awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 21:40:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Begin refactoring middleware for service accounts

Browse Source
This commit is contained in:
Tuan Dang
2023-04-04 11:08:03 +03:00
parent c797901778
commit aa53de9070
39 changed files with 943 additions and 577 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/v2/environment.ts
+4
View File
@@ -16,6 +16,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('environmentSlug').exists().trim(),
@@ -31,6 +32,7 @@ router.put(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('environmentSlug').exists().trim(),
@@ -47,6 +49,7 @@ router.delete(
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('environmentSlug').exists().trim(),
@@ -61,6 +64,7 @@ router.get(
}),
requireWorkspaceAuth({
acceptedRoles: [MEMBER, ADMIN],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
backend/src/routes/v2/secrets.ts
+23 -21
View File
@@ -8,12 +8,14 @@ import {
} from '../../middleware';
import { query, body } from 'express-validator';
import { secretsController } from '../../controllers/v2';
import { validateSecrets } from '../../helpers/secret';
import { validateClientForSecrets } from '../../helpers/secrets';
import {
ADMIN,
MEMBER,
SECRET_PERSONAL,
SECRET_SHARED
SECRET_SHARED,
PERMISSION_READ_SECRETS,
PERMISSION_WRITE_SECRETS
} from '../../variables';
import {
BatchSecretRequest
@@ -22,8 +24,7 @@ import {
router.post(
'/batch',
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken'],
requiredServiceTokenPermissions: ['read', 'write']
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
@@ -40,12 +41,11 @@ router.post(
.filter((secretId) => secretId !== undefined)
if (secretIds.length > 0) {
const relevantSecrets = await validateSecrets({
userId: req.user._id.toString(),
secretIds
req.secrets = await validateClientForSecrets({
authData: req.authData,
secretIds,
requiredPermissions: []
});
req.secrets = relevantSecrets;
}
}
return true;
@@ -100,12 +100,13 @@ router.post(
}),
validateRequest,
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken'],
requiredServiceTokenPermissions: ['write']
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken', 'serviceAccount']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'body'
locationWorkspaceId: 'body',
locationEnvironment: 'body',
requiredPermissions: [PERMISSION_WRITE_SECRETS]
}),
secretsController.createSecrets
);
@@ -117,12 +118,13 @@ router.get(
query('tagSlugs'),
validateRequest,
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken'],
requiredServiceTokenPermissions: ['read']
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken', 'serviceAccount']
}),
requireWorkspaceAuth({
acceptedRoles: [ADMIN, MEMBER],
locationWorkspaceId: 'query'
locationWorkspaceId: 'query',
locationEnvironment: 'query',
requiredPermissions: [PERMISSION_READ_SECRETS]
}),
secretsController.getSecrets
);
@@ -157,11 +159,11 @@ router.patch(
}),
validateRequest,
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken'],
requiredServiceTokenPermissions: ['write']
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken', 'serviceAccount']
}),
requireSecretsAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
requiredPermissions: [PERMISSION_WRITE_SECRETS]
}),
secretsController.updateSecrets
);
@@ -186,11 +188,11 @@ router.delete(
.isEmpty(),
validateRequest,
requireAuth({
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken'],
requiredServiceTokenPermissions: ['write']
acceptedAuthModes: ['jwt', 'apiKey', 'serviceToken', 'serviceAccount']
}),
requireSecretsAuth({
acceptedRoles: [ADMIN, MEMBER]
acceptedRoles: [ADMIN, MEMBER],
requiredPermissions: [PERMISSION_WRITE_SECRETS]
}),
secretsController.deleteSecrets
);
backend/src/routes/v2/serviceAccounts.ts
+2 -4
View File
@@ -125,10 +125,8 @@ router.post(
param('serviceAccountId').exists().isString().trim(),
body('workspaceId').exists().isString().notEmpty(),
body('environment').exists().isString().notEmpty(),
body('canRead').isBoolean().optional(),
body('canWrite').isBoolean().optional(),
body('canUpdate').isBoolean().optional(),
body('canDelete').isBoolean().optional(),
body('read').isBoolean().optional(),
body('write').isBoolean().optional(),
body('encryptedKey').exists().isString().notEmpty(),
body('nonce').exists().isString().notEmpty(),
validateRequest,
backend/src/routes/v2/tags.ts
+3 -1
View File
@@ -5,7 +5,7 @@ import { tagController } from '../../controllers/v2';
import {
requireAuth,
requireWorkspaceAuth,
validateRequest,
validateRequest
} from '../../middleware';
import { ADMIN, MEMBER } from '../../variables';
@@ -16,6 +16,7 @@ router.get(
}),
requireWorkspaceAuth({
acceptedRoles: [MEMBER, ADMIN],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
validateRequest,
@@ -39,6 +40,7 @@ router.post(
}),
requireWorkspaceAuth({
acceptedRoles: [MEMBER, ADMIN],
locationWorkspaceId: 'params'
}),
param('workspaceId').exists().trim(),
body('name').exists().trim(),