awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: changed req.auth.userId to permission.id to satisfy type error

Browse Source
This commit is contained in:
Akhil Mohan
2024-01-12 22:16:17 +05:30
parent 20fb99f042
commit fe416556f2
18 changed files with 107 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
backend-pg/src/ee/routes/v1/org-role-router.ts
View File

@@ -26,8 +26,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const role = await server.services.orgRole.createRole(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.body
);
@@ -57,8 +58,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const role = await server.services.orgRole.updateRole(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.params.roleId,
req.body
@@ -83,8 +85,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const role = await server.services.orgRole.deleteRole(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.params.roleId
);
@@ -111,8 +114,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const roles = await server.services.orgRole.listRoles(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { data: { roles } };
@@ -135,8 +139,9 @@ export const registerOrgRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { permissions, membership } = await server.services.orgRole.getUserPermission(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { permissions, membership };

3
backend-pg/src/ee/routes/v1/project-role-router.ts
View File

@@ -141,8 +141,9 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { permissions, membership } = await server.services.projectRole.getUserPermission(
req.auth.userId,
req.permission.id,
req.params.projectId
);
return { data: { permissions, membership } };

1
backend-pg/src/ee/services/permission/permission-dal.ts
View File

@@ -78,7 +78,6 @@ export const permissionDalFactory = (db: TDbClient) => {
.select(selectAllTableCols(TableName.IdentityProjectMembership))
.select("permissions")
.first();
return membership;
} catch (error) {
throw new DatabaseError({ error, name: "GetProjectIdentityPermission" });

32
backend-pg/src/ee/services/permission/permission-service.ts
View File

@@ -1,7 +1,14 @@
import { createMongoAbility, MongoAbility, RawRuleOf } from "@casl/ability";
import { PackRule, unpackRules } from "@casl/ability/extra";
import { MongoQuery } from "@ucast/mongo2js";
import { OrgMembershipRole, ProjectMembershipRole, ServiceTokenScopes } from "@app/db/schemas";
import {
OrgMembershipRole,
ProjectMembershipRole,
ServiceTokenScopes,
TIdentityProjectMemberships,
TProjectMemberships
} from "@app/db/schemas";
import { conditionsMatcher } from "@app/lib/casl";
import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
import { ActorType } from "@app/services/auth/auth-type";
@@ -170,18 +177,31 @@ export const permissionServiceFactory = ({
const scopes = ServiceTokenScopes.parse(serviceToken.scopes || []);
return {
permission: buildServiceTokenProjectPermission(scopes, serviceToken.permissions),
member: undefined
membership: undefined
};
};
const getProjectPermission = async (type: ActorType, id: string, projectId: string) => {
type TProjectPermissionRT<T extends ActorType> = T extends ActorType.SERVICE
? { permission: MongoAbility<ProjectPermissionSet, MongoQuery>; membership: undefined }
: {
permission: MongoAbility<ProjectPermissionSet, MongoQuery>;
membership: (T extends ActorType.USER
? TProjectMemberships
: TIdentityProjectMemberships) & { permissions?: unknown };
};
const getProjectPermission = async <T extends ActorType>(
type: T,
id: string,
projectId: string
): Promise<TProjectPermissionRT<T>> => {
switch (type) {
case ActorType.USER:
return getUserProjectPermission(id, projectId);
return getUserProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
case ActorType.SERVICE:
return getServiceTokenProjectPermission(id, projectId);
return getServiceTokenProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
case ActorType.IDENTITY:
return getIdentityProjectPermission(id, projectId);
return getIdentityProjectPermission(id, projectId) as Promise<TProjectPermissionRT<T>>;
default:
throw new UnauthorizedError({
message: "Permission not defined",

18
backend-pg/src/ee/services/secret-approval-request/secret-approval-request-service.ts
View File

@@ -73,7 +73,14 @@ export const secretApprovalRequestServiceFactory = ({
secretQueueService
}: TSecretApprovalRequestServiceFactoryDep) => {
const requestCount = async ({ projectId, actor, actorId }: TApprovalRequestCountDTO) => {
const { membership } = await permissionService.getProjectPermission(actor, actorId, projectId);
if (actor === ActorType.SERVICE)
throw new BadRequestError({ message: "Cannot use service token" });
const { membership } = await permissionService.getProjectPermission(
actor as ActorType.USER,
actorId,
projectId
);
const count = await secretApprovalRequestDal.findProjectRequestCount(projectId, membership.id);
return count;
};
@@ -86,6 +93,9 @@ export const secretApprovalRequestServiceFactory = ({
environment,
committer
}: TListApprovalsDTO) => {
if (actor === ActorType.SERVICE)
throw new BadRequestError({ message: "Cannot use service token" });
const { membership } = await permissionService.getProjectPermission(actor, actorId, projectId);
const approvals = await secretApprovalRequestDal.findByProjectId({
projectId,
@@ -98,6 +108,9 @@ export const secretApprovalRequestServiceFactory = ({
};
const getSecretApprovalDetails = async ({ actor, actorId, id }: TSecretApprovalDetailsDTO) => {
if (actor === ActorType.SERVICE)
throw new BadRequestError({ message: "Cannot use service token" });
const secretApprovalRequest = await secretApprovalRequestDal.findById(id);
if (!secretApprovalRequest)
throw new BadRequestError({ message: "Secret approval request not found" });
@@ -393,6 +406,9 @@ export const secretApprovalRequestServiceFactory = ({
secretPath,
environment
}: TGenerateSecretApprovalRequestDTO) => {
if (actor === ActorType.SERVICE)
throw new BadRequestError({ message: "Cannot use service token" });
const { permission, membership } = await permissionService.getProjectPermission(
actor,
actorId,

4
backend-pg/src/ee/services/secret-scanning/secret-scanning-service.ts
View File

@@ -1,7 +1,7 @@
import crypto from "node:crypto";
import { ForbiddenError } from "@casl/ability";
import { PushEvent } from "@octokit/webhooks-types";
import { WebhookEventMap } from "@octokit/webhooks-types";
import { ProbotOctokit } from "probot";
import {
@@ -146,7 +146,7 @@ export const secretScanningServiceFactory = ({
return { risk };
};
const handleRepoPushEvent = async (payload: PushEvent) => {
const handleRepoPushEvent = async (payload: WebhookEventMap["push"]) => {
const { commits, repository, installation, pusher } = payload;
if (!commits || !repository || !installation || !pusher) {
return;

2
backend-pg/src/server/plugins/audit-log.ts
View File

@@ -44,7 +44,7 @@ export const injectAuditLogInfo = fp(async (server: FastifyZodProvider) => {
type: ActorType.USER,
metadata: {
email: req.auth.user.email,
userId: req.auth.userId
userId: req.permission.id
}
};
} else if (req.auth.actor === ActorType.SERVICE) {

3
backend-pg/src/server/plugins/auth/superAdmin.ts
View File

@@ -1,9 +1,10 @@
import { FastifyRequest } from "fastify";
import { UnauthorizedError } from "@app/lib/errors";
import { ActorType } from "@app/services/auth/auth-type";
export const verifySuperAdmin = async <T extends FastifyRequest>(req: T) => {
if (!req.auth.user.superAdmin)
if (req.auth.actor !== ActorType.USER || !req.auth.user.superAdmin)
throw new UnauthorizedError({
name: "Unauthorized access",
message: "Requires superadmin access"

2
backend-pg/src/server/plugins/secret-scanner.ts
View File

@@ -22,7 +22,7 @@ export const registerSecretScannerGhApp = async (server: FastifyZodProvider) =>
app.on("push", async (context) => {
const { payload } = context;
await server.services.secretScanning.handleRepoPushEvent(payload);
await server.services.secretScanning.handleRepoPushEvent(payload as any);
});
};

2
backend-pg/src/server/routes/v1/auth-router.ts
View File

@@ -25,7 +25,7 @@ export const registerAuthRoutes = async (server: FastifyZodProvider) => {
handler: async (req, res) => {
const appCfg = getConfig();
if (req.auth.authMode === AuthMode.JWT) {
await server.services.login.logout(req.auth.userId, req.auth.tokenVersionId);
await server.services.login.logout(req.permission.id, req.auth.tokenVersionId);
}
res.cookie("jid", "", {
httpOnly: true,

5
backend-pg/src/server/routes/v1/invite-org-router.ts
View File

@@ -2,7 +2,7 @@ import { z } from "zod";
import { UsersSchema } from "@app/db/schemas";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import { ActorType, AuthMode } from "@app/services/auth/auth-type";
export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
server.route({
@@ -22,9 +22,10 @@ export const registerInviteOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const completeInviteLink = await server.services.org.inviteUserToOrganization({
orgId: req.body.organizationId,
userId: req.auth.userId,
userId: req.permission.id,
inviteeEmail: req.body.inviteeEmail
});

14
backend-pg/src/server/routes/v1/organization-router.ts
View File

@@ -22,7 +22,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const organizations = await server.services.org.findAllOrganizationOfUser(req.auth.userId);
const organizations = await server.services.org.findAllOrganizationOfUser(req.permission.id);
return { organizations };
}
});
@@ -43,7 +43,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const organization = await server.services.org.findOrganizationById(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { organization };
@@ -77,7 +77,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const users = await server.services.org.findAllOrgMembers(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { users };
@@ -102,7 +102,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const organization = await server.services.org.updateOrgName(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.body.name
);
@@ -127,7 +127,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const incidentContactsOrg = await req.server.services.org.findIncidentContacts(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { incidentContactsOrg };
@@ -149,7 +149,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const incidentContactsOrg = await req.server.services.org.createIncidentContact(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.body.email
);
@@ -172,7 +172,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const incidentContactsOrg = await req.server.services.org.deleteIncidentContact(
req.auth.userId,
req.permission.id,
req.params.organizationId,
req.params.incidentContactId
);

8
backend-pg/src/server/routes/v1/password-router.ts
View File

@@ -23,7 +23,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { salt, serverPublicKey } = await server.services.password.generateServerPubKey(
req.auth.userId,
req.permission.id,
req.body.clientPublicKey
);
return { salt, serverPublicKey };
@@ -54,7 +54,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req, res) => {
const appCfg = getConfig();
await server.services.password.changePassword({ ...req.body, userId: req.auth.userId });
await server.services.password.changePassword({ ...req.body, userId: req.permission.id });
res.cookie("jid", appCfg.COOKIE_SECRET_SIGN_KEY, {
httpOnly: true,
@@ -89,7 +89,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
handler: async (req) => {
const backupPrivateKey = await server.services.password.createBackupPrivateKey({
...req.body,
userId: req.auth.userId
userId: req.permission.id
});
if (!backupPrivateKey) throw new Error("Failed to create backup key");
@@ -111,7 +111,7 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
},
handler: async (req) => {
const backupPrivateKey = await server.services.password.getBackupPrivateKeyOfUser(
req.auth.userId
req.permission.id
);
if (!backupPrivateKey) throw new Error("Failed to find backup key");

4
backend-pg/src/server/routes/v1/user-action-router.ts
View File

@@ -22,7 +22,7 @@ export const registerUserActionRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const userAction = await server.services.user.createUserAction(
req.auth.userId,
req.permission.id,
req.body.action
);
return { userAction, message: "Successfully recorded user action" };
@@ -45,7 +45,7 @@ export const registerUserActionRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const userAction = await server.services.user.getUserAction(
req.auth.userId,
req.permission.id,
req.query.action
);
return { userAction };

2
backend-pg/src/server/routes/v1/user-router.ts
View File

@@ -17,7 +17,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const user = await server.services.user.getMe(req.auth.userId);
const user = await server.services.user.getMe(req.permission.id);
return { user };
}
});

22
backend-pg/src/server/routes/v2/organization-router.ts
View File

@@ -7,7 +7,7 @@ import {
UsersSchema
} from "@app/db/schemas";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import { ActorType, AuthMode } from "@app/services/auth/auth-type";
export const registerOrgRouter = async (server: FastifyZodProvider) => {
server.route({
@@ -36,8 +36,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const users = await server.services.org.findAllOrgMembers(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { users };
@@ -60,8 +62,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const membership = await server.services.org.updateOrgMembership({
userId: req.auth.userId,
userId: req.permission.id,
role: req.body.role,
orgId: req.params.organizationId,
membershipId: req.params.membershipId
@@ -83,8 +87,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const membership = await server.services.org.deleteOrgMembership({
userId: req.auth.userId,
userId: req.permission.id,
orgId: req.params.organizationId,
membershipId: req.params.membershipId
});
@@ -107,8 +113,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const organization = await server.services.org.createOrganization(
req.auth.userId,
req.permission.id,
req.body.name
);
return { organization };
@@ -130,8 +138,10 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
if (req.auth.actor !== ActorType.USER) return;
const organization = await server.services.org.deleteOrganizationById(
req.auth.userId,
req.permission.id,
req.params.organizationId
);
return { organization };

22
backend-pg/src/server/routes/v2/user-router.ts
View File

@@ -26,7 +26,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
const user = await server.services.user.toggleUserMfa(req.auth.userId, req.body.isMfaEnabled);
const user = await server.services.user.toggleUserMfa(req.permission.id, req.body.isMfaEnabled);
return { user };
}
});
@@ -48,7 +48,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
const user = await server.services.user.updateUserName(
req.auth.userId,
req.permission.id,
req.body.firstName,
req.body.lastName
);
@@ -72,7 +72,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
preHandler: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
const user = await server.services.user.updateAuthMethods(
req.auth.userId,
req.permission.id,
req.body.authMethods
);
return { user };
@@ -91,7 +91,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY]),
handler: async (req) => {
const organizations = await server.services.org.findAllOrganizationOfUser(req.auth.userId);
const organizations = await server.services.org.findAllOrganizationOfUser(req.permission.id);
return { organizations };
}
});
@@ -106,7 +106,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const apiKeys = await server.services.apiKey.getMyApiKeys(req.auth.userId);
const apiKeys = await server.services.apiKey.getMyApiKeys(req.permission.id);
return apiKeys;
}
});
@@ -129,7 +129,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const apiKeys = await server.services.apiKey.createApiKey(
req.auth.userId,
req.permission.id,
req.body.name,
req.body.expiresIn
);
@@ -153,7 +153,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const apiKeyData = await server.services.apiKey.deleteApiKey(
req.auth.userId,
req.permission.id,
req.params.apiKeyDataId
);
return { apiKeyData };
@@ -170,7 +170,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const sessions = await server.services.authToken.getTokenSessionByUser(req.auth.userId);
const sessions = await server.services.authToken.getTokenSessionByUser(req.permission.id);
return sessions;
}
});
@@ -187,7 +187,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
await server.services.authToken.revokeAllMySessions(req.auth.userId);
await server.services.authToken.revokeAllMySessions(req.permission.id);
return {
message: "Successfully revoked all sessions"
};
@@ -206,7 +206,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const user = await server.services.user.getMe(req.auth.userId);
const user = await server.services.user.getMe(req.permission.id);
return { user };
}
});
@@ -223,7 +223,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const user = await server.services.user.deleteMe(req.auth.userId);
const user = await server.services.user.deleteMe(req.permission.id);
return { user };
}
});

2
backend-pg/src/server/routes/v3/user-router.ts
View File

@@ -17,7 +17,7 @@ export const registerUserRouter = async (server: FastifyZodProvider) => {
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const apiKeyData = await server.services.apiKey.getMyApiKeys(req.auth.userId);
const apiKeyData = await server.services.apiKey.getMyApiKeys(req.permission.id);
return { apiKeyData };
}
});