awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated files on review changes

Browse Source
This commit is contained in:
=
2025-04-28 18:56:17 +05:30
parent a80520e425
commit 7b42f666f9
10 changed files with 42 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
backend/src/@types/fastify.d.ts vendored
View File

@@ -110,7 +110,7 @@ declare module "@fastify/request-context" {
};
};
identityPermissionMetadata?: Record<string, unknown>; // filled by permission service
assumedProjectRole?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
assumedPrivilegeDetails?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
}
}

8
backend/src/ee/routes/v1/assume-privilege-router.ts
View File

@@ -90,8 +90,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req, res) => {
const assumePrivilege = requestContext.get("assumedProjectRole");
if (req.auth.authMode === AuthMode.JWT && assumePrivilege) {
const assumedPrivilegeDetails = requestContext.get("assumedPrivilegeDetails");
if (req.auth.authMode === AuthMode.JWT && assumedPrivilegeDetails) {
const appCfg = getConfig();
void res.setCookie("infisical-project-assume-privileges", "", {
httpOnly: true,
@@ -110,8 +110,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id,
targetActorId: assumePrivilege.actorId,
targetActorType: assumePrivilege.actorType
targetActorId: assumedPrivilegeDetails.actorId,
targetActorType: assumedPrivilegeDetails.actorType
}
}
});

6
backend/src/ee/routes/v1/project-role-router.ts
View File

@@ -253,7 +253,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
})
.array()
}),
impersonation: z
assumedPrivilegeDetails: z
.object({
actorId: z.string(),
actorType: z.string(),
@@ -268,7 +268,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { permissions, membership, impersonation } = await server.services.projectRole.getUserPermission(
const { permissions, membership, assumedPrivilegeDetails } = await server.services.projectRole.getUserPermission(
req.permission.id,
req.params.projectId,
req.permission.authMethod,
@@ -279,7 +279,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
data: {
permissions,
membership,
impersonation
assumedPrivilegeDetails
}
};
}

12
backend/src/ee/services/permission/permission-service.ts
View File

@@ -560,15 +560,15 @@ export const permissionServiceFactory = ({
}: TGetProjectPermissionArg): Promise<TProjectPermissionRT<T>> => {
let actor = inputActor;
let actorId = inputActorId;
const assumedProjectRole = requestContext.get("assumedProjectRole");
const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails");
if (
assumedProjectRole &&
assumedPrivilegeDetailsCtx &&
actor === ActorType.USER &&
actorId === assumedProjectRole.requesterId &&
projectId === assumedProjectRole.projectId
actorId === assumedPrivilegeDetailsCtx.requesterId &&
projectId === assumedPrivilegeDetailsCtx.projectId
) {
actor = assumedProjectRole.actorType;
actorId = assumedProjectRole.actorId;
actor = assumedPrivilegeDetailsCtx.actorType;
actorId = assumedPrivilegeDetailsCtx.actorId;
}
switch (actor) {

2
backend/src/server/plugins/auth/inject-assume-privilege.ts
View File

@@ -13,7 +13,7 @@ export const injectAssumePrivilege = fp(async (server: FastifyZodProvider) => {
req.auth.tokenVersionId
);
if (decodedToken) {
requestContext.set("assumedProjectRole", decodedToken);
requestContext.set("assumedPrivilegeDetails", decodedToken);
}
}
} catch (error) {

32
backend/src/services/project-role/project-role-service.ts
View File

@@ -238,29 +238,31 @@ export const projectRoleServiceFactory = ({
// just to satisfy ts
if (!("roles" in membership)) throw new BadRequestError({ message: "Service token not allowed" });
const assumedProjectRole = requestContext.get("assumedProjectRole");
const isImpersonating = assumedProjectRole?.projectId === projectId;
const impersonation = isImpersonating
const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails");
const isAssumingPrivilege = assumedPrivilegeDetailsCtx?.projectId === projectId;
const assumedPrivilegeDetails = isAssumingPrivilege
? {
actorId: assumedProjectRole?.actorId,
actorType: assumedProjectRole?.actorType,
actorId: assumedPrivilegeDetailsCtx?.actorId,
actorType: assumedPrivilegeDetailsCtx?.actorType,
actorName: "",
actorEmail: ""
}
: undefined;
if (impersonation?.actorType === ActorType.IDENTITY) {
const identityDetails = await identityDAL.findById(impersonation.actorId);
if (!identityDetails) throw new NotFoundError({ message: `Identity with ID ${impersonation.actorId} not found` });
impersonation.actorName = identityDetails.name;
} else if (impersonation?.actorType === ActorType.USER) {
const userDetails = await userDAL.findById(impersonation?.actorId);
if (!userDetails) throw new NotFoundError({ message: `User with ID ${impersonation.actorId} not found` });
impersonation.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`;
impersonation.actorEmail = userDetails?.email || "";
if (assumedPrivilegeDetails?.actorType === ActorType.IDENTITY) {
const identityDetails = await identityDAL.findById(assumedPrivilegeDetails.actorId);
if (!identityDetails)
throw new NotFoundError({ message: `Identity with ID ${assumedPrivilegeDetails.actorId} not found` });
assumedPrivilegeDetails.actorName = identityDetails.name;
} else if (assumedPrivilegeDetails?.actorType === ActorType.USER) {
const userDetails = await userDAL.findById(assumedPrivilegeDetails?.actorId);
if (!userDetails)
throw new NotFoundError({ message: `User with ID ${assumedPrivilegeDetails.actorId} not found` });
assumedPrivilegeDetails.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`;
assumedPrivilegeDetails.actorEmail = userDetails?.email || "";
}
return { permissions: packRules(permission.rules), membership, impersonation };
return { permissions: packRules(permission.rules), membership, assumedPrivilegeDetails };
};
return { createRole, updateRole, deleteRole, listRoles, getUserPermission, getRoleBySlug };

6
frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx
View File

@@ -20,7 +20,7 @@ export const useProjectPermission = () => {
}
const {
data: { permission, membership, impersonation }
data: { permission, membership, assumedPrivilegeDetails }
} = useSuspenseQuery({
queryKey: roleQueryKeys.getUserProjectPermissions({ workspaceId: projectId }),
queryFn: () => fetchUserProjectPermissions({ workspaceId: projectId }),
@@ -30,7 +30,7 @@ export const useProjectPermission = () => {
const ability = evaluatePermissionsAbility(rule);
return {
permission: ability,
impersonation: data.impersonation,
assumedPrivilegeDetails: data.assumedPrivilegeDetails,
membership: {
...data.membership,
roles: data.membership.roles.map(({ role }) => role)
@@ -44,5 +44,5 @@ export const useProjectPermission = () => {
[]
);
return { permission, membership, hasProjectRole, impersonation };
return { permission, membership, hasProjectRole, assumedPrivilegeDetails };
};

2
frontend/src/hooks/api/roles/queries.tsx
View File

@@ -138,7 +138,7 @@ export const fetchUserProjectPermissions = async ({
data: {
permissions: PackRule<RawRuleOf<MongoAbility<OrgPermissionSet>>>[];
membership: Omit<TProjectMembership, "roles"> & { roles: { role: string }[] };
impersonation?: {
assumedPrivilegeDetails?: {
actorId: string;
actorType: ActorType;
actorEmail: string;

4
frontend/src/layouts/ProjectLayout/ProjectLayout.tsx
View File

@@ -30,7 +30,7 @@ export const ProjectLayout = () => {
const breadcrumbs = matches && "breadcrumbs" in matches ? matches.breadcrumbs : undefined;
const { t } = useTranslation();
const { impersonation } = useProjectPermission();
const { assumedPrivilegeDetails } = useProjectPermission();
const workspaceId = currentWorkspace?.id || "";
const projectSlug = currentWorkspace?.slug || "";
@@ -64,7 +64,7 @@ export const ProjectLayout = () => {
return (
<>
<div className="dark hidden h-screen w-full flex-col overflow-x-hidden md:flex">
{impersonation && <AssumePrivilegeModeBanner />}
{assumedPrivilegeDetails && <AssumePrivilegeModeBanner />}
<div className="flex flex-grow flex-col overflow-y-hidden md:flex-row">
<motion.div
key="menu-project-items"

8
frontend/src/layouts/ProjectLayout/components/AssumePrivilegeModeBanner/AssumePrivilegeModeBanner.tsx
View File

@@ -9,9 +9,9 @@ import { ActorType } from "@app/hooks/api/auditLogs/enums";
export const AssumePrivilegeModeBanner = () => {
const { currentWorkspace } = useWorkspace();
const exitAssumePrivilegeMode = useRemoveAssumeProjectPrivilege();
const { impersonation } = useProjectPermission();
const { assumedPrivilegeDetails } = useProjectPermission();
if (!impersonation) return null;
if (!assumedPrivilegeDetails) return null;
return (
<div className="z-10 -mx-4 flex items-center justify-center gap-2 rounded border border-mineshaft-600 bg-primary-400 p-2 text-mineshaft-800 shadow">
@@ -19,8 +19,8 @@ export const AssumePrivilegeModeBanner = () => {
<FontAwesomeIcon icon={faInfoCircle} className="mr-2" />
You are currently viewing the project with privileges of{" "}
<b>
{impersonation?.actorType === ActorType.IDENTITY ? "identity" : "user"}{" "}
{impersonation?.actorName}
{assumedPrivilegeDetails?.actorType === ActorType.IDENTITY ? "identity" : "user"}{" "}
{assumedPrivilegeDetails?.actorName}
</b>
</div>
<div>