awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 15:27:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: addressed typescript issue

Browse Source
This commit is contained in:
Sheen Capadngan
2025-11-12 20:11:04 +08:00
parent fd743aca72
commit e2d5b13383
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts
+7 -5
View File
@@ -208,8 +208,10 @@ export const identityOidcAuthServiceFactory = ({
}); });
} }
const verifiedTokenData: Record<string, string> = tokenData;
if (identityOidcAuth.boundSubject) { if (identityOidcAuth.boundSubject) {
if (!doesFieldValueMatchOidcPolicy(tokenData.sub, identityOidcAuth.boundSubject)) { if (!doesFieldValueMatchOidcPolicy(verifiedTokenData.sub, identityOidcAuth.boundSubject)) {
throw new ForbiddenRequestError({ throw new ForbiddenRequestError({
message: "Access denied: OIDC subject not allowed." message: "Access denied: OIDC subject not allowed."
}); });
@@ -220,7 +222,7 @@ export const identityOidcAuthServiceFactory = ({
if ( if (
!identityOidcAuth.boundAudiences !identityOidcAuth.boundAudiences
.split(", ") .split(", ")
.some((policyValue) => doesAudValueMatchOidcPolicy(tokenData.aud, policyValue)) .some((policyValue) => doesAudValueMatchOidcPolicy(verifiedTokenData.aud, policyValue))
) { ) {
throw new UnauthorizedError({ throw new UnauthorizedError({
message: "Access denied: OIDC audience not allowed." message: "Access denied: OIDC audience not allowed."
@@ -231,7 +233,7 @@ export const identityOidcAuthServiceFactory = ({
if (identityOidcAuth.boundClaims) { if (identityOidcAuth.boundClaims) {
Object.keys(identityOidcAuth.boundClaims).forEach((claimKey) => { Object.keys(identityOidcAuth.boundClaims).forEach((claimKey) => {
const claimValue = (identityOidcAuth.boundClaims as Record<string, string>)[claimKey]; const claimValue = (identityOidcAuth.boundClaims as Record<string, string>)[claimKey];
const value = getValueByDot(tokenData, claimKey); const value = getValueByDot(verifiedTokenData, claimKey);
if (!value) { if (!value) {
throw new UnauthorizedError({ throw new UnauthorizedError({
@@ -252,7 +254,7 @@ export const identityOidcAuthServiceFactory = ({
if (identityOidcAuth.claimMetadataMapping) { if (identityOidcAuth.claimMetadataMapping) {
Object.keys(identityOidcAuth.claimMetadataMapping).forEach((permissionKey) => { Object.keys(identityOidcAuth.claimMetadataMapping).forEach((permissionKey) => {
const claimKey = (identityOidcAuth.claimMetadataMapping as Record<string, string>)[permissionKey]; const claimKey = (identityOidcAuth.claimMetadataMapping as Record<string, string>)[permissionKey];
const value = getValueByDot(tokenData, claimKey); const value = getValueByDot(verifiedTokenData, claimKey);
if (!value) { if (!value) {
throw new UnauthorizedError({ throw new UnauthorizedError({
message: `Access denied: token has no ${claimKey} field` message: `Access denied: token has no ${claimKey} field`
@@ -316,7 +318,7 @@ export const identityOidcAuthServiceFactory = ({
}); });
} }
return { accessToken, identityOidcAuth, identityAccessToken, identity, oidcTokenData: tokenData }; return { accessToken, identityOidcAuth, identityAccessToken, identity, oidcTokenData: verifiedTokenData };
} catch (error) { } catch (error) {
if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) { if (appCfg.OTEL_TELEMETRY_COLLECTION_ENABLED) {
authAttemptCounter.add(1, { authAttemptCounter.add(1, {