feat(infisical-pg): auth injection completed and validation in password router

backend-pg/src/server/routes/index.ts

@@ -11,6 +11,7 @@ import { tokenServiceFactory } from "@app/services/token/token-service";
 import { registerV1Routes } from "./v1";
 import { registerV2Routes } from "./v2";
 import { registerV3Routes } from "./v3";
+import { injectIdentity } from "../plugins/auth/inject-identity";
 
 export const registerRoutes = async (
   server: FastifyZodProvider,
@@ -37,6 +38,8 @@ export const registerRoutes = async (
     user: authDal
   } as FastifyZodProvider["store"]);
 
+  await server.register(injectIdentity);
+
   // register routes for v1
   await server.register(registerV1Routes, { prefix: "/v1" });
   await server.register(registerV2Routes, { prefix: "/v2" });

backend-pg/src/server/routes/v1/password-router.ts

@@ -2,6 +2,8 @@ import { z } from "zod";
 
 import { BackupPrivateKeySchema } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerPasswordRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -18,6 +20,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
+    onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
       const { salt, serverPublicKey } = await server.services.password.generateServerPubKey(
         req.auth.userId,
@@ -48,6 +51,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
+    onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req, res) => {
       const appCfg = getConfig();
       await server.services.password.changePassword({ ...req.body, userId: req.auth.userId });
@@ -65,6 +69,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
     url: "/backup-private-key",
+    onRequest: verifyAuth([AuthMode.JWT]),
     schema: {
       body: z.object({
         clientProof: z.string().trim(),
@@ -95,6 +100,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
     url: "/backup-private-key",
+    onRequest: verifyAuth([AuthMode.JWT]),
     schema: {
       response: {
         200: z.object({

backend-pg/src/server/routes/v2/mfa-router.ts

@@ -2,20 +2,24 @@ import jwt, { JwtPayload } from "jsonwebtoken";
 import { z } from "zod";
 
 import { getConfig } from "@app/lib/config/env";
-import { AuthTokenType } from "@app/services/auth/auth-signup-type";
+import { AuthTokenType } from "@app/services/auth/auth-type";
 
 export const registerMfaRouter = async (server: FastifyZodProvider) => {
   const cfg = getConfig();
 
+  server.decorateRequest("mfa", null);
   server.addHook("preParsing", async (req, res) => {
     const authorizationHeader = req.headers.authorization;
 
     if (!authorizationHeader || !authorizationHeader.startsWith("Bearer ")) {
       res.status(401).send({ error: "Missing bearer token" });
-      return;
+      return res;
     }
     const token = authorizationHeader.split(" ")[1];
-    if (!token) res.status(401).send({ error: "Missing bearer token" });
+    if (!token) {
+      res.status(401).send({ error: "Missing bearer token" });
+      return res;
+    }
 
     const decodedToken = jwt.verify(token, cfg.JWT_AUTH_SECRET) as JwtPayload;
     if (decodedToken.authTokenType !== AuthTokenType.MFA_TOKEN)
@@ -23,8 +27,7 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => {
 
     const user = await server.store.user.getUserById(decodedToken.userId);
     if (!user) throw new Error("User not found");
-    req.mfa.userId = user.id;
-    req.mfa.user = user;
+    req.mfa = { userId: user.id, user };
   });
 
   server.route({
@@ -52,7 +55,7 @@ export const registerMfaRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          encryptionVersion: z.number().default(1).optional(),
+          encryptionVersion: z.number().default(1).nullable().optional(),
           protectedKey: z.string(),
           protectedKeyIV: z.string(),
           protectedKeyTag: z.string(),

backend-pg/src/server/routes/v3/login-router.ts

@@ -44,7 +44,7 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
           z.object({ mfaEnabled: z.literal(true), token: z.string() }),
           z.object({
             mfaEnabled: z.literal(false),
-            encryptionVersion: z.number().default(1).optional(),
+            encryptionVersion: z.number().default(1).nullable().optional(),
             protectedKey: z.string(),
             protectedKeyIV: z.string(),
             protectedKeyTag: z.string(),

backend-pg/src/server/routes/v3/signup-router.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { UserSchema } from "@app/db/schemas";
+import { UsersSchema } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 
 export const registerSignupRouter = async (server: FastifyZodProvider) => {
@@ -35,7 +35,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
         200: z.object({
           message: z.string(),
           token: z.string(),
-          user: UserSchema
+          user: UsersSchema
         })
       }
     },
@@ -72,7 +72,7 @@ export const registerSignupRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           message: z.string(),
-          user: UserSchema,
+          user: UsersSchema,
           token: z.string()
         })
       }