mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
Merge pull request #2566 from Infisical/feat/github-integration-app-auth
feat: github integration with Github app auth
This commit is contained in:
Sheen
@@ -36,16 +36,22 @@ CLIENT_ID_HEROKU=
|
||||
CLIENT_ID_VERCEL=
|
||||
CLIENT_ID_NETLIFY=
|
||||
CLIENT_ID_GITHUB=
|
||||
CLIENT_ID_GITHUB_APP=
|
||||
CLIENT_SLUG_GITHUB_APP=
|
||||
CLIENT_ID_GITLAB=
|
||||
CLIENT_ID_BITBUCKET=
|
||||
CLIENT_SECRET_HEROKU=
|
||||
CLIENT_SECRET_VERCEL=
|
||||
CLIENT_SECRET_NETLIFY=
|
||||
CLIENT_SECRET_GITHUB=
|
||||
CLIENT_SECRET_GITHUB_APP=
|
||||
CLIENT_SECRET_GITLAB=
|
||||
CLIENT_SECRET_BITBUCKET=
|
||||
CLIENT_SLUG_VERCEL=
|
||||
|
||||
CLIENT_PRIVATE_KEY_GITHUB_APP=
|
||||
CLIENT_APP_ID_GITHUB_APP=
|
||||
|
||||
# Sentry (optional) for monitoring errors
|
||||
SENTRY_DSN=
|
||||
|
||||
|
||||
573
backend/package-lock.json
generated
573
backend/package-lock.json
generated
@@ -28,6 +28,7 @@
|
||||
"@fastify/swagger": "^8.14.0",
|
||||
"@fastify/swagger-ui": "^2.1.0",
|
||||
"@node-saml/passport-saml": "^4.0.4",
|
||||
"@octokit/auth-app": "^7.1.1",
|
||||
"@octokit/plugin-retry": "^5.0.5",
|
||||
"@octokit/rest": "^20.0.2",
|
||||
"@octokit/webhooks-types": "^7.3.1",
|
||||
@@ -5000,24 +5001,73 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app": {
|
||||
"version": "6.0.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-app/-/auth-app-6.0.3.tgz",
|
||||
"integrity": "sha512-9N7IlBAKEJR3tJgPSubCxIDYGXSdc+2xbkjYpk9nCyqREnH8qEMoMhiEB1WgoA9yTFp91El92XNXAi+AjuKnfw==",
|
||||
"version": "7.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-app/-/auth-app-7.1.1.tgz",
|
||||
"integrity": "sha512-kRAd6yelV9OgvlEJE88H0VLlQdZcag9UlLr7dV0YYP37X8PPDvhgiTy66QVhDXdyoT0AleFN2w/qXkPdrSzINg==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-app": "^7.0.0",
|
||||
"@octokit/auth-oauth-user": "^4.0.0",
|
||||
"@octokit/request": "^8.0.2",
|
||||
"@octokit/request-error": "^5.0.0",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"deprecation": "^2.3.1",
|
||||
"@octokit/auth-oauth-app": "^8.1.0",
|
||||
"@octokit/auth-oauth-user": "^5.1.0",
|
||||
"@octokit/request": "^9.1.1",
|
||||
"@octokit/request-error": "^6.1.1",
|
||||
"@octokit/types": "^13.4.1",
|
||||
"lru-cache": "^10.0.0",
|
||||
"universal-github-app-jwt": "^1.1.2",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
"universal-github-app-jwt": "^2.2.0",
|
||||
"universal-user-agent": "^7.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/@octokit/endpoint": {
|
||||
"version": "10.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.1.tgz",
|
||||
"integrity": "sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/@octokit/request": {
|
||||
"version": "9.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.1.3.tgz",
|
||||
"integrity": "sha512-V+TFhu5fdF3K58rs1pGUJIDH5RZLbZm5BI+MNF+6o/ssFNT4vWlCh/tVpF3NxGtP15HUxTTMUbsG5llAuU2CZA==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^10.0.0",
|
||||
"@octokit/request-error": "^6.0.1",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/@octokit/request-error": {
|
||||
"version": "6.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
|
||||
"integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/lru-cache": {
|
||||
"version": "10.2.0",
|
||||
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.2.0.tgz",
|
||||
@@ -5026,53 +5076,220 @@
|
||||
"node": "14 || >=16.14"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-app/node_modules/universal-user-agent": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
|
||||
"integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app": {
|
||||
"version": "7.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-app/-/auth-oauth-app-7.0.1.tgz",
|
||||
"integrity": "sha512-RE0KK0DCjCHXHlQBoubwlLijXEKfhMhKm9gO56xYvFmP1QTMb+vvwRPmQLLx0V+5AvV9N9I3lr1WyTzwL3rMDg==",
|
||||
"version": "8.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-app/-/auth-oauth-app-8.1.1.tgz",
|
||||
"integrity": "sha512-5UtmxXAvU2wfcHIPPDWzVSAWXVJzG3NWsxb7zCFplCWEmMCArSZV0UQu5jw5goLQXbFyOr5onzEH37UJB3zQQg==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-device": "^6.0.0",
|
||||
"@octokit/auth-oauth-user": "^4.0.0",
|
||||
"@octokit/request": "^8.0.2",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"@types/btoa-lite": "^1.0.0",
|
||||
"btoa-lite": "^1.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
"@octokit/auth-oauth-device": "^7.0.0",
|
||||
"@octokit/auth-oauth-user": "^5.0.1",
|
||||
"@octokit/request": "^9.0.0",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/@octokit/endpoint": {
|
||||
"version": "10.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.1.tgz",
|
||||
"integrity": "sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request": {
|
||||
"version": "9.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.1.3.tgz",
|
||||
"integrity": "sha512-V+TFhu5fdF3K58rs1pGUJIDH5RZLbZm5BI+MNF+6o/ssFNT4vWlCh/tVpF3NxGtP15HUxTTMUbsG5llAuU2CZA==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^10.0.0",
|
||||
"@octokit/request-error": "^6.0.1",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/@octokit/request-error": {
|
||||
"version": "6.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
|
||||
"integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-app/node_modules/universal-user-agent": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
|
||||
"integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device": {
|
||||
"version": "6.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-device/-/auth-oauth-device-6.0.1.tgz",
|
||||
"integrity": "sha512-yxU0rkL65QkjbqQedgVx3gmW7YM5fF+r5uaSj9tM/cQGVqloXcqP2xK90eTyYvl29arFVCW8Vz4H/t47mL0ELw==",
|
||||
"version": "7.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-device/-/auth-oauth-device-7.1.1.tgz",
|
||||
"integrity": "sha512-HWl8lYueHonuyjrKKIup/1tiy0xcmQCdq5ikvMO1YwkNNkxb6DXfrPjrMYItNLyCP/o2H87WuijuE+SlBTT8eg==",
|
||||
"dependencies": {
|
||||
"@octokit/oauth-methods": "^4.0.0",
|
||||
"@octokit/request": "^8.0.0",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
"@octokit/oauth-methods": "^5.0.0",
|
||||
"@octokit/request": "^9.0.0",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user": {
|
||||
"version": "4.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-user/-/auth-oauth-user-4.0.1.tgz",
|
||||
"integrity": "sha512-N94wWW09d0hleCnrO5wt5MxekatqEJ4zf+1vSe8MKMrhZ7gAXKFOKrDEZW2INltvBWJCyDUELgGRv8gfErH1Iw==",
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/@octokit/endpoint": {
|
||||
"version": "10.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.1.tgz",
|
||||
"integrity": "sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-device": "^6.0.0",
|
||||
"@octokit/oauth-methods": "^4.0.0",
|
||||
"@octokit/request": "^8.0.2",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"btoa-lite": "^1.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request": {
|
||||
"version": "9.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.1.3.tgz",
|
||||
"integrity": "sha512-V+TFhu5fdF3K58rs1pGUJIDH5RZLbZm5BI+MNF+6o/ssFNT4vWlCh/tVpF3NxGtP15HUxTTMUbsG5llAuU2CZA==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^10.0.0",
|
||||
"@octokit/request-error": "^6.0.1",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/@octokit/request-error": {
|
||||
"version": "6.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
|
||||
"integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-device/node_modules/universal-user-agent": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
|
||||
"integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user": {
|
||||
"version": "5.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-user/-/auth-oauth-user-5.1.1.tgz",
|
||||
"integrity": "sha512-rRkMz0ErOppdvEfnemHJXgZ9vTPhBuC6yASeFaB7I2yLMd7QpjfrL1mnvRPlyKo+M6eeLxrKanXJ9Qte29SRsw==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-device": "^7.0.1",
|
||||
"@octokit/oauth-methods": "^5.0.0",
|
||||
"@octokit/request": "^9.0.1",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/@octokit/endpoint": {
|
||||
"version": "10.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.1.tgz",
|
||||
"integrity": "sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request": {
|
||||
"version": "9.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.1.3.tgz",
|
||||
"integrity": "sha512-V+TFhu5fdF3K58rs1pGUJIDH5RZLbZm5BI+MNF+6o/ssFNT4vWlCh/tVpF3NxGtP15HUxTTMUbsG5llAuU2CZA==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^10.0.0",
|
||||
"@octokit/request-error": "^6.0.1",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/@octokit/request-error": {
|
||||
"version": "6.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
|
||||
"integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/auth-oauth-user/node_modules/universal-user-agent": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
|
||||
"integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
|
||||
},
|
||||
"node_modules/@octokit/auth-token": {
|
||||
"version": "4.0.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
|
||||
@@ -5136,28 +5353,82 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-authorization-url": {
|
||||
"version": "6.0.2",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-authorization-url/-/oauth-authorization-url-6.0.2.tgz",
|
||||
"integrity": "sha512-CdoJukjXXxqLNK4y/VOiVzQVjibqoj/xHgInekviUJV73y/BSIcwvJ/4aNHPBPKcPWFnd4/lO9uqRV65jXhcLA==",
|
||||
"version": "7.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-authorization-url/-/oauth-authorization-url-7.1.1.tgz",
|
||||
"integrity": "sha512-ooXV8GBSabSWyhLUowlMIVd9l1s2nsOGQdlP2SQ4LnkEsGXzeCvbSbCPdZThXhEFzleGPwbapT0Sb+YhXRyjCA==",
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods": {
|
||||
"version": "4.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-methods/-/oauth-methods-4.0.1.tgz",
|
||||
"integrity": "sha512-1NdTGCoBHyD6J0n2WGXg9+yDLZrRNZ0moTEex/LSPr49m530WNKcCfXDghofYptr3st3eTii+EHoG5k/o+vbtw==",
|
||||
"version": "5.1.2",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-methods/-/oauth-methods-5.1.2.tgz",
|
||||
"integrity": "sha512-C5lglRD+sBlbrhCUTxgJAFjWgJlmTx5bQ7Ch0+2uqRjYv7Cfb5xpX4WuSC9UgQna3sqRGBL9EImX9PvTpMaQ7g==",
|
||||
"dependencies": {
|
||||
"@octokit/oauth-authorization-url": "^6.0.2",
|
||||
"@octokit/request": "^8.0.2",
|
||||
"@octokit/request-error": "^5.0.0",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"btoa-lite": "^1.0.0"
|
||||
"@octokit/oauth-authorization-url": "^7.0.0",
|
||||
"@octokit/request": "^9.1.0",
|
||||
"@octokit/request-error": "^6.1.0",
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/@octokit/endpoint": {
|
||||
"version": "10.1.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-10.1.1.tgz",
|
||||
"integrity": "sha512-JYjh5rMOwXMJyUpj028cu0Gbp7qe/ihxfJMLc8VZBMMqSwLgOxDI1911gV4Enl1QSavAQNJcwmwBF9M0VvLh6Q==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/@octokit/request": {
|
||||
"version": "9.1.3",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-9.1.3.tgz",
|
||||
"integrity": "sha512-V+TFhu5fdF3K58rs1pGUJIDH5RZLbZm5BI+MNF+6o/ssFNT4vWlCh/tVpF3NxGtP15HUxTTMUbsG5llAuU2CZA==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^10.0.0",
|
||||
"@octokit/request-error": "^6.0.1",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^7.0.2"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/@octokit/request-error": {
|
||||
"version": "6.1.5",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-6.1.5.tgz",
|
||||
"integrity": "sha512-IlBTfGX8Yn/oFPMwSfvugfncK2EwRLjzbrpifNaMY8o/HTEAFqCA1FZxjD9cWvSKBHgrIhc4CSBIzMxiLsbzFQ==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^13.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/oauth-methods/node_modules/universal-user-agent": {
|
||||
"version": "7.0.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.2.tgz",
|
||||
"integrity": "sha512-0JCqzSKnStlRRQfCdowvqy3cy0Dvtlb8xecj/H8JFZuCze4rwjPZQOgvFvn0Ws/usCHQFGpyr+pB9adaGwXn4Q=="
|
||||
},
|
||||
"node_modules/@octokit/openapi-types": {
|
||||
"version": "19.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-19.1.0.tgz",
|
||||
@@ -5272,13 +5543,13 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/request": {
|
||||
"version": "8.1.6",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.1.6.tgz",
|
||||
"integrity": "sha512-YhPaGml3ncZC1NfXpP3WZ7iliL1ap6tLkAp6MvbK2fTTPytzVUyUesBBogcdMm86uRYO5rHaM1xIWxigWZ17MQ==",
|
||||
"version": "8.4.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.0.tgz",
|
||||
"integrity": "sha512-9Bb014e+m2TgBeEJGEbdplMVWwPmL1FPtggHQRkV+WVsMggPtEkLKPlcVYm/o8xKLkpJ7B+6N8WfQMtDLX2Dpw==",
|
||||
"dependencies": {
|
||||
"@octokit/endpoint": "^9.0.0",
|
||||
"@octokit/request-error": "^5.0.0",
|
||||
"@octokit/types": "^12.0.0",
|
||||
"@octokit/endpoint": "^9.0.1",
|
||||
"@octokit/request-error": "^5.1.0",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
},
|
||||
"engines": {
|
||||
@@ -5286,11 +5557,11 @@
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/request-error": {
|
||||
"version": "5.0.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.0.1.tgz",
|
||||
"integrity": "sha512-X7pnyTMV7MgtGmiXBwmO6M5kIPrntOXdyKZLigNfQWSEQzVxR4a4vo49vJjTWX70mPndj8KhfT4Dx+2Ng3vnBQ==",
|
||||
"version": "5.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.0.tgz",
|
||||
"integrity": "sha512-GETXfE05J0+7H2STzekpKObFe765O5dlAKUTLNGeH+x47z7JjXHfsHKo5z21D/o/IOZTUEI6nyWyR+bZVP/n5Q==",
|
||||
"dependencies": {
|
||||
"@octokit/types": "^12.0.0",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"deprecation": "^2.0.0",
|
||||
"once": "^1.4.0"
|
||||
},
|
||||
@@ -5298,6 +5569,32 @@
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/request-error/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/@octokit/request/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@octokit/rest": {
|
||||
"version": "20.0.2",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/rest/-/rest-20.0.2.tgz",
|
||||
@@ -14184,6 +14481,154 @@
|
||||
"@octokit/core": ">=5"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-app": {
|
||||
"version": "6.1.2",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-app/-/auth-app-6.1.2.tgz",
|
||||
"integrity": "sha512-fWjIOpxnL8/YFY3kqquciFQ4o99aCqHw5kMFoGPYbz/h5HNZ11dJlV9zag5wS2nt0X1wJ5cs9BUo+CsAPfW4jQ==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-app": "^7.1.0",
|
||||
"@octokit/auth-oauth-user": "^4.1.0",
|
||||
"@octokit/request": "^8.3.1",
|
||||
"@octokit/request-error": "^5.1.0",
|
||||
"@octokit/types": "^13.1.0",
|
||||
"deprecation": "^2.3.1",
|
||||
"lru-cache": "^10.0.0",
|
||||
"universal-github-app-jwt": "^1.1.2",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-app/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-app": {
|
||||
"version": "7.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-app/-/auth-oauth-app-7.1.0.tgz",
|
||||
"integrity": "sha512-w+SyJN/b0l/HEb4EOPRudo7uUOSW51jcK1jwLa+4r7PA8FPFpoxEnHBHMITqCsc/3Vo2qqFjgQfz/xUUvsSQnA==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-device": "^6.1.0",
|
||||
"@octokit/auth-oauth-user": "^4.1.0",
|
||||
"@octokit/request": "^8.3.1",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"@types/btoa-lite": "^1.0.0",
|
||||
"btoa-lite": "^1.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-app/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-device": {
|
||||
"version": "6.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-device/-/auth-oauth-device-6.1.0.tgz",
|
||||
"integrity": "sha512-FNQ7cb8kASufd6Ej4gnJ3f1QB5vJitkoV1O0/g6e6lUsQ7+VsSNRHRmFScN2tV4IgKA12frrr/cegUs0t+0/Lw==",
|
||||
"dependencies": {
|
||||
"@octokit/oauth-methods": "^4.1.0",
|
||||
"@octokit/request": "^8.3.1",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-device/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-user": {
|
||||
"version": "4.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/auth-oauth-user/-/auth-oauth-user-4.1.0.tgz",
|
||||
"integrity": "sha512-FrEp8mtFuS/BrJyjpur+4GARteUCrPeR/tZJzD8YourzoVhRics7u7we/aDcKv+yywRNwNi/P4fRi631rG/OyQ==",
|
||||
"dependencies": {
|
||||
"@octokit/auth-oauth-device": "^6.1.0",
|
||||
"@octokit/oauth-methods": "^4.1.0",
|
||||
"@octokit/request": "^8.3.1",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"btoa-lite": "^1.0.0",
|
||||
"universal-user-agent": "^6.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/auth-oauth-user/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/oauth-authorization-url": {
|
||||
"version": "6.0.2",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-authorization-url/-/oauth-authorization-url-6.0.2.tgz",
|
||||
"integrity": "sha512-CdoJukjXXxqLNK4y/VOiVzQVjibqoj/xHgInekviUJV73y/BSIcwvJ/4aNHPBPKcPWFnd4/lO9uqRV65jXhcLA==",
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/oauth-methods": {
|
||||
"version": "4.1.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/oauth-methods/-/oauth-methods-4.1.0.tgz",
|
||||
"integrity": "sha512-4tuKnCRecJ6CG6gr0XcEXdZtkTDbfbnD5oaHBmLERTjTMZNi2CbfEHZxPU41xXLDG4DfKf+sonu00zvKI9NSbw==",
|
||||
"dependencies": {
|
||||
"@octokit/oauth-authorization-url": "^6.0.2",
|
||||
"@octokit/request": "^8.3.1",
|
||||
"@octokit/request-error": "^5.1.0",
|
||||
"@octokit/types": "^13.0.0",
|
||||
"btoa-lite": "^1.0.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">= 18"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/oauth-methods/node_modules/@octokit/types": {
|
||||
"version": "13.6.1",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.6.1.tgz",
|
||||
"integrity": "sha512-PHZE9Z+kWXb23Ndik8MKPirBPziOc0D2/3KH1P+6jK5nGWe96kadZuE4jev2/Jq7FvIfTlT2Ltg8Fv2x1v0a5g==",
|
||||
"dependencies": {
|
||||
"@octokit/openapi-types": "^22.2.0"
|
||||
}
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/@octokit/openapi-types": {
|
||||
"version": "22.2.0",
|
||||
"resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-22.2.0.tgz",
|
||||
"integrity": "sha512-QBhVjcUa9W7Wwhm6DBFu6ZZ+1/t/oYxqc2tp81Pi41YNuJinbFRx8B133qVOrAaBbF7D/m0Et6f9/pZt9Rc+tg=="
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/lru-cache": {
|
||||
"version": "10.4.3",
|
||||
"resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
|
||||
"integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
|
||||
},
|
||||
"node_modules/octokit-auth-probot/node_modules/universal-github-app-jwt": {
|
||||
"version": "1.2.0",
|
||||
"resolved": "https://registry.npmjs.org/universal-github-app-jwt/-/universal-github-app-jwt-1.2.0.tgz",
|
||||
"integrity": "sha512-dncpMpnsKBk0eetwfN8D8OUHGfiDhhJ+mtsbMl+7PfW7mYjiH8LIcqRmYMtzYLgSh47HjfdBtrBwIQ/gizKR3g==",
|
||||
"dependencies": {
|
||||
"@types/jsonwebtoken": "^9.0.0",
|
||||
"jsonwebtoken": "^9.0.2"
|
||||
}
|
||||
},
|
||||
"node_modules/oidc-token-hash": {
|
||||
"version": "5.0.3",
|
||||
"resolved": "https://registry.npmjs.org/oidc-token-hash/-/oidc-token-hash-5.0.3.tgz",
|
||||
@@ -18176,13 +18621,9 @@
|
||||
}
|
||||
},
|
||||
"node_modules/universal-github-app-jwt": {
|
||||
"version": "1.1.2",
|
||||
"resolved": "https://registry.npmjs.org/universal-github-app-jwt/-/universal-github-app-jwt-1.1.2.tgz",
|
||||
"integrity": "sha512-t1iB2FmLFE+yyJY9+3wMx0ejB+MQpEVkH0gQv7dR6FZyltyq+ZZO0uDpbopxhrZ3SLEO4dCEkIujOMldEQ2iOA==",
|
||||
"dependencies": {
|
||||
"@types/jsonwebtoken": "^9.0.0",
|
||||
"jsonwebtoken": "^9.0.2"
|
||||
}
|
||||
"version": "2.2.0",
|
||||
"resolved": "https://registry.npmjs.org/universal-github-app-jwt/-/universal-github-app-jwt-2.2.0.tgz",
|
||||
"integrity": "sha512-G5o6f95b5BggDGuUfKDApKaCgNYy2x7OdHY0zSMF081O0EJobw+1130VONhrA7ezGSV2FNOGyM+KQpQZAr9bIQ=="
|
||||
},
|
||||
"node_modules/universal-user-agent": {
|
||||
"version": "6.0.1",
|
||||
|
||||
@@ -132,6 +132,7 @@
|
||||
"@fastify/swagger": "^8.14.0",
|
||||
"@fastify/swagger-ui": "^2.1.0",
|
||||
"@node-saml/passport-saml": "^4.0.4",
|
||||
"@octokit/auth-app": "^7.1.1",
|
||||
"@octokit/plugin-retry": "^5.0.5",
|
||||
"@octokit/rest": "^20.0.2",
|
||||
"@octokit/webhooks-types": "^7.3.1",
|
||||
|
||||
@@ -117,9 +117,16 @@ const envSchema = z
|
||||
// gcp secret manager
|
||||
CLIENT_ID_GCP_SECRET_MANAGER: zpStr(z.string().optional()),
|
||||
CLIENT_SECRET_GCP_SECRET_MANAGER: zpStr(z.string().optional()),
|
||||
// github
|
||||
// github oauth
|
||||
CLIENT_ID_GITHUB: zpStr(z.string().optional()),
|
||||
CLIENT_SECRET_GITHUB: zpStr(z.string().optional()),
|
||||
// github app
|
||||
CLIENT_ID_GITHUB_APP: zpStr(z.string().optional()),
|
||||
CLIENT_SECRET_GITHUB_APP: zpStr(z.string().optional()),
|
||||
CLIENT_PRIVATE_KEY_GITHUB_APP: zpStr(z.string().optional()),
|
||||
CLIENT_APP_ID_GITHUB_APP: z.coerce.number().optional(),
|
||||
CLIENT_SLUG_GITHUB_APP: zpStr(z.string().optional()),
|
||||
|
||||
// azure
|
||||
CLIENT_ID_AZURE: zpStr(z.string().optional()),
|
||||
CLIENT_SECRET_AZURE: zpStr(z.string().optional()),
|
||||
|
||||
@@ -189,6 +189,7 @@ export const registerIntegrationAuthRouter = async (server: FastifyZodProvider)
|
||||
workspaceId: z.string().trim(),
|
||||
code: z.string().trim(),
|
||||
integration: z.string().trim(),
|
||||
installationId: z.string().trim().optional(),
|
||||
url: z.string().trim().url().optional()
|
||||
}),
|
||||
response: {
|
||||
@@ -452,6 +453,40 @@ export const registerIntegrationAuthRouter = async (server: FastifyZodProvider)
|
||||
}
|
||||
});
|
||||
|
||||
server.route({
|
||||
method: "POST",
|
||||
url: "/:integrationAuthId/duplicate",
|
||||
config: {
|
||||
rateLimit: writeLimit
|
||||
},
|
||||
onRequest: verifyAuth([AuthMode.JWT]),
|
||||
schema: {
|
||||
params: z.object({
|
||||
integrationAuthId: z.string().trim()
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim()
|
||||
}),
|
||||
response: {
|
||||
200: z.object({
|
||||
integrationAuth: integrationAuthPubSchema
|
||||
})
|
||||
}
|
||||
},
|
||||
handler: async (req) => {
|
||||
const integrationAuth = await server.services.integrationAuth.duplicateIntegrationAuth({
|
||||
actorId: req.permission.id,
|
||||
actor: req.permission.type,
|
||||
actorOrgId: req.permission.orgId,
|
||||
actorAuthMethod: req.permission.authMethod,
|
||||
id: req.params.integrationAuthId,
|
||||
projectId: req.body.projectId
|
||||
});
|
||||
|
||||
return { integrationAuth };
|
||||
}
|
||||
});
|
||||
|
||||
server.route({
|
||||
method: "GET",
|
||||
url: "/:integrationAuthId/github/envs",
|
||||
|
||||
@@ -17,6 +17,8 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
|
||||
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
|
||||
import { ActorType, AuthMode } from "@app/services/auth/auth-type";
|
||||
|
||||
import { integrationAuthPubSchema } from "../sanitizedSchemas";
|
||||
|
||||
export const registerOrgRouter = async (server: FastifyZodProvider) => {
|
||||
server.route({
|
||||
method: "GET",
|
||||
@@ -68,6 +70,35 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
|
||||
}
|
||||
});
|
||||
|
||||
server.route({
|
||||
method: "GET",
|
||||
url: "/:organizationId/integration-authorizations",
|
||||
config: {
|
||||
rateLimit: readLimit
|
||||
},
|
||||
schema: {
|
||||
params: z.object({
|
||||
organizationId: z.string().trim()
|
||||
}),
|
||||
response: {
|
||||
200: z.object({
|
||||
authorizations: integrationAuthPubSchema.array()
|
||||
})
|
||||
}
|
||||
},
|
||||
onRequest: verifyAuth([AuthMode.JWT]),
|
||||
handler: async (req) => {
|
||||
const authorizations = await server.services.integrationAuth.listOrgIntegrationAuth({
|
||||
actorId: req.permission.id,
|
||||
actorAuthMethod: req.permission.authMethod,
|
||||
actor: req.permission.type,
|
||||
actorOrgId: req.permission.orgId
|
||||
});
|
||||
|
||||
return { authorizations };
|
||||
}
|
||||
});
|
||||
|
||||
server.route({
|
||||
method: "GET",
|
||||
url: "/audit-logs",
|
||||
|
||||
@@ -1,9 +1,13 @@
|
||||
/* eslint-disable no-await-in-loop */
|
||||
import { createAppAuth } from "@octokit/auth-app";
|
||||
import { Octokit } from "@octokit/rest";
|
||||
|
||||
import { TIntegrationAuths } from "@app/db/schemas";
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { NotFoundError } from "@app/lib/errors";
|
||||
|
||||
import { IntegrationAuthMetadataSchema, TIntegrationAuthMetadata } from "./integration-auth-schema";
|
||||
import { Integrations, IntegrationUrls } from "./integration-list";
|
||||
|
||||
// akhilmhdh: check this part later. Copied from old base
|
||||
@@ -230,7 +234,13 @@ const getAppsNetlify = async ({ accessToken }: { accessToken: string }) => {
|
||||
/**
|
||||
* Return list of repositories for Github integration
|
||||
*/
|
||||
const getAppsGithub = async ({ accessToken }: { accessToken: string }) => {
|
||||
const getAppsGithub = async ({
|
||||
accessToken,
|
||||
authMetadata
|
||||
}: {
|
||||
accessToken: string;
|
||||
authMetadata?: TIntegrationAuthMetadata;
|
||||
}) => {
|
||||
interface GitHubApp {
|
||||
id: string;
|
||||
name: string;
|
||||
@@ -242,6 +252,29 @@ const getAppsGithub = async ({ accessToken }: { accessToken: string }) => {
|
||||
};
|
||||
}
|
||||
|
||||
if (authMetadata?.installationId) {
|
||||
const appCfg = getConfig();
|
||||
const octokit = new Octokit({
|
||||
authStrategy: createAppAuth,
|
||||
auth: {
|
||||
appId: appCfg.CLIENT_APP_ID_GITHUB_APP,
|
||||
privateKey: appCfg.CLIENT_PRIVATE_KEY_GITHUB_APP,
|
||||
installationId: authMetadata.installationId
|
||||
}
|
||||
});
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
|
||||
const repos = await octokit.paginate("GET /installation/repositories", {
|
||||
per_page: 100
|
||||
});
|
||||
|
||||
return repos.map((a) => ({
|
||||
appId: String(a.id),
|
||||
name: a.name,
|
||||
owner: a.owner.login
|
||||
}));
|
||||
}
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
|
||||
const repos = (await new Octokit({
|
||||
auth: accessToken
|
||||
@@ -1056,6 +1089,7 @@ const getAppsAzureDevOps = async ({ accessToken, orgName }: { accessToken: strin
|
||||
|
||||
export const getApps = async ({
|
||||
integration,
|
||||
integrationAuth,
|
||||
accessToken,
|
||||
accessId,
|
||||
teamId,
|
||||
@@ -1066,6 +1100,7 @@ export const getApps = async ({
|
||||
integration: string;
|
||||
accessToken: string;
|
||||
accessId?: string;
|
||||
integrationAuth: TIntegrationAuths;
|
||||
teamId?: string | null;
|
||||
azureDevOpsOrgName?: string | null;
|
||||
workspaceSlug?: string;
|
||||
@@ -1099,7 +1134,8 @@ export const getApps = async ({
|
||||
|
||||
case Integrations.GITHUB:
|
||||
return getAppsGithub({
|
||||
accessToken
|
||||
accessToken,
|
||||
authMetadata: IntegrationAuthMetadataSchema.parse(integrationAuth.metadata || {})
|
||||
});
|
||||
|
||||
case Integrations.GITLAB:
|
||||
|
||||
@@ -3,7 +3,7 @@ import { Knex } from "knex";
|
||||
import { TDbClient } from "@app/db";
|
||||
import { TableName, TIntegrationAuths, TIntegrationAuthsUpdate } from "@app/db/schemas";
|
||||
import { BadRequestError, DatabaseError } from "@app/lib/errors";
|
||||
import { ormify } from "@app/lib/knex";
|
||||
import { ormify, selectAllTableCols } from "@app/lib/knex";
|
||||
|
||||
export type TIntegrationAuthDALFactory = ReturnType<typeof integrationAuthDALFactory>;
|
||||
|
||||
@@ -28,8 +28,23 @@ export const integrationAuthDALFactory = (db: TDbClient) => {
|
||||
}
|
||||
};
|
||||
|
||||
const getByOrg = async (orgId: string, tx?: Knex) => {
|
||||
try {
|
||||
const integrationAuths = await (tx || db)(TableName.IntegrationAuth)
|
||||
.join(TableName.Project, `${TableName.Project}.id`, `${TableName.IntegrationAuth}.projectId`)
|
||||
.join(TableName.Organization, `${TableName.Organization}.id`, `${TableName.Project}.orgId`)
|
||||
.where(`${TableName.Organization}.id`, "=", orgId)
|
||||
.select(selectAllTableCols(TableName.IntegrationAuth));
|
||||
|
||||
return integrationAuths;
|
||||
} catch (error) {
|
||||
throw new DatabaseError({ error, name: "get by org" });
|
||||
}
|
||||
};
|
||||
|
||||
return {
|
||||
...integrationAuthOrm,
|
||||
bulkUpdate
|
||||
bulkUpdate,
|
||||
getByOrg
|
||||
};
|
||||
};
|
||||
|
||||
@@ -0,0 +1,7 @@
|
||||
import { z } from "zod";
|
||||
|
||||
export const IntegrationAuthMetadataSchema = z.object({
|
||||
installationId: z.string().optional()
|
||||
});
|
||||
|
||||
export type TIntegrationAuthMetadata = z.infer<typeof IntegrationAuthMetadataSchema>;
|
||||
@@ -1,14 +1,16 @@
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { createAppAuth } from "@octokit/auth-app";
|
||||
import { Octokit } from "@octokit/rest";
|
||||
import AWS from "aws-sdk";
|
||||
|
||||
import { SecretEncryptionAlgo, SecretKeyEncoding, TIntegrationAuths, TIntegrationAuthsInsert } from "@app/db/schemas";
|
||||
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
|
||||
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { decryptSymmetric128BitHexKeyUTF8, encryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
|
||||
import { BadRequestError, NotFoundError } from "@app/lib/errors";
|
||||
import { TProjectPermission } from "@app/lib/types";
|
||||
import { TGenericPermission, TProjectPermission } from "@app/lib/types";
|
||||
|
||||
import { TIntegrationDALFactory } from "../integration/integration-dal";
|
||||
import { TKmsServiceFactory } from "../kms/kms-service";
|
||||
@@ -16,11 +18,13 @@ import { KmsDataKey } from "../kms/kms-types";
|
||||
import { TProjectBotServiceFactory } from "../project-bot/project-bot-service";
|
||||
import { getApps } from "./integration-app-list";
|
||||
import { TIntegrationAuthDALFactory } from "./integration-auth-dal";
|
||||
import { IntegrationAuthMetadataSchema, TIntegrationAuthMetadata } from "./integration-auth-schema";
|
||||
import {
|
||||
TBitbucketWorkspace,
|
||||
TChecklyGroups,
|
||||
TDeleteIntegrationAuthByIdDTO,
|
||||
TDeleteIntegrationAuthsDTO,
|
||||
TDuplicateGithubIntegrationAuthDTO,
|
||||
TGetIntegrationAuthDTO,
|
||||
TGetIntegrationAuthTeamCityBuildConfigDTO,
|
||||
THerokuPipelineCoupling,
|
||||
@@ -86,6 +90,24 @@ export const integrationAuthServiceFactory = ({
|
||||
return authorizations;
|
||||
};
|
||||
|
||||
const listOrgIntegrationAuth = async ({ actorId, actor, actorOrgId, actorAuthMethod }: TGenericPermission) => {
|
||||
const authorizations = await integrationAuthDAL.getByOrg(actorOrgId as string);
|
||||
|
||||
return Promise.all(
|
||||
authorizations.filter(async (auth) => {
|
||||
const { permission } = await permissionService.getProjectPermission(
|
||||
actor,
|
||||
actorId,
|
||||
auth.projectId,
|
||||
actorAuthMethod,
|
||||
actorOrgId
|
||||
);
|
||||
|
||||
return permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
|
||||
})
|
||||
);
|
||||
};
|
||||
|
||||
const getIntegrationAuth = async ({ actor, id, actorId, actorAuthMethod, actorOrgId }: TGetIntegrationAuthDTO) => {
|
||||
const integrationAuth = await integrationAuthDAL.findById(id);
|
||||
if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
|
||||
@@ -109,7 +131,8 @@ export const integrationAuthServiceFactory = ({
|
||||
actorAuthMethod,
|
||||
integration,
|
||||
url,
|
||||
code
|
||||
code,
|
||||
installationId
|
||||
}: TOauthExchangeDTO) => {
|
||||
if (!Object.values(Integrations).includes(integration as Integrations))
|
||||
throw new BadRequestError({ message: "Invalid integration" });
|
||||
@@ -123,7 +146,7 @@ export const integrationAuthServiceFactory = ({
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
|
||||
|
||||
const tokenExchange = await exchangeCode({ integration, code, url });
|
||||
const tokenExchange = await exchangeCode({ integration, code, url, installationId });
|
||||
const updateDoc: TIntegrationAuthsInsert = {
|
||||
projectId,
|
||||
integration,
|
||||
@@ -141,6 +164,16 @@ export const integrationAuthServiceFactory = ({
|
||||
updateDoc.metadata = {
|
||||
authMethod: "oauth2"
|
||||
};
|
||||
} else if (integration === Integrations.GITHUB && installationId) {
|
||||
updateDoc.metadata = {
|
||||
installationId,
|
||||
installationName: tokenExchange.installationName,
|
||||
authMethod: "app"
|
||||
};
|
||||
}
|
||||
|
||||
if (installationId && integration === Integrations.GITHUB) {
|
||||
return integrationAuthDAL.create(updateDoc);
|
||||
}
|
||||
|
||||
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(projectId);
|
||||
@@ -176,12 +209,23 @@ export const integrationAuthServiceFactory = ({
|
||||
updateDoc.accessCiphertext = accessEncToken.ciphertext;
|
||||
}
|
||||
}
|
||||
|
||||
return integrationAuthDAL.transaction(async (tx) => {
|
||||
const doc = await integrationAuthDAL.findOne({ projectId, integration }, tx);
|
||||
if (!doc) {
|
||||
const integrationAuths = await integrationAuthDAL.find({ projectId, integration }, { tx });
|
||||
let existingIntegrationAuth: TIntegrationAuths | undefined;
|
||||
|
||||
// we need to ensure that the integration auth that we use for Github is actually Oauth
|
||||
if (integration === Integrations.GITHUB) {
|
||||
existingIntegrationAuth = integrationAuths.find((integAuth) => !integAuth.metadata);
|
||||
} else {
|
||||
[existingIntegrationAuth] = integrationAuths;
|
||||
}
|
||||
|
||||
if (!existingIntegrationAuth) {
|
||||
return integrationAuthDAL.create(updateDoc, tx);
|
||||
}
|
||||
return integrationAuthDAL.updateById(doc.id, updateDoc, tx);
|
||||
|
||||
return integrationAuthDAL.updateById(existingIntegrationAuth.id, updateDoc, tx);
|
||||
});
|
||||
};
|
||||
|
||||
@@ -334,6 +378,13 @@ export const integrationAuthServiceFactory = ({
|
||||
) {
|
||||
return { accessToken: "", accessId: "" };
|
||||
}
|
||||
if (
|
||||
integrationAuth.integration === Integrations.GITHUB &&
|
||||
IntegrationAuthMetadataSchema.parse(integrationAuth.metadata || {}).installationId
|
||||
) {
|
||||
return { accessToken: "", accessId: "" };
|
||||
}
|
||||
|
||||
if (shouldUseSecretV2Bridge) {
|
||||
const { decryptor: secretManagerDecryptor, encryptor: secretManagerEncryptor } =
|
||||
await kmsService.createCipherPairWithDataKey({
|
||||
@@ -460,6 +511,7 @@ export const integrationAuthServiceFactory = ({
|
||||
const { accessToken, accessId } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey);
|
||||
const apps = await getApps({
|
||||
integration: integrationAuth.integration,
|
||||
integrationAuth,
|
||||
accessToken,
|
||||
accessId,
|
||||
teamId,
|
||||
@@ -575,6 +627,7 @@ export const integrationAuthServiceFactory = ({
|
||||
};
|
||||
|
||||
const getGithubOrgs = async ({ actorId, actor, actorOrgId, actorAuthMethod, id }: TIntegrationAuthGithubOrgsDTO) => {
|
||||
const appCfg = getConfig();
|
||||
const integrationAuth = await integrationAuthDAL.findById(id);
|
||||
if (!integrationAuth) throw new NotFoundError({ message: "Failed to find integration" });
|
||||
|
||||
@@ -587,9 +640,44 @@ export const integrationAuthServiceFactory = ({
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
|
||||
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
|
||||
const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey);
|
||||
|
||||
const octokit = new Octokit({
|
||||
let octokit: Octokit;
|
||||
const { installationId } = (integrationAuth.metadata as TIntegrationAuthMetadata) || {};
|
||||
if (installationId) {
|
||||
octokit = new Octokit({
|
||||
authStrategy: createAppAuth,
|
||||
auth: {
|
||||
appId: appCfg.CLIENT_APP_ID_GITHUB_APP,
|
||||
privateKey: appCfg.CLIENT_PRIVATE_KEY_GITHUB_APP,
|
||||
installationId
|
||||
}
|
||||
});
|
||||
|
||||
// eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
|
||||
const repos = await octokit.paginate("GET /installation/repositories", {
|
||||
per_page: 100
|
||||
});
|
||||
|
||||
const orgSet: Set<string> = new Set();
|
||||
|
||||
return repos
|
||||
.filter((repo) => repo.owner.type === "Organization")
|
||||
.map((repo) => ({
|
||||
name: repo.owner.login,
|
||||
orgId: String(repo.owner.id)
|
||||
}))
|
||||
.filter((org) => {
|
||||
const isOrgProcessed = orgSet.has(org.orgId);
|
||||
if (!isOrgProcessed) {
|
||||
orgSet.add(org.orgId);
|
||||
}
|
||||
|
||||
return !isOrgProcessed;
|
||||
});
|
||||
}
|
||||
|
||||
const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey);
|
||||
octokit = new Octokit({
|
||||
auth: accessToken
|
||||
});
|
||||
|
||||
@@ -598,7 +686,9 @@ export const integrationAuthServiceFactory = ({
|
||||
"X-GitHub-Api-Version": "2022-11-28"
|
||||
}
|
||||
});
|
||||
if (!data) return [];
|
||||
if (!data) {
|
||||
return [];
|
||||
}
|
||||
|
||||
return data.map(({ login: name, id: orgId }) => ({ name, orgId: String(orgId) }));
|
||||
};
|
||||
@@ -626,9 +716,24 @@ export const integrationAuthServiceFactory = ({
|
||||
const { shouldUseSecretV2Bridge, botKey } = await projectBotService.getBotKey(integrationAuth.projectId);
|
||||
const { accessToken } = await getIntegrationAccessToken(integrationAuth, shouldUseSecretV2Bridge, botKey);
|
||||
|
||||
const octokit = new Octokit({
|
||||
auth: accessToken
|
||||
});
|
||||
let octokit: Octokit;
|
||||
const appCfg = getConfig();
|
||||
|
||||
const authMetadata = IntegrationAuthMetadataSchema.parse(integrationAuth.metadata || {});
|
||||
if (authMetadata.installationId) {
|
||||
octokit = new Octokit({
|
||||
authStrategy: createAppAuth,
|
||||
auth: {
|
||||
appId: appCfg.CLIENT_APP_ID_GITHUB_APP,
|
||||
privateKey: appCfg.CLIENT_PRIVATE_KEY_GITHUB_APP,
|
||||
installationId: authMetadata.installationId
|
||||
}
|
||||
});
|
||||
} else {
|
||||
octokit = new Octokit({
|
||||
auth: accessToken
|
||||
});
|
||||
}
|
||||
|
||||
const {
|
||||
data: { environments }
|
||||
@@ -1315,8 +1420,58 @@ export const integrationAuthServiceFactory = ({
|
||||
return delIntegrationAuth;
|
||||
};
|
||||
|
||||
// At the moment, we only use this for Github App integration as it's a special case
|
||||
const duplicateIntegrationAuth = async ({
|
||||
id,
|
||||
actorId,
|
||||
actor,
|
||||
actorAuthMethod,
|
||||
actorOrgId,
|
||||
projectId
|
||||
}: TDuplicateGithubIntegrationAuthDTO) => {
|
||||
const integrationAuth = await integrationAuthDAL.findById(id);
|
||||
if (!integrationAuth) {
|
||||
throw new NotFoundError({ message: "Failed to find integration" });
|
||||
}
|
||||
|
||||
const { permission: sourcePermission } = await permissionService.getProjectPermission(
|
||||
actor,
|
||||
actorId,
|
||||
integrationAuth.projectId,
|
||||
actorAuthMethod,
|
||||
actorOrgId
|
||||
);
|
||||
|
||||
ForbiddenError.from(sourcePermission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Integrations
|
||||
);
|
||||
|
||||
const { permission: targetPermission } = await permissionService.getProjectPermission(
|
||||
actor,
|
||||
actorId,
|
||||
projectId,
|
||||
actorAuthMethod,
|
||||
actorOrgId
|
||||
);
|
||||
|
||||
ForbiddenError.from(targetPermission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Integrations
|
||||
);
|
||||
|
||||
const newIntegrationAuth: Omit<typeof integrationAuth, "id"> & { id?: string } = {
|
||||
...integrationAuth,
|
||||
id: undefined,
|
||||
projectId
|
||||
};
|
||||
|
||||
return integrationAuthDAL.create(newIntegrationAuth);
|
||||
};
|
||||
|
||||
return {
|
||||
listIntegrationAuthByProjectId,
|
||||
listOrgIntegrationAuth,
|
||||
getIntegrationOptions,
|
||||
getIntegrationAuth,
|
||||
oauthExchange,
|
||||
@@ -1343,6 +1498,7 @@ export const integrationAuthServiceFactory = ({
|
||||
getNorthFlankSecretGroups,
|
||||
getTeamcityBuildConfigs,
|
||||
getBitbucketWorkspaces,
|
||||
getIntegrationAccessToken
|
||||
getIntegrationAccessToken,
|
||||
duplicateIntegrationAuth
|
||||
};
|
||||
};
|
||||
|
||||
@@ -9,6 +9,7 @@ export type TOauthExchangeDTO = {
|
||||
integration: string;
|
||||
code: string;
|
||||
url?: string;
|
||||
installationId?: string;
|
||||
} & TProjectPermission;
|
||||
|
||||
export type TSaveIntegrationAccessTokenDTO = {
|
||||
@@ -107,6 +108,10 @@ export type TDeleteIntegrationAuthByIdDTO = {
|
||||
id: string;
|
||||
} & Omit<TProjectPermission, "projectId">;
|
||||
|
||||
export type TDuplicateGithubIntegrationAuthDTO = {
|
||||
id: string;
|
||||
} & TProjectPermission;
|
||||
|
||||
export type TGetIntegrationAuthTeamCityBuildConfigDTO = {
|
||||
id: string;
|
||||
appId: string;
|
||||
|
||||
@@ -1,7 +1,10 @@
|
||||
/* eslint-disable @typescript-eslint/no-unsafe-member-access */
|
||||
import { createAppAuth } from "@octokit/auth-app";
|
||||
import { retry } from "@octokit/plugin-retry";
|
||||
import { Octokit } from "@octokit/rest";
|
||||
|
||||
import { TIntegrationAuths, TIntegrations } from "@app/db/schemas";
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
|
||||
import { BadRequestError, NotFoundError } from "@app/lib/errors";
|
||||
import { logger } from "@app/lib/logger";
|
||||
@@ -15,6 +18,7 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
|
||||
import { TSecretImportDALFactory } from "../secret-import/secret-import-dal";
|
||||
import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns";
|
||||
import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
|
||||
import { IntegrationAuthMetadataSchema, TIntegrationAuthMetadata } from "./integration-auth-schema";
|
||||
import { TIntegrationAuthServiceFactory } from "./integration-auth-service";
|
||||
import { Integrations } from "./integration-list";
|
||||
|
||||
@@ -154,10 +158,12 @@ const getIntegrationSecretsV1 = async (
|
||||
|
||||
export const deleteGithubSecrets = async ({
|
||||
integration,
|
||||
authMetadata,
|
||||
secrets,
|
||||
accessToken
|
||||
}: {
|
||||
integration: Omit<TIntegrations, "envId">;
|
||||
authMetadata: TIntegrationAuthMetadata;
|
||||
secrets: Record<string, boolean>;
|
||||
accessToken: string;
|
||||
}) => {
|
||||
@@ -170,9 +176,23 @@ export const deleteGithubSecrets = async ({
|
||||
}
|
||||
|
||||
const OctokitWithRetry = Octokit.plugin(retry);
|
||||
const octokit = new OctokitWithRetry({
|
||||
auth: accessToken
|
||||
});
|
||||
let octokit: Octokit;
|
||||
const appCfg = getConfig();
|
||||
|
||||
if (authMetadata.installationId) {
|
||||
octokit = new OctokitWithRetry({
|
||||
authStrategy: createAppAuth,
|
||||
auth: {
|
||||
appId: appCfg.CLIENT_APP_ID_GITHUB_APP,
|
||||
privateKey: appCfg.CLIENT_PRIVATE_KEY_GITHUB_APP,
|
||||
installationId: authMetadata.installationId
|
||||
}
|
||||
});
|
||||
} else {
|
||||
octokit = new OctokitWithRetry({
|
||||
auth: accessToken
|
||||
});
|
||||
}
|
||||
|
||||
enum GithubScope {
|
||||
Repo = "github-repo",
|
||||
@@ -192,6 +212,7 @@ export const deleteGithubSecrets = async ({
|
||||
break;
|
||||
}
|
||||
case GithubScope.Env: {
|
||||
// eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
|
||||
encryptedGithubSecrets = (
|
||||
await octokit.request("GET /repositories/{repository_id}/environments/{environment_name}/secrets", {
|
||||
repository_id: Number(integration.appId),
|
||||
@@ -346,6 +367,7 @@ export const deleteIntegrationSecrets = async ({
|
||||
case Integrations.GITHUB: {
|
||||
await deleteGithubSecrets({
|
||||
integration,
|
||||
authMetadata: IntegrationAuthMetadataSchema.parse(integrationAuth.metadata || {}),
|
||||
accessToken,
|
||||
secrets: Object.keys(suffixedSecrets).length !== 0 ? suffixedSecrets : secrets
|
||||
});
|
||||
|
||||
@@ -96,7 +96,9 @@ export enum IntegrationUrls {
|
||||
GCP_SECRET_MANAGER_SERVICE_NAME = "secretmanager.googleapis.com",
|
||||
GCP_SECRET_MANAGER_URL = `https://${GCP_SECRET_MANAGER_SERVICE_NAME}`,
|
||||
GCP_SERVICE_USAGE_URL = "https://serviceusage.googleapis.com",
|
||||
GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform"
|
||||
GCP_CLOUD_PLATFORM_SCOPE = "https://www.googleapis.com/auth/cloud-platform",
|
||||
|
||||
GITHUB_USER_INSTALLATIONS = "https://api.github.com/user/installations"
|
||||
}
|
||||
|
||||
export const getIntegrationOptions = async () => {
|
||||
@@ -138,6 +140,7 @@ export const getIntegrationOptions = async () => {
|
||||
isAvailable: true,
|
||||
type: "oauth",
|
||||
clientId: appCfg.CLIENT_ID_GITHUB,
|
||||
clientSlug: appCfg.CLIENT_SLUG_GITHUB_APP,
|
||||
docsLink: ""
|
||||
},
|
||||
{
|
||||
|
||||
@@ -19,6 +19,7 @@ import {
|
||||
UpdateSecretCommand
|
||||
} from "@aws-sdk/client-secrets-manager";
|
||||
import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
|
||||
import { createAppAuth } from "@octokit/auth-app";
|
||||
import { Octokit } from "@octokit/rest";
|
||||
import AWS, { AWSError } from "aws-sdk";
|
||||
import { AxiosError } from "axios";
|
||||
@@ -36,6 +37,7 @@ import { TCreateManySecretsRawFn, TUpdateManySecretsRawFn } from "@app/services/
|
||||
|
||||
import { TIntegrationDALFactory } from "../integration/integration-dal";
|
||||
import { IntegrationMetadataSchema } from "../integration/integration-schema";
|
||||
import { IntegrationAuthMetadataSchema } from "./integration-auth-schema";
|
||||
import { TIntegrationsWithEnvironment } from "./integration-auth-types";
|
||||
import {
|
||||
IntegrationInitialSyncBehavior,
|
||||
@@ -1542,11 +1544,13 @@ const syncSecretsNetlify = async ({
|
||||
*/
|
||||
const syncSecretsGitHub = async ({
|
||||
integration,
|
||||
integrationAuth,
|
||||
secrets,
|
||||
accessToken,
|
||||
appendices
|
||||
}: {
|
||||
integration: TIntegrations;
|
||||
integrationAuth: TIntegrationAuths;
|
||||
secrets: Record<string, { value: string; comment?: string }>;
|
||||
accessToken: string;
|
||||
appendices?: { prefix: string; suffix: string };
|
||||
@@ -1568,9 +1572,24 @@ const syncSecretsGitHub = async ({
|
||||
selected_repositories_url?: string | undefined;
|
||||
}
|
||||
|
||||
const octokit = new Octokit({
|
||||
auth: accessToken
|
||||
});
|
||||
const authMetadata = IntegrationAuthMetadataSchema.parse(integrationAuth.metadata || {});
|
||||
let octokit: Octokit;
|
||||
const appCfg = getConfig();
|
||||
|
||||
if (authMetadata.installationId) {
|
||||
octokit = new Octokit({
|
||||
authStrategy: createAppAuth,
|
||||
auth: {
|
||||
appId: appCfg.CLIENT_APP_ID_GITHUB_APP,
|
||||
privateKey: appCfg.CLIENT_PRIVATE_KEY_GITHUB_APP,
|
||||
installationId: authMetadata.installationId
|
||||
}
|
||||
});
|
||||
} else {
|
||||
octokit = new Octokit({
|
||||
auth: accessToken
|
||||
});
|
||||
}
|
||||
|
||||
enum GithubScope {
|
||||
Repo = "github-repo",
|
||||
@@ -4069,6 +4088,7 @@ export const syncIntegrationSecrets = async ({
|
||||
case Integrations.GITHUB:
|
||||
await syncSecretsGitHub({
|
||||
integration,
|
||||
integrationAuth,
|
||||
secrets,
|
||||
accessToken,
|
||||
appendices
|
||||
|
||||
@@ -2,7 +2,7 @@ import jwt from "jsonwebtoken";
|
||||
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { BadRequestError, NotFoundError } from "@app/lib/errors";
|
||||
import { BadRequestError, ForbiddenRequestError, InternalServerError, NotFoundError } from "@app/lib/errors";
|
||||
|
||||
import { Integrations, IntegrationUrls } from "./integration-list";
|
||||
|
||||
@@ -234,12 +234,73 @@ const exchangeCodeNetlify = async ({ code }: { code: string }) => {
|
||||
};
|
||||
};
|
||||
|
||||
const exchangeCodeGithub = async ({ code }: { code: string }) => {
|
||||
const exchangeCodeGithub = async ({ code, installationId }: { code: string; installationId?: string }) => {
|
||||
const appCfg = getConfig();
|
||||
if (!appCfg.CLIENT_ID_GITHUB || !appCfg.CLIENT_SECRET_GITHUB) {
|
||||
throw new BadRequestError({ message: "Missing client id and client secret" });
|
||||
|
||||
if (!installationId && (!appCfg.CLIENT_ID_GITHUB || !appCfg.CLIENT_SECRET_GITHUB)) {
|
||||
throw new InternalServerError({ message: "Missing client id and client secret" });
|
||||
}
|
||||
|
||||
if (installationId && (!appCfg.CLIENT_ID_GITHUB_APP || !appCfg.CLIENT_SECRET_GITHUB_APP)) {
|
||||
throw new InternalServerError({
|
||||
message: "Missing Github app client ID and client secret"
|
||||
});
|
||||
}
|
||||
|
||||
if (installationId) {
|
||||
// handle app installations
|
||||
const oauthRes = (
|
||||
await request.get<ExchangeCodeGithubResponse>(IntegrationUrls.GITHUB_TOKEN_URL, {
|
||||
params: {
|
||||
client_id: appCfg.CLIENT_ID_GITHUB_APP,
|
||||
client_secret: appCfg.CLIENT_SECRET_GITHUB_APP,
|
||||
code,
|
||||
redirect_uri: `${appCfg.SITE_URL}/integrations/github/oauth2/callback`
|
||||
},
|
||||
headers: {
|
||||
Accept: "application/json",
|
||||
"Accept-Encoding": "application/json"
|
||||
}
|
||||
})
|
||||
).data;
|
||||
|
||||
// use access token to validate installation ID
|
||||
const installationsRes = (
|
||||
await request.get<{
|
||||
installations: {
|
||||
id: number;
|
||||
account: {
|
||||
login: string;
|
||||
};
|
||||
}[];
|
||||
}>(IntegrationUrls.GITHUB_USER_INSTALLATIONS, {
|
||||
headers: {
|
||||
Accept: "application/json",
|
||||
Authorization: `Bearer ${oauthRes.access_token}`,
|
||||
"Accept-Encoding": "application/json"
|
||||
}
|
||||
})
|
||||
).data;
|
||||
|
||||
const matchingInstallation = installationsRes.installations.find(
|
||||
(installation) => installation.id === +installationId
|
||||
);
|
||||
|
||||
if (!matchingInstallation) {
|
||||
throw new ForbiddenRequestError({
|
||||
message: "User has no access to the provided installation"
|
||||
});
|
||||
}
|
||||
|
||||
return {
|
||||
accessToken: "", // for github app integrations, we only need the installationID from the metadata
|
||||
refreshToken: null,
|
||||
accessExpiresAt: null,
|
||||
installationName: matchingInstallation.account.login
|
||||
};
|
||||
}
|
||||
|
||||
// handle oauth github integration
|
||||
const res = (
|
||||
await request.get<ExchangeCodeGithubResponse>(IntegrationUrls.GITHUB_TOKEN_URL, {
|
||||
params: {
|
||||
@@ -346,6 +407,7 @@ type TExchangeReturn = {
|
||||
url?: string;
|
||||
teamId?: string;
|
||||
accountId?: string;
|
||||
installationName?: string;
|
||||
};
|
||||
|
||||
/**
|
||||
@@ -355,11 +417,13 @@ type TExchangeReturn = {
|
||||
export const exchangeCode = async ({
|
||||
integration,
|
||||
code,
|
||||
url
|
||||
url,
|
||||
installationId
|
||||
}: {
|
||||
integration: string;
|
||||
code: string;
|
||||
url?: string;
|
||||
installationId?: string;
|
||||
}): Promise<TExchangeReturn> => {
|
||||
switch (integration) {
|
||||
case Integrations.GCP_SECRET_MANAGER:
|
||||
@@ -384,7 +448,8 @@ export const exchangeCode = async ({
|
||||
});
|
||||
case Integrations.GITHUB:
|
||||
return exchangeCodeGithub({
|
||||
code
|
||||
code,
|
||||
installationId
|
||||
});
|
||||
case Integrations.GITLAB:
|
||||
return exchangeCodeGitlab({
|
||||
|
||||
@@ -258,27 +258,7 @@ export const integrationServiceFactory = ({
|
||||
});
|
||||
}
|
||||
|
||||
const deletedIntegration = await integrationDAL.transaction(async (tx) => {
|
||||
// delete integration
|
||||
const deletedIntegrationResult = await integrationDAL.deleteById(id, tx);
|
||||
|
||||
// check if there are other integrations that share the same integration auth
|
||||
const integrations = await integrationDAL.find(
|
||||
{
|
||||
integrationAuthId: integration.integrationAuthId
|
||||
},
|
||||
tx
|
||||
);
|
||||
|
||||
if (integrations.length === 0) {
|
||||
// no other integration shares the same integration auth
|
||||
// -> delete the integration auth
|
||||
await integrationAuthDAL.deleteById(integration.integrationAuthId, tx);
|
||||
}
|
||||
|
||||
return deletedIntegrationResult;
|
||||
});
|
||||
|
||||
const deletedIntegration = await integrationDAL.deleteById(id);
|
||||
return { ...integration, ...deletedIntegration };
|
||||
};
|
||||
|
||||
|
||||
BIN
docs/images/integrations/github/app/github-app-installation.png
Normal file
BIN
docs/images/integrations/github/app/github-app-installation.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 287 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 503 KiB |
BIN
docs/images/integrations/github/app/integration-overview.png
Normal file
BIN
docs/images/integrations/github/app/integration-overview.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 891 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 297 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 307 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 233 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 406 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 345 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 383 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 239 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 367 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 330 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 284 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 497 KiB |
BIN
docs/images/integrations/github/integration-overview.png
Normal file
BIN
docs/images/integrations/github/integration-overview.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 891 KiB |
@@ -4,12 +4,122 @@ description: "How to sync secrets from Infisical to GitHub Actions"
|
||||
---
|
||||
|
||||
<Note>
|
||||
Alternatively, you can use Infisical's official Github Action
|
||||
Alternatively, you can use Infisical's official GitHub Action
|
||||
[here](https://github.com/Infisical/secrets-action).
|
||||
</Note>
|
||||
|
||||
Infisical lets you sync secrets to GitHub at the organization-level, repository-level, and repository environment-level.
|
||||
|
||||
## Connecting with GitHub App (Recommended)
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Usage">
|
||||
<Steps>
|
||||
<Step title="Authorize GitHub Infisical App">
|
||||
Navigate to your project's integrations tab in Infisical and press on the GitHub tile.
|
||||
|
||||
|
||||
|
||||
Select GitHub App as the authentication method and click **Connect to GitHub**.
|
||||
|
||||
|
||||
|
||||
You will then be redirected to the GitHub app installation page.
|
||||
|
||||
|
||||
|
||||
Install and authorize the GitHub application. This will redirect you back to the Infisical integration page.
|
||||
|
||||
</Step>
|
||||
<Step title="Configure Infisical GitHub integration">
|
||||
Select which Infisical environment secrets you want to sync to which GitHub organization, repository, or repository environment.
|
||||
|
||||
<Tabs>
|
||||
<Tab title="Repository">
|
||||
|
||||
</Tab>
|
||||
<Tab title="Organization">
|
||||
|
||||
|
||||
When using the organization scope, your secrets will be saved in the top-level of your GitHub Organization.
|
||||
|
||||
You can choose the visibility, which defines which repositories can access the secrets. The options are:
|
||||
- **All public repositories**: All public repositories in the organization can access the secrets.
|
||||
- **All private repositories**: All private repositories in the organization can access the secrets.
|
||||
- **Selected repositories**: Only the selected repositories can access the secrets. This gives a more fine-grained control over which repositories can access the secrets. You can select _both_ private and public repositories with this option.
|
||||
</Tab>
|
||||
<Tab title="Repository Environment">
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
Finally, press create integration to start syncing secrets to GitHub.
|
||||
|
||||
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
<Tab title="Self-Hosted Setup">
|
||||
Using the GitHub integration with app authentication on a self-hosted instance of Infisical requires configuring an application on GitHub
|
||||
and registering your instance with it.
|
||||
<Steps>
|
||||
<Step title="Create an application on GitHub">
|
||||
Navigate to the GitHub app settings [here](https://github.com/settings/apps). Click **New GitHub App**.
|
||||
|
||||
|
||||
|
||||
Give the application a name, a homepage URL (your self-hosted domain i.e. `https://your-domain.com`), and a callback URL (i.e. `https://your-domain.com/integrations/github/oauth2/callback`).
|
||||
|
||||
|
||||
|
||||
Enable request user authorization during app installation.
|
||||
|
||||
|
||||
Disable webhook by unchecking the Active checkbox.
|
||||
|
||||
|
||||
Set the repository permissions as follows: Metadata: Read-only, Secrets: Read and write, Environments: Read and write.
|
||||
|
||||
|
||||
Similarly, set the organization permissions as follows: Secrets: Read and write.
|
||||
|
||||
|
||||
Create the Github application.
|
||||
|
||||
|
||||
<Note>
|
||||
If you have a GitHub organization, you can create an application under it
|
||||
in your organization Settings > Developer settings > GitHub Apps > New GitHub App.
|
||||
</Note>
|
||||
</Step>
|
||||
<Step title="Add your application credentials to Infisical">
|
||||
Generate a new **Client Secret** for your GitHub application.
|
||||
|
||||
|
||||
Generate a new **Private Key** for your Github application.
|
||||
|
||||
|
||||
Obtain the necessary Github application credentials. This would be the application slug, client ID, app ID, client secret, and private key.
|
||||
|
||||
|
||||
Back in your Infisical instance, add the five new environment variables for the credentials of your GitHub application:
|
||||
|
||||
- `CLIENT_ID_GITHUB_APP`: The **Client ID** of your GitHub application.
|
||||
- `CLIENT_SECRET_GITHUB_APP`: The **Client Secret** of your GitHub application.
|
||||
- `CLIENT_SLUG_GITHUB_APP`: The **Slug** of your GitHub application. This is the one found in the URL.
|
||||
- `CLIENT_APP_ID_GITHUB_APP`: The **App ID** of your GitHub application.
|
||||
- `CLIENT_PRIVATE_KEY_GITHUB_APP`: The **Private Key** of your GitHub application.
|
||||
|
||||
Once added, restart your Infisical instance and use the GitHub integration via app authentication.
|
||||
</Step>
|
||||
</Steps>
|
||||
|
||||
</Tab>
|
||||
</Tabs>
|
||||
|
||||
## Connecting with GitHub OAuth
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
@@ -19,12 +129,13 @@ Prerequisites:
|
||||
<Tab title="Usage">
|
||||
<Steps>
|
||||
<Step title="Authorize Infisical for GitHub">
|
||||
Navigate to your project's integrations tab in Infisical.
|
||||
Navigate to your project's integrations tab in Infisical and press on the GitHub tile.
|
||||
|
||||
|
||||
|
||||
|
||||
Press on the GitHub tile and grant Infisical access to your GitHub account (repo privileges only).
|
||||
Select OAuth as the authentication method and click **Connect to GitHub**.
|
||||
|
||||
|
||||
Grant Infisical access to your GitHub account (organization and repo privileges).
|
||||
|
||||
|
||||
</Step>
|
||||
@@ -38,7 +149,7 @@ Prerequisites:
|
||||
<Tab title="Organization">
|
||||
|
||||
|
||||
When using the organization scope, your secrets will be saved in the top-level of your Github Organization.
|
||||
When using the organization scope, your secrets will be saved in the top-level of your GitHub Organization.
|
||||
|
||||
You can choose the visibility, which defines which repositories can access the secrets. The options are:
|
||||
- **All public repositories**: All public repositories in the organization can access the secrets.
|
||||
|
||||
@@ -1,3 +1,4 @@
|
||||
export { useDuplicateIntegrationAuth } from "./mutations";
|
||||
export {
|
||||
useAuthorizeIntegration,
|
||||
useDeleteIntegrationAuth,
|
||||
|
||||
19
frontend/src/hooks/api/integrationAuth/mutations.tsx
Normal file
19
frontend/src/hooks/api/integrationAuth/mutations.tsx
Normal file
@@ -0,0 +1,19 @@
|
||||
import { useMutation } from "@tanstack/react-query";
|
||||
|
||||
import { apiRequest } from "@app/config/request";
|
||||
|
||||
import { IntegrationAuth, TDuplicateIntegrationAuthDTO } from "./types";
|
||||
|
||||
// For now, this should only be used in the Github app integration flow.
|
||||
export const useDuplicateIntegrationAuth = () => {
|
||||
return useMutation<IntegrationAuth, {}, TDuplicateIntegrationAuthDTO>({
|
||||
mutationFn: async (body) => {
|
||||
const { data } = await apiRequest.post<{ integrationAuth: IntegrationAuth }>(
|
||||
`/api/v1/integration-auth/${body.integrationAuthId}/duplicate`,
|
||||
body
|
||||
);
|
||||
|
||||
return data.integrationAuth;
|
||||
}
|
||||
});
|
||||
};
|
||||
@@ -777,11 +777,13 @@ export const useAuthorizeIntegration = () => {
|
||||
workspaceId,
|
||||
code,
|
||||
integration,
|
||||
installationId,
|
||||
url
|
||||
}: {
|
||||
workspaceId: string;
|
||||
code: string;
|
||||
integration: string;
|
||||
installationId?: string;
|
||||
url?: string;
|
||||
}) => {
|
||||
const {
|
||||
@@ -790,6 +792,7 @@ export const useAuthorizeIntegration = () => {
|
||||
workspaceId,
|
||||
code,
|
||||
integration,
|
||||
installationId,
|
||||
url
|
||||
});
|
||||
|
||||
|
||||
@@ -9,6 +9,10 @@ export type IntegrationAuth = {
|
||||
keyEncoding: string;
|
||||
url?: string;
|
||||
teamId?: string;
|
||||
metadata: {
|
||||
installationName?: string;
|
||||
installationId?: string;
|
||||
};
|
||||
};
|
||||
|
||||
export type App = {
|
||||
@@ -84,3 +88,8 @@ export type TeamCityBuildConfig = {
|
||||
name: string;
|
||||
buildConfigId: string;
|
||||
};
|
||||
|
||||
export type TDuplicateIntegrationAuthDTO = {
|
||||
integrationAuthId: string;
|
||||
projectId: string;
|
||||
};
|
||||
|
||||
@@ -8,8 +8,9 @@ export {
|
||||
useDeleteOrgTaxId,
|
||||
useGetIdentityMembershipOrgs,
|
||||
useGetOrganizationGroups,
|
||||
useGetOrganizations,
|
||||
useGetOrganizations,
|
||||
useGetOrgBillingDetails,
|
||||
useGetOrgIntegrationAuths,
|
||||
useGetOrgInvoices,
|
||||
useGetOrgLicenses,
|
||||
useGetOrgPlanBillingInfo,
|
||||
@@ -20,4 +21,4 @@ export {
|
||||
useGetOrgTrialUrl,
|
||||
useUpdateOrg,
|
||||
useUpdateOrgBillingDetails
|
||||
} from "./queries";
|
||||
} from "./queries";
|
||||
|
||||
@@ -4,6 +4,7 @@ import { apiRequest } from "@app/config/request";
|
||||
import { OrderByDirection } from "@app/hooks/api/generic/types";
|
||||
|
||||
import { TGroupOrgMembership } from "../groups/types";
|
||||
import { IntegrationAuth } from "../types";
|
||||
import {
|
||||
BillingDetails,
|
||||
Invoice,
|
||||
@@ -39,7 +40,8 @@ export const organizationKeys = {
|
||||
...params
|
||||
}: TListOrgIdentitiesDTO) =>
|
||||
[...organizationKeys.getOrgIdentityMemberships(orgId), params] as const,
|
||||
getOrgGroups: (orgId: string) => [{ orgId }, "organization-groups"] as const
|
||||
getOrgGroups: (orgId: string) => [{ orgId }, "organization-groups"] as const,
|
||||
getOrgIntegrationAuths: (orgId: string) => [{ orgId }, "integration-auths"] as const
|
||||
};
|
||||
|
||||
export const fetchOrganizations = async () => {
|
||||
@@ -464,3 +466,21 @@ export const useGetOrganizationGroups = (organizationId: string) => {
|
||||
}
|
||||
});
|
||||
};
|
||||
|
||||
export const useGetOrgIntegrationAuths = <TData = IntegrationAuth[],>(
|
||||
organizationId: string,
|
||||
select?: (data: IntegrationAuth[]) => TData
|
||||
) => {
|
||||
return useQuery({
|
||||
queryKey: organizationKeys.getOrgIntegrationAuths(organizationId),
|
||||
queryFn: async () => {
|
||||
const { data } = await apiRequest.get<{ authorizations: IntegrationAuth[] }>(
|
||||
`/api/v1/organization/${organizationId}/integration-authorizations`
|
||||
);
|
||||
|
||||
return data.authorizations;
|
||||
},
|
||||
enabled: Boolean(organizationId),
|
||||
select
|
||||
});
|
||||
};
|
||||
|
||||
108
frontend/src/pages/integrations/github/auth-mode-selection.tsx
Normal file
108
frontend/src/pages/integrations/github/auth-mode-selection.tsx
Normal file
@@ -0,0 +1,108 @@
|
||||
import crypto from "crypto";
|
||||
|
||||
import { useState } from "react";
|
||||
import Head from "next/head";
|
||||
import Image from "next/image";
|
||||
import Link from "next/link";
|
||||
import { useRouter } from "next/router";
|
||||
import { faArrowUpRightFromSquare, faBookOpen } from "@fortawesome/free-solid-svg-icons";
|
||||
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
|
||||
|
||||
import {
|
||||
Button,
|
||||
Card,
|
||||
CardBody,
|
||||
CardTitle,
|
||||
FormControl,
|
||||
Select,
|
||||
SelectItem
|
||||
} from "@app/components/v2";
|
||||
import { useGetCloudIntegrations } from "@app/hooks/api";
|
||||
|
||||
enum AuthMethod {
|
||||
APP = "APP",
|
||||
OAUTH = "OAUTH"
|
||||
}
|
||||
|
||||
export default function GithubIntegrationAuthModeSelectionPage() {
|
||||
const router = useRouter();
|
||||
const { data: cloudIntegrations } = useGetCloudIntegrations();
|
||||
const githubIntegration = cloudIntegrations?.find((integration) => integration.slug === "github");
|
||||
const [selectedAuthMethod, setSelectedAuthMethod] = useState<AuthMethod>(AuthMethod.APP);
|
||||
|
||||
return (
|
||||
<div className="flex h-full w-full items-center justify-center">
|
||||
<Head>
|
||||
<title>Select GitHub Integration Auth</title>
|
||||
<link rel="icon" href="/infisical.ico" />
|
||||
</Head>
|
||||
<Card className="mb-12 max-w-lg rounded-md border border-mineshaft-600">
|
||||
<CardTitle
|
||||
className="px-6 text-left text-xl"
|
||||
subTitle="Select how you'd like to integrate with GitHub. We recommend using the GitHub App method for fine-grained access."
|
||||
>
|
||||
<div className="flex flex-row items-center">
|
||||
<div className="flex items-center pb-0.5">
|
||||
<Image
|
||||
src="/images/integrations/GitHub.png"
|
||||
height={30}
|
||||
width={30}
|
||||
alt="Github logo"
|
||||
/>
|
||||
</div>
|
||||
<span className="ml-2.5">GitHub Integration </span>
|
||||
<Link href="https://infisical.com/docs/integrations/cicd/githubactions" passHref>
|
||||
<a target="_blank" rel="noopener noreferrer">
|
||||
<div className="ml-2 mb-1 inline-block cursor-default rounded-md bg-yellow/20 px-1.5 pb-[0.03rem] pt-[0.04rem] text-sm text-yellow opacity-80 hover:opacity-100">
|
||||
<FontAwesomeIcon icon={faBookOpen} className="mr-1.5" />
|
||||
Docs
|
||||
<FontAwesomeIcon
|
||||
icon={faArrowUpRightFromSquare}
|
||||
className="ml-1.5 mb-[0.07rem] text-xxs"
|
||||
/>
|
||||
</div>
|
||||
</a>
|
||||
</Link>
|
||||
</div>
|
||||
</CardTitle>
|
||||
<CardBody>
|
||||
<FormControl label="Select authentication method">
|
||||
<Select
|
||||
value={selectedAuthMethod}
|
||||
onValueChange={(val) => {
|
||||
setSelectedAuthMethod(val as AuthMethod);
|
||||
}}
|
||||
className="w-full border border-mineshaft-500"
|
||||
>
|
||||
<SelectItem value={AuthMethod.APP}>GitHub App (Recommended)</SelectItem>
|
||||
<SelectItem value={AuthMethod.OAUTH}>OAuth</SelectItem>
|
||||
</Select>
|
||||
</FormControl>
|
||||
<div className="flex items-end">
|
||||
<Button
|
||||
onClick={() => {
|
||||
if (selectedAuthMethod === AuthMethod.APP) {
|
||||
router.push("/integrations/select-integration-auth?integrationSlug=github");
|
||||
} else {
|
||||
const state = crypto.randomBytes(16).toString("hex");
|
||||
localStorage.setItem("latestCSRFToken", state);
|
||||
|
||||
window.location.assign(
|
||||
`https://github.com/login/oauth/authorize?client_id=${githubIntegration?.clientId}&response_type=code&scope=repo,admin:org&redirect_uri=${window.location.origin}/integrations/github/oauth2/callback&state=${state}`
|
||||
);
|
||||
}
|
||||
}}
|
||||
colorSchema="primary"
|
||||
variant="outline_bg"
|
||||
className="mt-4 ml-auto w-min"
|
||||
>
|
||||
Connect to GitHub
|
||||
</Button>
|
||||
</div>
|
||||
</CardBody>
|
||||
</Card>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
GithubIntegrationAuthModeSelectionPage.requireAuth = true;
|
||||
@@ -478,7 +478,7 @@ export default function GitHubCreateIntegrationPage() {
|
||||
errorText={
|
||||
integrationAuthOrgs?.length ? error?.message : "No organizations found"
|
||||
}
|
||||
isError={Boolean(integrationAuthOrgs?.length && error?.message)}
|
||||
isError={Boolean(integrationAuthOrgs?.length || error?.message)}
|
||||
>
|
||||
<Select
|
||||
value={field.value}
|
||||
|
||||
@@ -8,18 +8,23 @@ export default function GitHubOAuth2CallbackPage() {
|
||||
const router = useRouter();
|
||||
const { mutateAsync } = useAuthorizeIntegration();
|
||||
|
||||
const { code, state } = queryString.parse(router.asPath.split("?")[1]);
|
||||
// eslint-disable-next-line @typescript-eslint/naming-convention
|
||||
const { code, state, installation_id } = queryString.parse(router.asPath.split("?")[1]);
|
||||
|
||||
useEffect(() => {
|
||||
(async () => {
|
||||
try {
|
||||
// validate state
|
||||
if (state !== localStorage.getItem("latestCSRFToken")) return;
|
||||
if (state !== localStorage.getItem("latestCSRFToken")) {
|
||||
return;
|
||||
}
|
||||
|
||||
localStorage.removeItem("latestCSRFToken");
|
||||
|
||||
const integrationAuth = await mutateAsync({
|
||||
workspaceId: localStorage.getItem("projectData.id") as string,
|
||||
code: code as string,
|
||||
installationId: installation_id as string,
|
||||
integration: "github"
|
||||
});
|
||||
|
||||
|
||||
193
frontend/src/pages/integrations/select-integration-auth.tsx
Normal file
193
frontend/src/pages/integrations/select-integration-auth.tsx
Normal file
@@ -0,0 +1,193 @@
|
||||
import crypto from "crypto";
|
||||
|
||||
import { useCallback, useEffect } from "react";
|
||||
import Head from "next/head";
|
||||
import Image from "next/image";
|
||||
import { useRouter } from "next/router";
|
||||
|
||||
import { Button, Card, CardTitle, ContentLoader } from "@app/components/v2";
|
||||
import { useOrganization, useWorkspace } from "@app/context";
|
||||
import {
|
||||
useDuplicateIntegrationAuth,
|
||||
useGetCloudIntegrations,
|
||||
useGetOrgIntegrationAuths
|
||||
} from "@app/hooks/api";
|
||||
import { IntegrationAuth } from "@app/hooks/api/types";
|
||||
|
||||
export default function SelectIntegrationAuthPage() {
|
||||
const router = useRouter();
|
||||
const { data: cloudIntegrations } = useGetCloudIntegrations();
|
||||
const { currentOrg } = useOrganization();
|
||||
const { currentWorkspace } = useWorkspace();
|
||||
const orgId = currentOrg?.id || "";
|
||||
|
||||
const integrationSlug = router.query.integrationSlug as string;
|
||||
|
||||
const currentIntegration = cloudIntegrations?.find(
|
||||
(integration) => integration.slug === integrationSlug
|
||||
);
|
||||
const { mutateAsync: duplicateIntegrationAuth, isLoading: isIntegrationAuthSelectLoading } =
|
||||
useDuplicateIntegrationAuth();
|
||||
|
||||
// for Github, we want to reuse the same connection across the Infisical organization
|
||||
// when we do need to reuse this page for other integrations, add handling to fetch workspace integration auths instead
|
||||
const {
|
||||
data: integrationAuths,
|
||||
isLoading: isLoadingIntegrationAuths,
|
||||
isSuccess: isLoadingIntegrationAuthsSuccess
|
||||
} = useGetOrgIntegrationAuths(
|
||||
orgId,
|
||||
useCallback(
|
||||
(data: IntegrationAuth[]) => {
|
||||
const filteredIntegrationAuths = data.filter(
|
||||
(integrationAuth) => integrationAuth.integration === integrationSlug
|
||||
);
|
||||
|
||||
if (integrationSlug === "github") {
|
||||
const sameProjectIntegrationAuths = filteredIntegrationAuths.filter(
|
||||
(auth) => auth.projectId === currentWorkspace?.id
|
||||
);
|
||||
const differentProjectIntegrationAuths = filteredIntegrationAuths.filter(
|
||||
(auth) => auth.projectId !== currentWorkspace?.id
|
||||
);
|
||||
|
||||
const installationIds = new Set<string>();
|
||||
|
||||
// for now, we only display the integration auths for Github apps
|
||||
return (
|
||||
// we concatenate it this way so that integration auths from the same project are prioritized for display
|
||||
sameProjectIntegrationAuths
|
||||
.concat(differentProjectIntegrationAuths)
|
||||
.filter((integrationAuth) => Boolean(integrationAuth.metadata?.installationId))
|
||||
// we filter it so that we only show unique installations because the same installation/connection
|
||||
// can be used in multiple integration auths
|
||||
.filter((integrationAuth) => {
|
||||
const isProcessedInstallationId = installationIds.has(
|
||||
integrationAuth.metadata.installationId as string
|
||||
);
|
||||
|
||||
if (!isProcessedInstallationId) {
|
||||
installationIds.add(integrationAuth.metadata.installationId as string);
|
||||
}
|
||||
|
||||
return !isProcessedInstallationId;
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
return [];
|
||||
},
|
||||
[integrationSlug]
|
||||
)
|
||||
);
|
||||
|
||||
const handleNewConnection = () => {
|
||||
const state = crypto.randomBytes(16).toString("hex");
|
||||
localStorage.setItem("latestCSRFToken", state);
|
||||
|
||||
if (integrationSlug === "github") {
|
||||
// for now we only handle Github apps
|
||||
window.location.assign(
|
||||
`https://github.com/apps/${currentIntegration?.clientSlug}/installations/new?state=${state}`
|
||||
);
|
||||
}
|
||||
};
|
||||
|
||||
useEffect(() => {
|
||||
if (
|
||||
!isLoadingIntegrationAuths &&
|
||||
integrationAuths?.length === 0 &&
|
||||
isLoadingIntegrationAuthsSuccess
|
||||
) {
|
||||
handleNewConnection();
|
||||
}
|
||||
}, [isLoadingIntegrationAuths, integrationAuths, isLoadingIntegrationAuthsSuccess]);
|
||||
|
||||
const logo = integrationSlug === "github" ? "/images/integrations/GitHub.png" : "";
|
||||
|
||||
const handleConnectionSelect = async (integrationAuth: IntegrationAuth) => {
|
||||
if (integrationSlug === "github") {
|
||||
if (integrationAuth.projectId === currentWorkspace?.id) {
|
||||
router.push(`/integrations/github/create?integrationAuthId=${integrationAuth.id}`);
|
||||
} else {
|
||||
// we create a copy of the existing integration auth from another project to the current project
|
||||
const newIntegrationAuth = await duplicateIntegrationAuth({
|
||||
projectId: currentWorkspace?.id || "",
|
||||
integrationAuthId: integrationAuth.id
|
||||
});
|
||||
|
||||
router.push(`/integrations/github/create?integrationAuthId=${newIntegrationAuth.id}`);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
if (
|
||||
isLoadingIntegrationAuths ||
|
||||
(integrationAuths?.length === 0 && isLoadingIntegrationAuthsSuccess)
|
||||
) {
|
||||
return <ContentLoader />;
|
||||
}
|
||||
|
||||
return (
|
||||
<div className="flex h-full w-full items-center justify-center">
|
||||
<Head>
|
||||
<title>Select Connection</title>
|
||||
<link rel="icon" href="/infisical.ico" />
|
||||
</Head>
|
||||
<Card className="mb-12 max-w-lg rounded-md border border-mineshaft-600">
|
||||
<CardTitle
|
||||
className="px-6 text-left text-xl"
|
||||
subTitle="Select an existing connection below or create a new one for your integration."
|
||||
>
|
||||
<div className="flex flex-row items-center">
|
||||
<div className="flex items-center pb-0.5">
|
||||
<Image src={logo} height={30} width={30} alt="Integration logo" />
|
||||
</div>
|
||||
<span className="ml-2.5">Select Connection</span>
|
||||
</div>
|
||||
</CardTitle>
|
||||
<div className="mb-7 flex flex-col items-center">
|
||||
{!isLoadingIntegrationAuths && integrationAuths?.length
|
||||
? integrationAuths.map((integrationAuth) => {
|
||||
let connectionName = "";
|
||||
|
||||
if (integrationAuth.integration === "github") {
|
||||
connectionName = integrationAuth.metadata?.installationName || "";
|
||||
}
|
||||
|
||||
return (
|
||||
<Button
|
||||
colorSchema="secondary"
|
||||
className="mt-3 w-3/4"
|
||||
isDisabled={isIntegrationAuthSelectLoading}
|
||||
key={integrationAuth.id}
|
||||
size="sm"
|
||||
type="submit"
|
||||
onClick={() => handleConnectionSelect(integrationAuth)}
|
||||
>
|
||||
{connectionName}
|
||||
</Button>
|
||||
);
|
||||
})
|
||||
: undefined}
|
||||
<div className="mt-6 flex w-full flex-row items-center justify-center">
|
||||
<div className="w-1/5 border-t border-mineshaft-400" />
|
||||
<p className="mx-4 text-xs text-gray-400">OR</p>
|
||||
<div className="w-1/5 border-t border-mineshaft-400" />
|
||||
</div>
|
||||
<Button
|
||||
colorSchema="primary"
|
||||
className="mt-6 w-3/4"
|
||||
size="sm"
|
||||
type="submit"
|
||||
onClick={handleNewConnection}
|
||||
>
|
||||
Create New Connection
|
||||
</Button>
|
||||
</div>
|
||||
</Card>
|
||||
</div>
|
||||
);
|
||||
}
|
||||
|
||||
SelectIntegrationAuthPage.requireAuth = true;
|
||||
@@ -60,7 +60,7 @@ export const redirectForProviderAuth = (integrationOption: TCloudIntegration) =>
|
||||
link = `https://app.netlify.com/authorize?client_id=${integrationOption.clientId}&response_type=code&state=${state}&redirect_uri=${window.location.origin}/integrations/netlify/oauth2/callback`;
|
||||
break;
|
||||
case "github":
|
||||
link = `https://github.com/login/oauth/authorize?client_id=${integrationOption.clientId}&response_type=code&scope=repo,admin:org&redirect_uri=${window.location.origin}/integrations/github/oauth2/callback&state=${state}`;
|
||||
link = `${window.location.origin}/integrations/github/auth-mode-selection`;
|
||||
break;
|
||||
case "gitlab":
|
||||
link = `${window.location.origin}/integrations/gitlab/authorize`;
|
||||
|
||||
Reference in New Issue
Block a user