awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-10 20:28:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

Refine

Browse Source
This commit is contained in:
Fang-Pen Lin
2025-11-07 09:20:48 -08:00
parent 10054b3e4b
commit 708b8f9f65
1 changed files with 15 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/pki-acme/pki-acme-service.ts
+15 -12
View File
@@ -353,19 +353,22 @@ export const pkiAcmeServiceFactory = ({
kmsId: certificateManagerKmsId kmsId: certificateManagerKmsId
}); });
const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret! }); const eabSecret = await kmsDecryptor({ cipherTextBlob: profile.acmeConfig!.encryptedEabSecret! });
let eabPayload: Uint8Array<ArrayBufferLike> | undefined; const { eabPayload, eabProtectedHeader } = await (async () => {
let eabProtectedHeader: JWSHeaderParameters | undefined; try {
try { const { payload: eabPayload, protectedHeader: eabProtectedHeader } = await flattenedVerify(
const result = await flattenedVerify(externalAccountBinding, eabSecret); externalAccountBinding,
eabPayload = result.payload; eabSecret
eabProtectedHeader = result.protectedHeader; );
} catch (error) { return { eabPayload, eabProtectedHeader };
if (error instanceof errors.JWSInvalid) { } catch (error) {
throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" }); if (error instanceof errors.JWSInvalid) {
throw new AcmeMalformedError({ detail: "Invalid external account binding JWS payload" });
}
logger.error(error, "Unexpected error while verifying EAB JWS payload");
throw new AcmeServerInternalError({ detail: "Failed to verify EAB JWS payload" });
} }
logger.error(error, "Unexpected error while verifying EAB JWS payload"); })();
throw new AcmeServerInternalError({ detail: "Failed to verify EAB JWS payload" });
}
const { alg: eabAlg, kid: eabKid } = eabProtectedHeader!; const { alg: eabAlg, kid: eabKid } = eabProtectedHeader!;
if (!["HS256", "HS384", "HS512"].includes(eabAlg!)) { if (!["HS256", "HS384", "HS512"].includes(eabAlg!)) {
throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" }); throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" });