diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts index 16ad991ca..e1afceada 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts @@ -4,7 +4,7 @@ import jwt from "jsonwebtoken"; import { UnauthorizedError } from "@app/lib/errors"; -import { TDecodedGcpIamAuthJwt, TGcpGceIdTokenPayload } from "./identity-gcp-auth-types"; +import { TDecodedGcpIamAuthJwt, TGcpIdTokenPayload } from "./identity-gcp-auth-types"; /** * Validates that the identity token [jwt] sent in from a client GCE instance as part of GCP ID Token authentication @@ -13,7 +13,13 @@ import { TDecodedGcpIamAuthJwt, TGcpGceIdTokenPayload } from "./identity-gcp-aut * @param {string} jwt - The identity token to validate. * @param {string} credentials - The credentials in the GCP Auth configuration for Infisical. */ -export const validateGceIdentity = async ({ identityId, jwt: identityToken }: { identityId: string; jwt: string }) => { +export const validateIdTokenIdentity = async ({ + identityId, + jwt: identityToken +}: { + identityId: string; + jwt: string; +}) => { const oAuth2Client = new OAuth2Client(); const response = await oAuth2Client.getFederatedSignonCerts(); const ticket = await oAuth2Client.verifySignedJwtWithCertsAsync( @@ -22,7 +28,7 @@ export const validateGceIdentity = async ({ identityId, jwt: identityToken }: { identityId, // audience ["https://accounts.google.com"] ); - const payload = ticket.getPayload() as TGcpGceIdTokenPayload; + const payload = ticket.getPayload() as TGcpIdTokenPayload; if (!payload || !payload.email) throw new UnauthorizedError(); return { email: payload.email, computeEngineDetails: payload.google?.compute_engine }; diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts index 8c4fa8b49..b821b6dc3 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts @@ -15,7 +15,7 @@ import { TIdentityOrgDALFactory } from "../identity/identity-org-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TIdentityGcpAuthDALFactory } from "./identity-gcp-auth-dal"; -import { validateGceIdentity, validateIamIdentity } from "./identity-gcp-auth-fns"; +import { validateIamIdentity, validateIdTokenIdentity } from "./identity-gcp-auth-fns"; import { TAttachGcpAuthDTO, TGcpIdentityDetails, @@ -43,7 +43,7 @@ export const identityGcpAuthServiceFactory = ({ permissionService, licenseService }: TIdentityGcpAuthServiceFactoryDep) => { - const login = async ({ identityId, jwt: serviceAccountJwt }: TLoginGcpAuthDTO) => { + const login = async ({ identityId, jwt: gcpJwt }: TLoginGcpAuthDTO) => { const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId }); if (!identityGcpAuth) throw new UnauthorizedError(); @@ -53,16 +53,16 @@ export const identityGcpAuthServiceFactory = ({ let gcpIdentityDetails: TGcpIdentityDetails; switch (identityGcpAuth.type) { case "gce": { - gcpIdentityDetails = await validateGceIdentity({ + gcpIdentityDetails = await validateIdTokenIdentity({ identityId, - jwt: serviceAccountJwt + jwt: gcpJwt }); break; } case "iam": { gcpIdentityDetails = await validateIamIdentity({ identityId, - jwt: serviceAccountJwt + jwt: gcpJwt }); break; } diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-types.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-types.ts index 931de78e0..60ab36b58 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-types.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-types.ts @@ -47,7 +47,7 @@ export type TGcpIdentityDetails = { computeEngineDetails?: TComputeEngineDetails; }; -export type TGcpGceIdTokenPayload = { +export type TGcpIdTokenPayload = { aud: string; azp: string; email: string;