awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-11 10:28:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: updated files on review changes

Browse Source
This commit is contained in:
=
2025-04-28 18:56:17 +05:30
parent a80520e425
commit 7b42f666f9
10 changed files with 42 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/@types/fastify.d.ts
Vendored
+1 -1
View File
@@ -110,7 +110,7 @@ declare module "@fastify/request-context" {
};
};
identityPermissionMetadata?: Record<string, unknown>; // filled by permission service
assumedProjectRole?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
assumedPrivilegeDetails?: { requesterId: string; actorId: string; actorType: ActorType; projectId: string };
}
}
backend/src/ee/routes/v1/assume-privilege-router.ts
+4 -4
View File
@@ -90,8 +90,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req, res) => {
const assumePrivilege = requestContext.get("assumedProjectRole");
if (req.auth.authMode === AuthMode.JWT && assumePrivilege) {
const assumedPrivilegeDetails = requestContext.get("assumedPrivilegeDetails");
if (req.auth.authMode === AuthMode.JWT && assumedPrivilegeDetails) {
const appCfg = getConfig();
void res.setCookie("infisical-project-assume-privileges", "", {
httpOnly: true,
@@ -110,8 +110,8 @@ export const registerAssumePrivilegeRouter = async (server: FastifyZodProvider)
projectId: req.params.projectId,
requesterEmail: req.auth.user.username,
requesterId: req.auth.user.id,
targetActorId: assumePrivilege.actorId,
targetActorType: assumePrivilege.actorType
targetActorId: assumedPrivilegeDetails.actorId,
targetActorType: assumedPrivilegeDetails.actorType
}
}
});
backend/src/ee/routes/v1/project-role-router.ts
+3 -3
View File
@@ -253,7 +253,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
})
.array()
}),
impersonation: z
assumedPrivilegeDetails: z
.object({
actorId: z.string(),
actorType: z.string(),
@@ -268,7 +268,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { permissions, membership, impersonation } = await server.services.projectRole.getUserPermission(
const { permissions, membership, assumedPrivilegeDetails } = await server.services.projectRole.getUserPermission(
req.permission.id,
req.params.projectId,
req.permission.authMethod,
@@ -279,7 +279,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
data: {
permissions,
membership,
impersonation
assumedPrivilegeDetails
}
};
}
backend/src/ee/services/permission/permission-service.ts
+6 -6
View File
@@ -560,15 +560,15 @@ export const permissionServiceFactory = ({
}: TGetProjectPermissionArg): Promise<TProjectPermissionRT<T>> => {
let actor = inputActor;
let actorId = inputActorId;
const assumedProjectRole = requestContext.get("assumedProjectRole");
const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails");
if (
assumedProjectRole &&
assumedPrivilegeDetailsCtx &&
actor === ActorType.USER &&
actorId === assumedProjectRole.requesterId &&
projectId === assumedProjectRole.projectId
actorId === assumedPrivilegeDetailsCtx.requesterId &&
projectId === assumedPrivilegeDetailsCtx.projectId
) {
actor = assumedProjectRole.actorType;
actorId = assumedProjectRole.actorId;
actor = assumedPrivilegeDetailsCtx.actorType;
actorId = assumedPrivilegeDetailsCtx.actorId;
}
switch (actor) {
backend/src/server/plugins/auth/inject-assume-privilege.ts
+1 -1
View File
@@ -13,7 +13,7 @@ export const injectAssumePrivilege = fp(async (server: FastifyZodProvider) => {
req.auth.tokenVersionId
);
if (decodedToken) {
requestContext.set("assumedProjectRole", decodedToken);
requestContext.set("assumedPrivilegeDetails", decodedToken);
}
}
} catch (error) {
backend/src/services/project-role/project-role-service.ts
+17 -15
View File
@@ -238,29 +238,31 @@ export const projectRoleServiceFactory = ({
// just to satisfy ts
if (!("roles" in membership)) throw new BadRequestError({ message: "Service token not allowed" });
const assumedProjectRole = requestContext.get("assumedProjectRole");
const isImpersonating = assumedProjectRole?.projectId === projectId;
const impersonation = isImpersonating
const assumedPrivilegeDetailsCtx = requestContext.get("assumedPrivilegeDetails");
const isAssumingPrivilege = assumedPrivilegeDetailsCtx?.projectId === projectId;
const assumedPrivilegeDetails = isAssumingPrivilege
? {
actorId: assumedProjectRole?.actorId,
actorType: assumedProjectRole?.actorType,
actorId: assumedPrivilegeDetailsCtx?.actorId,
actorType: assumedPrivilegeDetailsCtx?.actorType,
actorName: "",
actorEmail: ""
}
: undefined;
if (impersonation?.actorType === ActorType.IDENTITY) {
const identityDetails = await identityDAL.findById(impersonation.actorId);
if (!identityDetails) throw new NotFoundError({ message: `Identity with ID ${impersonation.actorId} not found` });
impersonation.actorName = identityDetails.name;
} else if (impersonation?.actorType === ActorType.USER) {
const userDetails = await userDAL.findById(impersonation?.actorId);
if (!userDetails) throw new NotFoundError({ message: `User with ID ${impersonation.actorId} not found` });
impersonation.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`;
impersonation.actorEmail = userDetails?.email || "";
if (assumedPrivilegeDetails?.actorType === ActorType.IDENTITY) {
const identityDetails = await identityDAL.findById(assumedPrivilegeDetails.actorId);
if (!identityDetails)
throw new NotFoundError({ message: `Identity with ID ${assumedPrivilegeDetails.actorId} not found` });
assumedPrivilegeDetails.actorName = identityDetails.name;
} else if (assumedPrivilegeDetails?.actorType === ActorType.USER) {
const userDetails = await userDAL.findById(assumedPrivilegeDetails?.actorId);
if (!userDetails)
throw new NotFoundError({ message: `User with ID ${assumedPrivilegeDetails.actorId} not found` });
assumedPrivilegeDetails.actorName = `${userDetails?.firstName} ${userDetails?.lastName || ""}`;
assumedPrivilegeDetails.actorEmail = userDetails?.email || "";
}
return { permissions: packRules(permission.rules), membership, impersonation };
return { permissions: packRules(permission.rules), membership, assumedPrivilegeDetails };
};
return { createRole, updateRole, deleteRole, listRoles, getUserPermission, getRoleBySlug };