awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-15 19:16:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(rbac): added new zod validation and permission check for all org level api

Browse Source
This commit is contained in:
Akhil Mohan
2023-09-08 21:20:29 +05:30
parent 96437fd1b7
commit e342e88499
27 changed files with 1870 additions and 1593 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/routes/v1/inviteOrg.ts
+11 -14
View File
@@ -8,23 +8,20 @@ import { AuthMode } from "../../variables";
// TODO endpoint: consider moving these endpoints to be under /organization to be more RESTful
router.post(
"/signup",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
body("inviteeEmail").exists().trim().notEmpty().isEmail(),
body("organizationId").exists().trim().notEmpty(),
validateRequest,
membershipOrgController.inviteUserToOrganization
"/signup",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
membershipOrgController.inviteUserToOrganization
);
router.post(
"/verify",
body("email").exists().trim().notEmpty(),
body("organizationId").exists().trim().notEmpty(),
body("code").exists().trim().notEmpty(),
validateRequest,
membershipOrgController.verifyUserToOrganization
"/verify",
body("email").exists().trim().notEmpty(),
body("organizationId").exists().trim().notEmpty(),
body("code").exists().trim().notEmpty(),
validateRequest,
membershipOrgController.verifyUserToOrganization
);
export default router;
backend/src/routes/v1/membership.ts
+37 -33
View File
@@ -9,45 +9,49 @@ import { AuthMode } from "../../variables";
// note: ALL DEPRECIATED (moved to api/v2/workspace/:workspaceId/memberships/:membershipId)
// TODO endpoint: consider moving these endpoints to be under /workspace to be more RESTful
router.get( // TODO endpoint: deprecate - used for old CLI (deprecate)
"/:workspaceId/connect",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
param("workspaceId").exists().trim(),
validateRequest,
membershipController.validateMembership
router.get(
// TODO endpoint: deprecate - used for old CLI (deprecate)
"/:workspaceId/connect",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
param("workspaceId").exists().trim(),
validateRequest,
membershipController.validateMembership
);
router.delete( // TODO endpoint: check dashboard
"/:membershipId",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
param("membershipId").exists().trim(),
validateRequest,
membershipController.deleteMembership
router.delete(
// TODO endpoint: check dashboard
"/:membershipId",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
param("membershipId").exists().trim(),
validateRequest,
membershipController.deleteMembership
);
router.post( // TODO endpoint: check dashboard
"/:membershipId/change-role",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
body("role").exists().trim(),
validateRequest,
membershipController.changeMembershipRole
router.post(
// TODO endpoint: check dashboard
"/:membershipId/change-role",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
body("role").exists().trim(),
validateRequest,
membershipController.changeMembershipRole
);
router.post( // TODO endpoint: check dashboard
"/:membershipId/deny-permissions",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
param("membershipId").isMongoId().exists().trim(),
body("permissions").isArray().exists(),
validateRequest,
EEMembershipControllers.denyMembershipPermissions
router.post(
// TODO endpoint: check dashboard
"/:membershipId/deny-permissions",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
param("membershipId").isMongoId().exists().trim(),
body("permissions").isArray().exists(),
validateRequest,
EEMembershipControllers.denyMembershipPermissions
);
export default router;
backend/src/routes/v1/membershipOrg.ts
+14 -15
View File
@@ -5,24 +5,23 @@ import { requireAuth, validateRequest } from "../../middleware";
import { membershipOrgController } from "../../controllers/v1";
import { AuthMode } from "../../variables";
router.post( // TODO endpoint: check dashboard
"/membershipOrg/:membershipOrgId/change-role",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
param("membershipOrgId"),
validateRequest,
membershipOrgController.changeMembershipOrgRole
router.post(
// TODO endpoint: check dashboard
"/membershipOrg/:membershipOrgId/change-role",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
param("membershipOrgId"),
validateRequest,
membershipOrgController.changeMembershipOrgRole
);
router.delete(
"/:membershipOrgId", // TODO endpoint: check dashboard
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
param("membershipOrgId").exists().trim(),
validateRequest,
membershipOrgController.deleteMembershipOrg
"/:membershipOrgId", // TODO endpoint: check dashboard
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
membershipOrgController.deleteMembershipOrg
);
export default router;
backend/src/routes/v1/organization.ts
+65 -132
View File
@@ -1,166 +1,99 @@
import express from "express";
const router = express.Router();
import { body, param } from "express-validator";
import {
requireAuth,
requireOrganizationAuth,
validateRequest,
} from "../../middleware";
import {
ACCEPTED,
ADMIN,
AuthMode,
MEMBER,
OWNER
} from "../../variables";
import { requireAuth } from "../../middleware";
import { AuthMode } from "../../variables";
import { organizationController } from "../../controllers/v1";
router.get( // TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
"/",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
organizationController.getOrganizations
router.get(
// TODO endpoint: deprecate (moved to api/v2/users/me/organizations)
"/",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganizations
);
router.post( // not used on frontend
"/",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
body("organizationName").exists().trim().notEmpty(),
validateRequest,
organizationController.createOrganization
router.post(
// not used on frontend
"/",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.createOrganization
);
router.get(
"/:organizationId",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.getOrganization
"/:organizationId",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganization
);
router.get( // TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
"/:organizationId/users",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.getOrganizationMembers
router.get(
// TODO endpoint: deprecate (moved to api/v2/organizations/:organizationId/memberships)
"/:organizationId/users",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganizationMembers
);
router.get( // TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
"/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.getOrganizationWorkspaces
router.get(
// TODO endpoint: move to /v2/users/me/organizations/:organizationId/workspaces
"/:organizationId/my-workspaces", // deprecated (moved to api/v2/organizations/:organizationId/workspaces)
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganizationWorkspaces
);
router.patch(
"/:organizationId/name",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
body("name").exists().trim().notEmpty(),
validateRequest,
organizationController.changeOrganizationName
"/:organizationId/name",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.changeOrganizationName
);
router.get(
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.getOrganizationIncidentContacts
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganizationIncidentContacts
);
router.post(
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
body("email").exists().trim().notEmpty(),
validateRequest,
organizationController.addOrganizationIncidentContact
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.addOrganizationIncidentContact
);
router.delete(
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
body("email").exists().trim().notEmpty(),
validateRequest,
organizationController.deleteOrganizationIncidentContact
"/:organizationId/incidentContactOrg",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.deleteOrganizationIncidentContact
);
router.post(
"/:organizationId/customer-portal-session", // TODO endpoint: move to EE
requireAuth({
acceptedAuthModes: [AuthMode.JWT],
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.createOrganizationPortalSession
"/:organizationId/customer-portal-session", // TODO endpoint: move to EE
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.createOrganizationPortalSession
);
router.get(
"/:organizationId/workspace-memberships",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED],
}),
param("organizationId").exists().trim(),
validateRequest,
organizationController.getOrganizationMembersAndTheirWorkspaces
"/:organizationId/workspace-memberships",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
organizationController.getOrganizationMembersAndTheirWorkspaces
);
export default router;
backend/src/routes/v2/organizations.ts
+12 -51
View File
@@ -2,95 +2,56 @@ import express from "express";
const router = express.Router();
import {
requireAuth,
requireMembershipOrgAuth,
requireOrganizationAuth,
validateRequest
requireOrganizationAuth
} from "../../middleware";
import { body, param } from "express-validator";
import { ACCEPTED, ADMIN, AuthMode, MEMBER, OWNER } from "../../variables";
import { ACCEPTED, ADMIN, AuthMode, OWNER } from "../../variables";
import { organizationsController } from "../../controllers/v2";
// TODO: /POST to create membership
router.get(
"/:organizationId/memberships",
param("organizationId").exists().trim(),
validateRequest,
requireAuth({
acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN, MEMBER],
acceptedStatuses: [ACCEPTED]
}),
organizationsController.getOrganizationMemberships
);
router.patch(
"/:organizationId/memberships/:membershipId",
param("organizationId").exists().trim(),
param("membershipId").exists().trim(),
body("role").exists().isString().trim(),
validateRequest,
requireAuth({
acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED]
}),
requireMembershipOrgAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED]
}),
organizationsController.updateOrganizationMembership
);
router.delete(
"/:organizationId/memberships/:membershipId",
param("organizationId").exists().trim(),
param("membershipId").exists().trim(),
validateRequest,
requireAuth({
acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED]
}),
requireMembershipOrgAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED]
}),
organizationsController.deleteOrganizationMembership
);
router.get(
"/:organizationId/workspaces",
param("organizationId").exists().trim(),
validateRequest,
requireAuth({
acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
}),
organizationsController.getOrganizationWorkspaces
);
router.get(
// TODO endpoint: deprecate service accounts
"/:organizationId/service-accounts",
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED]
}),
organizationsController.getOrganizationWorkspaces
);
router.get( // TODO endpoint: deprecate service accounts
"/:organizationId/service-accounts",
param("organizationId").exists().trim(),
validateRequest,
requireAuth({
acceptedAuthModes: [AuthMode.JWT]
}),
requireOrganizationAuth({
acceptedRoles: [OWNER, ADMIN],
acceptedStatuses: [ACCEPTED],
}),
organizationsController.getOrganizationServiceAccounts
organizationsController.getOrganizationServiceAccounts
);
export default router;