From b6cc17d62aecdcd1bab8782ce64e0b9e7f004232 Mon Sep 17 00:00:00 2001 From: = Date: Sun, 23 Jun 2024 01:21:26 +0530 Subject: [PATCH] feat: updated var names and permission, rate limit changes based on comments --- .../src/server/routes/v1/identity-aws-iam-auth-router.ts | 2 +- backend/src/server/routes/v1/identity-azure-auth-router.ts | 2 +- backend/src/server/routes/v1/identity-gcp-auth-router.ts | 2 +- .../src/server/routes/v1/identity-kubernetes-auth-router.ts | 2 +- .../{identity-ua.ts => identity-universal-auth-router.ts} | 4 ++-- backend/src/server/routes/v1/index.ts | 2 +- .../services/identity-aws-auth/identity-aws-auth-service.ts | 6 +++--- .../identity-azure-auth/identity-azure-auth-service.ts | 6 +++--- .../services/identity-gcp-auth/identity-gcp-auth-service.ts | 6 +++--- .../identity-kubernetes-auth-service.ts | 6 +++--- backend/src/services/identity-ua/identity-ua-service.ts | 2 +- 11 files changed, 20 insertions(+), 20 deletions(-) rename backend/src/server/routes/v1/{identity-ua.ts => identity-universal-auth-router.ts} (100%) diff --git a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts index d3530797c..8a85323a6 100644 --- a/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts +++ b/backend/src/server/routes/v1/identity-aws-iam-auth-router.ts @@ -271,7 +271,7 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider) method: "DELETE", url: "/aws-auth/identities/:identityId", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v1/identity-azure-auth-router.ts b/backend/src/server/routes/v1/identity-azure-auth-router.ts index bd18102cc..6b4a7fb37 100644 --- a/backend/src/server/routes/v1/identity-azure-auth-router.ts +++ b/backend/src/server/routes/v1/identity-azure-auth-router.ts @@ -265,7 +265,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider method: "DELETE", url: "/azure-auth/identities/:identityId", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v1/identity-gcp-auth-router.ts b/backend/src/server/routes/v1/identity-gcp-auth-router.ts index 64e76bc1e..0deeb95d3 100644 --- a/backend/src/server/routes/v1/identity-gcp-auth-router.ts +++ b/backend/src/server/routes/v1/identity-gcp-auth-router.ts @@ -271,7 +271,7 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider) method: "DELETE", url: "/gcp-auth/identities/:identityId", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts index fc26525f7..4c54f1e7c 100644 --- a/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts +++ b/backend/src/server/routes/v1/identity-kubernetes-auth-router.ts @@ -286,7 +286,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide method: "DELETE", url: "/kubernetes-auth/identities/:identityId", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v1/identity-ua.ts b/backend/src/server/routes/v1/identity-universal-auth-router.ts similarity index 100% rename from backend/src/server/routes/v1/identity-ua.ts rename to backend/src/server/routes/v1/identity-universal-auth-router.ts index d2d60d112..b5a63f0db 100644 --- a/backend/src/server/routes/v1/identity-ua.ts +++ b/backend/src/server/routes/v1/identity-universal-auth-router.ts @@ -299,7 +299,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { method: "DELETE", url: "/universal-auth/identities/:identityId", config: { - rateLimit: readLimit + rateLimit: writeLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { @@ -450,7 +450,7 @@ export const registerIdentityUaRouter = async (server: FastifyZodProvider) => { method: "GET", url: "/universal-auth/identities/:identityId/client-secrets/:clientSecretId", config: { - rateLimit: writeLimit + rateLimit: readLimit }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), schema: { diff --git a/backend/src/server/routes/v1/index.ts b/backend/src/server/routes/v1/index.ts index eee7dac65..c2969b382 100644 --- a/backend/src/server/routes/v1/index.ts +++ b/backend/src/server/routes/v1/index.ts @@ -9,7 +9,7 @@ import { registerIdentityAzureAuthRouter } from "./identity-azure-auth-router"; import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router"; import { registerIdentityKubernetesRouter } from "./identity-kubernetes-auth-router"; import { registerIdentityRouter } from "./identity-router"; -import { registerIdentityUaRouter } from "./identity-ua"; +import { registerIdentityUaRouter } from "./identity-universal-auth-router"; import { registerIntegrationAuthRouter } from "./integration-auth-router"; import { registerIntegrationRouter } from "./integration-router"; import { registerInviteOrgRouter } from "./invite-org-router"; diff --git a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts index 0df860f10..9cb39aece 100644 --- a/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts +++ b/backend/src/services/identity-aws-auth/identity-aws-auth-service.ts @@ -323,7 +323,7 @@ export const identityAwsAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); const { permission: rolePermission } = await permissionService.getOrgPermission( ActorType.IDENTITY, @@ -339,9 +339,9 @@ export const identityAwsAuthServiceFactory = ({ }); const revokedIdentityAwsAuth = await identityAwsAuthDAL.transaction(async (tx) => { - const deletedUniversalAuth = await identityAwsAuthDAL.delete({ identityId }, tx); + const deletedAwsAuth = await identityAwsAuthDAL.delete({ identityId }, tx); await identityDAL.updateById(identityId, { authMethod: null }, tx); - return { ...deletedUniversalAuth?.[0], orgId: identityMembershipOrg.orgId }; + return { ...deletedAwsAuth?.[0], orgId: identityMembershipOrg.orgId }; }); return revokedIdentityAwsAuth; }; diff --git a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts index 084443745..0d52bf6a0 100644 --- a/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts +++ b/backend/src/services/identity-azure-auth/identity-azure-auth-service.ts @@ -302,7 +302,7 @@ export const identityAzureAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); const { permission: rolePermission } = await permissionService.getOrgPermission( ActorType.IDENTITY, @@ -318,9 +318,9 @@ export const identityAzureAuthServiceFactory = ({ }); const revokedIdentityAzureAuth = await identityAzureAuthDAL.transaction(async (tx) => { - const deletedUniversalAuth = await identityAzureAuthDAL.delete({ identityId }, tx); + const deletedAzureAuth = await identityAzureAuthDAL.delete({ identityId }, tx); await identityDAL.updateById(identityId, { authMethod: null }, tx); - return { ...deletedUniversalAuth?.[0], orgId: identityMembershipOrg.orgId }; + return { ...deletedAzureAuth?.[0], orgId: identityMembershipOrg.orgId }; }); return revokedIdentityAzureAuth; }; diff --git a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts index 97436598e..824e593ce 100644 --- a/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts +++ b/backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts @@ -337,7 +337,7 @@ export const identityGcpAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); const { permission: rolePermission } = await permissionService.getOrgPermission( ActorType.IDENTITY, @@ -353,9 +353,9 @@ export const identityGcpAuthServiceFactory = ({ }); const revokedIdentityGcpAuth = await identityGcpAuthDAL.transaction(async (tx) => { - const deletedUniversalAuth = await identityGcpAuthDAL.delete({ identityId }, tx); + const deletedGcpAuth = await identityGcpAuthDAL.delete({ identityId }, tx); await identityDAL.updateById(identityId, { authMethod: null }, tx); - return { ...deletedUniversalAuth?.[0], orgId: identityMembershipOrg.orgId }; + return { ...deletedGcpAuth?.[0], orgId: identityMembershipOrg.orgId }; }); return revokedIdentityGcpAuth; }; diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts index 2c73d025b..820777b46 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts @@ -555,7 +555,7 @@ export const identityKubernetesAuthServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); const { permission: rolePermission } = await permissionService.getOrgPermission( ActorType.IDENTITY, @@ -571,9 +571,9 @@ export const identityKubernetesAuthServiceFactory = ({ }); const revokedIdentityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => { - const deletedUniversalAuth = await identityKubernetesAuthDAL.delete({ identityId }, tx); + const deletedKubernetesAuth = await identityKubernetesAuthDAL.delete({ identityId }, tx); await identityDAL.updateById(identityId, { authMethod: null }, tx); - return { ...deletedUniversalAuth?.[0], orgId: identityMembershipOrg.orgId }; + return { ...deletedKubernetesAuth?.[0], orgId: identityMembershipOrg.orgId }; }); return revokedIdentityKubernetesAuth; }; diff --git a/backend/src/services/identity-ua/identity-ua-service.ts b/backend/src/services/identity-ua/identity-ua-service.ts index 3d9f0c3cb..00dfa5d60 100644 --- a/backend/src/services/identity-ua/identity-ua-service.ts +++ b/backend/src/services/identity-ua/identity-ua-service.ts @@ -355,7 +355,7 @@ export const identityUaServiceFactory = ({ actorAuthMethod, actorOrgId ); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity); const { permission: rolePermission } = await permissionService.getOrgPermission( ActorType.IDENTITY,