diff --git a/backend/src/config/index.ts b/backend/src/config/index.ts index 68427d078..29f62cdc6 100644 --- a/backend/src/config/index.ts +++ b/backend/src/config/index.ts @@ -48,4 +48,17 @@ export const getStripeSecretKey = () => infisical.get('STRIPE_SECRET_KEY')!; export const getStripeWebhookSecret = () => infisical.get('STRIPE_WEBHOOK_SECRET')!; export const getTelemetryEnabled = () => infisical.get('TELEMETRY_ENABLED')! !== 'false' && true; export const getLoopsApiKey = () => infisical.get('LOOPS_API_KEY')!; -export const getSmtpConfigured = () => infisical.get('SMTP_HOST') == '' || infisical.get('SMTP_HOST') == undefined ? false : true \ No newline at end of file +export const getSmtpConfigured = () => infisical.get('SMTP_HOST') == '' || infisical.get('SMTP_HOST') == undefined ? false : true +export const getHttpsEnabled = () => { + if (getNodeEnv() != "production") { + // no https for anything other than prod + return false + } + + if (infisical.get('HTTPS_ENABLED') == undefined || infisical.get('HTTPS_ENABLED') == "") { + // default when no value present + return true + } + + return infisical.get('HTTPS_ENABLED') === 'true' && true +} \ No newline at end of file diff --git a/backend/src/controllers/v1/authController.ts b/backend/src/controllers/v1/authController.ts index 3c6ec523a..84404bc74 100644 --- a/backend/src/controllers/v1/authController.ts +++ b/backend/src/controllers/v1/authController.ts @@ -15,10 +15,10 @@ import { BadRequestError } from '../../utils/errors'; import { EELogService } from '../../ee/services'; import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this import { - getNodeEnv, getJwtRefreshSecret, getJwtAuthLifetime, - getJwtAuthSecret + getJwtAuthSecret, + getHttpsEnabled } from '../../config'; declare module 'jsonwebtoken' { @@ -126,21 +126,21 @@ export const login2 = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() }); const loginAction = await EELogService.createAction({ name: ACTION_LOGIN, userId: user._id }); - + loginAction && await EELogService.createLog({ userId: user._id, actions: [loginAction], channel: getChannelFromUserAgent(req.headers['user-agent']), ipAddress: req.ip }); - + // return (access) token in response return res.status(200).send({ token: tokens.token, @@ -182,14 +182,14 @@ export const logout = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() as boolean }); const logoutAction = await EELogService.createAction({ name: ACTION_LOGOUT, userId: req.user._id }); - + logoutAction && await EELogService.createLog({ userId: req.user._id, actions: [logoutAction], diff --git a/backend/src/controllers/v2/authController.ts b/backend/src/controllers/v2/authController.ts index 3a36d559c..92b4a159a 100644 --- a/backend/src/controllers/v2/authController.ts +++ b/backend/src/controllers/v2/authController.ts @@ -17,9 +17,9 @@ import { } from '../../variables'; import { getChannelFromUserAgent } from '../../utils/posthog'; // TODO: move this import { - getNodeEnv, getJwtMfaLifetime, - getJwtMfaSecret + getJwtMfaSecret, + getHttpsEnabled } from '../../config'; declare module 'jsonwebtoken' { @@ -163,7 +163,7 @@ export const login2 = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() }); // case: user does not have MFA enablgged @@ -302,7 +302,7 @@ export const verifyMfaToken = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() }); interface VerifyMfaTokenRes { diff --git a/backend/src/controllers/v2/signupController.ts b/backend/src/controllers/v2/signupController.ts index aaf055b78..ff41aa017 100644 --- a/backend/src/controllers/v2/signupController.ts +++ b/backend/src/controllers/v2/signupController.ts @@ -8,7 +8,7 @@ import { import { issueAuthTokens } from '../../helpers/auth'; import { INVITED, ACCEPTED } from '../../variables'; import request from '../../config/request'; -import { getNodeEnv, getLoopsApiKey } from '../../config'; +import { getLoopsApiKey, getHttpsEnabled } from '../../config'; /** * Complete setting up user by adding their personal and auth information as part of the @@ -24,9 +24,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => { email, firstName, lastName, - protectedKey, - protectedKeyIV, - protectedKeyTag, + protectedKey, + protectedKeyIV, + protectedKeyTag, publicKey, encryptedPrivateKey, encryptedPrivateKeyIV, @@ -38,9 +38,9 @@ export const completeAccountSignup = async (req: Request, res: Response) => { email: string; firstName: string; lastName: string; - protectedKey: string; - protectedKeyIV: string; - protectedKeyTag: string; + protectedKey: string; + protectedKeyIV: string; + protectedKeyTag: string; publicKey: string; encryptedPrivateKey: string; encryptedPrivateKeyIV: string; @@ -48,11 +48,11 @@ export const completeAccountSignup = async (req: Request, res: Response) => { salt: string; verifier: string; organizationName: string; - } = req.body; + } = req.body; // get user user = await User.findOne({ email }); - + if (!user || (user && user?.publicKey)) { // case 1: user doesn't exist. // case 2: user has already completed account @@ -66,10 +66,10 @@ export const completeAccountSignup = async (req: Request, res: Response) => { userId: user._id.toString(), firstName, lastName, - encryptionVersion: 2, - protectedKey, - protectedKeyIV, - protectedKeyTag, + encryptionVersion: 2, + protectedKey, + protectedKeyIV, + protectedKeyTag, publicKey, encryptedPrivateKey, encryptedPrivateKeyIV, @@ -127,7 +127,7 @@ export const completeAccountSignup = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() }); } catch (err) { Sentry.setUser(null); @@ -158,9 +158,9 @@ export const completeAccountInvite = async (req: Request, res: Response) => { email, firstName, lastName, - protectedKey, - protectedKeyIV, - protectedKeyTag, + protectedKey, + protectedKeyIV, + protectedKeyTag, publicKey, encryptedPrivateKey, encryptedPrivateKeyIV, @@ -192,10 +192,10 @@ export const completeAccountInvite = async (req: Request, res: Response) => { userId: user._id.toString(), firstName, lastName, - encryptionVersion: 2, - protectedKey, - protectedKeyIV, - protectedKeyTag, + encryptionVersion: 2, + protectedKey, + protectedKeyIV, + protectedKeyTag, publicKey, encryptedPrivateKey, encryptedPrivateKeyIV, @@ -232,7 +232,7 @@ export const completeAccountInvite = async (req: Request, res: Response) => { httpOnly: true, path: '/', sameSite: 'strict', - secure: getNodeEnv() === 'production' ? true : false + secure: getHttpsEnabled() }); } catch (err) { Sentry.setUser(null); @@ -241,7 +241,7 @@ export const completeAccountInvite = async (req: Request, res: Response) => { message: 'Failed to complete account setup' }); } - + return res.status(200).send({ message: 'Successfully set up account', user, diff --git a/backend/src/helpers/auth.ts b/backend/src/helpers/auth.ts index b9c4e8232..9cbe82e34 100644 --- a/backend/src/helpers/auth.ts +++ b/backend/src/helpers/auth.ts @@ -157,7 +157,7 @@ const getAuthSTDPayload = async ({ }, { new: true }) - .select('+encryptedKey +iv +tag').populate('user'); + .select('+encryptedKey +iv +tag').populate('user serviceAccount'); if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' }); diff --git a/backend/src/services/TelemetryService.ts b/backend/src/services/TelemetryService.ts index 0566439b4..248ad3633 100644 --- a/backend/src/services/TelemetryService.ts +++ b/backend/src/services/TelemetryService.ts @@ -8,7 +8,9 @@ import { } from '../config'; import { IUser, + User, IServiceAccount, + ServiceAccount, IServiceTokenData } from '../models'; import { @@ -56,7 +58,7 @@ class Telemetry { }: { user?: IUser; serviceAccount?: IServiceAccount; - serviceTokenData?: IServiceTokenData; + serviceTokenData?: any; // TODO: fix (it's ServiceTokenData with user populated) }) => { let distinctId = ''; @@ -65,11 +67,13 @@ class Telemetry { } if (serviceAccount) { - distinctId = `sa.${serviceAccount._id}`; + distinctId = `sa.${serviceAccount._id.toString()}`; } - - if (serviceTokenData) { - distinctId = `st.${serviceTokenData._id}`; + + if (serviceTokenData?.user && serviceTokenData?.user instanceof User) { + distinctId = serviceTokenData.user.email; + } else if (serviceTokenData?.serviceAccount && serviceTokenData?.serviceAccount instanceof ServiceAccount) { + distinctId = `sa.${serviceTokenData.serviceAccount._id.toString()}`; } if (distinctId === '') { diff --git a/cloudformation/ec2-deployment/infisical-ec2-deployment.template b/cloudformation/ec2-deployment/infisical-ec2-deployment.template index 36f0d9dce..2db93b779 100644 --- a/cloudformation/ec2-deployment/infisical-ec2-deployment.template +++ b/cloudformation/ec2-deployment/infisical-ec2-deployment.template @@ -96,6 +96,7 @@ Resources: echo "JWT_AUTH_SECRET=${!JWT_AUTH_SECRET}" >> .env echo "JWT_SERVICE_SECRET=${!JWT_SERVICE_SECRET}" >> .env echo "MONGO_URL=${!DOCUMENT_DB_CONNECTION_URL}" >> .env + echo "HTTPS_ENABLED=false" >> .env docker-compose up -d diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index a3812974b..8acdad974 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -17,7 +17,7 @@ Self-hosted Infisical allows you to maintain your sensitive information within y - 1 DocumentDB instance - Security groups - +