diff --git a/backend/src/@types/fastify.d.ts b/backend/src/@types/fastify.d.ts index 265a235a0..185463f81 100644 --- a/backend/src/@types/fastify.d.ts +++ b/backend/src/@types/fastify.d.ts @@ -110,7 +110,7 @@ declare module "@fastify/request-context" { }; }; identityPermissionMetadata?: Record; // filled by permission service - assumedProjectRole?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string }; + assumedPrivilegeDetails?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string }; } } diff --git a/backend/src/ee/routes/v1/assume-privilege-router.ts b/backend/src/ee/routes/v1/assume-privilege-router.ts index ab280a4ec..5ee5723fd 100644 --- a/backend/src/ee/routes/v1/assume-privilege-router.ts +++ b/backend/src/ee/routes/v1/assume-privilege-router.ts @@ -90,8 +90,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider) }, onRequest: verifyAuth([AuthMode.JWT]), handler: async (req, res) => { - const assumePrivilege = requestContext.get("assumedProjectRole"); - if (req.auth.authMode === AuthMode.JWT && assumePrivilege) { + const assumedPrivilegeDetails = requestContext.get("assumedPrivilegeDetails"); + if (req.auth.authMode === AuthMode.JWT && assumedPrivilegeDetails) { const appCfg = getConfig(); void res.setCookie("infisical-project-assume-privileges", "", { httpOnly: true, @@ -110,8 +110,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider) projectId: req.params.projectId, requesterEmail: req.auth.user.username, requesterId: req.auth.user.id, - targetActorId: assumePrivilege.actorId, - targetActorType: assumePrivilege.actorType + targetActorId: assumedPrivilegeDetails.actorId, + targetActorType: assumedPrivilegeDetails.actorType } } }); diff --git a/backend/src/ee/routes/v1/project-role-router.ts b/backend/src/ee/routes/v1/project-role-router.ts index c9dc09e47..949d4cf7e 100644 --- a/backend/src/ee/routes/v1/project-role-router.ts +++ b/backend/src/ee/routes/v1/project-role-router.ts @@ -253,7 +253,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { }) .array() }), - impersonation: z + assumedPrivilegeDetails: z .object({ actorId: z.string(), actorType: z.string(), @@ -268,7 +268,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT]), handler: async (req) => { - const { permissions, membership, impersonation } = await server.services.projectRole.getUserPermission( + const { permissions, membership, assumedPrivilegeDetails } = await server.services.projectRole.getUserPermission( req.permission.id, req.params.projectId, req.permission.authMethod, @@ -279,7 +279,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => { data: { permissions, membership, - impersonation + assumedPrivilegeDetails } }; } diff --git a/backend/src/ee/services/permission/permission-service.ts b/backend/src/ee/services/permission/permission-service.ts index 67d553d59..3d2f96f82 100644 --- a/backend/src/ee/services/permission/permission-service.ts +++ b/backend/src/ee/services/permission/permission-service.ts @@ -560,15 +560,15 @@ export const permissionServiceFactory = ({ }: TGetProjectPermissionArg): Promise> => { let actor = inputActor; let actorId = inputActorId; - const assumedProjectRole = requestContext.get("assumedProjectRole"); + const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails"); if ( - assumedProjectRole && + assumedPrivilegeDetailsCtx && actor === ActorType.USER && - actorId === assumedProjectRole.requesterId && - projectId === assumedProjectRole.projectId + actorId === assumedPrivilegeDetailsCtx.requesterId && + projectId === assumedPrivilegeDetailsCtx.projectId ) { - actor = assumedProjectRole.actorType; - actorId = assumedProjectRole.actorId; + actor = assumedPrivilegeDetailsCtx.actorType; + actorId = assumedPrivilegeDetailsCtx.actorId; } switch (actor) { diff --git a/backend/src/server/plugins/auth/inject-assume-privilege.ts b/backend/src/server/plugins/auth/inject-assume-privilege.ts index 99fca57c0..58eb5c99c 100644 --- a/backend/src/server/plugins/auth/inject-assume-privilege.ts +++ b/backend/src/server/plugins/auth/inject-assume-privilege.ts @@ -13,7 +13,7 @@ export const injectAssumePrivilege = fp(async (server: FastifyZodProvider) => { req.auth.tokenVersionId ); if (decodedToken) { - requestContext.set("assumedProjectRole", decodedToken); + requestContext.set("assumedPrivilegeDetails", decodedToken); } } } catch (error) { diff --git a/backend/src/services/project-role/project-role-service.ts b/backend/src/services/project-role/project-role-service.ts index 38c5f393a..211dcff4f 100644 --- a/backend/src/services/project-role/project-role-service.ts +++ b/backend/src/services/project-role/project-role-service.ts @@ -238,29 +238,31 @@ export const projectRoleServiceFactory = ({ // just to satisfy ts if (!("roles" in membership)) throw new BadRequestError({ message: "Service token not allowed" }); - const assumedProjectRole = requestContext.get("assumedProjectRole"); - const isImpersonating = assumedProjectRole?.projectId === projectId; - const impersonation = isImpersonating + const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails"); + const isAssumingPrivilege = assumedPrivilegeDetailsCtx?.projectId === projectId; + const assumedPrivilegeDetails = isAssumingPrivilege ? { - actorId: assumedProjectRole?.actorId, - actorType: assumedProjectRole?.actorType, + actorId: assumedPrivilegeDetailsCtx?.actorId, + actorType: assumedPrivilegeDetailsCtx?.actorType, actorName: "", actorEmail: "" } : undefined; - if (impersonation?.actorType === ActorType.IDENTITY) { - const identityDetails = await identityDAL.findById(impersonation.actorId); - if (!identityDetails) throw new NotFoundError({ message: `Identity with ID ${impersonation.actorId} not found` }); - impersonation.actorName = identityDetails.name; - } else if (impersonation?.actorType === ActorType.USER) { - const userDetails = await userDAL.findById(impersonation?.actorId); - if (!userDetails) throw new NotFoundError({ message: `User with ID ${impersonation.actorId} not found` }); - impersonation.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`; - impersonation.actorEmail = userDetails?.email || ""; + if (assumedPrivilegeDetails?.actorType === ActorType.IDENTITY) { + const identityDetails = await identityDAL.findById(assumedPrivilegeDetails.actorId); + if (!identityDetails) + throw new NotFoundError({ message: `Identity with ID ${assumedPrivilegeDetails.actorId} not found` }); + assumedPrivilegeDetails.actorName = identityDetails.name; + } else if (assumedPrivilegeDetails?.actorType === ActorType.USER) { + const userDetails = await userDAL.findById(assumedPrivilegeDetails?.actorId); + if (!userDetails) + throw new NotFoundError({ message: `User with ID ${assumedPrivilegeDetails.actorId} not found` }); + assumedPrivilegeDetails.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`; + assumedPrivilegeDetails.actorEmail = userDetails?.email || ""; } - return { permissions: packRules(permission.rules), membership, impersonation }; + return { permissions: packRules(permission.rules), membership, assumedPrivilegeDetails }; }; return { createRole, updateRole, deleteRole, listRoles, getUserPermission, getRoleBySlug }; diff --git a/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx b/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx index c9bed4512..a824f6fa6 100644 --- a/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx +++ b/frontend/src/context/ProjectPermissionContext/ProjectPermissionContext.tsx @@ -20,7 +20,7 @@ export const useProjectPermission = () => { } const { - data: { permission, membership, impersonation } + data: { permission, membership, assumedPrivilegeDetails } } = useSuspenseQuery({ queryKey: roleQueryKeys.getUserProjectPermissions({ workspaceId: projectId }), queryFn: () => fetchUserProjectPermissions({ workspaceId: projectId }), @@ -30,7 +30,7 @@ export const useProjectPermission = () => { const ability = evaluatePermissionsAbility(rule); return { permission: ability, - impersonation: data.impersonation, + assumedPrivilegeDetails: data.assumedPrivilegeDetails, membership: { ...data.membership, roles: data.membership.roles.map(({ role }) => role) @@ -44,5 +44,5 @@ export const useProjectPermission = () => { [] ); - return { permission, membership, hasProjectRole, impersonation }; + return { permission, membership, hasProjectRole, assumedPrivilegeDetails }; }; diff --git a/frontend/src/hooks/api/roles/queries.tsx b/frontend/src/hooks/api/roles/queries.tsx index d8bd8d4c7..a406b6d45 100644 --- a/frontend/src/hooks/api/roles/queries.tsx +++ b/frontend/src/hooks/api/roles/queries.tsx @@ -138,7 +138,7 @@ export const fetchUserProjectPermissions = async ({ data: { permissions: PackRule>>[]; membership: Omit & { roles: { role: string }[] }; - impersonation?: { + assumedPrivilegeDetails?: { actorId: string; actorType: ActorType; actorEmail: string; diff --git a/frontend/src/layouts/ProjectLayout/ProjectLayout.tsx b/frontend/src/layouts/ProjectLayout/ProjectLayout.tsx index 981b177fa..b32c24b45 100644 --- a/frontend/src/layouts/ProjectLayout/ProjectLayout.tsx +++ b/frontend/src/layouts/ProjectLayout/ProjectLayout.tsx @@ -30,7 +30,7 @@ export const ProjectLayout = () => { const breadcrumbs = matches && "breadcrumbs" in matches ? matches.breadcrumbs : undefined; const { t } = useTranslation(); - const { impersonation } = useProjectPermission(); + const { assumedPrivilegeDetails } = useProjectPermission(); const workspaceId = currentWorkspace?.id || ""; const projectSlug = currentWorkspace?.slug || ""; @@ -64,7 +64,7 @@ export const ProjectLayout = () => { return ( <>
- {impersonation && } + {assumedPrivilegeDetails && }
{ const { currentWorkspace } = useWorkspace(); const exitAssumePrivilegeMode = useRemoveAssumeProjectPrivilege(); - const { impersonation } = useProjectPermission(); + const { assumedPrivilegeDetails } = useProjectPermission(); - if (!impersonation) return null; + if (!assumedPrivilegeDetails) return null; return (
@@ -19,8 +19,8 @@ export const AssumePrivilegeModeBanner = () => { You are currently viewing the project with privileges of{" "} - {impersonation?.actorType === ActorType.IDENTITY ? "identity" : "user"}{" "} - {impersonation?.actorName} + {assumedPrivilegeDetails?.actorType === ActorType.IDENTITY ? "identity" : "user"}{" "} + {assumedPrivilegeDetails?.actorName}