awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 05:19:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add eslint rule and fix as many issues as possible

Browse Source
This commit is contained in:
Khoa Le
2023-06-19 23:42:04 -04:00
parent e9eacc445d
commit 9d33e4756b
689 changed files with 9446 additions and 21821 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/validation/bot.ts
+12 -12
View File
@@ -1,25 +1,25 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
Bot,
IServiceAccount,
IServiceTokenData,
Bot,
User,
IUser,
ServiceAccount,
ServiceTokenData
} from '../models';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
import { validateUserClientForWorkspace } from './user';
ServiceTokenData,
User,
} from "../models";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
import { validateUserClientForWorkspace } from "./user";
import {
BotNotFoundError,
UnauthorizedRequestError,
BotNotFoundError
} from '../utils/errors';
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
/**
* Validate authenticated clients for bot with id [botId] based
backend/src/validation/index.ts
+11 -11
View File
@@ -1,11 +1,11 @@
export * from './user';
export * from './workspace';
export * from './bot';
export * from './integration';
export * from './integrationAuth';
export * from './membership';
export * from './membershipOrg';
export * from './organization';
export * from './secrets';
export * from './serviceAccount';
export * from './serviceTokenData';
export * from "./user";
export * from "./workspace";
export * from "./bot";
export * from "./integration";
export * from "./integrationAuth";
export * from "./membership";
export * from "./membershipOrg";
export * from "./organization";
export * from "./secrets";
export * from "./serviceAccount";
export * from "./serviceTokenData";
backend/src/validation/integration.ts
+22 -22
View File
@@ -1,28 +1,28 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
IServiceAccount,
IServiceTokenData,
IUser,
Integration,
IntegrationAuth,
User,
ServiceAccount,
ServiceTokenData
} from '../models';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
import { validateUserClientForWorkspace } from './user';
import { IntegrationService } from '../services';
ServiceTokenData,
User,
} from "../models";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
import { validateUserClientForWorkspace } from "./user";
import { IntegrationService } from "../services";
import {
IntegrationNotFoundError,
IntegrationAuthNotFoundError,
UnauthorizedRequestError
} from '../utils/errors';
IntegrationNotFoundError,
UnauthorizedRequestError,
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
/**
* Validate authenticated clients for integration with id [integrationId] based
@@ -37,14 +37,14 @@ import {
export const validateClientForIntegration = async ({
authData,
integrationId,
acceptedRoles
acceptedRoles,
}: {
authData: {
authMode: string;
authPayload: IUser | IServiceAccount | IServiceTokenData;
};
integrationId: Types.ObjectId;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
}) => {
const integration = await Integration.findById(integrationId);
@@ -53,20 +53,20 @@ export const validateClientForIntegration = async ({
const integrationAuth = await IntegrationAuth
.findById(integration.integrationAuth)
.select(
'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
"+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt"
);
if (!integrationAuth) throw IntegrationAuthNotFoundError();
const accessToken = (await IntegrationService.getIntegrationAuthAccess({
integrationAuthId: integrationAuth._id
integrationAuthId: integrationAuth._id,
})).accessToken;
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: integration.workspace,
acceptedRoles
acceptedRoles,
});
return ({ integration, accessToken });
@@ -75,7 +75,7 @@ export const validateClientForIntegration = async ({
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
await validateServiceAccountClientForWorkspace({
serviceAccount: authData.authPayload,
workspaceId: integration.workspace
workspaceId: integration.workspace,
});
return ({ integration, accessToken });
@@ -83,7 +83,7 @@ export const validateClientForIntegration = async ({
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
throw UnauthorizedRequestError({
message: 'Failed service token authorization for integration'
message: "Failed service token authorization for integration",
});
}
@@ -91,13 +91,13 @@ export const validateClientForIntegration = async ({
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: integration.workspace,
acceptedRoles
acceptedRoles,
});
return ({ integration, accessToken });
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for integration'
message: "Failed client authorization for integration",
});
}
backend/src/validation/integrationAuth.ts
+25 -25
View File
@@ -1,27 +1,27 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IntegrationAuth,
IUser,
User,
IServiceAccount,
ServiceAccount,
IServiceTokenData,
IUser,
IWorkspace,
IntegrationAuth,
ServiceAccount,
ServiceTokenData,
IWorkspace
} from '../models';
User,
} from "../models";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
import {
IntegrationAuthNotFoundError,
UnauthorizedRequestError
} from '../utils/errors';
import { IntegrationService } from '../services';
import { validateUserClientForWorkspace } from './user';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
UnauthorizedRequestError,
} from "../utils/errors";
import { IntegrationService } from "../services";
import { validateUserClientForWorkspace } from "./user";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
/**
* Validate authenticated clients for integration authorization with id [integrationAuthId] based
@@ -36,22 +36,22 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
authData,
integrationAuthId,
acceptedRoles,
attachAccessToken
attachAccessToken,
}: {
authData: {
authMode: string;
authPayload: IUser | IServiceAccount | IServiceTokenData;
};
integrationAuthId: Types.ObjectId;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
attachAccessToken?: boolean;
}) => {
const integrationAuth = await IntegrationAuth
.findById(integrationAuthId)
.populate<{ workspace: IWorkspace }>('workspace')
.populate<{ workspace: IWorkspace }>("workspace")
.select(
'+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt'
"+refreshCiphertext +refreshIV +refreshTag +accessCiphertext +accessIV +accessTag +accessExpiresAt"
);
if (!integrationAuth) throw IntegrationAuthNotFoundError();
@@ -59,7 +59,7 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
let accessToken, accessId;
if (attachAccessToken) {
const access = (await IntegrationService.getIntegrationAuthAccess({
integrationAuthId: integrationAuth._id
integrationAuthId: integrationAuth._id,
}));
accessToken = access.accessToken;
@@ -70,7 +70,7 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: integrationAuth.workspace._id,
acceptedRoles
acceptedRoles,
});
return ({ integrationAuth, accessToken, accessId });
@@ -79,7 +79,7 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
await validateServiceAccountClientForWorkspace({
serviceAccount: authData.authPayload,
workspaceId: integrationAuth.workspace._id
workspaceId: integrationAuth.workspace._id,
});
return ({ integrationAuth, accessToken, accessId });
@@ -87,7 +87,7 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
throw UnauthorizedRequestError({
message: 'Failed service token authorization for integration authorization'
message: "Failed service token authorization for integration authorization",
});
}
@@ -95,17 +95,17 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: integrationAuth.workspace._id,
acceptedRoles
acceptedRoles,
});
return ({ integrationAuth, accessToken, accessId });
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for integration authorization'
message: "Failed client authorization for integration authorization",
});
}
export {
validateClientForIntegrationAuth
validateClientForIntegrationAuth,
};
backend/src/validation/membership.ts
+20 -20
View File
@@ -1,26 +1,26 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
IServiceAccount,
IServiceTokenData,
IUser,
Membership,
User,
ServiceAccount,
ServiceTokenData
} from '../models';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
import { validateUserClientForWorkspace } from './user';
import { validateServiceTokenDataClientForWorkspace } from './serviceTokenData';
ServiceTokenData,
User,
} from "../models";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
import { validateUserClientForWorkspace } from "./user";
import { validateServiceTokenDataClientForWorkspace } from "./serviceTokenData";
import {
MembershipNotFoundError,
UnauthorizedRequestError
} from '../utils/errors';
UnauthorizedRequestError,
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
/**
* Validate authenticated clients for membership with id [membershipId] based
@@ -34,27 +34,27 @@ import {
export const validateClientForMembership = async ({
authData,
membershipId,
acceptedRoles
acceptedRoles,
}: {
authData: {
authMode: string;
authPayload: IUser | IServiceAccount | IServiceTokenData;
};
membershipId: Types.ObjectId;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
}) => {
const membership = await Membership.findById(membershipId);
if (!membership) throw MembershipNotFoundError({
message: 'Failed to find membership'
message: "Failed to find membership",
});
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: membership.workspace,
acceptedRoles
acceptedRoles,
});
return membership;
@@ -63,7 +63,7 @@ export const validateClientForMembership = async ({
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
await validateServiceAccountClientForWorkspace({
serviceAccount: authData.authPayload,
workspaceId: membership.workspace
workspaceId: membership.workspace,
});
return membership;
@@ -72,7 +72,7 @@ export const validateClientForMembership = async ({
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
await validateServiceTokenDataClientForWorkspace({
serviceTokenData: authData.authPayload,
workspaceId: new Types.ObjectId(membership.workspace)
workspaceId: new Types.ObjectId(membership.workspace),
});
return membership;
@@ -82,13 +82,13 @@ export const validateClientForMembership = async ({
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: membership.workspace,
acceptedRoles
acceptedRoles,
});
return membership;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for membership'
message: "Failed client authorization for membership",
});
}
backend/src/validation/membershipOrg.ts
+20 -20
View File
@@ -1,26 +1,26 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
IServiceAccount,
IServiceTokenData,
IUser,
MembershipOrg,
User,
ServiceAccount,
ServiceTokenData
} from '../models';
ServiceTokenData,
User,
} from "../models";
import {
validateMembershipOrg
} from '../helpers/membershipOrg';
validateMembershipOrg,
} from "../helpers/membershipOrg";
import {
MembershipOrgNotFoundError,
UnauthorizedRequestError
} from '../utils/errors';
UnauthorizedRequestError,
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
/**
* Validate authenticated clients for organization membership with id [membershipOrgId] based
@@ -35,20 +35,20 @@ export const validateClientForMembershipOrg = async ({
authData,
membershipOrgId,
acceptedRoles,
acceptedStatuses
acceptedStatuses,
}: {
authData: {
authMode: string;
authPayload: IUser | IServiceAccount | IServiceTokenData;
};
membershipOrgId: Types.ObjectId;
acceptedRoles: Array<'owner' | 'admin' | 'member'>;
acceptedStatuses: Array<'invited' | 'accepted'>;
acceptedRoles: Array<"owner" | "admin" | "member">;
acceptedStatuses: Array<"invited" | "accepted">;
}) => {
const membershipOrg = await MembershipOrg.findById(membershipOrgId);
if (!membershipOrg) throw MembershipOrgNotFoundError({
message: 'Failed to find organization membership '
message: "Failed to find organization membership ",
});
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
@@ -56,7 +56,7 @@ export const validateClientForMembershipOrg = async ({
userId: authData.authPayload._id,
organizationId: membershipOrg.organization,
acceptedRoles,
acceptedStatuses
acceptedStatuses,
});
return membershipOrg;
@@ -64,7 +64,7 @@ export const validateClientForMembershipOrg = async ({
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
if (!authData.authPayload.organization.equals(membershipOrg.organization)) throw UnauthorizedRequestError({
message: 'Failed service account client authorization for organization membership'
message: "Failed service account client authorization for organization membership",
});
return membershipOrg;
@@ -72,7 +72,7 @@ export const validateClientForMembershipOrg = async ({
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
throw UnauthorizedRequestError({
message: 'Failed service account client authorization for organization membership'
message: "Failed service account client authorization for organization membership",
});
}
@@ -81,13 +81,13 @@ export const validateClientForMembershipOrg = async ({
userId: authData.authPayload._id,
organizationId: membershipOrg.organization,
acceptedRoles,
acceptedStatuses
acceptedStatuses,
});
return membershipOrg;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for organization membership'
message: "Failed client authorization for organization membership",
});
}
backend/src/validation/organization.ts
+11 -11
View File
@@ -1,25 +1,25 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
IServiceAccount,
IServiceTokenData,
IUser,
Organization,
User,
ServiceAccount,
ServiceTokenData
} from '../models';
ServiceTokenData,
User,
} from "../models";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
import {
OrganizationNotFoundError,
UnauthorizedRequestError
} from '../utils/errors';
import { validateUserClientForOrganization } from './user';
import { validateServiceAccountClientForOrganization } from './serviceAccount';
UnauthorizedRequestError,
} from "../utils/errors";
import { validateUserClientForOrganization } from "./user";
import { validateServiceAccountClientForOrganization } from "./serviceAccount";
/**
* Validate accepted clients for organization with id [organizationId]
backend/src/validation/secrets.ts
+29 -29
View File
@@ -1,26 +1,26 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
ISecret,
Secret,
User,
ServiceAccount,
ServiceTokenData
} from '../models';
import { validateServiceAccountClientForWorkspace, validateServiceAccountClientForSecrets } from './serviceAccount';
import { validateUserClientForSecret, validateUserClientForSecrets } from './user';
import { validateServiceTokenDataClientForWorkspace, validateServiceTokenDataClientForSecrets } from './serviceTokenData';
import { AuthData } from '../interfaces/middleware';
ServiceTokenData,
User,
} from "../models";
import { validateServiceAccountClientForSecrets, validateServiceAccountClientForWorkspace } from "./serviceAccount";
import { validateUserClientForSecret, validateUserClientForSecrets } from "./user";
import { validateServiceTokenDataClientForSecrets, validateServiceTokenDataClientForWorkspace } from "./serviceTokenData";
import { AuthData } from "../interfaces/middleware";
import {
BadRequestError,
SecretNotFoundError,
UnauthorizedRequestError,
BadRequestError
} from '../utils/errors';
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
} from "../variables";
/**
* Validate authenticated clients for secrets with id [secretId] based
@@ -35,17 +35,17 @@ export const validateClientForSecret = async ({
authData,
secretId,
acceptedRoles,
requiredPermissions
requiredPermissions,
}: {
authData: AuthData;
secretId: Types.ObjectId;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
requiredPermissions: string[];
}) => {
const secret = await Secret.findById(secretId);
if (!secret) throw SecretNotFoundError({
message: 'Failed to find secret'
message: "Failed to find secret",
});
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
@@ -53,7 +53,7 @@ export const validateClientForSecret = async ({
user: authData.authPayload,
secret,
acceptedRoles,
requiredPermissions
requiredPermissions,
});
return secret;
@@ -64,7 +64,7 @@ export const validateClientForSecret = async ({
serviceAccount: authData.authPayload,
workspaceId: secret.workspace,
environment: secret.environment,
requiredPermissions
requiredPermissions,
});
return secret;
@@ -74,7 +74,7 @@ export const validateClientForSecret = async ({
await validateServiceTokenDataClientForWorkspace({
serviceTokenData: authData.authPayload,
workspaceId: secret.workspace,
environment: secret.environment
environment: secret.environment,
});
return secret;
@@ -85,14 +85,14 @@ export const validateClientForSecret = async ({
user: authData.authPayload,
secret,
acceptedRoles,
requiredPermissions
requiredPermissions,
});
return secret;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for secret'
message: "Failed client authorization for secret",
});
}
@@ -109,7 +109,7 @@ export const validateClientForSecret = async ({
export const validateClientForSecrets = async ({
authData,
secretIds,
requiredPermissions
requiredPermissions,
}: {
authData: AuthData;
secretIds: Types.ObjectId[];
@@ -120,19 +120,19 @@ export const validateClientForSecrets = async ({
secrets = await Secret.find({
_id: {
$in: secretIds
}
$in: secretIds,
},
});
if (secrets.length != secretIds.length) {
throw BadRequestError({ message: 'Failed to validate non-existent secrets' })
throw BadRequestError({ message: "Failed to validate non-existent secrets" })
}
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
await validateUserClientForSecrets({
user: authData.authPayload,
secrets,
requiredPermissions
requiredPermissions,
});
return secrets;
@@ -142,7 +142,7 @@ export const validateClientForSecrets = async ({
await validateServiceAccountClientForSecrets({
serviceAccount: authData.authPayload,
secrets,
requiredPermissions
requiredPermissions,
});
return secrets;
@@ -152,7 +152,7 @@ export const validateClientForSecrets = async ({
await validateServiceTokenDataClientForSecrets({
serviceTokenData: authData.authPayload,
secrets,
requiredPermissions
requiredPermissions,
});
return secrets;
@@ -162,13 +162,13 @@ export const validateClientForSecrets = async ({
await validateUserClientForSecrets({
user: authData.authPayload,
secrets,
requiredPermissions
requiredPermissions,
});
return secrets;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for secrets resource'
message: "Failed client authorization for secrets resource",
});
}
backend/src/validation/serviceAccount.ts
+37 -37
View File
@@ -1,35 +1,35 @@
import _ from 'lodash';
import { Types } from 'mongoose';
import _ from "lodash";
import { Types } from "mongoose";
import {
User,
IOrganization,
ISecret,
IServiceAccount,
IServiceTokenData,
IUser,
ServiceAccount,
IServiceAccount,
ServiceAccountWorkspacePermission,
ServiceTokenData,
IServiceTokenData,
ISecret,
IOrganization,
ServiceAccountWorkspacePermission
} from '../models';
import { validateUserClientForServiceAccount } from './user';
User,
} from "../models";
import { validateUserClientForServiceAccount } from "./user";
import {
BadRequestError,
ServiceAccountNotFoundError,
UnauthorizedRequestError,
ServiceAccountNotFoundError
} from '../utils/errors';
} from "../utils/errors";
import {
PERMISSION_READ_SECRETS,
PERMISSION_WRITE_SECRETS,
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
PERMISSION_READ_SECRETS,
PERMISSION_WRITE_SECRETS,
} from "../variables";
export const validateClientForServiceAccount = async ({
authData,
serviceAccountId,
requiredPermissions
requiredPermissions,
}: {
authData: {
authMode: string;
@@ -42,7 +42,7 @@ export const validateClientForServiceAccount = async ({
if (!serviceAccount) {
throw ServiceAccountNotFoundError({
message: 'Failed to find service account'
message: "Failed to find service account",
});
}
@@ -50,7 +50,7 @@ export const validateClientForServiceAccount = async ({
await validateUserClientForServiceAccount({
user: authData.authPayload,
serviceAccount,
requiredPermissions
requiredPermissions,
});
return serviceAccount;
@@ -60,7 +60,7 @@ export const validateClientForServiceAccount = async ({
await validateServiceAccountClientForServiceAccount({
serviceAccount: authData.authPayload,
targetServiceAccount: serviceAccount,
requiredPermissions
requiredPermissions,
});
return serviceAccount;
@@ -68,7 +68,7 @@ export const validateClientForServiceAccount = async ({
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
throw UnauthorizedRequestError({
message: 'Failed service token authorization for service account resource'
message: "Failed service token authorization for service account resource",
});
}
@@ -76,14 +76,14 @@ export const validateClientForServiceAccount = async ({
await validateUserClientForServiceAccount({
user: authData.authPayload,
serviceAccount,
requiredPermissions
requiredPermissions,
});
return serviceAccount;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for service account resource'
message: "Failed client authorization for service account resource",
});
}
@@ -101,7 +101,7 @@ export const validateServiceAccountClientForWorkspace = async ({
serviceAccount,
workspaceId,
environment,
requiredPermissions
requiredPermissions,
}: {
serviceAccount: IServiceAccount;
workspaceId: Types.ObjectId;
@@ -115,11 +115,11 @@ export const validateServiceAccountClientForWorkspace = async ({
const permission = await ServiceAccountWorkspacePermission.findOne({
serviceAccount,
workspace: new Types.ObjectId(workspaceId),
environment
environment,
});
if (!permission) throw UnauthorizedRequestError({
message: 'Failed service account authorization for the given workspace environment'
message: "Failed service account authorization for the given workspace environment",
});
let runningIsDisallowed = false;
@@ -137,7 +137,7 @@ export const validateServiceAccountClientForWorkspace = async ({
if (runningIsDisallowed) {
throw UnauthorizedRequestError({
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`,
});
}
});
@@ -149,11 +149,11 @@ export const validateServiceAccountClientForWorkspace = async ({
const permission = await ServiceAccountWorkspacePermission.findOne({
serviceAccount,
workspace: new Types.ObjectId(workspaceId)
workspace: new Types.ObjectId(workspaceId),
});
if (!permission) throw UnauthorizedRequestError({
message: 'Failed service account authorization for the given workspace'
message: "Failed service account authorization for the given workspace",
});
}
}
@@ -169,7 +169,7 @@ export const validateServiceAccountClientForWorkspace = async ({
export const validateServiceAccountClientForSecrets = async ({
serviceAccount,
secrets,
requiredPermissions
requiredPermissions,
}: {
serviceAccount: IServiceAccount;
secrets: ISecret[];
@@ -177,7 +177,7 @@ export const validateServiceAccountClientForSecrets = async ({
}) => {
const permissions = await ServiceAccountWorkspacePermission.find({
serviceAccount: serviceAccount._id
serviceAccount: serviceAccount._id,
});
const permissionsObj = _.keyBy(permissions, (p) => {
@@ -188,7 +188,7 @@ export const validateServiceAccountClientForSecrets = async ({
const permission = permissionsObj[`${secret.workspace.toString()}-${secret.environment}`];
if (!permission) throw BadRequestError({
message: 'Failed to find any permission for the secret workspace and environment'
message: "Failed to find any permission for the secret workspace and environment",
});
requiredPermissions?.forEach((requiredPermission: string) => {
@@ -207,7 +207,7 @@ export const validateServiceAccountClientForSecrets = async ({
if (runningIsDisallowed) {
throw UnauthorizedRequestError({
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`,
});
}
});
@@ -226,7 +226,7 @@ export const validateServiceAccountClientForSecrets = async ({
export const validateServiceAccountClientForServiceAccount = ({
serviceAccount,
targetServiceAccount,
requiredPermissions
requiredPermissions,
}: {
serviceAccount: IServiceAccount;
targetServiceAccount: IServiceAccount;
@@ -234,7 +234,7 @@ export const validateServiceAccountClientForServiceAccount = ({
}) => {
if (!serviceAccount.organization.equals(targetServiceAccount.organization)) {
throw UnauthorizedRequestError({
message: 'Failed service account authorization for the given service account'
message: "Failed service account authorization for the given service account",
});
}
}
@@ -247,14 +247,14 @@ export const validateServiceAccountClientForServiceAccount = ({
*/
export const validateServiceAccountClientForOrganization = async ({
serviceAccount,
organization
organization,
}: {
serviceAccount: IServiceAccount;
organization: IOrganization;
}) => {
if (!serviceAccount.organization.equals(organization._id)) {
throw UnauthorizedRequestError({
message: 'Failed service account authorization for the given organization'
message: "Failed service account authorization for the given organization",
});
}
}
backend/src/validation/serviceTokenData.ts
+31 -31
View File
@@ -1,25 +1,25 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
ISecret,
IServiceTokenData,
ServiceTokenData,
IUser,
User,
IServiceAccount,
IServiceTokenData,
IUser,
ServiceAccount,
} from '../models';
ServiceTokenData,
User,
} from "../models";
import {
ServiceTokenDataNotFoundError,
UnauthorizedRequestError,
ServiceTokenDataNotFoundError
} from '../utils/errors';
} from "../utils/errors";
import {
AUTH_MODE_JWT,
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
import { validateUserClientForWorkspace } from './user';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
} from "../variables";
import { validateUserClientForWorkspace } from "./user";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
/**
* Validate authenticated clients for service token with id [serviceTokenId] based
@@ -32,29 +32,29 @@ import { validateServiceAccountClientForWorkspace } from './serviceAccount';
export const validateClientForServiceTokenData = async ({
authData,
serviceTokenDataId,
acceptedRoles
acceptedRoles,
}: {
authData: {
authMode: string;
authPayload: IUser | IServiceAccount | IServiceTokenData;
};
serviceTokenDataId: Types.ObjectId;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
}) => {
const serviceTokenData = await ServiceTokenData
.findById(serviceTokenDataId)
.select('+encryptedKey +iv +tag')
.populate<{ user: IUser }>('user');
.select("+encryptedKey +iv +tag")
.populate<{ user: IUser }>("user");
if (!serviceTokenData) throw ServiceTokenDataNotFoundError({
message: 'Failed to find service token data'
message: "Failed to find service token data",
});
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: serviceTokenData.workspace,
acceptedRoles
acceptedRoles,
});
return serviceTokenData;
@@ -63,7 +63,7 @@ export const validateClientForServiceTokenData = async ({
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
await validateServiceAccountClientForWorkspace({
serviceAccount: authData.authPayload,
workspaceId: serviceTokenData.workspace
workspaceId: serviceTokenData.workspace,
});
return serviceTokenData;
@@ -71,7 +71,7 @@ export const validateClientForServiceTokenData = async ({
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
throw UnauthorizedRequestError({
message: 'Failed service token authorization for service token data'
message: "Failed service token authorization for service token data",
});
}
@@ -79,14 +79,14 @@ export const validateClientForServiceTokenData = async ({
await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId: serviceTokenData.workspace,
acceptedRoles
acceptedRoles,
});
return serviceTokenData;
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for service token data'
message: "Failed client authorization for service token data",
});
}
@@ -104,7 +104,7 @@ export const validateServiceTokenDataClientForWorkspace = async ({
serviceTokenData,
workspaceId,
environment,
requiredPermissions
requiredPermissions,
}: {
serviceTokenData: IServiceTokenData;
workspaceId: Types.ObjectId;
@@ -114,7 +114,7 @@ export const validateServiceTokenDataClientForWorkspace = async ({
if (!serviceTokenData.workspace.equals(workspaceId)) {
// case: invalid workspaceId passed
throw UnauthorizedRequestError({
message: 'Failed service token authorization for the given workspace'
message: "Failed service token authorization for the given workspace",
});
}
@@ -124,14 +124,14 @@ export const validateServiceTokenDataClientForWorkspace = async ({
if (serviceTokenData.environment !== environment) {
// case: invalid environment passed
throw UnauthorizedRequestError({
message: 'Failed service token authorization for the given workspace environment'
message: "Failed service token authorization for the given workspace environment",
});
}
requiredPermissions?.forEach((permission) => {
if (!serviceTokenData.permissions.includes(permission)) {
throw UnauthorizedRequestError({
message: `Failed service token authorization for the given workspace environment action: ${permission}`
message: `Failed service token authorization for the given workspace environment action: ${permission}`,
});
}
});
@@ -149,7 +149,7 @@ export const validateServiceTokenDataClientForWorkspace = async ({
export const validateServiceTokenDataClientForSecrets = async ({
serviceTokenData,
secrets,
requiredPermissions
requiredPermissions,
}: {
serviceTokenData: IServiceTokenData;
secrets: ISecret[];
@@ -160,21 +160,21 @@ export const validateServiceTokenDataClientForSecrets = async ({
if (!serviceTokenData.workspace.equals(secret.workspace)) {
// case: invalid workspaceId passed
throw UnauthorizedRequestError({
message: 'Failed service token authorization for the given workspace'
message: "Failed service token authorization for the given workspace",
});
}
if (serviceTokenData.environment !== secret.environment) {
// case: invalid environment passed
throw UnauthorizedRequestError({
message: 'Failed service token authorization for the given workspace environment'
message: "Failed service token authorization for the given workspace environment",
});
}
requiredPermissions?.forEach((permission) => {
if (!serviceTokenData.permissions.includes(permission)) {
throw UnauthorizedRequestError({
message: `Failed service token authorization for the given workspace environment action: ${permission}`
message: `Failed service token authorization for the given workspace environment action: ${permission}`,
});
}
});
backend/src/validation/user.ts
+36 -36
View File
@@ -1,37 +1,37 @@
import fs from 'fs';
import path from 'path';
import { Types } from 'mongoose';
import fs from "fs";
import path from "path";
import { Types } from "mongoose";
import {
IUser,
IOrganization,
ISecret,
IServiceAccount,
IUser,
Membership,
IOrganization,
} from '../models';
import { validateMembership } from '../helpers/membership';
import _ from 'lodash';
import { BadRequestError, UnauthorizedRequestError, ValidationError } from '../utils/errors';
} from "../models";
import { validateMembership } from "../helpers/membership";
import _ from "lodash";
import { BadRequestError, UnauthorizedRequestError, ValidationError } from "../utils/errors";
import {
validateMembershipOrg
} from '../helpers/membershipOrg';
validateMembershipOrg,
} from "../helpers/membershipOrg";
import {
PERMISSION_READ_SECRETS,
PERMISSION_WRITE_SECRETS
} from '../variables';
PERMISSION_WRITE_SECRETS,
} from "../variables";
/**
* Validate that email [email] is not disposable
* @param email - email to validate
*/
export const validateUserEmail = (email: string) => {
const emailDomain = email.split('@')[1];
const emailDomain = email.split("@")[1];
const disposableEmails = fs.readFileSync(
path.resolve(__dirname, '../data/' + 'disposable_emails.txt'),
'utf8'
).split('\n');
path.resolve(__dirname, "../data/" + "disposable_emails.txt"),
"utf8"
).split("\n");
if (disposableEmails.includes(emailDomain)) throw ValidationError({
message: 'Failed to validate email as non-disposable'
message: "Failed to validate email as non-disposable",
});
}
@@ -50,12 +50,12 @@ export const validateUserClientForWorkspace = async ({
workspaceId,
environment,
acceptedRoles,
requiredPermissions
requiredPermissions,
}: {
user: IUser;
workspaceId: Types.ObjectId;
environment?: string;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
requiredPermissions?: string[];
}) => {
@@ -63,7 +63,7 @@ export const validateUserClientForWorkspace = async ({
const membership = await validateMembership({
userId: user._id,
workspaceId,
acceptedRoles
acceptedRoles,
});
let runningIsDisallowed = false;
@@ -81,7 +81,7 @@ export const validateUserClientForWorkspace = async ({
if (runningIsDisallowed) {
throw UnauthorizedRequestError({
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`
message: `Failed permissions authorization for workspace environment action : ${requiredPermission}`,
});
}
});
@@ -101,17 +101,17 @@ export const validateUserClientForSecret = async ({
user,
secret,
acceptedRoles,
requiredPermissions
requiredPermissions,
}: {
user: IUser;
secret: ISecret;
acceptedRoles?: Array<'admin' | 'member'>;
acceptedRoles?: Array<"admin" | "member">;
requiredPermissions?: string[];
}) => {
const membership = await validateMembership({
userId: user._id,
workspaceId: secret.workspace,
acceptedRoles
acceptedRoles,
});
if (requiredPermissions?.includes(PERMISSION_WRITE_SECRETS)) {
@@ -119,7 +119,7 @@ export const validateUserClientForSecret = async ({
if (isDisallowed) {
throw UnauthorizedRequestError({
message: 'You do not have the required permissions to perform this action'
message: "You do not have the required permissions to perform this action",
});
}
}
@@ -136,7 +136,7 @@ export const validateUserClientForSecret = async ({
export const validateUserClientForSecrets = async ({
user,
secrets,
requiredPermissions
requiredPermissions,
}: {
user: IUser;
secrets: ISecret[];
@@ -146,14 +146,14 @@ export const validateUserClientForSecrets = async ({
// TODO: add acceptedRoles?
const userMemberships = await Membership.find({ user: user._id })
const userMembershipById = _.keyBy(userMemberships, 'workspace');
const userMembershipById = _.keyBy(userMemberships, "workspace");
const workspaceIdsSet = new Set(userMemberships.map((m) => m.workspace.toString()));
// for each secret check if the secret belongs to a workspace the user is a member of
secrets.forEach((secret: ISecret) => {
if (!workspaceIdsSet.has(secret.workspace.toString())) {
throw BadRequestError({
message: 'Failed authorization for the secret'
message: "Failed authorization for the secret",
});
}
@@ -163,7 +163,7 @@ export const validateUserClientForSecrets = async ({
if (isDisallowed) {
throw UnauthorizedRequestError({
message: 'You do not have the required permissions to perform this action'
message: "You do not have the required permissions to perform this action",
});
}
}
@@ -181,7 +181,7 @@ export const validateUserClientForSecrets = async ({
export const validateUserClientForServiceAccount = async ({
user,
serviceAccount,
requiredPermissions
requiredPermissions,
}: {
user: IUser;
serviceAccount: IServiceAccount;
@@ -194,7 +194,7 @@ export const validateUserClientForServiceAccount = async ({
userId: user._id,
organizationId: serviceAccount.organization,
acceptedRoles: [],
acceptedStatuses: []
acceptedStatuses: [],
});
}
}
@@ -209,18 +209,18 @@ export const validateUserClientForOrganization = async ({
user,
organization,
acceptedRoles,
acceptedStatuses
acceptedStatuses,
}: {
user: IUser;
organization: IOrganization;
acceptedRoles: Array<'owner' | 'admin' | 'member'>;
acceptedStatuses: Array<'invited' | 'accepted'>;
acceptedRoles: Array<"owner" | "admin" | "member">;
acceptedStatuses: Array<"invited" | "accepted">;
}) => {
const membershipOrg = await validateMembershipOrg({
userId: user._id,
organizationId: organization._id,
acceptedRoles,
acceptedStatuses
acceptedStatuses,
});
return membershipOrg;
backend/src/validation/workspace.ts
+25 -25
View File
@@ -1,29 +1,29 @@
import { Types } from 'mongoose';
import { Types } from "mongoose";
import {
IUser,
IServiceAccount,
IServiceTokenData,
Workspace,
User,
IUser,
SecretBlindIndexData,
ServiceAccount,
ServiceTokenData,
SecretBlindIndexData
} from '../models';
import { validateServiceAccountClientForWorkspace } from './serviceAccount';
import { validateUserClientForWorkspace } from './user';
import { validateServiceTokenDataClientForWorkspace } from './serviceTokenData';
User,
Workspace,
} from "../models";
import { validateServiceAccountClientForWorkspace } from "./serviceAccount";
import { validateUserClientForWorkspace } from "./user";
import { validateServiceTokenDataClientForWorkspace } from "./serviceTokenData";
import {
BadRequestError,
UnauthorizedRequestError,
WorkspaceNotFoundError
} from '../utils/errors';
WorkspaceNotFoundError,
} from "../utils/errors";
import {
AUTH_MODE_API_KEY,
AUTH_MODE_JWT,
AUTH_MODE_SERVICE_ACCOUNT,
AUTH_MODE_SERVICE_TOKEN,
AUTH_MODE_API_KEY
} from '../variables';
import { BotService } from '../services';
} from "../variables";
import { BotService } from "../services";
/**
* Validate authenticated clients for workspace with id [workspaceId] based
@@ -42,7 +42,7 @@ export const validateClientForWorkspace = async ({
acceptedRoles,
requiredPermissions,
requireBlindIndicesEnabled,
requireE2EEOff
requireE2EEOff,
}: {
authData: {
authMode: string;
@@ -50,7 +50,7 @@ export const validateClientForWorkspace = async ({
};
workspaceId: Types.ObjectId;
environment?: string;
acceptedRoles: Array<'admin' | 'member'>;
acceptedRoles: Array<"admin" | "member">;
requiredPermissions?: string[];
requireBlindIndicesEnabled: boolean;
requireE2EEOff: boolean;
@@ -58,7 +58,7 @@ export const validateClientForWorkspace = async ({
const workspace = await Workspace.findById(workspaceId);
if (!workspace) throw WorkspaceNotFoundError({
message: 'Failed to find workspace'
message: "Failed to find workspace",
});
if (requireBlindIndicesEnabled) {
@@ -67,11 +67,11 @@ export const validateClientForWorkspace = async ({
// and no admin has enabled it)
const secretBlindIndexData = await SecretBlindIndexData.exists({
workspace: new Types.ObjectId(workspaceId)
workspace: new Types.ObjectId(workspaceId),
});
if (!secretBlindIndexData) throw UnauthorizedRequestError({
message: 'Failed workspace authorization due to blind indices not being enabled'
message: "Failed workspace authorization due to blind indices not being enabled",
});
}
@@ -79,7 +79,7 @@ export const validateClientForWorkspace = async ({
const isWorkspaceE2EE = await BotService.getIsWorkspaceE2EE(workspaceId);
if (isWorkspaceE2EE) throw BadRequestError({
message: 'Failed workspace authorization due to end-to-end encryption not being disabled'
message: "Failed workspace authorization due to end-to-end encryption not being disabled",
});
}
@@ -89,7 +89,7 @@ export const validateClientForWorkspace = async ({
workspaceId,
environment,
acceptedRoles,
requiredPermissions
requiredPermissions,
});
return ({ membership, workspace });
@@ -100,7 +100,7 @@ export const validateClientForWorkspace = async ({
serviceAccount: authData.authPayload,
workspaceId,
environment,
requiredPermissions
requiredPermissions,
});
return {};
@@ -111,7 +111,7 @@ export const validateClientForWorkspace = async ({
serviceTokenData: authData.authPayload,
workspaceId,
environment,
requiredPermissions
requiredPermissions,
});
return {};
@@ -123,13 +123,13 @@ export const validateClientForWorkspace = async ({
workspaceId,
environment,
acceptedRoles,
requiredPermissions
requiredPermissions,
});
return ({ membership, workspace });
}
throw UnauthorizedRequestError({
message: 'Failed client authorization for workspace'
message: "Failed client authorization for workspace",
});
}