awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 17:40:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update MI authz logic

Browse Source
This commit is contained in:
Tuan Dang
2023-11-27 14:19:10 +07:00
parent 99c41bb63b
commit 6579b3c93f
15 changed files with 49 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/controllers/v1/authController.ts
+1 -1
View File
@@ -26,7 +26,7 @@ declare module "jsonwebtoken" {
refreshVersion?: number;
}
export interface MachineRefreshTokenJwtPayload extends jwt.JwtPayload {
serviceTokenDataId: string;
_id: string;
authTokenType: string;
tokenVersion: number;
}
backend/src/controllers/v1/membershipController.ts
+2 -2
View File
@@ -4,7 +4,7 @@ import { IUser, Key, Membership, MembershipOrg, User, Workspace } from "../../mo
import { EventType, Role } from "../../ee/models";
import { deleteMembership as deleteMember, findMembership } from "../../helpers/membership";
import { sendMail } from "../../helpers/nodemailer";
import { ACCEPTED, ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
import { ACCEPTED, ADMIN, CUSTOM, MEMBER, NO_ACCESS, VIEWER } from "../../variables";
import { getSiteURL } from "../../config";
import { EEAuditLogService, EELicenseService } from "../../ee/services";
import { validateRequest } from "../../helpers/validation";
@@ -129,7 +129,7 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
ProjectPermissionSub.Member
);
const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
if (isCustomRole) {
const wsRole = await Role.findOne({
slug: role,
backend/src/controllers/v2/workspaceController.ts
+6 -6
View File
@@ -516,7 +516,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
body: {
role
}
} = await validateRequest(reqValidator.AddWorkspaceServiceMemberV2, req);
} = await validateRequest(reqValidator.AddMachineToWorkspaceV2, req);
const { permission } = await getAuthDataProjectPermissions({
authData: req.authData,
@@ -574,7 +574,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
role: customRole ? CUSTOM : role,
customRole
}).save();
return res.status(200).send({
machineMembership
});
@@ -592,7 +592,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
body: {
role
}
} = await validateRequest(reqValidator.AddWorkspaceServiceMemberV2, req);
} = await validateRequest(reqValidator.UpdateMachineWorkspaceRoleV2, req);
const { permission } = await getAuthDataProjectPermissions({
authData: req.authData,
@@ -650,7 +650,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
workspace: new Types.ObjectId(workspaceId),
},
{
role,
role: customRole ? CUSTOM : role,
customRole
},
{
@@ -672,7 +672,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
export const deleteMachineFromWorkspace = async (req: Request, res: Response) => {
const {
params: { workspaceId, machineId }
} = await validateRequest(reqValidator.DeleteWorkspaceServiceMemberV2, req);
} = await validateRequest(reqValidator.DeleteMachineFromWorkspaceV2, req);
const { permission } = await getAuthDataProjectPermissions({
authData: req.authData,
@@ -705,7 +705,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
export const getWorkspaceMachineMemberships = async (req: Request, res: Response) => {
const {
params: { workspaceId }
} = await validateRequest(reqValidator.GetWorkspaceServiceMembersV2, req);
} = await validateRequest(reqValidator.GetWorkspaceMachineMembersV2, req);
const { permission } = await getAuthDataProjectPermissions({
authData: req.authData,
backend/src/ee/controllers/v1/roleController.ts
+1 -1
View File
@@ -82,7 +82,7 @@ export const updateRole = async (req: Request, res: Response) => {
body: { name, description, slug, permissions, workspaceId, orgId }
} = await validateRequest(UpdateRoleSchema, req);
const isOrgRole = !workspaceId; // if workspaceid is provided then its a workspace rule
if (isOrgRole) {
const { permission } = await getUserOrgPermissions(req.user.id, orgId);
if (permission.cannot(OrgPermissionActions.Edit, OrgPermissionSubjects.Role)) {
backend/src/ee/controllers/v1/workspaceController.ts
+3 -3
View File
@@ -757,19 +757,19 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
}
}));
const serviceV3Actors: MachineActor[] = (
const machineActors: MachineActor[] = (
await MachineIdentity.find({
workspace: new Types.ObjectId(workspaceId)
})
).map((machineIdentity) => ({
type: ActorType.MACHINE,
metadata: {
serviceId: machineIdentity._id.toString(),
machineId: machineIdentity._id.toString(),
name: machineIdentity.name
}
}));
const actors = [...userActors, ...serviceActors, ...serviceV3Actors];
const actors = [...userActors, ...serviceActors, ...machineActors];
return res.status(200).send({
actors
backend/src/ee/controllers/v3/machineIdentityController.ts
+3 -3
View File
@@ -43,7 +43,7 @@ import { ForbiddenError } from "@casl/ability";
refreshToken
}
} = await validateRequest(reqValidator.RefreshTokenV3, req);
const decodedToken = <jwt.MachineRefreshTokenJwtPayload>(
jwt.verify(refreshToken, await getAuthSecret())
);
@@ -51,7 +51,7 @@ import { ForbiddenError } from "@casl/ability";
if (decodedToken.authTokenType !== AuthTokenType.MACHINE_REFRESH_TOKEN) throw UnauthorizedRequestError();
let machineIdentity = await MachineIdentity.findOne({
_id: new Types.ObjectId(decodedToken.serviceTokenDataId),
_id: new Types.ObjectId(decodedToken._id),
isActive: true
});
@@ -101,7 +101,7 @@ import { ForbiddenError } from "@casl/ability";
response.accessToken = createToken({
payload: {
_id: machineIdentity._id.toString(), // TODO: fix this
_id: machineIdentity._id.toString(),
authTokenType: AuthTokenType.MACHINE_ACCESS_TOKEN,
tokenVersion: machineIdentity.tokenVersion
},
backend/src/ee/services/ProjectRoleService.ts
+1
View File
@@ -332,6 +332,7 @@ export const getAuthDataProjectPermissions = async ({
role = machineMembership.role;
customRole = machineMembership.customRole;
break;
}
default:
backend/src/validation/workspace.ts
+13 -3
View File
@@ -280,7 +280,7 @@ export const ToggleAutoCapitalizationV2 = z.object({
})
});
export const AddWorkspaceServiceMemberV2 = z.object({
export const AddMachineToWorkspaceV2 = z.object({
params: z.object({
workspaceId: z.string().trim(),
machineId: z.string().trim()
@@ -290,14 +290,24 @@ export const AddWorkspaceServiceMemberV2 = z.object({
})
});
export const DeleteWorkspaceServiceMemberV2 = z.object({
export const UpdateMachineWorkspaceRoleV2 = z.object({
params: z.object({
workspaceId: z.string().trim(),
machineId: z.string().trim()
}),
body: z.object({
role: z.string().trim().min(1).default(NO_ACCESS),
})
});
export const DeleteMachineFromWorkspaceV2 = z.object({
params: z.object({
workspaceId: z.string().trim(),
machineId: z.string().trim()
})
});
export const GetWorkspaceServiceMembersV2 = z.object({
export const GetWorkspaceMachineMembersV2 = z.object({
params: z.object({
workspaceId: z.string().trim()
}),