From 463eb0014e7a234e7c9bd2fabdd3812ee8e4daad Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Mon, 25 Nov 2024 20:17:50 +0400 Subject: [PATCH] fix(dynamic-secrets): renewal 500 error --- .../dynamic-secret/providers/aws-elasticache.ts | 2 +- .../services/dynamic-secret/providers/aws-iam.ts | 5 ++--- .../dynamic-secret/providers/azure-entra-id.ts | 10 +++++----- .../services/dynamic-secret/providers/cassandra.ts | 14 +++++++++----- .../dynamic-secret/providers/elastic-search.ts | 2 +- .../ee/services/dynamic-secret/providers/ldap.ts | 2 +- .../services/dynamic-secret/providers/mongo-db.ts | 1 + .../services/dynamic-secret/providers/rabbit-mq.ts | 2 +- .../ee/services/dynamic-secret/providers/redis.ts | 2 ++ .../services/dynamic-secret/providers/sap-hana.ts | 8 +++++--- .../services/dynamic-secret/providers/snowflake.ts | 9 ++++----- .../dynamic-secret/providers/sql-database.ts | 12 +++++++++--- .../ee/services/dynamic-secret/providers/totp.ts | 8 +++----- 13 files changed, 44 insertions(+), 33 deletions(-) diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts b/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts index 2cb862029..46360976d 100644 --- a/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts +++ b/backend/src/ee/services/dynamic-secret/providers/aws-elasticache.ts @@ -212,7 +212,7 @@ export const AwsElastiCacheDatabaseProvider = (): TDynamicProviderFns => { }; const renew = async (inputs: unknown, entityId: string) => { - // Do nothing + // No renewal necessary return { entityId }; }; diff --git a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts index 3feafa534..a1aa780f7 100644 --- a/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts +++ b/backend/src/ee/services/dynamic-secret/providers/aws-iam.ts @@ -179,9 +179,8 @@ export const AwsIamProvider = (): TDynamicProviderFns => { }; const renew = async (_inputs: unknown, entityId: string) => { - // do nothing - const username = entityId; - return { entityId: username }; + // No renewal necessary + return { entityId }; }; return { diff --git a/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts b/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts index e2dfe2d4b..88d333aad 100644 --- a/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts +++ b/backend/src/ee/services/dynamic-secret/providers/azure-entra-id.ts @@ -55,11 +55,6 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & { return data.success; }; - const renew = async (inputs: unknown, entityId: string) => { - // Do nothing - return { entityId }; - }; - const create = async (inputs: unknown) => { const providerInputs = await validateProviderInputs(inputs); const data = await getToken(providerInputs.tenantId, providerInputs.applicationId, providerInputs.clientSecret); @@ -127,6 +122,11 @@ export const AzureEntraIDProvider = (): TDynamicProviderFns & { return users; }; + const renew = async (inputs: unknown, entityId: string) => { + // No renewal necessary + return { entityId }; + }; + return { validateProviderInputs, validateConnection, diff --git a/backend/src/ee/services/dynamic-secret/providers/cassandra.ts b/backend/src/ee/services/dynamic-secret/providers/cassandra.ts index aea0b9c99..20e93e927 100644 --- a/backend/src/ee/services/dynamic-secret/providers/cassandra.ts +++ b/backend/src/ee/services/dynamic-secret/providers/cassandra.ts @@ -99,20 +99,24 @@ export const CassandraProvider = (): TDynamicProviderFns => { const renew = async (inputs: unknown, entityId: string, expireAt: number) => { const providerInputs = await validateProviderInputs(inputs); + if (!providerInputs.renewStatement) return { entityId }; + const client = await getClient(providerInputs); - const username = entityId; const expiration = new Date(expireAt).toISOString(); const { keyspace } = providerInputs; - const renewStatement = handlebars.compile(providerInputs.revocationStatement)({ username, keyspace, expiration }); + const renewStatement = handlebars.compile(providerInputs.renewStatement)({ + username: entityId, + keyspace, + expiration + }); const queries = renewStatement.toString().split(";").filter(Boolean); - for (const query of queries) { - // eslint-disable-next-line + for await (const query of queries) { await client.execute(query); } await client.shutdown(); - return { entityId: username }; + return { entityId }; }; return { diff --git a/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts b/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts index bfe0ac443..18881834d 100644 --- a/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts +++ b/backend/src/ee/services/dynamic-secret/providers/elastic-search.ts @@ -96,7 +96,7 @@ export const ElasticSearchProvider = (): TDynamicProviderFns => { }; const renew = async (inputs: unknown, entityId: string) => { - // Do nothing + // No renewal necessary return { entityId }; }; diff --git a/backend/src/ee/services/dynamic-secret/providers/ldap.ts b/backend/src/ee/services/dynamic-secret/providers/ldap.ts index f94e61629..fc1ef01d6 100644 --- a/backend/src/ee/services/dynamic-secret/providers/ldap.ts +++ b/backend/src/ee/services/dynamic-secret/providers/ldap.ts @@ -268,7 +268,7 @@ export const LdapProvider = (): TDynamicProviderFns => { }; const renew = async (inputs: unknown, entityId: string) => { - // Do nothing + // No renewal necessary return { entityId }; }; diff --git a/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts b/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts index b824f5aa8..a50af88bc 100644 --- a/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts +++ b/backend/src/ee/services/dynamic-secret/providers/mongo-db.ts @@ -88,6 +88,7 @@ export const MongoDBProvider = (): TDynamicProviderFns => { }; const renew = async (_inputs: unknown, entityId: string) => { + // No renewal necessary return { entityId }; }; diff --git a/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts b/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts index 00d3b538f..e78fa3725 100644 --- a/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts +++ b/backend/src/ee/services/dynamic-secret/providers/rabbit-mq.ts @@ -142,7 +142,7 @@ export const RabbitMqProvider = (): TDynamicProviderFns => { }; const renew = async (inputs: unknown, entityId: string) => { - // Do nothing + // No renewal necessary return { entityId }; }; diff --git a/backend/src/ee/services/dynamic-secret/providers/redis.ts b/backend/src/ee/services/dynamic-secret/providers/redis.ts index 0e7ae99a0..b08c5d421 100644 --- a/backend/src/ee/services/dynamic-secret/providers/redis.ts +++ b/backend/src/ee/services/dynamic-secret/providers/redis.ts @@ -141,6 +141,8 @@ export const RedisDatabaseProvider = (): TDynamicProviderFns => { const renew = async (inputs: unknown, entityId: string, expireAt: number) => { const providerInputs = await validateProviderInputs(inputs); + if (!providerInputs.renewStatement) return { entityId }; + const connection = await getClient(providerInputs); const username = entityId; diff --git a/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts b/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts index d120cf4fe..388994fb4 100644 --- a/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts +++ b/backend/src/ee/services/dynamic-secret/providers/sap-hana.ts @@ -135,13 +135,15 @@ export const SapHanaProvider = (): TDynamicProviderFns => { return { entityId: username }; }; - const renew = async (inputs: unknown, username: string, expireAt: number) => { + const renew = async (inputs: unknown, entityId: string, expireAt: number) => { const providerInputs = await validateProviderInputs(inputs); + if (!providerInputs.renewStatement) return { entityId }; + const client = await getClient(providerInputs); try { const expiration = new Date(expireAt).toISOString(); - const renewStatement = handlebars.compile(providerInputs.renewStatement)({ username, expiration }); + const renewStatement = handlebars.compile(providerInputs.renewStatement)({ username: entityId, expiration }); const queries = renewStatement.toString().split(";").filter(Boolean); for await (const query of queries) { await new Promise((resolve, reject) => { @@ -161,7 +163,7 @@ export const SapHanaProvider = (): TDynamicProviderFns => { client.disconnect(); } - return { entityId: username }; + return { entityId }; }; return { diff --git a/backend/src/ee/services/dynamic-secret/providers/snowflake.ts b/backend/src/ee/services/dynamic-secret/providers/snowflake.ts index 27ac3f49c..26e7a590a 100644 --- a/backend/src/ee/services/dynamic-secret/providers/snowflake.ts +++ b/backend/src/ee/services/dynamic-secret/providers/snowflake.ts @@ -131,17 +131,16 @@ export const SnowflakeProvider = (): TDynamicProviderFns => { return { entityId: username }; }; - const renew = async (inputs: unknown, username: string, expireAt: number) => { + const renew = async (inputs: unknown, entityId: string, expireAt: number) => { const providerInputs = await validateProviderInputs(inputs); - - if (!providerInputs.renewStatement) return { entityId: username }; + if (!providerInputs.renewStatement) return { entityId }; const client = await getClient(providerInputs); try { const expiration = getDaysToExpiry(new Date(expireAt)); const renewStatement = handlebars.compile(providerInputs.renewStatement)({ - username, + username: entityId, expiration }); @@ -161,7 +160,7 @@ export const SnowflakeProvider = (): TDynamicProviderFns => { client.destroy(noop); } - return { entityId: username }; + return { entityId }; }; return { diff --git a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts index 6acf23b06..511017586 100644 --- a/backend/src/ee/services/dynamic-secret/providers/sql-database.ts +++ b/backend/src/ee/services/dynamic-secret/providers/sql-database.ts @@ -110,13 +110,19 @@ export const SqlDatabaseProvider = (): TDynamicProviderFns => { const renew = async (inputs: unknown, entityId: string, expireAt: number) => { const providerInputs = await validateProviderInputs(inputs); + if (!providerInputs.renewStatement) return { entityId }; + const db = await getClient(providerInputs); - const username = entityId; const expiration = new Date(expireAt).toISOString(); const { database } = providerInputs; - const renewStatement = handlebars.compile(providerInputs.renewStatement)({ username, expiration, database }); + const renewStatement = handlebars.compile(providerInputs.renewStatement)({ + username: entityId, + expiration, + database + }); + if (renewStatement) { const queries = renewStatement.toString().split(";").filter(Boolean); await db.transaction(async (tx) => { @@ -128,7 +134,7 @@ export const SqlDatabaseProvider = (): TDynamicProviderFns => { } await db.destroy(); - return { entityId: username }; + return { entityId }; }; return { diff --git a/backend/src/ee/services/dynamic-secret/providers/totp.ts b/backend/src/ee/services/dynamic-secret/providers/totp.ts index 4e3ab6eb2..d16b82306 100644 --- a/backend/src/ee/services/dynamic-secret/providers/totp.ts +++ b/backend/src/ee/services/dynamic-secret/providers/totp.ts @@ -1,7 +1,6 @@ import { authenticator } from "otplib"; import { HashAlgorithms } from "otplib/core"; -import { BadRequestError } from "@app/lib/errors"; import { alphaNumericNanoId } from "@app/lib/nanoid"; import { DynamicSecretTotpSchema, TDynamicProviderFns, TotpConfigType } from "./models"; @@ -76,10 +75,9 @@ export const TotpProvider = (): TDynamicProviderFns => { }; // eslint-disable-next-line @typescript-eslint/no-unused-vars - const renew = async (_inputs: unknown, _entityId: string) => { - throw new BadRequestError({ - message: "Lease renewal is not supported for TOTPs" - }); + const renew = async (_inputs: unknown, entityId: string) => { + // No renewal necessary + return { entityId }; }; return {