awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 05:19:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: go greppy

Browse Source
This commit is contained in:
=
2025-10-10 00:09:48 +05:30
parent fe1bc168f6
commit 97135d9cfa
46 changed files with 150 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts
-1
View File
@@ -281,7 +281,6 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
},
data: {
...req.body,
isTemporary: true,
...updatedInfo,
// eslint-disable-next-line @typescript-eslint/ban-ts-comment
// @ts-ignore-error this is valid ts
backend/src/ee/services/github-org-sync/github-org-sync-service.ts
+46 -2
View File
@@ -6,13 +6,15 @@ import { paginateGraphql } from "@octokit/plugin-paginate-graphql";
import { Octokit as OctokitRest } from "@octokit/rest";
import RE2 from "re2";
import { OrgMembershipRole } from "@app/db/schemas";
import { AccessScope, OrgMembershipRole } from "@app/db/schemas";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { groupBy } from "@app/lib/fn";
import { logger } from "@app/lib/logger";
import { retryWithBackoff } from "@app/lib/retry";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { KmsDataKey } from "@app/services/kms/kms-types";
import { TMembershipRoleDALFactory } from "@app/services/membership/membership-role-dal";
import { TMembershipGroupDALFactory } from "@app/services/membership-group/membership-group-dal";
import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
import { TGroupDALFactory } from "../group/group-dal";
@@ -77,6 +79,8 @@ type TGithubOrgSyncServiceFactoryDep = {
"findGroupMembershipsByUserIdInOrg" | "findGroupMembershipsByGroupIdInOrg" | "insertMany" | "delete"
>;
groupDAL: Pick<TGroupDALFactory, "insertMany" | "transaction" | "find">;
membershipRoleDAL: Pick<TMembershipRoleDALFactory, "insertMany">;
membershipGroupDAL: Pick<TMembershipGroupDALFactory, "insertMany">;
licenseService: Pick<TLicenseServiceFactory, "getPlan">;
orgMembershipDAL: Pick<TOrgMembershipDALFactory, "findOrgMembershipById" | "findOrgMembershipsWithUsersByOrgId">;
};
@@ -90,7 +94,9 @@ export const githubOrgSyncServiceFactory = ({
userGroupMembershipDAL,
groupDAL,
licenseService,
orgMembershipDAL
orgMembershipDAL,
membershipRoleDAL,
membershipGroupDAL
}: TGithubOrgSyncServiceFactoryDep) => {
const createGithubOrgSync = async ({
githubOrgName,
@@ -365,6 +371,25 @@ export const githubOrgSyncServiceFactory = ({
})),
tx
);
const memberships = await membershipGroupDAL.insertMany(
newGroups.map(
(el) => ({
actorGroupId: el.id,
scope: AccessScope.Organization,
scopeOrgId: orgId
}),
tx
)
);
await membershipRoleDAL.insertMany(
memberships.map((el) => ({
membershipId: el.id,
role: OrgMembershipRole.Member
})),
tx
);
await userGroupMembershipDAL.insertMany(
newGroups.map((el) => ({
groupId: el.id,
@@ -691,6 +716,25 @@ export const githubOrgSyncServiceFactory = ({
tx
);
const memberships = await membershipGroupDAL.insertMany(
newGroups.map(
(el) => ({
actorGroupId: el.id,
scope: AccessScope.Organization,
scopeOrgId: orgPermission.orgId
}),
tx
)
);
await membershipRoleDAL.insertMany(
memberships.map((el) => ({
membershipId: el.id,
role: OrgMembershipRole.Member
})),
tx
);
newGroups.forEach((group) => {
if (!existingTeamsMap[group.name]) {
existingTeamsMap[group.name] = [];
backend/src/ee/services/group/user-group-membership-dal.ts
+1 -1
View File
@@ -71,7 +71,7 @@ export const userGroupMembershipDALFactory = (db: TDbClient) => {
const groups: string[] = await (tx || db.replicaNode())(TableName.Membership)
.where(`${TableName.Membership}.scopeProjectId`, projectId)
.whereNot(`${TableName.Membership}.actorGroupId`, groupId)
.pluck(`${TableName.Membership}.groupId`);
.pluck(`${TableName.Membership}.actorGroupId`);
// main query
const members = await (tx || db.replicaNode())(TableName.UserGroupMembership)
backend/src/ee/services/license/license-dal.ts
+1 -1
View File
@@ -36,7 +36,7 @@ export const licenseDALFactory = (db: TDbClient) => {
void bd.where(`${TableName.Membership}.scopeOrgId`, orgId);
}
})
.join(TableName.Users, `${TableName.Membership}.userId`, `${TableName.Users}.id`)
.join(TableName.Users, `${TableName.Membership}.actorUserId`, `${TableName.Users}.id`)
.where(`${TableName.Users}.isGhost`, false)
.count();
backend/src/ee/services/permission/org-permission.ts
+6 -2
View File
@@ -219,7 +219,9 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [
}),
z.object({
subject: z.literal(OrgPermissionSubjects.Groups).describe("The entity this permission pertains to."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.")
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionGroupActions).describe(
"Describe what action an entity can take."
)
}),
z.object({
subject: z.literal(OrgPermissionSubjects.SecretScanning).describe("The entity this permission pertains to."),
@@ -231,7 +233,9 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [
}),
z.object({
subject: z.literal(OrgPermissionSubjects.Identity).describe("The entity this permission pertains to."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionActions).describe("Describe what action an entity can take.")
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionIdentityActions).describe(
"Describe what action an entity can take."
)
}),
z.object({
subject: z.literal(OrgPermissionSubjects.Kms).describe("The entity this permission pertains to."),
backend/src/ee/services/permission/permission-dal.ts
+3 -2
View File
@@ -18,6 +18,7 @@ import { ActorType } from "@app/services/auth/auth-type";
interface TPermissionDataReturn extends TMemberships {
orgAuthEnforced?: boolean | null;
orgGoogleSsoAuthEnforced?: boolean | null;
shouldUseNewPrivilegeSystem?: boolean | null;
bypassOrgAuthEnabled?: boolean | null;
roles: {
id: string;
@@ -223,8 +224,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
} else if (scopeData.scope === AccessScope.Namespace) {
void qb
.where(`${TableName.Membership}.scope`, AccessScope.Namespace)
.where(`${TableName.Membership}.scopeNamespaceId`, scopeData.namespaceId)
.whereNull(`${TableName.Membership}.scopeNamespaceId`);
.where(`${TableName.Membership}.scopeNamespaceId`, scopeData.namespaceId);
} else if (scopeData.scope === AccessScope.Project) {
void qb
.where(`${TableName.Membership}.scope`, AccessScope.Project)
@@ -282,6 +282,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
parentMapper: (el) =>
MembershipsSchema.extend({
orgAuthEnforced: z.boolean().optional().nullable(),
shouldUseNewPrivilegeSystem: z.boolean().optional().nullable(),
orgGoogleSsoAuthEnforced: z.boolean(),
bypassOrgAuthEnabled: z.boolean()
}).parse(el),
backend/src/ee/services/permission/permission-service-types.ts
+6 -1
View File
@@ -66,7 +66,12 @@ export type TPermissionServiceFactory = {
actorOrgId: string | undefined
) => Promise<{
permission: MongoAbility<OrgPermissionSet, MongoQuery>;
memberships: Array<TMemberships & { roles: { role: string; customRoleSlug?: string | null }[] }>;
memberships: Array<
TMemberships & {
roles: { role: string; customRoleSlug?: string | null }[];
shouldUseNewPrivilegeSystem?: boolean | null;
}
>;
hasRole: (role: string) => boolean;
}>;
getProjectPermission: (arg: TGetProjectPermissionArg) => Promise<{
backend/src/ee/services/permission/permission-service.ts
-4
View File
@@ -258,10 +258,6 @@ export const permissionServiceFactory = ({
if (!serviceTokenProject) throw new BadRequestError({ message: "Service token not linked to a project" });
if (serviceTokenProject.orgId !== actorOrgId) {
throw new ForbiddenRequestError({ message: "Service token not a part of the specified organization" });
}
if (serviceToken.projectId !== projectId) {
throw new ForbiddenRequestError({
name: `Service token not a part of the specified project with ID ${projectId}`
backend/src/ee/services/scim/scim-service.ts
+8 -5
View File
@@ -354,11 +354,14 @@ export const scimServiceFactory = ({
},
tx
);
await membershipRoleDAL.create({
membershipId: orgMembership.id,
role,
customRoleId: roleId
});
await membershipRoleDAL.create(
{
membershipId: orgMembership.id,
role,
customRoleId: roleId
},
tx
);
} else if (orgMembership.status === OrgMembershipStatus.Invited && user.isAccepted) {
orgMembership = await membershipUserDAL.updateById(
orgMembership.id,
backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
+10 -13
View File
@@ -37,6 +37,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
.where(filter)
.join(TableName.SecretFolder, `${TableName.SecretApprovalRequest}.folderId`, `${TableName.SecretFolder}.id`)
.join(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
.join(TableName.Project, `${TableName.Environment}.projectId`, `${TableName.Project}.id`)
.join(
TableName.SecretApprovalPolicy,
`${TableName.SecretApprovalRequest}.policyId`,
@@ -111,24 +112,20 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
)
.leftJoin<TMemberships>(db(TableName.Membership).as("approverOrgMembership"), (qb) => {
qb.on(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, `approverOrgMembership.actorUserId`).andOn(
`approverOrgMembership.scope`,
db.raw("?", [AccessScope.Organization])
);
qb.on(`${TableName.SecretApprovalPolicyApprover}.approverUserId`, `approverOrgMembership.actorUserId`)
.andOn(`approverOrgMembership.scopeOrgId`, `${TableName.Project}.orgId`)
.andOn(`approverOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
})
.leftJoin<TMemberships>(db(TableName.Membership).as("approverGroupOrgMembership"), (qb) => {
qb.on(`secretApprovalPolicyGroupApproverUser.id`, `approverGroupOrgMembership.actorUserId`).andOn(
`approverGroupOrgMembership.scope`,
db.raw("?", [AccessScope.Organization])
);
qb.on(`secretApprovalPolicyGroupApproverUser.id`, `approverGroupOrgMembership.actorUserId`)
.andOn(`approverGroupOrgMembership.scopeOrgId`, `${TableName.Project}.orgId`)
.andOn(`approverGroupOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
})
.leftJoin<TMemberships>(db(TableName.Membership).as("reviewerOrgMembership"), (qb) => {
qb.on(`${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, `reviewerOrgMembership.actorUserId`).andOn(
`reviewerOrgMembership.scope`,
db.raw("?", [AccessScope.Organization])
);
qb.on(`${TableName.SecretApprovalRequestReviewer}.reviewerUserId`, `reviewerOrgMembership.actorUserId`)
.andOn(`reviewerOrgMembership.scopeOrgId`, `${TableName.Project}.orgId`)
.andOn(`reviewerOrgMembership.scope`, db.raw("?", [AccessScope.Organization]));
})
.select(selectAllTableCols(TableName.SecretApprovalRequest))
.select(