mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-19 13:23:23 +00:00
Add Certificate Syncs
This commit is contained in:
Carlos Monastyrski
@@ -41,12 +41,12 @@ export const ConditionsFields = ({
|
||||
} = useFormContext<TFormSchema>();
|
||||
const items = useFieldArray({
|
||||
control,
|
||||
name: `permissions.${subject}.${position}.conditions`
|
||||
name: `permissions.${subject}.${position}.conditions` as const
|
||||
});
|
||||
|
||||
const conditionErrorMessage =
|
||||
errors?.permissions?.[subject]?.[position]?.conditions?.message ||
|
||||
errors?.permissions?.[subject]?.[position]?.conditions?.root?.message;
|
||||
(errors?.permissions as any)?.[subject]?.[position]?.conditions?.message ||
|
||||
(errors?.permissions as any)?.[subject]?.[position]?.conditions?.root?.message;
|
||||
|
||||
return (
|
||||
<div className="mt-6 border-t border-t-mineshaft-600 bg-mineshaft-800 pt-2">
|
||||
@@ -91,7 +91,7 @@ export const ConditionsFields = ({
|
||||
{Boolean(items.fields.length) &&
|
||||
items.fields.map((el, index) => {
|
||||
const condition =
|
||||
(watch(`permissions.${subject}.${position}.conditions.${index}`) as {
|
||||
(watch(`permissions.${subject}.${position}.conditions.${index}` as const) as {
|
||||
lhs: string;
|
||||
rhs: string;
|
||||
operator: string;
|
||||
@@ -104,7 +104,7 @@ export const ConditionsFields = ({
|
||||
<div className="w-1/4">
|
||||
<Controller
|
||||
control={control}
|
||||
name={`permissions.${subject}.${position}.conditions.${index}.lhs`}
|
||||
name={`permissions.${subject}.${position}.conditions.${index}.lhs` as const}
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
isError={Boolean(error?.message)}
|
||||
@@ -116,7 +116,7 @@ export const ConditionsFields = ({
|
||||
{...field}
|
||||
onValueChange={(e) => {
|
||||
setValue(
|
||||
`permissions.${subject}.${position}.conditions.${index}.operator`,
|
||||
`permissions.${subject}.${position}.conditions.${index}.operator` as const,
|
||||
PermissionConditionOperators.$IN as never
|
||||
);
|
||||
field.onChange(e);
|
||||
@@ -137,7 +137,9 @@ export const ConditionsFields = ({
|
||||
<div className="flex w-44 items-center space-x-2">
|
||||
<Controller
|
||||
control={control}
|
||||
name={`permissions.${subject}.${position}.conditions.${index}.operator`}
|
||||
name={
|
||||
`permissions.${subject}.${position}.conditions.${index}.operator` as const
|
||||
}
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
isError={Boolean(error?.message)}
|
||||
@@ -171,7 +173,7 @@ export const ConditionsFields = ({
|
||||
<div className="flex-grow">
|
||||
<Controller
|
||||
control={control}
|
||||
name={`permissions.${subject}.${position}.conditions.${index}.rhs`}
|
||||
name={`permissions.${subject}.${position}.conditions.${index}.rhs` as const}
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
isError={Boolean(error?.message)}
|
||||
|
||||
+2
-1
@@ -8,7 +8,8 @@ type Props = {
|
||||
type:
|
||||
| ProjectPermissionSub.SecretFolders
|
||||
| ProjectPermissionSub.SecretImports
|
||||
| ProjectPermissionSub.SecretRotation;
|
||||
| ProjectPermissionSub.SecretRotation
|
||||
| ProjectPermissionSub.PkiSyncs;
|
||||
};
|
||||
|
||||
export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }: Props) => {
|
||||
|
||||
+79
@@ -20,6 +20,7 @@ import {
|
||||
ProjectPermissionKmipActions,
|
||||
ProjectPermissionMemberActions,
|
||||
ProjectPermissionPkiSubscriberActions,
|
||||
ProjectPermissionPkiSyncActions,
|
||||
ProjectPermissionPkiTemplateActions,
|
||||
ProjectPermissionSecretActions,
|
||||
ProjectPermissionSecretEventActions,
|
||||
@@ -100,6 +101,16 @@ const SecretSyncPolicyActionSchema = z.object({
|
||||
[ProjectPermissionSecretSyncActions.RemoveSecrets]: z.boolean().optional()
|
||||
});
|
||||
|
||||
const PkiSyncPolicyActionSchema = z.object({
|
||||
[ProjectPermissionPkiSyncActions.Read]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.Create]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.Edit]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.Delete]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.SyncCertificates]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.ImportCertificates]: z.boolean().optional(),
|
||||
[ProjectPermissionPkiSyncActions.RemoveCertificates]: z.boolean().optional()
|
||||
});
|
||||
|
||||
const CommitPolicyActionSchema = z.object({
|
||||
[ProjectPermissionCommitsActions.Read]: z.boolean().optional(),
|
||||
[ProjectPermissionCommitsActions.PerformRollback]: z.boolean().optional()
|
||||
@@ -311,6 +322,12 @@ export const projectRoleFormSchema = z.object({
|
||||
})
|
||||
.array()
|
||||
.default([]),
|
||||
[ProjectPermissionSub.PkiSyncs]: PkiSyncPolicyActionSchema.extend({
|
||||
inverted: z.boolean().optional(),
|
||||
conditions: ConditionSchema
|
||||
})
|
||||
.array()
|
||||
.default([]),
|
||||
|
||||
[ProjectPermissionSub.Commits]: CommitPolicyActionSchema.array().default([]),
|
||||
[ProjectPermissionSub.Member]: MemberPolicyActionSchema.array().default([]),
|
||||
@@ -393,6 +410,7 @@ type TConditionalFields =
|
||||
| ProjectPermissionSub.SecretRotation
|
||||
| ProjectPermissionSub.Identity
|
||||
| ProjectPermissionSub.SecretSyncs
|
||||
| ProjectPermissionSub.PkiSyncs
|
||||
| ProjectPermissionSub.SecretEvents;
|
||||
|
||||
export const isConditionalSubjects = (
|
||||
@@ -408,6 +426,7 @@ export const isConditionalSubjects = (
|
||||
subject === ProjectPermissionSub.PkiSubscribers ||
|
||||
subject === ProjectPermissionSub.CertificateTemplates ||
|
||||
subject === ProjectPermissionSub.SecretSyncs ||
|
||||
subject === ProjectPermissionSub.PkiSyncs ||
|
||||
subject === ProjectPermissionSub.SecretEvents;
|
||||
|
||||
const convertCaslConditionToFormOperator = (caslConditions: TPermissionCondition) => {
|
||||
@@ -515,6 +534,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
|
||||
ProjectPermissionSub.SshCertificates,
|
||||
ProjectPermissionSub.SshHostGroups,
|
||||
ProjectPermissionSub.SecretSyncs,
|
||||
ProjectPermissionSub.PkiSyncs,
|
||||
ProjectPermissionSub.SecretEvents
|
||||
].includes(subject)
|
||||
) {
|
||||
@@ -576,6 +596,38 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
|
||||
return;
|
||||
}
|
||||
|
||||
if (subject === ProjectPermissionSub.PkiSyncs) {
|
||||
const canRead = action.includes(ProjectPermissionPkiSyncActions.Read);
|
||||
const canEdit = action.includes(ProjectPermissionPkiSyncActions.Edit);
|
||||
const canDelete = action.includes(ProjectPermissionPkiSyncActions.Delete);
|
||||
const canCreate = action.includes(ProjectPermissionPkiSyncActions.Create);
|
||||
const canSyncCertificates = action.includes(
|
||||
ProjectPermissionPkiSyncActions.SyncCertificates
|
||||
);
|
||||
const canImportCertificates = action.includes(
|
||||
ProjectPermissionPkiSyncActions.ImportCertificates
|
||||
);
|
||||
const canRemoveCertificates = action.includes(
|
||||
ProjectPermissionPkiSyncActions.RemoveCertificates
|
||||
);
|
||||
|
||||
if (!formVal[subject]) formVal[subject] = [{ conditions: [], inverted: false }];
|
||||
|
||||
// from above statement we are sure it won't be undefined
|
||||
formVal[subject]!.push({
|
||||
[ProjectPermissionPkiSyncActions.Read]: canRead,
|
||||
[ProjectPermissionPkiSyncActions.Create]: canCreate,
|
||||
[ProjectPermissionPkiSyncActions.Edit]: canEdit,
|
||||
[ProjectPermissionPkiSyncActions.Delete]: canDelete,
|
||||
[ProjectPermissionPkiSyncActions.SyncCertificates]: canSyncCertificates,
|
||||
[ProjectPermissionPkiSyncActions.ImportCertificates]: canImportCertificates,
|
||||
[ProjectPermissionPkiSyncActions.RemoveCertificates]: canRemoveCertificates,
|
||||
conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
|
||||
inverted
|
||||
});
|
||||
return;
|
||||
}
|
||||
|
||||
if (subject === ProjectPermissionSub.DynamicSecrets) {
|
||||
const canRead = action.includes(ProjectPermissionDynamicSecretActions.ReadRootCredential);
|
||||
const canEdit = action.includes(ProjectPermissionDynamicSecretActions.EditRootCredential);
|
||||
@@ -1493,6 +1545,24 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
|
||||
}
|
||||
]
|
||||
},
|
||||
[ProjectPermissionSub.PkiSyncs]: {
|
||||
title: "Certificate Syncs",
|
||||
actions: [
|
||||
{ label: "Read", value: ProjectPermissionPkiSyncActions.Read },
|
||||
{ label: "Create", value: ProjectPermissionPkiSyncActions.Create },
|
||||
{ label: "Modify", value: ProjectPermissionPkiSyncActions.Edit },
|
||||
{ label: "Remove", value: ProjectPermissionPkiSyncActions.Delete },
|
||||
{ label: "Trigger Syncs", value: ProjectPermissionPkiSyncActions.SyncCertificates },
|
||||
{
|
||||
label: "Import Certificates from Destination",
|
||||
value: ProjectPermissionPkiSyncActions.ImportCertificates
|
||||
},
|
||||
{
|
||||
label: "Remove Certificates from Destination",
|
||||
value: ProjectPermissionPkiSyncActions.RemoveCertificates
|
||||
}
|
||||
]
|
||||
},
|
||||
[ProjectPermissionSub.Kmip]: {
|
||||
title: "KMIP",
|
||||
actions: [
|
||||
@@ -1618,6 +1688,7 @@ const SecretsManagerPermissionSubjects = (enabled = false) => ({
|
||||
[ProjectPermissionSub.SecretApproval]: enabled,
|
||||
[ProjectPermissionSub.Integrations]: enabled,
|
||||
[ProjectPermissionSub.SecretSyncs]: enabled,
|
||||
[ProjectPermissionSub.PkiSyncs]: enabled,
|
||||
[ProjectPermissionSub.Kms]: enabled,
|
||||
[ProjectPermissionSub.Environments]: enabled,
|
||||
[ProjectPermissionSub.Tags]: enabled,
|
||||
@@ -2008,6 +2079,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
|
||||
subject: ProjectPermissionSub.SecretSyncs,
|
||||
actions: [ProjectPermissionSecretSyncActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiSyncs,
|
||||
actions: [ProjectPermissionPkiSyncActions.Read]
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Commits,
|
||||
actions: [ProjectPermissionCommitsActions.Read]
|
||||
@@ -2069,6 +2144,10 @@ export const RoleTemplates: Record<ProjectType, RoleTemplate[]> = {
|
||||
subject: ProjectPermissionSub.SecretSyncs,
|
||||
actions: Object.values(ProjectPermissionSecretSyncActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.PkiSyncs,
|
||||
actions: Object.values(ProjectPermissionPkiSyncActions)
|
||||
},
|
||||
{
|
||||
subject: ProjectPermissionSub.Commits,
|
||||
actions: Object.values(ProjectPermissionCommitsActions)
|
||||
|
||||
Reference in New Issue
Block a user