Merge branch 'main' of https://github.com/Infisical/infisical into fix/folder-sorting

backend/src/ee/routes/v1/app-connection-routers/chef-connection-router.ts

@@ -1,17 +1,16 @@
 import z from "zod";
 
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import {
   CreateChefConnectionSchema,
   SanitizedChefConnectionSchema,
   UpdateChefConnectionSchema
-} from "@app/services/app-connection/chef";
+} from "@app/ee/services/app-connections/chef";
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { registerAppConnectionEndpoints } from "@app/server/routes/v1/app-connection-routers/app-connection-endpoints";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { AuthMode } from "@app/services/auth/auth-type";
 
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
 export const registerChefConnectionRouter = async (server: FastifyZodProvider) => {
   registerAppConnectionEndpoints({
     app: AppConnection.Chef,

backend/src/ee/routes/v1/secret-sync-routers/chef-sync-router.ts

@@ -1,8 +1,7 @@
-import { ChefSyncSchema, CreateChefSyncSchema, UpdateChefSyncSchema } from "@app/services/secret-sync/chef";
+import { ChefSyncSchema, CreateChefSyncSchema, UpdateChefSyncSchema } from "@app/ee/services/secret-sync/chef";
+import { registerSyncSecretsEndpoints } from "@app/server/routes/v1/secret-sync-routers/secret-sync-endpoints";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
 export const registerChefSyncRouter = async (server: FastifyZodProvider) =>
   registerSyncSecretsEndpoints({
     destination: SecretSync.Chef,

backend/src/ee/services/app-connections/chef/chef-connection-fns.ts

@@ -5,10 +5,10 @@ import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
 
 import { TChefDataBagItemContent } from "../../secret-sync/chef/chef-sync-types";
-import { AppConnection } from "../app-connection-enums";
 import { ChefConnectionMethod } from "./chef-connection-enums";
 import {
   TChefConnection,

backend/src/ee/services/app-connections/chef/chef-connection-service.ts

@@ -1,7 +1,8 @@
-import { ForbiddenRequestError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
 
-import { AppConnection } from "../app-connection-enums";
+import { AppConnection } from "../../../../services/app-connection/app-connection-enums";
+import { TLicenseServiceFactory } from "../../license/license-service";
 import { listChefDataBagItems, listChefDataBags } from "./chef-connection-fns";
 import { TChefConnection } from "./chef-connection-types";
 
@@ -11,8 +12,23 @@ type TGetAppConnectionFunc = (
   actor: OrgServiceActor
 ) => Promise<TChefConnection>;
 
-export const chefConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+// Enterprise check
+export const checkPlan = async (licenseService: Pick<TLicenseServiceFactory, "getPlan">, orgId: string) => {
+  const plan = await licenseService.getPlan(orgId);
+  if (!plan.enterpriseAppConnections)
+    throw new BadRequestError({
+      message:
+        "Failed to use app connection due to plan restriction. Upgrade plan to access enterprise app connections."
+    });
+};
+
+export const chefConnectionService = (
+  getAppConnection: TGetAppConnectionFunc,
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">
+) => {
   const listDataBags = async (appConnectionId: string, actor: OrgServiceActor) => {
+    await checkPlan(licenseService, actor.orgId);
+
     const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
 
     if (!appConnection) {
@@ -23,6 +39,8 @@ export const chefConnectionService = (getAppConnection: TGetAppConnectionFunc) =
   };
 
   const listDataBagItems = async (appConnectionId: string, dataBagName: string, actor: OrgServiceActor) => {
+    await checkPlan(licenseService, actor.orgId);
+
     const appConnection = await getAppConnection(AppConnection.Chef, appConnectionId, actor);
 
     if (!appConnection) {

backend/src/ee/services/app-connections/chef/chef-connection-types.ts

@@ -1,9 +1,9 @@
 import z from "zod";
 
+import { TChefDataBagItemContent } from "@app/ee/services/secret-sync/chef";
 import { DiscriminativePick } from "@app/lib/types";
-import { TChefDataBagItemContent } from "@app/services/secret-sync/chef";
 
-import { AppConnection } from "../app-connection-enums";
+import { AppConnection } from "../../../../services/app-connection/app-connection-enums";
 import {
   ChefConnectionSchema,
   CreateChefConnectionSchema,

backend/src/ee/services/gateway-v2/gateway-v2-service.ts

@@ -3,7 +3,7 @@ import net from "node:net";
 import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 
-import { OrganizationActionScope, OrgMembershipRole, TRelays } from "@app/db/schemas";
+import { OrganizationActionScope, OrgMembershipRole, OrgMembershipStatus, TRelays } from "@app/db/schemas";
 import { PgSqlLock } from "@app/keystore/keystore";
 import { crypto } from "@app/lib/crypto";
 import { DatabaseErrorCode } from "@app/lib/error-codes";
@@ -909,7 +909,9 @@ export const gatewayV2ServiceFactory = ({
 
     for await (const [orgId, gateways] of Object.entries(gatewaysByOrg)) {
       try {
-        const admins = await orgDAL.findOrgMembersByRole(orgId, OrgMembershipRole.Admin);
+        const admins = (await orgDAL.findOrgMembersByRole(orgId, OrgMembershipRole.Admin)).filter(
+          (admin) => admin.status !== OrgMembershipStatus.Invited
+        );
         if (admins.length === 0) {
           logger.warn({ orgId }, "Organization has no admins to notify about unhealthy gateway.");
           // eslint-disable-next-line no-continue

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts

@@ -1,6 +1,5 @@
 import knex from "knex";
 import mysql, { Connection } from "mysql2/promise";
-import * as pg from "pg";
 import tls, { PeerCertificate } from "tls";
 
 import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns";
@@ -97,7 +96,7 @@ const makeSqlConnection = (
           try {
             await client.raw(SIMPLE_QUERY);
           } catch (error) {
-            if (error instanceof pg.DatabaseError) {
+            if (error instanceof Error) {
               // Hacky way to know if we successfully hit the database.
               // TODO: potentially two approaches to solve the problem.
               //       1. change the work flow, add account first then resource

backend/src/ee/services/relay/relay-service.ts

@@ -3,7 +3,7 @@ import { isIP } from "node:net";
 import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 
-import { OrganizationActionScope, OrgMembershipRole, TRelays } from "@app/db/schemas";
+import { OrganizationActionScope, OrgMembershipRole, OrgMembershipStatus, TRelays } from "@app/db/schemas";
 import { PgSqlLock } from "@app/keystore/keystore";
 import { crypto } from "@app/lib/crypto";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -1248,7 +1248,9 @@ export const relayServiceFactory = ({
             });
           }
         } else {
-          const admins = await orgDAL.findOrgMembersByRole(orgId, OrgMembershipRole.Admin);
+          const admins = (await orgDAL.findOrgMembersByRole(orgId, OrgMembershipRole.Admin)).filter(
+            (admin) => admin.status !== OrgMembershipStatus.Invited
+          );
           if (admins.length === 0) {
             // eslint-disable-next-line no-continue
             continue;

backend/src/ee/services/secret-sync/chef/chef-sync-constants.ts

@@ -6,5 +6,6 @@ export const CHEF_SYNC_LIST_OPTION: TSecretSyncListItem = {
   name: "Chef",
   destination: SecretSync.Chef,
   connection: AppConnection.Chef,
-  canImportSecrets: true
+  canImportSecrets: true,
+  enterprise: true
 };

backend/src/ee/services/secret-sync/chef/chef-sync-fns.ts

@@ -1,4 +1,4 @@
-import { getChefDataBagItem, updateChefDataBagItem } from "@app/services/app-connection/chef";
+import { getChefDataBagItem, updateChefDataBagItem } from "@app/ee/services/app-connections/chef";
 import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 

backend/src/ee/services/secret-sync/chef/chef-sync-schemas.ts

@@ -42,5 +42,6 @@ export const ChefSyncListItemSchema = z.object({
   name: z.literal("Chef"),
   connection: z.literal(AppConnection.Chef),
   destination: z.literal(SecretSync.Chef),
-  canImportSecrets: z.literal(true)
+  canImportSecrets: z.literal(true),
+  enterprise: z.boolean()
 });

backend/src/ee/services/secret-sync/chef/chef-sync-types.ts

@@ -1,6 +1,6 @@
 import z from "zod";
 
-import { TChefConnection } from "@app/services/app-connection/chef";
+import { TChefConnection } from "@app/ee/services/app-connections/chef";
 
 import { ChefSyncListItemSchema, ChefSyncSchema, CreateChefSyncSchema } from "./chef-sync-schemas";
 

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { ProjectType } from "@app/db/schemas";
+import { ChefConnectionListItemSchema, SanitizedChefConnectionSchema } from "@app/ee/services/app-connections/chef";
 import { OCIConnectionListItemSchema, SanitizedOCIConnectionSchema } from "@app/ee/services/app-connections/oci";
 import {
   OracleDBConnectionListItemSchema,
@@ -48,7 +49,6 @@ import {
   ChecklyConnectionListItemSchema,
   SanitizedChecklyConnectionSchema
 } from "@app/services/app-connection/checkly";
-import { ChefConnectionListItemSchema, SanitizedChefConnectionSchema } from "@app/services/app-connection/chef";
 import {
   CloudflareConnectionListItemSchema,
   SanitizedCloudflareConnectionSchema

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -1,3 +1,4 @@
+import { registerChefConnectionRouter } from "@app/ee/routes/v1/app-connection-routers/chef-connection-router";
 import { registerOCIConnectionRouter } from "@app/ee/routes/v1/app-connection-routers/oci-connection-router";
 import { registerOracleDBConnectionRouter } from "@app/ee/routes/v1/app-connection-routers/oracledb-connection-router";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
@@ -13,7 +14,6 @@ import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connect
 import { registerBitbucketConnectionRouter } from "./bitbucket-connection-router";
 import { registerCamundaConnectionRouter } from "./camunda-connection-router";
 import { registerChecklyConnectionRouter } from "./checkly-connection-router";
-import { registerChefConnectionRouter } from "./chef-connection-router";
 import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
 import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
 import { registerDigitalOceanConnectionRouter } from "./digital-ocean-connection-router";

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -1,3 +1,4 @@
+import { registerChefSyncRouter } from "@app/ee/routes/v1/secret-sync-routers/chef-sync-router";
 import { registerOCIVaultSyncRouter } from "@app/ee/routes/v1/secret-sync-routers/oci-vault-sync-router";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
@@ -10,7 +11,6 @@ import { registerAzureKeyVaultSyncRouter } from "./azure-key-vault-sync-router";
 import { registerBitbucketSyncRouter } from "./bitbucket-sync-router";
 import { registerCamundaSyncRouter } from "./camunda-sync-router";
 import { registerChecklySyncRouter } from "./checkly-sync-router";
-import { registerChefSyncRouter } from "./chef-sync-router";
 import { registerCloudflarePagesSyncRouter } from "./cloudflare-pages-sync-router";
 import { registerCloudflareWorkersSyncRouter } from "./cloudflare-workers-sync-router";
 import { registerDatabricksSyncRouter } from "./databricks-sync-router";

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { ChefSyncListItemSchema, ChefSyncSchema } from "@app/ee/services/secret-sync/chef";
 import { OCIVaultSyncListItemSchema, OCIVaultSyncSchema } from "@app/ee/services/secret-sync/oci-vault";
 import { ApiDocsTags, SecretSyncs } from "@app/lib/api-docs";
 import { readLimit } from "@app/server/config/rateLimiter";
@@ -24,7 +25,6 @@ import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/s
 import { BitbucketSyncListItemSchema, BitbucketSyncSchema } from "@app/services/secret-sync/bitbucket";
 import { CamundaSyncListItemSchema, CamundaSyncSchema } from "@app/services/secret-sync/camunda";
 import { ChecklySyncListItemSchema, ChecklySyncSchema } from "@app/services/secret-sync/checkly/checkly-sync-schemas";
-import { ChefSyncListItemSchema, ChefSyncSchema } from "@app/services/secret-sync/chef";
 import {
   CloudflarePagesSyncListItemSchema,
   CloudflarePagesSyncSchema

backend/src/services/app-connection/app-connection-fns.ts

@@ -1,5 +1,10 @@
 import { ProjectType } from "@app/db/schemas";
 import { TAppConnections } from "@app/db/schemas/app-connections";
+import {
+  ChefConnectionMethod,
+  getChefConnectionListItem,
+  validateChefConnectionCredentials
+} from "@app/ee/services/app-connections/chef";
 import {
   getOCIConnectionListItem,
   OCIConnectionMethod,
@@ -68,7 +73,6 @@ import {
 } from "./bitbucket";
 import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
 import { ChecklyConnectionMethod, getChecklyConnectionListItem, validateChecklyConnectionCredentials } from "./checkly";
-import { ChefConnectionMethod, getChefConnectionListItem, validateChefConnectionCredentials } from "./chef";
 import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
 import {
   getCloudflareConnectionListItem,

backend/src/services/app-connection/app-connection-maps.ts

@@ -86,6 +86,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.Netlify]: AppConnectionPlanType.Regular,
   [AppConnection.Okta]: AppConnectionPlanType.Regular,
   [AppConnection.Redis]: AppConnectionPlanType.Regular,
-  [AppConnection.Chef]: AppConnectionPlanType.Regular,
+  [AppConnection.Chef]: AppConnectionPlanType.Enterprise,
   [AppConnection.Northflank]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -1,6 +1,8 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, OrganizationActionScope, TAppConnections } from "@app/db/schemas";
+import { ValidateChefConnectionCredentialsSchema } from "@app/ee/services/app-connections/chef";
+import { chefConnectionService } from "@app/ee/services/app-connections/chef/chef-connection-service";
 import { ValidateOCIConnectionCredentialsSchema } from "@app/ee/services/app-connections/oci";
 import { ociConnectionService } from "@app/ee/services/app-connections/oci/oci-connection-service";
 import { ValidateOracleDBConnectionCredentialsSchema } from "@app/ee/services/app-connections/oracledb";
@@ -67,8 +69,6 @@ import { ValidateCamundaConnectionCredentialsSchema } from "./camunda";
 import { camundaConnectionService } from "./camunda/camunda-connection-service";
 import { ValidateChecklyConnectionCredentialsSchema } from "./checkly";
 import { checklyConnectionService } from "./checkly/checkly-connection-service";
-import { ValidateChefConnectionCredentialsSchema } from "./chef";
-import { chefConnectionService } from "./chef/chef-connection-service";
 import { ValidateCloudflareConnectionCredentialsSchema } from "./cloudflare/cloudflare-connection-schema";
 import { cloudflareConnectionService } from "./cloudflare/cloudflare-connection-service";
 import { ValidateDatabricksConnectionCredentialsSchema } from "./databricks";
@@ -885,6 +885,6 @@ export const appConnectionServiceFactory = ({
     northflank: northflankConnectionService(connectAppConnectionById),
     okta: oktaConnectionService(connectAppConnectionById),
     laravelForge: laravelForgeConnectionService(connectAppConnectionById),
-    chef: chefConnectionService(connectAppConnectionById)
+    chef: chefConnectionService(connectAppConnectionById, licenseService)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -1,3 +1,9 @@
+import {
+  TChefConnection,
+  TChefConnectionConfig,
+  TChefConnectionInput,
+  TValidateChefConnectionCredentialsSchema
+} from "@app/ee/services/app-connections/chef";
 import {
   TOCIConnection,
   TOCIConnectionConfig,
@@ -82,12 +88,6 @@ import {
   TChecklyConnectionInput,
   TValidateChecklyConnectionCredentialsSchema
 } from "./checkly";
-import {
-  TChefConnection,
-  TChefConnectionConfig,
-  TChefConnectionInput,
-  TValidateChefConnectionCredentialsSchema
-} from "./chef";
 import {
   TCloudflareConnection,
   TCloudflareConnectionConfig,

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -4,6 +4,7 @@ import handlebars from "handlebars";
 import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service";
 import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
+import { CHEF_SYNC_LIST_OPTION, ChefSyncFns } from "@app/ee/services/secret-sync/chef";
 import { OCI_VAULT_SYNC_LIST_OPTION, OCIVaultSyncFns } from "@app/ee/services/secret-sync/oci-vault";
 import { BadRequestError } from "@app/lib/errors";
 import {
@@ -34,7 +35,6 @@ import { BITBUCKET_SYNC_LIST_OPTION, BitbucketSyncFns } from "./bitbucket";
 import { CAMUNDA_SYNC_LIST_OPTION, camundaSyncFactory } from "./camunda";
 import { CHECKLY_SYNC_LIST_OPTION } from "./checkly/checkly-sync-constants";
 import { ChecklySyncFns } from "./checkly/checkly-sync-fns";
-import { CHEF_SYNC_LIST_OPTION, ChefSyncFns } from "./chef";
 import { CLOUDFLARE_PAGES_SYNC_LIST_OPTION } from "./cloudflare-pages/cloudflare-pages-constants";
 import { CloudflarePagesSyncFns } from "./cloudflare-pages/cloudflare-pages-fns";
 import { CLOUDFLARE_WORKERS_SYNC_LIST_OPTION, CloudflareWorkersSyncFns } from "./cloudflare-workers";

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -107,7 +107,7 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.Northflank]: SecretSyncPlanType.Regular,
   [SecretSync.Bitbucket]: SecretSyncPlanType.Regular,
   [SecretSync.LaravelForge]: SecretSyncPlanType.Regular,
-  [SecretSync.Chef]: SecretSyncPlanType.Regular
+  [SecretSync.Chef]: SecretSyncPlanType.Enterprise
 };
 
 export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {

backend/src/services/secret-sync/secret-sync-types.ts

@@ -1,6 +1,12 @@
 import { Job } from "bullmq";
 
 import { AuditLogInfo } from "@app/ee/services/audit-log/audit-log-types";
+import {
+  TChefSync,
+  TChefSyncInput,
+  TChefSyncListItem,
+  TChefSyncWithCredentials
+} from "@app/ee/services/secret-sync/chef";
 import {
   TOCIVaultSync,
   TOCIVaultSyncInput,
@@ -21,7 +27,6 @@ import {
   TCamundaSyncListItem,
   TCamundaSyncWithCredentials
 } from "@app/services/secret-sync/camunda";
-import { TChefSync, TChefSyncInput, TChefSyncListItem, TChefSyncWithCredentials } from "@app/services/secret-sync/chef";
 import {
   TDatabricksSync,
   TDatabricksSyncInput,