awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Feat: Org Scoped JWT Tokens

Browse Source
This commit is contained in:
Daniel Hougaard
2024-03-09 08:56:25 +01:00
parent 4a0668e92e
commit c2bfeb89e8
1 changed files with 21 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
backend/src/server/plugins/auth/inject-identity.ts
View File

@@ -18,18 +18,19 @@ export type TAuthMode =
user: TUsers; user: TUsers;
orgId?: string; orgId?: string;
} }
| { // | {
authMode: AuthMode.API_KEY; // authMode: AuthMode.API_KEY;
actor: ActorType.USER; // actor: ActorType.USER;
userId: string; // userId: string;
user: TUsers; // user: TUsers;
orgId?: string; // orgId?: string;
} // }
| { | {
authMode: AuthMode.SERVICE_TOKEN; authMode: AuthMode.SERVICE_TOKEN;
serviceToken: TServiceTokens & { createdByEmail: string }; serviceToken: TServiceTokens & { createdByEmail: string };
actor: ActorType.SERVICE; actor: ActorType.SERVICE;
serviceTokenId: string; serviceTokenId: string;
orgId: string;
} }
| { | {
authMode: AuthMode.IDENTITY_ACCESS_TOKEN; authMode: AuthMode.IDENTITY_ACCESS_TOKEN;
@@ -51,6 +52,7 @@ const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
return { authMode: AuthMode.API_KEY, token: apiKey, actor: ActorType.USER } as const; return { authMode: AuthMode.API_KEY, token: apiKey, actor: ActorType.USER } as const;
} }
const authHeader = req.headers?.authorization; const authHeader = req.headers?.authorization;
if (!authHeader) return { authMode: null, token: null }; if (!authHeader) return { authMode: null, token: null };
const authTokenValue = authHeader.slice(7); // slice of after Bearer const authTokenValue = authHeader.slice(7); // slice of after Bearer
@@ -72,7 +74,8 @@ const extractAuth = async (req: FastifyRequest, jwtSecret: string) => {
actor: ActorType.USER actor: ActorType.USER
} as const; } as const;
case AuthTokenType.API_KEY: case AuthTokenType.API_KEY:
return { authMode: AuthMode.API_KEY, token: decodedToken, actor: ActorType.USER } as const; throw new Error("API Key auth is no longer supported.");
// return { authMode: AuthMode.API_KEY, token: decodedToken, actor: ActorType.USER } as const;
case AuthTokenType.IDENTITY_ACCESS_TOKEN: case AuthTokenType.IDENTITY_ACCESS_TOKEN:
return { return {
authMode: AuthMode.IDENTITY_ACCESS_TOKEN, authMode: AuthMode.IDENTITY_ACCESS_TOKEN,
@@ -96,6 +99,10 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
server.addHook("onRequest", async (req) => { server.addHook("onRequest", async (req) => {
const appCfg = getConfig(); const appCfg = getConfig();
const { authMode, token, actor } = await extractAuth(req, appCfg.AUTH_SECRET); const { authMode, token, actor } = await extractAuth(req, appCfg.AUTH_SECRET);
if (req.url.includes("/api/v3/auth/")) {
return;
}
if (!authMode) return; if (!authMode) return;
switch (authMode) { switch (authMode) {
@@ -119,6 +126,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
case AuthMode.SERVICE_TOKEN: { case AuthMode.SERVICE_TOKEN: {
const serviceToken = await server.services.serviceToken.fnValidateServiceToken(token); const serviceToken = await server.services.serviceToken.fnValidateServiceToken(token);
req.auth = { req.auth = {
orgId: serviceToken.orgId,
authMode: AuthMode.SERVICE_TOKEN as const, authMode: AuthMode.SERVICE_TOKEN as const,
serviceToken, serviceToken,
serviceTokenId: serviceToken.id, serviceTokenId: serviceToken.id,
@@ -126,11 +134,11 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
}; };
break; break;
} }
case AuthMode.API_KEY: { // case AuthMode.API_KEY: {
const user = await server.services.apiKey.fnValidateApiKey(token as string); // const user = await server.services.apiKey.fnValidateApiKey(token as string);
req.auth = { authMode: AuthMode.API_KEY as const, userId: user.id, actor, user }; // req.auth = { authMode: AuthMode.API_KEY as const, userId: user.id, actor, user };
break; // break;
} // }
case AuthMode.SCIM_TOKEN: { case AuthMode.SCIM_TOKEN: {
const { orgId, scimTokenId } = await server.services.scim.fnValidateScimToken(token); const { orgId, scimTokenId } = await server.services.scim.fnValidateScimToken(token);
req.auth = { authMode: AuthMode.SCIM_TOKEN, actor, scimTokenId, orgId }; req.auth = { authMode: AuthMode.SCIM_TOKEN, actor, scimTokenId, orgId };