awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Begin service account middleware

Browse Source
This commit is contained in:
Tuan Dang
2023-03-30 23:55:24 +07:00
parent 54e099f8a8
commit 9c18adf35f
31 changed files with 279 additions and 146 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/controllers/v2/serviceAccountsController.ts
View File

@@ -79,7 +79,7 @@ export const createServiceAccount = async (req: Request, res: Response) => {
const secretId = Buffer.from(serviceAccount._id.toString(), 'hex').toString('base64');
return res.status(200).send({
serviceAccountAccessKey: `SA.${secretId}.${secret}`,
serviceAccountAccessKey: `sa.${secretId}.${secret}`,
serviceAccount: serviceAccountObj
});
}
@@ -211,7 +211,7 @@ export const addServiceAccountWorkspacePermission = async (req: Request, res: Re
const existingPermission = await ServiceAccountWorkspacePermission.findOne({
serviceAccount: new Types.ObjectId(serviceAccountId),
workspaceId: new Types.ObjectId(workspaceId),
workspace: new Types.ObjectId(workspaceId),
environment
});

5
backend/src/controllers/v2/workspaceController.ts
View File

@@ -508,3 +508,8 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
});
};
export const getAak = (req: Request, res: Response) => {
return res.status(200).send({
message: 'getAak'
});
}

4
backend/src/ee/middleware/requireSecretSnapshotAuth.ts
View File

@@ -30,8 +30,8 @@ const requireSecretSnapshotAuth = ({
}
await validateMembership({
userId: req.user._id.toString(),
workspaceId: secretSnapshot.workspace.toString(),
userId: req.user._id,
workspaceId: secretSnapshot.workspace,
acceptedRoles
});

12
backend/src/ee/routes/v1/workspace.ts
View File

@@ -15,7 +15,8 @@ router.get(
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
query('offset').exists().isInt(),
@@ -30,7 +31,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -43,7 +45,8 @@ router.post(
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('version').exists().isInt(),
@@ -57,7 +60,8 @@ router.get(
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
query('offset').exists().isInt(),

37
backend/src/helpers/auth.ts
View File

@@ -5,11 +5,13 @@ import {
IUser,
User,
ServiceTokenData,
ServiceAccount,
APIKeyData
} from '../models';
import {
AccountNotFoundError,
ServiceTokenDataNotFoundError,
ServiceAccountNotFoundError,
APIKeyDataNotFoundError,
UnauthorizedRequestError,
BadRequestError
@@ -63,9 +65,13 @@ const validateAuthMode = ({
case 'st':
authTokenType = 'serviceToken';
break;
case 'sa':
authTokenType = 'serviceAccount';
break;
default:
authTokenType = 'jwt';
}
authTokenValue = tokenValue;
}
@@ -164,6 +170,36 @@ const getAuthSTDPayload = async ({
}
/**
* Return service account access key payload
* @param {Object} obj
* @param {String} obj.authTokenValue - service account access token value
* @returns {ServiceAccount} serviceAccount
*/
const getAuthSAAKPayload = async ({
authTokenValue
}: {
authTokenValue: string;
}) => {
const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3);
const serviceAccount = await ServiceAccount.findById(
Buffer.from(TOKEN_IDENTIFIER, 'base64').toString('hex')
).select('+secretHash');
if (!serviceAccount) {
throw ServiceAccountNotFoundError({ message: 'Failed to find service account' });
}
const result = await bcrypt.compare(TOKEN_SECRET, serviceAccount.secretHash);
if (!result) throw UnauthorizedRequestError({
message: 'Failed to authenticate service account access key'
});
return serviceAccount;
}
/**
* TODO: deprecate API keys
* Return API key data payload corresponding to API key [authTokenValue]
* @param {Object} obj
* @param {String} obj.authTokenValue - API key value
@@ -300,6 +336,7 @@ export {
validateAuthMode,
getAuthUserPayload,
getAuthSTDPayload,
getAuthSAAKPayload,
getAuthAPIKeyPayload,
createToken,
issueAuthTokens,

13
backend/src/helpers/membership.ts
View File

@@ -1,4 +1,5 @@
import * as Sentry from '@sentry/node';
import { Types } from 'mongoose';
import { Membership, Key } from '../models';
import {
MembershipNotFoundError,
@@ -18,9 +19,9 @@ const validateMembership = async ({
workspaceId,
acceptedRoles,
}: {
userId: string;
workspaceId: string;
acceptedRoles: string[];
userId: Types.ObjectId;
workspaceId: Types.ObjectId;
acceptedRoles?: string[];
}) => {
const membership = await Membership.findOne({
@@ -32,8 +33,10 @@ const validateMembership = async ({
throw MembershipNotFoundError({ message: 'Failed to find workspace membership' });
}
if (!acceptedRoles.includes(membership.role)) {
throw BadRequestError({ message: 'Failed to validate workspace membership role' });
if (acceptedRoles) {
if (!acceptedRoles.includes(membership.role)) {
throw BadRequestError({ message: 'Failed to validate workspace membership role' });
}
}
return membership;

51
backend/src/helpers/workspace.ts
View File

@@ -1,4 +1,5 @@
import * as Sentry from '@sentry/node';
import { Types } from 'mongoose';
import {
Workspace,
Bot,
@@ -7,6 +8,50 @@ import {
Secret
} from '../models';
import { createBot } from '../helpers/bot';
import { validateMembership } from '../helpers/membership';
/**
* Validate accepted clients by id including [userId], [serviceAccountId],
* and [serviceTokenDataId] for workspace with id [workspaceId] based
* on any known permissions.
* @param {Object} obj
* @param {Types.ObjectId} obj.userId - id of user
*/
const validateClientForWorkspace = async ({
userId,
serviceAccountId,
serviceTokenDataId,
workspaceId,
environment
}: {
userId?: Types.ObjectId;
serviceAccountId?: Types.ObjectId;
serviceTokenDataId?: Types.ObjectId;
workspaceId: Types.ObjectId;
environment?: string;
}) => {
let membership;
if (userId) {
membership = await validateMembership({
userId,
workspaceId
});
}
if (serviceAccountId) {
// TODO
}
if (serviceTokenDataId) {
// TODO
}
return ({
membership
});
}
/**
* Create a workspace with name [name] in organization with id [organizationId]
@@ -71,4 +116,8 @@ const deleteWorkspace = async ({ id }: { id: string }) => {
}
};
export { createWorkspace, deleteWorkspace };
export {
validateClientForWorkspace,
createWorkspace,
deleteWorkspace
};

14
backend/src/middleware/requireAuth.ts
View File

@@ -4,7 +4,8 @@ import {
validateAuthMode,
getAuthUserPayload,
getAuthSTDPayload,
getAuthAPIKeyPayload
getAuthAPIKeyPayload,
getAuthSAAKPayload
} from '../helpers/auth';
import {
UnauthorizedRequestError
@@ -41,14 +42,22 @@ const requireAuth = ({
acceptedAuthModes
});
req.authTokenType = authTokenType;
// attach auth payloads
let serviceTokenData: any;
switch (authTokenType) {
case 'serviceAccount':
req.serviceAccount = await getAuthSAAKPayload({
authTokenValue
});
break;
case 'serviceToken':
serviceTokenData = await getAuthSTDPayload({
authTokenValue
});
// TODO: bring this into a separate collection
requiredServiceTokenPermissions.forEach((requiredServiceTokenPermission) => {
if (!serviceTokenData.permissions.includes(requiredServiceTokenPermission)) {
return next(UnauthorizedRequestError({ message: 'Failed to authorize service token for endpoint' }));
@@ -60,6 +69,7 @@ const requireAuth = ({
break;
case 'apiKey':
// TODO: deprecate API key
req.user = await getAuthAPIKeyPayload({
authTokenValue
});
@@ -70,7 +80,7 @@ const requireAuth = ({
});
break;
}
return next();
}
}

4
backend/src/middleware/requireBotAuth.ts
View File

@@ -20,8 +20,8 @@ const requireBotAuth = ({
}
await validateMembership({
userId: req.user._id.toString(),
workspaceId: bot.workspace.toString(),
userId: req.user._id,
workspaceId: bot.workspace,
acceptedRoles
});

4
backend/src/middleware/requireIntegrationAuth.ts
View File

@@ -30,8 +30,8 @@ const requireIntegrationAuth = ({
}
await validateMembership({
userId: req.user._id.toString(),
workspaceId: integration.workspace.toString(),
userId: req.user._id,
workspaceId: integration.workspace,
acceptedRoles
});

4
backend/src/middleware/requireIntegrationAuthorizationAuth.ts
View File

@@ -38,8 +38,8 @@ const requireIntegrationAuthorizationAuth = ({
}
await validateMembership({
userId: req.user._id.toString(),
workspaceId: integrationAuth.workspace._id.toString(),
userId: req.user._id,
workspaceId: integrationAuth.workspace._id,
acceptedRoles
});

4
backend/src/middleware/requireMembershipAuth.ts
View File

@@ -40,8 +40,8 @@ const requireMembershipAuth = ({
if (!userMembership) throw new Error('Failed to validate own membership')
const targetMembership = await validateMembership({
userId: req.user._id.toString(),
workspaceId: membership.workspace.toString(),
userId: req.user._id,
workspaceId: membership.workspace,
acceptedRoles
});

4
backend/src/middleware/requireSecretAuth.ts
View File

@@ -32,8 +32,8 @@ const requireSecretAuth = ({
}
await validateMembership({
userId: req.user._id.toString(),
workspaceId: secret.workspace.toString(),
userId: req.user._id,
workspaceId: secret.workspace,
acceptedRoles
});

4
backend/src/middleware/requireServiceTokenDataAuth.ts
View File

@@ -26,8 +26,8 @@ const requireServiceTokenDataAuth = ({
if (req.user) {
// case: jwt auth
await validateMembership({
userId: req.user._id.toString(),
workspaceId: serviceTokenData.workspace.toString(),
userId: req.user._id,
workspaceId: serviceTokenData.workspace,
acceptedRoles
});
}

33
backend/src/middleware/requireWorkspaceAuth.ts
View File

@@ -1,5 +1,7 @@
import { Request, Response, NextFunction } from 'express';
import { Types } from 'mongoose';
import { validateMembership } from '../helpers/membership';
import { validateClientForWorkspace } from '../helpers/workspace';
import { UnauthorizedRequestError } from '../utils/errors';
type req = 'params' | 'body' | 'query';
@@ -13,26 +15,33 @@ type req = 'params' | 'body' | 'query';
*/
const requireWorkspaceAuth = ({
acceptedRoles,
location = 'params'
locationWorkspaceId,
locationEnvironment = undefined
}: {
acceptedRoles: string[];
location?: req;
locationWorkspaceId: req;
locationEnvironment?: req | undefined;
}) => {
return async (req: Request, res: Response, next: NextFunction) => {
try {
const { workspaceId } = req[location];
if (req.user) {
// case: jwt auth
const membership = await validateMembership({
userId: req.user._id.toString(),
workspaceId,
acceptedRoles
});
// TODO: throw errors if workspaceId or environemnt are not present
const workspaceId = req[locationWorkspaceId]?.workspaceId;
const environment = locationEnvironment ? req[locationEnvironment]?.environment : undefined;
// validate clients
const { membership } = await validateClientForWorkspace({
userId: req.user?._id,
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(workspaceId),
environment
});
if (membership) {
req.membership = membership;
}
if (
req.serviceTokenData
&& req.serviceTokenData.workspace.toString() !== workspaceId

3
backend/src/routes/v1/bot.ts
View File

@@ -16,7 +16,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim().notEmpty(),
validateRequest,

16
backend/src/routes/v1/integrationAuth.ts
View File

@@ -38,7 +38,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
body('workspaceId').exists().trim().notEmpty(),
body('code').exists().trim().notEmpty(),
@@ -49,18 +49,18 @@ router.post(
router.post(
'/access-token',
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
}),
body('workspaceId').exists().trim().notEmpty(),
body('accessId').trim(),
body('accessToken').exists().trim().notEmpty(),
body('integration').exists().trim().notEmpty(),
validateRequest,
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'body'
}),
integrationAuthController.saveIntegrationAccessToken
);

6
backend/src/routes/v1/key.ts
View File

@@ -15,7 +15,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('key').exists(),
@@ -29,7 +30,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId'),
validateRequest,

8
backend/src/routes/v1/secret.ts
View File

@@ -10,13 +10,16 @@ import { body, query, param } from 'express-validator';
import { secretController } from '../../controllers/v1';
import { ADMIN, MEMBER } from '../../variables';
// note to devs: these endpoints will be deprecated in favor of v2
router.post(
'/:workspaceId',
requireAuth({
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
body('secrets').exists(),
body('keys').exists(),
@@ -33,7 +36,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
query('environment').exists().trim(),
query('channel'),

2
backend/src/routes/v1/serviceToken.ts
View File

@@ -25,7 +25,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
body('name').exists().trim().notEmpty(),
body('workspaceId').exists().trim().notEmpty(),

25
backend/src/routes/v1/workspace.ts
View File

@@ -15,7 +15,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -29,6 +30,7 @@ router.get(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -49,7 +51,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -73,7 +76,8 @@ router.delete(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN]
acceptedRoles: [ADMIN],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -86,7 +90,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('name').exists().trim().notEmpty(),
@@ -100,7 +105,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('email').exists().trim().notEmpty(),
@@ -114,7 +120,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -127,7 +134,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -140,7 +148,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,

19
backend/src/routes/v2/secret.ts
View File

@@ -20,7 +20,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().isMongoId().trim(),
param('environment').exists().trim(),
@@ -36,7 +37,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().isMongoId().trim(),
param('environment').exists().trim(),
@@ -54,7 +56,8 @@ router.get(
acceptedAuthModes: ['jwt', 'serviceToken']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
query('channel'),
validateRequest,
@@ -82,7 +85,8 @@ router.delete(
param('environmentName').exists().trim(),
body('secretIds').exists().isArray().custom(array => array.length > 0),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
validateRequest,
secretController.deleteSecrets
@@ -110,13 +114,13 @@ router.patch(
param('workspaceId').exists().isMongoId().trim(),
param('environmentName').exists().trim(),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
validateRequest,
secretController.updateSecrets
);
router.patch(
'/workspace/:workspaceId/environment/:environmentName',
requireAuth({
@@ -126,7 +130,8 @@ router.patch(
param('workspaceId').exists().isMongoId().trim(),
param('environmentName').exists().trim(),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
validateRequest,
secretController.updateSecret

6
backend/src/routes/v2/secrets.ts
View File

@@ -27,7 +27,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
body('workspaceId').exists().isString().trim(),
body('environment').exists().isString().trim(),
@@ -105,7 +105,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
secretsController.createSecrets
);
@@ -122,7 +122,7 @@ router.get(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'query'
locationWorkspaceId: 'query'
}),
secretsController.getSecrets
);

2
backend/src/routes/v2/serviceAccounts.ts
View File

@@ -141,7 +141,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
serviceAccountsController.addServiceAccountWorkspacePermission
);

2
backend/src/routes/v2/serviceTokenData.ts
View File

@@ -28,7 +28,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
location: 'body'
locationWorkspaceId: 'body'
}),
body('name').exists().isString().trim(),
body('workspaceId').exists().isString().trim(),

32
backend/src/routes/v2/workspace.ts
View File

@@ -16,7 +16,8 @@ router.post(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
body('secrets').exists(),
body('keys').exists(),
@@ -33,7 +34,8 @@ router.get(
acceptedAuthModes: ['jwt', 'serviceToken']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
query('environment').exists().trim(),
query('channel'),
@@ -48,7 +50,8 @@ router.get(
acceptedAuthModes: ['jwt', 'apiKey']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -61,7 +64,8 @@ router.get(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -79,6 +83,7 @@ router.get( // new - TODO: rewire dashboard to this route
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
workspaceController.getWorkspaceMemberships
);
@@ -94,6 +99,7 @@ router.patch( // TODO - rewire dashboard to this route
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN],
locationWorkspaceId: 'params'
}),
requireMembershipAuth({
acceptedRoles: [ADMIN]
@@ -111,6 +117,7 @@ router.delete( // TODO - rewire dashboard to this route
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN],
locationWorkspaceId: 'params'
}),
requireMembershipAuth({
acceptedRoles: [ADMIN]
@@ -124,7 +131,8 @@ router.patch(
acceptedAuthModes: ['jwt']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('autoCapitalization').exists().trim().notEmpty(),
@@ -132,4 +140,18 @@ router.patch(
workspaceController.toggleAutoCapitalization
);
router.get(
'/:workspaceId/aak',
requireAuth({
acceptedAuthModes: ['serviceAccount']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
workspaceController.getAak
);
export default router;

1
backend/src/types/express/index.d.ts vendored
View File

@@ -24,6 +24,7 @@ declare global {
serviceTokenData: any;
apiKeyData: any;
query?: any;
authTokenType: string;
}
}
}

4
frontend/src/hooks/api/serviceAccounts/types.ts
View File

@@ -1,3 +1,5 @@
import { Workspace } from '../workspace/types';
export type ServiceAccount = {
_id: string;
name: string;
@@ -27,7 +29,7 @@ export type RenameServiceAccountDTO = {
export type ServiceAccountWorkspacePermission = {
_id: string;
serviceAccount: string;
workspace: string;
workspace: Workspace;
environment: string;
canRead: boolean;
canWrite: boolean;

20
frontend/src/pages/settings/service-account/[id].tsx
View File

@@ -1,20 +0,0 @@
/* eslint-disable @typescript-eslint/no-unused-vars */
import Head from 'next/head';
export default function NewServiceAccountPage() {
console.log('NewServiceAccountPage');
return (
<div>
<Head>
<title>Some title</title>
<link rel="icon" href="/infisical.ico" />
</Head>
<div>
Hello!
</div>
{/* <OrgSettingsPage /> */}
</div>
);
}
// NewServiceAccountPage.requireAuth = true;

38
frontend/src/views/Settings/CreateServiceAccountPage/components/SAProjectLevelPermissionsTable/SAProjectLevelPermissionsTable.tsx
View File

@@ -1,4 +1,4 @@
import { useEffect, useState } from 'react';
import { useState } from 'react';
import { Controller,useForm } from 'react-hook-form';
import {
faKey,
@@ -63,11 +63,10 @@ type Props = {
export const SAProjectLevelPermissionsTable = ({
serviceAccountId
}: Props) => {
}: Props): JSX.Element => {
const { data: serviceAccount } = useGetServiceAccountById(serviceAccountId);
const { data: userWorkspaces, isLoading: isUserWorkspacesLoading } = useGetUserWorkspaces();
const [searchPermissions, setSearchPermissions] = useState('');
const [defaultValues, setDefaultValues] = useState<CreateProjectLevelPermissionForm | undefined>(undefined);
const { data: serviceAccountWorkspacePermissions, isLoading: isPermissionsLoading } = useGetServiceAccountProjectLevelPermissions(serviceAccountId);
@@ -78,13 +77,15 @@ export const SAProjectLevelPermissionsTable = ({
'addProjectLevelPermission',
'removeProjectLevelPermission',
] as const);
const [, setSelectedWorkspace] = useState<undefined | string>(undefined);
const {
control,
handleSubmit,
reset,
formState: { isSubmitting }
} = useForm<CreateProjectLevelPermissionForm>({ resolver: yupResolver(createProjectLevelPermissionSchema), defaultValues })
} = useForm<CreateProjectLevelPermissionForm>({ resolver: yupResolver(createProjectLevelPermissionSchema) })
const onAddProjectLevelPermission = async ({
privateKey,
@@ -144,22 +145,6 @@ export const SAProjectLevelPermissionsTable = ({
handlePopUpClose('removeProjectLevelPermission');
}
useEffect(() => {
if (userWorkspaces) {
setDefaultValues({
privateKey: '',
workspace: String(userWorkspaces?.[0]?._id),
environment: String(userWorkspaces?.[0]?.environments?.[0]?.slug),
permissions: {
canRead: true,
canWrite: false,
canUpdate: false,
canDelete: false,
}
});
}
}, [userWorkspaces]);
return (
<div className="w-full bg-white/5 p-6">
<p className="mb-4 text-xl font-semibold">Project-Level Permissions</p>
@@ -217,28 +202,28 @@ export const SAProjectLevelPermissionsTable = ({
id="isReadPermissionEnabled"
isChecked={canRead}
isDisabled
/>
>{/**/}</Checkbox>
</Td>
<Td>
<Checkbox
id="isWritePermissionEnabled"
isChecked={canWrite}
isDisabled
/>
>{/**/}</Checkbox>
</Td>
<Td>
<Checkbox
id="isUpdatePermissionEnabled"
isChecked={canUpdate}
isDisabled
/>
>{/**/}</Checkbox>
</Td>
<Td>
<Checkbox
id="isDeletePermissionEnabled"
isChecked={canDelete}
isDisabled
/>
>{/**/}</Checkbox>
</Td>
<Td>
<IconButton
@@ -302,7 +287,10 @@ export const SAProjectLevelPermissionsTable = ({
<Select
defaultValue={field.value}
{...field}
onValueChange={(e) => onChange(e)}
onValueChange={(e) => {
onChange(e);
setSelectedWorkspace(e);
}}
className="w-full border border-mine-shaft-500"
>
{userWorkspaces && userWorkspaces.length > 0 ? (

44
frontend/src/views/Settings/OrgSettingsPage/components/OrgServiceAccountsTable/OrgServiceAccountsTable.tsx
View File

@@ -104,12 +104,12 @@ export const OrgServiceAccountsTable = () => {
const keyPair = generateKeyPair();
setPrivateKey(keyPair.privateKey);
const serviceAccountDetails = await createServiceAccount.mutateAsync({
name,
organizationId: currentOrg?._id,
publicKey: keyPair.publicKey,
expiresIn
expiresIn: Number(expiresIn)
});
setAccessKey(serviceAccountDetails.serviceAccountAccessKey);
@@ -152,26 +152,28 @@ export const OrgServiceAccountsTable = () => {
control={control}
name="expiresIn"
defaultValue={String(serviceAccountExpiration?.[0]?.value)}
render={({ field: { onChange, ...field }, fieldState: { error } }) => (
<FormControl
label="Expiration"
errorText={error?.message}
isError={Boolean(error)}
>
<Select
defaultValue={field.value}
{...field}
onValueChange={(e) => onChange(e)}
className="w-full"
render={({ field: { onChange, ...field }, fieldState: { error } }) => {
return (
<FormControl
label="Expiration"
errorText={error?.message}
isError={Boolean(error)}
>
{serviceAccountExpiration.map(({ label, value }) => (
<SelectItem value={String(value)} key={label}>
{label}
</SelectItem>
))}
</Select>
</FormControl>
)}
<Select
defaultValue={field.value}
{...field}
onValueChange={(e) => onChange(e)}
className="w-full"
>
{serviceAccountExpiration.map(({ label, value }) => (
<SelectItem value={String(value)} key={label}>
{label}
</SelectItem>
))}
</Select>
</FormControl>
);
}}
/>
<div className="mt-8 flex items-center">
<Button