mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-12 03:29:18 +00:00
feat(secret-syncs): azure app config & key vault support
This commit is contained in:
Daniel Hougaard
@@ -849,7 +849,8 @@ export const registerRoutes = async (
|
||||
secretVersionTagDAL,
|
||||
secretVersionV2BridgeDAL,
|
||||
secretVersionTagV2BridgeDAL,
|
||||
resourceMetadataDAL
|
||||
resourceMetadataDAL,
|
||||
appConnectionDAL
|
||||
});
|
||||
|
||||
const secretQueueService = secretQueueFactory({
|
||||
|
||||
@@ -8,6 +8,7 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
|
||||
import { TAppConnection, TAppConnectionInput } from "@app/services/app-connection/app-connection-types";
|
||||
import { AzureResources } from "@app/services/app-connection/azure";
|
||||
import { AuthMode } from "@app/services/auth/auth-type";
|
||||
|
||||
export const registerAppConnectionEndpoints = <T extends TAppConnection, I extends TAppConnectionInput>({
|
||||
@@ -73,7 +74,14 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
|
||||
description: `List the ${appName} Connections the current user has permission to establish connections with.`,
|
||||
response: {
|
||||
200: z.object({
|
||||
appConnections: z.object({ app: z.literal(app), name: z.string(), id: z.string().uuid() }).array()
|
||||
appConnections: z
|
||||
.object({
|
||||
app: z.literal(app),
|
||||
name: z.string(),
|
||||
id: z.string().uuid(),
|
||||
azureResource: z.nativeEnum(AzureResources).optional()
|
||||
})
|
||||
.array()
|
||||
})
|
||||
}
|
||||
},
|
||||
|
||||
@@ -4,6 +4,7 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
|
||||
import { readLimit } from "@app/server/config/rateLimiter";
|
||||
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
|
||||
import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
|
||||
import { AzureConnectionListItemSchema, SanitizedAzureConnectionSchema } from "@app/services/app-connection/azure";
|
||||
import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
|
||||
import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
|
||||
import { AuthMode } from "@app/services/auth/auth-type";
|
||||
@@ -12,13 +13,15 @@ import { AuthMode } from "@app/services/auth/auth-type";
|
||||
const SanitizedAppConnectionSchema = z.union([
|
||||
...SanitizedAwsConnectionSchema.options,
|
||||
...SanitizedGitHubConnectionSchema.options,
|
||||
...SanitizedGcpConnectionSchema.options
|
||||
...SanitizedGcpConnectionSchema.options,
|
||||
...SanitizedAzureConnectionSchema.options
|
||||
]);
|
||||
|
||||
const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
|
||||
AwsConnectionListItemSchema,
|
||||
GitHubConnectionListItemSchema,
|
||||
GcpConnectionListItemSchema
|
||||
GcpConnectionListItemSchema,
|
||||
AzureConnectionListItemSchema
|
||||
]);
|
||||
|
||||
export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {
|
||||
|
||||
@@ -0,0 +1,20 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import {
|
||||
CreateAzureConnectionSchema,
|
||||
SanitizedAzureConnectionSchema,
|
||||
UpdateAzureConnectionSchema
|
||||
} from "@app/services/app-connection/azure";
|
||||
|
||||
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
|
||||
|
||||
export const registerAzureConnectionRouter = async (server: FastifyZodProvider) => {
|
||||
registerAppConnectionEndpoints({
|
||||
app: AppConnection.Azure,
|
||||
server,
|
||||
sanitizedResponseSchema: SanitizedAzureConnectionSchema,
|
||||
createSchema: CreateAzureConnectionSchema,
|
||||
updateSchema: UpdateAzureConnectionSchema
|
||||
});
|
||||
|
||||
// The below endpoints are not exposed and for Infisical App use
|
||||
};
|
||||
@@ -1,6 +1,7 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
|
||||
import { registerAwsConnectionRouter } from "./aws-connection-router";
|
||||
import { registerAzureConnectionRouter } from "./azure-connection-router";
|
||||
import { registerGcpConnectionRouter } from "./gcp-connection-router";
|
||||
import { registerGitHubConnectionRouter } from "./github-connection-router";
|
||||
|
||||
@@ -10,5 +11,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
|
||||
{
|
||||
[AppConnection.AWS]: registerAwsConnectionRouter,
|
||||
[AppConnection.GitHub]: registerGitHubConnectionRouter,
|
||||
[AppConnection.GCP]: registerGcpConnectionRouter
|
||||
[AppConnection.GCP]: registerGcpConnectionRouter,
|
||||
[AppConnection.Azure]: registerAzureConnectionRouter
|
||||
};
|
||||
|
||||
+17
@@ -0,0 +1,17 @@
|
||||
import {
|
||||
AzureAppConfigurationSyncSchema,
|
||||
CreateAzureAppConfigurationSyncSchema,
|
||||
UpdateAzureAppConfigurationSyncSchema
|
||||
} from "@app/services/secret-sync/azure-app-configuration";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
|
||||
import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
|
||||
|
||||
export const registerAzureAppConfigurationSyncRouter = async (server: FastifyZodProvider) =>
|
||||
registerSyncSecretsEndpoints({
|
||||
destination: SecretSync.AzureAppConfiguration,
|
||||
server,
|
||||
responseSchema: AzureAppConfigurationSyncSchema,
|
||||
createSchema: CreateAzureAppConfigurationSyncSchema,
|
||||
updateSchema: UpdateAzureAppConfigurationSyncSchema
|
||||
});
|
||||
@@ -0,0 +1,17 @@
|
||||
import {
|
||||
AzureKeyVaultSyncSchema,
|
||||
CreateAzureKeyVaultSyncSchema,
|
||||
UpdateAzureKeyVaultSyncSchema
|
||||
} from "@app/services/secret-sync/azure-key-vault";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
|
||||
import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
|
||||
|
||||
export const registerAzureKeyVaultSyncRouter = async (server: FastifyZodProvider) =>
|
||||
registerSyncSecretsEndpoints({
|
||||
destination: SecretSync.AzureKeyVault,
|
||||
server,
|
||||
responseSchema: AzureKeyVaultSyncSchema,
|
||||
createSchema: CreateAzureKeyVaultSyncSchema,
|
||||
updateSchema: UpdateAzureKeyVaultSyncSchema
|
||||
});
|
||||
@@ -2,6 +2,8 @@ import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
|
||||
import { registerAwsParameterStoreSyncRouter } from "./aws-parameter-store-sync-router";
|
||||
import { registerAwsSecretsManagerSyncRouter } from "./aws-secrets-manager-sync-router";
|
||||
import { registerAzureAppConfigurationSyncRouter } from "./azure-app-configuration-sync-router";
|
||||
import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
|
||||
import { registerGcpSyncRouter } from "./gcp-sync-router";
|
||||
import { registerGitHubSyncRouter } from "./github-sync-router";
|
||||
|
||||
@@ -11,5 +13,7 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
|
||||
[SecretSync.AWSParameterStore]: registerAwsParameterStoreSyncRouter,
|
||||
[SecretSync.AWSSecretsManager]: registerAwsSecretsManagerSyncRouter,
|
||||
[SecretSync.GitHub]: registerGitHubSyncRouter,
|
||||
[SecretSync.GCPSecretManager]: registerGcpSyncRouter
|
||||
[SecretSync.GCPSecretManager]: registerGcpSyncRouter,
|
||||
[SecretSync.AzureKeyVault]: registerAzureKeyVaultSyncRouter,
|
||||
[SecretSync.AzureAppConfiguration]: registerAzureAppConfigurationSyncRouter
|
||||
};
|
||||
|
||||
@@ -13,6 +13,11 @@ import {
|
||||
AwsSecretsManagerSyncListItemSchema,
|
||||
AwsSecretsManagerSyncSchema
|
||||
} from "@app/services/secret-sync/aws-secrets-manager";
|
||||
import {
|
||||
AzureAppConfigurationSyncListItemSchema,
|
||||
AzureAppConfigurationSyncSchema
|
||||
} from "@app/services/secret-sync/azure-app-configuration";
|
||||
import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/services/secret-sync/azure-key-vault";
|
||||
import { GcpSyncListItemSchema, GcpSyncSchema } from "@app/services/secret-sync/gcp";
|
||||
import { GitHubSyncListItemSchema, GitHubSyncSchema } from "@app/services/secret-sync/github";
|
||||
|
||||
@@ -20,14 +25,18 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
|
||||
AwsParameterStoreSyncSchema,
|
||||
AwsSecretsManagerSyncSchema,
|
||||
GitHubSyncSchema,
|
||||
GcpSyncSchema
|
||||
GcpSyncSchema,
|
||||
AzureKeyVaultSyncSchema,
|
||||
AzureAppConfigurationSyncSchema
|
||||
]);
|
||||
|
||||
const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
|
||||
AwsParameterStoreSyncListItemSchema,
|
||||
AwsSecretsManagerSyncListItemSchema,
|
||||
GitHubSyncListItemSchema,
|
||||
GcpSyncListItemSchema
|
||||
GcpSyncListItemSchema,
|
||||
AzureKeyVaultSyncListItemSchema,
|
||||
AzureAppConfigurationSyncListItemSchema
|
||||
]);
|
||||
|
||||
export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {
|
||||
|
||||
@@ -1,7 +1,8 @@
|
||||
export enum AppConnection {
|
||||
GitHub = "github",
|
||||
AWS = "aws",
|
||||
GCP = "gcp"
|
||||
GCP = "gcp",
|
||||
Azure = "azure"
|
||||
}
|
||||
|
||||
export enum AWSRegion {
|
||||
|
||||
@@ -20,10 +20,15 @@ import {
|
||||
} from "@app/services/app-connection/github";
|
||||
import { KmsDataKey } from "@app/services/kms/kms-types";
|
||||
|
||||
import { AzureConnectionMethod, getAzureConnectionListItem, validateAzureConnectionCredentials } from "./azure";
|
||||
|
||||
export const listAppConnectionOptions = () => {
|
||||
return [getAwsAppConnectionListItem(), getGitHubConnectionListItem(), getGcpAppConnectionListItem()].sort((a, b) =>
|
||||
a.name.localeCompare(b.name)
|
||||
);
|
||||
return [
|
||||
getAwsAppConnectionListItem(),
|
||||
getGitHubConnectionListItem(),
|
||||
getGcpAppConnectionListItem(),
|
||||
getAzureConnectionListItem()
|
||||
].sort((a, b) => a.name.localeCompare(b.name));
|
||||
};
|
||||
|
||||
export const encryptAppConnectionCredentials = async ({
|
||||
@@ -79,6 +84,8 @@ export const validateAppConnectionCredentials = async (
|
||||
return validateGitHubConnectionCredentials(appConnection);
|
||||
case AppConnection.GCP:
|
||||
return validateGcpConnectionCredentials(appConnection);
|
||||
case AppConnection.Azure:
|
||||
return validateAzureConnectionCredentials(appConnection);
|
||||
default:
|
||||
// eslint-disable-next-line @typescript-eslint/restrict-template-expressions
|
||||
throw new Error(`Unhandled App Connection ${app}`);
|
||||
@@ -89,6 +96,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
|
||||
switch (method) {
|
||||
case GitHubConnectionMethod.App:
|
||||
return "GitHub App";
|
||||
case AzureConnectionMethod.OAuth:
|
||||
case GitHubConnectionMethod.OAuth:
|
||||
return "OAuth";
|
||||
case AwsConnectionMethod.AccessKey:
|
||||
|
||||
@@ -3,5 +3,6 @@ import { AppConnection } from "./app-connection-enums";
|
||||
export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
|
||||
[AppConnection.AWS]: "AWS",
|
||||
[AppConnection.GitHub]: "GitHub",
|
||||
[AppConnection.GCP]: "GCP"
|
||||
[AppConnection.GCP]: "GCP",
|
||||
[AppConnection.Azure]: "Azure"
|
||||
};
|
||||
|
||||
@@ -27,7 +27,9 @@ import { ValidateGitHubConnectionCredentialsSchema } from "@app/services/app-con
|
||||
import { githubConnectionService } from "@app/services/app-connection/github/github-connection-service";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
|
||||
import { KmsDataKey } from "../kms/kms-types";
|
||||
import { TAppConnectionDALFactory } from "./app-connection-dal";
|
||||
import { AzureResources } from "./azure";
|
||||
import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
|
||||
import { gcpConnectionService } from "./gcp/gcp-connection-service";
|
||||
|
||||
@@ -42,7 +44,8 @@ export type TAppConnectionServiceFactory = ReturnType<typeof appConnectionServic
|
||||
const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAppConnectionCredentials> = {
|
||||
[AppConnection.AWS]: ValidateAwsConnectionCredentialsSchema,
|
||||
[AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
|
||||
[AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema
|
||||
[AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
|
||||
[AppConnection.Azure]: ValidateGcpConnectionCredentialsSchema
|
||||
};
|
||||
|
||||
export const appConnectionServiceFactory = ({
|
||||
@@ -347,7 +350,27 @@ export const appConnectionServiceFactory = ({
|
||||
)
|
||||
);
|
||||
|
||||
return availableConnections as Omit<TAppConnection, "credentials">[];
|
||||
const { decryptor } = await kmsService.createCipherPairWithDataKey({
|
||||
type: KmsDataKey.Organization,
|
||||
orgId: actor.orgId
|
||||
});
|
||||
|
||||
const decryptedConnections = availableConnections.map((connection) => {
|
||||
const decryptedPlainTextBlob = decryptor({
|
||||
cipherTextBlob: connection.encryptedCredentials
|
||||
});
|
||||
|
||||
const credentials = JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
|
||||
|
||||
return {
|
||||
...connection,
|
||||
...(app === AppConnection.Azure && {
|
||||
azureResource: (credentials as { resource: AzureResources }).resource
|
||||
})
|
||||
};
|
||||
});
|
||||
|
||||
return decryptedConnections as Omit<TAppConnection, "credentials">[];
|
||||
};
|
||||
|
||||
return {
|
||||
|
||||
@@ -11,11 +11,22 @@ import {
|
||||
TValidateGitHubConnectionCredentials
|
||||
} from "@app/services/app-connection/github";
|
||||
|
||||
import {
|
||||
TAzureConnection,
|
||||
TAzureConnectionConfig,
|
||||
TAzureConnectionInput,
|
||||
TValidateAzureConnectionCredentials
|
||||
} from "./azure";
|
||||
import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
|
||||
|
||||
export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection);
|
||||
export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection);
|
||||
|
||||
export type TAppConnectionInput = { id: string } & (TAwsConnectionInput | TGitHubConnectionInput | TGcpConnectionInput);
|
||||
export type TAppConnectionInput = { id: string } & (
|
||||
| TAwsConnectionInput
|
||||
| TGitHubConnectionInput
|
||||
| TGcpConnectionInput
|
||||
| TAzureConnectionInput
|
||||
);
|
||||
|
||||
export type TCreateAppConnectionDTO = Pick<
|
||||
TAppConnectionInput,
|
||||
@@ -26,9 +37,14 @@ export type TUpdateAppConnectionDTO = Partial<Omit<TCreateAppConnectionDTO, "met
|
||||
connectionId: string;
|
||||
};
|
||||
|
||||
export type TAppConnectionConfig = TAwsConnectionConfig | TGitHubConnectionConfig | TGcpConnectionConfig;
|
||||
export type TAppConnectionConfig =
|
||||
| TAwsConnectionConfig
|
||||
| TGitHubConnectionConfig
|
||||
| TGcpConnectionConfig
|
||||
| TAzureConnectionConfig;
|
||||
|
||||
export type TValidateAppConnectionCredentials =
|
||||
| TValidateAwsConnectionCredentials
|
||||
| TValidateGitHubConnectionCredentials
|
||||
| TValidateGcpConnectionCredentials;
|
||||
| TValidateGcpConnectionCredentials
|
||||
| TValidateAzureConnectionCredentials;
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
export enum AzureConnectionMethod {
|
||||
OAuth = "oauth"
|
||||
}
|
||||
|
||||
export enum AzureResources {
|
||||
KeyVault = "key-vault",
|
||||
AppConfiguration = "app-configuration"
|
||||
}
|
||||
@@ -0,0 +1,182 @@
|
||||
import { AxiosError, AxiosResponse } from "axios";
|
||||
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { BadRequestError, InternalServerError, NotFoundError } from "@app/lib/errors";
|
||||
import {
|
||||
decryptAppConnectionCredentials,
|
||||
encryptAppConnectionCredentials,
|
||||
getAppConnectionMethodName
|
||||
} from "@app/services/app-connection/app-connection-fns";
|
||||
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
|
||||
import { TAppConnectionDALFactory } from "../app-connection-dal";
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
|
||||
import { TAzureConnectionConfig, TAzureConnectionCredentials } from "./azure-connection-types";
|
||||
|
||||
const resourceScopes: Record<AzureResources, string> = {
|
||||
[AzureResources.AppConfiguration]: "https://azconfig.io/.default",
|
||||
[AzureResources.KeyVault]: "https://vault.azure.net/.default"
|
||||
};
|
||||
|
||||
export const getAzureConnectionAccessToken = async (
|
||||
connectionId: string,
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">,
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
|
||||
) => {
|
||||
const appCfg = getConfig();
|
||||
|
||||
const appConnection = await appConnectionDAL.findById(connectionId);
|
||||
|
||||
if (!appConnection) {
|
||||
throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
|
||||
}
|
||||
|
||||
if (appConnection.app !== AppConnection.Azure) {
|
||||
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure connection` });
|
||||
}
|
||||
|
||||
const credentials = (await decryptAppConnectionCredentials({
|
||||
orgId: appConnection.orgId,
|
||||
kmsService,
|
||||
encryptedCredentials: appConnection.encryptedCredentials
|
||||
})) as TAzureConnectionCredentials;
|
||||
|
||||
const { data } = await request.post<ExchangeCodeAzureResponse>(
|
||||
IntegrationUrls.AZURE_TOKEN_URL.replace("common", credentials.tenantId || "common"),
|
||||
new URLSearchParams({
|
||||
grant_type: "refresh_token",
|
||||
scope: `openid offline_access`,
|
||||
client_id: appCfg.CLIENT_ID_AZURE!,
|
||||
client_secret: appCfg.CLIENT_SECRET_AZURE!,
|
||||
refresh_token: credentials.refreshToken
|
||||
})
|
||||
);
|
||||
|
||||
const accessExpiresAt = new Date();
|
||||
accessExpiresAt.setSeconds(accessExpiresAt.getSeconds() + data.expires_in);
|
||||
|
||||
const updatedCredentials = {
|
||||
...credentials,
|
||||
accessToken: data.access_token,
|
||||
expiresAt: accessExpiresAt.getTime(),
|
||||
refreshToken: data.refresh_token
|
||||
};
|
||||
|
||||
const encryptedCredentials = await encryptAppConnectionCredentials({
|
||||
credentials: updatedCredentials,
|
||||
orgId: appConnection.orgId,
|
||||
kmsService
|
||||
});
|
||||
|
||||
await appConnectionDAL.update(
|
||||
{ id: connectionId },
|
||||
{
|
||||
encryptedCredentials
|
||||
}
|
||||
);
|
||||
|
||||
return {
|
||||
accessToken: data.access_token
|
||||
};
|
||||
};
|
||||
|
||||
export const getAzureConnectionListItem = () => {
|
||||
const { CLIENT_ID_AZURE } = getConfig();
|
||||
|
||||
return {
|
||||
name: "Azure" as const,
|
||||
app: AppConnection.Azure as const,
|
||||
methods: Object.values(AzureConnectionMethod) as [AzureConnectionMethod.OAuth],
|
||||
oauthClientId: CLIENT_ID_AZURE
|
||||
};
|
||||
};
|
||||
|
||||
type ExchangeCodeAzureResponse = {
|
||||
token_type: string;
|
||||
scope: string;
|
||||
expires_in: number;
|
||||
ext_expires_in: number;
|
||||
access_token: string;
|
||||
refresh_token: string;
|
||||
id_token: string;
|
||||
};
|
||||
|
||||
export const validateAzureConnectionCredentials = async (config: TAzureConnectionConfig) => {
|
||||
const { credentials: inputCredentials, method } = config;
|
||||
|
||||
const { CLIENT_ID_AZURE, CLIENT_SECRET_AZURE } = getConfig();
|
||||
|
||||
if (!CLIENT_ID_AZURE || !CLIENT_SECRET_AZURE) {
|
||||
throw new InternalServerError({
|
||||
message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
|
||||
});
|
||||
}
|
||||
|
||||
let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
|
||||
let tokenError: AxiosError | null = null;
|
||||
|
||||
try {
|
||||
const appCfg = getConfig();
|
||||
if (!appCfg.CLIENT_ID_AZURE || !appCfg.CLIENT_SECRET_AZURE) {
|
||||
throw new BadRequestError({ message: "Missing client id and client secret" });
|
||||
}
|
||||
|
||||
tokenResp = await request.post<ExchangeCodeAzureResponse>(
|
||||
IntegrationUrls.AZURE_TOKEN_URL.replace("common", inputCredentials.tenantId || "common"),
|
||||
new URLSearchParams({
|
||||
grant_type: "authorization_code",
|
||||
code: inputCredentials.code,
|
||||
scope: `openid offline_access ${resourceScopes[inputCredentials.resource]}`,
|
||||
client_id: appCfg.CLIENT_ID_AZURE,
|
||||
client_secret: appCfg.CLIENT_SECRET_AZURE,
|
||||
redirect_uri: `${appCfg.SITE_URL}/organization/app-connections/azure/oauth/callback`
|
||||
})
|
||||
);
|
||||
// TODO(daniel): handle token refreshing
|
||||
} catch (e: unknown) {
|
||||
if (e instanceof AxiosError) {
|
||||
tokenError = e;
|
||||
} else {
|
||||
throw new BadRequestError({
|
||||
message: `Unable to validate connection - verify credentials`
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (tokenError) {
|
||||
if (tokenError instanceof AxiosError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to get access token: ${
|
||||
(tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
|
||||
}`
|
||||
});
|
||||
} else {
|
||||
throw new InternalServerError({
|
||||
message: "Failed to get access token"
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (!tokenResp) {
|
||||
throw new InternalServerError({
|
||||
message: `Failed to get access token: Token was empty with no error`
|
||||
});
|
||||
}
|
||||
|
||||
switch (method) {
|
||||
case AzureConnectionMethod.OAuth:
|
||||
return {
|
||||
accessToken: tokenResp.data.access_token,
|
||||
refreshToken: tokenResp.data.refresh_token,
|
||||
expiresAt: Date.now() + tokenResp.data.expires_in * 1000,
|
||||
resource: inputCredentials.resource
|
||||
};
|
||||
default:
|
||||
throw new InternalServerError({
|
||||
message: `Unhandled Azure connection method: ${method as AzureConnectionMethod}`
|
||||
});
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,74 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { AppConnections } from "@app/lib/api-docs";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import {
|
||||
BaseAppConnectionSchema,
|
||||
GenericCreateAppConnectionFieldsSchema,
|
||||
GenericUpdateAppConnectionFieldsSchema
|
||||
} from "@app/services/app-connection/app-connection-schemas";
|
||||
|
||||
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
|
||||
|
||||
export const AzureConnectionOAuthInputCredentialsSchema = z.object({
|
||||
code: z.string().trim().min(1, "OAuth code required"),
|
||||
tenantId: z.string().trim().optional(),
|
||||
resource: z.nativeEnum(AzureResources)
|
||||
});
|
||||
|
||||
export const AzureConnectionOAuthOutputCredentialsSchema = z.object({
|
||||
tenantId: z.string().optional(),
|
||||
accessToken: z.string(),
|
||||
refreshToken: z.string(),
|
||||
expiresAt: z.number(), // unix timestamp,
|
||||
resource: z.nativeEnum(AzureResources)
|
||||
});
|
||||
|
||||
export const ValidateAzureConnectionCredentialsSchema = z.discriminatedUnion("method", [
|
||||
z.object({
|
||||
method: z.literal(AzureConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.Azure).method),
|
||||
credentials: AzureConnectionOAuthInputCredentialsSchema.describe(
|
||||
AppConnections.CREATE(AppConnection.Azure).credentials
|
||||
)
|
||||
})
|
||||
]);
|
||||
|
||||
export const CreateAzureConnectionSchema = ValidateAzureConnectionCredentialsSchema.and(
|
||||
GenericCreateAppConnectionFieldsSchema(AppConnection.Azure)
|
||||
);
|
||||
|
||||
export const UpdateAzureConnectionSchema = z
|
||||
.object({
|
||||
credentials: AzureConnectionOAuthInputCredentialsSchema.optional().describe(
|
||||
AppConnections.UPDATE(AppConnection.Azure).credentials
|
||||
)
|
||||
})
|
||||
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Azure));
|
||||
|
||||
const BaseAzureConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Azure) });
|
||||
|
||||
export const AzureConnectionSchema = z.intersection(
|
||||
BaseAzureConnectionSchema,
|
||||
z.discriminatedUnion("method", [
|
||||
z.object({
|
||||
method: z.literal(AzureConnectionMethod.OAuth),
|
||||
credentials: AzureConnectionOAuthOutputCredentialsSchema
|
||||
})
|
||||
])
|
||||
);
|
||||
|
||||
export const SanitizedAzureConnectionSchema = z.discriminatedUnion("method", [
|
||||
BaseAzureConnectionSchema.extend({
|
||||
method: z.literal(AzureConnectionMethod.OAuth),
|
||||
credentials: AzureConnectionOAuthOutputCredentialsSchema.pick({
|
||||
resource: true
|
||||
})
|
||||
})
|
||||
]);
|
||||
|
||||
export const AzureConnectionListItemSchema = z.object({
|
||||
name: z.literal("Azure"),
|
||||
app: z.literal(AppConnection.Azure),
|
||||
methods: z.nativeEnum(AzureConnectionMethod).array(),
|
||||
oauthClientId: z.string().optional()
|
||||
});
|
||||
@@ -0,0 +1,35 @@
|
||||
import z from "zod";
|
||||
|
||||
import { DiscriminativePick } from "@app/lib/types";
|
||||
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import {
|
||||
AzureConnectionOAuthOutputCredentialsSchema,
|
||||
AzureConnectionSchema,
|
||||
CreateAzureConnectionSchema,
|
||||
ValidateAzureConnectionCredentialsSchema
|
||||
} from "./azure-connection-schemas";
|
||||
|
||||
export type TAzureConnection = z.infer<typeof AzureConnectionSchema>;
|
||||
|
||||
export type TAzureConnectionInput = z.infer<typeof CreateAzureConnectionSchema> & {
|
||||
app: AppConnection.Azure;
|
||||
};
|
||||
|
||||
export type TValidateAzureConnectionCredentials = typeof ValidateAzureConnectionCredentialsSchema;
|
||||
|
||||
export type TAzureConnectionConfig = DiscriminativePick<TAzureConnectionInput, "method" | "app" | "credentials"> & {
|
||||
orgId: string;
|
||||
};
|
||||
|
||||
export type ExchangeCodeAzureResponse = {
|
||||
token_type: string;
|
||||
scope: string;
|
||||
expires_in: number;
|
||||
ext_expires_in: number;
|
||||
access_token: string;
|
||||
refresh_token: string;
|
||||
id_token: string;
|
||||
};
|
||||
|
||||
export type TAzureConnectionCredentials = z.infer<typeof AzureConnectionOAuthOutputCredentialsSchema>;
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./azure-connection-enums";
|
||||
export * from "./azure-connection-fns";
|
||||
export * from "./azure-connection-schemas";
|
||||
export * from "./azure-connection-types";
|
||||
+10
@@ -0,0 +1,10 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
export const AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION: TSecretSyncListItem = {
|
||||
name: "Azure App Configuration",
|
||||
destination: SecretSync.AzureAppConfiguration,
|
||||
connection: AppConnection.Azure,
|
||||
canImportSecrets: false
|
||||
};
|
||||
+195
@@ -0,0 +1,195 @@
|
||||
/* eslint-disable no-await-in-loop */
|
||||
import https from "https";
|
||||
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { BadRequestError } from "@app/lib/errors";
|
||||
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
|
||||
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
|
||||
import { isAzureKeyVaultReference } from "@app/services/integration-auth/integration-sync-secret-fns";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { TAzureAppConfigurationSyncWithCredentials } from "./azure-app-configuration-sync-types";
|
||||
|
||||
type TAzureAppConfigurationSecretSyncFactoryDeps = {
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
};
|
||||
|
||||
interface AzureAppConfigKeyValue {
|
||||
key: string;
|
||||
value: string;
|
||||
}
|
||||
|
||||
export const azureAppConfigurationSecretSyncFactory = ({
|
||||
kmsService,
|
||||
appConnectionDAL
|
||||
}: TAzureAppConfigurationSecretSyncFactoryDeps) => {
|
||||
const $getCompleteAzureAppConfigValues = async (accessToken: string, baseURL: string, url: string) => {
|
||||
let result: AzureAppConfigKeyValue[] = [];
|
||||
let currentUrl = url;
|
||||
|
||||
while (currentUrl) {
|
||||
const res = await request.get<{ items: AzureAppConfigKeyValue[]; ["@nextLink"]: string }>(currentUrl, {
|
||||
baseURL,
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
},
|
||||
// we force IPV4 because docker setup fails with ipv6
|
||||
httpsAgent: new https.Agent({
|
||||
family: 4
|
||||
})
|
||||
});
|
||||
|
||||
result = result.concat(res.data.items);
|
||||
currentUrl = res.data?.["@nextLink"];
|
||||
}
|
||||
|
||||
return result;
|
||||
};
|
||||
|
||||
const $deleteAzureSecret = async (accessToken: string, configurationUrl: string, key: string, label?: string) => {
|
||||
await request.delete(`${configurationUrl}/kv/${key}?api-version=2023-11-01`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
},
|
||||
...(label &&
|
||||
label.length > 0 && {
|
||||
params: {
|
||||
label
|
||||
}
|
||||
}),
|
||||
httpsAgent: new https.Agent({
|
||||
family: 4
|
||||
})
|
||||
});
|
||||
};
|
||||
|
||||
const syncSecrets = async (secretSync: TAzureAppConfigurationSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
if (!secretSync.destinationConfig.configurationUrl.endsWith(".azconfig.io")) {
|
||||
throw new BadRequestError({
|
||||
message: "Invalid Azure App Configuration URL provided."
|
||||
});
|
||||
}
|
||||
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connectionId, appConnectionDAL, kmsService);
|
||||
|
||||
const azureAppConfigValuesUrl = `/kv?api-version=2023-11-01${
|
||||
secretSync.destinationConfig.label ? `&label=${secretSync.destinationConfig.label}` : "&label=%00"
|
||||
}`;
|
||||
|
||||
const azureAppConfigSecrets = Object.fromEntries(
|
||||
(
|
||||
await $getCompleteAzureAppConfigValues(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.configurationUrl,
|
||||
azureAppConfigValuesUrl
|
||||
)
|
||||
).map((entry) => [entry.key, entry.value])
|
||||
);
|
||||
|
||||
// add the secrets to azure app config, that are in infisical
|
||||
for await (const key of Object.keys(secretMap)) {
|
||||
if (!(key in azureAppConfigSecrets) || secretMap[key]?.value !== azureAppConfigSecrets[key]) {
|
||||
await request.put(
|
||||
`${secretSync.destinationConfig.configurationUrl}/kv/${key}?api-version=2023-11-01`,
|
||||
{
|
||||
value: secretMap[key]?.value,
|
||||
...(isAzureKeyVaultReference(secretMap[key]?.value || "") && {
|
||||
content_type: "application/vnd.microsoft.appconfig.keyvaultref+json;charset=utf-8"
|
||||
})
|
||||
},
|
||||
{
|
||||
...(secretSync.destinationConfig.label && {
|
||||
params: {
|
||||
label: secretSync.destinationConfig.label
|
||||
}
|
||||
}),
|
||||
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
},
|
||||
httpsAgent: new https.Agent({
|
||||
family: 4
|
||||
})
|
||||
}
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
// delete the secrets that are in azure app config, but not in infisical
|
||||
for await (const key of Object.keys(azureAppConfigSecrets)) {
|
||||
if (!(key in secretMap) || secretMap[key] === null) {
|
||||
await $deleteAzureSecret(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.configurationUrl,
|
||||
key,
|
||||
secretSync.destinationConfig.label
|
||||
);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const removeSecrets = async (secretSync: TAzureAppConfigurationSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connectionId, appConnectionDAL, kmsService);
|
||||
|
||||
const azureAppConfigValuesUrl = `/kv?api-version=2023-11-01${
|
||||
secretSync.destinationConfig.label ? `&label=${secretSync.destinationConfig.label}` : "&label=%00"
|
||||
}`;
|
||||
|
||||
const azureAppConfigSecrets = Object.fromEntries(
|
||||
(
|
||||
await $getCompleteAzureAppConfigValues(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.configurationUrl,
|
||||
azureAppConfigValuesUrl
|
||||
)
|
||||
).map((entry) => [entry.key, entry.value])
|
||||
);
|
||||
|
||||
for await (const infisicalKey of Object.keys(secretMap)) {
|
||||
if (infisicalKey in azureAppConfigSecrets) {
|
||||
await $deleteAzureSecret(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.configurationUrl,
|
||||
infisicalKey,
|
||||
secretSync.destinationConfig.label
|
||||
);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const getSecrets = async (secretSync: TAzureAppConfigurationSyncWithCredentials) => {
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connectionId, appConnectionDAL, kmsService);
|
||||
|
||||
const secretMap: TSecretMap = {};
|
||||
|
||||
const azureAppConfigValuesUrl = `/kv?api-version=2023-11-01${
|
||||
secretSync.destinationConfig.label ? `&label=${secretSync.destinationConfig.label}` : "&label=%00"
|
||||
}`;
|
||||
|
||||
const azureAppConfigSecrets = Object.fromEntries(
|
||||
(
|
||||
await $getCompleteAzureAppConfigValues(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.configurationUrl,
|
||||
azureAppConfigValuesUrl
|
||||
)
|
||||
).map((entry) => [entry.key, entry.value])
|
||||
);
|
||||
|
||||
Object.keys(azureAppConfigSecrets).forEach((key) => {
|
||||
secretMap[key] = {
|
||||
value: azureAppConfigSecrets[key]
|
||||
};
|
||||
});
|
||||
|
||||
return secretMap;
|
||||
};
|
||||
|
||||
return {
|
||||
syncSecrets,
|
||||
removeSecrets,
|
||||
getSecrets
|
||||
};
|
||||
};
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import {
|
||||
BaseSecretSyncSchema,
|
||||
GenericCreateSecretSyncFieldsSchema,
|
||||
GenericUpdateSecretSyncFieldsSchema
|
||||
} from "@app/services/secret-sync/secret-sync-schemas";
|
||||
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
const AzureAppConfigurationSyncDestinationConfigSchema = z.object({
|
||||
configurationUrl: z.string().min(1, "App Configuration URL required"),
|
||||
label: z.string().optional()
|
||||
});
|
||||
|
||||
const AzureAppConfigurationSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
|
||||
|
||||
export const AzureAppConfigurationSyncSchema = BaseSecretSyncSchema(
|
||||
SecretSync.AzureAppConfiguration,
|
||||
AzureAppConfigurationSyncOptionsConfig
|
||||
).extend({
|
||||
destination: z.literal(SecretSync.AzureAppConfiguration),
|
||||
destinationConfig: AzureAppConfigurationSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const CreateAzureAppConfigurationSyncSchema = GenericCreateSecretSyncFieldsSchema(
|
||||
SecretSync.AzureAppConfiguration,
|
||||
AzureAppConfigurationSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: AzureAppConfigurationSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const UpdateAzureAppConfigurationSyncSchema = GenericUpdateSecretSyncFieldsSchema(
|
||||
SecretSync.AzureAppConfiguration,
|
||||
AzureAppConfigurationSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: AzureAppConfigurationSyncDestinationConfigSchema.optional()
|
||||
});
|
||||
|
||||
export const AzureAppConfigurationSyncListItemSchema = z.object({
|
||||
name: z.literal("Azure App Configuration"),
|
||||
connection: z.literal(AppConnection.Azure),
|
||||
destination: z.literal(SecretSync.AzureAppConfiguration),
|
||||
canImportSecrets: z.literal(false)
|
||||
});
|
||||
+19
@@ -0,0 +1,19 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { TAzureConnection } from "@app/services/app-connection/azure";
|
||||
|
||||
import {
|
||||
AzureAppConfigurationSyncListItemSchema,
|
||||
AzureAppConfigurationSyncSchema,
|
||||
CreateAzureAppConfigurationSyncSchema
|
||||
} from "./azure-app-configuration-sync-schemas";
|
||||
|
||||
export type TAzureAppConfigurationSync = z.infer<typeof AzureAppConfigurationSyncSchema>;
|
||||
|
||||
export type TAzureAppConfigurationSyncInput = z.infer<typeof CreateAzureAppConfigurationSyncSchema>;
|
||||
|
||||
export type TAzureAppConfigurationSyncListItem = z.infer<typeof AzureAppConfigurationSyncListItemSchema>;
|
||||
|
||||
export type TAzureAppConfigurationSyncWithCredentials = TAzureAppConfigurationSync & {
|
||||
connection: TAzureConnection;
|
||||
};
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./azure-app-configuration-sync-constants";
|
||||
export * from "./azure-app-configuration-sync-fns";
|
||||
export * from "./azure-app-configuration-sync-schemas";
|
||||
export * from "./azure-app-configuration-sync-types";
|
||||
@@ -0,0 +1,10 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
export const AZURE_KEY_VAULT_SYNC_LIST_OPTION: TSecretSyncListItem = {
|
||||
name: "Azure Key Vault",
|
||||
destination: SecretSync.AzureKeyVault,
|
||||
connection: AppConnection.Azure,
|
||||
canImportSecrets: false
|
||||
};
|
||||
@@ -0,0 +1,246 @@
|
||||
/* eslint-disable no-await-in-loop */
|
||||
import { AxiosError } from "axios";
|
||||
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
|
||||
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { GetAzureKeyVaultSecret, TAzureKeyVaultSyncWithCredentials } from "./azure-key-vault-sync-types";
|
||||
|
||||
type TAzureKeyVaultSecretSyncFactoryDeps = {
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
};
|
||||
|
||||
export const azureKeyVaultSecretSyncFactory = ({
|
||||
kmsService,
|
||||
appConnectionDAL
|
||||
}: TAzureKeyVaultSecretSyncFactoryDeps) => {
|
||||
const $getAzureKeyVaultSecrets = async (accessToken: string, vaultBaseUrl: string) => {
|
||||
const paginateAzureKeyVaultSecrets = async () => {
|
||||
let result: GetAzureKeyVaultSecret[] = [];
|
||||
|
||||
let currentUrl = `${vaultBaseUrl}/secrets?api-version=7.3`;
|
||||
|
||||
while (currentUrl) {
|
||||
const res = await request.get<{ value: GetAzureKeyVaultSecret; nextLink: string }>(currentUrl, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
});
|
||||
|
||||
result = result.concat(res.data.value);
|
||||
currentUrl = res.data.nextLink;
|
||||
}
|
||||
|
||||
return result;
|
||||
};
|
||||
|
||||
const getAzureKeyVaultSecrets = await paginateAzureKeyVaultSecrets();
|
||||
|
||||
const enabledAzureKeyVaultSecrets = getAzureKeyVaultSecrets.filter((secret) => secret.attributes.enabled);
|
||||
|
||||
// disabled keys to skip sending updates to
|
||||
const disabledAzureKeyVaultSecretKeys = getAzureKeyVaultSecrets
|
||||
.filter(({ attributes }) => !attributes.enabled)
|
||||
.map((getAzureKeyVaultSecret) => {
|
||||
return getAzureKeyVaultSecret.id.substring(getAzureKeyVaultSecret.id.lastIndexOf("/") + 1);
|
||||
});
|
||||
|
||||
let lastSlashIndex: number;
|
||||
const res = (
|
||||
await Promise.all(
|
||||
enabledAzureKeyVaultSecrets.map(async (getAzureKeyVaultSecret) => {
|
||||
if (!lastSlashIndex) {
|
||||
lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf("/");
|
||||
}
|
||||
|
||||
const azureKeyVaultSecret = await request.get<GetAzureKeyVaultSecret>(
|
||||
`${getAzureKeyVaultSecret.id}?api-version=7.3`,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
return {
|
||||
...azureKeyVaultSecret.data,
|
||||
key: getAzureKeyVaultSecret.id.substring(lastSlashIndex + 1)
|
||||
};
|
||||
})
|
||||
)
|
||||
).reduce(
|
||||
(obj, secret) => ({
|
||||
...obj,
|
||||
[secret.key]: secret
|
||||
}),
|
||||
{} as Record<string, GetAzureKeyVaultSecret>
|
||||
);
|
||||
|
||||
return {
|
||||
vaultSecrets: res,
|
||||
disabledAzureKeyVaultSecretKeys
|
||||
};
|
||||
};
|
||||
|
||||
const syncSecrets = async (secretSync: TAzureKeyVaultSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connection.id, appConnectionDAL, kmsService);
|
||||
|
||||
const { vaultSecrets, disabledAzureKeyVaultSecretKeys } = await $getAzureKeyVaultSecrets(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.vaultBaseUrl
|
||||
);
|
||||
|
||||
const setSecrets: {
|
||||
key: string;
|
||||
value: string;
|
||||
}[] = [];
|
||||
|
||||
const deleteSecrets: string[] = [];
|
||||
|
||||
Object.keys(secretMap).forEach((infisicalKey) => {
|
||||
const hyphenatedKey = infisicalKey.replace(/_/g, "-");
|
||||
if (!(hyphenatedKey in vaultSecrets)) {
|
||||
// case: secret has been created
|
||||
setSecrets.push({
|
||||
key: hyphenatedKey,
|
||||
value: secretMap[infisicalKey].value
|
||||
});
|
||||
} else if (secretMap[infisicalKey].value !== vaultSecrets[hyphenatedKey].value) {
|
||||
// case: secret has been updated
|
||||
setSecrets.push({
|
||||
key: hyphenatedKey,
|
||||
value: secretMap[infisicalKey].value
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
Object.keys(vaultSecrets).forEach((key) => {
|
||||
const underscoredKey = key.replace(/-/g, "_");
|
||||
if (!(underscoredKey in secretMap)) {
|
||||
deleteSecrets.push(key);
|
||||
}
|
||||
});
|
||||
|
||||
const setSecretAzureKeyVault = async ({ key, value }: { key: string; value: string }) => {
|
||||
let isSecretSet = false;
|
||||
let maxTries = 6;
|
||||
if (disabledAzureKeyVaultSecretKeys.includes(key)) return;
|
||||
|
||||
while (!isSecretSet && maxTries > 0) {
|
||||
// try to set secret
|
||||
try {
|
||||
await request.put(
|
||||
`${secretSync.destinationConfig.vaultBaseUrl}/secrets/${key}?api-version=7.3`,
|
||||
{
|
||||
value
|
||||
},
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
isSecretSet = true;
|
||||
} catch (err) {
|
||||
if (err instanceof AxiosError) {
|
||||
// eslint-disable-next-line
|
||||
if (err.response?.data?.error?.innererror?.code === "ObjectIsDeletedButRecoverable") {
|
||||
await request.post(
|
||||
`${secretSync.destinationConfig.vaultBaseUrl}/deletedsecrets/${key}/recover?api-version=7.3`,
|
||||
{},
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
await new Promise((resolve) => {
|
||||
setTimeout(resolve, 10_000);
|
||||
});
|
||||
} else {
|
||||
await new Promise((resolve) => {
|
||||
setTimeout(resolve, 10_000);
|
||||
});
|
||||
maxTries -= 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
for await (const setSecret of setSecrets) {
|
||||
const { key, value } = setSecret;
|
||||
await setSecretAzureKeyVault({
|
||||
key,
|
||||
value
|
||||
});
|
||||
}
|
||||
|
||||
for await (const deleteSecretKey of deleteSecrets.filter(
|
||||
(secret) => !setSecrets.find((setSecret) => setSecret.key === secret)
|
||||
)) {
|
||||
await request.delete(`${secretSync.destinationConfig.vaultBaseUrl}/secrets/${deleteSecretKey}?api-version=7.3`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const removeSecrets = async (secretSync: TAzureKeyVaultSyncWithCredentials, secretMap: TSecretMap) => {
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connection.id, appConnectionDAL, kmsService);
|
||||
|
||||
const { vaultSecrets, disabledAzureKeyVaultSecretKeys } = await $getAzureKeyVaultSecrets(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.vaultBaseUrl
|
||||
);
|
||||
|
||||
for await (const [key] of Object.entries(vaultSecrets)) {
|
||||
const underscoredKey = key.replace(/-/g, "_");
|
||||
|
||||
if (underscoredKey in secretMap) {
|
||||
if (!disabledAzureKeyVaultSecretKeys.includes(underscoredKey)) {
|
||||
await request.delete(`${secretSync.destinationConfig.vaultBaseUrl}/secrets/${key}?api-version=7.3`, {
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
const getSecrets = async (secretSync: TAzureKeyVaultSyncWithCredentials) => {
|
||||
const { accessToken } = await getAzureConnectionAccessToken(secretSync.connection.id, appConnectionDAL, kmsService);
|
||||
|
||||
const { vaultSecrets, disabledAzureKeyVaultSecretKeys } = await $getAzureKeyVaultSecrets(
|
||||
accessToken,
|
||||
secretSync.destinationConfig.vaultBaseUrl
|
||||
);
|
||||
|
||||
const secretMap: TSecretMap = {};
|
||||
|
||||
Object.keys(vaultSecrets).forEach((key) => {
|
||||
if (!disabledAzureKeyVaultSecretKeys.includes(key)) {
|
||||
const underscoredKey = key.replace(/-/g, "_");
|
||||
secretMap[underscoredKey] = {
|
||||
value: vaultSecrets[key].value
|
||||
};
|
||||
}
|
||||
});
|
||||
|
||||
return secretMap;
|
||||
};
|
||||
|
||||
return {
|
||||
syncSecrets,
|
||||
removeSecrets,
|
||||
getSecrets
|
||||
};
|
||||
};
|
||||
@@ -0,0 +1,45 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import {
|
||||
BaseSecretSyncSchema,
|
||||
GenericCreateSecretSyncFieldsSchema,
|
||||
GenericUpdateSecretSyncFieldsSchema
|
||||
} from "@app/services/secret-sync/secret-sync-schemas";
|
||||
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
const AzureKeyVaultSyncDestinationConfigSchema = z.object({
|
||||
vaultBaseUrl: z.string().min(1, "Vault base URL required")
|
||||
});
|
||||
|
||||
const AzureKeyVaultSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
|
||||
|
||||
export const AzureKeyVaultSyncSchema = BaseSecretSyncSchema(
|
||||
SecretSync.AzureKeyVault,
|
||||
AzureKeyVaultSyncOptionsConfig
|
||||
).extend({
|
||||
destination: z.literal(SecretSync.AzureKeyVault),
|
||||
destinationConfig: AzureKeyVaultSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const CreateAzureKeyVaultSyncSchema = GenericCreateSecretSyncFieldsSchema(
|
||||
SecretSync.AzureKeyVault,
|
||||
AzureKeyVaultSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: AzureKeyVaultSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const UpdateAzureKeyVaultSyncSchema = GenericUpdateSecretSyncFieldsSchema(
|
||||
SecretSync.AzureKeyVault,
|
||||
AzureKeyVaultSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: AzureKeyVaultSyncDestinationConfigSchema.optional()
|
||||
});
|
||||
|
||||
export const AzureKeyVaultSyncListItemSchema = z.object({
|
||||
name: z.literal("Azure Key Vault"),
|
||||
connection: z.literal(AppConnection.Azure),
|
||||
destination: z.literal(SecretSync.AzureKeyVault),
|
||||
canImportSecrets: z.literal(false)
|
||||
});
|
||||
@@ -0,0 +1,35 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { TAzureConnection } from "@app/services/app-connection/azure";
|
||||
|
||||
import {
|
||||
AzureKeyVaultSyncListItemSchema,
|
||||
AzureKeyVaultSyncSchema,
|
||||
CreateAzureKeyVaultSyncSchema
|
||||
} from "./azure-key-vault-sync-schemas";
|
||||
|
||||
export type TAzureKeyVaultSync = z.infer<typeof AzureKeyVaultSyncSchema>;
|
||||
|
||||
export type TAzureKeyVaultSyncInput = z.infer<typeof CreateAzureKeyVaultSyncSchema>;
|
||||
|
||||
export type TAzureKeyVaultSyncListItem = z.infer<typeof AzureKeyVaultSyncListItemSchema>;
|
||||
|
||||
export type TAzureKeyVaultSyncWithCredentials = TAzureKeyVaultSync & {
|
||||
connection: TAzureConnection;
|
||||
};
|
||||
|
||||
export interface GetAzureKeyVaultSecret {
|
||||
id: string; // secret URI
|
||||
value: string;
|
||||
attributes: {
|
||||
enabled: boolean;
|
||||
created: number;
|
||||
updated: number;
|
||||
recoveryLevel: string;
|
||||
recoverableDays: number;
|
||||
};
|
||||
}
|
||||
|
||||
export interface AzureKeyVaultSecret extends GetAzureKeyVaultSecret {
|
||||
key: string;
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./azure-key-vault-sync-constants";
|
||||
export * from "./azure-key-vault-sync-fns";
|
||||
export * from "./azure-key-vault-sync-schemas";
|
||||
export * from "./azure-key-vault-sync-types";
|
||||
@@ -2,7 +2,9 @@ export enum SecretSync {
|
||||
AWSParameterStore = "aws-parameter-store",
|
||||
AWSSecretsManager = "aws-secrets-manager",
|
||||
GitHub = "github",
|
||||
GCPSecretManager = "gcp-secret-manager"
|
||||
GCPSecretManager = "gcp-secret-manager",
|
||||
AzureKeyVault = "azure-key-vault",
|
||||
AzureAppConfiguration = "azure-app-configuration"
|
||||
}
|
||||
|
||||
export enum SecretSyncInitialSyncBehavior {
|
||||
|
||||
@@ -17,6 +17,13 @@ import {
|
||||
TSecretSyncWithCredentials
|
||||
} from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
|
||||
import { TKmsServiceFactory } from "../kms/kms-service";
|
||||
import {
|
||||
AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION,
|
||||
azureAppConfigurationSecretSyncFactory
|
||||
} from "./azure-app-configuration";
|
||||
import { AZURE_KEY_VAULT_SYNC_LIST_OPTION, azureKeyVaultSecretSyncFactory } from "./azure-key-vault";
|
||||
import { GCP_SYNC_LIST_OPTION } from "./gcp";
|
||||
import { GcpSyncFns } from "./gcp/gcp-sync-fns";
|
||||
|
||||
@@ -24,13 +31,20 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
|
||||
[SecretSync.AWSParameterStore]: AWS_PARAMETER_STORE_SYNC_LIST_OPTION,
|
||||
[SecretSync.AWSSecretsManager]: AWS_SECRETS_MANAGER_SYNC_LIST_OPTION,
|
||||
[SecretSync.GitHub]: GITHUB_SYNC_LIST_OPTION,
|
||||
[SecretSync.GCPSecretManager]: GCP_SYNC_LIST_OPTION
|
||||
[SecretSync.GCPSecretManager]: GCP_SYNC_LIST_OPTION,
|
||||
[SecretSync.AzureKeyVault]: AZURE_KEY_VAULT_SYNC_LIST_OPTION,
|
||||
[SecretSync.AzureAppConfiguration]: AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION
|
||||
};
|
||||
|
||||
export const listSecretSyncOptions = () => {
|
||||
return Object.values(SECRET_SYNC_LIST_OPTIONS).sort((a, b) => a.name.localeCompare(b.name));
|
||||
};
|
||||
|
||||
type TSyncSecretDeps = {
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
};
|
||||
|
||||
// const addAffixes = (secretSync: TSecretSyncWithCredentials, unprocessedSecretMap: TSecretMap) => {
|
||||
// let secretMap = { ...unprocessedSecretMap };
|
||||
//
|
||||
@@ -72,9 +86,23 @@ export const listSecretSyncOptions = () => {
|
||||
// };
|
||||
|
||||
export const SecretSyncFns = {
|
||||
syncSecrets: (secretSync: TSecretSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
|
||||
syncSecrets: (
|
||||
secretSync: TSecretSyncWithCredentials,
|
||||
secretMap: TSecretMap,
|
||||
{ kmsService, appConnectionDAL }: TSyncSecretDeps
|
||||
): Promise<void> => {
|
||||
// const affixedSecretMap = addAffixes(secretSync, secretMap);
|
||||
|
||||
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
switch (secretSync.destination) {
|
||||
case SecretSync.AWSParameterStore:
|
||||
return AwsParameterStoreSyncFns.syncSecrets(secretSync, secretMap);
|
||||
@@ -84,13 +112,25 @@ export const SecretSyncFns = {
|
||||
return GithubSyncFns.syncSecrets(secretSync, secretMap);
|
||||
case SecretSync.GCPSecretManager:
|
||||
return GcpSyncFns.syncSecrets(secretSync, secretMap);
|
||||
case SecretSync.AzureKeyVault:
|
||||
return azureKeyVaultSecretSync.syncSecrets(secretSync, secretMap);
|
||||
case SecretSync.AzureAppConfiguration:
|
||||
return azureAppConfigurationSecretSync.syncSecrets(secretSync, secretMap);
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
);
|
||||
}
|
||||
},
|
||||
getSecrets: async (secretSync: TSecretSyncWithCredentials): Promise<TSecretMap> => {
|
||||
getSecrets: async (
|
||||
secretSync: TSecretSyncWithCredentials,
|
||||
{ kmsService, appConnectionDAL }: TSyncSecretDeps
|
||||
): Promise<TSecretMap> => {
|
||||
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
let secretMap: TSecretMap;
|
||||
switch (secretSync.destination) {
|
||||
case SecretSync.AWSParameterStore:
|
||||
@@ -105,6 +145,10 @@ export const SecretSyncFns = {
|
||||
case SecretSync.GCPSecretManager:
|
||||
secretMap = await GcpSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
case SecretSync.AzureKeyVault:
|
||||
secretMap = await azureKeyVaultSecretSync.getSecrets(secretSync);
|
||||
break;
|
||||
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
@@ -114,9 +158,18 @@ export const SecretSyncFns = {
|
||||
return secretMap;
|
||||
// return stripAffixes(secretSync, secretMap);
|
||||
},
|
||||
removeSecrets: (secretSync: TSecretSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
|
||||
removeSecrets: (
|
||||
secretSync: TSecretSyncWithCredentials,
|
||||
secretMap: TSecretMap,
|
||||
{ kmsService, appConnectionDAL }: TSyncSecretDeps
|
||||
): Promise<void> => {
|
||||
// const affixedSecretMap = addAffixes(secretSync, secretMap);
|
||||
|
||||
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
switch (secretSync.destination) {
|
||||
case SecretSync.AWSParameterStore:
|
||||
return AwsParameterStoreSyncFns.removeSecrets(secretSync, secretMap);
|
||||
@@ -126,6 +179,8 @@ export const SecretSyncFns = {
|
||||
return GithubSyncFns.removeSecrets(secretSync, secretMap);
|
||||
case SecretSync.GCPSecretManager:
|
||||
return GcpSyncFns.removeSecrets(secretSync, secretMap);
|
||||
case SecretSync.AzureKeyVault:
|
||||
return azureKeyVaultSecretSync.removeSecrets(secretSync, secretMap);
|
||||
default:
|
||||
throw new Error(
|
||||
`Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
|
||||
|
||||
@@ -5,12 +5,16 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
|
||||
[SecretSync.AWSParameterStore]: "AWS Parameter Store",
|
||||
[SecretSync.AWSSecretsManager]: "AWS Secrets Manager",
|
||||
[SecretSync.GitHub]: "GitHub",
|
||||
[SecretSync.GCPSecretManager]: "GCP Secret Manager"
|
||||
[SecretSync.GCPSecretManager]: "GCP Secret Manager",
|
||||
[SecretSync.AzureKeyVault]: "Azure Key Vault",
|
||||
[SecretSync.AzureAppConfiguration]: "Azure App Configuration"
|
||||
};
|
||||
|
||||
export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
|
||||
[SecretSync.AWSParameterStore]: AppConnection.AWS,
|
||||
[SecretSync.AWSSecretsManager]: AppConnection.AWS,
|
||||
[SecretSync.GitHub]: AppConnection.GitHub,
|
||||
[SecretSync.GCPSecretManager]: AppConnection.GCP
|
||||
[SecretSync.GCPSecretManager]: AppConnection.GCP,
|
||||
[SecretSync.AzureKeyVault]: AppConnection.Azure,
|
||||
[SecretSync.AzureAppConfiguration]: AppConnection.Azure
|
||||
};
|
||||
|
||||
@@ -57,11 +57,14 @@ import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secre
|
||||
import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
|
||||
import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
|
||||
|
||||
import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
|
||||
|
||||
export type TSecretSyncQueueFactory = ReturnType<typeof secretSyncQueueFactory>;
|
||||
|
||||
type TSecretSyncQueueFactoryDep = {
|
||||
queueService: Pick<TQueueServiceFactory, "queue" | "start">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
|
||||
keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem">;
|
||||
folderDAL: TSecretFolderDALFactory;
|
||||
secretV2BridgeDAL: Pick<
|
||||
@@ -111,6 +114,7 @@ const getRequeueDelay = (failureCount?: number) => {
|
||||
export const secretSyncQueueFactory = ({
|
||||
queueService,
|
||||
kmsService,
|
||||
appConnectionDAL,
|
||||
keyStore,
|
||||
folderDAL,
|
||||
secretV2BridgeDAL,
|
||||
@@ -322,7 +326,10 @@ export const secretSyncQueueFactory = ({
|
||||
"Invalid Secret Sync source configuration: folder no longer exists. Please update source environment and secret path."
|
||||
);
|
||||
|
||||
const importedSecrets = await SecretSyncFns.getSecrets(secretSync);
|
||||
const importedSecrets = await SecretSyncFns.getSecrets(secretSync, {
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
if (!Object.keys(importedSecrets).length) return {};
|
||||
|
||||
@@ -434,7 +441,10 @@ export const secretSyncQueueFactory = ({
|
||||
});
|
||||
}
|
||||
|
||||
await SecretSyncFns.syncSecrets(secretSyncWithCredentials, secretMap);
|
||||
await SecretSyncFns.syncSecrets(secretSyncWithCredentials, secretMap, {
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
});
|
||||
|
||||
isSynced = true;
|
||||
} catch (err) {
|
||||
@@ -672,7 +682,11 @@ export const secretSyncQueueFactory = ({
|
||||
credentials
|
||||
}
|
||||
} as TSecretSyncWithCredentials,
|
||||
secretMap
|
||||
secretMap,
|
||||
{
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
}
|
||||
);
|
||||
|
||||
isSuccess = true;
|
||||
|
||||
@@ -23,27 +23,51 @@ import {
|
||||
TAwsParameterStoreSyncListItem,
|
||||
TAwsParameterStoreSyncWithCredentials
|
||||
} from "./aws-parameter-store";
|
||||
import {
|
||||
TAzureAppConfigurationSync,
|
||||
TAzureAppConfigurationSyncInput,
|
||||
TAzureAppConfigurationSyncListItem,
|
||||
TAzureAppConfigurationSyncWithCredentials
|
||||
} from "./azure-app-configuration";
|
||||
import {
|
||||
TAzureKeyVaultSync,
|
||||
TAzureKeyVaultSyncInput,
|
||||
TAzureKeyVaultSyncListItem,
|
||||
TAzureKeyVaultSyncWithCredentials
|
||||
} from "./azure-key-vault";
|
||||
import { TGcpSync, TGcpSyncInput, TGcpSyncListItem, TGcpSyncWithCredentials } from "./gcp";
|
||||
|
||||
export type TSecretSync = TAwsParameterStoreSync | TAwsSecretsManagerSync | TGitHubSync | TGcpSync;
|
||||
export type TSecretSync =
|
||||
| TAwsParameterStoreSync
|
||||
| TAwsSecretsManagerSync
|
||||
| TGitHubSync
|
||||
| TGcpSync
|
||||
| TAzureKeyVaultSync
|
||||
| TAzureAppConfigurationSync;
|
||||
|
||||
export type TSecretSyncWithCredentials =
|
||||
| TAwsParameterStoreSyncWithCredentials
|
||||
| TAwsSecretsManagerSyncWithCredentials
|
||||
| TGitHubSyncWithCredentials
|
||||
| TGcpSyncWithCredentials;
|
||||
| TGcpSyncWithCredentials
|
||||
| TAzureKeyVaultSyncWithCredentials
|
||||
| TAzureAppConfigurationSyncWithCredentials;
|
||||
|
||||
export type TSecretSyncInput =
|
||||
| TAwsParameterStoreSyncInput
|
||||
| TAwsSecretsManagerSyncInput
|
||||
| TGitHubSyncInput
|
||||
| TGcpSyncInput;
|
||||
| TGcpSyncInput
|
||||
| TAzureKeyVaultSyncInput
|
||||
| TAzureAppConfigurationSyncInput;
|
||||
|
||||
export type TSecretSyncListItem =
|
||||
| TAwsParameterStoreSyncListItem
|
||||
| TAwsSecretsManagerSyncListItem
|
||||
| TGitHubSyncListItem
|
||||
| TGcpSyncListItem;
|
||||
| TGcpSyncListItem
|
||||
| TAzureKeyVaultSyncListItem
|
||||
| TAzureAppConfigurationSyncListItem;
|
||||
|
||||
export type TSyncOptionsConfig = {
|
||||
canImportSecrets: boolean;
|
||||
|
||||
Reference in New Issue
Block a user