From 9ac4453523199273e410922bfce3c66063fa57af Mon Sep 17 00:00:00 2001 From: x032205 Date: Thu, 19 Jun 2025 15:12:41 -0400 Subject: [PATCH] Review fixes --- .../dynamic-secret/providers/github.ts | 13 ++++--- .../platform/dynamic-secrets/github.mdx | 36 ++++++++----------- .../CreateDynamicSecretForm.tsx | 2 +- 3 files changed, 23 insertions(+), 28 deletions(-) diff --git a/backend/src/ee/services/dynamic-secret/providers/github.ts b/backend/src/ee/services/dynamic-secret/providers/github.ts index 9b5f02c78..67d92b2a6 100644 --- a/backend/src/ee/services/dynamic-secret/providers/github.ts +++ b/backend/src/ee/services/dynamic-secret/providers/github.ts @@ -33,8 +33,8 @@ export const GithubProvider = (): TDynamicProviderFns => { const nowInSeconds = Math.floor(Date.now() / 1000); const jwtPayload = { - iat: nowInSeconds - 60, - exp: nowInSeconds + 10 * 60 - 60, + iat: nowInSeconds - 5, + exp: nowInSeconds + 60, iss: String(appId) }; @@ -110,9 +110,12 @@ export const GithubProvider = (): TDynamicProviderFns => { }; }; - const revoke = async (_inputs: unknown, entityId: string) => { - // GitHub installation access tokens cannot be revoked. - return { entityId }; + const revoke = async () => { + // GitHub installation tokens cannot be revoked. + throw new BadRequestError({ + message: + "Github dynamic secret does not support revocation because GitHub itself cannot revoke installation tokens" + }); }; const renew = async () => { diff --git a/docs/documentation/platform/dynamic-secrets/github.mdx b/docs/documentation/platform/dynamic-secrets/github.mdx index 9eced246d..b1ceb9871 100644 --- a/docs/documentation/platform/dynamic-secrets/github.mdx +++ b/docs/documentation/platform/dynamic-secrets/github.mdx @@ -1,23 +1,15 @@ --- -title: "Github" -description: "Learn how to dynamically generate Github app tokens." +title: "GitHub" +description: "Learn how to dynamically generate GitHub App tokens." --- -The Infisical Github dynamic secret allows you to generate short-lived tokens for a Github app on demand based on service account permissions. +The Infisical GitHub dynamic secret allows you to generate short-lived tokens for a GitHub App on demand based on service account permissions. - - Github app tokens cannot be revoked. As such, revoking a token on Infisical does not invalidate the Github token; it remains active until it expires. - - - - Github app tokens are fixed to a TTL of 1 hour. - - -## Setup Github App +## Setup GitHub App - Navigate to [GitHub app settings](https://github.com/settings/apps) and click **New GitHub App**. + Navigate to [GitHub App settings](https://github.com/settings/apps) and click **New GitHub App**. ![integrations github app create](/images/integrations/github/app/self-hosted-github-app-create.png) @@ -26,9 +18,9 @@ The Infisical Github dynamic secret allows you to generate short-lived tokens fo Disable webhook by unchecking the Active checkbox. ![integrations github app webhook](/images/integrations/github/app/self-hosted-github-app-webhook.png) - Configure the app's permissions to grant the necessary access for the dynamic secret's short-lived tokens. + Configure the app's permissions to grant the necessary access for the dynamic secret's short-lived tokens based on your use case. - Create the Github application. + Create the GitHub Application. ![integrations github app create confirm](/images/integrations/github/app/self-hosted-github-app-create-confirm.png) @@ -37,7 +29,7 @@ The Infisical Github dynamic secret allows you to generate short-lived tokens fo - Copy the **App ID** and generate a new **Private Key** for your Github application. + Copy the **App ID** and generate a new **Private Key** for your GitHub Application. ![integrations github app create private key](/images/integrations/github/app/self-hosted-github-app-private-key.png) Save these for later steps. @@ -53,7 +45,7 @@ The Infisical Github dynamic secret allows you to generate short-lived tokens fo -## Set up Dynamic Secrets with Github +## Set up Dynamic Secrets with GitHub @@ -62,7 +54,7 @@ The Infisical Github dynamic secret allows you to generate short-lived tokens fo ![Add Dynamic Secret Button](../../../images/platform/dynamic-secrets/add-dynamic-secret-button.png) - + ![Dynamic Secret Modal](../../../images/platform/dynamic-secrets/github/modal.png) @@ -110,11 +102,11 @@ This will allow you to see the expiration time of the lease or delete a lease be ![Lease Data](/images/platform/dynamic-secrets/lease-data.png) - Github app tokens cannot be revoked. As such, revoking a token on Infisical does not invalidate the Github token; it remains active until it expires. + GitHub App tokens cannot be revoked. As such, revoking a token on Infisical does not invalidate the GitHub token; it remains active until it expires. ## Renew Leases - - Github app tokens cannot be renewed because they are fixed to a lifetime of 1 hour. - + + GitHub App tokens cannot be renewed because they are fixed to a lifetime of 1 hour. + diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CreateDynamicSecretForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CreateDynamicSecretForm.tsx index 9e79cd0c8..18af939b1 100644 --- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CreateDynamicSecretForm.tsx +++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/CreateDynamicSecretForm.tsx @@ -148,7 +148,7 @@ const DYNAMIC_SECRET_LIST = [ { icon: , provider: DynamicSecretProviders.Github, - title: "Github" + title: "GitHub" } ];