awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3830 from Infisical/revert-cli-refresh

Browse Source 
Revert CLI refresh PR
This commit is contained in:
Maidul Islam
2025-06-19 20:58:11 -04:00
committed by GitHub
parent f291aa1c01 f167ba0fb8
commit ec3cbb9460
19 changed files with 60 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/lib/config/env.ts
View File

@@ -101,9 +101,9 @@ const envSchema = z
LOOPS_API_KEY: zpStr(z.string().optional()),
// jwt options
AUTH_SECRET: zpStr(z.string()).default(process.env.JWT_AUTH_SECRET), // for those still using old JWT_AUTH_SECRET
JWT_AUTH_LIFETIME: zpStr(z.string().default("1d")),
JWT_AUTH_LIFETIME: zpStr(z.string().default("10d")),
JWT_SIGNUP_LIFETIME: zpStr(z.string().default("15m")),
JWT_REFRESH_LIFETIME: zpStr(z.string().default("14d")),
JWT_REFRESH_LIFETIME: zpStr(z.string().default("90d")),
JWT_INVITE_LIFETIME: zpStr(z.string().default("1d")),
JWT_MFA_LIFETIME: zpStr(z.string().default("5m")),
JWT_PROVIDER_AUTH_LIFETIME: zpStr(z.string().default("15m")),

2
backend/src/server/plugins/auth/inject-identity.ts
View File

@@ -107,7 +107,7 @@ export const injectIdentity = fp(async (server: FastifyZodProvider) => {
server.addHook("onRequest", async (req) => {
const appCfg = getConfig();
if (req.url.includes(".well-known/est") || req.url.includes("/api/v3/auth/") || req.url === "/api/v1/auth/token") {
if (req.url.includes(".well-known/est") || req.url.includes("/api/v3/auth/")) {
return;
}

11
backend/src/server/routes/v3/login-router.ts
View File

@@ -50,8 +50,7 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
200: z.object({
token: z.string(),
isMfaEnabled: z.boolean(),
mfaMethod: z.string().optional(),
RefreshToken: z.string().optional()
mfaMethod: z.string().optional()
})
}
},
@@ -102,7 +101,7 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
maxAge: 0
});
return { token: tokens.access, isMfaEnabled: false, RefreshToken: tokens.refresh };
return { token: tokens.access, isMfaEnabled: false };
}
});
@@ -130,8 +129,7 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
encryptedPrivateKey: z.string(),
iv: z.string(),
tag: z.string(),
token: z.string(),
RefreshToken: z.string().optional()
token: z.string()
})
}
},
@@ -174,8 +172,7 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
tag: data.user.tag,
protectedKey: data.user.protectedKey || null,
protectedKeyIV: data.user.protectedKeyIV || null,
protectedKeyTag: data.user.protectedKeyTag || null,
RefreshToken: data.token.refresh
protectedKeyTag: data.user.protectedKeyTag || null
} as const;
}
});

2
cli/packages/api/model.go
View File

@@ -21,7 +21,7 @@ type LoginTwoRequest struct {
}
type LoginTwoResponse struct {
JWTToken string `json:"token"`
JTWToken string `json:"token"`
RefreshToken string `json:"refreshToken"`
PublicKey string `json:"publicKey"`
EncryptedPrivateKey string `json:"encryptedPrivateKey"`

10
cli/packages/cmd/dynamic_secrets.go
View File

@@ -87,7 +87,7 @@ func getDynamicSecretList(cmd *cobra.Command, args []string) {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
httpClient.SetAuthToken(infisicalToken)
@@ -211,7 +211,7 @@ func createDynamicSecretLeaseByName(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
httpClient.SetAuthToken(infisicalToken)
@@ -363,7 +363,7 @@ func renewDynamicSecretLeaseByName(cmd *cobra.Command, args []string) {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
httpClient.SetAuthToken(infisicalToken)
@@ -478,7 +478,7 @@ func revokeDynamicSecretLeaseByName(cmd *cobra.Command, args []string) {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
httpClient.SetAuthToken(infisicalToken)
@@ -592,7 +592,7 @@ func listDynamicSecretLeaseByName(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
httpClient.SetAuthToken(infisicalToken)

2
cli/packages/cmd/export.go
View File

@@ -115,7 +115,7 @@ var exportCmd = &cobra.Command{
if err != nil {
util.HandleError(err)
}
accessToken = loggedInUserDetails.UserCredentials.JWTToken
accessToken = loggedInUserDetails.UserCredentials.JTWToken
}
processedTemplate, err := ProcessTemplate(1, templatePath, nil, accessToken, "", &newEtag, dynamicSecretLeases)

4
cli/packages/cmd/init.go
View File

@@ -53,7 +53,7 @@ var initCmd = &cobra.Command{
if err != nil {
util.HandleError(err, "Unable to get resty client with custom headers")
}
httpClient.SetAuthToken(userCreds.UserCredentials.JWTToken)
httpClient.SetAuthToken(userCreds.UserCredentials.JTWToken)
organizationResponse, err := api.CallGetAllOrganizations(httpClient)
if err != nil {
@@ -124,7 +124,7 @@ var initCmd = &cobra.Command{
}
// set the config jwt token to the new token
userCreds.UserCredentials.JWTToken = tokenResponse.Token
userCreds.UserCredentials.JTWToken = tokenResponse.Token
err = util.StoreUserCredsInKeyRing(&userCreds.UserCredentials)
httpClient.SetAuthToken(tokenResponse.Token)

9
cli/packages/cmd/login.go
View File

@@ -111,7 +111,7 @@ var loginCmd = &cobra.Command{
infisicalClient := infisicalSdk.NewInfisicalClient(context.Background(), infisicalSdk.Config{
SiteUrl: config.INFISICAL_URL,
UserAgent: api.USER_AGENT,
AutoTokenRefresh: true,
AutoTokenRefresh: false,
CustomHeaders: customHeaders,
})
@@ -437,8 +437,7 @@ func cliDefaultLogin(userCredentialsToBeStored *models.UserCredentials) {
//updating usercredentials
userCredentialsToBeStored.Email = email
userCredentialsToBeStored.PrivateKey = string(decryptedPrivateKey)
userCredentialsToBeStored.JWTToken = newJwtToken
userCredentialsToBeStored.RefreshToken = loginTwoResponse.RefreshToken
userCredentialsToBeStored.JTWToken = newJwtToken
}
func init() {
@@ -863,7 +862,7 @@ func askToPasteJwtToken(success chan models.UserCredentials, failure chan error)
os.Exit(1)
}
// verify JWT
// verify JTW
httpClient, err := util.GetRestyClientWithCustomHeaders()
if err != nil {
failure <- err
@@ -872,7 +871,7 @@ func askToPasteJwtToken(success chan models.UserCredentials, failure chan error)
}
httpClient.
SetAuthToken(userCredentials.JWTToken).
SetAuthToken(userCredentials.JTWToken).
SetHeader("Accept", "application/json")
isAuthenticated := api.CallIsAuthenticated(httpClient)

4
cli/packages/cmd/secrets.go
View File

@@ -245,7 +245,7 @@ var secretsSetCmd = &cobra.Command{
secretOperations, err = util.SetRawSecrets(processedArgs, secretType, environmentName, secretsPath, projectId, &models.TokenDetails{
Type: "",
Token: loggedInUserDetails.UserCredentials.JWTToken,
Token: loggedInUserDetails.UserCredentials.JTWToken,
}, file)
}
@@ -330,7 +330,7 @@ var secretsDeleteCmd = &cobra.Command{
loggedInUserDetails = util.EstablishUserLoginSession()
}
httpClient.SetAuthToken(loggedInUserDetails.UserCredentials.JWTToken)
httpClient.SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken)
}
for _, secretName := range args {

8
cli/packages/cmd/ssh.go
View File

@@ -186,7 +186,7 @@ func issueCredentials(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
certificateTemplateId, err := cmd.Flags().GetString("certificateTemplateId")
@@ -419,7 +419,7 @@ func signKey(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
certificateTemplateId, err := cmd.Flags().GetString("certificateTemplateId")
@@ -628,7 +628,7 @@ func sshConnect(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
writeHostCaToFile, err := cmd.Flags().GetBool("write-host-ca-to-file")
@@ -881,7 +881,7 @@ func sshAddHost(cmd *cobra.Command, args []string) {
if loggedInUserDetails.LoginExpired {
loggedInUserDetails = util.EstablishUserLoginSession()
}
infisicalToken = loggedInUserDetails.UserCredentials.JWTToken
infisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
projectId, err := cmd.Flags().GetString("projectId")

4
cli/packages/cmd/tokens.go
View File

@@ -115,7 +115,7 @@ var tokensCreateCmd = &cobra.Command{
}
}
workspaceKey, err := util.GetPlainTextWorkspaceKey(loggedInUserDetails.UserCredentials.JWTToken, loggedInUserDetails.UserCredentials.PrivateKey, workspaceId)
workspaceKey, err := util.GetPlainTextWorkspaceKey(loggedInUserDetails.UserCredentials.JTWToken, loggedInUserDetails.UserCredentials.PrivateKey, workspaceId)
if err != nil {
util.HandleError(err, "Unable to get workspace key needed to create service token")
}
@@ -140,7 +140,7 @@ var tokensCreateCmd = &cobra.Command{
util.HandleError(err, "Unable to get resty client with custom headers")
}
httpClient.SetAuthToken(loggedInUserDetails.UserCredentials.JWTToken).
httpClient.SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken).
SetHeader("Accept", "application/json")
createServiceTokenResponse, err := api.CallCreateServiceToken(httpClient, api.CreateServiceTokenRequest{

4
cli/packages/cmd/user.go
View File

@@ -118,7 +118,7 @@ var userGetTokenCmd = &cobra.Command{
util.HandleError(err, "[infisical user get token]: Unable to get logged in user token")
}
tokenParts := strings.Split(loggedInUserDetails.UserCredentials.JWTToken, ".")
tokenParts := strings.Split(loggedInUserDetails.UserCredentials.JTWToken, ".")
if len(tokenParts) != 3 {
util.HandleError(errors.New("invalid token format"), "[infisical user get token]: Invalid token format")
}
@@ -136,7 +136,7 @@ var userGetTokenCmd = &cobra.Command{
}
fmt.Println("Session ID:", tokenPayload.TokenVersionId)
fmt.Println("Token:", loggedInUserDetails.UserCredentials.JWTToken)
fmt.Println("Token:", loggedInUserDetails.UserCredentials.JTWToken)
},
}

2
cli/packages/models/cli.go
View File

@@ -5,7 +5,7 @@ import "time"
type UserCredentials struct {
Email string `json:"email"`
PrivateKey string `json:"privateKey"`
JWTToken string `json:"JTWToken"`
JTWToken string `json:"JTWToken"`
RefreshToken string `json:"RefreshToken"`
}

26
cli/packages/util/credentials.go
View File

@@ -9,7 +9,6 @@ import (
"github.com/Infisical/infisical-merge/packages/api"
"github.com/Infisical/infisical-merge/packages/config"
"github.com/Infisical/infisical-merge/packages/models"
"github.com/rs/zerolog/log"
"github.com/zalando/go-keyring"
)
@@ -91,22 +90,23 @@ func GetCurrentLoggedInUserDetails(setConfigVariables bool) (LoggedInUserDetails
}
httpClient.
SetAuthToken(userCreds.JWTToken).
SetAuthToken(userCreds.JTWToken).
SetHeader("Accept", "application/json")
isAuthenticated := api.CallIsAuthenticated(httpClient)
if !isAuthenticated {
accessTokenResponse, refreshErr := api.CallGetNewAccessTokenWithRefreshToken(httpClient, userCreds.RefreshToken)
if refreshErr == nil && accessTokenResponse.Token != "" {
isAuthenticated = true
userCreds.JWTToken = accessTokenResponse.Token
}
}
// TODO: add refresh token
// if !isAuthenticated {
// accessTokenResponse, err := api.CallGetNewAccessTokenWithRefreshToken(httpClient, userCreds.RefreshToken)
// if err == nil && accessTokenResponse.Token != "" {
// isAuthenticated = true
// userCreds.JTWToken = accessTokenResponse.Token
// }
// }
err = StoreUserCredsInKeyRing(&userCreds)
if err != nil {
log.Debug().Msg("unable to store your user credentials with new access token")
}
// err = StoreUserCredsInKeyRing(&userCreds)
// if err != nil {
// log.Debug().Msg("unable to store your user credentials with new access token")
// }
if !isAuthenticated {
return LoggedInUserDetails{

10
cli/packages/util/folders.go
View File

@@ -35,7 +35,7 @@ func GetAllFolders(params models.GetAllFoldersParameters) ([]models.SingleFolder
params.WorkspaceId = workspaceFile.WorkspaceId
}
folders, err := GetFoldersViaJWT(loggedInUserDetails.UserCredentials.JWTToken, params.WorkspaceId, params.Environment, params.FoldersPath)
folders, err := GetFoldersViaJTW(loggedInUserDetails.UserCredentials.JTWToken, params.WorkspaceId, params.Environment, params.FoldersPath)
folderErr = err
foldersToReturn = folders
} else if params.InfisicalToken != "" {
@@ -60,14 +60,14 @@ func GetAllFolders(params models.GetAllFoldersParameters) ([]models.SingleFolder
return foldersToReturn, folderErr
}
func GetFoldersViaJWT(JWTToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
func GetFoldersViaJTW(JTWToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
// set up resty client
httpClient, err := GetRestyClientWithCustomHeaders()
if err != nil {
return nil, err
}
httpClient.SetAuthToken(JWTToken).
httpClient.SetAuthToken(JTWToken).
SetHeader("Accept", "application/json")
getFoldersRequest := api.GetFoldersV1Request{
@@ -194,7 +194,7 @@ func CreateFolder(params models.CreateFolderParameters) (models.SingleFolder, er
loggedInUserDetails = EstablishUserLoginSession()
}
params.InfisicalToken = loggedInUserDetails.UserCredentials.JWTToken
params.InfisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
// set up resty client
@@ -243,7 +243,7 @@ func DeleteFolder(params models.DeleteFolderParameters) ([]models.SingleFolder,
loggedInUserDetails = EstablishUserLoginSession()
}
params.InfisicalToken = loggedInUserDetails.UserCredentials.JWTToken
params.InfisicalToken = loggedInUserDetails.UserCredentials.JTWToken
}
// set up resty client

4
cli/packages/util/secrets.go
View File

@@ -302,9 +302,9 @@ func GetAllEnvironmentVariables(params models.GetAllSecretsParameters, projectCo
params.WorkspaceId = infisicalDotJson.WorkspaceId
}
res, err := GetPlainTextSecretsV3(loggedInUserDetails.UserCredentials.JWTToken, params.WorkspaceId,
res, err := GetPlainTextSecretsV3(loggedInUserDetails.UserCredentials.JTWToken, params.WorkspaceId,
params.Environment, params.SecretsPath, params.IncludeImport, params.Recursive, params.TagSlugs, true)
log.Debug().Msgf("GetAllEnvironmentVariables: Trying to fetch secrets JWT token [err=%s]", err)
log.Debug().Msgf("GetAllEnvironmentVariables: Trying to fetch secrets JTW token [err=%s]", err)
if err == nil {
backupEncryptionKey, err := GetBackupEncryptionKey()

1
frontend/src/hooks/api/auth/queries.tsx
View File

@@ -73,7 +73,6 @@ export const selectOrganization = async (data: {
}) => {
const { data: res } = await apiRequest.post<{
token: string;
RefreshToken: string;
isMfaEnabled: boolean;
mfaMethod?: MfaMethod;
}>("/api/v3/auth/select-organization", data);

16
frontend/src/pages/auth/LoginPage/components/PasswordStep/PasswordStep.tsx
View File

@@ -76,9 +76,7 @@ export const PasswordStep = ({
// case: organization ID is present from the provider auth token -- select the org and use the new jwt token in the CLI, then navigate to the org
if (organizationId) {
const finishWithOrgWorkflow = async () => {
const { token, isMfaEnabled, mfaMethod, RefreshToken } = await selectOrganization({
organizationId
});
const { token, isMfaEnabled, mfaMethod } = await selectOrganization({ organizationId });
if (isMfaEnabled) {
SecurityClient.setMfaToken(token);
@@ -96,11 +94,10 @@ export const PasswordStep = ({
const payload = {
privateKey,
email,
JTWToken: token,
RefreshToken
JTWToken: token
};
await instance.post(cliUrl, payload).catch(() => {
// if error happens to communicate we set the token with an expiry in session storage
// if error happens to communicate we set the token with an expiry in sessino storage
// the cli-redirect page has logic to show this to user and ask them to paste it in terminal
sessionStorage.setItem(
SessionStorageKeys.CLI_TERMINAL_TOKEN,
@@ -190,7 +187,7 @@ export const PasswordStep = ({
// case: organization ID is present from the provider auth token -- select the org and use the new jwt token in the CLI, then navigate to the org
if (organizationId) {
const finishWithOrgWorkflow = async () => {
const { token, isMfaEnabled, mfaMethod, RefreshToken } = await selectOrganization({
const { token, isMfaEnabled, mfaMethod } = await selectOrganization({
organizationId
});
@@ -209,11 +206,10 @@ export const PasswordStep = ({
const instance = axios.create();
const payload = {
...isCliLoginSuccessful.loginResponse,
JTWToken: token,
RefreshToken
JTWToken: token
};
await instance.post(cliUrl, payload).catch(() => {
// if error happens to communicate we set the token with an expiry in session storage
// if error happens to communicate we set the token with an expiry in sessino storage
// the cli-redirect page has logic to show this to user and ask them to paste it in terminal
sessionStorage.setItem(
SessionStorageKeys.CLI_TERMINAL_TOKEN,

7
frontend/src/pages/auth/SelectOrgPage/SelectOrgSection.tsx
View File

@@ -112,7 +112,7 @@ export const SelectOrganizationSection = () => {
return;
}
const { token, isMfaEnabled, mfaMethod, RefreshToken } = await selectOrg
const { token, isMfaEnabled, mfaMethod } = await selectOrg
.mutateAsync({
organizationId: organization.id,
userAgent: callbackPort ? UserAgentType.CLI : undefined
@@ -151,14 +151,13 @@ export const SelectOrganizationSection = () => {
const payload = {
JTWToken: token,
email: user?.email,
privateKey,
RefreshToken
privateKey
} as IsCliLoginSuccessful["loginResponse"];
// send request to server endpoint
const instance = axios.create();
await instance.post(`http://127.0.0.1:${callbackPort}/`, payload).catch(() => {
// if error happens to communicate we set the token with an expiry in session storage
// if error happens to communicate we set the token with an expiry in sessino storage
// the cli-redirect page has logic to show this to user and ask them to paste it in terminal
sessionStorage.setItem(
SessionStorageKeys.CLI_TERMINAL_TOKEN,