feat(infisical-pg: completed machine identity services

backend-pg/src/lib/casl/index.ts

@@ -0,0 +1,44 @@
+import { buildMongoQueryMatcher, MongoAbility } from "@casl/ability";
+import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
+import picomatch from "picomatch";
+
+const $glob: FieldInstruction<string> = {
+  type: "field",
+  validate(instruction, value) {
+    if (typeof value !== "string") {
+      throw new Error(`"${instruction.name}" expects value to be a string`);
+    }
+  }
+};
+
+const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
+  const secretPath = context.get(object, node.field);
+  const permissionSecretGlobPath = node.value;
+  return picomatch.isMatch(secretPath, permissionSecretGlobPath, { strictSlashes: false });
+};
+
+export const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
+
+/**
+ * Extracts and formats permissions from a CASL Ability object or a raw permission set.
+ */
+const extractPermissions = (ability: MongoAbility) =>
+  ability.rules.map((permission) => `${permission.action}_${permission.subject}`);
+
+/**
+ * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
+ * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
+ *
+ */
+export const isAtLeastAsPrivileged = (permissions1: MongoAbility, permissions2: MongoAbility) => {
+  const set1 = new Set(extractPermissions(permissions1));
+  const set2 = new Set(extractPermissions(permissions2));
+
+  for (const perm of set2) {
+    if (!set1.has(perm)) {
+      return false;
+    }
+  }
+
+  return set1.size >= set2.size;
+};

backend-pg/src/lib/errors/index.ts

@@ -16,9 +16,21 @@ export class UnauthorizedError extends Error {
 
   error: unknown;
 
-  constructor({ name, error, message }: { message?: string; name: string; error?: unknown }) {
+  constructor({ name, error, message }: { message?: string; name?: string; error?: unknown } = {}) {
     super(message ?? "You are not allowed to access this resourve");
-    this.name = name;
+    this.name = name || "UnauthorizedError";
+    this.error = error;
+  }
+}
+
+export class ForbiddenRequestError extends Error {
+  name: string;
+
+  error: unknown;
+
+  constructor({ name, error, message }: { message?: string; name?: string; error?: unknown }) {
+    super(message ?? "You are not allowed to access this resourve");
+    this.name = name || "ForbideenError";
     this.error = error;
   }
 }

backend-pg/src/lib/ip/index.ts

@@ -0,0 +1,137 @@
+import net from "node:net";
+
+import { UnauthorizedError } from "../errors";
+
+export enum IPType {
+  IPV4 = "ipv4",
+  IPV6 = "ipv6"
+}
+
+/**
+ * Return details of IP [ip]:
+ * - If [ip] is a specific IP address then return the IPv4/IPv6 address
+ * - If [ip] is a subnet then return the network IPv4/IPv6 address and prefix
+ */
+export const extractIPDetails = (ip: string) => {
+  if (net.isIPv4(ip))
+    return {
+      ipAddress: ip,
+      type: IPType.IPV4
+    };
+
+  if (net.isIPv6(ip))
+    return {
+      ipAddress: ip,
+      type: IPType.IPV6
+    };
+
+  const [ipNet, prefix] = ip.split("/");
+
+  let type;
+  switch (net.isIP(ipNet)) {
+    case 4:
+      type = IPType.IPV4;
+      break;
+    case 6:
+      type = IPType.IPV6;
+      break;
+    default:
+      throw new Error("Failed to extract IP details");
+  }
+
+  return {
+    ipAddress: ipNet,
+    type,
+    prefix: parseInt(prefix, 10)
+  };
+};
+
+/**
+ * Checks if a given string is a valid CIDR block.
+ *
+ * The function checks if the input string is a valid IPv4 or IPv6 address in CIDR notation.
+ *
+ * CIDR notation includes a network address followed by a slash ('/') and a prefix length.
+ * For IPv4, the prefix length must be between 0 and 32. For IPv6, it must be between 0 and 128.
+ * If the input string is not a valid CIDR block, the function returns `false`.
+ *
+ */
+export const isValidCidr = (cidr: string): boolean => {
+  const [ip, prefix] = cidr.split("/");
+
+  const prefixNum = parseInt(prefix, 10);
+
+  // ensure prefix exists and is a number within the appropriate range for each IP version
+  if (
+    !prefix ||
+    Number.isNaN(prefixNum) ||
+    (net.isIPv4(ip) && (prefixNum < 0 || prefixNum > 32)) ||
+    (net.isIPv6(ip) && (prefixNum < 0 || prefixNum > 128))
+  ) {
+    return false;
+  }
+
+  // ensure the IP portion of the CIDR block is a valid IPv4 or IPv6 address
+  if (!net.isIPv4(ip) && !net.isIPv6(ip)) {
+    return false;
+  }
+
+  return true;
+};
+
+/**
+ * Checks if a given string is a valid IPv4/IPv6 address or a valid CIDR block.
+ *
+ * If the string contains a slash ('/'), it treats the input as a CIDR block and checks its validity.
+ * Otherwise, it treats the string as a standalone IP address (either IPv4 or IPv6) and checks its validity.
+ *
+ * @param {string} input - The string to be checked. It could be an IP address or a CIDR block.
+ * @returns {boolean} Returns `true` if the string is a valid IP address (either IPv4 or IPv6) or a valid CIDR block, `false` otherwise.
+ *
+ */
+export const isValidIpOrCidr = (ip: string): boolean => {
+  // if the string contains a slash, treat it as a CIDR block
+  if (ip.includes("/")) {
+    return isValidCidr(ip);
+  }
+
+  // otherwise, treat it as a standalone IP address
+  if (net.isIPv4(ip) || net.isIPv6(ip)) {
+    return true;
+  }
+
+  return false;
+};
+
+/**
+ * Validates the IP address [ipAddress] against the trusted IPs [trustedIps].
+ */
+export const checkIPAgainstBlocklist = ({
+  ipAddress,
+  trustedIps
+}: {
+  ipAddress: string;
+  trustedIps: {
+    ipAddress: string;
+    type: IPType;
+    prefix: number;
+  }[];
+}) => {
+  const blockList = new net.BlockList();
+
+  for (const trustedIp of trustedIps) {
+    if (trustedIp.prefix !== undefined) {
+      blockList.addSubnet(trustedIp.ipAddress, trustedIp.prefix, trustedIp.type);
+    } else {
+      blockList.addAddress(trustedIp.ipAddress, trustedIp.type);
+    }
+  }
+
+  const { type } = extractIPDetails(ipAddress);
+  const check = blockList.check(ipAddress, type);
+
+  if (!check)
+    throw new UnauthorizedError({
+      message: "Failed to authenticate"
+    });
+};

backend-pg/src/lib/types/index.ts

@@ -1,5 +1,11 @@
 import { ActorType } from "@app/services/auth/auth-type";
 
+export type TOrgPermission = {
+  actor: ActorType;
+  actorId: string;
+  orgId: string;
+};
+
 export type TProjectPermission = {
   actor: ActorType;
   actorId: string;