awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 18:41:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'revert-2505-revert-2494-daniel/api-errors' of https://github.com/Infisical/infisical into revert-2505-revert-2494-daniel/api-errors

Browse Source
This commit is contained in:
Daniel Hougaard
2024-09-30 22:16:32 +04:00
parent 2b35e20b1d ba1db870a4
commit d44f99bac2
17 changed files with 135 additions and 110 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-access-token/identity-access-token-service.ts
+9 -9
View File
@@ -2,7 +2,7 @@ import jwt, { JwtPayload } from "jsonwebtoken";
import { TableName, TIdentityAccessTokens } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue";
@@ -39,7 +39,7 @@ export const identityAccessTokenServiceFactory = ({
if (accessTokenNumUsesLimit > 0 && accessTokenNumUses > 0 && accessTokenNumUses >= accessTokenNumUsesLimit) {
await identityAccessTokenDAL.deleteById(tokenId);
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Unable to renew because access token number of uses limit reached"
});
}
@@ -55,7 +55,7 @@ export const identityAccessTokenServiceFactory = ({
if (currentDate > expirationDate) {
await identityAccessTokenDAL.deleteById(tokenId);
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Failed to renew MI access token due to TTL expiration"
});
}
@@ -67,7 +67,7 @@ export const identityAccessTokenServiceFactory = ({
if (currentDate > expirationDate) {
await identityAccessTokenDAL.deleteById(tokenId);
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Failed to renew MI access token due to TTL expiration"
});
}
@@ -82,7 +82,7 @@ export const identityAccessTokenServiceFactory = ({
identityAccessTokenId: string;
};
if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {
throw new ForbiddenRequestError({ message: "Only identity access tokens can be renewed" });
throw new BadRequestError({ message: "Only identity access tokens can be renewed" });
}
const identityAccessToken = await identityAccessTokenDAL.findOne({
@@ -109,7 +109,7 @@ export const identityAccessTokenServiceFactory = ({
if (currentDate > expirationDate) {
await identityAccessTokenDAL.deleteById(identityAccessToken.id);
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Failed to renew MI access token due to Max TTL expiration"
});
}
@@ -117,7 +117,7 @@ export const identityAccessTokenServiceFactory = ({
const extendToDate = new Date(currentDate.getTime() + Number(accessTokenTTL * 1000));
if (extendToDate > expirationDate) {
await identityAccessTokenDAL.deleteById(identityAccessToken.id);
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Failed to renew MI access token past its Max TTL expiration"
});
}
@@ -137,7 +137,7 @@ export const identityAccessTokenServiceFactory = ({
identityAccessTokenId: string;
};
if (decodedToken.authTokenType !== AuthTokenType.IDENTITY_ACCESS_TOKEN) {
throw new ForbiddenRequestError({ message: "Only identity access tokens can be revoked" });
throw new UnauthorizedError({ message: "Only identity access tokens can be revoked" });
}
const identityAccessToken = await identityAccessTokenDAL.findOne({
@@ -160,7 +160,7 @@ export const identityAccessTokenServiceFactory = ({
});
if (!identityAccessToken) throw new UnauthorizedError({ message: "No identity access token found" });
if (identityAccessToken.isAccessTokenRevoked)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Failed to authorize revoked access token, access token is revoked"
});
backend/src/services/identity-aws-auth/identity-aws-auth-service.ts
+3 -3
View File
@@ -9,7 +9,7 @@ import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/pe
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { isAtLeastAsPrivileged } from "@app/lib/casl";
import { getConfig } from "@app/lib/config/env";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
import { ActorType, AuthTokenType } from "../auth/auth-type";
@@ -81,7 +81,7 @@ export const identityAwsAuthServiceFactory = ({
.some((accountId) => accountId === Account);
if (!isAccountAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: AWS account ID not allowed."
});
}
@@ -100,7 +100,7 @@ export const identityAwsAuthServiceFactory = ({
});
if (!isArnAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: AWS principal ARN not allowed."
});
}
backend/src/services/identity-azure-auth/identity-azure-auth-service.ts
+2 -3
View File
@@ -73,7 +73,7 @@ export const identityAzureAuthServiceFactory = ({
.map((servicePrincipalId) => servicePrincipalId.trim())
.some((servicePrincipalId) => servicePrincipalId === azureIdentity.oid);
if (!isServicePrincipalAllowed) throw new ForbiddenRequestError({ message: "Service principal not allowed" });
if (!isServicePrincipalAllowed) throw new UnauthorizedError({ message: "Service principal not allowed" });
}
const identityAccessToken = await identityAzureAuthDAL.transaction(async (tx) => {
@@ -314,8 +314,7 @@ export const identityAzureAuthServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke azure auth of identity with more privileged role"
});
backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts
+4 -5
View File
@@ -86,7 +86,7 @@ export const identityGcpAuthServiceFactory = ({
.some((serviceAccount) => serviceAccount === gcpIdentityDetails.email);
if (!isServiceAccountAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP service account not allowed."
});
}
@@ -100,7 +100,7 @@ export const identityGcpAuthServiceFactory = ({
.some((project) => project === gcpIdentityDetails.computeEngineDetails?.project_id);
if (!isProjectAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP project not allowed."
});
}
@@ -112,7 +112,7 @@ export const identityGcpAuthServiceFactory = ({
.some((zone) => zone === gcpIdentityDetails.computeEngineDetails?.zone);
if (!isZoneAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: GCP zone not allowed."
});
}
@@ -359,8 +359,7 @@ export const identityGcpAuthServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke gcp auth of identity with more privileged role"
});
backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts
+4 -4
View File
@@ -132,7 +132,7 @@ export const identityKubernetesAuthServiceFactory = ({
// check the response to determine if the token is valid
if (!(data.status && data.status.authenticated))
throw new ForbiddenRequestError({ message: "Kubernetes token not authenticated" });
throw new UnauthorizedError({ message: "Kubernetes token not authenticated" });
const { namespace: targetNamespace, name: targetName } = extractK8sUsername(data.status.user.username);
@@ -145,7 +145,7 @@ export const identityKubernetesAuthServiceFactory = ({
.some((namespace) => namespace === targetNamespace);
if (!isNamespaceAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s namespace not allowed."
});
}
@@ -159,7 +159,7 @@ export const identityKubernetesAuthServiceFactory = ({
.some((name) => name === targetName);
if (!isNameAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s name not allowed."
});
}
@@ -171,7 +171,7 @@ export const identityKubernetesAuthServiceFactory = ({
);
if (!isAudienceAllowed)
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: K8s audience not allowed."
});
}
backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
+3 -4
View File
@@ -148,7 +148,7 @@ export const identityOidcAuthServiceFactory = ({
.split(", ")
.some((policyValue) => doesFieldValueMatchOidcPolicy(tokenData.aud, policyValue))
) {
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: OIDC audience not allowed."
});
}
@@ -161,7 +161,7 @@ export const identityOidcAuthServiceFactory = ({
if (
!claimValue.split(", ").some((claimEntry) => doesFieldValueMatchOidcPolicy(tokenData[claimKey], claimEntry))
) {
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied: OIDC claim not allowed."
});
}
@@ -532,8 +532,7 @@ export const identityOidcAuthServiceFactory = ({
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge) {
if (!isAtLeastAsPrivileged(permission, rolePermission)) {
throw new ForbiddenRequestError({
message: "Failed to revoke OIDC auth of identity with more privileged role"
});
backend/src/services/identity-ua/identity-ua-service.ts
+8 -10
View File
@@ -88,7 +88,7 @@ export const identityUaServiceFactory = ({
isClientSecretRevoked: true
});
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied due to expired client secret"
});
}
@@ -100,7 +100,7 @@ export const identityUaServiceFactory = ({
await identityUaClientSecretDAL.updateById(validClientSecretInfo.id, {
isClientSecretRevoked: true
});
throw new ForbiddenRequestError({
throw new UnauthorizedError({
message: "Access denied due to client secret usage limit reached"
});
}
@@ -368,8 +368,7 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke universal auth of identity with more privileged role"
});
@@ -474,8 +473,8 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to add identity to project with more privileged role"
});
@@ -521,8 +520,7 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to read identity client secret of project with more privileged role"
});
@@ -561,8 +559,8 @@ export const identityUaServiceFactory = ({
actorAuthMethod,
actorOrgId
);
const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
if (!hasPriviledge)
if (!isAtLeastAsPrivileged(permission, rolePermission))
throw new ForbiddenRequestError({
message: "Failed to revoke identity client secret with more privileged role"
});
backend/src/services/org/org-service.ts
+4 -2
View File
@@ -892,7 +892,7 @@ export const orgServiceFactory = ({
const membership = await orgMembershipDAL.findOrgMembershipById(membershipId);
if (!membership) {
throw new NotFoundError({ message: "Failed to find organization membership" });
throw new NotFoundError({ message: "Organization membership not found" });
}
if (membership.orgId !== orgId) {
throw new ForbiddenRequestError({ message: "Membership does not belong to organization" });
@@ -937,7 +937,9 @@ export const orgServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Member);
const membership = await orgMembershipDAL.findOrgMembershipById(orgMembershipId);
if (!membership) throw new NotFoundError({ message: "Failed to find organization membership" });
if (!membership) {
throw new NotFoundError({ message: "Organization membership not found" });
}
if (membership.orgId !== orgId) throw new NotFoundError({ message: "Failed to find organization membership" });
const projectMemberships = await projectMembershipDAL.findProjectMembershipsByUserId(orgId, membership.user.id);
backend/src/services/project/project-service.ts
+1 -3
View File
@@ -909,9 +909,7 @@ export const projectServiceFactory = ({
);
if (!membership) {
throw new ForbiddenRequestError({
message: "User is not a member of the project"
});
throw new ForbiddenRequestError({ message: "You are not a member of this project" });
}
const kmsKeyId = await kmsService.getProjectSecretManagerKmsKeyId(projectId);
backend/src/services/service-token/service-token-service.ts
+2 -2
View File
@@ -6,7 +6,7 @@ import bcrypt from "bcrypt";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getConfig } from "@app/lib/config/env";
import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
import { TAccessTokenQueueServiceFactory } from "../access-token-queue/access-token-queue";
import { ActorType } from "../auth/auth-type";
@@ -168,7 +168,7 @@ export const serviceTokenServiceFactory = ({
}
const isMatch = await bcrypt.compare(tokenSecret, serviceToken.secretHash);
if (!isMatch) throw new ForbiddenRequestError();
if (!isMatch) throw new UnauthorizedError({ message: "Invalid service token" });
await accessTokenQueue.updateServiceTokenStatus(serviceToken.id);
return { ...serviceToken, lastUsed: new Date(), orgId: project.orgId };