awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 12:38:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve verification and resend code logic, added oidc and ldap

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-08-12 18:58:23 -07:00
parent 60b3f5c7c6
commit 8a72023e80
11 changed files with 101 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/services/ldap-config/ldap-config-service.ts
+15 -15
View File
@@ -400,15 +400,13 @@ export const ldapConfigServiceFactory = ({
userAlias = await userDAL.transaction(async (tx) => {
let newUser: TUsers | undefined;
if (serverCfg.trustLdapEmails) {
newUser = await userDAL.findOne(
{
email: email.toLowerCase(),
isEmailVerified: true
},
tx
);
}
newUser = await userDAL.findOne(
{
email: email.toLowerCase(),
isEmailVerified: true
},
tx
);
if (!newUser) {
const uniqueUsername = await normalizeUsername(username, userDAL);
@@ -433,7 +431,8 @@ export const ldapConfigServiceFactory = ({
aliasType: UserAliasType.LDAP,
externalId,
emails: [email],
orgId
orgId,
isEmailVerified: serverCfg.trustLdapEmails
},
tx
);
@@ -556,15 +555,14 @@ export const ldapConfigServiceFactory = ({
return newUser;
});
const isUserCompleted = Boolean(user.isAccepted);
const isUserCompleted = Boolean(user.isAccepted) && userAlias.isEmailVerified;
const providerAuthToken = crypto.jwt().sign(
{
authTokenType: AuthTokenType.PROVIDER_TOKEN,
userId: user.id,
username: user.username,
hasExchangedPrivateKey: true,
...(user.email && { email: user.email, isEmailVerified: user.isEmailVerified }),
...(user.email && { email: user.email, isEmailVerified: userAlias.isEmailVerified }),
firstName,
lastName,
organizationName: organization.name,
@@ -572,6 +570,7 @@ export const ldapConfigServiceFactory = ({
organizationSlug: organization.slug,
authMethod: AuthMethod.LDAP,
authType: UserAliasType.LDAP,
aliasId: userAlias.id,
isUserCompleted,
...(relayState
? {
@@ -585,10 +584,11 @@ export const ldapConfigServiceFactory = ({
}
);
if (user.email && !user.isEmailVerified) {
if (user.email && !userAlias.isEmailVerified) {
const token = await tokenService.createTokenForUser({
type: TokenType.TOKEN_EMAIL_VERIFICATION,
userId: user.id
userId: user.id,
aliasId: userAlias.id
});
await smtpService.sendMail({
backend/src/ee/services/oidc/oidc-config-service.ts
+26 -26
View File
@@ -180,7 +180,7 @@ export const oidcConfigServiceFactory = ({
}
const appCfg = getConfig();
const userAlias = await userAliasDAL.findOne({
let userAlias = await userAliasDAL.findOne({
externalId,
orgId,
aliasType: UserAliasType.OIDC
@@ -231,32 +231,29 @@ export const oidcConfigServiceFactory = ({
} else {
user = await userDAL.transaction(async (tx) => {
let newUser: TUsers | undefined;
// we prioritize getting the most complete user to create the new alias under
newUser = await userDAL.findOne(
{
email,
isEmailVerified: true
},
tx
);
if (serverCfg.trustOidcEmails) {
// we prioritize getting the most complete user to create the new alias under
if (!newUser) {
// this fetches user entries created via invites
newUser = await userDAL.findOne(
{
email,
isEmailVerified: true
username: email
},
tx
);
if (!newUser) {
// this fetches user entries created via invites
newUser = await userDAL.findOne(
{
username: email
},
tx
);
if (newUser && !newUser.isEmailVerified) {
// we automatically mark it as email-verified because we've configured trust for OIDC emails
newUser = await userDAL.updateById(newUser.id, {
isEmailVerified: true
});
}
if (newUser && !newUser.isEmailVerified) {
// we automatically mark it as email-verified because we've configured trust for OIDC emails
newUser = await userDAL.updateById(newUser.id, {
isEmailVerified: serverCfg.trustOidcEmails
});
}
}
@@ -276,13 +273,14 @@ export const oidcConfigServiceFactory = ({
);
}
await userAliasDAL.create(
userAlias = await userAliasDAL.create(
{
userId: newUser.id,
aliasType: UserAliasType.OIDC,
externalId,
emails: email ? [email] : [],
orgId
orgId,
isEmailVerified: serverCfg.trustOidcEmails
},
tx
);
@@ -404,19 +402,20 @@ export const oidcConfigServiceFactory = ({
await licenseService.updateSubscriptionOrgMemberCount(organization.id);
const isUserCompleted = Boolean(user.isAccepted);
const isUserCompleted = Boolean(user.isAccepted) && userAlias.isEmailVerified;
const providerAuthToken = crypto.jwt().sign(
{
authTokenType: AuthTokenType.PROVIDER_TOKEN,
userId: user.id,
username: user.username,
...(user.email && { email: user.email, isEmailVerified: user.isEmailVerified }),
...(user.email && { email: user.email, isEmailVerified: userAlias.isEmailVerified }),
firstName,
lastName,
organizationName: organization.name,
organizationId: organization.id,
organizationSlug: organization.slug,
hasExchangedPrivateKey: true,
aliasId: userAlias.id,
authMethod: AuthMethod.OIDC,
authType: UserAliasType.OIDC,
isUserCompleted,
@@ -430,10 +429,11 @@ export const oidcConfigServiceFactory = ({
await oidcConfigDAL.update({ orgId }, { lastUsed: new Date() });
if (user.email && !user.isEmailVerified) {
if (user.email && !userAlias.isEmailVerified) {
const token = await tokenService.createTokenForUser({
type: TokenType.TOKEN_EMAIL_VERIFICATION,
userId: user.id
userId: user.id,
aliasId: userAlias.id
});
await smtpService
backend/src/ee/services/saml-config/saml-config-service.ts
+2 -1
View File
@@ -443,7 +443,8 @@ export const samlConfigServiceFactory = ({
if (user.email && !userAlias.isEmailVerified) {
const token = await tokenService.createTokenForUser({
type: TokenType.TOKEN_EMAIL_VERIFICATION,
userId: user.id
userId: user.id,
aliasId: userAlias.id
});
await smtpService.sendMail({