awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Minor edits to renaming GCE -> ID Token

Browse Source
This commit is contained in:
Tuan Dang
2024-05-10 10:14:13 -07:00
parent c6d14a4bea
commit 95e12287c2
3 changed files with 15 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
backend/src/services/identity-gcp-auth/identity-gcp-auth-fns.ts
View File

@@ -4,7 +4,7 @@ import jwt from "jsonwebtoken";
import { UnauthorizedError } from "@app/lib/errors"; import { UnauthorizedError } from "@app/lib/errors";
import { TDecodedGcpIamAuthJwt, TGcpGceIdTokenPayload } from "./identity-gcp-auth-types"; import { TDecodedGcpIamAuthJwt, TGcpIdTokenPayload } from "./identity-gcp-auth-types";
/** /**
* Validates that the identity token [jwt] sent in from a client GCE instance as part of GCP ID Token authentication * Validates that the identity token [jwt] sent in from a client GCE instance as part of GCP ID Token authentication
@@ -13,7 +13,13 @@ import { TDecodedGcpIamAuthJwt, TGcpGceIdTokenPayload } from "./identity-gcp-aut
* @param {string} jwt - The identity token to validate. * @param {string} jwt - The identity token to validate.
* @param {string} credentials - The credentials in the GCP Auth configuration for Infisical. * @param {string} credentials - The credentials in the GCP Auth configuration for Infisical.
*/ */
export const validateGceIdentity = async ({ identityId, jwt: identityToken }: { identityId: string; jwt: string }) => { export const validateIdTokenIdentity = async ({
identityId,
jwt: identityToken
}: {
identityId: string;
jwt: string;
}) => {
const oAuth2Client = new OAuth2Client(); const oAuth2Client = new OAuth2Client();
const response = await oAuth2Client.getFederatedSignonCerts(); const response = await oAuth2Client.getFederatedSignonCerts();
const ticket = await oAuth2Client.verifySignedJwtWithCertsAsync( const ticket = await oAuth2Client.verifySignedJwtWithCertsAsync(
@@ -22,7 +28,7 @@ export const validateGceIdentity = async ({ identityId, jwt: identityToken }: {
identityId, // audience identityId, // audience
["https://accounts.google.com"] ["https://accounts.google.com"]
); );
const payload = ticket.getPayload() as TGcpGceIdTokenPayload; const payload = ticket.getPayload() as TGcpIdTokenPayload;
if (!payload || !payload.email) throw new UnauthorizedError(); if (!payload || !payload.email) throw new UnauthorizedError();
return { email: payload.email, computeEngineDetails: payload.google?.compute_engine }; return { email: payload.email, computeEngineDetails: payload.google?.compute_engine };

10
backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
View File

@@ -15,7 +15,7 @@ import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal"; import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types"; import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
import { TIdentityGcpAuthDALFactory } from "./identity-gcp-auth-dal"; import { TIdentityGcpAuthDALFactory } from "./identity-gcp-auth-dal";
import { validateGceIdentity, validateIamIdentity } from "./identity-gcp-auth-fns"; import { validateIamIdentity, validateIdTokenIdentity } from "./identity-gcp-auth-fns";
import { import {
TAttachGcpAuthDTO, TAttachGcpAuthDTO,
TGcpIdentityDetails, TGcpIdentityDetails,
@@ -43,7 +43,7 @@ export const identityGcpAuthServiceFactory = ({
permissionService, permissionService,
licenseService licenseService
}: TIdentityGcpAuthServiceFactoryDep) => { }: TIdentityGcpAuthServiceFactoryDep) => {
const login = async ({ identityId, jwt: serviceAccountJwt }: TLoginGcpAuthDTO) => { const login = async ({ identityId, jwt: gcpJwt }: TLoginGcpAuthDTO) => {
const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId }); const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId });
if (!identityGcpAuth) throw new UnauthorizedError(); if (!identityGcpAuth) throw new UnauthorizedError();
@@ -53,16 +53,16 @@ export const identityGcpAuthServiceFactory = ({
let gcpIdentityDetails: TGcpIdentityDetails; let gcpIdentityDetails: TGcpIdentityDetails;
switch (identityGcpAuth.type) { switch (identityGcpAuth.type) {
case "gce": { case "gce": {
gcpIdentityDetails = await validateGceIdentity({ gcpIdentityDetails = await validateIdTokenIdentity({
identityId, identityId,
jwt: serviceAccountJwt jwt: gcpJwt
}); });
break; break;
} }
case "iam": { case "iam": {
gcpIdentityDetails = await validateIamIdentity({ gcpIdentityDetails = await validateIamIdentity({
identityId, identityId,
jwt: serviceAccountJwt jwt: gcpJwt
}); });
break; break;
} }

2
backend/src/services/identity-gcp-auth/identity-gcp-auth-types.ts
View File

@@ -47,7 +47,7 @@ export type TGcpIdentityDetails = {
computeEngineDetails?: TComputeEngineDetails; computeEngineDetails?: TComputeEngineDetails;
}; };
export type TGcpGceIdTokenPayload = { export type TGcpIdTokenPayload = {
aud: string; aud: string;
azp: string; azp: string;
email: string; email: string;