awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-06 15:27:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4460 from Infisical/fix/selectOrganizationAdminBypass

Browse Source 
Fix blocking issue for auth admin bypass on selectOrganization
This commit is contained in:
carlosmonastyrski
2025-09-02 22:09:57 -03:00
committed by GitHub
parent a4ff6340f8 e666409026
commit 65f0597bd8
1 changed files with 8 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/auth/auth-login-service.ts
+8 -7
View File
@@ -453,23 +453,24 @@ export const authLoginServiceFactory = ({
const selectedOrg = await orgDAL.findById(organizationId); const selectedOrg = await orgDAL.findById(organizationId);
if (!selectedOrgMembership) {
throw new ForbiddenRequestError({
message: `User does not have access to the organization named ${selectedOrg?.name}`
});
}
// Check if authEnforced is true and the current auth method is not an enforced method // Check if authEnforced is true and the current auth method is not an enforced method
if ( if (
selectedOrg.authEnforced && selectedOrg.authEnforced &&
!isAuthMethodSaml(decodedToken.authMethod) && !isAuthMethodSaml(decodedToken.authMethod) &&
decodedToken.authMethod !== AuthMethod.OIDC decodedToken.authMethod !== AuthMethod.OIDC &&
!(selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin)
) { ) {
throw new BadRequestError({ throw new BadRequestError({
message: "Login with the auth method required by your organization." message: "Login with the auth method required by your organization."
}); });
} }
if (!selectedOrgMembership) {
throw new ForbiddenRequestError({
message: `User does not have access to the organization named ${selectedOrg?.name}`
});
}
if (selectedOrg.googleSsoAuthEnforced && decodedToken.authMethod !== AuthMethod.GOOGLE) { if (selectedOrg.googleSsoAuthEnforced && decodedToken.authMethod !== AuthMethod.GOOGLE) {
const canBypass = selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin; const canBypass = selectedOrg.bypassOrgAuthEnabled && selectedOrgMembership.userRole === OrgMembershipRole.Admin;