diff --git a/backend/src/config/index.ts b/backend/src/config/index.ts index 33066f613..68427d078 100644 --- a/backend/src/config/index.ts +++ b/backend/src/config/index.ts @@ -13,7 +13,7 @@ export const getJwtServiceSecret = () => infisical.get('JWT_SERVICE_SECRET')!; export const getJwtSignupLifetime = () => infisical.get('JWT_SIGNUP_LIFETIME')! || '15m'; export const getJwtSignupSecret = () => infisical.get('JWT_SIGNUP_SECRET')!; export const getMongoURL = () => infisical.get('MONGO_URL')!; -export const getNodeEnv = () => infisical.get('NODE_ENV')!; +export const getNodeEnv = () => infisical.get('NODE_ENV')! || 'production'; export const getVerboseErrorOutput = () => infisical.get('VERBOSE_ERROR_OUTPUT')! === 'true' && true; export const getLokiHost = () => infisical.get('LOKI_HOST')!; export const getClientIdAzure = () => infisical.get('CLIENT_ID_AZURE')!; diff --git a/backend/src/controllers/v2/secretsController.ts b/backend/src/controllers/v2/secretsController.ts index 82b5c65d6..b18073515 100644 --- a/backend/src/controllers/v2/secretsController.ts +++ b/backend/src/controllers/v2/secretsController.ts @@ -560,9 +560,9 @@ export const getSecrets = async (req: Request, res: Response) => { return tag ? tag.id : null; }); } - + let secrets: ISecret[] = []; - + if (req.user) { // case: client authorization is via JWT @@ -578,12 +578,12 @@ export const getSecrets = async (req: Request, res: Response) => { let secretQuery: any; if (tagNamesList != undefined && tagNamesList.length != 0) { const workspaceFromDB = await Tag.find({ workspace: workspaceId }) - + const tagIds = _.map(tagNamesList, (tagName) => { const tag = _.find(workspaceFromDB, { slug: tagName }); return tag ? tag.id : null; }); - + secretQuery = { workspace: workspaceId, environment, @@ -608,15 +608,15 @@ export const getSecrets = async (req: Request, res: Response) => { if (hasWriteOnlyAccess) { // (i.e. you don't get values to decrypt since you can only write) - secrets = await Secret.find(secretQuery).select("secretKeyCiphertext secretKeyIV secretKeyTag") + secrets = await Secret.find(secretQuery).select("secretKeyCiphertext secretKeyIV secretKeyTag").populate("tags") } else { secrets = await Secret.find(secretQuery).populate("tags") } } - + if (req.serviceAccount || req.serviceTokenData) { // case: client authorization is either via service account or service token - + secrets = await Secret.find({ workspace: new Types.ObjectId(workspaceId), environment, @@ -625,7 +625,7 @@ export const getSecrets = async (req: Request, res: Response) => { }, ...(tagIds.length > 0 ? { tags: { $in: tagIds } } : {}), type: SECRET_SHARED - }); + }).populate("tags"); } const channel = getChannelFromUserAgent(req.headers['user-agent']) @@ -638,7 +638,7 @@ export const getSecrets = async (req: Request, res: Response) => { workspaceId: new Types.ObjectId(workspaceId as string), secretIds: secrets.map((n: any) => n._id) }); - + readAction && await EELogService.createLog({ userId: req.user?._id, serviceAccountId: req.serviceAccount?._id, @@ -952,7 +952,7 @@ export const deleteSecrets = async (req: Request, res: Response) => { } } */ - + return res.status(200).send({ message: 'delete secrets!!' }); diff --git a/backend/src/helpers/auth.ts b/backend/src/helpers/auth.ts index c2c21ded5..b9c4e8232 100644 --- a/backend/src/helpers/auth.ts +++ b/backend/src/helpers/auth.ts @@ -148,7 +148,7 @@ const getAuthSTDPayload = async ({ if (!isMatch) throw UnauthorizedRequestError({ message: 'Failed to authenticate service token' }); - + serviceTokenData = await ServiceTokenData .findOneAndUpdate({ _id: new Types.ObjectId(TOKEN_IDENTIFIER) @@ -157,8 +157,8 @@ const getAuthSTDPayload = async ({ }, { new: true }) - .select('+encryptedKey +iv +tag'); - + .select('+encryptedKey +iv +tag').populate('user'); + if (!serviceTokenData) throw ServiceTokenDataNotFoundError({ message: 'Failed to find service token data' }); return serviceTokenData; @@ -176,20 +176,20 @@ const getAuthSAAKPayload = async ({ authTokenValue: string; }) => { const [_, TOKEN_IDENTIFIER, TOKEN_SECRET] = <[string, string, string]>authTokenValue.split('.', 3); - + const serviceAccount = await ServiceAccount.findById( Buffer.from(TOKEN_IDENTIFIER, 'base64').toString('hex') ).select('+secretHash'); - + if (!serviceAccount) { throw ServiceAccountNotFoundError({ message: 'Failed to find service account' }); } - + const result = await bcrypt.compare(TOKEN_SECRET, serviceAccount.secretHash); if (!result) throw UnauthorizedRequestError({ message: 'Failed to authenticate service account access key' }); - + return serviceAccount; } @@ -208,7 +208,7 @@ const getAuthAPIKeyPayload = async ({ let apiKeyData = await APIKeyData .findById(TOKEN_IDENTIFIER, '+secretHash +expiresAt') - .populate<{user: IUser}>('user', '+publicKey'); + .populate<{ user: IUser }>('user', '+publicKey'); if (!apiKeyData) { throw APIKeyDataNotFoundError({ message: 'Failed to find API key data' }); @@ -232,13 +232,13 @@ const getAuthAPIKeyPayload = async ({ }, { new: true }); - + if (!apiKeyData) { throw APIKeyDataNotFoundError({ message: 'Failed to find API key data' }); } - + const user = await User.findById(apiKeyData.user).select('+publicKey'); - + if (!user) { throw AccountNotFoundError({ message: 'Failed to find user' diff --git a/cli/packages/api/model.go b/cli/packages/api/model.go index af8dbc5b4..71354c84c 100644 --- a/cli/packages/api/model.go +++ b/cli/packages/api/model.go @@ -230,19 +230,10 @@ type GetEncryptedSecretsV2Response struct { } type GetServiceTokenDetailsResponse struct { - ID string `json:"_id"` - Name string `json:"name"` - Workspace string `json:"workspace"` - Environment string `json:"environment"` - User struct { - ID string `json:"_id"` - Email string `json:"email"` - CreatedAt time.Time `json:"createdAt"` - UpdatedAt time.Time `json:"updatedAt"` - V int `json:"__v"` - FirstName string `json:"firstName"` - LastName string `json:"lastName"` - } `json:"user"` + ID string `json:"_id"` + Name string `json:"name"` + Workspace string `json:"workspace"` + Environment string `json:"environment"` ExpiresAt time.Time `json:"expiresAt"` EncryptedKey string `json:"encryptedKey"` Iv string `json:"iv"` diff --git a/docs/self-hosting/overview.mdx b/docs/self-hosting/overview.mdx index 995fe93a0..a3812974b 100644 --- a/docs/self-hosting/overview.mdx +++ b/docs/self-hosting/overview.mdx @@ -28,6 +28,7 @@ Self-hosted Infisical allows you to maintain your sensitive information within y This deployment option is highly available + **Prerequisites** - You have understanding of [Kubernetes](https://kubernetes.io/)