awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-03 16:26:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into feature/aws-iam-pam

Browse Source
This commit is contained in:
Victor Santos
2025-12-05 13:29:30 -03:00
parent b2e4c1e6bf 3f70897593
commit feb1d9b854
70 changed files with 2417 additions and 915 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.infisicalignore
+2 -1
View File
@@ -57,4 +57,5 @@ docs/documentation/platform/pki/enrollment-methods/api.mdx:generic-api-key:93
docs/documentation/platform/pki/enrollment-methods/api.mdx:private-key:139
docs/documentation/platform/pki/certificate-syncs/aws-secrets-manager.mdx:private-key:62
docs/documentation/platform/pki/certificate-syncs/chef.mdx:private-key:61
backend/src/services/certificate-request/certificate-request-service.test.ts:private-key:246
backend/src/services/certificate-request/certificate-request-service.test.ts:private-key:246
backend/src/services/certificate-request/certificate-request-service.test.ts:private-key:248
backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts
+7 -3
View File
@@ -110,7 +110,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
schema: {
description: "Access PAM account",
body: z.object({
accountId: z.string().uuid(),
accountPath: z.string().trim(),
projectId: z.string().uuid(),
duration: z
.string()
.min(1)
@@ -192,7 +193,9 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
actorIp: req.realIp,
actorName: `${req.auth.user.firstName ?? ""} ${req.auth.user.lastName ?? ""}`.trim(),
actorUserAgent: req.auditLogInfo.userAgent ?? "",
...req.body
accountPath: req.body.accountPath,
projectId: req.body.projectId,
duration: req.body.duration
},
req.permission
);
@@ -204,7 +207,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
event: {
type: EventType.PAM_ACCOUNT_ACCESS,
metadata: {
accountId: req.body.accountId,
accountId: response.account.id,
accountPath: req.body.accountPath,
accountName: response.account.name,
duration: req.body.duration ? new Date(req.body.duration).toISOString() : undefined
}
backend/src/ee/services/audit-log/audit-log-types.ts
+1
View File
@@ -4076,6 +4076,7 @@ interface PamAccountAccessEvent {
type: EventType.PAM_ACCOUNT_ACCESS;
metadata: {
accountId: string;
accountPath: string;
accountName: string;
duration?: string;
};
backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts
+5 -2
View File
@@ -4,7 +4,10 @@ import * as x509 from "@peculiar/x509";
import { ActionProjectType } from "@app/db/schemas";
import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import {
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { NotFoundError } from "@app/lib/errors";
import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
import { expandInternalCa } from "@app/services/certificate-authority/certificate-authority-fns";
@@ -83,7 +86,7 @@ export const certificateAuthorityCrlServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionCertificateAuthorityActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
backend/src/ee/services/pam-account/pam-account-service.ts
+40 -17
View File
@@ -508,7 +508,7 @@ export const pamAccountServiceFactory = ({
};
const access = async (
{ accountId, actorEmail, actorIp, actorName, actorUserAgent, duration }: TAccessAccountDTO,
{ accountPath, projectId, actorEmail, actorIp, actorName, actorUserAgent, duration }: TAccessAccountDTO,
actor: OrgServiceActor
) => {
const orgLicensePlan = await licenseService.getPlan(actor.orgId);
@@ -518,8 +518,36 @@ export const pamAccountServiceFactory = ({
});
}
const account = await pamAccountDAL.findById(accountId);
if (!account) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
const pathSegments: string[] = accountPath.split("/").filter(Boolean);
if (pathSegments.length === 0) {
throw new BadRequestError({ message: "Invalid accountPath. Path must contain at least the account name." });
}
const accountName: string = pathSegments[pathSegments.length - 1] ?? "";
const folderPathSegments: string[] = pathSegments.slice(0, -1);
const folderPath: string = folderPathSegments.length > 0 ? `/${folderPathSegments.join("/")}` : "/";
let folderId: string | null = null;
if (folderPath !== "/") {
const folder = await pamFolderDAL.findByPath(projectId, folderPath);
if (!folder) {
throw new NotFoundError({ message: `Folder at path '${folderPath}' not found` });
}
folderId = folder.id;
}
const account = await pamAccountDAL.findOne({
projectId,
folderId,
name: accountName
});
if (!account) {
throw new NotFoundError({
message: `Account with name '${accountName}' not found at path '${accountPath}'`
});
}
const resource = await pamResourceDAL.findById(account.resourceId);
if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
@@ -529,22 +557,16 @@ export const pamAccountServiceFactory = ({
actorAuthMethod: actor.authMethod,
actorId: actor.id,
actorOrgId: actor.orgId,
projectId: account.projectId,
projectId,
actionProjectType: ActionProjectType.PAM
});
const accountPath = await getFullPamFolderPath({
pamFolderDAL,
folderId: account.folderId,
projectId: account.projectId
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPamAccountActions.Access,
subject(ProjectPermissionSub.PamAccounts, {
resourceName: resource.name,
accountName: account.name,
accountPath
accountPath: folderPath
})
);
@@ -613,7 +635,7 @@ export const pamAccountServiceFactory = ({
actorIp,
actorName,
actorUserAgent,
projectId: account.projectId,
projectId,
resourceName: resource.name,
resourceType: resource.resourceType,
status: PamSessionStatus.Starting,
@@ -621,6 +643,7 @@ export const pamAccountServiceFactory = ({
userId: actor.id,
expiresAt: new Date(Date.now() + duration)
});
if (!gatewayId) {
throw new BadRequestError({ message: "Gateway ID is required for this resource type" });
}
@@ -652,20 +675,20 @@ export const pamAccountServiceFactory = ({
const connectionCredentials = (await decryptResourceConnectionDetails({
encryptedConnectionDetails: resource.encryptedConnectionDetails,
kmsService,
projectId: account.projectId
projectId
})) as TSqlResourceConnectionDetails;
const credentials = (await decryptAccountCredentials({
encryptedCredentials: account.encryptedCredentials,
kmsService,
projectId: account.projectId
projectId
})) as TSqlAccountCredentials;
metadata = {
username: credentials.username,
database: connectionCredentials.database,
accountName: account.name,
accountPath
accountPath: folderPath
};
}
break;
@@ -674,7 +697,7 @@ export const pamAccountServiceFactory = ({
const credentials = (await decryptAccountCredentials({
encryptedCredentials: account.encryptedCredentials,
kmsService,
projectId: account.projectId
projectId
})) as TSSHAccountCredentials;
metadata = {
@@ -696,7 +719,7 @@ export const pamAccountServiceFactory = ({
gatewayClientPrivateKey: gatewayConnectionDetails.gateway.clientPrivateKey,
gatewayServerCertificateChain: gatewayConnectionDetails.gateway.serverCertificateChain,
relayHost: gatewayConnectionDetails.relayHost,
projectId: account.projectId,
projectId,
account,
metadata
};
backend/src/ee/services/pam-account/pam-account-types.ts
+2 -1
View File
@@ -16,7 +16,8 @@ export type TUpdateAccountDTO = Partial<Omit<TCreateAccountDTO, "folderId" | "re
};
export type TAccessAccountDTO = {
accountId: string;
accountPath: string;
projectId: string;
actorEmail: string;
actorIp: string;
actorName: string;
backend/src/ee/services/permission/default-roles.ts
+19 -5
View File
@@ -5,6 +5,7 @@ import {
ProjectPermissionAppConnectionActions,
ProjectPermissionAuditLogsActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionCmekActions,
ProjectPermissionCommitsActions,
@@ -45,7 +46,6 @@ const buildAdminPermissionRules = () => {
ProjectPermissionSub.Environments,
ProjectPermissionSub.Tags,
ProjectPermissionSub.IpAllowList,
ProjectPermissionSub.CertificateAuthorities,
ProjectPermissionSub.PkiAlerts,
ProjectPermissionSub.PkiCollections,
ProjectPermissionSub.SshCertificateAuthorities,
@@ -68,6 +68,18 @@ const buildAdminPermissionRules = () => {
can([ProjectPermissionAuditLogsActions.Read], ProjectPermissionSub.AuditLogs);
can(
[
ProjectPermissionCertificateAuthorityActions.Read,
ProjectPermissionCertificateAuthorityActions.Create,
ProjectPermissionCertificateAuthorityActions.Edit,
ProjectPermissionCertificateAuthorityActions.Delete,
ProjectPermissionCertificateAuthorityActions.Renew,
ProjectPermissionCertificateAuthorityActions.SignIntermediate
],
ProjectPermissionSub.CertificateAuthorities
);
can(
[
ProjectPermissionPkiTemplateActions.Read,
@@ -96,7 +108,8 @@ const buildAdminPermissionRules = () => {
ProjectPermissionCertificateActions.Edit,
ProjectPermissionCertificateActions.Create,
ProjectPermissionCertificateActions.Delete,
ProjectPermissionCertificateActions.ReadPrivateKey
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionCertificateActions.Import
],
ProjectPermissionSub.Certificates
);
@@ -461,7 +474,7 @@ const buildMemberPermissionRules = () => {
can([ProjectPermissionActions.Read], ProjectPermissionSub.IpAllowList);
// double check if all CRUD are needed for CA and Certificates
can([ProjectPermissionActions.Read], ProjectPermissionSub.CertificateAuthorities);
can([ProjectPermissionCertificateAuthorityActions.Read], ProjectPermissionSub.CertificateAuthorities);
can([ProjectPermissionPkiTemplateActions.Read], ProjectPermissionSub.CertificateTemplates);
can(
@@ -469,7 +482,8 @@ const buildMemberPermissionRules = () => {
ProjectPermissionCertificateActions.Read,
ProjectPermissionCertificateActions.Edit,
ProjectPermissionCertificateActions.Create,
ProjectPermissionCertificateActions.Delete
ProjectPermissionCertificateActions.Delete,
ProjectPermissionCertificateActions.Import
],
ProjectPermissionSub.Certificates
);
@@ -600,7 +614,7 @@ const buildViewerPermissionRules = () => {
can(ProjectPermissionActions.Read, ProjectPermissionSub.Tags);
can(ProjectPermissionAuditLogsActions.Read, ProjectPermissionSub.AuditLogs);
can(ProjectPermissionActions.Read, ProjectPermissionSub.IpAllowList);
can(ProjectPermissionActions.Read, ProjectPermissionSub.CertificateAuthorities);
can(ProjectPermissionCertificateAuthorityActions.Read, ProjectPermissionSub.CertificateAuthorities);
can(ProjectPermissionCertificateActions.Read, ProjectPermissionSub.Certificates);
can(ProjectPermissionPkiTemplateActions.Read, ProjectPermissionSub.CertificateTemplates);
can(ProjectPermissionCmekActions.Read, ProjectPermissionSub.Cmek);
backend/src/ee/services/permission/project-permission.ts
+179 -18
View File
@@ -23,12 +23,22 @@ export enum ProjectPermissionCommitsActions {
PerformRollback = "perform-rollback"
}
export enum ProjectPermissionCertificateAuthorityActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
Renew = "renew",
SignIntermediate = "sign-intermediate"
}
export enum ProjectPermissionCertificateActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
ReadPrivateKey = "read-private-key"
ReadPrivateKey = "read-private-key",
Import = "import"
}
export enum ProjectPermissionSecretActions {
@@ -292,7 +302,8 @@ export type SecretSyncSubjectFields = {
};
export type PkiSyncSubjectFields = {
subscriberName: string;
subscriberName?: string;
name: string;
};
export type DynamicSecretSubjectFields = {
@@ -332,6 +343,26 @@ export type PkiSubscriberSubjectFields = {
// (dangtony98): consider adding [commonName] as a subject field in the future
};
export type CertificateAuthoritySubjectFields = {
name: string;
};
export type CertificateSubjectFields = {
commonName?: string;
altNames?: string;
serialNumber?: string;
friendlyName?: string;
status?: string;
};
export type CertificateProfileSubjectFields = {
slug: string;
};
export type CertificateTemplateV2SubjectFields = {
name: string;
};
export type AppConnectionSubjectFields = {
connectionId: string;
};
@@ -399,8 +430,17 @@ export type ProjectPermissionSet =
ProjectPermissionIdentityActions,
ProjectPermissionSub.Identity | (ForcedSubject<ProjectPermissionSub.Identity> & IdentityManagementSubjectFields)
]
| [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
| [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
| [
ProjectPermissionCertificateAuthorityActions,
(
| ProjectPermissionSub.CertificateAuthorities
| (ForcedSubject<ProjectPermissionSub.CertificateAuthorities> & CertificateAuthoritySubjectFields)
)
]
| [
ProjectPermissionCertificateActions,
ProjectPermissionSub.Certificates | (ForcedSubject<ProjectPermissionSub.Certificates> & CertificateSubjectFields)
]
| [
ProjectPermissionPkiTemplateActions,
(
@@ -454,7 +494,13 @@ export type ProjectPermissionSet =
ProjectPermissionSub.PamAccounts | (ForcedSubject<ProjectPermissionSub.PamAccounts> & PamAccountSubjectFields)
]
| [ProjectPermissionPamSessionActions, ProjectPermissionSub.PamSessions]
| [ProjectPermissionCertificateProfileActions, ProjectPermissionSub.CertificateProfiles];
| [
ProjectPermissionCertificateProfileActions,
(
| ProjectPermissionSub.CertificateProfiles
| (ForcedSubject<ProjectPermissionSub.CertificateProfiles> & CertificateProfileSubjectFields)
)
];
const SECRET_PATH_MISSING_SLASH_ERR_MSG = "Invalid Secret Path; it must start with a '/'";
const SECRET_PATH_PERMISSION_OPERATOR_SCHEMA = z.union([
@@ -572,6 +618,17 @@ const SecretSyncConditionV2Schema = z
const PkiSyncConditionSchema = z
.object({
name: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
]),
subscriberName: z.union([
z.string(),
z
@@ -698,6 +755,7 @@ const PkiTemplateConditionSchema = z
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
})
@@ -749,6 +807,98 @@ const PamAccountConditionSchema = z
})
.partial();
const CertificateAuthorityConditionSchema = z
.object({
name: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
])
})
.partial();
const CertificateConditionSchema = z
.object({
commonName: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
]),
altNames: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
]),
serialNumber: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
]),
friendlyName: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
]),
status: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
])
})
.partial();
const CertificateProfileConditionSchema = z
.object({
slug: z.union([
z.string(),
z
.object({
[PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
[PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
[PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
[PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
})
.partial()
])
})
.partial();
const GeneralPermissionSchema = [
z.object({
subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
@@ -828,18 +978,6 @@ const GeneralPermissionSchema = [
"Describe what action an entity can take."
)
}),
z.object({
subject: z.literal(ProjectPermissionSub.CertificateAuthorities).describe("The entity this permission pertains to."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
"Describe what action an entity can take."
)
}),
z.object({
subject: z.literal(ProjectPermissionSub.Certificates).describe("The entity this permission pertains to."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCertificateActions).describe(
"Describe what action an entity can take."
)
}),
z.object({
subject: z
.literal(ProjectPermissionSub.SshCertificateAuthorities)
@@ -1130,7 +1268,30 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCertificateProfileActions).describe(
"Describe what action an entity can take."
)
),
conditions: CertificateProfileConditionSchema.describe(
"When specified, only matching conditions will be allowed to access given resource."
).optional()
}),
z.object({
subject: z.literal(ProjectPermissionSub.CertificateAuthorities).describe("The entity this permission pertains to."),
inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCertificateAuthorityActions).describe(
"Describe what action an entity can take."
),
conditions: CertificateAuthorityConditionSchema.describe(
"When specified, only matching conditions will be allowed to access given resource."
).optional()
}),
z.object({
subject: z.literal(ProjectPermissionSub.Certificates).describe("The entity this permission pertains to."),
inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCertificateActions).describe(
"Describe what action an entity can take."
),
conditions: CertificateConditionSchema.describe(
"When specified, only matching conditions will be allowed to access given resource."
).optional()
}),
...GeneralPermissionSchema
]);
backend/src/lib/casl/permission-filter-utils.ts
+225
View File
@@ -0,0 +1,225 @@
import type { MongoAbility, MongoQuery, RawRuleOf } from "@casl/ability";
import RE2 from "re2";
export interface PermissionFilterConfig {
operator: string;
value: unknown;
isPattern: boolean;
isInverted?: boolean;
}
export type PermissionFilters = Record<string, Array<PermissionFilterConfig>>;
export interface ProcessedPermissionRules {
allowRules: Array<Record<string, Array<PermissionFilterConfig>>>;
forbidRules: Array<Record<string, Array<PermissionFilterConfig>>>;
}
interface MongoRegexFilter {
$regex: RegExp;
}
interface MongoEqFilter {
$eq: unknown;
}
interface MongoInFilter {
$in: unknown[];
}
interface MongoNeFilter {
$ne: unknown;
}
interface MongoGlobFilter {
$glob: unknown;
}
/**
* Builds permission filters from CASL MongoDB-style conditions
* @param conditions - MongoDB-style conditions from CASL ability
* @param isInverted - Whether this rule is inverted (forbidden)
* @returns Record of field names to arrays of filter configurations
*/
const buildPermissionFiltersFromConditions = (conditions: MongoQuery, isInverted = false): PermissionFilters => {
const permissionFilters: PermissionFilters = {};
function addFilterToField(key: string, operator: string, value: unknown, isPattern: boolean) {
if (!permissionFilters[key]) {
permissionFilters[key] = [];
}
// Convert operators for inverted/forbidden rules
let finalOperator = operator;
if (isInverted) {
switch (operator) {
case "=":
finalOperator = "!=";
break;
case "!=":
finalOperator = "=";
break;
case "LIKE":
finalOperator = "NOT LIKE";
break;
case "NOT LIKE":
finalOperator = "LIKE";
break;
case "IN":
finalOperator = "NOT IN";
break;
case "NOT IN":
finalOperator = "IN";
break;
case ">":
finalOperator = "<=";
break;
case ">=":
finalOperator = "<";
break;
case "<":
finalOperator = ">=";
break;
case "<=":
finalOperator = ">";
break;
case "IS NULL":
finalOperator = "IS NOT NULL";
break;
case "IS NOT NULL":
finalOperator = "IS NULL";
break;
// Default: keep the same operator
default:
finalOperator = operator;
break;
}
}
permissionFilters[key].push({ operator: finalOperator, value, isPattern, isInverted });
}
function processCondition(key: string, value: unknown) {
if (value && typeof value === "object") {
const valueObj = value as Record<string, unknown>;
const operatorKeys = ["$regex", "$eq", "$in", "$glob", "$ne"];
const presentOperators = operatorKeys.filter((op) => op in valueObj);
if (presentOperators.length > 1) {
if ("$eq" in valueObj) {
addFilterToField(key, "=", valueObj.$eq, false);
}
if ("$glob" in valueObj) {
addFilterToField(key, "LIKE", valueObj.$glob, true);
}
if ("$regex" in valueObj) {
const regexValue = valueObj.$regex as RegExp;
const regexPattern = regexValue.source;
const globPattern = regexPattern
.replace(new RE2("^\\\\\\^"), "")
.replace(new RE2("\\\\\\$$"), "")
.replace(new RE2("\\\\\\.\\*", "g"), "*");
addFilterToField(key, "LIKE", globPattern, true);
}
if ("$ne" in valueObj) {
const valueStr = String(valueObj.$ne);
const hasWildcards = valueStr.includes("*") || valueStr.includes("?");
addFilterToField(key, hasWildcards ? "NOT LIKE" : "!=", valueObj.$ne, hasWildcards);
}
if ("$in" in valueObj) {
const inValues = valueObj.$in as unknown[];
addFilterToField(key, "IN", inValues, false);
}
} else if ("$regex" in value) {
const regexFilter = value as MongoRegexFilter;
const regexPattern = regexFilter.$regex.source;
const globPattern = regexPattern
.replace(new RE2("^\\\\\\^"), "")
.replace(new RE2("\\\\\\$$"), "")
.replace(new RE2("\\\\\\.\\*", "g"), "*");
addFilterToField(key, "LIKE", globPattern, true);
} else if ("$eq" in value) {
const eqFilter = value as MongoEqFilter;
addFilterToField(key, "=", eqFilter.$eq, false);
} else if ("$in" in value) {
const inFilter = value as MongoInFilter;
addFilterToField(key, "IN", inFilter.$in, false);
} else if ("$glob" in value) {
const globFilter = value as MongoGlobFilter;
addFilterToField(key, "LIKE", globFilter.$glob, true);
} else if ("$ne" in value) {
const neFilter = value as MongoNeFilter;
const valueStr = String(neFilter.$ne);
const hasWildcards = valueStr.includes("*") || valueStr.includes("?");
addFilterToField(key, hasWildcards ? "NOT LIKE" : "!=", neFilter.$ne, hasWildcards);
}
} else {
addFilterToField(key, "=", value, false);
}
}
function processConditions(mongoConditions: MongoQuery) {
if (
mongoConditions &&
typeof mongoConditions === "object" &&
"$or" in mongoConditions &&
Array.isArray(mongoConditions.$or)
) {
mongoConditions.$or.forEach((orCondition: MongoQuery) => {
processConditions(orCondition);
});
} else if (mongoConditions && typeof mongoConditions === "object") {
Object.entries(mongoConditions).forEach(([key, value]) => {
if (key.startsWith("$")) return;
processCondition(key, value);
});
}
}
if (conditions && typeof conditions === "object") {
processConditions(conditions);
}
return permissionFilters;
};
/**
* Extract permission filters for a subject and action,
* converting them into ProcessedPermissionRules format for use with Knex queries.
* @param ability - CASL MongoAbility instance
* @param action - Permission action to filter for
* @param subjectName - Permission subject to filter for
* @returns ProcessedPermissionRules object for use with applyPermissionFiltersToQuery
*/
export function getProcessedPermissionRules(
ability: MongoAbility,
action: string,
subjectName: string
): ProcessedPermissionRules {
const matchingRules = ability.rules.filter((rule: RawRuleOf<MongoAbility>) => {
const actionMatches = Array.isArray(rule.action) ? rule.action.includes(action) : rule.action === action;
const subjectMatches = Array.isArray(rule.subject)
? rule.subject.includes(subjectName)
: rule.subject === subjectName;
return actionMatches && subjectMatches && rule.conditions;
});
const allowRules: Array<Record<string, Array<PermissionFilterConfig>>> = [];
const forbidRules: Array<Record<string, Array<PermissionFilterConfig>>> = [];
matchingRules.forEach((rule: RawRuleOf<MongoAbility>) => {
if (rule.conditions) {
const isInverted = rule.inverted || false;
const ruleFilters = buildPermissionFiltersFromConditions(rule.conditions, isInverted);
if (isInverted) {
forbidRules.push(ruleFilters);
} else {
allowRules.push(ruleFilters);
}
}
});
return { allowRules, forbidRules };
}
backend/src/lib/knex/permission-filter-utils.ts
+145
View File
@@ -0,0 +1,145 @@
import type { Knex } from "knex";
import RE2 from "re2";
export interface PermissionFilterConfig {
operator: string;
value: unknown;
isPattern: boolean;
isInverted?: boolean;
}
export type PermissionFilters = Record<string, Array<PermissionFilterConfig>>;
export interface ProcessedPermissionRules {
allowRules: Array<Record<string, Array<PermissionFilterConfig>>>;
forbidRules: Array<Record<string, Array<PermissionFilterConfig>>>;
}
/**
* Applies a single filter configuration to a query
* @param query - The Knex query builder instance
* @param tableName - The name of the table to apply filters to
* @param key - The field name
* @param filterConfig - The filter configuration
*/
const applySingleFilter = (
query: Knex.QueryBuilder,
tableName: string,
key: string,
filterConfig: PermissionFilterConfig
): void => {
if (filterConfig.value !== undefined && filterConfig.value !== null) {
const { operator, value, isPattern } = filterConfig;
const fieldName = `${tableName}.${key}`;
switch (operator) {
case "=":
void query.andWhere(fieldName, "=", value as string | number);
break;
case "!=":
void query.andWhere(fieldName, "!=", value as string | number);
break;
case "LIKE": {
const likePattern = isPattern ? String(value).replace(new RE2("\\*", "g"), "%") : String(value);
void query.andWhere(fieldName, "like", likePattern);
break;
}
case "NOT LIKE": {
const notLikePattern = isPattern ? String(value).replace(new RE2("\\*", "g"), "%") : String(value);
void query.andWhere(fieldName, "not like", notLikePattern);
break;
}
case "IN": {
const inValues = Array.isArray(value) ? value : [value];
void query.andWhere(fieldName, "in", inValues as (string | number)[]);
break;
}
case "NOT IN": {
const notInValues = Array.isArray(value) ? value : [value];
void query.andWhere(fieldName, "not in", notInValues as (string | number)[]);
break;
}
case ">":
void query.andWhere(fieldName, ">", value as string | number);
break;
case ">=":
void query.andWhere(fieldName, ">=", value as string | number);
break;
case "<":
void query.andWhere(fieldName, "<", value as string | number);
break;
case "<=":
void query.andWhere(fieldName, "<=", value as string | number);
break;
case "IS NULL":
void query.andWhere(fieldName, "is", null);
break;
case "IS NOT NULL":
void query.andWhere(fieldName, "is not", null);
break;
default:
void query.andWhere(fieldName, "=", value as string | number);
break;
}
}
};
/**
* Applies complex permission rules to a Knex query with proper OR/AND logic
* @param query - The Knex query builder instance
* @param tableName - The name of the table to apply filters to
* @param processedRules - Processed permission rules with allow and forbid rules
* @returns The modified query builder with permission rules applied
*/
export const applyProcessedPermissionRulesToQuery = (
originalQuery: Knex.QueryBuilder,
tableName: string,
processedRules?: ProcessedPermissionRules
): Knex.QueryBuilder => {
if (!processedRules || (processedRules.allowRules.length === 0 && processedRules.forbidRules.length === 0)) {
return originalQuery;
}
let query = originalQuery;
if (processedRules.allowRules.length > 0) {
query = query.andWhere((allowBuilder) => {
processedRules.allowRules.forEach((rule, index) => {
const ruleBuilder = (ruleSubBuilder: Knex.QueryBuilder) => {
Object.entries(rule).forEach(([key, filterConfigs]) => {
filterConfigs.forEach((filterConfig) => {
applySingleFilter(ruleSubBuilder, tableName, key, filterConfig);
});
});
};
if (index === 0) {
void allowBuilder.where(ruleBuilder);
} else {
void allowBuilder.orWhere(ruleBuilder);
}
});
});
}
if (processedRules.forbidRules.length > 0) {
processedRules.forbidRules.forEach((forbidRule) => {
Object.entries(forbidRule).forEach(([key, filterConfigs]) => {
filterConfigs.forEach((filterConfig) => {
applySingleFilter(query, tableName, key, filterConfig);
});
});
});
}
return query;
};
/**
* Sanitizes a string value for safe use in SQL LIKE queries
* @param value - The string value to sanitize
* @returns The sanitized string with SQL special characters escaped
*/
export const sanitizeForLike = (value: string): string => {
return String(value).replace(new RE2("[%_\\\\]", "g"), "\\$&");
};
backend/src/server/routes/v1/certificate-router.ts
+2 -1
View File
@@ -176,7 +176,8 @@ export const registerCertificateRouter = async (server: FastifyZodProvider) => {
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
actorOrgId: req.permission.orgId,
isInternal: true
});
const caType = (ca?.externalCa?.type as CaType) ?? CaType.INTERNAL;
useOrderFlow = caType !== CaType.INTERNAL;
backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts
+16 -5
View File
@@ -7,6 +7,7 @@ import { TableName } from "@app/db/schemas";
import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import { BadRequestError, CryptographyError, NotFoundError } from "@app/lib/errors";
import { ProcessedPermissionRules } from "@app/lib/knex/permission-filter-utils";
import { OrgServiceActor } from "@app/lib/types";
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -715,11 +716,21 @@ export const AcmeCertificateAuthorityFns = ({
return castDbEntryToAcmeCertificateAuthority(updatedCa);
};
const listCertificateAuthorities = async ({ projectId }: { projectId: string }) => {
const cas = await certificateAuthorityDAL.findWithAssociatedCa({
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
[`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.ACME
});
const listCertificateAuthorities = async ({
projectId,
permissionFilters
}: {
projectId: string;
permissionFilters?: ProcessedPermissionRules;
}) => {
const cas = await certificateAuthorityDAL.findWithAssociatedCa(
{
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
[`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.ACME
},
{},
permissionFilters
);
return cas.map(castDbEntryToAcmeCertificateAuthority);
};
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts
+16 -5
View File
@@ -5,6 +5,7 @@ import RE2 from "re2";
import { TableName } from "@app/db/schemas";
import { crypto } from "@app/lib/crypto/cryptography";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { ProcessedPermissionRules } from "@app/lib/knex/permission-filter-utils";
import { ms } from "@app/lib/ms";
import { OrgServiceActor } from "@app/lib/types";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -798,11 +799,21 @@ export const AzureAdCsCertificateAuthorityFns = ({
return castDbEntryToAzureAdCsCertificateAuthority(updatedCa);
};
const listCertificateAuthorities = async ({ projectId }: { projectId: string }) => {
const cas = await certificateAuthorityDAL.findWithAssociatedCa({
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
[`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.AZURE_AD_CS
});
const listCertificateAuthorities = async ({
projectId,
permissionFilters
}: {
projectId: string;
permissionFilters?: ProcessedPermissionRules;
}) => {
const cas = await certificateAuthorityDAL.findWithAssociatedCa(
{
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
[`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.AZURE_AD_CS
},
{},
permissionFilters
);
return cas.map(castDbEntryToAzureAdCsCertificateAuthority);
};
backend/src/services/certificate-authority/certificate-authority-dal.ts
+14 -1
View File
@@ -4,6 +4,10 @@ import { TDbClient } from "@app/db";
import { CertificateAuthoritiesSchema, TableName, TCertificateAuthorities } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import { buildFindFilter, ormify, selectAllTableCols, TFindOpt } from "@app/lib/knex";
import {
applyProcessedPermissionRulesToQuery,
type ProcessedPermissionRules
} from "@app/lib/knex/permission-filter-utils";
export type TCertificateAuthorityDALFactory = ReturnType<typeof certificateAuthorityDALFactory>;
@@ -220,10 +224,11 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
const findWithAssociatedCa = async (
filter: Parameters<(typeof caOrm)["find"]>[0] & { dn?: string; type?: string; serialNumber?: string },
{ offset, limit, sort = [["createdAt", "desc"]] }: TFindOpt<TCertificateAuthorities> = {},
permissionFilters?: ProcessedPermissionRules,
tx?: Knex
) => {
try {
const query = (tx || db.replicaNode())(TableName.CertificateAuthority)
let query = (tx || db.replicaNode())(TableName.CertificateAuthority)
.leftJoin(
TableName.InternalCertificateAuthority,
`${TableName.CertificateAuthority}.id`,
@@ -268,6 +273,14 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
);
if (permissionFilters) {
query = applyProcessedPermissionRulesToQuery(
query,
TableName.CertificateAuthority,
permissionFilters
) as typeof query;
}
if (limit) void query.limit(limit);
if (offset) void query.offset(offset);
if (sort) {
backend/src/services/certificate-authority/certificate-authority-service.ts
+68 -38
View File
@@ -1,8 +1,12 @@
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import { ActionProjectType, TableName } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import {
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { OrgServiceActor } from "@app/lib/types";
@@ -142,8 +146,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Create,
subject(ProjectPermissionSub.CertificateAuthorities, { name })
);
if (type === CaType.INTERNAL) {
@@ -212,8 +216,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, { name: certificateAuthority.name })
);
if (type === CaType.INTERNAL) {
@@ -227,6 +231,7 @@ export const certificateAuthorityServiceFactory = ({
id: certificateAuthority.id,
type,
enableDirectIssuance: certificateAuthority.enableDirectIssuance,
subject: ProjectPermissionSub.CertificateAuthorities,
name: certificateAuthority.name,
projectId: certificateAuthority.projectId,
configuration: certificateAuthority.internalCa,
@@ -275,8 +280,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, { name: caName })
);
if (type === CaType.INTERNAL) {
@@ -328,15 +333,25 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionCertificateAuthorityActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
const permissionFilters = getProcessedPermissionRules(
permission,
ProjectPermissionCertificateAuthorityActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
if (type === CaType.INTERNAL) {
const cas = await certificateAuthorityDAL.findWithAssociatedCa({
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
$notNull: [`${TableName.InternalCertificateAuthority}.id` as "id"]
});
const cas = await certificateAuthorityDAL.findWithAssociatedCa(
{
[`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
$notNull: [`${TableName.InternalCertificateAuthority}.id` as "id"]
},
{},
permissionFilters
);
return cas
.filter((ca): ca is typeof ca & { internalCa: NonNullable<typeof ca.internalCa> } => Boolean(ca.internalCa))
@@ -352,11 +367,11 @@ export const certificateAuthorityServiceFactory = ({
}
if (type === CaType.ACME) {
return acmeFns.listCertificateAuthorities({ projectId });
return acmeFns.listCertificateAuthorities({ projectId, permissionFilters });
}
if (type === CaType.AZURE_AD_CS) {
return azureAdCsFns.listCertificateAuthorities({ projectId });
return azureAdCsFns.listCertificateAuthorities({ projectId, permissionFilters });
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
@@ -383,8 +398,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Edit,
subject(ProjectPermissionSub.CertificateAuthorities, { name: certificateAuthority.name })
);
if (type === CaType.INTERNAL) {
@@ -459,8 +474,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Delete,
subject(ProjectPermissionSub.CertificateAuthorities, { name: certificateAuthority.name })
);
if (!certificateAuthority.internalCa?.id && type === CaType.INTERNAL) {
@@ -524,8 +539,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Edit,
subject(ProjectPermissionSub.CertificateAuthorities, { name: certificateAuthority.name })
);
if (type === CaType.INTERNAL) {
@@ -606,8 +621,8 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Delete,
subject(ProjectPermissionSub.CertificateAuthorities, { name: certificateAuthority.name })
);
if (!certificateAuthority.internalCa?.id && type === CaType.INTERNAL) {
@@ -662,6 +677,13 @@ export const certificateAuthorityServiceFactory = ({
actorAuthMethod: OrgServiceActor["authMethod"];
actorOrgId?: string;
}) => {
const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!certificateAuthority)
throw new NotFoundError({
message: `Could not find certificate authority with id "${caId}"`
});
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
@@ -672,8 +694,10 @@ export const certificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, {
name: certificateAuthority.name
})
);
return azureAdCsFns.getTemplates({
@@ -687,32 +711,38 @@ export const certificateAuthorityServiceFactory = ({
actor,
actorId,
actorAuthMethod,
actorOrgId
actorOrgId,
isInternal
}: {
caId: string;
actor: OrgServiceActor["type"];
actorId: string;
actorAuthMethod: OrgServiceActor["authMethod"];
actorOrgId?: string;
isInternal?: boolean;
}) => {
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
if (!ca) {
throw new NotFoundError({ message: "CA not found" });
}
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
if (!isInternal) {
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId: ca.projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})
);
}
return ca;
};
backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts
+21 -21
View File
@@ -7,8 +7,8 @@ import { Knex } from "knex";
import { ActionProjectType, TableName, TCertificateAuthorities, TCertificateTemplates } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import {
ProjectPermissionActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionPkiTemplateActions,
ProjectPermissionSub
@@ -174,8 +174,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Create,
subject(ProjectPermissionSub.CertificateAuthorities, { name: commonName })
);
} else {
projectId = dto.projectId;
@@ -357,8 +357,8 @@ export const internalCertificateAuthorityServiceFactory = ({
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
return expandInternalCa(ca);
@@ -383,8 +383,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Edit,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
}
@@ -416,8 +416,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Delete,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Delete,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
await certificateAuthorityDAL.deleteById(ca.id);
@@ -442,8 +442,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Create,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
if (ca.internalCa.type === InternalCaType.ROOT)
@@ -506,8 +506,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Renew,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
@@ -793,8 +793,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
const caCertChains = await getCaCertChains({
@@ -830,8 +830,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
const { caCert, caCertChain, serialNumber } = await getCaCertChain({
@@ -911,8 +911,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.SignIntermediate,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
@@ -1059,8 +1059,8 @@ export const internalCertificateAuthorityServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
ProjectPermissionCertificateAuthorityActions.Create,
subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })
);
if (ca.internalCa.parentCaId) {
backend/src/services/certificate-profile/certificate-profile-dal.ts
+23 -1
View File
@@ -4,6 +4,10 @@ import { TDbClient } from "@app/db";
import { TableName } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import { ormify, selectAllTableCols } from "@app/lib/knex";
import {
applyProcessedPermissionRulesToQuery,
type ProcessedPermissionRules
} from "@app/lib/knex/permission-filter-utils";
import {
EnrollmentType,
@@ -276,6 +280,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
issuerType?: IssuerType;
caId?: string;
} = {},
processedRules?: ProcessedPermissionRules,
tx?: Knex
): Promise<TCertificateProfile[] | TCertificateProfileWithConfigs[]> => {
try {
@@ -308,7 +313,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
baseQuery = baseQuery.where(`${TableName.PkiCertificateProfile}.issuerType`, issuerType);
}
const query = baseQuery
let query = baseQuery
.leftJoin(
TableName.CertificateAuthority,
`${TableName.PkiCertificateProfile}.caId`,
@@ -354,6 +359,14 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
db.ref("id").withSchema(TableName.PkiAcmeEnrollmentConfig).as("acmeId")
);
if (processedRules) {
query = applyProcessedPermissionRulesToQuery(
query,
TableName.PkiCertificateProfile,
processedRules
) as typeof query;
}
const results = (await query
.orderBy(`${TableName.PkiCertificateProfile}.createdAt`, "desc")
.offset(offset)
@@ -432,6 +445,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
issuerType?: IssuerType;
caId?: string;
} = {},
processedRules?: ProcessedPermissionRules,
tx?: Knex
): Promise<number> => {
try {
@@ -459,6 +473,14 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
query = query.where({ issuerType });
}
if (processedRules) {
query = applyProcessedPermissionRulesToQuery(
query,
TableName.PkiCertificateProfile,
processedRules
) as typeof query;
}
const result = await query.count("*").first();
return parseInt((result as unknown as { count: string }).count || "0", 10);
} catch (error) {
backend/src/services/certificate-profile/certificate-profile-service.test.ts
+26 -15
View File
@@ -169,7 +169,8 @@ describe("CertificateProfileService", () => {
const mockPermissionService = {
getProjectPermission: vi.fn().mockResolvedValue({
permission: {
throwUnlessCan: vi.fn()
throwUnlessCan: vi.fn(),
rules: []
}
})
} as unknown as Pick<TPermissionServiceFactory, "getProjectPermission">;
@@ -598,13 +599,18 @@ describe("CertificateProfileService", () => {
expect(result.profiles).toEqual(mockProfiles);
expect(result.totalCount).toBe(1);
expect(mockCertificateProfileDAL.findByProjectId).toHaveBeenCalledWith("project-123", {
offset: 0,
limit: 20,
search: undefined,
enrollmentType: undefined,
caId: undefined
});
expect(mockCertificateProfileDAL.findByProjectId).toHaveBeenCalledWith(
"project-123",
{
offset: 0,
limit: 20,
search: undefined,
enrollmentType: undefined,
caId: undefined,
issuerType: undefined
},
{ allowRules: [], forbidRules: [] }
);
});
it("should list profiles with filters", async () => {
@@ -618,13 +624,18 @@ describe("CertificateProfileService", () => {
caId: "ca-123"
});
expect(mockCertificateProfileDAL.findByProjectId).toHaveBeenCalledWith("project-123", {
offset: 10,
limit: 5,
search: "test",
enrollmentType: EnrollmentType.API,
caId: "ca-123"
});
expect(mockCertificateProfileDAL.findByProjectId).toHaveBeenCalledWith(
"project-123",
{
offset: 10,
limit: 5,
search: "test",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
issuerType: undefined
},
{ allowRules: [], forbidRules: [] }
);
});
});
backend/src/services/certificate-profile/certificate-profile-service.ts
+78 -35
View File
@@ -1,4 +1,4 @@
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import { ActionProjectType } from "@app/db/schemas";
@@ -10,6 +10,7 @@ import {
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { buildUrl } from "@app/ee/services/pki-acme/pki-acme-fns";
import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
import { extractX509CertFromChain } from "@app/lib/certificates/extract-certificate";
import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
@@ -299,7 +300,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Create,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: data.slug
})
);
const project = await projectDAL.findById(projectId);
@@ -454,7 +457,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Edit,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: existingProfile.slug
})
);
if (data.certificateTemplateId) {
@@ -577,7 +582,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
const converted = convertDalToService(profile);
@@ -613,7 +620,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
if (profile.estConfig && profile.estConfig.caChain) {
@@ -687,7 +696,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug
})
);
const profile = await certificateProfileDAL.findBySlugAndProjectId(slug, projectId);
@@ -739,21 +750,35 @@ export const certificateProfileServiceFactory = ({
ProjectPermissionSub.CertificateProfiles
);
const profiles = await certificateProfileDAL.findByProjectId(projectId, {
offset,
limit,
search,
enrollmentType,
issuerType,
caId
});
const processedRules = getProcessedPermissionRules(
permission,
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
);
const totalCount = await certificateProfileDAL.countByProjectId(projectId, {
search,
enrollmentType,
issuerType,
caId
});
const profiles = await certificateProfileDAL.findByProjectId(
projectId,
{
offset,
limit,
search,
enrollmentType,
issuerType,
caId
},
processedRules
);
const totalCount = await certificateProfileDAL.countByProjectId(
projectId,
{
search,
enrollmentType,
issuerType,
caId
},
processedRules
);
const convertedProfiles = await Promise.all(
profiles.map(async (profile) => {
@@ -838,7 +863,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Delete,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
const deletedProfile = await certificateProfileDAL.deleteById(profileId);
@@ -884,7 +911,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
const certificates = await certificateProfileDAL.getCertificatesByProfile(profileId, {
@@ -925,17 +954,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
const cert = await certificateProfileDAL.getLatestActiveCertificateForProfile(profileId);
@@ -944,6 +965,24 @@ export const certificateProfileServiceFactory = ({
return null;
}
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Read,
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.ReadPrivateKey,
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
@@ -1037,7 +1076,9 @@ export const certificateProfileServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
}
@@ -1088,7 +1129,9 @@ export const certificateProfileServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
if (profile.enrollmentType !== EnrollmentType.ACME) {
backend/src/services/certificate-request/certificate-request-service.test.ts
+69 -5
View File
@@ -10,6 +10,7 @@ import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import {
ProjectPermissionCertificateActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionSet,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
@@ -79,8 +80,8 @@ describe("CertificateRequestService", () => {
const mockPermission = {
permission: createMongoAbility<ProjectPermissionSet>([
{
action: ProjectPermissionCertificateActions.Create,
subject: ProjectPermissionSub.Certificates
action: ProjectPermissionCertificateProfileActions.IssueCert,
subject: ProjectPermissionSub.CertificateProfiles
}
])
};
@@ -224,6 +225,10 @@ describe("CertificateRequestService", () => {
{
action: ProjectPermissionCertificateActions.Read,
subject: ProjectPermissionSub.Certificates
},
{
action: ProjectPermissionCertificateActions.ReadPrivateKey,
subject: ProjectPermissionSub.Certificates
}
])
};
@@ -318,7 +323,7 @@ describe("CertificateRequestService", () => {
});
});
it("should get certificate from request successfully when private key access is denied", async () => {
it("should get certificate from request successfully when user lacks private key permission", async () => {
const mockPermission = {
permission: createMongoAbility<ProjectPermissionSet>([
{
@@ -348,7 +353,6 @@ describe("CertificateRequestService", () => {
(mockPermissionService.getProjectPermission as any).mockResolvedValue(mockPermission);
(mockCertificateRequestDAL.findByIdWithCertificate as any).mockResolvedValue(mockRequestWithCert);
(mockCertificateService.getCertBody as any).mockResolvedValue(mockCertBody);
(mockCertificateService.getCertPrivateKey as any).mockRejectedValue(new Error("Private key access denied"));
const result = await service.getCertificateFromRequest(mockGetData);
@@ -362,8 +366,68 @@ describe("CertificateRequestService", () => {
actorAuthMethod: AuthMethod.EMAIL,
actorOrgId: "550e8400-e29b-41d4-a716-446655440002"
});
expect(mockCertificateService.getCertPrivateKey).not.toHaveBeenCalled();
expect(result).toEqual({
status: CertificateRequestStatus.ISSUED,
certificate: "-----BEGIN CERTIFICATE-----\nMOCK_CERT_PEM\n-----END CERTIFICATE-----",
privateKey: null,
serialNumber: "123456",
errorMessage: null,
createdAt: mockRequestWithCert.createdAt,
updatedAt: mockRequestWithCert.updatedAt
});
});
it("should get certificate from request successfully when user has private key permission but key retrieval fails", async () => {
const mockPermission = {
permission: createMongoAbility<ProjectPermissionSet>([
{
action: ProjectPermissionCertificateActions.Read,
subject: ProjectPermissionSub.Certificates
},
{
action: ProjectPermissionCertificateActions.ReadPrivateKey,
subject: ProjectPermissionSub.Certificates
}
])
};
const mockCertificate = {
id: "550e8400-e29b-41d4-a716-446655440009",
serialNumber: "123456",
commonName: "test.example.com"
};
const mockRequestWithCert = {
id: "550e8400-e29b-41d4-a716-446655440005",
projectId: "550e8400-e29b-41d4-a716-446655440003",
status: CertificateRequestStatus.ISSUED,
certificate: mockCertificate,
errorMessage: null,
createdAt: new Date(),
updatedAt: new Date()
};
const mockCertBody = {
certificate: "-----BEGIN CERTIFICATE-----\nMOCK_CERT_PEM\n-----END CERTIFICATE-----"
};
(mockPermissionService.getProjectPermission as any).mockResolvedValue(mockPermission);
(mockCertificateRequestDAL.findByIdWithCertificate as any).mockResolvedValue(mockRequestWithCert);
(mockCertificateService.getCertBody as any).mockResolvedValue(mockCertBody);
(mockCertificateService.getCertPrivateKey as any).mockRejectedValue(new Error("Private key not found"));
const result = await service.getCertificateFromRequest(mockGetData);
expect(mockCertificateRequestDAL.findByIdWithCertificate).toHaveBeenCalledWith(
"550e8400-e29b-41d4-a716-446655440005"
);
expect(mockCertificateService.getCertBody).toHaveBeenCalledWith({
id: "550e8400-e29b-41d4-a716-446655440009",
actor: ActorType.USER,
actorId: "550e8400-e29b-41d4-a716-446655440001",
actorAuthMethod: AuthMethod.EMAIL,
actorOrgId: "550e8400-e29b-41d4-a716-446655440002"
});
expect(mockCertificateService.getCertPrivateKey).toHaveBeenCalledWith({
id: "550e8400-e29b-41d4-a716-446655440008",
id: "550e8400-e29b-41d4-a716-446655440009",
actor: ActorType.USER,
actorId: "550e8400-e29b-41d4-a716-446655440001",
actorAuthMethod: AuthMethod.EMAIL,
backend/src/services/certificate-request/certificate-request-service.ts
+21 -15
View File
@@ -6,6 +6,7 @@ import { ActionProjectType } from "@app/db/schemas";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import {
ProjectPermissionCertificateActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -110,8 +111,8 @@ export const certificateRequestServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Create,
ProjectPermissionSub.Certificates
ProjectPermissionCertificateProfileActions.IssueCert,
ProjectPermissionSub.CertificateProfiles
);
}
@@ -217,20 +218,25 @@ export const certificateRequestServiceFactory = ({
actorOrgId
});
// Try to get private key (may fail if user doesn't have permission)
const canReadPrivateKey = permission.can(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
);
let privateKey: string | null = null;
try {
const certPrivateKey = await certificateService.getCertPrivateKey({
id: certificateRequest.certificate.id,
actor,
actorId,
actorAuthMethod,
actorOrgId
});
privateKey = certPrivateKey.certPrivateKey;
} catch (error) {
// Private key access denied - continue without it
privateKey = null;
if (canReadPrivateKey) {
try {
const certPrivateKey = await certificateService.getCertPrivateKey({
id: certificateRequest.certificate.id,
actor,
actorId,
actorAuthMethod,
actorOrgId
});
privateKey = certPrivateKey.certPrivateKey;
} catch (error) {
privateKey = null;
}
}
return {
backend/src/services/certificate-template-v2/certificate-template-v2-dal.ts
+22
View File
@@ -5,6 +5,10 @@ import { TableName } from "@app/db/schemas";
import { TPkiCertificateTemplatesV2Insert } from "@app/db/schemas/pki-certificate-templates-v2";
import { DatabaseError } from "@app/lib/errors";
import { ormify } from "@app/lib/knex";
import {
applyProcessedPermissionRulesToQuery,
type ProcessedPermissionRules
} from "@app/lib/knex/permission-filter-utils";
import {
TCertificateTemplateV2,
@@ -133,6 +137,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
limit?: number;
search?: string;
} = {},
processedRules?: ProcessedPermissionRules,
tx?: Knex
) => {
try {
@@ -146,6 +151,14 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
});
}
if (processedRules) {
query = applyProcessedPermissionRulesToQuery(
query,
TableName.PkiCertificateTemplateV2,
processedRules
) as typeof query;
}
const certificateTemplatesV2 = await query.orderBy("createdAt", "desc").offset(offset).limit(limit);
return certificateTemplatesV2.map((template: Record<string, unknown>) => parseJsonFields(template));
@@ -159,6 +172,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
options: {
search?: string;
} = {},
processedRules?: ProcessedPermissionRules,
tx?: Knex
) => {
try {
@@ -172,6 +186,14 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
});
}
if (processedRules) {
query = applyProcessedPermissionRulesToQuery(
query,
TableName.PkiCertificateTemplateV2,
processedRules
) as typeof query;
}
const result = await query.count("*").first();
return parseInt((result as unknown as { count: string }).count || "0", 10);
} catch (error) {
backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts
+32 -16
View File
@@ -267,14 +267,22 @@ describe("CertificateTemplateV2Service", () => {
limit: 20
});
expect(mockCertificateTemplateV2DAL.findByProjectId).toHaveBeenCalledWith("project-123", {
offset: 0,
limit: 20,
search: undefined
});
expect(mockCertificateTemplateV2DAL.countByProjectId).toHaveBeenCalledWith("project-123", {
search: undefined
});
expect(mockCertificateTemplateV2DAL.findByProjectId).toHaveBeenCalledWith(
"project-123",
{
offset: 0,
limit: 20,
search: undefined
},
{ allowRules: [], forbidRules: [] }
);
expect(mockCertificateTemplateV2DAL.countByProjectId).toHaveBeenCalledWith(
"project-123",
{
search: undefined
},
{ allowRules: [], forbidRules: [] }
);
expect(result).toEqual({ templates, totalCount });
});
@@ -291,14 +299,22 @@ describe("CertificateTemplateV2Service", () => {
search: "web server"
});
expect(mockCertificateTemplateV2DAL.findByProjectId).toHaveBeenCalledWith("project-123", {
offset: 0,
limit: 20,
search: "web server"
});
expect(mockCertificateTemplateV2DAL.countByProjectId).toHaveBeenCalledWith("project-123", {
search: "web server"
});
expect(mockCertificateTemplateV2DAL.findByProjectId).toHaveBeenCalledWith(
"project-123",
{
offset: 0,
limit: 20,
search: "web server"
},
{ allowRules: [], forbidRules: [] }
);
expect(mockCertificateTemplateV2DAL.countByProjectId).toHaveBeenCalledWith(
"project-123",
{
search: "web server"
},
{ allowRules: [], forbidRules: [] }
);
});
});
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
+34 -19
View File
@@ -1,4 +1,4 @@
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import slugify from "@sindresorhus/slugify";
import RE2 from "re2";
@@ -8,6 +8,7 @@ import {
ProjectPermissionPkiTemplateActions,
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -77,12 +78,12 @@ export const certificateTemplateV2ServiceFactory = ({
};
const validateSubjectAttributePolicy = (
subject: Array<{ type: string; allowed?: string[]; required?: string[]; denied?: string[] }>
subjectAttributes: Array<{ type: string; allowed?: string[]; required?: string[]; denied?: string[] }>
) => {
if (!subject || subject.length === 0) return;
if (!subjectAttributes || subjectAttributes.length === 0) return;
// Validate each subject attribute policy
for (const attr of subject) {
for (const attr of subjectAttributes) {
// Ensure at least one field is provided
if (!attr.allowed && !attr.required && !attr.denied) {
throw new ForbiddenRequestError({
@@ -634,7 +635,9 @@ export const certificateTemplateV2ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Create,
ProjectPermissionSub.CertificateTemplates
subject(ProjectPermissionSub.CertificateTemplates, {
name: data.name
})
);
if (!data) {
@@ -711,7 +714,9 @@ export const certificateTemplateV2ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Edit,
ProjectPermissionSub.CertificateTemplates
subject(ProjectPermissionSub.CertificateTemplates, {
name: existingTemplate.name
})
);
const consolidatedData = {
@@ -784,7 +789,9 @@ export const certificateTemplateV2ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Read,
ProjectPermissionSub.CertificateTemplates
subject(ProjectPermissionSub.CertificateTemplates, {
name: template.name
})
);
}
@@ -815,16 +822,17 @@ export const certificateTemplateV2ServiceFactory = ({
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Read,
ProjectPermissionSub.CertificateTemplates
);
const template = await certificateTemplateV2DAL.findByNameAndProjectId(slug, projectId);
if (!template) {
throw new NotFoundError({ message: "Certificate template not found" });
}
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Read,
subject(ProjectPermissionSub.CertificateTemplates, {
name: template.name
})
);
return template;
};
@@ -864,13 +872,18 @@ export const certificateTemplateV2ServiceFactory = ({
ProjectPermissionSub.CertificateTemplates
);
const templates = await certificateTemplateV2DAL.findByProjectId(projectId, {
offset,
limit,
search
});
const processedRules = getProcessedPermissionRules(
permission,
ProjectPermissionPkiTemplateActions.Read,
ProjectPermissionSub.CertificateTemplates
);
const templates = await certificateTemplateV2DAL.findByProjectId(
projectId,
{ offset, limit, search },
processedRules
);
const totalCount = await certificateTemplateV2DAL.countByProjectId(projectId, { search });
const totalCount = await certificateTemplateV2DAL.countByProjectId(projectId, { search }, processedRules);
return {
templates,
@@ -907,7 +920,9 @@ export const certificateTemplateV2ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Delete,
ProjectPermissionSub.CertificateTemplates
subject(ProjectPermissionSub.CertificateTemplates, {
name: template.name
})
);
const isInUse = await certificateTemplateV2DAL.isTemplateInUse(templateId);
backend/src/services/certificate-v3/certificate-v3-service.ts
+55 -10
View File
@@ -1,4 +1,4 @@
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import { randomUUID } from "crypto";
import RE2 from "re2";
@@ -167,7 +167,9 @@ const validateProfileAndPermissions = async (
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.IssueCert,
ProjectPermissionSub.CertificateProfiles
subject(ProjectPermissionSub.CertificateProfiles, {
slug: profile.slug
})
);
return profile;
@@ -999,11 +1001,27 @@ export const certificateV3ServiceFactory = ({
});
}
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId: profile.projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
const canReadPrivateKey = permission.can(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
);
const privateKeyForResponse = canReadPrivateKey ? selfSignedResult.privateKey.toString("utf8") : undefined;
return {
certificate: selfSignedResult.certificate.toString("utf8"),
issuingCaCertificate: "",
certificateChain: selfSignedResult.certificate.toString("utf8"),
privateKey: selfSignedResult.privateKey.toString("utf8"),
privateKey: privateKeyForResponse,
serialNumber: selfSignedResult.serialNumber,
certificateId: certificateData.id,
certificateRequestId,
@@ -1100,11 +1118,28 @@ export const certificateV3ServiceFactory = ({
finalCertificateChain = removeRootCaFromChain(finalCertificateChain);
}
// Check if user has permission to read private key
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId: profile.projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
const canReadPrivateKey = permission.can(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
);
const privateKeyForResponse = canReadPrivateKey ? bufferToString(privateKey) : undefined;
return {
certificate: bufferToString(certificate),
issuingCaCertificate: bufferToString(issuingCaCertificate),
certificateChain: finalCertificateChain,
privateKey: bufferToString(privateKey),
privateKey: privateKeyForResponse,
serialNumber,
certificateId: cert.id,
certificateRequestId,
@@ -1489,10 +1524,12 @@ export const certificateV3ServiceFactory = ({
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.IssueCert,
ProjectPermissionSub.CertificateProfiles
);
if (profile) {
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateProfileActions.IssueCert,
subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })
);
}
}
const issuerType = profile?.issuerType || (originalCert.caId ? IssuerType.CA : IssuerType.SELF_SIGNED);
@@ -1869,7 +1906,11 @@ export const certificateV3ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Edit,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames ?? undefined,
serialNumber: certificate.serialNumber
})
);
if (!certificate.profileId) {
@@ -1972,7 +2013,11 @@ export const certificateV3ServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Edit,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames ?? undefined,
serialNumber: certificate.serialNumber
})
);
if (!certificate.profileId) {
backend/src/services/certificate/certificate-dal.ts
+16 -2
View File
@@ -4,6 +4,10 @@ import { TDbClient } from "@app/db";
import { TableName, TCertificates } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import { ormify, selectAllTableCols } from "@app/lib/knex";
import {
applyProcessedPermissionRulesToQuery,
type ProcessedPermissionRules
} from "@app/lib/knex/permission-filter-utils";
import { CertStatus } from "./certificate-types";
@@ -140,7 +144,8 @@ export const certificateDALFactory = (db: TDbClient) => {
const findActiveCertificatesForSync = async (
filter: Partial<TCertificates & { friendlyName?: string; commonName?: string }>,
options?: { limit?: number; offset?: number }
options?: { limit?: number; offset?: number },
permissionFilters?: ProcessedPermissionRules
): Promise<(TCertificates & { hasPrivateKey: boolean })[]> => {
try {
let query = db
@@ -163,6 +168,10 @@ export const certificateDALFactory = (db: TDbClient) => {
}
});
if (permissionFilters) {
query = applyProcessedPermissionRulesToQuery(query, TableName.Certificate, permissionFilters) as typeof query;
}
if (options?.offset) {
query = query.offset(options.offset);
}
@@ -267,7 +276,8 @@ export const certificateDALFactory = (db: TDbClient) => {
const findWithPrivateKeyInfo = async (
filter: Partial<TCertificates & { friendlyName?: string; commonName?: string }>,
options?: { offset?: number; limit?: number; sort?: [string, "asc" | "desc"][] }
options?: { offset?: number; limit?: number; sort?: [string, "asc" | "desc"][] },
permissionFilters?: ProcessedPermissionRules
): Promise<(TCertificates & { hasPrivateKey: boolean })[]> => {
try {
let query = db
@@ -287,6 +297,10 @@ export const certificateDALFactory = (db: TDbClient) => {
}
});
if (permissionFilters) {
query = applyProcessedPermissionRulesToQuery(query, TableName.Certificate, permissionFilters) as typeof query;
}
if (options?.offset) {
query = query.offset(options.offset);
}
backend/src/services/certificate/certificate-service.ts
+50 -10
View File
@@ -1,5 +1,5 @@
/* eslint-disable no-await-in-loop */
import { ForbiddenError } from "@casl/ability";
import { ForbiddenError, subject } from "@casl/ability";
import * as x509 from "@peculiar/x509";
import { ActionProjectType } from "@app/db/schemas";
@@ -108,7 +108,11 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
return {
@@ -140,7 +144,11 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
const { certPrivateKey } = await getCertificateCredentials({
@@ -174,7 +182,11 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Delete,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
const deletedCert = await certificateDAL.deleteById(cert.id);
@@ -234,7 +246,13 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Delete,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber,
friendlyName: cert.friendlyName,
status: cert.status
})
);
if (cert.status === CertStatus.REVOKED) throw new Error("Certificate already revoked");
@@ -309,7 +327,11 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber
})
);
const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
@@ -397,7 +419,7 @@ export const certificateServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Create,
ProjectPermissionCertificateActions.Import,
ProjectPermissionSub.Certificates
);
@@ -610,11 +632,23 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber,
friendlyName: cert.friendlyName,
status: cert.status
})
);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber,
friendlyName: cert.friendlyName,
status: cert.status
})
);
const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
@@ -726,7 +760,13 @@ export const certificateServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionCertificateActions.ReadPrivateKey,
ProjectPermissionSub.Certificates
subject(ProjectPermissionSub.Certificates, {
commonName: cert.commonName,
altNames: cert.altNames ?? undefined,
serialNumber: cert.serialNumber,
friendlyName: cert.friendlyName,
status: cert.status
})
);
// Get certificate bundle (certificate, chain, private key)
backend/src/services/pki-sync/pki-sync-dal.ts
+23 -4
View File
@@ -4,6 +4,10 @@ import { TDbClient } from "@app/db";
import { TableName, TPkiSyncs } from "@app/db/schemas";
import { DatabaseError } from "@app/lib/errors";
import { buildFindFilter, ormify, prependTableNameToFindFilter, selectAllTableCols } from "@app/lib/knex";
import {
applyProcessedPermissionRulesToQuery,
type ProcessedPermissionRules
} from "@app/lib/knex/permission-filter-utils";
import { PkiSync } from "./pki-sync-enums";
@@ -45,13 +49,15 @@ const basePkiSyncQuery = ({ filter, db, tx }: { db: TDbClient; filter?: PkiSyncF
const basePkiSyncWithSubscriberQuery = ({
filter,
db,
tx
tx,
processedRules
}: {
db: TDbClient;
filter?: PkiSyncFindFilter;
tx?: Knex;
processedRules?: ProcessedPermissionRules;
}) => {
const query = (tx || db.replicaNode())(TableName.PkiSync)
let query = (tx || db.replicaNode())(TableName.PkiSync)
.leftJoin(TableName.AppConnection, `${TableName.PkiSync}.connectionId`, `${TableName.AppConnection}.id`)
.leftJoin(TableName.PkiSubscriber, `${TableName.PkiSync}.subscriberId`, `${TableName.PkiSubscriber}.id`)
.select(selectAllTableCols(TableName.PkiSync))
@@ -82,6 +88,10 @@ const basePkiSyncWithSubscriberQuery = ({
void query.where(buildFindFilter(prependTableNameToFindFilter(TableName.PkiSync, filter)));
}
if (processedRules) {
query = applyProcessedPermissionRulesToQuery(query, TableName.PkiSync, processedRules) as typeof query;
}
return query;
};
@@ -184,9 +194,18 @@ export const pkiSyncDALFactory = (db: TDbClient) => {
}
};
const findByProjectIdWithSubscribers = async (projectId: string, tx?: Knex) => {
const findByProjectIdWithSubscribers = async (
projectId: string,
processedRules?: ProcessedPermissionRules,
tx?: Knex
) => {
try {
const pkiSyncs = await basePkiSyncWithSubscriberQuery({ filter: { projectId }, db, tx });
const pkiSyncs = await basePkiSyncWithSubscriberQuery({
filter: { projectId },
db,
tx,
processedRules
});
return pkiSyncs.map(expandPkiSyncWithSubscriber);
} catch (error) {
throw new DatabaseError({ error, name: "Find By Project ID With Subscribers - PKI Sync" });
backend/src/services/pki-sync/pki-sync-service.ts
+60 -25
View File
@@ -4,6 +4,7 @@ import { ActionProjectType, TCertificateSyncs } from "@app/db/schemas";
import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
import { ProjectPermissionPkiSyncActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
import { OrgServiceActor } from "@app/lib/types";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
@@ -145,9 +146,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Create,
subscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: subscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: subscriber?.name,
name
})
);
// Get the destination app type based on PKI sync destination
@@ -235,9 +237,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Edit,
currentSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: currentSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: currentSubscriber?.name,
name: pkiSync.name
})
);
if (name && name !== pkiSync.name) {
@@ -331,9 +334,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Delete,
pkiSyncSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: pkiSyncSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: pkiSyncSubscriber?.name,
name: pkiSync.name
})
);
return pkiSyncDAL.deleteById(id);
@@ -354,7 +358,13 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionPkiSyncActions.Read, ProjectPermissionSub.PkiSyncs);
const pkiSyncsWithSubscribers = await pkiSyncDAL.findByProjectIdWithSubscribers(projectId);
const processedRules = getProcessedPermissionRules(
permission,
ProjectPermissionPkiSyncActions.Read,
ProjectPermissionSub.PkiSyncs
);
const pkiSyncsWithSubscribers = await pkiSyncDAL.findByProjectIdWithSubscribers(projectId, processedRules);
if (certificateId) {
const syncsWithCertificateInfo = await Promise.all(
@@ -406,9 +416,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Read,
findSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: findSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: findSubscriber?.name,
name: pkiSync.name
})
);
const result = {
@@ -442,9 +453,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.SyncCertificates,
syncSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: syncSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: syncSubscriber?.name,
name: pkiSync.name
})
);
await pkiSyncQueue.queuePkiSyncSyncCertificatesById({ syncId: id });
@@ -483,9 +495,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.ImportCertificates,
importSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: importSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: importSubscriber?.name,
name: pkiSync.name
})
);
await pkiSyncQueue.queuePkiSyncImportCertificatesById({ syncId: id });
@@ -516,9 +529,10 @@ export const pkiSyncServiceFactory = ({
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.RemoveCertificates,
removeSubscriber
? subject(ProjectPermissionSub.PkiSyncs, { subscriberName: removeSubscriber.name })
: ProjectPermissionSub.PkiSyncs
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: removeSubscriber?.name,
name: pkiSync.name
})
);
await pkiSyncQueue.queuePkiSyncRemoveCertificatesById({ syncId: id });
@@ -549,7 +563,18 @@ export const pkiSyncServiceFactory = ({
projectId: pkiSync.projectId
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionPkiSyncActions.Edit, ProjectPermissionSub.PkiSyncs);
let pkiSyncSubscriber;
if (pkiSync.subscriberId) {
pkiSyncSubscriber = await pkiSubscriberDAL.findById(pkiSync.subscriberId);
}
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Edit,
subject(ProjectPermissionSub.PkiSyncs, {
subscriberName: pkiSyncSubscriber?.name,
name: pkiSync.name
})
);
await validateCertificatesProjectOwnership(certificateIds, pkiSync.projectId);
@@ -588,7 +613,12 @@ export const pkiSyncServiceFactory = ({
projectId: pkiSync.projectId
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionPkiSyncActions.Edit, ProjectPermissionSub.PkiSyncs);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Edit,
subject(ProjectPermissionSub.PkiSyncs, {
name: pkiSync.name
})
);
const removedCount = await certificateSyncDAL.removeCertificates(pkiSyncId, certificateIds);
@@ -626,7 +656,12 @@ export const pkiSyncServiceFactory = ({
projectId: pkiSync.projectId
});
ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionPkiSyncActions.Read, ProjectPermissionSub.PkiSyncs);
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiSyncActions.Read,
subject(ProjectPermissionSub.PkiSyncs, {
name: pkiSync.name
})
);
const result = await certificateSyncDAL.findWithDetails({
pkiSyncId,
backend/src/services/project/project-service.ts
+28 -23
View File
@@ -20,6 +20,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
import {
ProjectPermissionActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionMemberActions,
ProjectPermissionPkiSubscriberActions,
ProjectPermissionPkiTemplateActions,
@@ -39,6 +40,7 @@ import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certific
import { TSshHostDALFactory } from "@app/ee/services/ssh-host/ssh-host-dal";
import { TSshHostGroupDALFactory } from "@app/ee/services/ssh-host-group/ssh-host-group-dal";
import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
import { getProcessedPermissionRules } from "@app/lib/casl/permission-filter-utils";
import { getConfig } from "@app/lib/config/env";
import { crypto } from "@app/lib/crypto/cryptography";
import { DatabaseErrorCode } from "@app/lib/error-codes";
@@ -911,7 +913,7 @@ export const projectServiceFactory = ({
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionCertificateAuthorityActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
@@ -963,35 +965,38 @@ export const projectServiceFactory = ({
ProjectPermissionSub.Certificates
);
const regularFilters = {
projectId,
...(friendlyName && { friendlyName }),
...(commonName && { commonName })
};
const permissionFilters = getProcessedPermissionRules(
permission,
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
);
const certificates = forPkiSync
? await certificateDAL.findActiveCertificatesForSync(
{
projectId,
...(friendlyName && { friendlyName }),
...(commonName && { commonName })
},
{ offset, limit }
)
? await certificateDAL.findActiveCertificatesForSync(regularFilters, { offset, limit }, permissionFilters)
: await certificateDAL.findWithPrivateKeyInfo(
regularFilters,
{
projectId,
...(friendlyName && { friendlyName }),
...(commonName && { commonName })
offset,
limit,
sort: [["notAfter", "desc"]]
},
{ offset, limit, sort: [["notAfter", "desc"]] }
permissionFilters
);
const countFilter = {
projectId,
...(regularFilters.friendlyName && { friendlyName: String(regularFilters.friendlyName) }),
...(regularFilters.commonName && { commonName: String(regularFilters.commonName) })
};
const count = forPkiSync
? await certificateDAL.countActiveCertificatesForSync({
projectId,
friendlyName,
commonName
})
: await certificateDAL.countCertificatesInProject({
projectId,
friendlyName,
commonName
});
? await certificateDAL.countActiveCertificatesForSync(countFilter)
: await certificateDAL.countCertificatesInProject(countFilter);
return {
certificates,
docs/docs.json
-2
View File
@@ -2493,8 +2493,6 @@
"pages": [
"api-reference/endpoints/certificates/list",
"api-reference/endpoints/certificates/read",
"api-reference/endpoints/certificates/issue-certificate",
"api-reference/endpoints/certificates/sign-certificate",
"api-reference/endpoints/certificates/renew",
"api-reference/endpoints/certificates/update-config",
"api-reference/endpoints/certificates/revoke",
frontend/src/context/ProjectPermissionContext/index.tsx
+2
View File
@@ -4,6 +4,7 @@ export {
ProjectPermissionActions,
ProjectPermissionAuditLogsActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionCmekActions,
ProjectPermissionDynamicSecretActions,
@@ -12,6 +13,7 @@ export {
ProjectPermissionKmipActions,
ProjectPermissionMemberActions,
ProjectPermissionPkiSubscriberActions,
ProjectPermissionPkiSyncActions,
ProjectPermissionPkiTemplateActions,
ProjectPermissionSshHostActions,
ProjectPermissionSub
frontend/src/context/ProjectPermissionContext/types.ts
+60 -7
View File
@@ -12,7 +12,9 @@ export enum ProjectPermissionCertificateActions {
Create = "create",
Edit = "edit",
Delete = "delete",
ReadPrivateKey = "read-private-key"
List = "list",
ReadPrivateKey = "read-private-key",
Import = "import"
}
export enum ProjectPermissionSecretActions {
@@ -67,6 +69,7 @@ export enum ProjectPermissionPkiSyncActions {
Create = "create",
Edit = "edit",
Delete = "delete",
List = "list",
SyncCertificates = "sync-certificates",
ImportCertificates = "import-certificates",
RemoveCertificates = "remove-certificates"
@@ -128,13 +131,25 @@ export enum ProjectPermissionPkiTemplateActions {
ListCerts = "list-certs"
}
export enum ProjectPermissionCertificateProfileActions {
export enum ProjectPermissionCertificateAuthorityActions {
Read = "read",
Create = "create",
Edit = "edit",
Delete = "delete",
List = "list",
Renew = "renew",
SignIntermediate = "sign-intermediate"
}
export enum ProjectPermissionCertificateProfileActions {
Read = "read",
List = "list",
Create = "create",
Edit = "edit",
Delete = "delete",
IssueCert = "issue-cert",
RevealAcmeEabSecret = "reveal-acme-eab-secret"
RevealAcmeEabSecret = "reveal-acme-eab-secret",
RotateAcmeEabSecret = "rotate-acme-eab-secret"
}
export enum ProjectPermissionSecretRotationActions {
@@ -230,6 +245,9 @@ export type ConditionalProjectPermissionSubject =
| ProjectPermissionSub.SshHosts
| ProjectPermissionSub.PkiSubscribers
| ProjectPermissionSub.CertificateTemplates
| ProjectPermissionSub.CertificateAuthorities
| ProjectPermissionSub.Certificates
| ProjectPermissionSub.CertificateProfiles
| ProjectPermissionSub.SecretFolders
| ProjectPermissionSub.SecretImports
| ProjectPermissionSub.SecretRotation
@@ -361,7 +379,22 @@ export type SecretSyncSubjectFields = {
};
export type PkiSyncSubjectFields = {
subscriberId: string;
subscriberName: string;
name: string;
};
export type CertificateAuthoritySubjectFields = {
name: string;
};
export type CertificateSubjectFields = {
commonName?: string;
altNames?: string;
serialNumber?: string;
};
export type CertificateProfileSubjectFields = {
slug: string;
};
export type SecretRotationSubjectFields = {
@@ -457,8 +490,21 @@ export type ProjectPermissionSet =
| (ForcedSubject<ProjectPermissionSub.Identity> & IdentityManagementSubjectFields)
)
]
| [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
| [ProjectPermissionCertificateActions, ProjectPermissionSub.Certificates]
| [
ProjectPermissionCertificateAuthorityActions,
(
| ProjectPermissionSub.CertificateAuthorities
| (ForcedSubject<ProjectPermissionSub.CertificateAuthorities> &
CertificateAuthoritySubjectFields)
)
]
| [
ProjectPermissionCertificateActions,
(
| ProjectPermissionSub.Certificates
| (ForcedSubject<ProjectPermissionSub.Certificates> & CertificateSubjectFields)
)
]
| [
ProjectPermissionPkiTemplateActions,
(
@@ -484,7 +530,14 @@ export type ProjectPermissionSet =
| (ForcedSubject<ProjectPermissionSub.PkiSubscribers> & PkiSubscriberSubjectFields)
)
]
| [ProjectPermissionCertificateProfileActions, ProjectPermissionSub.CertificateProfiles]
| [
ProjectPermissionCertificateProfileActions,
(
| ProjectPermissionSub.CertificateProfiles
| (ForcedSubject<ProjectPermissionSub.CertificateProfiles> &
CertificateProfileSubjectFields)
)
]
| [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
| [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
| [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
frontend/src/context/index.tsx
+2
View File
@@ -15,6 +15,7 @@ export {
ProjectPermissionActions,
ProjectPermissionAuditLogsActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionCmekActions,
ProjectPermissionDynamicSecretActions,
@@ -23,6 +24,7 @@ export {
ProjectPermissionKmipActions,
ProjectPermissionMemberActions,
ProjectPermissionPkiSubscriberActions,
ProjectPermissionPkiSyncActions,
ProjectPermissionPkiTemplateActions,
ProjectPermissionSshHostActions,
ProjectPermissionSub,
frontend/src/hooks/api/auditLogs/constants.tsx
+3 -3
View File
@@ -72,7 +72,7 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.SIGN_INTERMEDIATE]: "Sign intermediate",
[EventType.IMPORT_CA_CERT]: "Import CA certificate",
[EventType.GET_CA_CRL]: "Get CA CRL",
[EventType.ISSUE_CERT]: "Issue certificate",
[EventType.ISSUE_CERT]: "Request certificate",
[EventType.IMPORT_CERT]: "Import certificate",
[EventType.GET_CERT]: "Get certificate",
[EventType.DELETE_CERT]: "Delete certificate",
@@ -225,7 +225,7 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.UPDATE_PKI_SUBSCRIBER]: "Update PKI subscriber",
[EventType.DELETE_PKI_SUBSCRIBER]: "Delete PKI subscriber",
[EventType.GET_PKI_SUBSCRIBER]: "Get PKI subscriber",
[EventType.ISSUE_PKI_SUBSCRIBER_CERT]: "Issue PKI subscriber certificate",
[EventType.ISSUE_PKI_SUBSCRIBER_CERT]: "Request PKI subscriber certificate",
[EventType.SIGN_PKI_SUBSCRIBER_CERT]: "Sign PKI subscriber certificate",
[EventType.AUTOMATED_RENEW_SUBSCRIBER_CERT]: "Automated renew PKI subscriber certificate",
[EventType.LIST_PKI_SUBSCRIBER_CERTS]: "List PKI subscriber certificates",
@@ -287,7 +287,7 @@ export const eventToNameMap: { [K in EventType]: string } = {
[EventType.DELETE_CERTIFICATE_PROFILE]: "Delete Certificate Profile",
[EventType.GET_CERTIFICATE_PROFILE]: "Get Certificate Profile",
[EventType.LIST_CERTIFICATE_PROFILES]: "List Certificate Profiles",
[EventType.ISSUE_CERTIFICATE_FROM_PROFILE]: "Issue Certificate From Profile",
[EventType.ISSUE_CERTIFICATE_FROM_PROFILE]: "Request Certificate From Profile",
[EventType.SIGN_CERTIFICATE_FROM_PROFILE]: "Sign Certificate From Profile",
[EventType.ORDER_CERTIFICATE_FROM_PROFILE]: "Order Certificate From Profile",
[EventType.GET_CERTIFICATE_PROFILE_LATEST_ACTIVE_BUNDLE]:
frontend/src/layouts/OrganizationLayout/components/NavBar/Navbar.tsx
+2 -3
View File
@@ -183,9 +183,6 @@ export const Navbar = () => {
}, [subscription, isBillingPage, isModalIntrusive]);
const handleOrgChange = async (orgId: string) => {
queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
queryClient.removeQueries({ queryKey: projectKeys.getAllUserProjects() });
const { token, isMfaEnabled, mfaMethod } = await selectOrganization({
organizationId: orgId
});
@@ -202,6 +199,8 @@ export const Navbar = () => {
await router.invalidate();
await navigateUserToOrg(navigate, orgId);
queryClient.removeQueries({ queryKey: subOrgQuery.queryKey });
queryClient.removeQueries({ queryKey: authKeys.getAuthToken });
queryClient.removeQueries({ queryKey: projectKeys.getAllUserProjects() });
};
const { mutateAsync } = useGetOrgTrialUrl();
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/CertAuthDetailsByIDPage.tsx
+76 -57
View File
@@ -1,4 +1,5 @@
import { Helmet } from "react-helmet";
import { subject } from "@casl/ability";
import { faChevronLeft } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { Link, useNavigate, useParams } from "@tanstack/react-router";
@@ -7,6 +8,7 @@ import { twMerge } from "tailwind-merge";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import {
AccessRestrictedBanner,
Button,
DeleteActionModal,
DropdownMenu,
@@ -18,7 +20,7 @@ import {
} from "@app/components/v2";
import { ROUTE_PATHS } from "@app/const/routes";
import {
ProjectPermissionActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub,
useOrganization,
useProject
@@ -88,63 +90,80 @@ const Page = () => {
return (
<div className="mx-auto flex flex-col justify-between bg-bunker-800 text-white">
{data && (
<div className="mx-auto mb-6 w-full max-w-8xl">
<Link
to="/organizations/$orgId/projects/cert-management/$projectId/certificate-authorities"
params={{
orgId: currentOrg.id,
projectId
}}
className="mb-4 flex items-center gap-x-2 text-sm text-mineshaft-400"
>
<FontAwesomeIcon icon={faChevronLeft} />
Certificate Authorities
</Link>
<PageHeader
scope={ProjectType.CertificateManager}
description="Manage certificate authority"
title={data.name}
>
<DropdownMenu>
<DropdownMenuTrigger asChild className="rounded-lg">
<div className="hover:text-primary-400 data-[state=open]:text-primary-400">
<Tooltip content="More options">
<Button variant="outline_bg">More</Button>
</Tooltip>
</div>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="p-1">
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.CertificateAuthorities}
<ProjectPermissionCan
I={ProjectPermissionCertificateAuthorityActions.Read}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: data.name
})}
>
{(isAllowed) =>
isAllowed ? (
<div className="mx-auto mb-6 w-full max-w-8xl">
<Link
to="/organizations/$orgId/projects/cert-management/$projectId/certificate-authorities"
params={{
orgId: currentOrg.id,
projectId
}}
className="mb-4 flex items-center gap-x-2 text-sm text-mineshaft-400"
>
{(isAllowed) => (
<DropdownMenuItem
className={twMerge(
isAllowed
? "hover:bg-red-500! hover:text-white!"
: "pointer-events-none cursor-not-allowed opacity-50"
)}
onClick={() => handlePopUpOpen("deleteCa")}
disabled={!isAllowed}
>
Delete CA
</DropdownMenuItem>
)}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
</PageHeader>
<div className="flex">
<div className="mr-4 w-96">
<CaDetailsSection caId={data.id} handlePopUpOpen={handlePopUpOpen} />
</div>
<div className="w-full">
<CaCertificatesSection caId={data.id} />
<CaCrlsSection caId={data.id} />
</div>
</div>
</div>
<FontAwesomeIcon icon={faChevronLeft} />
Certificate Authorities
</Link>
<PageHeader
scope={ProjectType.CertificateManager}
description="Manage certificate authority"
title={data.name}
>
<DropdownMenu>
<DropdownMenuTrigger asChild className="rounded-lg">
<div className="hover:text-primary-400 data-[state=open]:text-primary-400">
<Tooltip content="More options">
<Button variant="outline_bg">More</Button>
</Tooltip>
</div>
</DropdownMenuTrigger>
<DropdownMenuContent align="end" className="p-1">
<ProjectPermissionCan
I={ProjectPermissionCertificateAuthorityActions.Delete}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: data.name
})}
>
{(canDelete) => (
<DropdownMenuItem
className={twMerge(
canDelete
? "hover:bg-red-500! hover:text-white!"
: "pointer-events-none cursor-not-allowed opacity-50"
)}
onClick={() => handlePopUpOpen("deleteCa")}
disabled={!canDelete}
>
Delete CA
</DropdownMenuItem>
)}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
</PageHeader>
<div className="flex">
<div className="mr-4 w-96">
<CaDetailsSection caId={data.id} handlePopUpOpen={handlePopUpOpen} />
</div>
<div className="w-full">
<CaCertificatesSection caId={data.id} caName={data.name} />
<CaCrlsSection caId={data.id} />
</div>
</div>
</div>
) : (
<div className="container mx-auto flex h-full items-center justify-center">
<AccessRestrictedBanner />
</div>
)
}
</ProjectPermissionCan>
)}
<CaModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
<CaRenewalModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesSection.tsx
+3 -2
View File
@@ -2,9 +2,10 @@ import { CaCertificatesTable } from "./CaCertificatesTable";
type Props = {
caId: string;
caName: string;
};
export const CaCertificatesSection = ({ caId }: Props) => {
export const CaCertificatesSection = ({ caId, caName }: Props) => {
return (
<div className="w-full rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
<div className="flex items-center justify-between border-b border-mineshaft-400 pb-4">
@@ -21,7 +22,7 @@ export const CaCertificatesSection = ({ caId }: Props) => {
</IconButton> */}
</div>
<div className="py-4">
<CaCertificatesTable caId={caId} />
<CaCertificatesTable caId={caId} caName={caName} />
</div>
</div>
);
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaCertificatesSection/CaCertificatesTable.tsx
+12 -6
View File
@@ -1,3 +1,4 @@
import { subject } from "@casl/ability";
import { faCertificate, faEllipsis } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import * as x509 from "@peculiar/x509";
@@ -22,14 +23,15 @@ import {
Tr
} from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
import { ProjectPermissionCertificateAuthorityActions, ProjectPermissionSub } from "@app/context";
import { useGetCaCerts } from "@app/hooks/api";
type Props = {
caId: string;
caName: string;
};
export const CaCertificatesTable = ({ caId }: Props) => {
export const CaCertificatesTable = ({ caId, caName }: Props) => {
const { data: caCerts, isPending } = useGetCaCerts(caId);
const downloadTxtFile = (filename: string, content: string) => {
@@ -77,8 +79,10 @@ export const CaCertificatesTable = ({ caId }: Props) => {
</DropdownMenuTrigger>
<DropdownMenuContent align="start" className="p-1">
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.Identity}
I={ProjectPermissionCertificateAuthorityActions.Read}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: caName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -96,8 +100,10 @@ export const CaCertificatesTable = ({ caId }: Props) => {
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.Identity}
I={ProjectPermissionCertificateAuthorityActions.Read}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: caName
})}
>
{(isAllowed) => (
<DropdownMenuItem
frontend/src/pages/cert-manager/CertAuthDetailsByIDPage/components/CaDetailsSection.tsx
+10 -6
View File
@@ -1,10 +1,11 @@
import { subject } from "@casl/ability";
import { faCheck, faCopy, faPencil } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { format } from "date-fns";
import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, IconButton, Tooltip } from "@app/components/v2";
import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
import { ProjectPermissionCertificateAuthorityActions, ProjectPermissionSub } from "@app/context";
import { useTimedReset } from "@app/hooks";
import { CaStatus, CaType, InternalCaType, useGetCa } from "@app/hooks/api";
import { caStatusToNameMap, caTypeToNameMap } from "@app/hooks/api/ca/constants";
@@ -39,7 +40,10 @@ export const CaDetailsSection = ({ caId, handlePopUpOpen }: Props) => {
<div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
<div className="flex items-center justify-between border-b border-mineshaft-400 pb-4">
<h3 className="text-lg font-medium text-mineshaft-100">CA Details</h3>
<ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Identity}>
<ProjectPermissionCan
I={ProjectPermissionCertificateAuthorityActions.Edit}
a={subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })}
>
{(isAllowed) => {
return (
<Tooltip content="Edit CA">
@@ -154,8 +158,8 @@ export const CaDetailsSection = ({ caId, handlePopUpOpen }: Props) => {
</div>
{ca.status === CaStatus.ACTIVE && (
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Renew}
a={subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })}
>
{(isAllowed) => {
return (
@@ -190,8 +194,8 @@ export const CaDetailsSection = ({ caId, handlePopUpOpen }: Props) => {
)}
{ca.status === CaStatus.PENDING_CERTIFICATE && (
<ProjectPermissionCan
I={ProjectPermissionActions.Create}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Create}
a={subject(ProjectPermissionSub.CertificateAuthorities, { name: ca.name })}
>
{(isAllowed) => {
return (
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaSection.tsx
+7 -2
View File
@@ -4,7 +4,11 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, DeleteActionModal } from "@app/components/v2";
import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
import {
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub,
useProject
} from "@app/context";
import { CaStatus, CaType, useDeleteCa, useUpdateCa } from "@app/hooks/api";
import { usePopUp } from "@app/hooks/usePopUp";
@@ -57,7 +61,7 @@ export const CaSection = () => {
<div className="mb-4 flex justify-between">
<p className="text-xl font-medium text-mineshaft-100">Internal Certificate Authorities</p>
<ProjectPermissionCan
I={ProjectPermissionActions.Create}
I={ProjectPermissionCertificateAuthorityActions.Create}
a={ProjectPermissionSub.CertificateAuthorities}
>
{(isAllowed) => (
@@ -100,6 +104,7 @@ export const CaSection = () => {
: "This action will prevent the CA from issuing new certificates."
}
onChange={(isOpen) => handlePopUpToggle("caStatus", isOpen)}
buttonText="Confirm"
deleteKey="confirm"
onDeleteApproved={() =>
onUpdateCaStatus(popUp?.caStatus?.data as { caId: string; status: CaStatus })
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaTable.tsx
+34 -11
View File
@@ -1,3 +1,4 @@
import { subject } from "@casl/ability";
import { faBan, faCertificate, faEllipsis, faTrash } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { useNavigate } from "@tanstack/react-router";
@@ -23,10 +24,11 @@ import {
} from "@app/components/v2";
import { Badge } from "@app/components/v3";
import {
ProjectPermissionActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub,
useOrganization,
useProject
useProject,
useProjectPermission
} from "@app/context";
import { CaStatus, CaType, useListCasByTypeAndProjectId } from "@app/hooks/api";
import {
@@ -53,6 +55,7 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
const navigate = useNavigate();
const { currentOrg } = useOrganization();
const { currentProject } = useProject();
const { permission } = useProjectPermission();
const { data, isPending } = useListCasByTypeAndProjectId(CaType.INTERNAL, currentProject.id);
const cas = data as TInternalCertificateAuthority[];
@@ -75,11 +78,23 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
cas &&
cas.length > 0 &&
cas.map((ca) => {
const canReadCa = permission.can(
ProjectPermissionCertificateAuthorityActions.Read,
subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})
);
return (
<Tr
className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
className={twMerge(
"h-10 transition-colors duration-100",
canReadCa && "cursor-pointer hover:bg-mineshaft-700",
!canReadCa && "cursor-not-allowed opacity-60"
)}
key={`ca-${ca.id}`}
onClick={() =>
canReadCa &&
navigate({
to: "/organizations/$orgId/projects/cert-management/$projectId/ca/$caId",
params: {
@@ -118,8 +133,10 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
<DropdownMenuContent align="start" className="p-1">
{ca.status === CaStatus.PENDING_CERTIFICATE && (
<ProjectPermissionCan
I={ProjectPermissionActions.Create}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Create}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -143,8 +160,10 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
)}
{ca.status !== CaStatus.PENDING_CERTIFICATE && (
<ProjectPermissionCan
I={ProjectPermissionActions.Read}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Read}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -168,8 +187,10 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
)}
{(ca.status === CaStatus.ACTIVE || ca.status === CaStatus.DISABLED) && (
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Edit}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -196,8 +217,10 @@ export const CaTable = ({ handlePopUpOpen }: Props) => {
</ProjectPermissionCan>
)}
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Delete}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaSection.tsx
+6 -2
View File
@@ -4,7 +4,11 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, DeleteActionModal } from "@app/components/v2";
import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
import {
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub,
useProject
} from "@app/context";
import { CaStatus, CaType, useDeleteCa, useUpdateCa } from "@app/hooks/api";
import { usePopUp } from "@app/hooks/usePopUp";
@@ -61,7 +65,7 @@ export const ExternalCaSection = () => {
<div className="mb-4 flex justify-between">
<p className="text-xl font-medium text-mineshaft-100">External Certificate Authorities</p>
<ProjectPermissionCan
I={ProjectPermissionActions.Create}
I={ProjectPermissionCertificateAuthorityActions.Create}
a={ProjectPermissionSub.CertificateAuthorities}
>
{(isAllowed) => (
frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/ExternalCaTable.tsx
+36 -11
View File
@@ -1,3 +1,4 @@
import { subject } from "@casl/ability";
import {
faBan,
faCertificate,
@@ -26,7 +27,12 @@ import {
Tr
} from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { ProjectPermissionActions, ProjectPermissionSub, useProject } from "@app/context";
import {
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionSub,
useProject,
useProjectPermission
} from "@app/context";
import { CaStatus, CaType, useListExternalCasByProjectId } from "@app/hooks/api";
import { caStatusToNameMap, getCaStatusBadgeVariant } from "@app/hooks/api/ca/constants";
import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -45,6 +51,7 @@ type Props = {
export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
const { currentProject } = useProject();
const { permission } = useProjectPermission();
const { data, isPending } = useListExternalCasByProjectId(currentProject.id);
return (
@@ -65,17 +72,29 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
data &&
data.length > 0 &&
data.map((ca) => {
const canEditCa = permission.can(
ProjectPermissionCertificateAuthorityActions.Edit,
subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})
);
return (
<Tr
className="h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700"
className={twMerge(
"h-10 transition-colors duration-100",
canEditCa && "cursor-pointer hover:bg-mineshaft-700",
!canEditCa && "cursor-not-allowed opacity-60"
)}
key={`ca-${ca.id}`}
onClick={() => {
onClick={() =>
canEditCa &&
handlePopUpOpen("ca", {
caId: ca.id,
name: ca.name,
type: ca.type
});
}}
})
}
>
<Td>{ca.name}</Td>
<Td>{ca.type}</Td>
@@ -95,8 +114,10 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
</DropdownMenuTrigger>
<DropdownMenuContent align="start" className="p-1">
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Edit}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -120,8 +141,10 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
</ProjectPermissionCan>
{(ca.status === CaStatus.ACTIVE || ca.status === CaStatus.DISABLED) && (
<ProjectPermissionCan
I={ProjectPermissionActions.Edit}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Edit}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -149,8 +172,10 @@ export const ExternalCaTable = ({ handlePopUpOpen }: Props) => {
</ProjectPermissionCan>
)}
<ProjectPermissionCan
I={ProjectPermissionActions.Delete}
a={ProjectPermissionSub.CertificateAuthorities}
I={ProjectPermissionCertificateAuthorityActions.Delete}
a={subject(ProjectPermissionSub.CertificateAuthorities, {
name: ca.name
})}
>
{(isAllowed) => (
<DropdownMenuItem
frontend/src/pages/cert-manager/CertificatesPage/components/CertificateModal.tsx
+1 -1
View File
@@ -241,7 +241,7 @@ export const CertificateModal = ({ popUp, handlePopUpToggle, preselectedTemplate
setCertificateDetails(null);
}}
>
<ModalContent title={`${cert ? "View" : "Issue"} Certificate`}>
<ModalContent title={`${cert ? "View" : "Request"} Certificate`}>
{!certificateDetails ? (
<form onSubmit={handleSubmit(onFormSubmit)}>
<Controller
frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesSection.tsx
+17 -9
View File
@@ -6,6 +6,7 @@ import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, DeleteActionModal } from "@app/components/v2";
import {
ProjectPermissionCertificateActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionSub,
useProject
} from "@app/context";
@@ -104,12 +105,12 @@ export const CertificatesSection = () => {
<div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
<div className="mb-4 flex justify-between">
<p className="text-xl font-medium text-mineshaft-100">Certificates</p>
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Create}
a={ProjectPermissionSub.Certificates}
>
{(isAllowed) => (
<div className="flex gap-2">
<div className="flex gap-2">
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Import}
a={ProjectPermissionSub.Certificates}
>
{(isAllowed) => (
<Button
variant="outline_bg"
leftIcon={<FontAwesomeIcon icon={faArrowRight} />}
@@ -118,6 +119,13 @@ export const CertificatesSection = () => {
>
Import
</Button>
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.IssueCert}
a={ProjectPermissionSub.CertificateProfiles}
>
{(isAllowed) => (
<Button
colorSchema="primary"
type="submit"
@@ -127,9 +135,9 @@ export const CertificatesSection = () => {
>
Request
</Button>
</div>
)}
</ProjectPermissionCan>
)}
</ProjectPermissionCan>
</div>
</div>
<CertificatesTable handlePopUpOpen={handlePopUpOpen} />
<CertificateIssuanceModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
+116 -60
View File
@@ -1,4 +1,5 @@
import { useMemo, useState } from "react";
import { subject } from "@casl/ability";
import {
faBan,
faCertificate,
@@ -40,8 +41,10 @@ import {
import { Badge } from "@app/components/v3";
import {
ProjectPermissionCertificateActions,
ProjectPermissionPkiSyncActions,
ProjectPermissionSub,
useProject
useProject,
useProjectPermission
} from "@app/context";
import { useUpdateRenewalConfig } from "@app/hooks/api";
import { caSupportsCapability } from "@app/hooks/api/ca/constants";
@@ -96,6 +99,7 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
const [perPage, setPerPage] = useState(PER_PAGE_INIT);
const { currentProject } = useProject();
const { permission } = useProjectPermission();
const { data, isPending } = useListWorkspaceCertificates({
projectId: currentProject?.id ?? "",
offset: (page - 1) * perPage,
@@ -207,55 +211,72 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
return "opacity-0 group-hover:opacity-100";
})()}`}
>
{canShowAutoRenewalIcon && (
<Tooltip
content={(() => {
if (hasFailed && certificate.renewalError) {
return `Auto-renewal failed: ${certificate.renewalError}`;
}
if (isAutoRenewalEnabled) {
const expiryDate = new Date(certificate.notAfter);
const now = new Date();
const daysUntilExpiry = Math.ceil(
(expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000)
);
const daysUntilRenewal = Math.max(
0,
daysUntilExpiry - (certificate.renewBeforeDays || 0)
);
return `Auto-renews in ${daysUntilRenewal}d`;
}
return "Set auto renewal";
})()}
>
<button
type="button"
className={(() => {
if (hasFailed) return "pr-1 text-red-500 hover:text-red-400";
return "pr-1 text-primary-500 hover:text-primary-400";
})()}
aria-label="Certificate auto-renewal"
onClick={(e) => {
e.stopPropagation();
if (hasFailed) return;
{canShowAutoRenewalIcon &&
(() => {
const canEditCertificate = permission.can(
ProjectPermissionCertificateActions.Edit,
subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber
})
);
handlePopUpOpen("manageRenewal", {
certificateId: certificate.id,
commonName: originalDisplayName,
profileId: certificate.profileId || "",
renewBeforeDays: certificate.renewBeforeDays || 7,
ttlDays: Math.ceil(
(new Date(certificate.notAfter).getTime() -
new Date(certificate.notBefore).getTime()) /
(24 * 60 * 60 * 1000)
)
});
}}
>
<FontAwesomeIcon icon={faClockRotateLeft} />
</button>
</Tooltip>
)}
return (
<Tooltip
content={(() => {
if (hasFailed && certificate.renewalError) {
return `Auto-renewal failed: ${certificate.renewalError}`;
}
if (isAutoRenewalEnabled) {
const expiryDate = new Date(certificate.notAfter);
const now = new Date();
const daysUntilExpiry = Math.ceil(
(expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000)
);
const daysUntilRenewal = Math.max(
0,
daysUntilExpiry - (certificate.renewBeforeDays || 0)
);
return `Auto-renews in ${daysUntilRenewal}d`;
}
return "Set auto renewal";
})()}
>
<button
type="button"
className={(() => {
if (hasFailed) return "pr-1 text-red-500 hover:text-red-400";
return "pr-1 text-primary-500 hover:text-primary-400";
})()}
aria-label="Certificate auto-renewal"
onClick={(e) => {
e.stopPropagation();
if (!canEditCertificate) return;
if (hasFailed) return;
handlePopUpOpen("manageRenewal", {
certificateId: certificate.id,
commonName: originalDisplayName,
profileId: certificate.profileId || "",
renewBeforeDays: certificate.renewBeforeDays || 7,
ttlDays: Math.ceil(
(new Date(certificate.notAfter).getTime() -
new Date(certificate.notBefore).getTime()) /
(24 * 60 * 60 * 1000)
),
notAfter: certificate.notAfter,
renewalError: certificate.renewalError,
renewedFromCertificateId: certificate.renewedFromCertificateId,
renewedByCertificateId: certificate.renewedByCertificateId
});
}}
>
<FontAwesomeIcon icon={faClockRotateLeft} />
</button>
</Tooltip>
);
})()}
</div>
<DropdownMenu>
<DropdownMenuTrigger asChild className="rounded-lg">
@@ -268,7 +289,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
<DropdownMenuContent align="start" className="p-1">
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Read}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -291,7 +317,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
{isLegacyTemplatesEnabled && (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Read}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -327,7 +358,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
return (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => {
return (
@@ -391,7 +427,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
return (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -428,7 +469,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
return (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -455,8 +501,8 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
{certificate.status === CertStatus.ACTIVE &&
!certificate.renewedByCertificateId && (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Edit}
a={ProjectPermissionSub.Certificates}
I={ProjectPermissionPkiSyncActions.Edit}
a={ProjectPermissionSub.PkiSyncs}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -478,21 +524,26 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
)}
</ProjectPermissionCan>
)}
{/* Only show revoke button if CA supports revocation */}
{/* Only show revoke button if CA supports revocation and certificate is not already revoked */}
{(() => {
const caType = caCapabilityMap[certificate.caId];
const supportsRevocation =
!caType ||
caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES);
if (!supportsRevocation) {
if (!supportsRevocation || isRevoked) {
return null;
}
return (
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Delete}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
@@ -516,7 +567,12 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
})()}
<ProjectPermissionCan
I={ProjectPermissionCertificateActions.Delete}
a={ProjectPermissionSub.Certificates}
a={subject(ProjectPermissionSub.Certificates, {
commonName: certificate.commonName,
altNames: certificate.altNames,
serialNumber: certificate.serialNumber,
friendlyName: certificate.friendlyName
})}
>
{(isAllowed) => (
<DropdownMenuItem
frontend/src/pages/cert-manager/IntegrationsListPage/components/PkiSyncsTab/PkiSyncTable/PkiSyncRow.tsx
+267 -245
View File
@@ -67,7 +67,6 @@ export const PkiSyncRow = ({
const navigate = useNavigate();
const {
id,
subscriberId,
lastSyncMessage,
destination,
lastSyncedAt,
@@ -117,263 +116,286 @@ export const PkiSyncRow = ({
const destinationDetails = PKI_SYNC_MAP[destination];
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: subscriberId || ""
subscriberName: destinationName,
name
});
return (
<Tr
onClick={() => {
// console.log("PKI Sync navigation:", { syncId: id, projectId });
navigate({
to: ROUTE_PATHS.CertManager.PkiSyncDetailsByIDPage.path,
params: {
syncId: id,
projectId,
orgId: currentOrg.id
}
});
}}
className={twMerge(
"group h-10 cursor-pointer transition-colors duration-100 hover:bg-mineshaft-700",
syncStatus === PkiSyncStatus.Failed && "bg-red/5 hover:bg-red/10"
)}
key={`sync-${id}`}
>
<Td>
<img
alt={`${destinationDetails.name} sync`}
src={`/images/integrations/${destinationDetails.image}`}
className="min-w-7"
/>
</Td>
<Td className="max-w-0 min-w-32!">
<div>
<div className="flex w-full items-center">
<p className="truncate">{name}</p>
{description && (
<Tooltip content={description}>
<FontAwesomeIcon
icon={faInfoCircle}
size="xs"
className="ml-1 text-mineshaft-400"
/>
</Tooltip>
)}
</div>
<p className="truncate text-xs leading-4 text-bunker-300">{destinationDetails.name}</p>
</div>
</Td>
<PkiSyncDestinationCol pkiSync={pkiSync} />
<Td>
<div className="flex items-center gap-1">
{syncStatus && (
<Tooltip
position="left"
className="max-w-sm"
content={
[PkiSyncStatus.Succeeded, PkiSyncStatus.Failed].includes(syncStatus) ? (
<div className="flex flex-col gap-2 py-1 whitespace-normal">
{lastSyncedAt && (
<div>
<div
className={`mb-2 flex self-start ${syncStatus === PkiSyncStatus.Failed ? "text-yellow" : "text-green"}`}
>
<FontAwesomeIcon
icon={faCalendarCheck}
className="ml-1 pt-0.5 pr-1.5 text-sm"
/>
<div className="text-xs">Last Synced</div>
</div>
<div className="rounded-sm bg-mineshaft-600 p-2 text-xs">
{format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
</div>
</div>
)}
{failureMessage && (
<div>
<div className="mb-2 flex self-start text-red">
<FontAwesomeIcon icon={faXmark} className="ml-1 pt-0.5 pr-1.5 text-sm" />
<div className="text-xs">Failure Reason</div>
</div>
<div className="rounded-sm bg-mineshaft-600 p-2 text-xs break-words">
{failureMessage}
</div>
</div>
)}
</div>
) : undefined
<ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Read} a={permissionSubject}>
{(isAllowed: boolean) => {
return (
<Tr
onClick={() => {
if (!isAllowed) {
return;
}
>
// console.log("PKI Sync navigation:", { syncId: id, projectId });
navigate({
to: ROUTE_PATHS.CertManager.PkiSyncDetailsByIDPage.path,
params: {
syncId: id,
projectId,
orgId: currentOrg.id
}
});
}}
className={twMerge(
"group h-10 transition-colors duration-100 hover:bg-mineshaft-700",
syncStatus === PkiSyncStatus.Failed && "bg-red/5 hover:bg-red/10",
isAllowed ? "cursor-pointer" : "cursor-not-allowed"
)}
key={`sync-${id}`}
>
<Td>
<img
alt={`${destinationDetails.name} sync`}
src={`/images/integrations/${destinationDetails.image}`}
className="min-w-7"
/>
</Td>
<Td className="max-w-0 min-w-32!">
<div>
<PkiSyncStatusBadge status={syncStatus} />
</div>
</Tooltip>
)}
{!isAutoSyncEnabled && (
<Tooltip
className="text-xs"
content="Auto-Sync is disabled. Certificate changes in the PKI subscriber will not be automatically synced to the destination."
>
<Badge variant="neutral">
<BanIcon />
{!syncStatus && "Auto-Sync Disabled"}
</Badge>
</Tooltip>
)}
{syncOption?.canImportCertificates && <PkiSyncImportStatusBadge mini pkiSync={pkiSync} />}
<PkiSyncRemoveStatusBadge mini pkiSync={pkiSync} />
</div>
</Td>
<Td>
<Tooltip className="max-w-sm text-center" content="Options">
<DropdownMenu>
<DropdownMenuTrigger asChild>
<IconButton
ariaLabel="Options"
colorSchema="secondary"
className="w-6"
variant="plain"
>
<FontAwesomeIcon icon={faEllipsisV} />
</IconButton>
</DropdownMenuTrigger>
<DropdownMenuContent sideOffset={2} align="end">
<DropdownMenuItem
icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
onClick={(e) => {
e.stopPropagation();
handleCopyId();
}}
>
Copy Sync ID
</DropdownMenuItem>
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.SyncCertificates}
a={permissionSubject}
>
{(isAllowed: boolean) => (
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faRotate} />}
onClick={(e) => {
e.stopPropagation();
onTriggerSyncCertificates(pkiSync);
}}
isDisabled={!isAllowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Manually trigger a sync for this ${destinationName} destination.`}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span> Trigger Sync</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
<div className="flex w-full items-center">
<p className="truncate">{name}</p>
{description && (
<Tooltip content={description}>
<FontAwesomeIcon
icon={faInfoCircle}
size="xs"
className="ml-1 text-mineshaft-400"
/>
</Tooltip>
</DropdownMenuItem>
)}
</div>
<p className="truncate text-xs leading-4 text-bunker-300">
{destinationDetails.name}
</p>
</div>
</Td>
<PkiSyncDestinationCol pkiSync={pkiSync} />
<Td>
<div className="flex items-center gap-1">
{syncStatus && (
<Tooltip
position="left"
className="max-w-sm"
content={
[PkiSyncStatus.Succeeded, PkiSyncStatus.Failed].includes(syncStatus) ? (
<div className="flex flex-col gap-2 py-1 whitespace-normal">
{lastSyncedAt && (
<div>
<div
className={`mb-2 flex self-start ${syncStatus === PkiSyncStatus.Failed ? "text-yellow" : "text-green"}`}
>
<FontAwesomeIcon
icon={faCalendarCheck}
className="ml-1 pt-0.5 pr-1.5 text-sm"
/>
<div className="text-xs">Last Synced</div>
</div>
<div className="rounded-sm bg-mineshaft-600 p-2 text-xs">
{format(new Date(lastSyncedAt), "yyyy-MM-dd, hh:mm aaa")}
</div>
</div>
)}
{failureMessage && (
<div>
<div className="mb-2 flex self-start text-red">
<FontAwesomeIcon
icon={faXmark}
className="ml-1 pt-0.5 pr-1.5 text-sm"
/>
<div className="text-xs">Failure Reason</div>
</div>
<div className="rounded-sm bg-mineshaft-600 p-2 text-xs break-words">
{failureMessage}
</div>
</div>
)}
</div>
) : undefined
}
>
<div>
<PkiSyncStatusBadge status={syncStatus} />
</div>
</Tooltip>
)}
</ProjectPermissionCan>
{syncOption?.canImportCertificates && (
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.ImportCertificates}
a={permissionSubject}
>
{(isAllowed: boolean) => (
{!isAutoSyncEnabled && (
<Tooltip
className="text-xs"
content="Auto-Sync is disabled. Certificate changes in the PKI subscriber will not be automatically synced to the destination."
>
<Badge variant="neutral">
<BanIcon />
{!syncStatus && "Auto-Sync Disabled"}
</Badge>
</Tooltip>
)}
{syncOption?.canImportCertificates && (
<PkiSyncImportStatusBadge mini pkiSync={pkiSync} />
)}
<PkiSyncRemoveStatusBadge mini pkiSync={pkiSync} />
</div>
</Td>
<Td>
<Tooltip className="max-w-sm text-center" content="Options">
<DropdownMenu>
<DropdownMenuTrigger asChild>
<IconButton
ariaLabel="Options"
colorSchema="secondary"
className="w-6"
variant="plain"
>
<FontAwesomeIcon icon={faEllipsisV} />
</IconButton>
</DropdownMenuTrigger>
<DropdownMenuContent sideOffset={2} align="end">
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faDownload} />}
icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
onClick={(e) => {
e.stopPropagation();
onTriggerImportCertificates(pkiSync);
handleCopyId();
}}
isDisabled={!isAllowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Import certificates from this ${destinationName} destination into Infisical.`}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span>Import Certificates</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
</Tooltip>
Copy Sync ID
</DropdownMenuItem>
)}
</ProjectPermissionCan>
)}
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.RemoveCertificates}
a={permissionSubject}
>
{(isAllowed: boolean) => (
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faEraser} />}
onClick={(e) => {
e.stopPropagation();
onTriggerRemoveCertificates(pkiSync);
}}
isDisabled={!isAllowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Remove certificates synced by Infisical from this ${destinationName} destination.`}
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.SyncCertificates}
a={permissionSubject}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span>Remove Certificates</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
</Tooltip>
</DropdownMenuItem>
)}
</ProjectPermissionCan>
<ProjectPermissionCan I={ProjectPermissionPkiSyncActions.Edit} a={permissionSubject}>
{(isAllowed: boolean) => (
<DropdownMenuItem
isDisabled={!isAllowed}
icon={<FontAwesomeIcon icon={isAutoSyncEnabled ? faToggleOff : faToggleOn} />}
onClick={(e) => {
e.stopPropagation();
onToggleEnable(pkiSync);
}}
>
{isAutoSyncEnabled ? "Disable" : "Enable"} Auto-Sync
</DropdownMenuItem>
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.Delete}
a={permissionSubject}
>
{(isAllowed: boolean) => (
<DropdownMenuItem
isDisabled={!isAllowed}
icon={<FontAwesomeIcon icon={faTrash} />}
onClick={(e) => {
e.stopPropagation();
onDelete(pkiSync);
}}
>
Delete Sync
</DropdownMenuItem>
)}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
</Tooltip>
</Td>
</Tr>
{(allowed: boolean) => (
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faRotate} />}
onClick={(e) => {
e.stopPropagation();
onTriggerSyncCertificates(pkiSync);
}}
isDisabled={!allowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Manually trigger a sync for this ${destinationName} destination.`}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span> Trigger Sync</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
</Tooltip>
</DropdownMenuItem>
)}
</ProjectPermissionCan>
{syncOption?.canImportCertificates && (
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.ImportCertificates}
a={permissionSubject}
>
{(allowed: boolean) => (
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faDownload} />}
onClick={(e) => {
e.stopPropagation();
onTriggerImportCertificates(pkiSync);
}}
isDisabled={!allowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Import certificates from this ${destinationName} destination into Infisical.`}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span>Import Certificates</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
</Tooltip>
</DropdownMenuItem>
)}
</ProjectPermissionCan>
)}
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.RemoveCertificates}
a={permissionSubject}
>
{(allowed: boolean) => (
<DropdownMenuItem
icon={<FontAwesomeIcon icon={faEraser} />}
onClick={(e) => {
e.stopPropagation();
onTriggerRemoveCertificates(pkiSync);
}}
isDisabled={!allowed}
>
<Tooltip
position="left"
sideOffset={42}
content={`Remove certificates synced by Infisical from this ${destinationName} destination.`}
>
<div className="flex h-full w-full items-center justify-between gap-1">
<span>Remove Certificates</span>
<FontAwesomeIcon
className="text-bunker-300"
size="sm"
icon={faInfoCircle}
/>
</div>
</Tooltip>
</DropdownMenuItem>
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.Edit}
a={permissionSubject}
>
{(allowed: boolean) => (
<DropdownMenuItem
isDisabled={!allowed}
icon={
<FontAwesomeIcon icon={isAutoSyncEnabled ? faToggleOff : faToggleOn} />
}
onClick={(e) => {
e.stopPropagation();
onToggleEnable(pkiSync);
}}
>
{isAutoSyncEnabled ? "Disable" : "Enable"} Auto-Sync
</DropdownMenuItem>
)}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionPkiSyncActions.Delete}
a={permissionSubject}
>
{(allowed: boolean) => (
<DropdownMenuItem
isDisabled={!allowed}
icon={<FontAwesomeIcon icon={faTrash} />}
onClick={(e) => {
e.stopPropagation();
onDelete(pkiSync);
}}
>
Delete Sync
</DropdownMenuItem>
)}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
</Tooltip>
</Td>
</Tr>
);
}}
</ProjectPermissionCan>
);
};
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncActionTriggers.tsx
+3 -2
View File
@@ -53,7 +53,7 @@ type Props = {
};
export const PkiSyncActionTriggers = ({ pkiSync }: Props) => {
const { destination, subscriberId, projectId, id } = pkiSync;
const { destination, projectId, id } = pkiSync;
const navigate = useNavigate();
const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
@@ -112,7 +112,8 @@ export const PkiSyncActionTriggers = ({ pkiSync }: Props) => {
}, [updatePkiSyncMutation, id, projectId, pkiSync.isAutoSyncEnabled]);
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncCertificatesSection.tsx
+5 -1
View File
@@ -32,6 +32,7 @@ import {
import { Badge } from "@app/components/v3";
import { ProjectPermissionSub } from "@app/context";
import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
import { useListPkiSyncCertificates, useRemoveCertificatesFromPkiSync } from "@app/hooks/api";
import { CertificateSyncStatus, TPkiSync } from "@app/hooks/api/pkiSyncs";
@@ -84,8 +85,11 @@ export const PkiSyncCertificatesSection = ({ pkiSync }: Props) => {
const totalCount = data?.totalCount || 0;
const removeCertificatesFromSync = useRemoveCertificatesFromPkiSync();
const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: pkiSync.subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
const handleRemoveCertificate = async (certificateId: string) => {
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDestinationSection.tsx
+3 -2
View File
@@ -31,7 +31,7 @@ type Props = {
};
export const PkiSyncDestinationSection = ({ pkiSync, onEditDestination }: Props) => {
const { destination, subscriberId } = pkiSync;
const { destination } = pkiSync;
const destinationDetails = PKI_SYNC_MAP[destination];
@@ -55,7 +55,8 @@ export const PkiSyncDestinationSection = ({ pkiSync, onEditDestination }: Props)
}
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: subscriberId || ""
subscriberName: destinationDetails.name,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncDetailsSection.tsx
+6 -3
View File
@@ -10,6 +10,7 @@ import { PkiSyncStatusBadge } from "@app/components/pki-syncs";
import { IconButton } from "@app/components/v2";
import { ProjectPermissionSub } from "@app/context";
import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
import { PkiSyncStatus, TPkiSync } from "@app/hooks/api/pkiSyncs";
const GenericFieldLabel = ({
@@ -33,8 +34,7 @@ type Props = {
};
export const PkiSyncDetailsSection = ({ pkiSync, onEditDetails }: Props) => {
const { syncStatus, lastSyncMessage, lastSyncedAt, name, description, subscriberId, subscriber } =
pkiSync;
const { syncStatus, lastSyncMessage, lastSyncedAt, name, description, subscriber } = pkiSync;
const failureMessage = useMemo(() => {
if (syncStatus === PkiSyncStatus.Failed) {
@@ -50,8 +50,11 @@ export const PkiSyncDetailsSection = ({ pkiSync, onEditDetails }: Props) => {
return null;
}, [syncStatus, lastSyncMessage]);
const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: subscriber?.id || subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncFieldMappingsSection.tsx
+4 -1
View File
@@ -7,6 +7,7 @@ import { IconButton } from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { ProjectPermissionSub } from "@app/context";
import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
import { PkiSync, TPkiSync } from "@app/hooks/api/pkiSyncs";
const GenericFieldLabel = ({
@@ -35,9 +36,11 @@ export const PkiSyncFieldMappingsSection = ({ pkiSync, onEditMappings }: Props)
}
const fieldMappings = pkiSync.syncOptions?.fieldMappings;
const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: pkiSync.subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncOptionsSection/PkiSyncOptionsSection.tsx
+5 -1
View File
@@ -7,6 +7,7 @@ import { IconButton } from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { ProjectPermissionSub } from "@app/context";
import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
import { TPkiSync } from "@app/hooks/api/pkiSyncs";
const GenericFieldLabel = ({
@@ -34,8 +35,11 @@ export const PkiSyncOptionsSection = ({ pkiSync, onEditOptions }: Props) => {
syncOptions: { canRemoveCertificates }
} = pkiSync;
const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: pkiSync.subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PkiSyncDetailsByIDPage/components/PkiSyncSourceSection.tsx
+5 -1
View File
@@ -9,6 +9,7 @@ import { IconButton, Tooltip } from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { ProjectPermissionSub } from "@app/context";
import { ProjectPermissionPkiSyncActions } from "@app/context/ProjectPermissionContext/types";
import { PKI_SYNC_MAP } from "@app/helpers/pkiSyncs";
import { TPkiSync } from "@app/hooks/api/pkiSyncs";
const GenericFieldLabel = ({ label, children }: { label: string; children: React.ReactNode }) => (
@@ -26,8 +27,11 @@ type Props = {
export const PkiSyncSourceSection = ({ pkiSync, onEditSource }: Props) => {
const { subscriberId, subscriber } = pkiSync;
const destinationName = PKI_SYNC_MAP[pkiSync.destination].name;
const permissionSubject = subject(ProjectPermissionSub.PkiSyncs, {
subscriberId: subscriberId || ""
subscriberName: destinationName,
name: pkiSync.name
});
return (
frontend/src/pages/cert-manager/PoliciesPage/PoliciesPage.tsx
+29 -4
View File
@@ -2,8 +2,15 @@ import { useState } from "react";
import { Helmet } from "react-helmet";
import { useTranslation } from "react-i18next";
import { PermissionDeniedBanner } from "@app/components/permissions";
import { ContentLoader, PageHeader, Tab, TabList, TabPanel, Tabs } from "@app/components/v2";
import { useProject } from "@app/context";
import { useProject, useProjectPermission } from "@app/context";
import {
ProjectPermissionCertificateActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionPkiTemplateActions,
ProjectPermissionSub
} from "@app/context/ProjectPermissionContext/types";
import { ProjectType } from "@app/hooks/api/projects/types";
import { CertificateProfilesTab } from "./components/CertificateProfilesTab";
@@ -20,8 +27,22 @@ enum TabSections {
export const PoliciesPage = () => {
const { t } = useTranslation();
const { currentProject } = useProject();
const { permission } = useProjectPermission();
const [activeTab, setActiveTab] = useState(TabSections.CertificateProfiles);
const canReadCertificateProfiles = permission.can(
ProjectPermissionCertificateProfileActions.Read,
ProjectPermissionSub.CertificateProfiles
);
const canReadCertificateTemplates = permission.can(
ProjectPermissionPkiTemplateActions.Read,
ProjectPermissionSub.CertificateTemplates
);
const canReadCertificates = permission.can(
ProjectPermissionCertificateActions.Read,
ProjectPermissionSub.Certificates
);
if (!currentProject) {
return <ContentLoader />;
}
@@ -56,15 +77,19 @@ export const PoliciesPage = () => {
</TabList>
<TabPanel value={TabSections.CertificateProfiles}>
<CertificateProfilesTab />
{canReadCertificateProfiles ? <CertificateProfilesTab /> : <PermissionDeniedBanner />}
</TabPanel>
<TabPanel value={TabSections.CertificateTemplatesV2}>
<CertificateTemplatesV2Tab />
{canReadCertificateTemplates ? (
<CertificateTemplatesV2Tab />
) : (
<PermissionDeniedBanner />
)}
</TabPanel>
<TabPanel value={TabSections.Certificates}>
<CertificatesTab />
{canReadCertificates ? <CertificatesTab /> : <PermissionDeniedBanner />}
</TabPanel>
</Tabs>
</div>
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CertificateProfilesTab.tsx
+18 -19
View File
@@ -4,10 +4,10 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { UpgradePlanModal } from "@app/components/license/UpgradePlanModal";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, DeleteActionModal } from "@app/components/v2";
import { useProjectPermission } from "@app/context";
import {
ProjectPermissionActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionSub
} from "@app/context/ProjectPermissionContext/types";
import { usePopUp } from "@app/hooks";
@@ -21,8 +21,6 @@ import { ProfileList } from "./ProfileList";
import { RevealAcmeEabSecretModal } from "./RevealAcmeEabSecretModal";
export const CertificateProfilesTab = () => {
const { permission } = useProjectPermission();
const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
const [isEditModalOpen, setIsEditModalOpen] = useState(false);
const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
@@ -35,11 +33,6 @@ export const CertificateProfilesTab = () => {
const deleteProfile = useDeleteCertificateProfile();
const canCreateProfile = permission.can(
ProjectPermissionActions.Create,
ProjectPermissionSub.CertificateAuthorities
);
const handleCreateProfile = () => {
setIsCreateModalOpen(true);
};
@@ -84,16 +77,22 @@ export const CertificateProfilesTab = () => {
</p>
</div>
{canCreateProfile && (
<Button
colorSchema="primary"
type="button"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
onClick={handleCreateProfile}
>
Create Profile
</Button>
)}
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.Create}
a={ProjectPermissionSub.CertificateProfiles}
>
{(isAllowed) => (
<Button
isDisabled={!isAllowed}
colorSchema="primary"
type="button"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
onClick={handleCreateProfile}
>
Create Profile
</Button>
)}
</ProjectPermissionCan>
</div>
<ProfileList
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx
+74 -64
View File
@@ -1,5 +1,6 @@
/* eslint-disable no-nested-ternary */
import { useCallback } from "react";
import { subject } from "@casl/ability";
import {
faCheck,
faCircleInfo,
@@ -13,6 +14,7 @@ import {
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import {
DropdownMenu,
DropdownMenuContent,
@@ -23,9 +25,7 @@ import {
Tr
} from "@app/components/v2";
import { Badge } from "@app/components/v3";
import { useProjectPermission } from "@app/context";
import {
ProjectPermissionActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionSub
} from "@app/context/ProjectPermissionContext/types";
@@ -48,8 +48,6 @@ export const ProfileRow = ({
onRevealProfileAcmeEabSecret,
onDeleteProfile
}: Props) => {
const { permission } = useProjectPermission();
const { data: caData } = useGetInternalCaById(profile.caId ?? "");
const { popUp, handlePopUpToggle } = usePopUp(["issueCertificate"] as const);
@@ -72,26 +70,6 @@ export const ProfileRow = ({
templateId: profile.certificateTemplateId
});
const canEditProfile = permission.can(
ProjectPermissionActions.Edit,
ProjectPermissionSub.CertificateAuthorities
);
const canRevealProfileAcmeEabSecret = permission.can(
ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret,
ProjectPermissionSub.CertificateProfiles
);
const canIssueCertificate = permission.can(
ProjectPermissionCertificateProfileActions.IssueCert,
ProjectPermissionSub.CertificateProfiles
);
const canDeleteProfile = permission.can(
ProjectPermissionActions.Delete,
ProjectPermissionSub.CertificateAuthorities
);
const getEnrollmentTypeBadge = (enrollmentType: string) => {
const config = {
api: { variant: "ghost" as const, label: "API" },
@@ -152,50 +130,82 @@ export const ProfileRow = ({
>
Copy Profile ID
</DropdownMenuItem>
{canEditProfile && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onEditProfile(profile);
}}
icon={<FontAwesomeIcon icon={faEdit} className="w-3" />}
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.Edit}
a={subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })}
>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onEditProfile(profile);
}}
icon={<FontAwesomeIcon icon={faEdit} className="w-3" />}
>
Edit Profile
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
{profile.enrollmentType === "acme" && (
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret}
a={subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })}
>
Edit Profile
</DropdownMenuItem>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onRevealProfileAcmeEabSecret(profile);
}}
icon={<FontAwesomeIcon icon={faEye} className="w-3" />}
>
Reveal ACME EAB
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
)}
{canRevealProfileAcmeEabSecret && profile.enrollmentType === "acme" && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onRevealProfileAcmeEabSecret(profile);
}}
icon={<FontAwesomeIcon icon={faEye} className="w-3" />}
{profile.enrollmentType === "api" && (
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.IssueCert}
a={subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })}
>
Reveal ACME EAB
</DropdownMenuItem>
)}
{canIssueCertificate && profile.enrollmentType === "api" && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
handlePopUpToggle("issueCertificate");
}}
icon={<FontAwesomeIcon icon={faPlus} className="w-3" />}
>
Request Certificate
</DropdownMenuItem>
)}
{canDeleteProfile && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onDeleteProfile(profile);
}}
icon={<FontAwesomeIcon icon={faTrash} className="w-3" />}
>
Delete Profile
</DropdownMenuItem>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
handlePopUpToggle("issueCertificate");
}}
icon={<FontAwesomeIcon icon={faPlus} className="w-3" />}
>
Request Certificate
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
)}
<ProjectPermissionCan
I={ProjectPermissionCertificateProfileActions.Delete}
a={subject(ProjectPermissionSub.CertificateProfiles, { slug: profile.slug })}
>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onDeleteProfile(profile);
}}
icon={<FontAwesomeIcon icon={faTrash} className="w-3" />}
>
Delete Profile
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
<CertificateIssuanceModal
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CertificateTemplatesV2Tab.tsx
+17 -18
View File
@@ -3,8 +3,8 @@ import { faPlus } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import { Button, DeleteActionModal } from "@app/components/v2";
import { useProjectPermission } from "@app/context";
import {
ProjectPermissionPkiTemplateActions,
ProjectPermissionSub
@@ -16,8 +16,6 @@ import { CreateTemplateModal } from "./CreateTemplateModal";
import { TemplateList } from "./TemplateList";
export const CertificateTemplatesV2Tab = () => {
const { permission } = useProjectPermission();
const [isCreateModalOpen, setIsCreateModalOpen] = useState(false);
const [isEditModalOpen, setIsEditModalOpen] = useState(false);
const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
@@ -26,11 +24,6 @@ export const CertificateTemplatesV2Tab = () => {
const deleteTemplateV2 = useDeleteCertificateTemplateV2WithPolicies();
const canCreateTemplate = permission.can(
ProjectPermissionPkiTemplateActions.Create,
ProjectPermissionSub.CertificateTemplates
);
const handleCreateTemplate = () => {
setIsCreateModalOpen(true);
};
@@ -70,16 +63,22 @@ export const CertificateTemplatesV2Tab = () => {
</p>
</div>
{canCreateTemplate && (
<Button
colorSchema="primary"
type="button"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
onClick={handleCreateTemplate}
>
Create Template
</Button>
)}
<ProjectPermissionCan
I={ProjectPermissionPkiTemplateActions.Create}
a={ProjectPermissionSub.CertificateTemplates}
>
{(isAllowed) => (
<Button
isDisabled={!isAllowed}
colorSchema="primary"
type="button"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
onClick={handleCreateTemplate}
>
Create Template
</Button>
)}
</ProjectPermissionCan>
</div>
<TemplateList onEditTemplate={handleEditTemplate} onDeleteTemplate={handleDeleteTemplate} />
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
+5 -2
View File
@@ -258,7 +258,7 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
};
};
const { control, handleSubmit, reset, watch, setValue, formState } = useForm<
const { control, handleSubmit, reset, watch, setValue, formState, trigger } = useForm<
FormData & { preset: TemplatePresetId }
>({
resolver: zodResolver(templateSchema),
@@ -286,10 +286,11 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
};
const watchedPreset = watch("preset") || TEMPLATE_PRESET_IDS.CUSTOM;
const handlePresetChange = (presetId: TemplatePresetId) => {
const handlePresetChange = async (presetId: TemplatePresetId) => {
setValue("preset", presetId);
if (presetId === TEMPLATE_PRESET_IDS.CUSTOM) {
await trigger();
return;
}
@@ -313,6 +314,8 @@ export const CreateTemplateModal = ({ isOpen, onClose, template, mode = "create"
if (selectedPreset.formData.keyAlgorithm) {
setValue("keyAlgorithm", selectedPreset.formData.keyAlgorithm);
}
await trigger();
}
};
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx
+79 -35
View File
@@ -1,6 +1,17 @@
import { faCircleInfo, faEdit, faEllipsis, faTrash } from "@fortawesome/free-solid-svg-icons";
import { useCallback } from "react";
import { subject } from "@casl/ability";
import {
faCheck,
faCircleInfo,
faCopy,
faEdit,
faEllipsis,
faTrash
} from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import { ProjectPermissionCan } from "@app/components/permissions";
import {
DropdownMenu,
DropdownMenuContent,
@@ -17,11 +28,12 @@ import {
Tooltip,
Tr
} from "@app/components/v2";
import { useProject, useProjectPermission } from "@app/context";
import { useProject } from "@app/context";
import {
ProjectPermissionPkiTemplateActions,
ProjectPermissionSub
} from "@app/context/ProjectPermissionContext/types";
import { useToggle } from "@app/hooks";
import { useListCertificateTemplatesV2 } from "@app/hooks/api/certificateTemplates/queries";
import { TCertificateTemplateV2WithPolicies } from "@app/hooks/api/certificateTemplates/types";
@@ -31,8 +43,8 @@ interface Props {
}
export const TemplateList = ({ onEditTemplate, onDeleteTemplate }: Props) => {
const { permission } = useProjectPermission();
const { currentProject } = useProject();
const [isIdCopied, setIsIdCopied] = useToggle(false);
const { data, isLoading } = useListCertificateTemplatesV2({
projectId: currentProject?.id || "",
@@ -42,20 +54,25 @@ export const TemplateList = ({ onEditTemplate, onDeleteTemplate }: Props) => {
const templates = data?.certificateTemplates || [];
const handleCopyId = useCallback(
(templateId: string) => {
setIsIdCopied.on();
navigator.clipboard.writeText(templateId);
createNotification({
text: "Template ID copied to clipboard",
type: "info"
});
setTimeout(() => setIsIdCopied.off(), 2000);
},
[setIsIdCopied]
);
if (!currentProject?.id) {
return null;
}
const canEditTemplate = permission.can(
ProjectPermissionPkiTemplateActions.Edit,
ProjectPermissionSub.CertificateTemplates
);
const canDeleteTemplate = permission.can(
ProjectPermissionPkiTemplateActions.Delete,
ProjectPermissionSub.CertificateTemplates
);
const formatDate = (dateString: string) => {
return new Date(dateString).toLocaleDateString();
};
@@ -110,28 +127,55 @@ export const TemplateList = ({ onEditTemplate, onDeleteTemplate }: Props) => {
</div>
</DropdownMenuTrigger>
<DropdownMenuContent align="start" className="p-1">
{canEditTemplate && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onEditTemplate(template);
}}
icon={<FontAwesomeIcon icon={faEdit} />}
>
Edit Template
</DropdownMenuItem>
)}
{canDeleteTemplate && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onDeleteTemplate(template);
}}
icon={<FontAwesomeIcon icon={faTrash} />}
>
Delete Template
</DropdownMenuItem>
)}
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
handleCopyId(template.id);
}}
icon={<FontAwesomeIcon icon={isIdCopied ? faCheck : faCopy} />}
>
Copy Template ID
</DropdownMenuItem>
<ProjectPermissionCan
I={ProjectPermissionPkiTemplateActions.Edit}
a={subject(ProjectPermissionSub.CertificateTemplates, {
name: template.name
})}
>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onEditTemplate(template);
}}
icon={<FontAwesomeIcon icon={faEdit} />}
>
Edit Template
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
<ProjectPermissionCan
I={ProjectPermissionPkiTemplateActions.Delete}
a={subject(ProjectPermissionSub.CertificateTemplates, {
name: template.name
})}
>
{(isAllowed) =>
isAllowed && (
<DropdownMenuItem
onClick={(e) => {
e.stopPropagation();
onDeleteTemplate(template);
}}
icon={<FontAwesomeIcon icon={faTrash} />}
>
Delete Template
</DropdownMenuItem>
)
}
</ProjectPermissionCan>
</DropdownMenuContent>
</DropdownMenu>
</Td>
frontend/src/pages/pam/PamAccountsPage/components/PamAccessAccountModal.tsx
+29 -5
View File
@@ -18,8 +18,10 @@ import { PamResourceType, TPamAccount, useAccessPamAccount } from "@app/hooks/ap
type Props = {
account?: TPamAccount;
accountPath?: string;
isOpen: boolean;
onOpenChange: (isOpen: boolean) => void;
projectId: string;
};
const AwsIamAccessContent = ({
@@ -119,11 +121,22 @@ const AwsIamAccessContent = ({
const CliAccessContent = ({
account,
onOpenChange
onOpenChange,
projectId,
accountPath
}: {
account: TPamAccount;
onOpenChange: (isOpen: boolean) => void;
projectId: string;
accountPath?: string;
}) => {
let fullAccountPath = account?.name;
if (accountPath) {
let path = accountPath;
if (path.startsWith("/")) path = path.slice(1);
fullAccountPath = `${path}/${account?.name}`;
}
const { protocol, hostname, port } = window.location;
const portSuffix = port && port !== "80" && port !== "443" ? `:${port}` : "";
const siteURL = `${protocol}//${hostname}${portSuffix}`;
@@ -177,9 +190,9 @@ const CliAccessContent = ({
switch (account.resource.resourceType) {
case PamResourceType.Postgres:
case PamResourceType.MySQL:
return `infisical pam db access-account ${account.id} --duration ${cliDuration} --domain ${siteURL}`;
return `infisical pam db access-account ${fullAccountPath} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
case PamResourceType.SSH:
return `infisical pam ssh access-account ${account.id} --duration ${cliDuration} --domain ${siteURL}`;
return `infisical pam ssh access-account ${fullAccountPath} --project-id ${projectId} --duration ${cliDuration} --domain ${siteURL}`;
default:
return "";
}
@@ -232,7 +245,13 @@ const CliAccessContent = ({
);
};
export const PamAccessAccountModal = ({ isOpen, onOpenChange, account }: Props) => {
export const PamAccessAccountModal = ({
isOpen,
onOpenChange,
account,
projectId,
accountPath
}: Props) => {
if (!account) return null;
const isAwsIam = account.resource.resourceType === PamResourceType.AwsIam;
@@ -251,7 +270,12 @@ export const PamAccessAccountModal = ({ isOpen, onOpenChange, account }: Props)
{isAwsIam ? (
<AwsIamAccessContent account={account} onOpenChange={onOpenChange} />
) : (
<CliAccessContent account={account} onOpenChange={onOpenChange} />
<CliAccessContent
account={account}
onOpenChange={onOpenChange}
projectId={projectId}
accountPath={accountPath}
/>
)}
</ModalContent>
</Modal>
frontend/src/pages/pam/PamAccountsPage/components/PamAccountsTable.tsx
+6
View File
@@ -476,6 +476,12 @@ export const PamAccountsTable = ({ projectId }: Props) => {
isOpen={popUp.accessAccount.isOpen}
onOpenChange={(isOpen) => handlePopUpToggle("accessAccount", isOpen)}
account={popUp.accessAccount.data}
accountPath={
popUp.accessAccount.data?.folderId
? folderPaths[popUp.accessAccount.data.folderId]
: undefined
}
projectId={projectId}
/>
<PamDeleteAccountModal
isOpen={popUp.deleteAccount.isOpen}
frontend/src/pages/project/RoleDetailsBySlugPage/components/CertificateAuthorityPermissionConditions.tsx
+19
View File
@@ -0,0 +1,19 @@
import { ProjectPermissionSub } from "@app/context/ProjectPermissionContext/types";
import { ConditionsFields } from "./ConditionsFields";
type Props = {
position?: number;
isDisabled?: boolean;
};
export const CertificateAuthorityPermissionConditions = ({ position = 0, isDisabled }: Props) => {
return (
<ConditionsFields
isDisabled={isDisabled}
subject={ProjectPermissionSub.CertificateAuthorities}
position={position}
selectOptions={[{ value: "name", label: "Name" }]}
/>
);
};
frontend/src/pages/project/RoleDetailsBySlugPage/components/CertificatePermissionConditions.tsx
+23
View File
@@ -0,0 +1,23 @@
import { ProjectPermissionSub } from "@app/context/ProjectPermissionContext/types";
import { ConditionsFields } from "./ConditionsFields";
type Props = {
position?: number;
isDisabled?: boolean;
};
export const CertificatePermissionConditions = ({ position = 0, isDisabled }: Props) => {
return (
<ConditionsFields
isDisabled={isDisabled}
subject={ProjectPermissionSub.Certificates}
position={position}
selectOptions={[
{ value: "commonName", label: "Common Name" },
{ value: "altNames", label: "Subject Alternative Names" },
{ value: "serialNumber", label: "Serial Number" }
]}
/>
);
};
frontend/src/pages/project/RoleDetailsBySlugPage/components/CertificateProfilePermissionConditions.tsx
+19
View File
@@ -0,0 +1,19 @@
import { ProjectPermissionSub } from "@app/context/ProjectPermissionContext/types";
import { ConditionsFields } from "./ConditionsFields";
type Props = {
position?: number;
isDisabled?: boolean;
};
export const CertificateProfilePermissionConditions = ({ position = 0, isDisabled }: Props) => {
return (
<ConditionsFields
isDisabled={isDisabled}
subject={ProjectPermissionSub.CertificateProfiles}
position={position}
selectOptions={[{ value: "slug", label: "Name" }]}
/>
);
};
frontend/src/pages/project/RoleDetailsBySlugPage/components/PermissionConditionHelpers.tsx
+1
View File
@@ -36,6 +36,7 @@ export const renderOperatorSelectItems = (type: string) => {
return (
<>
<SelectItem value={PermissionConditionOperators.$EQ}>Equal</SelectItem>
<SelectItem value={PermissionConditionOperators.$NEQ}>Not Equal</SelectItem>
<SelectItem value={PermissionConditionOperators.$GLOB}>Glob Match</SelectItem>
<SelectItem value={PermissionConditionOperators.$IN}>In</SelectItem>
</>
frontend/src/pages/project/RoleDetailsBySlugPage/components/PkiSyncPermissionConditions.tsx
+1 -1
View File
@@ -13,7 +13,7 @@ export const PkiSyncPermissionConditions = ({ position = 0, isDisabled }: Props)
isDisabled={isDisabled}
subject={ProjectPermissionSub.PkiSyncs}
position={position}
selectOptions={[{ value: "subscriberName", label: "Subscriber Name" }]}
selectOptions={[{ value: "name", label: "Sync Name" }]}
/>
);
};
frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
+98 -31
View File
@@ -7,6 +7,7 @@ import { Tooltip } from "@app/components/v2";
import {
ProjectPermissionActions,
ProjectPermissionCertificateActions,
ProjectPermissionCertificateAuthorityActions,
ProjectPermissionCertificateProfileActions,
ProjectPermissionCmekActions,
ProjectPermissionSub
@@ -56,7 +57,17 @@ const CertificatePolicyActionSchema = z.object({
[ProjectPermissionCertificateActions.Delete]: z.boolean().optional(),
[ProjectPermissionCertificateActions.Edit]: z.boolean().optional(),
[ProjectPermissionCertificateActions.Read]: z.boolean().optional(),
[ProjectPermissionCertificateActions.ReadPrivateKey]: z.boolean().optional()
[ProjectPermissionCertificateActions.ReadPrivateKey]: z.boolean().optional(),
[ProjectPermissionCertificateActions.Import]: z.boolean().optional()
});
const CertificateAuthorityPolicyActionSchema = z.object({
[ProjectPermissionCertificateAuthorityActions.Create]: z.boolean().optional(),
[ProjectPermissionCertificateAuthorityActions.Delete]: z.boolean().optional(),
[ProjectPermissionCertificateAuthorityActions.Edit]: z.boolean().optional(),
[ProjectPermissionCertificateAuthorityActions.Read]: z.boolean().optional(),
[ProjectPermissionCertificateAuthorityActions.Renew]: z.boolean().optional(),
[ProjectPermissionCertificateAuthorityActions.SignIntermediate]: z.boolean().optional()
});
const SecretPolicyActionSchema = z.object({
@@ -208,7 +219,6 @@ const PkiSubscriberPolicyActionSchema = z.object({
[ProjectPermissionPkiSubscriberActions.Create]: z.boolean().optional(),
[ProjectPermissionPkiSubscriberActions.Edit]: z.boolean().optional(),
[ProjectPermissionPkiSubscriberActions.Delete]: z.boolean().optional(),
[ProjectPermissionPkiSubscriberActions.IssueCert]: z.boolean().optional(),
[ProjectPermissionPkiSubscriberActions.ListCerts]: z.boolean().optional()
});
@@ -217,7 +227,6 @@ const PkiTemplatePolicyActionSchema = z.object({
[ProjectPermissionPkiTemplateActions.Create]: z.boolean().optional(),
[ProjectPermissionPkiTemplateActions.Edit]: z.boolean().optional(),
[ProjectPermissionPkiTemplateActions.Delete]: z.boolean().optional(),
[ProjectPermissionPkiTemplateActions.IssueCert]: z.boolean().optional(),
[ProjectPermissionPkiTemplateActions.ListCerts]: z.boolean().optional()
});
const CertificateProfilePolicyActionSchema = z.object({
@@ -225,7 +234,9 @@ const CertificateProfilePolicyActionSchema = z.object({
[ProjectPermissionCertificateProfileActions.Create]: z.boolean().optional(),
[ProjectPermissionCertificateProfileActions.Edit]: z.boolean().optional(),
[ProjectPermissionCertificateProfileActions.Delete]: z.boolean().optional(),
[ProjectPermissionCertificateProfileActions.IssueCert]: z.boolean().optional()
[ProjectPermissionCertificateProfileActions.IssueCert]: z.boolean().optional(),
[ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret]: z.boolean().optional(),
[ProjectPermissionCertificateProfileActions.RotateAcmeEabSecret]: z.boolean().optional()
});
const SecretEventsPolicyActionSchema = z.object({
@@ -381,8 +392,18 @@ export const projectRoleFormSchema = z.object({
[ProjectPermissionSub.Environments]: GeneralPolicyActionSchema.array().default([]),
[ProjectPermissionSub.AuditLogs]: AuditLogsPolicyActionSchema.array().default([]),
[ProjectPermissionSub.IpAllowList]: GeneralPolicyActionSchema.array().default([]),
[ProjectPermissionSub.CertificateAuthorities]: GeneralPolicyActionSchema.array().default([]),
[ProjectPermissionSub.Certificates]: CertificatePolicyActionSchema.array().default([]),
[ProjectPermissionSub.CertificateAuthorities]: CertificateAuthorityPolicyActionSchema.extend({
inverted: z.boolean().optional(),
conditions: ConditionSchema
})
.array()
.default([]),
[ProjectPermissionSub.Certificates]: CertificatePolicyActionSchema.extend({
inverted: z.boolean().optional(),
conditions: ConditionSchema
})
.array()
.default([]),
[ProjectPermissionSub.PkiSubscribers]: PkiSubscriberPolicyActionSchema.extend({
inverted: z.boolean().optional(),
conditions: ConditionSchema
@@ -397,8 +418,12 @@ export const projectRoleFormSchema = z.object({
})
.array()
.default([]),
[ProjectPermissionSub.CertificateProfiles]:
CertificateProfilePolicyActionSchema.array().default([]),
[ProjectPermissionSub.CertificateProfiles]: CertificateProfilePolicyActionSchema.extend({
inverted: z.boolean().optional(),
conditions: ConditionSchema
})
.array()
.default([]),
[ProjectPermissionSub.SshCertificateAuthorities]: GeneralPolicyActionSchema.array().default(
[]
),
@@ -458,6 +483,9 @@ type TConditionalFields =
| ProjectPermissionSub.DynamicSecrets
| ProjectPermissionSub.PkiSubscribers
| ProjectPermissionSub.CertificateTemplates
| ProjectPermissionSub.CertificateAuthorities
| ProjectPermissionSub.Certificates
| ProjectPermissionSub.CertificateProfiles
| ProjectPermissionSub.SshHosts
| ProjectPermissionSub.SecretRotation
| ProjectPermissionSub.Identity
@@ -479,6 +507,9 @@ export const isConditionalSubjects = (
subject === ProjectPermissionSub.SecretRotation ||
subject === ProjectPermissionSub.PkiSubscribers ||
subject === ProjectPermissionSub.CertificateTemplates ||
subject === ProjectPermissionSub.CertificateAuthorities ||
subject === ProjectPermissionSub.Certificates ||
subject === ProjectPermissionSub.CertificateProfiles ||
subject === ProjectPermissionSub.SecretSyncs ||
subject === ProjectPermissionSub.PkiSyncs ||
subject === ProjectPermissionSub.SecretEvents ||
@@ -822,6 +853,31 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
return;
}
if (subject === ProjectPermissionSub.CertificateAuthorities) {
const canRead = action.includes(ProjectPermissionCertificateAuthorityActions.Read);
const canCreate = action.includes(ProjectPermissionCertificateAuthorityActions.Create);
const canEdit = action.includes(ProjectPermissionCertificateAuthorityActions.Edit);
const canDelete = action.includes(ProjectPermissionCertificateAuthorityActions.Delete);
const canRenew = action.includes(ProjectPermissionCertificateAuthorityActions.Renew);
const canSignIntermediate = action.includes(
ProjectPermissionCertificateAuthorityActions.SignIntermediate
);
// from above statement we are sure it won't be undefined
formVal[subject]!.push({
[ProjectPermissionCertificateAuthorityActions.Read]: canRead,
[ProjectPermissionCertificateAuthorityActions.Create]: canCreate,
[ProjectPermissionCertificateAuthorityActions.Edit]: canEdit,
[ProjectPermissionCertificateAuthorityActions.Delete]: canDelete,
[ProjectPermissionCertificateAuthorityActions.Renew]: canRenew,
[ProjectPermissionCertificateAuthorityActions.SignIntermediate]: canSignIntermediate,
conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
inverted
});
return;
}
// for other subjects
const canRead = action.includes(ProjectPermissionActions.Read);
const canEdit = action.includes(ProjectPermissionActions.Edit);
@@ -873,17 +929,22 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
const canEdit = action.includes(ProjectPermissionCertificateActions.Edit);
const canDelete = action.includes(ProjectPermissionCertificateActions.Delete);
const canCreate = action.includes(ProjectPermissionCertificateActions.Create);
const canImport = action.includes(ProjectPermissionCertificateActions.Import);
const canReadPrivateKey = action.includes(ProjectPermissionCertificateActions.ReadPrivateKey);
if (!formVal[subject]) formVal[subject] = [{}];
if (!formVal[subject]) formVal[subject] = [];
// from above statement we are sure it won't be undefined
if (canRead) formVal[subject]![0].read = true;
if (canEdit) formVal[subject]![0].edit = true;
if (canCreate) formVal[subject]![0].create = true;
if (canDelete) formVal[subject]![0].delete = true;
if (canReadPrivateKey)
formVal[subject]![0][ProjectPermissionCertificateActions.ReadPrivateKey] = true;
formVal[subject]!.push({
[ProjectPermissionCertificateActions.Read]: canRead,
[ProjectPermissionCertificateActions.Edit]: canEdit,
[ProjectPermissionCertificateActions.Create]: canCreate,
[ProjectPermissionCertificateActions.Delete]: canDelete,
[ProjectPermissionCertificateActions.ReadPrivateKey]: canReadPrivateKey,
[ProjectPermissionCertificateActions.Import]: canImport,
conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
inverted
});
return;
}
@@ -1129,9 +1190,6 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
[ProjectPermissionPkiSubscriberActions.Read]: action.includes(
ProjectPermissionPkiSubscriberActions.Read
),
[ProjectPermissionPkiSubscriberActions.IssueCert]: action.includes(
ProjectPermissionPkiSubscriberActions.IssueCert
),
[ProjectPermissionPkiSubscriberActions.ListCerts]: action.includes(
ProjectPermissionPkiSubscriberActions.ListCerts
),
@@ -1157,9 +1215,6 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
[ProjectPermissionPkiTemplateActions.Read]: action.includes(
ProjectPermissionPkiTemplateActions.Read
),
[ProjectPermissionPkiTemplateActions.IssueCert]: action.includes(
ProjectPermissionPkiTemplateActions.IssueCert
),
[ProjectPermissionPkiTemplateActions.ListCerts]: action.includes(
ProjectPermissionPkiTemplateActions.ListCerts
),
@@ -1187,7 +1242,15 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
),
[ProjectPermissionCertificateProfileActions.IssueCert]: action.includes(
ProjectPermissionCertificateProfileActions.IssueCert
)
),
[ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret]: action.includes(
ProjectPermissionCertificateProfileActions.RevealAcmeEabSecret
),
[ProjectPermissionCertificateProfileActions.RotateAcmeEabSecret]: action.includes(
ProjectPermissionCertificateProfileActions.RotateAcmeEabSecret
),
conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
inverted
});
return;
@@ -1196,7 +1259,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
if (subject === ProjectPermissionSub.PamAccounts) {
if (!formVal[subject]) formVal[subject] = [];
formVal[subject].push({
formVal[subject]!.push({
[ProjectPermissionPamAccountActions.Access]: action.includes(
ProjectPermissionPamAccountActions.Access
),
@@ -1552,10 +1615,15 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
[ProjectPermissionSub.CertificateAuthorities]: {
title: "Certificate Authorities",
actions: [
{ label: "Read", value: "read" },
{ label: "Create", value: "create" },
{ label: "Modify", value: "edit" },
{ label: "Remove", value: "delete" }
{ label: "Read", value: ProjectPermissionCertificateAuthorityActions.Read },
{ label: "Create", value: ProjectPermissionCertificateAuthorityActions.Create },
{ label: "Modify", value: ProjectPermissionCertificateAuthorityActions.Edit },
{ label: "Remove", value: ProjectPermissionCertificateAuthorityActions.Delete },
{ label: "Renew", value: ProjectPermissionCertificateAuthorityActions.Renew },
{
label: "Sign Intermediate",
value: ProjectPermissionCertificateAuthorityActions.SignIntermediate
}
]
},
[ProjectPermissionSub.Certificates]: {
@@ -1563,7 +1631,8 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
actions: [
{ label: "Read", value: ProjectPermissionCertificateActions.Read },
{ label: "Read Private Key", value: ProjectPermissionCertificateActions.ReadPrivateKey },
{ label: "Create", value: ProjectPermissionCertificateActions.Create },
// { label: "Create", value: ProjectPermissionCertificateActions.Create }, // Hidden from UI - kept for backend compatibility
{ label: "Import", value: ProjectPermissionCertificateActions.Import },
{ label: "Modify", value: ProjectPermissionCertificateActions.Edit },
{ label: "Remove", value: ProjectPermissionCertificateActions.Delete }
]
@@ -1575,7 +1644,6 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
{ label: "Create", value: ProjectPermissionPkiTemplateActions.Create },
{ label: "Modify", value: ProjectPermissionPkiTemplateActions.Edit },
{ label: "Remove", value: ProjectPermissionPkiTemplateActions.Delete },
{ label: "Issue Certificates", value: ProjectPermissionPkiTemplateActions.IssueCert },
{ label: "List Certificates", value: ProjectPermissionPkiTemplateActions.ListCerts }
]
},
@@ -1586,7 +1654,7 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
{ label: "Create", value: ProjectPermissionCertificateProfileActions.Create },
{ label: "Modify", value: ProjectPermissionCertificateProfileActions.Edit },
{ label: "Remove", value: ProjectPermissionCertificateProfileActions.Delete },
{ label: "Issue Certificates", value: ProjectPermissionCertificateProfileActions.IssueCert }
{ label: "Request Certificates", value: ProjectPermissionCertificateProfileActions.IssueCert }
]
},
[ProjectPermissionSub.SshCertificateAuthorities]: {
@@ -1642,7 +1710,6 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
{ label: "Create", value: ProjectPermissionPkiSubscriberActions.Create },
{ label: "Modify", value: ProjectPermissionPkiSubscriberActions.Edit },
{ label: "Remove", value: ProjectPermissionPkiSubscriberActions.Delete },
{ label: "Issue Certificate", value: ProjectPermissionPkiSubscriberActions.IssueCert },
{ label: "List Certificates", value: ProjectPermissionPkiSubscriberActions.ListCerts }
]
},
frontend/src/pages/project/RoleDetailsBySlugPage/components/RolePermissionsSection.tsx
+15
View File
@@ -21,6 +21,9 @@ import { ProjectMembershipRole } from "@app/hooks/api/roles/types";
import { AddPoliciesButton } from "./AddPoliciesButton";
import { AppConnectionPermissionConditions } from "./AppConnectionPermissionConditions";
import { CertificateAuthorityPermissionConditions } from "./CertificateAuthorityPermissionConditions";
import { CertificatePermissionConditions } from "./CertificatePermissionConditions";
import { CertificateProfilePermissionConditions } from "./CertificateProfilePermissionConditions";
import { DynamicSecretPermissionConditions } from "./DynamicSecretPermissionConditions";
import { GeneralPermissionConditions } from "./GeneralPermissionConditions";
import { GeneralPermissionPolicies } from "./GeneralPermissionPolicies";
@@ -96,6 +99,18 @@ export const renderConditionalComponents = (
return <PamAccountPermissionConditions isDisabled={isDisabled} />;
}
if (subject === ProjectPermissionSub.CertificateAuthorities) {
return <CertificateAuthorityPermissionConditions isDisabled={isDisabled} />;
}
if (subject === ProjectPermissionSub.Certificates) {
return <CertificatePermissionConditions isDisabled={isDisabled} />;
}
if (subject === ProjectPermissionSub.CertificateProfiles) {
return <CertificateProfilePermissionConditions isDisabled={isDisabled} />;
}
return <GeneralPermissionConditions isDisabled={isDisabled} type={subject} />;
}