awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 11:38:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed review comments

Browse Source
This commit is contained in:
Sheen Capadngan
2024-12-13 13:39:23 +08:00
parent a7b25f3bd8
commit c35657ed49
10 changed files with 48 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-jwt-auth/identity-jwt-auth-fns.ts
+7 -2
View File
@@ -1,4 +1,9 @@
import picomatch from "picomatch";
export const doesFieldValueMatchJwtPolicy = (fieldValue: string, policyValue: string) =>
policyValue === fieldValue || picomatch.isMatch(fieldValue, policyValue);
export const doesFieldValueMatchJwtPolicy = (fieldValue: string | boolean, policyValue: string) => {
if (typeof fieldValue === "boolean") {
return fieldValue === (policyValue === "true");
}
return policyValue === fieldValue || picomatch.isMatch(fieldValue, policyValue);
};
backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts
+2 -8
View File
@@ -75,7 +75,7 @@ export const identityJwtAuthServiceFactory = ({
});
}
let tokenData: Record<string, string> = {};
let tokenData: Record<string, string | boolean> = {};
if (identityJwtAuth.configurationType === JwtConfigurationType.JWKS) {
const decryptedJwksCaCert = orgDataKeyDecryptor({
@@ -127,13 +127,7 @@ export const identityJwtAuthServiceFactory = ({
}
if (identityJwtAuth.boundIssuer) {
if (!tokenData.iss) {
throw new UnauthorizedError({
message: "Access denied: token has no issuer field"
});
}
if (!doesFieldValueMatchJwtPolicy(tokenData.iss, identityJwtAuth.boundIssuer)) {
if (tokenData.iss !== identityJwtAuth.boundIssuer) {
throw new ForbiddenRequestError({
message: "Access denied: issuer mismatch"
});