awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 22:51:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: standardize org ID's on auth requests

Browse Source
This commit is contained in:
Daniel Hougaard
2024-03-17 18:48:09 +01:00
parent 92441e018f
commit 96abbd9f80
5 changed files with 36 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/plugins/auth/inject-identity.ts
+10 -1
View File
@@ -30,6 +30,7 @@ export type TAuthMode =
serviceToken: TServiceTokens & { createdByEmail: string };
actor: ActorType.SERVICE;
serviceTokenId: string;
orgId: string;
}
| {
authMode: AuthMode.IDENTITY_ACCESS_TOKEN;
@@ -99,8 +100,12 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
if (!authMode) return;
switch (authMode) {
// May or may not have an orgId. If it doesn't have an org ID, it's likely because the token is from an org that doesn't enforce org-level auth.
case AuthMode.JWT: {
const { user, tokenVersionId, orgId } = await server.services.authToken.fnValidateJwtIdentity(token);
const { user, tokenVersionId, orgId } = await server.services.authToken.fnValidateJwtIdentity(
token,
req.headers?.["x-infisical-organization-id"]
);
req.auth = { authMode: AuthMode.JWT, user, userId: user.id, tokenVersionId, actor, orgId };
break;
}
@@ -116,21 +121,25 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
};
break;
}
// Will always contain an orgId.
case AuthMode.SERVICE_TOKEN: {
const serviceToken = await server.services.serviceToken.fnValidateServiceToken(token);
req.auth = {
authMode: AuthMode.SERVICE_TOKEN as const,
serviceToken,
orgId: serviceToken.orgId,
serviceTokenId: serviceToken.id,
actor
};
break;
}
// Will never contain an orgId. API keys are not tied to an organization.
case AuthMode.API_KEY: {
const user = await server.services.apiKey.fnValidateApiKey(token as string);
req.auth = { authMode: AuthMode.API_KEY as const, userId: user.id, actor, user };
break;
}
// OK
case AuthMode.SCIM_TOKEN: {
const { orgId, scimTokenId } = await server.services.scim.fnValidateScimToken(token);
req.auth = { authMode: AuthMode.SCIM_TOKEN, actor, scimTokenId, orgId };
backend/src/server/plugins/auth/inject-permission.ts
+1 -1
View File
@@ -13,7 +13,7 @@ export const injectPermission = fp(async (server) => {
} else if (req.auth.actor === ActorType.IDENTITY) {
req.permission = { type: ActorType.IDENTITY, id: req.auth.identityId, orgId: req.auth.orgId };
} else if (req.auth.actor === ActorType.SERVICE) {
req.permission = { type: ActorType.SERVICE, id: req.auth.serviceTokenId };
req.permission = { type: ActorType.SERVICE, id: req.auth.serviceTokenId, orgId: req.auth.orgId };
} else if (req.auth.actor === ActorType.SCIM_CLIENT) {
req.permission = { type: ActorType.SCIM_CLIENT, id: req.auth.scimTokenId, orgId: req.auth.orgId };
}