON.stringify(lockout)
);
}
backend/src/services/identity-ldap-auth/identity-ldap-auth-types.ts
+4 -4
View File
@@ -29,8 +29,8 @@ export type TAttachLdapAuthDTO = {
isActorSuperAdmin?: boolean;
lockoutEnabled: boolean;
lockoutThreshold: number;
lockoutDuration: number;
lockoutCounterReset: number;
lockoutDurationSeconds: number;
lockoutCounterResetSeconds: number;
} & Omit<TProjectPermission, "projectId">;
export type TUpdateLdapAuthDTO = {
@@ -49,8 +49,8 @@ export type TUpdateLdapAuthDTO = {
accessTokenTrustedIps?: { ipAddress: string }[];
lockoutEnabled?: boolean;
lockoutThreshold?: number;
lockoutDuration?: number;
lockoutCounterReset?: number;
lockoutDurationSeconds?: number;
lockoutCounterResetSeconds?: number;
} & Omit<TProjectPermission, "projectId">;
export type TGetLdapAuthDTO = {