awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 16:40:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add org-scoped auth to project-level endpoints

Browse Source
This commit is contained in:
Tuan Dang
2024-02-05 14:48:02 -08:00
parent 410476ecb5
commit c1aa5c840c
55 changed files with 821 additions and 280 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/secret-import/secret-import-service.ts
+42 -10
View File
@@ -36,8 +36,16 @@ export const secretImportServiceFactory = ({
folderDAL,
secretDAL
}: TSecretImportServiceFactoryDep) => {
const createImport = async ({ environment, data, actor, actorId, projectId, path }: TCreateSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const createImport = async ({
environment,
data,
actor,
actorId,
actorOrgScope,
projectId,
path
}: TCreateSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
// check if user has permission to import into destination path
ForbiddenError.from(permission).throwUnlessCan(
@@ -77,8 +85,17 @@ export const secretImportServiceFactory = ({
return { ...secImport, importEnv };
};
const updateImport = async ({ path, environment, projectId, actor, actorId, data, id }: TUpdateSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const updateImport = async ({
path,
environment,
projectId,
actor,
actorId,
actorOrgScope,
data,
id
}: TUpdateSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -115,8 +132,16 @@ export const secretImportServiceFactory = ({
return { ...updatedSecImport, importEnv: importedEnv };
};
const deleteImport = async ({ path, environment, projectId, actor, actorId, id }: TDeleteSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const deleteImport = async ({
path,
environment,
projectId,
actor,
actorId,
actorOrgScope,
id
}: TDeleteSecretImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -137,8 +162,8 @@ export const secretImportServiceFactory = ({
return secImport;
};
const getImports = async ({ path, environment, projectId, actor, actorId }: TGetSecretImportsDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const getImports = async ({ path, environment, projectId, actor, actorId, actorOrgScope }: TGetSecretImportsDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
@@ -151,8 +176,15 @@ export const secretImportServiceFactory = ({
return secImports;
};
const getSecretsFromImports = async ({ path, environment, projectId, actor, actorId }: TGetSecretsFromImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId);
const getSecretsFromImports = async ({
path,
environment,
projectId,
actor,
actorId,
actorOrgScope
}: TGetSecretsFromImportDTO) => {
const { permission } = await permissionService.getProjectPermission(actor, actorId, projectId, actorOrgScope);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })