awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-17 08:35:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add required endpoints/functions for service account to create service tokens

Browse Source
This commit is contained in:
Tuan Dang
2023-04-06 16:59:55 +03:00
parent a3b2d1c838
commit d54753289a
18 changed files with 431 additions and 220 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/helpers/workspace.ts
+14 -16
View File
@@ -53,30 +53,26 @@ const validateClientForWorkspace = async ({
requiredPermissions?: string[];
}) => {
let membership;
if (authData.authMode === AUTH_MODE_JWT && authData.authPayload instanceof User) {
membership = await validateUserClientForWorkspace({
const membership = await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId,
environment,
requiredPermissions
});
// TODO: validate user against [requiredPermissions]
return ({ membership });
}
if (authData.authMode === AUTH_MODE_SERVICE_ACCOUNT && authData.authPayload instanceof ServiceAccount) {
const permission = await ServiceAccountWorkspacePermission.findOne({
serviceAccount: authData.authPayload._id,
workspace: new Types.ObjectId(workspaceId),
environment
await validateServiceAccountClientForWorkspace({
serviceAccount: authData.authPayload,
workspaceId,
environment,
requiredPermissions
});
if (!permission) throw UnauthorizedRequestError({
message: 'Failed service account authorization for the given workspace environment'
});
// TODO: validate [requiredPermissions] against [permission]
return {};
}
if (authData.authMode === AUTH_MODE_SERVICE_TOKEN && authData.authPayload instanceof ServiceTokenData) {
@@ -87,20 +83,22 @@ const validateClientForWorkspace = async ({
requiredPermissions
});
// TODO: validate [requiredPermissions] against [permission]
return {};
}
if (authData.authMode === AUTH_MODE_API_KEY && authData.authPayload instanceof User) {
membership = await validateUserClientForWorkspace({
const membership = await validateUserClientForWorkspace({
user: authData.authPayload,
workspaceId,
environment,
requiredPermissions
});
return ({ membership });
}
return ({
membership
throw UnauthorizedRequestError({
message: 'Failed client authorization for workspace resource'
});
}