From 929eac4350ea5e5933633ececc3c5dd1b4d2faae Mon Sep 17 00:00:00 2001 From: = Date: Mon, 30 Jun 2025 20:13:26 +0530 Subject: [PATCH] feat: resolved inefficient join for ip restriction in access token --- backend/src/server/routes/index.ts | 3 +- .../identity-access-token-dal.ts | 64 +------------------ .../identity-access-token-service.ts | 28 +++----- backend/src/services/identity/identity-dal.ts | 26 +++++++- 4 files changed, 37 insertions(+), 84 deletions(-) diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 3cf90f13d..aeef89838 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -1419,7 +1419,8 @@ export const registerRoutes = async ( const identityAccessTokenService = identityAccessTokenServiceFactory({ identityAccessTokenDAL, identityOrgMembershipDAL, - accessTokenQueue + accessTokenQueue, + identityDAL }); const identityProjectService = identityProjectServiceFactory({ diff --git a/backend/src/services/identity-access-token/identity-access-token-dal.ts b/backend/src/services/identity-access-token/identity-access-token-dal.ts index 629bba12d..8f65d8555 100644 --- a/backend/src/services/identity-access-token/identity-access-token-dal.ts +++ b/backend/src/services/identity-access-token/identity-access-token-dal.ts @@ -17,71 +17,11 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => { const doc = await (tx || db.replicaNode())(TableName.IdentityAccessToken) .where(filter) .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.IdentityAccessToken}.identityId`) - .leftJoin( - TableName.IdentityUaClientSecret, - `${TableName.IdentityAccessToken}.identityUAClientSecretId`, - `${TableName.IdentityUaClientSecret}.id` - ) - .leftJoin( - TableName.IdentityUniversalAuth, - `${TableName.IdentityUaClientSecret}.identityUAId`, - `${TableName.IdentityUniversalAuth}.id` - ) - .leftJoin(TableName.IdentityGcpAuth, `${TableName.Identity}.id`, `${TableName.IdentityGcpAuth}.identityId`) - .leftJoin( - TableName.IdentityAliCloudAuth, - `${TableName.Identity}.id`, - `${TableName.IdentityAliCloudAuth}.identityId` - ) - .leftJoin(TableName.IdentityAwsAuth, `${TableName.Identity}.id`, `${TableName.IdentityAwsAuth}.identityId`) - .leftJoin(TableName.IdentityAzureAuth, `${TableName.Identity}.id`, `${TableName.IdentityAzureAuth}.identityId`) - .leftJoin(TableName.IdentityLdapAuth, `${TableName.Identity}.id`, `${TableName.IdentityLdapAuth}.identityId`) - .leftJoin( - TableName.IdentityKubernetesAuth, - `${TableName.Identity}.id`, - `${TableName.IdentityKubernetesAuth}.identityId` - ) - .leftJoin(TableName.IdentityOciAuth, `${TableName.Identity}.id`, `${TableName.IdentityOciAuth}.identityId`) - .leftJoin(TableName.IdentityOidcAuth, `${TableName.Identity}.id`, `${TableName.IdentityOidcAuth}.identityId`) - .leftJoin(TableName.IdentityTokenAuth, `${TableName.Identity}.id`, `${TableName.IdentityTokenAuth}.identityId`) - .leftJoin(TableName.IdentityJwtAuth, `${TableName.Identity}.id`, `${TableName.IdentityJwtAuth}.identityId`) .select(selectAllTableCols(TableName.IdentityAccessToken)) - .select( - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityUniversalAuth).as("accessTokenTrustedIpsUa"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityGcpAuth).as("accessTokenTrustedIpsGcp"), - db - .ref("accessTokenTrustedIps") - .withSchema(TableName.IdentityAliCloudAuth) - .as("accessTokenTrustedIpsAliCloud"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityAwsAuth).as("accessTokenTrustedIpsAws"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityAzureAuth).as("accessTokenTrustedIpsAzure"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityKubernetesAuth).as("accessTokenTrustedIpsK8s"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityOciAuth).as("accessTokenTrustedIpsOci"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityOidcAuth).as("accessTokenTrustedIpsOidc"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityTokenAuth).as("accessTokenTrustedIpsToken"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityJwtAuth).as("accessTokenTrustedIpsJwt"), - db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityLdapAuth).as("accessTokenTrustedIpsLdap"), - db.ref("name").withSchema(TableName.Identity) - ) + .select(db.ref("name").withSchema(TableName.Identity)) .first(); - if (!doc) return; - - return { - ...doc, - trustedIpsUniversalAuth: doc.accessTokenTrustedIpsUa, - trustedIpsGcpAuth: doc.accessTokenTrustedIpsGcp, - trustedIpsAliCloudAuth: doc.accessTokenTrustedIpsAliCloud, - trustedIpsAwsAuth: doc.accessTokenTrustedIpsAws, - trustedIpsAzureAuth: doc.accessTokenTrustedIpsAzure, - trustedIpsKubernetesAuth: doc.accessTokenTrustedIpsK8s, - trustedIpsOciAuth: doc.accessTokenTrustedIpsOci, - trustedIpsOidcAuth: doc.accessTokenTrustedIpsOidc, - trustedIpsAccessTokenAuth: doc.accessTokenTrustedIpsToken, - trustedIpsAccessJwtAuth: doc.accessTokenTrustedIpsJwt, - trustedIpsAccessLdapAuth: doc.accessTokenTrustedIpsLdap, - trustedIpsAccessTlsCertAuth: [] - }; + return doc; } catch (error) { throw new DatabaseError({ error, name: "IdAccessTokenFindOne" }); } diff --git a/backend/src/services/identity-access-token/identity-access-token-service.ts b/backend/src/services/identity-access-token/identity-access-token-service.ts index 587b7c436..0937b9640 100644 --- a/backend/src/services/identity-access-token/identity-access-token-service.ts +++ b/backend/src/services/identity-access-token/identity-access-token-service.ts @@ -7,12 +7,14 @@ import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip"; import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue"; import { AuthTokenType } from "../auth/auth-type"; +import { TIdentityDALFactory } from "../identity/identity-dal"; import { TIdentityOrgDALFactory } from "../identity/identity-org-dal"; import { TIdentityAccessTokenDALFactory } from "./identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload, TRenewAccessTokenDTO } from "./identity-access-token-types"; type TIdentityAccessTokenServiceFactoryDep = { identityAccessTokenDAL: TIdentityAccessTokenDALFactory; + identityDAL: Pick; identityOrgMembershipDAL: TIdentityOrgDALFactory; accessTokenQueue: Pick< TAccessTokenQueueServiceFactory, @@ -25,7 +27,8 @@ export type TIdentityAccessTokenServiceFactory = ReturnType { const validateAccessTokenExp = async (identityAccessToken: TIdentityAccessTokens) => { const { @@ -190,24 +193,11 @@ export const identityAccessTokenServiceFactory = ({ message: "Failed to authorize revoked access token, access token is revoked" }); - const trustedIpsMap: Record = { - [IdentityAuthMethod.UNIVERSAL_AUTH]: identityAccessToken.trustedIpsUniversalAuth, - [IdentityAuthMethod.GCP_AUTH]: identityAccessToken.trustedIpsGcpAuth, - [IdentityAuthMethod.ALICLOUD_AUTH]: identityAccessToken.trustedIpsAliCloudAuth, - [IdentityAuthMethod.AWS_AUTH]: identityAccessToken.trustedIpsAwsAuth, - [IdentityAuthMethod.OCI_AUTH]: identityAccessToken.trustedIpsOciAuth, - [IdentityAuthMethod.AZURE_AUTH]: identityAccessToken.trustedIpsAzureAuth, - [IdentityAuthMethod.KUBERNETES_AUTH]: identityAccessToken.trustedIpsKubernetesAuth, - [IdentityAuthMethod.OIDC_AUTH]: identityAccessToken.trustedIpsOidcAuth, - [IdentityAuthMethod.TOKEN_AUTH]: identityAccessToken.trustedIpsAccessTokenAuth, - [IdentityAuthMethod.JWT_AUTH]: identityAccessToken.trustedIpsAccessJwtAuth, - [IdentityAuthMethod.LDAP_AUTH]: identityAccessToken.trustedIpsAccessLdapAuth, - [IdentityAuthMethod.TLS_CERT_AUTH]: identityAccessToken.trustedIpsAccessTlsCertAuth - }; - - const trustedIps = trustedIpsMap[identityAccessToken.authMethod as IdentityAuthMethod]; - - if (ipAddress) { + const trustedIps = await identityDAL.getTrustedIpsByAuthMethod( + identityAccessToken.identityId, + identityAccessToken.authMethod as IdentityAuthMethod + ); + if (ipAddress && trustedIps) { checkIPAgainstBlocklist({ ipAddress, trustedIps: trustedIps as TIp[] diff --git a/backend/src/services/identity/identity-dal.ts b/backend/src/services/identity/identity-dal.ts index c4d0b6307..363412493 100644 --- a/backend/src/services/identity/identity-dal.ts +++ b/backend/src/services/identity/identity-dal.ts @@ -1,5 +1,5 @@ import { TDbClient } from "@app/db"; -import { TableName, TIdentities } from "@app/db/schemas"; +import { IdentityAuthMethod, TableName, TIdentities } from "@app/db/schemas"; import { DatabaseError } from "@app/lib/errors"; import { ormify, selectAllTableCols } from "@app/lib/knex"; @@ -8,6 +8,28 @@ export type TIdentityDALFactory = ReturnType; export const identityDALFactory = (db: TDbClient) => { const identityOrm = ormify(db, TableName.Identity); + const getTrustedIpsByAuthMethod = async (identityId: string, authMethod: IdentityAuthMethod) => { + const authMethodToTableName = { + [IdentityAuthMethod.TOKEN_AUTH]: TableName.IdentityTokenAuth, + [IdentityAuthMethod.UNIVERSAL_AUTH]: TableName.IdentityUniversalAuth, + [IdentityAuthMethod.KUBERNETES_AUTH]: TableName.IdentityKubernetesAuth, + [IdentityAuthMethod.GCP_AUTH]: TableName.IdentityGcpAuth, + [IdentityAuthMethod.ALICLOUD_AUTH]: TableName.IdentityAliCloudAuth, + [IdentityAuthMethod.AWS_AUTH]: TableName.IdentityAwsAuth, + [IdentityAuthMethod.AZURE_AUTH]: TableName.IdentityAzureAuth, + [IdentityAuthMethod.TLS_CERT_AUTH]: TableName.IdentityTlsCertAuth, + [IdentityAuthMethod.OCI_AUTH]: TableName.IdentityOciAuth, + [IdentityAuthMethod.OIDC_AUTH]: TableName.IdentityOidcAuth, + [IdentityAuthMethod.JWT_AUTH]: TableName.IdentityJwtAuth, + [IdentityAuthMethod.LDAP_AUTH]: TableName.IdentityLdapAuth + } as const; + const tableName = authMethodToTableName[authMethod]; + if (!tableName) return; + const data = await db(tableName).where({ identityId }).first(); + if (!data) return; + return data.accessTokenTrustedIps; + }; + const getIdentitiesByFilter = async ({ limit, offset, @@ -38,5 +60,5 @@ export const identityDALFactory = (db: TDbClient) => { } }; - return { ...identityOrm, getIdentitiesByFilter }; + return { ...identityOrm, getTrustedIpsByAuthMethod, getIdentitiesByFilter }; };