diff --git a/backend/src/ee/routes/v1/github-org-sync-router.ts b/backend/src/ee/routes/v1/github-org-sync-router.ts
index 3666b3480..d33d33f3a 100644
--- a/backend/src/ee/routes/v1/github-org-sync-router.ts
+++ b/backend/src/ee/routes/v1/github-org-sync-router.ts
@@ -1,11 +1,12 @@
import { z } from "zod";
import { GithubOrgSyncConfigsSchema } from "@app/db/schemas";
+import { CharacterType, zodValidateCharacters } from "@app/lib/validator/validate-string";
import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
-const SanitiziedGithubOrgSyncSchema = GithubOrgSyncConfigsSchema.pick({
+const SanitizedGithubOrgSyncSchema = GithubOrgSyncConfigsSchema.pick({
isActive: true,
id: true,
createdAt: true,
@@ -14,6 +15,7 @@ const SanitiziedGithubOrgSyncSchema = GithubOrgSyncConfigsSchema.pick({
githubOrgName: true
});
+const githubOrgNameValidator = zodValidateCharacters([CharacterType.AlphaNumeric, CharacterType.Hyphen]);
export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) => {
server.route({
url: "/",
@@ -24,13 +26,13 @@ export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) =>
onRequest: verifyAuth([AuthMode.JWT]),
schema: {
body: z.object({
- githubOrgName: z.string().trim(),
+ githubOrgName: githubOrgNameValidator(z.string().trim(), "GitHub Org Name"),
githubOrgAccessToken: z.string().trim().max(1000).optional(),
isActive: z.boolean().default(false)
}),
response: {
200: z.object({
- githubOrgSyncConfig: SanitiziedGithubOrgSyncSchema
+ githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
})
}
},
@@ -56,14 +58,14 @@ export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) =>
schema: {
body: z
.object({
- githubOrgName: z.string().trim(),
+ githubOrgName: githubOrgNameValidator(z.string().trim(), "GitHub Org Name"),
githubOrgAccessToken: z.string().trim().max(1000),
isActive: z.boolean().default(false)
})
.partial(),
response: {
200: z.object({
- githubOrgSyncConfig: SanitiziedGithubOrgSyncSchema
+ githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
})
}
},
@@ -89,7 +91,7 @@ export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) =>
schema: {
response: {
200: z.object({
- githubOrgSyncConfig: SanitiziedGithubOrgSyncSchema
+ githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
})
}
},
@@ -112,7 +114,7 @@ export const registerGithubOrgSyncRouter = async (server: FastifyZodProvider) =>
schema: {
response: {
200: z.object({
- githubOrgSyncConfig: SanitiziedGithubOrgSyncSchema
+ githubOrgSyncConfig: SanitizedGithubOrgSyncSchema
})
}
},
diff --git a/backend/src/ee/services/github-org-sync/github-org-sync-service.ts b/backend/src/ee/services/github-org-sync/github-org-sync-service.ts
index 9ce673a9e..e95a2098c 100644
--- a/backend/src/ee/services/github-org-sync/github-org-sync-service.ts
+++ b/backend/src/ee/services/github-org-sync/github-org-sync-service.ts
@@ -79,7 +79,7 @@ export const githubOrgSyncServiceFactory = ({
const { data } = await octokit.rest.orgs.get({
org: githubOrgName
});
- if (data.login.toLowerCase() !== githubOrgName)
+ if (data.login.toLowerCase() !== githubOrgName.toLowerCase())
throw new BadRequestError({ message: "Invalid GitHub organisation" });
const { encryptor } = await kmsService.createCipherPairWithDataKey({
@@ -152,7 +152,7 @@ export const githubOrgSyncServiceFactory = ({
org: newData.githubOrgName
});
- if (data.login.toLowerCase() !== newData.githubOrgName)
+ if (data.login.toLowerCase() !== newData.githubOrgName.toLowerCase())
throw new BadRequestError({ message: "Invalid GitHub organisation" });
}
@@ -280,7 +280,7 @@ export const githubOrgSyncServiceFactory = ({
const {
organization: { teams }
} = data;
- const githubUserTeams = teams?.edges?.map((el) => el.node.name.toLowerCase());
+ const githubUserTeams = teams?.edges?.map((el) => el.node.name.toLowerCase()) || [];
const githubUserTeamSet = new Set(githubUserTeams);
const githubUserTeamOnInfisical = await groupDAL.find({ orgId, $in: { name: githubUserTeams } });
const githubUserTeamOnInfisicalGroupByName = groupBy(githubUserTeamOnInfisical, (i) => i.name);
diff --git a/docs/documentation/platform/github-org-sync.mdx b/docs/documentation/platform/github-org-sync.mdx
index 7495c03fb..426c51060 100644
--- a/docs/documentation/platform/github-org-sync.mdx
+++ b/docs/documentation/platform/github-org-sync.mdx
@@ -19,7 +19,7 @@ To enable and configure GitHub Organization Synchronization, follow these steps:

- Toggle ON GitHub Organization sync to active sync.
+ Toggle ON GitHub Organization sync to activate sync.

@@ -33,7 +33,7 @@ To enable and configure GitHub Organization Synchronization, follow these steps:
This action only needs to be done once and authorizes the Infisical OAuth app to read organization details, including team information.
- The following users doesn't need to select organization in GitHub on login anymore.
+ The following users don't need to select organization in GitHub on login anymore.
diff --git a/frontend/src/hooks/api/githubOrgSyncConfig/types.ts b/frontend/src/hooks/api/githubOrgSyncConfig/types.ts
index aa2ae6451..f663c8caf 100644
--- a/frontend/src/hooks/api/githubOrgSyncConfig/types.ts
+++ b/frontend/src/hooks/api/githubOrgSyncConfig/types.ts
@@ -1,7 +1,7 @@
export type TGithubOrgSyncConfig = {
id: string;
orgId: string;
- githubAccessToken: string;
+ githubOrgAccessToken?: string;
githubOrgName: string;
createdAt: string;
isActive?: boolean;
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
index d88640cc1..72ebc2987 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
+++ b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
@@ -110,6 +110,7 @@ export const formSchema = z.object({
"secret-scanning": generalPermissionSchema,
sso: generalPermissionSchema,
scim: generalPermissionSchema,
+ [OrgPermissionSubjects.GithubOrgSync]: generalPermissionSchema,
ldap: generalPermissionSchema,
billing: generalPermissionSchema,
identity: identityPermissionSchema,
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
index f077a63a7..7c9cb9850 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
+++ b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/RolePermissionsSection.tsx
@@ -63,6 +63,10 @@ const SIMPLE_PERMISSION_OPTIONS = [
title: "SCIM",
formName: "scim"
},
+ {
+ title: "GitHub Organization Sync",
+ formName: OrgPermissionSubjects.GithubOrgSync
+ },
{
title: "External KMS",
formName: OrgPermissionSubjects.Kms
diff --git a/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/GithubOrgSyncConfigModal.tsx b/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/GithubOrgSyncConfigModal.tsx
index 65fedbfe8..1aa050441 100644
--- a/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/GithubOrgSyncConfigModal.tsx
+++ b/frontend/src/pages/organization/SettingsPage/components/OrgAuthTab/GithubOrgSyncConfigModal.tsx
@@ -145,7 +145,7 @@ export const GithubOrgSyncConfigModal = ({
@@ -163,7 +163,7 @@ export const GithubOrgSyncConfigModal = ({
handlePopUpToggle("githubOrgSyncConfig", isOpen)}
+ onChange={(isOpen) => handlePopUpToggle("deleteGithubOrgSyncConfig", isOpen)}
deleteKey="confirm"
onDeleteApproved={onDelete}
/>