awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Attached settings URL to email, actor no longer a recipient, removed error handling for email send, used read replica node for findOrgMembersByRole

Browse Source
This commit is contained in:
x
2025-04-23 19:46:25 -04:00
parent a838f84601
commit 8bd21ffa63
3 changed files with 20 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
backend/src/services/auth/auth-login-service.ts
View File

@@ -450,26 +450,25 @@ export const authLoginServiceFactory = ({
}
});
// Notify all admins via email
// Notify all admins via email (besides the actor)
const orgAdmins = await orgDAL.findOrgMembersByRole(organizationId, OrgMembershipRole.Admin);
const adminEmails = orgAdmins.map((admin) => admin.user?.email).filter(Boolean) as string[];
const adminEmails = orgAdmins
.filter((admin) => admin.user.id !== user.id)
.map((admin) => admin.user.email)
.filter(Boolean) as string[];
try {
if (adminEmails.length > 0) {
await smtpService.sendMail({
recipients: adminEmails,
subjectLine: "Security Alert: Admin SSO Bypass",
substitutions: {
email: user.email,
timestamp: new Date().toISOString(),
ip: ipAddress,
userAgent
},
template: SmtpTemplates.OrgAdminBreakglassAccess
});
}
} catch (error) {
logger.error(error, `Failed to send SSO bypass notification emails for user ${user.email}`);
if (adminEmails.length > 0) {
await smtpService.sendMail({
recipients: adminEmails,
subjectLine: "Security Alert: Admin SSO Bypass",
substitutions: {
email: user.email,
timestamp: new Date().toISOString(),
ip: ipAddress,
userAgent
},
template: SmtpTemplates.OrgAdminBreakglassAccess
});
}
}

2
backend/src/services/org/org-dal.ts
View File

@@ -254,7 +254,7 @@ export const orgDALFactory = (db: TDbClient) => {
const findOrgMembersByRole = async (orgId: string, role: OrgMembershipRole, tx?: Knex) => {
try {
const conn = tx || db;
const conn = tx || db.replicaNode();
const members = await conn(TableName.OrgMembership)
.where(`${TableName.OrgMembership}.orgId`, orgId)
.where(`${TableName.OrgMembership}.role`, role)

4
backend/src/services/smtp/templates/orgAdminBreakglassAccess.handlebars
View File

@@ -8,11 +8,11 @@
<body>
<h2>Infisical</h2>
<p>The organization admin {{email}} has just bypassed enforced SSO login.</p>
<p>The organization admin {{email}} has bypassed enforced SSO login.</p>
<p><strong>Timestamp</strong>: {{timestamp}}</p>
<p><strong>IP address</strong>: {{ip}}</p>
<p><strong>User agent</strong>: {{userAgent}}</p>
<p>If you'd like to disable Admin SSO Bypass, please visit Organization Settings > Security.</p>
<p>If you'd like to disable Admin SSO Bypass, please visit <a href="https://app.infisical.com/organization/settings">Organization Settings</a> > Security.</p>
{{emailFooter}}
</body>