awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add case for MI token renewal

Browse Source
This commit is contained in:
Tuan Dang
2023-12-07 00:29:08 +07:00
parent 69b57817d6
commit ec5cf97f18
2 changed files with 28 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
backend/src/ee/controllers/v1/machineIdentitiesController.ts
View File

@@ -481,29 +481,47 @@ export const renewAccessToken = async (req: Request, res: Response) => {
message: "Failed to renew non-renewable access token" message: "Failed to renew non-renewable access token"
}); });
// ttl check
if (accessTokenTTL > 0) { if (accessTokenTTL > 0) {
const currentDate = new Date(); const currentDate = new Date();
if (accessTokenLastRenewedAt) { if (accessTokenLastRenewedAt) {
// access token has been renewed // access token has been renewed
const accessTokenRenewed = new Date(accessTokenLastRenewedAt); const accessTokenRenewed = new Date(accessTokenLastRenewedAt);
const ttlInMilliseconds = accessTokenTTL * 1000; const ttlInMilliseconds = accessTokenTTL * 1000;
const expirationTime = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds); const expirationDate = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds);
if (currentDate > expirationTime) throw UnauthorizedRequestError({ if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to renew MI access token due to TTL expiration" message: "Failed to renew MI access token due to TTL expiration"
}); });
} else { } else {
// access token has never been renewed // access token has never been renewed
const accessTokenCreated = new Date(accessTokenCreatedAt); const accessTokenCreated = new Date(accessTokenCreatedAt);
const ttlInMilliseconds = accessTokenTTL * 1000; const ttlInMilliseconds = accessTokenTTL * 1000;
const expirationTime = new Date(accessTokenCreated.getTime() + ttlInMilliseconds); const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
if (currentDate > expirationTime) throw UnauthorizedRequestError({ if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to renew MI access token due to TTL expiration" message: "Failed to renew MI access token due to TTL expiration"
}); });
} }
} }
// max ttl checks
if (accessTokenMaxTTL > 0) {
const accessTokenCreated = new Date(accessTokenCreatedAt);
const ttlInMilliseconds = accessTokenMaxTTL * 1000;
const currentDate = new Date();
const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to renew MI access token due to Max TTL expiration"
});
const extendToDate = new Date(currentDate.getTime() + accessTokenTTL);
if (extendToDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to renew MI access token past its Max TTL expiration"
});
}
await IdentityAccessToken.findByIdAndUpdate( await IdentityAccessToken.findByIdAndUpdate(
machineIdentityAccessToken._id, machineIdentityAccessToken._id,
{ {

12
backend/src/utils/authn/authModeValidators/machineIdentity.ts
View File

@@ -45,18 +45,18 @@ export const validateMachineIdentity = async ({
// access token has been renewed // access token has been renewed
const accessTokenRenewed = new Date(accessTokenLastRenewedAt); const accessTokenRenewed = new Date(accessTokenLastRenewedAt);
const ttlInMilliseconds = accessTokenTTL * 1000; const ttlInMilliseconds = accessTokenTTL * 1000;
const expirationTime = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds); const expirationDate = new Date(accessTokenRenewed.getTime() + ttlInMilliseconds);
if (currentDate > expirationTime) throw UnauthorizedRequestError({ if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to authenticate MI access token due to TTL expiration" message: "Failed to authenticate MI access token due to TTL expiration"
}); });
} else { } else {
// access token has never been renewed // access token has never been renewed
const accessTokenCreated = new Date(accessTokenCreatedAt); const accessTokenCreated = new Date(accessTokenCreatedAt);
const ttlInMilliseconds = accessTokenTTL * 1000; const ttlInMilliseconds = accessTokenTTL * 1000;
const expirationTime = new Date(accessTokenCreated.getTime() + ttlInMilliseconds); const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
if (currentDate > expirationTime) throw UnauthorizedRequestError({ if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to authenticate MI access token due to TTL expiration" message: "Failed to authenticate MI access token due to TTL expiration"
}); });
} }
@@ -67,9 +67,9 @@ export const validateMachineIdentity = async ({
const accessTokenCreated = new Date(accessTokenCreatedAt); const accessTokenCreated = new Date(accessTokenCreatedAt);
const ttlInMilliseconds = accessTokenMaxTTL * 1000; const ttlInMilliseconds = accessTokenMaxTTL * 1000;
const currentDate = new Date(); const currentDate = new Date();
const expirationTime = new Date(accessTokenCreated.getTime() + ttlInMilliseconds); const expirationDate = new Date(accessTokenCreated.getTime() + ttlInMilliseconds);
if (currentDate > expirationTime) throw UnauthorizedRequestError({ if (currentDate > expirationDate) throw UnauthorizedRequestError({
message: "Failed to authenticate MI access token due to Max TTL expiration" message: "Failed to authenticate MI access token due to Max TTL expiration"
}); });
} }