awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2024-09-30 21:45:11 +04:00
parent 66485f0464
commit 7885a3b0ff
6 changed files with 24 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
View File

@@ -9,7 +9,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -81,7 +81,7 @@ export const identityAwsAuthServiceFactory = ({
.some((accountId) => accountId === Account);
if (!isAccountAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: AWS account ID not allowed."
});
}
@@ -100,7 +100,7 @@ export const identityAwsAuthServiceFactory = ({
});
if (!isArnAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: AWS principal ARN not allowed."
});
}

5
backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
View File

@@ -73,7 +73,7 @@ export const identityAzureAuthServiceFactory = ({
.map((servicePrincipalId) => servicePrincipalId.trim())
.some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
if (!isServicePrincipalAllowed) throw new ForbiddenRequestError({ message: "Service principal not allowed" });
if (!isServicePrincipalAllowed) throw new UnauthorizedError({ message: "Service principal not allowed" });
}
const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
@@ -314,8 +314,7 @@ export const identityAzureAuthServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke azure auth of identity with more privileged role"
});

9
backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
View File

@@ -86,7 +86,7 @@ export const identityGcpAuthServiceFactory = ({
.some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
if (!isServiceAccountAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP service account not allowed."
});
}
@@ -100,7 +100,7 @@ export const identityGcpAuthServiceFactory = ({
.some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
if (!isProjectAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP project not allowed."
});
}
@@ -112,7 +112,7 @@ export const identityGcpAuthServiceFactory = ({
.some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
if (!isZoneAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP zone not allowed."
});
}
@@ -359,8 +359,7 @@ export const identityGcpAuthServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke gcp auth of identity with more privileged role"
});

8
backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
View File

@@ -132,7 +132,7 @@ export const identityKubernetesAuthServiceFactory = ({
// check the response to determine if the token is valid
if (!(data.status && data.status.authenticated))
throw new ForbiddenRequestError({ message: "Kubernetes token not authenticated" });
throw new UnauthorizedError({ message: "Kubernetes token not authenticated" });
const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
@@ -145,7 +145,7 @@ export const identityKubernetesAuthServiceFactory = ({
.some((namespace) => namespace === targetNamespace);
if (!isNamespaceAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s namespace not allowed."
});
}
@@ -159,7 +159,7 @@ export const identityKubernetesAuthServiceFactory = ({
.some((name) => name === targetName);
if (!isNameAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s name not allowed."
});
}
@@ -171,7 +171,7 @@ export const identityKubernetesAuthServiceFactory = ({
);
if (!isAudienceAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s audience not allowed."
});
}

7
backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
View File

@@ -148,7 +148,7 @@ export const identityOidcAuthServiceFactory = ({
.split(", ")
.some((policyValue) => doesFieldValueMatchOidcPolicy(tokenData.aud, policyValue))
) {
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: OIDC audience not allowed."
});
}
@@ -161,7 +161,7 @@ export const identityOidcAuthServiceFactory = ({
if (
!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(tokenData[claimKey], claimEntry))
) {
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: OIDC claim not allowed."
});
}
@@ -532,8 +532,7 @@ export const identityOidcAuthServiceFactory = ({
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge) {
if (!isAtLeastAsPrivileged(permission, rolePermission)) {
throw new ForbiddenRequestError({
message: "Failed to revoke OIDC auth of identity with more privileged role"
});

18
backend/src/services/identity-ua/identity-ua-service.ts
View File

@@ -88,7 +88,7 @@ export const identityUaServiceFactory = ({
isClientSecretRevoked: true
});
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied due to expired client secret"
});
}
@@ -100,7 +100,7 @@ export const identityUaServiceFactory = ({
await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
isClientSecretRevoked: true
});
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied due to client secret usage limit reached"
});
}
@@ -368,8 +368,7 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke universal auth of identity with more privileged role"
});
@@ -474,8 +473,8 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to add identity to project with more privileged role"
});
@@ -521,8 +520,7 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to read identity client secret of project with more privileged role"
});
@@ -561,8 +559,8 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke identity client secret with more privileged role"
});