From ec39f84719598e86f59e64393472345eb4b68e8a Mon Sep 17 00:00:00 2001 From: Sheen Capadngan Date: Wed, 3 Sep 2025 21:18:34 +0800 Subject: [PATCH] misc: addressed greptile comments 1 --- backend/src/ee/routes/v1/proxy-router.ts | 13 ++++++++++++- backend/src/ee/services/proxy/proxy-fns.ts | 4 +++- backend/src/ee/services/proxy/proxy-service.ts | 6 +++--- backend/src/lib/gateway-v2/gateway-v2.ts | 8 +++++--- backend/src/server/plugins/auth/inject-identity.ts | 3 ++- .../hc-vault/hc-vault-connection-fns.ts | 5 ++++- frontend/src/hooks/api/gateways/queries.tsx | 6 ++++-- 7 files changed, 33 insertions(+), 12 deletions(-) diff --git a/backend/src/ee/routes/v1/proxy-router.ts b/backend/src/ee/routes/v1/proxy-router.ts index e837eb624..d7742baa7 100644 --- a/backend/src/ee/routes/v1/proxy-router.ts +++ b/backend/src/ee/routes/v1/proxy-router.ts @@ -65,7 +65,18 @@ export const registerProxyRouter = async (server: FastifyZodProvider) => { name: z.string() }), response: { - 200: z.any() + 200: z.object({ + pki: z.object({ + serverCertificate: z.string(), + serverPrivateKey: z.string(), + clientCertificateChain: z.string() + }), + ssh: z.object({ + serverCertificate: z.string(), + serverPrivateKey: z.string(), + clientCAPublicKey: z.string() + }) + }) } }, onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]), diff --git a/backend/src/ee/services/proxy/proxy-fns.ts b/backend/src/ee/services/proxy/proxy-fns.ts index 588a7b2ba..58ad60832 100644 --- a/backend/src/ee/services/proxy/proxy-fns.ts +++ b/backend/src/ee/services/proxy/proxy-fns.ts @@ -1,3 +1,5 @@ +export const INSTANCE_PROXY_PREFIX = "infisical-"; + export const isInstanceProxy = (proxyName: string) => { - return proxyName.startsWith("infisical-"); + return proxyName.startsWith(INSTANCE_PROXY_PREFIX); }; diff --git a/backend/src/ee/services/proxy/proxy-service.ts b/backend/src/ee/services/proxy/proxy-service.ts index 37b9ab7e3..ae6ae3383 100644 --- a/backend/src/ee/services/proxy/proxy-service.ts +++ b/backend/src/ee/services/proxy/proxy-service.ts @@ -405,7 +405,7 @@ export const proxyServiceFactory = ({ format: "der", type: "pkcs8" }); - const orgProxyClientCaPrivateKey = await crypto.nativeCrypto.subtle.importKey( + const orgProxyCaPrivateKey = await crypto.nativeCrypto.subtle.importKey( "pkcs8", orgProxyCaSkObj.export({ format: "der", type: "pkcs8" }), alg, @@ -425,7 +425,7 @@ export const proxyServiceFactory = ({ issuer: orgProxyCaCert.subject, notBefore: orgProxyClientCaIssuedAt, notAfter: orgProxyClientCaExpiration, - signingKey: orgProxyClientCaPrivateKey, + signingKey: orgProxyCaPrivateKey, publicKey: orgProxyClientCaKeys.publicKey, signingAlgorithm: alg, extensions: [ @@ -460,7 +460,7 @@ export const proxyServiceFactory = ({ issuer: orgProxyCaCert.subject, notBefore: orgProxyServerCaIssuedAt, notAfter: orgProxyServerCaExpiration, - signingKey: orgProxyClientCaPrivateKey, + signingKey: orgProxyCaPrivateKey, publicKey: orgProxyServerCaKeys.publicKey, signingAlgorithm: alg, extensions: [ diff --git a/backend/src/lib/gateway-v2/gateway-v2.ts b/backend/src/lib/gateway-v2/gateway-v2.ts index beb76e582..c29cfe272 100644 --- a/backend/src/lib/gateway-v2/gateway-v2.ts +++ b/backend/src/lib/gateway-v2/gateway-v2.ts @@ -3,6 +3,7 @@ import tls from "node:tls"; import https from "https"; +import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns"; import { splitPemChain } from "@app/services/certificate/certificate-fns"; import { BadRequestError } from "../errors"; @@ -27,12 +28,13 @@ const createProxyConnection = async ({ clientPrivateKey: string; serverCertificateChain: string; }): Promise => { - const [host, portStr] = proxyIp.split(":"); - const port = parseInt(portStr, 10) || 443; + const [targetHost] = await verifyHostInputValidity(proxyIp); + const [, portStr] = proxyIp.split(":"); + const port = parseInt(portStr, 10) || 8443; const serverCAs = splitPemChain(serverCertificateChain); const tlsOptions: tls.ConnectionOptions = { - host, + host: targetHost, port, cert: clientCertificate, key: clientPrivateKey, diff --git a/backend/src/server/plugins/auth/inject-identity.ts b/backend/src/server/plugins/auth/inject-identity.ts index 0d0926d35..0126a4129 100644 --- a/backend/src/server/plugins/auth/inject-identity.ts +++ b/backend/src/server/plugins/auth/inject-identity.ts @@ -121,7 +121,8 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => { return; } - if (req.url.includes("/api/v1/proxies/register-instance-proxy")) { + // Authentication is handled on a route-level + if (req.url === "/api/v1/proxies/register-instance-proxy") { return; } diff --git a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts index 46a59bcec..3a79e2f8e 100644 --- a/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts +++ b/backend/src/services/app-connection/hc-vault/hc-vault-connection-fns.ts @@ -3,6 +3,7 @@ import https from "https"; import { verifyHostInputValidity } from "@app/ee/services/dynamic-secret/dynamic-secret-fns"; import { TGatewayServiceFactory } from "@app/ee/services/gateway/gateway-service"; +import { TGatewayV2ServiceFactory } from "@app/ee/services/gateway-v2/gateway-v2-service"; import { request } from "@app/lib/config/request"; import { BadRequestError } from "@app/lib/errors"; import { removeTrailingSlash } from "@app/lib/fn"; @@ -144,7 +145,9 @@ export const getHCVaultAccessToken = async ( export const validateHCVaultConnectionCredentials = async ( connection: THCVaultConnection, - gatewayService: Pick + gatewayService: Pick, + // eslint-disable-next-line @typescript-eslint/no-unused-vars + _gatewayV2Service: Pick ) => { const instanceUrl = await getHCVaultInstanceUrl(connection); diff --git a/frontend/src/hooks/api/gateways/queries.tsx b/frontend/src/hooks/api/gateways/queries.tsx index 43d3aae87..ef4dafb75 100644 --- a/frontend/src/hooks/api/gateways/queries.tsx +++ b/frontend/src/hooks/api/gateways/queries.tsx @@ -12,8 +12,10 @@ export const gatewaysQueryKeys = { queryOptions({ queryKey: gatewaysQueryKeys.listKey(), queryFn: async () => { - const { data } = await apiRequest.get<{ gateways: TGateway[] }>("/api/v1/gateways"); - const { data: dataV2 } = await apiRequest.get("/api/v2/gateways"); + const [{ data }, { data: dataV2 }] = await Promise.all([ + apiRequest.get<{ gateways: TGateway[] }>("/api/v1/gateways"), + apiRequest.get("/api/v2/gateways") + ]); return [ ...data.gateways.map((g) => ({