awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

edge case: read write for non existing env in deniedPermissions

Browse Source
This commit is contained in:
Maidul Islam
2023-09-15 22:32:03 -04:00
parent f16944024b
commit d8d480f2bc
1 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/src/utils/setup/backfillData.ts
View File

@@ -723,6 +723,13 @@ export const backfillPermission = async () => {
if (ability === "read") secretAccessRule[environmentSlug].read = false; if (ability === "read") secretAccessRule[environmentSlug].read = false;
}); });
// environments that are not listed in deniedPermissions should be set to allowed for both read & and write
membership.workspace.environments.forEach(env => {
if (!secretAccessRule?.[env.slug]) {
secretAccessRule[env.slug] = { read: true, write: true };
}
})
const secretPermissions: any = []; const secretPermissions: any = [];
Object.entries(secretAccessRule).forEach(([envSlug, { read, write }]) => { Object.entries(secretAccessRule).forEach(([envSlug, { read, write }]) => {
if (read) { if (read) {
@@ -768,7 +775,7 @@ export const backfillPermission = async () => {
const { membershipIds, permissions, workspaceId, organizationId } = value const { membershipIds, permissions, workspaceId, organizationId } = value
const membership_identity = crypto.randomBytes(3).toString("hex") const membership_identity = crypto.randomBytes(3).toString("hex")
const role = new Role({ const role = new Role({
name: `Migrated Role [${membership_identity.toUpperCase()}]`, name: `Limited [${membership_identity.toUpperCase()}]`,
organization: organizationId, organization: organizationId,
workspace: workspaceId, workspace: workspaceId,
description: "This role was auto generated by Infisical in effort to migrate your project members to our new permission system", description: "This role was auto generated by Infisical in effort to migrate your project members to our new permission system",