awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Rename azure flag to enableVersions

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-11-03 11:40:15 -03:00
parent ee7e793200
commit ea7bff7f34
8 changed files with 56 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts
View File

@@ -3,6 +3,7 @@ import * as AWS from "aws-sdk";
import RE2 from "re2";
import { z } from "zod";
import { TCertificateSyncs } from "@app/db/schemas";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { logger } from "@app/lib/logger";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -397,11 +398,10 @@ export const awsCertificateManagerPkiSyncFactory = ({
});
const existingSyncRecords = await certificateSyncDAL.findByPkiSyncId(pkiSync.id);
type SyncRecord = (typeof existingSyncRecords)[0];
const syncRecordsByCertId = new Map<string, SyncRecord>();
const syncRecordsByExternalId = new Map<string, SyncRecord>();
const syncRecordsByCertId = new Map<string, TCertificateSyncs>();
const syncRecordsByExternalId = new Map<string, TCertificateSyncs>();
existingSyncRecords.forEach((record: SyncRecord) => {
existingSyncRecords.forEach((record: TCertificateSyncs) => {
if (record.certificateId) {
syncRecordsByCertId.set(record.certificateId, record);
}

20
backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts
View File

@@ -2,6 +2,7 @@
import { AxiosError } from "axios";
import * as crypto from "crypto";
import { TCertificateSyncs } from "@app/db/schemas";
import { request } from "@app/lib/config/request";
import { logger } from "@app/lib/logger";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -346,11 +347,10 @@ export const azureKeyVaultPkiSyncFactory = ({
);
const existingSyncRecords = await certificateSyncDAL.findByPkiSyncId(pkiSync.id);
type SyncRecord = (typeof existingSyncRecords)[0];
const syncRecordsByCertId = new Map<string, SyncRecord>();
const syncRecordsByExternalId = new Map<string, SyncRecord>();
const syncRecordsByCertId = new Map<string, TCertificateSyncs>();
const syncRecordsByExternalId = new Map<string, TCertificateSyncs>();
existingSyncRecords.forEach((record: SyncRecord) => {
existingSyncRecords.forEach((record: TCertificateSyncs) => {
if (record.certificateId) {
syncRecordsByCertId.set(record.certificateId, record);
}
@@ -368,10 +368,10 @@ export const azureKeyVaultPkiSyncFactory = ({
}[] = [];
const syncOptions = pkiSync.syncOptions as
| { certificateNameSchema?: string; canRemoveCertificates?: boolean; preserveVersion?: boolean }
| { certificateNameSchema?: string; canRemoveCertificates?: boolean; enableVersioning?: boolean }
| undefined;
const canRemoveCertificates = syncOptions?.canRemoveCertificates ?? true;
const preserveVersion = syncOptions?.preserveVersion ?? true;
const enableVersioning = syncOptions?.enableVersioning ?? true;
const activeExternalIdentifiers = new Set<string>();
@@ -382,7 +382,7 @@ export const azureKeyVaultPkiSyncFactory = ({
continue;
}
if (preserveVersion && typeof certificateId === "string") {
if (enableVersioning && typeof certificateId === "string") {
const certificate = await certificateDAL.findById(certificateId);
if (certificate?.renewedByCertificateId) {
// eslint-disable-next-line no-continue
@@ -399,7 +399,7 @@ export const azureKeyVaultPkiSyncFactory = ({
if (existingSyncRecord?.externalIdentifier) {
const existingAzureCert = vaultCertificates[existingSyncRecord.externalIdentifier];
if (existingAzureCert && preserveVersion) {
if (existingAzureCert && enableVersioning) {
targetCertName = existingSyncRecord.externalIdentifier;
activeExternalIdentifiers.add(targetCertName);
@@ -409,7 +409,7 @@ export const azureKeyVaultPkiSyncFactory = ({
}
} else if (!existingAzureCert) {
shouldCreateNew = true;
} else if (!preserveVersion) {
} else if (!enableVersioning) {
shouldCreateNew = true;
}
} else {
@@ -544,7 +544,7 @@ export const azureKeyVaultPkiSyncFactory = ({
]);
}
if (preserveVersion) {
if (enableVersioning) {
const currentCertificate = await certificateDAL.findById(certificateId);
if (currentCertificate?.renewedFromCertificateId) {
await certificateSyncDAL.removeCertificates(pkiSync.id, [currentCertificate.renewedFromCertificateId]);

2
backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts
View File

@@ -14,7 +14,7 @@ export const AzureKeyVaultPkiSyncConfigSchema = z.object({
const AzureKeyVaultPkiSyncOptionsSchema = z.object({
canImportCertificates: z.boolean().default(false),
canRemoveCertificates: z.boolean().default(true),
preserveVersion: z.boolean().default(true),
enableVersioning: z.boolean().default(true),
certificateNameSchema: z
.string()
.optional()

13
backend/src/services/pki-sync/pki-sync-service.ts
View File

@@ -95,10 +95,17 @@ export const pkiSyncServiceFactory = ({
});
}
const invalidCertificates = certificates.filter((cert) => cert.projectId !== expectedProjectId);
if (invalidCertificates.length > 0) {
const invalidProjectCertificates = certificates.filter((cert) => cert.projectId !== expectedProjectId);
if (invalidProjectCertificates.length > 0) {
throw new BadRequestError({
message: `Certificates do not belong to the same project: ${invalidCertificates.map((cert) => cert.id).join(", ")}`
message: `Certificates do not belong to the same project: ${invalidProjectCertificates.map((cert) => cert.id).join(", ")}`
});
}
const invalidRenewedCertificates = certificates.filter((cert) => cert.renewedByCertificateId);
if (invalidRenewedCertificates.length > 0) {
throw new BadRequestError({
message: `Cannot add renewed certificates to PKI sync: ${invalidRenewedCertificates.map((cert) => cert.id).join(", ")}`
});
}
};

2
frontend/src/components/pki-syncs/forms/PkiSyncConnectionField.tsx
View File

@@ -69,7 +69,7 @@ export const PkiSyncConnectionField = ({ onChange: callback }: Props) => {
<Controller
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
tooltipText="App Connections can be created from the Organization Settings page."
tooltipText="App Connections can be created from the Project Settings page."
isError={Boolean(error)}
errorText={error?.message}
label={`${connectionName} Connection`}

4
frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx
View File

@@ -141,7 +141,7 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
{currentDestination === PkiSync.AzureKeyVault && (
<Controller
control={control}
name="syncOptions.preserveVersion"
name="syncOptions.enableVersioning"
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl isError={Boolean(error)} errorText={error?.message}>
<Switch
@@ -160,7 +160,7 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
<p>
When enabled, Infisical will create a new version of the existing
certificate in Azure Key Vault during certificate renewal syncs,
preserving the certificate name.
preserving the original certificate name.
</p>
<p className="mt-4">
This allows consuming services to continue using the same certificate name

2
frontend/src/components/pki-syncs/forms/schemas/azure-key-vault-pki-sync-destination-schema.ts
View File

@@ -7,7 +7,7 @@ import { BasePkiSyncSchema } from "./base-pki-sync-schema";
const AzureKeyVaultSyncOptionsSchema = z.object({
canImportCertificates: z.boolean().default(false),
canRemoveCertificates: z.boolean().default(true),
preserveVersion: z.boolean().default(true),
enableVersioning: z.boolean().default(true),
certificateNameSchema: z
.string()
.optional()

52
frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
View File

@@ -458,31 +458,33 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
</ProjectPermissionCan>
);
})()}
{/* PKI Sync management - only for active certificates */}
{certificate.status === CertStatus.ACTIVE && (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
>
{(isAllowed) => (
<DropdownMenuItem
className={twMerge(
!isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
)}
onClick={async () =>
handlePopUpOpen("managePkiSyncs", {
certificateId: certificate.id,
commonName: certificate.commonName
})
}
disabled={!isAllowed}
icon={<FontAwesomeIcon icon={faLink} />}
>
Manage PKI Syncs
</DropdownMenuItem>
)}
</ProjectPermissionCan>
)}
{/* PKI Sync management - only for active certificates that are not renewed */}
{certificate.status === CertStatus.ACTIVE &&
!certificate.renewedByCertificateId && (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
>
{(isAllowed) => (
<DropdownMenuItem
className={twMerge(
!isAllowed &&
"pointer-events-none cursor-not-allowed opacity-50"
)}
onClick={async () =>
handlePopUpOpen("managePkiSyncs", {
certificateId: certificate.id,
commonName: certificate.commonName
})
}
disabled={!isAllowed}
icon={<FontAwesomeIcon icon={faLink} />}
>
Manage PKI Syncs
</DropdownMenuItem>
)}
</ProjectPermissionCan>
)}
{/* Only show revoke button if CA supports revocation */}
{(() => {
const caType = caCapabilityMap[certificate.caId];