+
+
+ 
+
+
-
Open-source, end-to-end encrypted platform to manage secrets and configs across your team and infrastructure.
+Open-source, end-to-end encrypted secret management platform: distribute secrets/configs across your team/infrastructure and prevent secret leaks.
@@ -25,7 +34,7 @@
- 
+ 
@@ -54,24 +63,18 @@ We're on a mission to make secret management more accessible to everyone, not ju
- **[Secret versioning](https://infisical.com/docs/documentation/platform/secret-versioning)** and **[Point-in-Time Recovery]()** to version every secret and project state
- **[Audit logs](https://infisical.com/docs/documentation/platform/audit-logs)** to record every action taken in a project
- **Role-based Access Controls** per environment
-- [**Simple on-premise deployments** to AWS and Digital Ocean](https://infisical.com/docs/self-hosting/overview)
-- [**Secret Scanning**](https://infisical.com/docs/cli/scanning-overview)
+- [**Simple on-premise deployments** to AWS, Digital Ocean, and more](https://infisical.com/docs/self-hosting/overview)
+- [**Secret Scanning and Leak Prevention**](https://infisical.com/docs/cli/scanning-overview)
And much more.
## Getting started
-Check out the [Quickstart](https://infisical.com/docs/getting-started/introduction) Guides
+Check out the [Quickstart Guides](https://infisical.com/docs/getting-started/introduction)
-### Use Infisical Cloud
-
-The fastest and most reliable way to get started with Infisical is signing up for free to [Infisical Cloud](https://app.infisical.com/login).
-
-### Deploy Infisical on premise
-
-
-
-View all [deployment options](https://infisical.com/docs/self-hosting/overview)
+| Use Infisical Cloud | Deploy Infisical on premise |
+| --- | ----------- |
+| The fastest and most reliable way to 
## Security
diff --git a/backend/.eslintrc b/backend/.eslintrc
index 64b049ea7..172e72d4b 100644
--- a/backend/.eslintrc
+++ b/backend/.eslintrc
@@ -1,21 +1,44 @@
{
"parser": "@typescript-eslint/parser",
- "plugins": ["@typescript-eslint", "unused-imports"],
+ "plugins": [
+ "@typescript-eslint",
+ "unused-imports"
+ ],
"extends": [
"eslint:recommended",
"plugin:@typescript-eslint/eslint-recommended",
"plugin:@typescript-eslint/recommended"
],
"rules": {
+ "@typescript-eslint/no-empty-function": "off",
"no-console": 2,
- "quotes": ["error", "double", { "avoidEscape": true }],
- "comma-dangle": ["error", "only-multiline"],
+ "quotes": [
+ "error",
+ "double",
+ {
+ "avoidEscape": true
+ }
+ ],
+ "comma-dangle": [
+ "error",
+ "only-multiline"
+ ],
"@typescript-eslint/no-unused-vars": "off",
"unused-imports/no-unused-imports": "error",
"unused-imports/no-unused-vars": [
"warn",
- { "vars": "all", "varsIgnorePattern": "^_", "args": "after-used", "argsIgnorePattern": "^_" }
+ {
+ "vars": "all",
+ "varsIgnorePattern": "^_",
+ "args": "after-used",
+ "argsIgnorePattern": "^_"
+ }
],
- "sort-imports": ["error", { "ignoreDeclarationSort": true }]
+ "sort-imports": [
+ "error",
+ {
+ "ignoreDeclarationSort": true
+ }
+ ]
}
-}
+}
\ No newline at end of file
diff --git a/backend/package-lock.json b/backend/package-lock.json
index 524a6017b..0a4a2db17 100644
--- a/backend/package-lock.json
+++ b/backend/package-lock.json
@@ -71,6 +71,7 @@
"@types/node": "^18.11.3",
"@types/nodemailer": "^6.4.6",
"@types/passport": "^1.0.12",
+ "@types/picomatch": "^2.3.0",
"@types/supertest": "^2.0.12",
"@types/swagger-jsdoc": "^6.0.1",
"@types/swagger-ui-express": "^4.1.3",
@@ -2200,6 +2201,26 @@
}
}
},
+ "node_modules/@jest/reporters/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/@jest/schemas": {
"version": "29.4.3",
"resolved": "https://registry.npmjs.org/@jest/schemas/-/schemas-29.4.3.tgz",
@@ -3241,6 +3262,12 @@
"@types/express": "*"
}
},
+ "node_modules/@types/picomatch": {
+ "version": "2.3.0",
+ "resolved": "https://registry.npmjs.org/@types/picomatch/-/picomatch-2.3.0.tgz",
+ "integrity": "sha512-O397rnSS9iQI4OirieAtsDqvCj4+3eY1J+EPdNTKuHuRWIfUoGyzX294o8C4KJYaLqgSrd2o60c5EqCU8Zv02g==",
+ "dev": true
+ },
"node_modules/@types/prettier": {
"version": "2.7.2",
"resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.2.tgz",
@@ -5680,25 +5707,6 @@
"url": "https://github.com/sponsors/sindresorhus"
}
},
- "node_modules/glob": {
- "version": "7.2.3",
- "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
- "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
- "dependencies": {
- "fs.realpath": "^1.0.0",
- "inflight": "^1.0.4",
- "inherits": "2",
- "minimatch": "^3.1.1",
- "once": "^1.3.0",
- "path-is-absolute": "^1.0.0"
- },
- "engines": {
- "node": "*"
- },
- "funding": {
- "url": "https://github.com/sponsors/isaacs"
- }
- },
"node_modules/glob-parent": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
@@ -6481,6 +6489,26 @@
}
}
},
+ "node_modules/jest-config/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/jest-diff": {
"version": "29.5.0",
"resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-29.5.0.tgz",
@@ -6776,6 +6804,26 @@
"node": "^14.15.0 || ^16.10.0 || >=18.0.0"
}
},
+ "node_modules/jest-runtime/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/jest-snapshot": {
"version": "29.5.0",
"resolved": "https://registry.npmjs.org/jest-snapshot/-/jest-snapshot-29.5.0.tgz",
@@ -11071,6 +11119,25 @@
"url": "https://github.com/sponsors/isaacs"
}
},
+ "node_modules/rimraf/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/ripemd160": {
"version": "2.0.2",
"resolved": "https://registry.npmjs.org/ripemd160/-/ripemd160-2.0.2.tgz",
@@ -11669,6 +11736,25 @@
"node": ">=0.4.0"
}
},
+ "node_modules/swagger-autogen/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/swagger-ui-dist": {
"version": "4.19.0",
"resolved": "https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-4.19.0.tgz",
@@ -11723,6 +11809,26 @@
"node": ">=8"
}
},
+ "node_modules/test-exclude/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
"node_modules/text-hex": {
"version": "1.0.0",
"resolved": "https://registry.npmjs.org/text-hex/-/text-hex-1.0.0.tgz",
@@ -14154,6 +14260,22 @@
"string-length": "^4.0.1",
"strip-ansi": "^6.0.0",
"v8-to-istanbul": "^9.0.1"
+ },
+ "dependencies": {
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
+ }
}
},
"@jest/schemas": {
@@ -14988,6 +15110,12 @@
"@types/express": "*"
}
},
+ "@types/picomatch": {
+ "version": "2.3.0",
+ "resolved": "https://registry.npmjs.org/@types/picomatch/-/picomatch-2.3.0.tgz",
+ "integrity": "sha512-O397rnSS9iQI4OirieAtsDqvCj4+3eY1J+EPdNTKuHuRWIfUoGyzX294o8C4KJYaLqgSrd2o60c5EqCU8Zv02g==",
+ "dev": true
+ },
"@types/prettier": {
"version": "2.7.2",
"resolved": "https://registry.npmjs.org/@types/prettier/-/prettier-2.7.2.tgz",
@@ -16808,19 +16936,6 @@
"integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
"dev": true
},
- "glob": {
- "version": "7.2.3",
- "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
- "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
- "requires": {
- "fs.realpath": "^1.0.0",
- "inflight": "^1.0.4",
- "inherits": "2",
- "minimatch": "^3.1.1",
- "once": "^1.3.0",
- "path-is-absolute": "^1.0.0"
- }
- },
"glob-parent": {
"version": "6.0.2",
"resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
@@ -17371,6 +17486,22 @@
"pretty-format": "^29.5.0",
"slash": "^3.0.0",
"strip-json-comments": "^3.1.1"
+ },
+ "dependencies": {
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
+ }
}
},
"jest-diff": {
@@ -17606,6 +17737,22 @@
"jest-util": "^29.5.0",
"slash": "^3.0.0",
"strip-bom": "^4.0.0"
+ },
+ "dependencies": {
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
+ }
}
},
"jest-snapshot": {
@@ -20674,6 +20821,21 @@
"integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
"requires": {
"glob": "^7.1.3"
+ },
+ "dependencies": {
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
+ }
}
},
"ripemd160": {
@@ -21129,6 +21291,19 @@
"version": "7.4.1",
"resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
"integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="
+ },
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
}
}
},
@@ -21174,6 +21349,22 @@
"@istanbuljs/schema": "^0.1.2",
"glob": "^7.1.4",
"minimatch": "^3.0.4"
+ },
+ "dependencies": {
+ "glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "dev": true,
+ "requires": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ }
+ }
}
},
"text-hex": {
diff --git a/backend/package.json b/backend/package.json
index 448ccfac2..0c0f0642d 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -89,6 +89,7 @@
"@types/node": "^18.11.3",
"@types/nodemailer": "^6.4.6",
"@types/passport": "^1.0.12",
+ "@types/picomatch": "^2.3.0",
"@types/supertest": "^2.0.12",
"@types/swagger-jsdoc": "^6.0.1",
"@types/swagger-ui-express": "^4.1.3",
diff --git a/backend/src/config/index.ts b/backend/src/config/index.ts
index 0f626b804..e023a12c8 100644
--- a/backend/src/config/index.ts
+++ b/backend/src/config/index.ts
@@ -82,4 +82,4 @@ export const getHttpsEnabled = async () => {
}
return (await client.getSecret("HTTPS_ENABLED")).secretValue === "true" && true
-}
\ No newline at end of file
+}
diff --git a/backend/src/controllers/v2/secretController.ts b/backend/src/controllers/v2/secretController.ts
index c24243f3b..edc1d50aa 100644
--- a/backend/src/controllers/v2/secretController.ts
+++ b/backend/src/controllers/v2/secretController.ts
@@ -290,7 +290,7 @@ export const updateSecret = async (req: Request, res: Response) => {
const { workspaceId, environmentName } = req.params;
const secretModificationsRequested: ModifySecretRequestBody = req.body.secret;
- const secretIdUserCanModify = await Secret.findOne({ workspace: workspaceId, environment: environmentName }, { _id: 1 });
+ await Secret.findOne({ workspace: workspaceId, environment: environmentName }, { _id: 1 });
const sanitizedSecret: SanitizedSecretModify = {
secretKeyCiphertext: secretModificationsRequested.secretKeyCiphertext,
diff --git a/backend/src/controllers/v2/secretsController.ts b/backend/src/controllers/v2/secretsController.ts
index a760a511c..b93846e70 100644
--- a/backend/src/controllers/v2/secretsController.ts
+++ b/backend/src/controllers/v2/secretsController.ts
@@ -9,7 +9,7 @@ import {
ACTION_UPDATE_SECRETS,
ALGORITHM_AES_256_GCM,
ENCODING_SCHEME_UTF8,
- SECRET_PERSONAL,
+ SECRET_PERSONAL
} from "../../variables";
import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
import { EventService } from "../../services";
@@ -21,7 +21,7 @@ import { PERMISSION_WRITE_SECRETS } from "../../variables";
import {
userHasNoAbility,
userHasWorkspaceAccess,
- userHasWriteOnlyAbility,
+ userHasWriteOnlyAbility
} from "../../ee/helpers/checkMembershipPermissions";
import Tag from "../../models/tag";
import _ from "lodash";
@@ -30,8 +30,9 @@ import Folder from "../../models/folder";
import {
getFolderByPath,
getFolderIdFromServiceToken,
- searchByFolderId,
+ searchByFolderId
} from "../../services/FolderService";
+import { isValidScope } from "../../helpers/secrets";
/**
* Peform a batch of any specified CUD secret operations
@@ -47,7 +48,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
environment,
requests,
- secretPath,
+ secretPath
}: {
workspaceId: string;
environment: string;
@@ -63,7 +64,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
// get secret blind index salt
const salt = await SecretService.getSecretBlindIndexSalt({
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
const folders = await Folder.findOne({ workspace: workspaceId, environment });
@@ -73,22 +74,17 @@ export const batchSecrets = async (req: Request, res: Response) => {
}
if (req.authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = req.authData.authPayload;
+ const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+
// in service token when not giving secretpath folderid must be root
// this is to avoid giving folderid when service tokens are used
- if (
- (!secretPath && folderId !== "root") ||
- (secretPath && secretPath !== serviceTkScopedSecretPath)
- ) {
+ if ((!secretPath && folderId !== "root") || (secretPath && !isValidScopeAccess)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
+
if (secretPath) {
- folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
}
for await (const request of requests) {
@@ -97,12 +93,10 @@ export const batchSecrets = async (req: Request, res: Response) => {
let secretBlindIndex = "";
switch (request.method) {
case "POST":
- secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt(
- {
- secretName: request.secret.secretName,
- salt,
- }
- );
+ secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+ secretName: request.secret.secretName,
+ salt
+ });
createSecrets.push({
...request.secret,
@@ -113,16 +107,14 @@ export const batchSecrets = async (req: Request, res: Response) => {
folder: folderId,
secretBlindIndex,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
break;
case "PATCH":
- secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt(
- {
- secretName: request.secret.secretName,
- salt,
- }
- );
+ secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+ secretName: request.secret.secretName,
+ salt
+ });
updateSecrets.push({
...request.secret,
@@ -130,7 +122,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
secretBlindIndex,
folder: folderId,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
break;
case "DELETE":
@@ -150,9 +142,9 @@ export const batchSecrets = async (req: Request, res: Response) => {
...n._doc,
_id: new Types.ObjectId(),
secret: n._id,
- isDeleted: false,
+ isDeleted: false
};
- }),
+ })
});
const addAction = (await EELogService.createAction({
@@ -161,7 +153,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(workspaceId),
- secretIds: createdSecrets.map((n) => n._id),
+ secretIds: createdSecrets.map((n) => n._id)
})) as IAction;
actions.push(addAction);
@@ -175,8 +167,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
folderId,
channel,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
}
@@ -195,7 +187,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
listedSecretsObj = req.secrets.reduce(
(obj: any, secret: ISecret) => ({
...obj,
- [secret._id.toString()]: secret,
+ [secret._id.toString()]: secret
}),
{}
);
@@ -204,16 +196,16 @@ export const batchSecrets = async (req: Request, res: Response) => {
updateOne: {
filter: {
_id: new Types.ObjectId(u._id),
- workspace: new Types.ObjectId(workspaceId),
+ workspace: new Types.ObjectId(workspaceId)
},
update: {
$inc: {
- version: 1,
+ version: 1
},
...u,
- _id: new Types.ObjectId(u._id),
- },
- },
+ _id: new Types.ObjectId(u._id)
+ }
+ }
}));
await Secret.bulkWrite(updateOperations);
@@ -240,25 +232,25 @@ export const batchSecrets = async (req: Request, res: Response) => {
algorithm: ALGORITHM_AES_256_GCM,
keyEncoding: ENCODING_SCHEME_UTF8,
tags: u.tags,
- folder: u.folder,
+ folder: u.folder
})
);
await EESecretService.addSecretVersions({
- secretVersions,
+ secretVersions
});
updatedSecrets = await Secret.find({
_id: {
- $in: updateSecrets.map((u) => new Types.ObjectId(u._id)),
- },
+ $in: updateSecrets.map((u) => new Types.ObjectId(u._id))
+ }
});
const updateAction = (await EELogService.createAction({
name: ACTION_UPDATE_SECRETS,
userId: req.user._id,
workspaceId: new Types.ObjectId(workspaceId),
- secretIds: updatedSecrets.map((u) => u._id),
+ secretIds: updatedSecrets.map((u) => u._id)
})) as IAction;
actions.push(updateAction);
@@ -272,8 +264,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId,
folderId,
channel,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
}
@@ -282,19 +274,19 @@ export const batchSecrets = async (req: Request, res: Response) => {
if (deleteSecrets.length > 0) {
await Secret.deleteMany({
_id: {
- $in: deleteSecrets,
- },
+ $in: deleteSecrets
+ }
});
await EESecretService.markDeletedSecretVersions({
- secretIds: deleteSecrets,
+ secretIds: deleteSecrets
});
const deleteAction = (await EELogService.createAction({
name: ACTION_DELETE_SECRETS,
userId: req.user._id,
workspaceId: new Types.ObjectId(workspaceId),
- secretIds: deleteSecrets,
+ secretIds: deleteSecrets
})) as IAction;
actions.push(deleteAction);
@@ -307,8 +299,8 @@ export const batchSecrets = async (req: Request, res: Response) => {
environment,
workspaceId,
channel: channel,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
}
@@ -320,22 +312,22 @@ export const batchSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(workspaceId),
actions,
channel,
- ipAddress: req.realIP,
+ ipAddress: req.realIP
});
}
// // trigger event - push secrets
await EventService.handleEvent({
event: eventPushSecrets({
- workspaceId: new Types.ObjectId(workspaceId),
- }),
+ workspaceId: new Types.ObjectId(workspaceId)
+ })
});
// (EE) take a secret snapshot
await EESecretService.takeSecretSnapshot({
workspaceId: new Types.ObjectId(workspaceId),
environment,
- folderId,
+ folderId
});
const resObj: { [key: string]: ISecret[] | string[] } = {};
@@ -418,7 +410,7 @@ export const createSecrets = async (req: Request, res: Response) => {
const {
workspaceId,
environment,
- secretPath,
+ secretPath
}: {
workspaceId: string;
environment: string;
@@ -435,8 +427,7 @@ export const createSecrets = async (req: Request, res: Response) => {
);
if (!hasAccess) {
throw UnauthorizedRequestError({
- message:
- "You do not have the necessary permission(s) perform this action",
+ message: "You do not have the necessary permission(s) perform this action"
});
}
}
@@ -449,28 +440,27 @@ export const createSecrets = async (req: Request, res: Response) => {
// case: create 1 secret
listOfSecretsToCreate = [req.body.secrets];
}
+
if (req.authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = req.authData.authPayload;
+ const isValidScopeAccess = isValidScope(
+ req.authData.authPayload,
+ environment,
+ secretPath || "/"
+ );
+
// in service token when not giving secretpath folderid must be root
// this is to avoid giving folderid when service tokens are used
- if (
- (!secretPath && folderId !== "root") ||
- (secretPath && secretPath !== serviceTkScopedSecretPath)
- ) {
+ if ((!secretPath && folderId !== "root") || (secretPath && !isValidScopeAccess)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
if (secretPath) {
- folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
}
// get secret blind index salt
const salt = await SecretService.getSecretBlindIndexSalt({
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
type secretsToCreateType = {
@@ -502,15 +492,14 @@ export const createSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext,
secretCommentIV,
secretCommentTag,
- tags,
+ tags
}: secretsToCreateType) => {
let secretBlindIndex;
if (secretName) {
- secretBlindIndex =
- await SecretService.generateSecretBlindIndexWithSalt({
- secretName,
- salt,
- });
+ secretBlindIndex = await SecretService.generateSecretBlindIndexWithSalt({
+ secretName,
+ salt
+ });
}
return {
@@ -532,22 +521,22 @@ export const createSecrets = async (req: Request, res: Response) => {
secretCommentTag,
algorithm: ALGORITHM_AES_256_GCM,
keyEncoding: ENCODING_SCHEME_UTF8,
- tags,
+ tags
};
}
)
);
- const newlyCreatedSecrets: ISecret[] = (
- await Secret.insertMany(secretsToInsert)
- ).map((insertedSecret) => insertedSecret.toObject());
+ const newlyCreatedSecrets: ISecret[] = (await Secret.insertMany(secretsToInsert)).map(
+ (insertedSecret) => insertedSecret.toObject()
+ );
setTimeout(async () => {
// trigger event - push secrets
await EventService.handleEvent({
event: eventPushSecrets({
- workspaceId: new Types.ObjectId(workspaceId),
- }),
+ workspaceId: new Types.ObjectId(workspaceId)
+ })
});
}, 5000);
@@ -567,7 +556,7 @@ export const createSecrets = async (req: Request, res: Response) => {
secretKeyTag,
secretValueCiphertext,
secretValueIV,
- secretValueTag,
+ secretValueTag
}) =>
new SecretVersion({
secret: _id,
@@ -586,9 +575,9 @@ export const createSecrets = async (req: Request, res: Response) => {
secretValueTag,
folder: folderId,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
})
- ),
+ )
});
const addAction = await EELogService.createAction({
@@ -597,7 +586,7 @@ export const createSecrets = async (req: Request, res: Response) => {
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(workspaceId),
- secretIds: newlyCreatedSecrets.map((n) => n._id),
+ secretIds: newlyCreatedSecrets.map((n) => n._id)
});
// (EE) create (audit) log
@@ -609,14 +598,14 @@ export const createSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(workspaceId),
actions: [addAction],
channel,
- ipAddress: req.realIP,
+ ipAddress: req.realIP
}));
// (EE) take a secret snapshot
await EESecretService.takeSecretSnapshot({
workspaceId: new Types.ObjectId(workspaceId),
environment,
- folderId,
+ folderId
});
const postHogClient = await TelemetryService.getPostHogClient();
@@ -624,7 +613,7 @@ export const createSecrets = async (req: Request, res: Response) => {
postHogClient.capture({
event: "secrets added",
distinctId: await TelemetryService.getDistinctId({
- authData: req.authData,
+ authData: req.authData
}),
properties: {
numberOfSecrets: listOfSecretsToCreate.length,
@@ -632,13 +621,13 @@ export const createSecrets = async (req: Request, res: Response) => {
workspaceId,
channel: channel,
folderId,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
return res.status(200).send({
- secrets: newlyCreatedSecrets,
+ secrets: newlyCreatedSecrets
});
};
@@ -696,10 +685,7 @@ export const getSecrets = async (req: Request, res: Response) => {
const environment = req.query.environment as string;
const folders = await Folder.findOne({ workspace: workspaceId, environment });
- if (
- (!folders && folderId && folderId !== "root") ||
- (!folders && secretPath)
- ) {
+ if ((!folders && folderId && folderId !== "root") || (!folders && secretPath)) {
res.send({ secrets: [] });
return;
}
@@ -712,13 +698,15 @@ export const getSecrets = async (req: Request, res: Response) => {
}
if (req.authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = req.authData.authPayload;
+ const isValidScopeAccess = isValidScope(
+ req.authData.authPayload,
+ environment,
+ (secretPath as string) || "/"
+ );
+
// in service token when not giving secretpath folderid must be root
// this is to avoid giving folderid when service tokens are used
- if (
- (!secretPath && folderId !== "root") ||
- (secretPath && secretPath !== serviceTkScopedSecretPath)
- ) {
+ if ((!secretPath && folderId !== "root") || (secretPath && !isValidScopeAccess)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
@@ -738,8 +726,7 @@ export const getSecrets = async (req: Request, res: Response) => {
// query tags table to get all tags ids for the tag names for the given workspace
let tagIds = [];
- const tagNamesList =
- typeof tagSlugs === "string" && tagSlugs !== "" ? tagSlugs.split(",") : [];
+ const tagNamesList = typeof tagSlugs === "string" && tagSlugs !== "" ? tagSlugs.split(",") : [];
if (tagNamesList != undefined && tagNamesList.length != 0) {
const workspaceFromDB = await Tag.find({ workspace: workspaceId });
tagIds = _.map(tagNamesList, (tagName: string) => {
@@ -762,8 +749,7 @@ export const getSecrets = async (req: Request, res: Response) => {
);
if (hasNoAccess) {
throw UnauthorizedRequestError({
- message:
- "You do not have the necessary permission(s) perform this action",
+ message: "You do not have the necessary permission(s) perform this action"
});
}
@@ -773,8 +759,8 @@ export const getSecrets = async (req: Request, res: Response) => {
folder: folderId,
$or: [
{ user: req.user._id }, // personal secrets for this user
- { user: { $exists: false } }, // shared secrets from workspace
- ],
+ { user: { $exists: false } } // shared secrets from workspace
+ ]
};
if (tagIds.length > 0) {
@@ -801,8 +787,8 @@ export const getSecrets = async (req: Request, res: Response) => {
environment,
$or: [
{ user: userId }, // personal secrets for this user
- { user: { $exists: false } }, // shared secrets from workspace
- ],
+ { user: { $exists: false } } // shared secrets from workspace
+ ]
};
if (tagIds.length > 0) {
@@ -820,7 +806,7 @@ export const getSecrets = async (req: Request, res: Response) => {
workspace: workspaceId,
environment,
folder: folderId,
- user: { $exists: false }, // shared secrets only from workspace
+ user: { $exists: false } // shared secrets only from workspace
};
if (tagIds.length > 0) {
@@ -838,7 +824,7 @@ export const getSecrets = async (req: Request, res: Response) => {
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(workspaceId as string),
- secretIds: secrets.map((n: any) => n._id),
+ secretIds: secrets.map((n: any) => n._id)
});
readAction &&
@@ -849,7 +835,7 @@ export const getSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(workspaceId as string),
actions: [readAction],
channel,
- ipAddress: req.realIP,
+ ipAddress: req.realIP
}));
const postHogClient = await TelemetryService.getPostHogClient();
@@ -857,7 +843,7 @@ export const getSecrets = async (req: Request, res: Response) => {
postHogClient.capture({
event: "secrets pulled",
distinctId: await TelemetryService.getDistinctId({
- authData: req.authData,
+ authData: req.authData
}),
properties: {
numberOfSecrets: secrets.length,
@@ -865,13 +851,13 @@ export const getSecrets = async (req: Request, res: Response) => {
workspaceId,
channel,
folderId,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
return res.status(200).send({
- secrets,
+ secrets
});
};
@@ -925,9 +911,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
}
}
*/
- const channel = req.headers?.["user-agent"]?.toLowerCase().includes("mozilla")
- ? "web"
- : "cli";
+ const channel = req.headers?.["user-agent"]?.toLowerCase().includes("mozilla") ? "web" : "cli";
interface PatchSecret {
id: string;
@@ -943,51 +927,47 @@ export const updateSecrets = async (req: Request, res: Response) => {
tags: string[];
}
- const updateOperationsToPerform = req.body.secrets.map(
- (secret: PatchSecret) => {
- const {
- secretKeyCiphertext,
- secretKeyIV,
- secretKeyTag,
- secretValueCiphertext,
- secretValueIV,
- secretValueTag,
- secretCommentCiphertext,
- secretCommentIV,
- secretCommentTag,
- tags,
- } = secret;
+ const updateOperationsToPerform = req.body.secrets.map((secret: PatchSecret) => {
+ const {
+ secretKeyCiphertext,
+ secretKeyIV,
+ secretKeyTag,
+ secretValueCiphertext,
+ secretValueIV,
+ secretValueTag,
+ secretCommentCiphertext,
+ secretCommentIV,
+ secretCommentTag,
+ tags
+ } = secret;
- return {
- updateOne: {
- filter: { _id: new Types.ObjectId(secret.id) },
- update: {
- $inc: {
- version: 1,
- },
- secretKeyCiphertext,
- secretKeyIV,
- secretKeyTag,
- secretValueCiphertext,
- secretValueIV,
- secretValueTag,
- algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
- tags,
- ...(secretCommentCiphertext !== undefined &&
- secretCommentIV &&
- secretCommentTag
- ? {
- secretCommentCiphertext,
- secretCommentIV,
- secretCommentTag,
- }
- : {}),
+ return {
+ updateOne: {
+ filter: { _id: new Types.ObjectId(secret.id) },
+ update: {
+ $inc: {
+ version: 1
},
- },
- };
- }
- );
+ secretKeyCiphertext,
+ secretKeyIV,
+ secretKeyTag,
+ secretValueCiphertext,
+ secretValueIV,
+ secretValueTag,
+ algorithm: ALGORITHM_AES_256_GCM,
+ keyEncoding: ENCODING_SCHEME_UTF8,
+ tags,
+ ...(secretCommentCiphertext !== undefined && secretCommentIV && secretCommentTag
+ ? {
+ secretCommentCiphertext,
+ secretCommentIV,
+ secretCommentTag
+ }
+ : {})
+ }
+ }
+ };
+ });
await Secret.bulkWrite(updateOperationsToPerform);
@@ -1009,7 +989,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext,
secretCommentIV,
secretCommentTag,
- tags,
+ tags
} = secretModificationsBySecretId[secret._id.toString()];
return {
@@ -1018,9 +998,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
workspace: secret.workspace,
type: secret.type,
environment: secret.environment,
- secretKeyCiphertext: secretKeyCiphertext
- ? secretKeyCiphertext
- : secret.secretKeyCiphertext,
+ secretKeyCiphertext: secretKeyCiphertext ? secretKeyCiphertext : secret.secretKeyCiphertext,
secretKeyIV: secretKeyIV ? secretKeyIV : secret.secretKeyIV,
secretKeyTag: secretKeyTag ? secretKeyTag : secret.secretKeyTag,
secretValueCiphertext: secretValueCiphertext
@@ -1031,17 +1009,13 @@ export const updateSecrets = async (req: Request, res: Response) => {
secretCommentCiphertext: secretCommentCiphertext
? secretCommentCiphertext
: secret.secretCommentCiphertext,
- secretCommentIV: secretCommentIV
- ? secretCommentIV
- : secret.secretCommentIV,
- secretCommentTag: secretCommentTag
- ? secretCommentTag
- : secret.secretCommentTag,
+ secretCommentIV: secretCommentIV ? secretCommentIV : secret.secretCommentIV,
+ secretCommentTag: secretCommentTag ? secretCommentTag : secret.secretCommentTag,
tags: tags ? tags : secret.tags,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
};
- }),
+ })
};
await EESecretService.addSecretVersions(secretVersions);
@@ -1062,8 +1036,8 @@ export const updateSecrets = async (req: Request, res: Response) => {
setTimeout(async () => {
await EventService.handleEvent({
event: eventPushSecrets({
- workspaceId: new Types.ObjectId(key),
- }),
+ workspaceId: new Types.ObjectId(key)
+ })
});
}, 10000);
@@ -1073,7 +1047,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(key),
- secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id),
+ secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
});
// (EE) create (audit) log
@@ -1085,7 +1059,7 @@ export const updateSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(key),
actions: [updateAction],
channel,
- ipAddress: req.realIP,
+ ipAddress: req.realIP
}));
// (EE) take a secret snapshot
@@ -1101,15 +1075,15 @@ export const updateSecrets = async (req: Request, res: Response) => {
postHogClient.capture({
event: "secrets modified",
distinctId: await TelemetryService.getDistinctId({
- authData: req.authData,
+ authData: req.authData
}),
properties: {
numberOfSecrets: workspaceSecretObj[key].length,
environment: workspaceSecretObj[key][0].environment,
workspaceId: key,
channel: channel,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
});
@@ -1117,9 +1091,9 @@ export const updateSecrets = async (req: Request, res: Response) => {
return res.status(200).send({
secrets: await Secret.find({
_id: {
- $in: req.secrets.map((secret: ISecret) => secret._id),
- },
- }),
+ $in: req.secrets.map((secret: ISecret) => secret._id)
+ }
+ })
});
};
@@ -1179,12 +1153,12 @@ export const deleteSecrets = async (req: Request, res: Response) => {
await Secret.deleteMany({
_id: {
- $in: toDelete,
- },
+ $in: toDelete
+ }
});
await EESecretService.markDeletedSecretVersions({
- secretIds: toDelete,
+ secretIds: toDelete
});
// group secrets into workspaces so deleted secrets can
@@ -1202,8 +1176,8 @@ export const deleteSecrets = async (req: Request, res: Response) => {
// trigger event - push secrets
await EventService.handleEvent({
event: eventPushSecrets({
- workspaceId: new Types.ObjectId(key),
- }),
+ workspaceId: new Types.ObjectId(key)
+ })
});
const deleteAction = await EELogService.createAction({
name: ACTION_DELETE_SECRETS,
@@ -1211,7 +1185,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
serviceAccountId: req.serviceAccount?._id,
serviceTokenDataId: req.serviceTokenData?._id,
workspaceId: new Types.ObjectId(key),
- secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id),
+ secretIds: workspaceSecretObj[key].map((secret: ISecret) => secret._id)
});
// (EE) create (audit) log
@@ -1223,7 +1197,7 @@ export const deleteSecrets = async (req: Request, res: Response) => {
workspaceId: new Types.ObjectId(key),
actions: [deleteAction],
channel,
- ipAddress: req.realIP,
+ ipAddress: req.realIP
}));
// (EE) take a secret snapshot
@@ -1237,20 +1211,20 @@ export const deleteSecrets = async (req: Request, res: Response) => {
postHogClient.capture({
event: "secrets deleted",
distinctId: await TelemetryService.getDistinctId({
- authData: req.authData,
+ authData: req.authData
}),
properties: {
numberOfSecrets: workspaceSecretObj[key].length,
environment: workspaceSecretObj[key][0].environment,
workspaceId: key,
channel: channel,
- userAgent: req.headers?.["user-agent"],
- },
+ userAgent: req.headers?.["user-agent"]
+ }
});
}
});
return res.status(200).send({
- secrets: req.secrets,
+ secrets: req.secrets
});
};
diff --git a/backend/src/controllers/v2/serviceTokenDataController.ts b/backend/src/controllers/v2/serviceTokenDataController.ts
index 304311da7..d81fb97d6 100644
--- a/backend/src/controllers/v2/serviceTokenDataController.ts
+++ b/backend/src/controllers/v2/serviceTokenDataController.ts
@@ -2,10 +2,7 @@ import { Request, Response } from "express";
import crypto from "crypto";
import bcrypt from "bcrypt";
import { ServiceAccount, ServiceTokenData, User } from "../../models";
-import {
- AUTH_MODE_JWT,
- AUTH_MODE_SERVICE_ACCOUNT,
-} from "../../variables";
+import { AUTH_MODE_JWT, AUTH_MODE_SERVICE_ACCOUNT } from "../../variables";
import { getSaltRounds } from "../../config";
import { BadRequestError } from "../../utils/errors";
import Folder from "../../models/folder";
@@ -46,14 +43,13 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
if (!(req.authData.authPayload instanceof ServiceTokenData))
throw BadRequestError({
- message: "Failed accepted client validation for service token data",
+ message: "Failed accepted client validation for service token data"
});
- const serviceTokenData = await ServiceTokenData.findById(
- req.authData.authPayload._id
- )
+ const serviceTokenData = await ServiceTokenData.findById(req.authData.authPayload._id)
.select("+encryptedKey +iv +tag")
- .populate("user").lean();
+ .populate("user")
+ .lean();
return res.status(200).json(serviceTokenData);
};
@@ -68,29 +64,7 @@ export const getServiceTokenData = async (req: Request, res: Response) => {
export const createServiceTokenData = async (req: Request, res: Response) => {
let serviceTokenData;
- const {
- name,
- workspaceId,
- environment,
- encryptedKey,
- iv,
- tag,
- expiresIn,
- secretPath,
- permissions,
- } = req.body;
-
- const folders = await Folder.findOne({
- workspace: workspaceId,
- environment,
- });
-
- if (folders) {
- const folder = getFolderByPath(folders.nodes, secretPath);
- if (folder == undefined) {
- throw BadRequestError({ message: "Path for service token does not exist" })
- }
- }
+ const { name, workspaceId, encryptedKey, iv, tag, expiresIn, permissions, scopes } = req.body;
const secret = crypto.randomBytes(16).toString("hex");
const secretHash = await bcrypt.hash(secret, await getSaltRounds());
@@ -103,10 +77,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
let user, serviceAccount;
- if (
- req.authData.authMode === AUTH_MODE_JWT &&
- req.authData.authPayload instanceof User
- ) {
+ if (req.authData.authMode === AUTH_MODE_JWT && req.authData.authPayload instanceof User) {
user = req.authData.authPayload._id;
}
@@ -120,17 +91,16 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
serviceTokenData = await new ServiceTokenData({
name,
workspace: workspaceId,
- environment,
user,
serviceAccount,
+ scopes,
lastUsed: new Date(),
expiresAt,
secretHash,
encryptedKey,
iv,
tag,
- secretPath,
- permissions,
+ permissions
}).save();
// return service token data without sensitive data
@@ -142,7 +112,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
return res.status(200).send({
serviceToken,
- serviceTokenData,
+ serviceTokenData
});
};
@@ -155,11 +125,9 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
export const deleteServiceTokenData = async (req: Request, res: Response) => {
const { serviceTokenDataId } = req.params;
- const serviceTokenData = await ServiceTokenData.findByIdAndDelete(
- serviceTokenDataId
- );
+ const serviceTokenData = await ServiceTokenData.findByIdAndDelete(serviceTokenDataId);
return res.status(200).send({
- serviceTokenData,
+ serviceTokenData
});
};
diff --git a/backend/src/controllers/v2/tagController.ts b/backend/src/controllers/v2/tagController.ts
index 2d32a8c2f..0d945c3e5 100644
--- a/backend/src/controllers/v2/tagController.ts
+++ b/backend/src/controllers/v2/tagController.ts
@@ -3,7 +3,6 @@ import { Types } from "mongoose";
import { Membership, Secret } from "../../models";
import Tag from "../../models/tag";
import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
-import { MongoError } from "mongodb";
export const createWorkspaceTag = async (req: Request, res: Response) => {
const { workspaceId } = req.params;
diff --git a/backend/src/ee/services/EELicenseService.ts b/backend/src/ee/services/EELicenseService.ts
index 9e3416583..b4bb97753 100644
--- a/backend/src/ee/services/EELicenseService.ts
+++ b/backend/src/ee/services/EELicenseService.ts
@@ -30,6 +30,8 @@ interface FeatureSet {
customRateLimits: boolean;
customAlerts: boolean;
auditLogs: boolean;
+ status: 'incomplete' | 'incomplete_expired' | 'trialing' | 'active' | 'past_due' | 'canceled' | 'unpaid' | null;
+ trial_end: number | null;
}
/**
@@ -60,6 +62,8 @@ class EELicenseService {
customRateLimits: true,
customAlerts: true,
auditLogs: false,
+ status: null,
+ trial_end: null
}
public localFeatureSet: NodeCache;
diff --git a/backend/src/helpers/organization.ts b/backend/src/helpers/organization.ts
index 2e9189e11..3748f18fe 100644
--- a/backend/src/helpers/organization.ts
+++ b/backend/src/helpers/organization.ts
@@ -45,6 +45,7 @@ export const createOrganization = async ({
name,
customerId
}).save();
+
} else {
organization = await new Organization({
name,
diff --git a/backend/src/helpers/secrets.ts b/backend/src/helpers/secrets.ts
index 51731bb6a..1a68930bc 100644
--- a/backend/src/helpers/secrets.ts
+++ b/backend/src/helpers/secrets.ts
@@ -4,13 +4,14 @@ import {
DeleteSecretParams,
GetSecretParams,
GetSecretsParams,
- UpdateSecretParams,
+ UpdateSecretParams
} from "../interfaces/services/SecretService";
import {
ISecret,
+ IServiceTokenData,
Secret,
SecretBlindIndexData,
- ServiceTokenData,
+ ServiceTokenData
} from "../models";
import { SecretVersion } from "../ee/models";
import {
@@ -18,7 +19,7 @@ import {
InternalServerError,
SecretBlindIndexDataNotFoundError,
SecretNotFoundError,
- UnauthorizedRequestError,
+ UnauthorizedRequestError
} from "../utils/errors";
import {
ACTION_ADD_SECRETS,
@@ -29,51 +30,57 @@ import {
ENCODING_SCHEME_BASE64,
ENCODING_SCHEME_UTF8,
SECRET_PERSONAL,
- SECRET_SHARED,
+ SECRET_SHARED
} from "../variables";
import crypto from "crypto";
import * as argon2 from "argon2";
import {
decryptSymmetric128BitHexKeyUTF8,
- encryptSymmetric128BitHexKeyUTF8,
+ encryptSymmetric128BitHexKeyUTF8
} from "../utils/crypto";
import { TelemetryService } from "../services";
import { client, getEncryptionKey, getRootEncryptionKey } from "../config";
import { EELogService, EESecretService } from "../ee/services";
-import {
- getAuthDataPayloadIdObj,
- getAuthDataPayloadUserObj,
-} from "../utils/auth";
+import { getAuthDataPayloadIdObj, getAuthDataPayloadUserObj } from "../utils/auth";
import { getFolderIdFromServiceToken } from "../services/FolderService";
+import picomatch from "picomatch";
+
+export const isValidScope = (
+ authPayload: IServiceTokenData,
+ environment: string,
+ secretPath: string
+) => {
+ const { scopes: tkScopes } = authPayload;
+ const validScope = tkScopes.find(
+ (scope) =>
+ picomatch.isMatch(secretPath, scope.secretPath, { strictSlashes: false }) &&
+ scope.environment === environment
+ );
+
+ return Boolean(validScope);
+};
/**
* Returns an object containing secret [secret] but with its value, key, comment decrypted.
- *
+ *
* Precondition: the workspace for secret [secret] must have E2EE disabled
* @param {ISecret} secret - secret to repackage to raw
* @param {String} key - symmetric key to use to decrypt secret
- * @returns
+ * @returns
*/
-export const repackageSecretToRaw = ({
- secret,
- key,
-}: {
- secret: ISecret;
- key: string;
-}) => {
-
+export const repackageSecretToRaw = ({ secret, key }: { secret: ISecret; key: string }) => {
const secretKey = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secret.secretKeyCiphertext,
iv: secret.secretKeyIV,
tag: secret.secretKeyTag,
- key,
+ key
});
const secretValue = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secret.secretValueCiphertext,
iv: secret.secretValueIV,
tag: secret.secretValueTag,
- key,
+ key
});
let secretComment = "";
@@ -83,11 +90,11 @@ export const repackageSecretToRaw = ({
ciphertext: secret.secretCommentCiphertext,
iv: secret.secretCommentIV,
tag: secret.secretCommentTag,
- key,
+ key
});
}
- return ({
+ return {
_id: secret._id,
version: secret.version,
workspace: secret.workspace,
@@ -96,9 +103,9 @@ export const repackageSecretToRaw = ({
user: secret.user,
secretKey,
secretValue,
- secretComment,
- });
-}
+ secretComment
+ };
+};
/**
* Create secret blind index data containing encrypted blind index [salt]
@@ -107,7 +114,7 @@ export const repackageSecretToRaw = ({
* @param {Types.ObjectId} obj.workspaceId
*/
export const createSecretBlindIndexDataHelper = async ({
- workspaceId,
+ workspaceId
}: {
workspaceId: Types.ObjectId;
}) => {
@@ -121,7 +128,7 @@ export const createSecretBlindIndexDataHelper = async ({
const {
ciphertext: encryptedSaltCiphertext,
iv: saltIV,
- tag: saltTag,
+ tag: saltTag
} = client.encryptSymmetric(salt, rootEncryptionKey);
return await new SecretBlindIndexData({
@@ -130,16 +137,16 @@ export const createSecretBlindIndexDataHelper = async ({
saltIV,
saltTag,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_BASE64,
+ keyEncoding: ENCODING_SCHEME_BASE64
}).save();
} else {
const {
ciphertext: encryptedSaltCiphertext,
iv: saltIV,
- tag: saltTag,
+ tag: saltTag
} = encryptSymmetric128BitHexKeyUTF8({
plaintext: salt,
- key: encryptionKey,
+ key: encryptionKey
});
return await new SecretBlindIndexData({
@@ -148,7 +155,7 @@ export const createSecretBlindIndexDataHelper = async ({
saltIV,
saltTag,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
}).save();
}
};
@@ -160,7 +167,7 @@ export const createSecretBlindIndexDataHelper = async ({
* @returns
*/
export const getSecretBlindIndexSaltHelper = async ({
- workspaceId,
+ workspaceId
}: {
workspaceId: Types.ObjectId;
}) => {
@@ -168,36 +175,30 @@ export const getSecretBlindIndexSaltHelper = async ({
const rootEncryptionKey = await getRootEncryptionKey();
const secretBlindIndexData = await SecretBlindIndexData.findOne({
- workspace: workspaceId,
+ workspace: workspaceId
}).select("+algorithm +keyEncoding");
if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
- if (
- rootEncryptionKey &&
- secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64
- ) {
+ if (rootEncryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64) {
return client.decryptSymmetric(
secretBlindIndexData.encryptedSaltCiphertext,
rootEncryptionKey,
secretBlindIndexData.saltIV,
secretBlindIndexData.saltTag
);
- } else if (
- encryptionKey &&
- secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8
- ) {
+ } else if (encryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8) {
// decrypt workspace salt
return decryptSymmetric128BitHexKeyUTF8({
ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
iv: secretBlindIndexData.saltIV,
tag: secretBlindIndexData.saltTag,
- key: encryptionKey,
+ key: encryptionKey
});
}
throw InternalServerError({
- message: "Failed to obtain workspace salt needed for secret blind indexing",
+ message: "Failed to obtain workspace salt needed for secret blind indexing"
});
};
@@ -210,7 +211,7 @@ export const getSecretBlindIndexSaltHelper = async ({
*/
export const generateSecretBlindIndexWithSaltHelper = async ({
secretName,
- salt,
+ salt
}: {
secretName: string;
salt: string;
@@ -224,7 +225,7 @@ export const generateSecretBlindIndexWithSaltHelper = async ({
memoryCost: 65536, // default pool of 64 MiB per thread.
hashLength: 32,
parallelism: 1,
- raw: true,
+ raw: true
})
).toString("base64");
@@ -240,7 +241,7 @@ export const generateSecretBlindIndexWithSaltHelper = async ({
*/
export const generateSecretBlindIndexHelper = async ({
secretName,
- workspaceId,
+ workspaceId
}: {
secretName: string;
workspaceId: Types.ObjectId;
@@ -250,16 +251,13 @@ export const generateSecretBlindIndexHelper = async ({
const rootEncryptionKey = await getRootEncryptionKey();
const secretBlindIndexData = await SecretBlindIndexData.findOne({
- workspace: workspaceId,
+ workspace: workspaceId
}).select("+algorithm +keyEncoding");
if (!secretBlindIndexData) throw SecretBlindIndexDataNotFoundError();
let salt;
- if (
- rootEncryptionKey &&
- secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64
- ) {
+ if (rootEncryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_BASE64) {
salt = client.decryptSymmetric(
secretBlindIndexData.encryptedSaltCiphertext,
rootEncryptionKey,
@@ -269,32 +267,29 @@ export const generateSecretBlindIndexHelper = async ({
const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
secretName,
- salt,
+ salt
});
return secretBlindIndex;
- } else if (
- encryptionKey &&
- secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8
- ) {
+ } else if (encryptionKey && secretBlindIndexData.keyEncoding === ENCODING_SCHEME_UTF8) {
// decrypt workspace salt
salt = decryptSymmetric128BitHexKeyUTF8({
ciphertext: secretBlindIndexData.encryptedSaltCiphertext,
iv: secretBlindIndexData.saltIV,
tag: secretBlindIndexData.saltTag,
- key: encryptionKey,
+ key: encryptionKey
});
const secretBlindIndex = await generateSecretBlindIndexWithSaltHelper({
secretName,
- salt,
+ salt
});
return secretBlindIndex;
}
throw InternalServerError({
- message: "Failed to generate secret blind index",
+ message: "Failed to generate secret blind index"
});
};
@@ -323,38 +318,32 @@ export const createSecretHelper = async ({
secretCommentCiphertext,
secretCommentIV,
secretCommentTag,
- secretPath = "/",
+ secretPath = "/"
}: CreateSecretParams) => {
-
const secretBlindIndex = await generateSecretBlindIndexHelper({
secretName,
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
// if using service token filter towards the folderId by secretpath
if (authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = authData.authPayload;
- if (secretPath !== serviceTkScopedSecretPath) {
+ if (!isValidScope(authData.authPayload, environment, secretPath)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
- const folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ const folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
const exists = await Secret.exists({
secretBlindIndex,
workspace: new Types.ObjectId(workspaceId),
folder: folderId,
type,
- ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {}),
+ ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {})
});
if (exists)
throw BadRequestError({
- message: "Failed to create secret that already exists",
+ message: "Failed to create secret that already exists"
});
if (type === SECRET_PERSONAL) {
@@ -365,13 +354,12 @@ export const createSecretHelper = async ({
secretBlindIndex,
folder: folderId,
workspace: new Types.ObjectId(workspaceId),
- type: SECRET_SHARED,
+ type: SECRET_SHARED
});
if (!exists)
throw BadRequestError({
- message:
- "Failed to create personal secret override for no corresponding shared secret",
+ message: "Failed to create personal secret override for no corresponding shared secret"
});
}
@@ -394,7 +382,7 @@ export const createSecretHelper = async ({
secretCommentTag,
folder: folderId,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
}).save();
const secretVersion = new SecretVersion({
@@ -414,12 +402,12 @@ export const createSecretHelper = async ({
secretValueIV,
secretValueTag,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
// (EE) add version for new secret
await EESecretService.addSecretVersions({
- secretVersions: [secretVersion],
+ secretVersions: [secretVersion]
});
// (EE) create (audit) log
@@ -427,7 +415,7 @@ export const createSecretHelper = async ({
name: ACTION_ADD_SECRETS,
...getAuthDataPayloadIdObj(authData),
workspaceId,
- secretIds: [secret._id],
+ secretIds: [secret._id]
});
action &&
@@ -436,14 +424,14 @@ export const createSecretHelper = async ({
workspaceId,
actions: [action],
channel: authData.authChannel,
- ipAddress: authData.authIP,
+ ipAddress: authData.authIP
}));
// (EE) take a secret snapshot
await EESecretService.takeSecretSnapshot({
workspaceId,
environment,
- folderId,
+ folderId
});
const postHogClient = await TelemetryService.getPostHogClient();
@@ -452,7 +440,7 @@ export const createSecretHelper = async ({
postHogClient.capture({
event: "secrets added",
distinctId: await TelemetryService.getDistinctId({
- authData,
+ authData
}),
properties: {
numberOfSecrets: 1,
@@ -460,8 +448,8 @@ export const createSecretHelper = async ({
workspaceId,
folderId,
channel: authData.authChannel,
- userAgent: authData.authUserAgent,
- },
+ userAgent: authData.authUserAgent
+ }
});
}
@@ -480,21 +468,16 @@ export const getSecretsHelper = async ({
workspaceId,
environment,
authData,
- secretPath = "/",
+ secretPath = "/"
}: GetSecretsParams) => {
let secrets: ISecret[] = [];
// if using service token filter towards the folderId by secretpath
if (authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = authData.authPayload;
- if (secretPath !== serviceTkScopedSecretPath) {
+ if (!isValidScope(authData.authPayload, environment, secretPath)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
- const folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ const folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
// get personal secrets first
secrets = await Secret.find({
@@ -502,8 +485,10 @@ export const getSecretsHelper = async ({
environment,
folder: folderId,
type: SECRET_PERSONAL,
- ...getAuthDataPayloadUserObj(authData),
- }).populate("tags").lean();
+ ...getAuthDataPayloadUserObj(authData)
+ })
+ .populate("tags")
+ .lean();
// concat with shared secrets
secrets = secrets.concat(
@@ -513,9 +498,11 @@ export const getSecretsHelper = async ({
folder: folderId,
type: SECRET_SHARED,
secretBlindIndex: {
- $nin: secrets.map((secret) => secret.secretBlindIndex),
- },
- }).populate("tags").lean()
+ $nin: secrets.map((secret) => secret.secretBlindIndex)
+ }
+ })
+ .populate("tags")
+ .lean()
);
// (EE) create (audit) log
@@ -523,7 +510,7 @@ export const getSecretsHelper = async ({
name: ACTION_READ_SECRETS,
...getAuthDataPayloadIdObj(authData),
workspaceId,
- secretIds: secrets.map((secret) => secret._id),
+ secretIds: secrets.map((secret) => secret._id)
});
action &&
@@ -532,7 +519,7 @@ export const getSecretsHelper = async ({
workspaceId,
actions: [action],
channel: authData.authChannel,
- ipAddress: authData.authIP,
+ ipAddress: authData.authIP
}));
const postHogClient = await TelemetryService.getPostHogClient();
@@ -541,7 +528,7 @@ export const getSecretsHelper = async ({
postHogClient.capture({
event: "secrets pulled",
distinctId: await TelemetryService.getDistinctId({
- authData,
+ authData
}),
properties: {
numberOfSecrets: secrets.length,
@@ -549,8 +536,8 @@ export const getSecretsHelper = async ({
workspaceId,
folderId,
channel: authData.authChannel,
- userAgent: authData.authUserAgent,
- },
+ userAgent: authData.authUserAgent
+ }
});
}
@@ -573,25 +560,20 @@ export const getSecretHelper = async ({
environment,
type,
authData,
- secretPath = "/",
+ secretPath = "/"
}: GetSecretParams) => {
const secretBlindIndex = await generateSecretBlindIndexHelper({
secretName,
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
let secret: ISecret | null = null;
// if using service token filter towards the folderId by secretpath
if (authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = authData.authPayload;
- if (secretPath !== serviceTkScopedSecretPath) {
+ if (!isValidScope(authData.authPayload, environment, secretPath)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
- const folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ const folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
// try getting personal secret first (if exists)
secret = await Secret.findOne({
@@ -600,7 +582,7 @@ export const getSecretHelper = async ({
environment,
folder: folderId,
type: type ?? SECRET_PERSONAL,
- ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {}),
+ ...(type === SECRET_PERSONAL ? getAuthDataPayloadUserObj(authData) : {})
}).lean();
if (!secret) {
@@ -611,7 +593,7 @@ export const getSecretHelper = async ({
workspace: new Types.ObjectId(workspaceId),
environment,
folder: folderId,
- type: SECRET_SHARED,
+ type: SECRET_SHARED
}).lean();
}
@@ -622,7 +604,7 @@ export const getSecretHelper = async ({
name: ACTION_READ_SECRETS,
...getAuthDataPayloadIdObj(authData),
workspaceId,
- secretIds: [secret._id],
+ secretIds: [secret._id]
});
action &&
@@ -631,7 +613,7 @@ export const getSecretHelper = async ({
workspaceId,
actions: [action],
channel: authData.authChannel,
- ipAddress: authData.authIP,
+ ipAddress: authData.authIP
}));
const postHogClient = await TelemetryService.getPostHogClient();
@@ -640,7 +622,7 @@ export const getSecretHelper = async ({
postHogClient.capture({
event: "secrets pull",
distinctId: await TelemetryService.getDistinctId({
- authData,
+ authData
}),
properties: {
numberOfSecrets: 1,
@@ -648,8 +630,8 @@ export const getSecretHelper = async ({
workspaceId,
folderId,
channel: authData.authChannel,
- userAgent: authData.authUserAgent,
- },
+ userAgent: authData.authUserAgent
+ }
});
}
@@ -679,26 +661,21 @@ export const updateSecretHelper = async ({
secretValueCiphertext,
secretValueIV,
secretValueTag,
- secretPath,
+ secretPath
}: UpdateSecretParams) => {
const secretBlindIndex = await generateSecretBlindIndexHelper({
secretName,
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
let secret: ISecret | null = null;
// if using service token filter towards the folderId by secretpath
if (authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = authData.authPayload;
- if (secretPath !== serviceTkScopedSecretPath) {
+ if (!isValidScope(authData.authPayload, environment, secretPath)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
- const folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ const folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
if (type === SECRET_SHARED) {
// case: update shared secret
@@ -708,16 +685,16 @@ export const updateSecretHelper = async ({
workspace: new Types.ObjectId(workspaceId),
environment,
folder: folderId,
- type,
+ type
},
{
secretValueCiphertext,
secretValueIV,
secretValueTag,
- $inc: { version: 1 },
+ $inc: { version: 1 }
},
{
- new: true,
+ new: true
}
);
} else {
@@ -730,16 +707,16 @@ export const updateSecretHelper = async ({
environment,
type,
folder: folderId,
- ...getAuthDataPayloadUserObj(authData),
+ ...getAuthDataPayloadUserObj(authData)
},
{
secretValueCiphertext,
secretValueIV,
secretValueTag,
- $inc: { version: 1 },
+ $inc: { version: 1 }
},
{
- new: true,
+ new: true
}
);
}
@@ -763,12 +740,12 @@ export const updateSecretHelper = async ({
secretValueIV,
secretValueTag,
algorithm: ALGORITHM_AES_256_GCM,
- keyEncoding: ENCODING_SCHEME_UTF8,
+ keyEncoding: ENCODING_SCHEME_UTF8
});
// (EE) add version for new secret
await EESecretService.addSecretVersions({
- secretVersions: [secretVersion],
+ secretVersions: [secretVersion]
});
// (EE) create (audit) log
@@ -776,7 +753,7 @@ export const updateSecretHelper = async ({
name: ACTION_UPDATE_SECRETS,
...getAuthDataPayloadIdObj(authData),
workspaceId,
- secretIds: [secret._id],
+ secretIds: [secret._id]
});
action &&
@@ -785,14 +762,14 @@ export const updateSecretHelper = async ({
workspaceId,
actions: [action],
channel: authData.authChannel,
- ipAddress: authData.authIP,
+ ipAddress: authData.authIP
}));
// (EE) take a secret snapshot
await EESecretService.takeSecretSnapshot({
workspaceId,
environment,
- folderId: secret?.folder,
+ folderId: secret?.folder
});
const postHogClient = await TelemetryService.getPostHogClient();
@@ -801,7 +778,7 @@ export const updateSecretHelper = async ({
postHogClient.capture({
event: "secrets modified",
distinctId: await TelemetryService.getDistinctId({
- authData,
+ authData
}),
properties: {
numberOfSecrets: 1,
@@ -809,8 +786,8 @@ export const updateSecretHelper = async ({
workspaceId,
folderId,
channel: authData.authChannel,
- userAgent: authData.authUserAgent,
- },
+ userAgent: authData.authUserAgent
+ }
});
}
@@ -833,26 +810,20 @@ export const deleteSecretHelper = async ({
environment,
type,
authData,
- secretPath = "/",
+ secretPath = "/"
}: DeleteSecretParams) => {
const secretBlindIndex = await generateSecretBlindIndexHelper({
secretName,
- workspaceId: new Types.ObjectId(workspaceId),
+ workspaceId: new Types.ObjectId(workspaceId)
});
// if using service token filter towards the folderId by secretpath
if (authData.authPayload instanceof ServiceTokenData) {
- const { secretPath: serviceTkScopedSecretPath } = authData.authPayload;
-
- if (secretPath !== serviceTkScopedSecretPath) {
+ if (!isValidScope(authData.authPayload, environment, secretPath)) {
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
}
}
- const folderId = await getFolderIdFromServiceToken(
- workspaceId,
- environment,
- secretPath
- );
+ const folderId = await getFolderIdFromServiceToken(workspaceId, environment, secretPath);
let secrets: ISecret[] = [];
let secret: ISecret | null = null;
@@ -862,7 +833,7 @@ export const deleteSecretHelper = async ({
secretBlindIndex,
workspaceId: new Types.ObjectId(workspaceId),
environment,
- folder: folderId,
+ folder: folderId
}).lean();
secret = await Secret.findOneAndDelete({
@@ -870,14 +841,14 @@ export const deleteSecretHelper = async ({
workspaceId: new Types.ObjectId(workspaceId),
environment,
type,
- folder: folderId,
+ folder: folderId
}).lean();
await Secret.deleteMany({
secretBlindIndex,
workspaceId: new Types.ObjectId(workspaceId),
environment,
- folder: folderId,
+ folder: folderId
});
} else {
secret = await Secret.findOneAndDelete({
@@ -886,7 +857,7 @@ export const deleteSecretHelper = async ({
workspaceId: new Types.ObjectId(workspaceId),
environment,
type,
- ...getAuthDataPayloadUserObj(authData),
+ ...getAuthDataPayloadUserObj(authData)
}).lean();
if (secret) {
@@ -897,7 +868,7 @@ export const deleteSecretHelper = async ({
if (!secret) throw SecretNotFoundError();
await EESecretService.markDeletedSecretVersions({
- secretIds: secrets.map((secret) => secret._id),
+ secretIds: secrets.map((secret) => secret._id)
});
// (EE) create (audit) log
@@ -905,22 +876,23 @@ export const deleteSecretHelper = async ({
name: ACTION_DELETE_SECRETS,
...getAuthDataPayloadIdObj(authData),
workspaceId,
- secretIds: secrets.map((secret) => secret._id),
+ secretIds: secrets.map((secret) => secret._id)
});
- action && (await EELogService.createLog({
- ...getAuthDataPayloadIdObj(authData),
- workspaceId,
- actions: [action],
- channel: authData.authChannel,
- ipAddress: authData.authIP,
- }));
+ action &&
+ (await EELogService.createLog({
+ ...getAuthDataPayloadIdObj(authData),
+ workspaceId,
+ actions: [action],
+ channel: authData.authChannel,
+ ipAddress: authData.authIP
+ }));
// (EE) take a secret snapshot
await EESecretService.takeSecretSnapshot({
workspaceId,
environment,
- folderId: secret?.folder,
+ folderId: secret?.folder
});
const postHogClient = await TelemetryService.getPostHogClient();
@@ -929,7 +901,7 @@ export const deleteSecretHelper = async ({
postHogClient.capture({
event: "secrets deleted",
distinctId: await TelemetryService.getDistinctId({
- authData,
+ authData
}),
properties: {
numberOfSecrets: secrets.length,
@@ -937,13 +909,13 @@ export const deleteSecretHelper = async ({
workspaceId,
folderId,
channel: authData.authChannel,
- userAgent: authData.authUserAgent,
- },
+ userAgent: authData.authUserAgent
+ }
});
}
- return ({
+ return {
secrets,
- secret,
- });
+ secret
+ };
};
diff --git a/backend/src/integrations/apps.ts b/backend/src/integrations/apps.ts
index bc8f01a80..b2fec9292 100644
--- a/backend/src/integrations/apps.ts
+++ b/backend/src/integrations/apps.ts
@@ -9,15 +9,17 @@ import {
INTEGRATION_CHECKLY_API_URL,
INTEGRATION_CIRCLECI,
INTEGRATION_CIRCLECI_API_URL,
+ INTEGRATION_CLOUDFLARE_PAGES,
+ INTEGRATION_CLOUDFLARE_PAGES_API_URL,
INTEGRATION_FLYIO,
INTEGRATION_FLYIO_API_URL,
INTEGRATION_GITHUB,
INTEGRATION_GITLAB,
- INTEGRATION_CLOUDFLARE_PAGES,
- INTEGRATION_CLOUDFLARE_PAGES_API_URL,
INTEGRATION_GITLAB_API_URL,
INTEGRATION_HEROKU,
INTEGRATION_HEROKU_API_URL,
+ INTEGRATION_LARAVELFORGE,
+ INTEGRATION_LARAVELFORGE_API_URL,
INTEGRATION_NETLIFY,
INTEGRATION_NETLIFY_API_URL,
INTEGRATION_RAILWAY,
@@ -116,6 +118,12 @@ const getApps = async ({
accessToken,
});
break;
+ case INTEGRATION_LARAVELFORGE:
+ apps = await getAppsLaravelForge({
+ accessToken,
+ serverId: accessId
+ });
+ break;
case INTEGRATION_TRAVISCI:
apps = await getAppsTravisCI({
accessToken,
@@ -398,6 +406,40 @@ const getAppsRailway = async ({ accessToken }: { accessToken: string }) => {
return apps;
};
+/**
+ * Return list of sites for Laravel Forge integration
+ * @param {Object} obj
+ * @param {String} obj.accessToken - access token for Laravel Forge API
+ * @param {String} obj.serverId - server id of Laravel Forge
+ * @returns {Object[]} apps - names and ids of Laravel Forge sites
+ * @returns {String} apps.name - name of Laravel Forge sites
+ * @returns {String} apps.appId - id of Laravel Forge sites
+ */
+const getAppsLaravelForge = async ({
+ accessToken,
+ serverId
+}: {
+ accessToken: string;
+ serverId?: string;
+}) => {
+ const res = (
+ await standardRequest.get(`${INTEGRATION_LARAVELFORGE_API_URL}/api/v1/servers/${serverId}/sites`, {
+ headers: {
+ Authorization: `Bearer ${accessToken}`,
+ Accept: "application/json",
+ "Content-Type": "application/json",
+ },
+ })
+ ).data.sites;
+
+ const apps = res.map((a: any) => ({
+ name: a.name,
+ appId: a.id,
+ }));
+
+ return apps;
+};
+
/**
* Return list of apps for Fly.io integration
* @param {Object} obj
diff --git a/backend/src/integrations/sync.ts b/backend/src/integrations/sync.ts
index 0cc3a9438..5d8efa101 100644
--- a/backend/src/integrations/sync.ts
+++ b/backend/src/integrations/sync.ts
@@ -18,6 +18,8 @@ import {
INTEGRATION_CHECKLY_API_URL,
INTEGRATION_CIRCLECI,
INTEGRATION_CIRCLECI_API_URL,
+ INTEGRATION_CLOUDFLARE_PAGES,
+ INTEGRATION_CLOUDFLARE_PAGES_API_URL,
INTEGRATION_FLYIO,
INTEGRATION_FLYIO_API_URL,
INTEGRATION_GITHUB,
@@ -26,6 +28,8 @@ import {
INTEGRATION_HASHICORP_VAULT,
INTEGRATION_HEROKU,
INTEGRATION_HEROKU_API_URL,
+ INTEGRATION_LARAVELFORGE,
+ INTEGRATION_LARAVELFORGE_API_URL,
INTEGRATION_NETLIFY,
INTEGRATION_NETLIFY_API_URL,
INTEGRATION_RAILWAY,
@@ -34,8 +38,6 @@ import {
INTEGRATION_RENDER_API_URL,
INTEGRATION_SUPABASE,
INTEGRATION_SUPABASE_API_URL,
- INTEGRATION_CLOUDFLARE_PAGES,
- INTEGRATION_CLOUDFLARE_PAGES_API_URL,
INTEGRATION_TRAVISCI,
INTEGRATION_TRAVISCI_API_URL,
INTEGRATION_VERCEL,
@@ -154,6 +156,14 @@ const syncSecrets = async ({
accessToken,
});
break;
+ case INTEGRATION_LARAVELFORGE:
+ await syncSecretsLaravelForge({
+ integration,
+ secrets,
+ accessId,
+ accessToken,
+ });
+ break;
case INTEGRATION_TRAVISCI:
await syncSecretsTravisCI({
integration,
@@ -168,58 +178,30 @@ const syncSecrets = async ({
accessToken,
});
break;
- case INTEGRATION_FLYIO:
- await syncSecretsFlyio({
+ case INTEGRATION_CHECKLY:
+ await syncSecretsCheckly({
+ integration,
+ secrets,
+ accessToken,
+ });
+ break;
+ case INTEGRATION_HASHICORP_VAULT:
+ await syncSecretsHashiCorpVault({
+ integration,
+ integrationAuth,
+ secrets,
+ accessId,
+ accessToken,
+ });
+ break;
+ case INTEGRATION_CLOUDFLARE_PAGES:
+ await syncSecretsCloudflarePages({
integration,
secrets,
- accessToken,
- });
- break;
- case INTEGRATION_CIRCLECI:
- await syncSecretsCircleCI({
- integration,
- secrets,
- accessToken,
- });
- break;
- case INTEGRATION_TRAVISCI:
- await syncSecretsTravisCI({
- integration,
- secrets,
- accessToken,
- });
- break;
- case INTEGRATION_SUPABASE:
- await syncSecretsSupabase({
- integration,
- secrets,
- accessToken,
- });
- break;
- case INTEGRATION_CHECKLY:
- await syncSecretsCheckly({
- integration,
- secrets,
- accessToken,
- });
- break;
- case INTEGRATION_HASHICORP_VAULT:
- await syncSecretsHashiCorpVault({
- integration,
- integrationAuth,
- secrets,
accessId,
- accessToken,
- });
- break;
- case INTEGRATION_CLOUDFLARE_PAGES:
- await syncSecretsCloudflarePages({
- integration,
- secrets,
- accessId,
- accessToken
- });
- break;
+ accessToken
+ });
+ break;
}
};
@@ -1167,6 +1149,48 @@ const syncSecretsRender = async ({
);
};
+/**
+ * Sync/push [secrets] to Laravel Forge sites with id [integration.appId]
+ * @param {Object} obj
+ * @param {IIntegration} obj.integration - integration details
+ * @param {Object} obj.secrets - secrets to push to integration (object where keys are secret keys and values are secret values)
+ * @param {String} obj.accessToken - access token for Laravel Forge integration
+ */
+const syncSecretsLaravelForge = async ({
+ integration,
+ secrets,
+ accessId,
+ accessToken,
+}: {
+ integration: IIntegration;
+ secrets: any;
+ accessId: string | null;
+ accessToken: string;
+}) => {
+
+ function transformObjectToString(obj: any) {
+ let result = "";
+ for (const key in obj) {
+ result += `${key}=${obj[key]}\n`;
+ }
+ return result;
+ }
+
+ await standardRequest.put(
+ `${INTEGRATION_LARAVELFORGE_API_URL}/api/v1/servers/${accessId}/sites/${integration.appId}/env`,
+ {
+ content: transformObjectToString(secrets),
+ },
+ {
+ headers: {
+ Authorization: `Bearer ${accessToken}`,
+ Accept: "application/json",
+ "Content-Type": "application/json",
+ },
+ }
+ );
+};
+
/**
* Sync/push [secrets] to Railway project with id [integration.appId]
* @param {Object} obj
@@ -1874,7 +1898,7 @@ const syncSecretsCloudflarePages = async ({
}
)
)
- .data.result['deployment_configs'][integration.targetEnvironment]['env_vars'];
+ .data.result["deployment_configs"][integration.targetEnvironment]["env_vars"];
// copy the secrets object, so we can set deleted keys to null
const secretsObj: any = {...secrets};
diff --git a/backend/src/middleware/requestErrorHandler.ts b/backend/src/middleware/requestErrorHandler.ts
index dca6a82ba..2869a0f94 100644
--- a/backend/src/middleware/requestErrorHandler.ts
+++ b/backend/src/middleware/requestErrorHandler.ts
@@ -1,6 +1,7 @@
import * as Sentry from "@sentry/node";
import { ErrorRequestHandler } from "express";
-import { InternalServerError } from "../utils/errors";
+import { TokenExpiredError } from "jsonwebtoken";
+import { InternalServerError, UnauthorizedRequestError } from "../utils/errors";
import { getLogger } from "../utils/logger";
import RequestError, { LogLevel } from "../utils/requestError";
import { getNodeEnv } from "../config";
@@ -19,7 +20,9 @@ export const requestErrorHandler: ErrorRequestHandler = async (
}
//TODO: Find better way to type check for error. In current setting you need to cast type to get the functions and variables from RequestError
- if (!(error instanceof RequestError)) {
+ if (error instanceof TokenExpiredError) {
+ error = UnauthorizedRequestError({ stack: error.stack, message: "Token expired" });
+ } else if (!(error instanceof RequestError)) {
error = InternalServerError({
context: { exception: error.message },
stack: error.stack,
diff --git a/backend/src/models/integration.ts b/backend/src/models/integration.ts
index d94cc9faa..c4021977d 100644
--- a/backend/src/models/integration.ts
+++ b/backend/src/models/integration.ts
@@ -5,16 +5,17 @@ import {
INTEGRATION_AZURE_KEY_VAULT,
INTEGRATION_CHECKLY,
INTEGRATION_CIRCLECI,
+ INTEGRATION_CLOUDFLARE_PAGES,
INTEGRATION_FLYIO,
INTEGRATION_GITHUB,
INTEGRATION_GITLAB,
INTEGRATION_HASHICORP_VAULT,
INTEGRATION_HEROKU,
+ INTEGRATION_LARAVELFORGE,
INTEGRATION_NETLIFY,
INTEGRATION_RAILWAY,
INTEGRATION_RENDER,
INTEGRATION_SUPABASE,
- INTEGRATION_CLOUDFLARE_PAGES,
INTEGRATION_TRAVISCI,
INTEGRATION_VERCEL,
} from "../variables";
@@ -48,6 +49,7 @@ export interface IIntegration {
| "railway"
| "flyio"
| "circleci"
+ | "laravel-forge"
| "travisci"
| "supabase"
| "checkly"
@@ -136,6 +138,7 @@ const integrationSchema = new Schema+ {`Currently trialing the ${formatPlanSlug(subscription.slug)} plan until ${formatDate(subscription.trial_end).formattedDate} - ${formatDate(subscription.trial_end).remainingDays} day(s) left. `} + Add a card to avoid being downgraded to the Starter plan afterward → +
+Current plan
-- {formatPlanSlug(subscription.slug)} +
+ {`${formatPlanSlug(subscription.slug)} ${subscription.status === "trialing" ? "(Trial)" : ""}`}