mirror of
https://github.com/Infisical/infisical.git
synced 2025-03-25 14:05:03 +00:00
Compare commits
4 Commits
hide-blind
...
default-no
| Author | SHA1 | Date | |
|---|---|---|---|
| caa0dc6e3f | |||
| 4d28a66572 | |||
| 7346b2ff34 | |||
| ab361b1315 |
backend
package-lock.jsonpackage.jsonspec.json
src
config
controllers
v1
botController.tsintegrationAuthController.tsintegrationController.tskeyController.tsmembershipController.tssecretImpsController.tssecretsFolderController.tswebhookController.tsworkspaceController.ts
v2
environmentController.tsmembershipController.tsorganizationsController.tssecretsController.tsserviceTokenDataController.tstagController.tsworkspaceController.ts
v3
v4
ee
controllers
v1
roleController.tssecretApprovalPolicyController.tssecretApprovalRequestsController.tssecretController.tssecretRotationController.tssecretRotationProviderController.tssecretSnapshotController.tsworkspaceController.ts
v3
models/auditLog
services
events
helpers
index.tsintegrations
interfaces/services/SecretService
middleware
models
queues/reminders
routes
services
templates
utils/logging
validation
variables
swagger
tsconfig.jsoncli
docs
api-reference/endpoints
changelog
cli/commands
contributing
documentation/platform
images
agent
integrations/cloudflare
platform
infisical-agent
integrations
internals
mint.jsonself-hosting/deployment-options
spec.yamlfrontend
public/data
src
components
hooks/api
auditLogs
secrets
serviceTokens
workspace
layouts/AppLayout
pages/integrations/cloudflare-workers
views
IntegrationsPage
Project
SecretMainPage/components/SecretListView
SecretOverviewPage
Settings/ProjectSettingsPage
ProjectSettingsPage.tsx
components
2753
backend/package-lock.json
generated
2753
backend/package-lock.json
generated
File diff suppressed because it is too large
Load Diff
@ -8,7 +8,6 @@
|
||||
"@octokit/rest": "^19.0.5",
|
||||
"@sentry/node": "^7.77.0",
|
||||
"@sentry/tracing": "^7.48.0",
|
||||
"@serdnam/pino-cloudwatch-transport": "^1.0.4",
|
||||
"@types/crypto-js": "^4.1.1",
|
||||
"@types/libsodium-wrappers": "^0.7.10",
|
||||
"@ucast/mongo2js": "^1.3.4",
|
||||
@ -72,7 +71,7 @@
|
||||
"main": "src/index.js",
|
||||
"scripts": {
|
||||
"start": "node build/index.js",
|
||||
"dev": "nodemon index.js",
|
||||
"dev": "nodemon index.js | pino-pretty --colorize",
|
||||
"swagger-autogen": "node ./swagger/index.ts",
|
||||
"build": "rimraf ./build && tsc && cp -R ./src/templates ./build && cp -R ./src/data ./build",
|
||||
"lint": "eslint . --ext .ts",
|
||||
@ -97,8 +96,6 @@
|
||||
"devDependencies": {
|
||||
"@jest/globals": "^29.3.1",
|
||||
"@posthog/plugin-scaffold": "^1.3.4",
|
||||
"@swc/core": "^1.3.99",
|
||||
"@swc/helpers": "^0.5.3",
|
||||
"@types/bcrypt": "^5.0.0",
|
||||
"@types/bcryptjs": "^2.4.2",
|
||||
"@types/bull": "^4.10.0",
|
||||
@ -129,7 +126,6 @@
|
||||
"nodemon": "^2.0.19",
|
||||
"npm": "^8.19.3",
|
||||
"pino-pretty": "^10.2.3",
|
||||
"regenerator-runtime": "^0.14.0",
|
||||
"smee-client": "^1.2.3",
|
||||
"supertest": "^6.3.3",
|
||||
"swagger-autogen": "^2.23.5",
|
||||
|
||||
@ -306,77 +306,12 @@
|
||||
},
|
||||
"/api/v1/workspace/{workspaceId}/audit-logs": {
|
||||
"get": {
|
||||
"summary": "Return audit logs",
|
||||
"description": "Return audit logs",
|
||||
"description": "",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "workspaceId",
|
||||
"in": "path",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ID of the workspace where to get folders from"
|
||||
},
|
||||
{
|
||||
"name": "offset",
|
||||
"description": "Number of logs to skip before starting to return logs for pagination",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "limit",
|
||||
"description": "Maximum number of logs to return for pagination",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "startDate",
|
||||
"description": "Filter logs from this date in ISO-8601 format",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "endDate",
|
||||
"description": "Filter logs till this date in ISO-8601 format",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "eventType",
|
||||
"description": "Filter by type of event such as get-secrets, get-secret, create-secret, update-secret, delete-secret, etc.",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "userAgentType",
|
||||
"description": "Filter by type of user agent such as web, cli, k8-operator, or other",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
},
|
||||
{
|
||||
"name": "actor",
|
||||
"description": "Filter by actor such as user or service",
|
||||
"required": false,
|
||||
"in": "query",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
@ -384,30 +319,9 @@
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"auditLogs": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"$ref": "#/components/schemas/AuditLog"
|
||||
},
|
||||
"description": "List of audit log"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
"description": "OK"
|
||||
}
|
||||
},
|
||||
"security": [
|
||||
{
|
||||
"apiKeyAuth": []
|
||||
}
|
||||
]
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/workspace/{workspaceId}/audit-logs/filters/actors": {
|
||||
@ -1218,43 +1132,6 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/config": {
|
||||
"get": {
|
||||
"description": "",
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK"
|
||||
}
|
||||
}
|
||||
},
|
||||
"patch": {
|
||||
"description": "",
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/admin/signup": {
|
||||
"post": {
|
||||
"description": "",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "user-agent",
|
||||
"in": "header",
|
||||
"schema": {
|
||||
"type": "string"
|
||||
}
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK"
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"/api/v1/bot/{workspaceId}": {
|
||||
"get": {
|
||||
"description": "",
|
||||
@ -4683,6 +4560,65 @@
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"get": {
|
||||
"summary": "Get all accessible environments of a workspace",
|
||||
"description": "Fetch all environments that the user has access to in a specified workspace",
|
||||
"parameters": [
|
||||
{
|
||||
"name": "workspaceId",
|
||||
"in": "path",
|
||||
"required": true,
|
||||
"schema": {
|
||||
"type": "string"
|
||||
},
|
||||
"description": "ID of the workspace"
|
||||
}
|
||||
],
|
||||
"responses": {
|
||||
"200": {
|
||||
"description": "OK",
|
||||
"content": {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"accessibleEnvironments": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string",
|
||||
"example": "Development"
|
||||
},
|
||||
"slug": {
|
||||
"type": "string",
|
||||
"example": "development"
|
||||
},
|
||||
"isWriteDenied": {
|
||||
"type": "boolean",
|
||||
"example": false
|
||||
},
|
||||
"isReadDenied": {
|
||||
"type": "boolean",
|
||||
"example": false
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "List of environments the user has access to in the specified workspace"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"security": [
|
||||
{
|
||||
"apiKeyAuth": []
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"/api/v2/workspace/{workspaceId}/tags": {
|
||||
@ -6928,61 +6864,6 @@
|
||||
"example": "2023-01-13T14:16:12.210Z"
|
||||
}
|
||||
}
|
||||
},
|
||||
"AuditLog": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"actor": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object",
|
||||
"properties": {}
|
||||
}
|
||||
}
|
||||
},
|
||||
"organization": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"workspace": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"ipAddress": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"event": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"type": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"metadata": {
|
||||
"type": "object",
|
||||
"properties": {}
|
||||
}
|
||||
}
|
||||
},
|
||||
"userAgent": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"userAgentType": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
},
|
||||
"expiresAt": {
|
||||
"type": "string",
|
||||
"example": ""
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"securitySchemes": {
|
||||
|
||||
@ -89,21 +89,6 @@ export const getClientSecretGitLabLogin = async () =>
|
||||
export const getUrlGitLabLogin = async () =>
|
||||
(await client.getSecret("URL_GITLAB_LOGIN")).secretValue || GITLAB_URL;
|
||||
|
||||
export const getAwsCloudWatchLog = async () => {
|
||||
const logGroupName =
|
||||
(await client.getSecret("AWS_CLOUDWATCH_LOG_GROUP_NAME")).secretValue || "infisical-log-stream";
|
||||
const region = (await client.getSecret("AWS_CLOUDWATCH_LOG_REGION")).secretValue;
|
||||
const accessKeyId = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_ID")).secretValue;
|
||||
const accessKeySecret = (await client.getSecret("AWS_CLOUDWATCH_LOG_ACCESS_KEY_SECRET"))
|
||||
.secretValue;
|
||||
const interval = parseInt(
|
||||
(await client.getSecret("AWS_CLOUDWATCH_LOG_INTERVAL")).secretValue || 1000,
|
||||
10
|
||||
);
|
||||
if (!region || !accessKeyId || !accessKeySecret) return;
|
||||
return { logGroupName, region, accessKeySecret, accessKeyId, interval };
|
||||
};
|
||||
|
||||
export const getPostHogHost = async () =>
|
||||
(await client.getSecret("POSTHOG_HOST")).secretValue || "https://app.posthog.com";
|
||||
export const getPostHogProjectApiKey = async () =>
|
||||
|
||||
@ -7,7 +7,7 @@ import * as reqValidator from "../../validation/bot";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { BadRequestError } from "../../utils/errors";
|
||||
@ -28,11 +28,7 @@ export const getBotByWorkspaceId = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetBotByWorkspaceIdV1, req);
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -74,11 +70,7 @@ export const setBotActiveState = async (req: Request, res: Response) => {
|
||||
}
|
||||
const userId = req.user._id;
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: bot.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(userId, bot.workspace.toString());
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Integrations
|
||||
|
||||
@ -25,7 +25,7 @@ import * as reqValidator from "../../validation/integrationAuth";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { getIntegrationAuthAccessHelper } from "../../helpers";
|
||||
@ -40,15 +40,15 @@ export const getIntegrationAuth = async (req: Request, res: Response) => {
|
||||
|
||||
const integrationAuth = await IntegrationAuth.findById(integrationAuthId);
|
||||
|
||||
if (!integrationAuth) return res.status(400).send({
|
||||
message: "Failed to find integration authorization"
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
if (!integrationAuth)
|
||||
return res.status(400).send({
|
||||
message: "Failed to find integration authorization"
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -79,11 +79,7 @@ export const oAuthExchange = async (req: Request, res: Response) => {
|
||||
} = await validateRequest(reqValidator.OauthExchangeV1, req);
|
||||
if (!INTEGRATION_SET.has(integration)) throw new Error("Failed to validate integration");
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -135,11 +131,7 @@ export const saveIntegrationToken = async (req: Request, res: Response) => {
|
||||
body: { workspaceId, integration, url, accessId, namespace, accessToken, refreshToken }
|
||||
} = await validateRequest(reqValidator.SaveIntegrationAccessTokenV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -232,12 +224,11 @@ export const getIntegrationAuthApps = async (req: Request, res: Response) => {
|
||||
const { integrationAuth, accessToken, accessId } = await getIntegrationAuthAccessHelper({
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -272,11 +263,10 @@ export const getIntegrationAuthTeams = async (req: Request, res: Response) => {
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -309,11 +299,10 @@ export const getIntegrationAuthVercelBranches = async (req: Request, res: Respon
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -371,11 +360,10 @@ export const getIntegrationAuthChecklyGroups = async (req: Request, res: Respons
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -425,11 +413,10 @@ export const getIntegrationAuthQoveryOrgs = async (req: Request, res: Response)
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -478,11 +465,10 @@ export const getIntegrationAuthQoveryProjects = async (req: Request, res: Respon
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -540,11 +526,10 @@ export const getIntegrationAuthQoveryEnvironments = async (req: Request, res: Re
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -602,11 +587,10 @@ export const getIntegrationAuthQoveryApps = async (req: Request, res: Response)
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -664,11 +648,10 @@ export const getIntegrationAuthQoveryContainers = async (req: Request, res: Resp
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -726,11 +709,10 @@ export const getIntegrationAuthQoveryJobs = async (req: Request, res: Response)
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -789,11 +771,10 @@ export const getIntegrationAuthRailwayEnvironments = async (req: Request, res: R
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -883,11 +864,10 @@ export const getIntegrationAuthRailwayServices = async (req: Request, res: Respo
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -1008,11 +988,10 @@ export const getIntegrationAuthBitBucketWorkspaces = async (req: Request, res: R
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -1065,11 +1044,10 @@ export const getIntegrationAuthNorthflankSecretGroups = async (req: Request, res
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -1154,11 +1132,10 @@ export const getIntegrationAuthTeamCityBuildConfigs = async (req: Request, res:
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -1224,11 +1201,10 @@ export const deleteIntegrationAuth = async (req: Request, res: Response) => {
|
||||
integrationAuthId: new Types.ObjectId(integrationAuthId)
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Integrations
|
||||
|
||||
@ -13,7 +13,7 @@ import * as reqValidator from "../../validation/integration";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
|
||||
@ -51,12 +51,11 @@ export const createIntegration = async (req: Request, res: Response) => {
|
||||
);
|
||||
|
||||
if (!integrationAuth) throw BadRequestError({ message: "Integration auth not found" });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integrationAuth.workspace._id
|
||||
});
|
||||
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integrationAuth.workspace._id.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -165,11 +164,10 @@ export const updateIntegration = async (req: Request, res: Response) => {
|
||||
const integration = await Integration.findById(integrationId);
|
||||
if (!integration) throw BadRequestError({ message: "Integration not found" });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integration.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integration.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -236,11 +234,10 @@ export const deleteIntegration = async (req: Request, res: Response) => {
|
||||
const integration = await Integration.findById(integrationId);
|
||||
if (!integration) throw BadRequestError({ message: "Integration not found" });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: integration.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
integration.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -288,11 +285,7 @@ export const manualSync = async (req: Request, res: Response) => {
|
||||
body: { workspaceId, environment }
|
||||
} = await validateRequest(reqValidator.ManualSyncV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Integrations
|
||||
|
||||
@ -9,7 +9,7 @@ import * as reqValidator from "../../validation/key";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
|
||||
@ -26,11 +26,7 @@ export const uploadKey = async (req: Request, res: Response) => {
|
||||
body: { key }
|
||||
} = await validateRequest(reqValidator.UploadKeyV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Member
|
||||
|
||||
@ -12,7 +12,7 @@ import * as reqValidator from "../../validation/membership";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { BadRequestError } from "../../utils/errors";
|
||||
@ -63,12 +63,11 @@ export const deleteMembership = async (req: Request, res: Response) => {
|
||||
if (!membershipToDelete) {
|
||||
throw new Error("Failed to delete workspace membership that doesn't exist");
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: membershipToDelete.workspace
|
||||
});
|
||||
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
membershipToDelete.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Member
|
||||
@ -119,11 +118,10 @@ export const changeMembershipRole = async (req: Request, res: Response) => {
|
||||
throw new Error("Failed to find membership to change role");
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: membershipToChangeRole.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
membershipToChangeRole.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Member
|
||||
@ -193,12 +191,7 @@ export const inviteUserToWorkspace = async (req: Request, res: Response) => {
|
||||
params: { workspaceId },
|
||||
body: { email }
|
||||
} = await validateRequest(InviteUserToWorkspaceV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Member
|
||||
|
||||
@ -1,6 +1,4 @@
|
||||
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { isValidScope } from "../../helpers";
|
||||
import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
|
||||
import { getAllImportedSecrets } from "../../services/SecretImportService";
|
||||
@ -17,7 +15,7 @@ import * as reqValidator from "../../validation/secretImports";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError, subject } from "@casl/ability";
|
||||
|
||||
@ -107,11 +105,7 @@ export const createSecretImp = async (req: Request, res: Response) => {
|
||||
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
|
||||
@ -319,11 +313,10 @@ export const updateSecretImport = async (req: Request, res: Response) => {
|
||||
}
|
||||
} else {
|
||||
// non token entry check
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: importSecDoc.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
importSecDoc.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
@ -449,11 +442,10 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
|
||||
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: importSecDoc.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
importSecDoc.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
@ -558,11 +550,7 @@ export const getSecretImports = async (req: Request, res: Response) => {
|
||||
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
@ -616,11 +604,7 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
|
||||
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
@ -673,11 +657,10 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
|
||||
permissionCheckFn = (env: string, secPath: string) =>
|
||||
isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: importSecDoc.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
importSecDoc.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
|
||||
@ -17,7 +17,7 @@ import {
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
|
||||
import * as reqValidator from "../../validation/folders";
|
||||
@ -125,11 +125,7 @@ export const createFolder = async (req: Request, res: Response) => {
|
||||
}
|
||||
} else {
|
||||
// user check
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
|
||||
@ -336,11 +332,7 @@ export const updateFolderById = async (req: Request, res: Response) => {
|
||||
throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
|
||||
@ -510,11 +502,7 @@ export const deleteFolder = async (req: Request, res: Response) => {
|
||||
}
|
||||
} else {
|
||||
// check that user is a member of the workspace
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath: directory })
|
||||
@ -661,10 +649,7 @@ export const getFolders = async (req: Request, res: Response) => {
|
||||
}
|
||||
} else {
|
||||
// check that user is a member of the workspace
|
||||
await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
}
|
||||
|
||||
const folders = await Folder.findOne({ workspace: workspaceId, environment });
|
||||
|
||||
@ -16,7 +16,7 @@ import * as reqValidator from "../../validation/webhooks";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
|
||||
@ -26,11 +26,7 @@ export const createWebhook = async (req: Request, res: Response) => {
|
||||
body: { webhookUrl, webhookSecretKey, environment, workspaceId, secretPath }
|
||||
} = await validateRequest(reqValidator.CreateWebhookV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Webhooks
|
||||
@ -102,11 +98,11 @@ export const updateWebhook = async (req: Request, res: Response) => {
|
||||
if (!webhook) {
|
||||
throw BadRequestError({ message: "Webhook not found!!" });
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: webhook.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
webhook.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Webhooks
|
||||
@ -150,11 +146,10 @@ export const deleteWebhook = async (req: Request, res: Response) => {
|
||||
throw ResourceNotFoundError({ message: "Webhook not found!!" });
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: webhook.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
webhook.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Webhooks
|
||||
@ -198,11 +193,10 @@ export const testWebhook = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "Webhook not found!!" });
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: webhook.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
webhook.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Webhooks
|
||||
@ -242,12 +236,8 @@ export const listWebhooks = async (req: Request, res: Response) => {
|
||||
const {
|
||||
query: { environment, workspaceId, secretPath }
|
||||
} = await validateRequest(reqValidator.ListWebhooksV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Webhooks
|
||||
|
||||
@ -25,7 +25,7 @@ import * as reqValidator from "../../validation";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
|
||||
/**
|
||||
@ -39,11 +39,7 @@ export const getWorkspacePublicKeys = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspacePublicKeysV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Member
|
||||
@ -76,11 +72,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceMembershipsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Member
|
||||
@ -203,11 +195,7 @@ export const deleteWorkspace = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.DeleteWorkspaceV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Workspace
|
||||
@ -235,11 +223,7 @@ export const changeWorkspaceName = async (req: Request, res: Response) => {
|
||||
body: { name }
|
||||
} = await validateRequest(reqValidator.ChangeWorkspaceNameV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Workspace
|
||||
@ -273,12 +257,7 @@ export const getWorkspaceIntegrations = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceIntegrationsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -304,11 +283,7 @@ export const getWorkspaceIntegrationAuthorizations = async (req: Request, res: R
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceIntegrationAuthorizationsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Integrations
|
||||
@ -334,11 +309,7 @@ export const getWorkspaceServiceTokens = async (req: Request, res: Response) =>
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceServiceTokensV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.ServiceTokens
|
||||
|
||||
@ -12,12 +12,14 @@ import {
|
||||
import { EventType, SecretVersion } from "../../ee/models";
|
||||
import { EEAuditLogService, EELicenseService } from "../../ee/services";
|
||||
import { BadRequestError, WorkspaceNotFoundError } from "../../utils/errors";
|
||||
import _ from "lodash";
|
||||
import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
import * as reqValidator from "../../validation/environments";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { SecretImport } from "../../models";
|
||||
@ -112,11 +114,7 @@ export const createWorkspaceEnvironment = async (req: Request, res: Response) =>
|
||||
body: { environmentName, environmentSlug }
|
||||
} = await validateRequest(reqValidator.CreateWorkspaceEnvironmentV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Environments
|
||||
@ -193,11 +191,7 @@ export const reorderWorkspaceEnvironments = async (req: Request, res: Response)
|
||||
body: { environmentName, environmentSlug, otherEnvironmentSlug, otherEnvironmentName }
|
||||
} = await validateRequest(reqValidator.ReorderWorkspaceEnvironmentsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Environments
|
||||
@ -328,11 +322,7 @@ export const renameWorkspaceEnvironment = async (req: Request, res: Response) =>
|
||||
body: { environmentName, environmentSlug, oldEnvironmentSlug }
|
||||
} = await validateRequest(reqValidator.UpdateWorkspaceEnvironmentV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Environments
|
||||
@ -521,11 +511,7 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
|
||||
body: { environmentSlug }
|
||||
} = await validateRequest(reqValidator.DeleteWorkspaceEnvironmentV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Environments
|
||||
@ -601,4 +587,98 @@ export const deleteWorkspaceEnvironment = async (req: Request, res: Response) =>
|
||||
workspace: workspaceId,
|
||||
environment: environmentSlug
|
||||
});
|
||||
};
|
||||
};
|
||||
|
||||
// TODO(akhilmhdh) after rbac this can be completely removed
|
||||
export const getAllAccessibleEnvironmentsOfWorkspace = async (req: Request, res: Response) => {
|
||||
/*
|
||||
#swagger.summary = 'Get all accessible environments of a workspace'
|
||||
#swagger.description = 'Fetch all environments that the user has access to in a specified workspace'
|
||||
|
||||
#swagger.security = [{
|
||||
"apiKeyAuth": []
|
||||
}]
|
||||
|
||||
#swagger.parameters['workspaceId'] = {
|
||||
"description": "ID of the workspace",
|
||||
"required": true,
|
||||
"type": "string",
|
||||
"in": "path"
|
||||
}
|
||||
|
||||
#swagger.responses[200] = {
|
||||
content: {
|
||||
"application/json": {
|
||||
"schema": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"accessibleEnvironments": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string",
|
||||
"example": "Development"
|
||||
},
|
||||
"slug": {
|
||||
"type": "string",
|
||||
"example": "development"
|
||||
},
|
||||
"isWriteDenied": {
|
||||
"type": "boolean",
|
||||
"example": false
|
||||
},
|
||||
"isReadDenied": {
|
||||
"type": "boolean",
|
||||
"example": false
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"description": "List of environments the user has access to in the specified workspace"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
const {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetAllAccessibileEnvironmentsOfWorkspaceV2, req);
|
||||
|
||||
const { membership: workspacesUserIsMemberOf } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
workspaceId
|
||||
);
|
||||
|
||||
const accessibleEnvironments: any = [];
|
||||
const deniedPermission = workspacesUserIsMemberOf.deniedPermissions;
|
||||
|
||||
const relatedWorkspace = await Workspace.findById(workspaceId);
|
||||
if (!relatedWorkspace) {
|
||||
throw BadRequestError();
|
||||
}
|
||||
relatedWorkspace.environments.forEach((environment) => {
|
||||
const isReadBlocked = _.some(deniedPermission, {
|
||||
environmentSlug: environment.slug,
|
||||
ability: PERMISSION_READ_SECRETS
|
||||
});
|
||||
const isWriteBlocked = _.some(deniedPermission, {
|
||||
environmentSlug: environment.slug,
|
||||
ability: PERMISSION_WRITE_SECRETS
|
||||
});
|
||||
if (isReadBlocked && isWriteBlocked) {
|
||||
return;
|
||||
} else {
|
||||
accessibleEnvironments.push({
|
||||
name: environment.name,
|
||||
slug: environment.slug,
|
||||
isWriteDenied: isWriteBlocked,
|
||||
isReadDenied: isReadBlocked
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
res.json({ accessibleEnvironments });
|
||||
};
|
||||
|
||||
@ -8,7 +8,7 @@ import { EEAuditLogService } from "../../ee/services";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { sendMail } from "../../helpers";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
@ -27,11 +27,7 @@ export const addUserToWorkspace = async (req: Request, res: Response) => {
|
||||
if (!workspace) throw new Error("Failed to find workspace");
|
||||
|
||||
// check permission
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Member
|
||||
|
||||
@ -1,16 +1,24 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { Membership, MembershipOrg, Workspace } from "../../models";
|
||||
import {
|
||||
Membership,
|
||||
MembershipOrg,
|
||||
Workspace
|
||||
} from "../../models";
|
||||
import { Role } from "../../ee/models";
|
||||
import { deleteMembershipOrg } from "../../helpers/membershipOrg";
|
||||
import {
|
||||
import {
|
||||
createOrganization as create,
|
||||
deleteOrganization,
|
||||
updateSubscriptionOrgQuantity
|
||||
} from "../../helpers/organization";
|
||||
import { addMembershipsOrg } from "../../helpers/membershipOrg";
|
||||
import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
|
||||
import { ACCEPTED, ADMIN, CUSTOM } from "../../variables";
|
||||
import {
|
||||
ACCEPTED,
|
||||
ADMIN,
|
||||
CUSTOM
|
||||
} from "../../variables";
|
||||
import * as reqValidator from "../../validation/organization";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
import {
|
||||
@ -147,7 +155,7 @@ export const updateOrganizationMembership = async (req: Request, res: Response)
|
||||
OrgPermissionSubjects.Member
|
||||
);
|
||||
|
||||
const isCustomRole = !["admin", "member"].includes(role);
|
||||
const isCustomRole = !["admin", "member", "owner"].includes(role);
|
||||
if (isCustomRole) {
|
||||
const orgRole = await Role.findOne({ slug: role, isOrgRole: true });
|
||||
if (!orgRole) throw BadRequestError({ message: "Role not found" });
|
||||
@ -328,7 +336,7 @@ export const getOrganizationWorkspaces = async (req: Request, res: Response) =>
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const createOrganization = async (req: Request, res: Response) => {
|
||||
export const createOrganization = async (req: Request, res: Response) => {
|
||||
const {
|
||||
body: { name }
|
||||
} = await validateRequest(reqValidator.CreateOrgv2, req);
|
||||
@ -353,27 +361,27 @@ export const createOrganization = async (req: Request, res: Response) => {
|
||||
|
||||
/**
|
||||
* Delete organization with id [organizationId]
|
||||
* @param req
|
||||
* @param res
|
||||
* @param req
|
||||
* @param res
|
||||
*/
|
||||
export const deleteOrganizationById = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: { organizationId }
|
||||
} = await validateRequest(reqValidator.DeleteOrgv2, req);
|
||||
|
||||
|
||||
const membershipOrg = await MembershipOrg.findOne({
|
||||
user: req.user._id,
|
||||
organization: new Types.ObjectId(organizationId),
|
||||
role: ADMIN
|
||||
});
|
||||
|
||||
|
||||
if (!membershipOrg) throw UnauthorizedRequestError();
|
||||
|
||||
|
||||
const organization = await deleteOrganization({
|
||||
organizationId: new Types.ObjectId(organizationId)
|
||||
});
|
||||
|
||||
|
||||
return res.status(200).send({
|
||||
organization
|
||||
});
|
||||
};
|
||||
}
|
||||
@ -39,7 +39,7 @@ import {
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError, subject } from "@casl/ability";
|
||||
|
||||
@ -159,11 +159,7 @@ export const batchSecrets = async (req: Request, res: Response) => {
|
||||
}
|
||||
// not using service token using auth
|
||||
if (!(req.authData.authPayload instanceof ServiceTokenData)) {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
if (createSecrets.length)
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
|
||||
@ -11,7 +11,7 @@ import * as reqValidator from "../../validation/serviceTokenData";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { Types } from "mongoose";
|
||||
@ -75,12 +75,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
const {
|
||||
body: { workspaceId, permissions, tag, encryptedKey, scopes, name, expiresIn, iv }
|
||||
} = await validateRequest(reqValidator.CreateServiceTokenV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.ServiceTokens
|
||||
@ -156,11 +151,10 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
|
||||
let serviceTokenData = await ServiceTokenData.findById(serviceTokenDataId);
|
||||
if (!serviceTokenData) throw BadRequestError({ message: "Service token not found" });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: serviceTokenData.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
serviceTokenData.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.ServiceTokens
|
||||
|
||||
@ -7,7 +7,7 @@ import { validateRequest } from "../../helpers/validation";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import * as reqValidator from "../../validation/tags";
|
||||
|
||||
@ -17,11 +17,7 @@ export const createWorkspaceTag = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.CreateWorkspaceTagsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.Tags
|
||||
@ -49,11 +45,10 @@ export const deleteWorkspaceTag = async (req: Request, res: Response) => {
|
||||
throw BadRequestError();
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: tagFromDB.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
tagFromDB.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Tags
|
||||
@ -71,12 +66,7 @@ export const getWorkspaceTags = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceTagsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Tags
|
||||
|
||||
@ -16,7 +16,7 @@ import * as reqValidator from "../../validation";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
|
||||
@ -272,11 +272,7 @@ export const getWorkspaceMemberships = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceMembershipsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.Member
|
||||
@ -356,11 +352,7 @@ export const updateWorkspaceMembership = async (req: Request, res: Response) =>
|
||||
body: { role }
|
||||
} = await validateRequest(reqValidator.UpdateWorkspaceMembershipsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Member
|
||||
@ -428,11 +420,7 @@ export const deleteWorkspaceMembership = async (req: Request, res: Response) =>
|
||||
params: { workspaceId, membershipId }
|
||||
} = await validateRequest(reqValidator.DeleteWorkspaceMembershipsV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.Member
|
||||
@ -464,11 +452,7 @@ export const toggleAutoCapitalization = async (req: Request, res: Response) => {
|
||||
body: { autoCapitalization }
|
||||
} = await validateRequest(reqValidator.ToggleAutoCapitalizationV2, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.Settings
|
||||
|
||||
@ -3,123 +3,24 @@ import { Types } from "mongoose";
|
||||
import { EventService, SecretService } from "../../services";
|
||||
import { eventPushSecrets } from "../../events";
|
||||
import { BotService } from "../../services";
|
||||
import { containsGlobPatterns, repackageSecretToRaw } from "../../helpers/secrets";
|
||||
import {
|
||||
checkSecretsPermission,
|
||||
containsGlobPatterns,
|
||||
repackageSecretV3ToRaw
|
||||
} from "../../helpers/secrets";
|
||||
import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
|
||||
import { getAllImportedSecrets } from "../../services/SecretImportService";
|
||||
import { Folder, IServiceTokenData, Membership, ServiceTokenData, User } from "../../models";
|
||||
import { Folder, IServiceTokenData } from "../../models";
|
||||
import { getFolderByPath } from "../../services/FolderService";
|
||||
import { BadRequestError } from "../../utils/errors";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
import * as reqValidator from "../../validation/secrets";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
} from "../../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError, subject } from "@casl/ability";
|
||||
import { validateServiceTokenDataClientForWorkspace } from "../../validation";
|
||||
import { PERMISSION_READ_SECRETS, PERMISSION_WRITE_SECRETS } from "../../variables";
|
||||
import { ActorType } from "../../ee/models";
|
||||
import { UnauthorizedRequestError } from "../../utils/errors";
|
||||
import { AuthData } from "../../interfaces/middleware";
|
||||
import { ProjectPermissionActions } from "../../ee/services/ProjectRoleService";
|
||||
import {
|
||||
generateSecretApprovalRequest,
|
||||
getSecretPolicyOfBoard
|
||||
} from "../../ee/services/SecretApprovalService";
|
||||
import { CommitType } from "../../ee/models/secretApprovalRequest";
|
||||
import { logger } from "../../utils/logging";
|
||||
import { createReminder, deleteReminder } from "../../helpers/reminder";
|
||||
|
||||
const checkSecretsPermission = async ({
|
||||
authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
secretAction
|
||||
}: {
|
||||
authData: AuthData;
|
||||
workspaceId: string;
|
||||
environment: string;
|
||||
secretPath: string;
|
||||
secretAction: ProjectPermissionActions; // CRUD
|
||||
}): Promise<{
|
||||
authVerifier: (env: string, secPath: string) => boolean;
|
||||
}> => {
|
||||
let STV2RequiredPermissions = [];
|
||||
|
||||
switch (secretAction) {
|
||||
case ProjectPermissionActions.Create:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
break;
|
||||
case ProjectPermissionActions.Read:
|
||||
STV2RequiredPermissions = [PERMISSION_READ_SECRETS];
|
||||
break;
|
||||
case ProjectPermissionActions.Edit:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
break;
|
||||
case ProjectPermissionActions.Delete:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
break;
|
||||
}
|
||||
|
||||
switch (authData.actor.type) {
|
||||
case ActorType.USER: {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath })
|
||||
);
|
||||
return {
|
||||
authVerifier: (env: string, secPath: string) =>
|
||||
permission.can(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
environment: env,
|
||||
secretPath: secPath
|
||||
})
|
||||
)
|
||||
};
|
||||
}
|
||||
case ActorType.SERVICE: {
|
||||
await validateServiceTokenDataClientForWorkspace({
|
||||
serviceTokenData: authData.authPayload as IServiceTokenData,
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath,
|
||||
requiredPermissions: STV2RequiredPermissions
|
||||
});
|
||||
return { authVerifier: () => true };
|
||||
}
|
||||
case ActorType.SERVICE_V3: {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath })
|
||||
);
|
||||
return {
|
||||
authVerifier: (env: string, secPath: string) =>
|
||||
permission.can(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
environment: env,
|
||||
secretPath: secPath
|
||||
})
|
||||
)
|
||||
};
|
||||
}
|
||||
default: {
|
||||
throw UnauthorizedRequestError();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Return secrets for workspace with id [workspaceId] and environment
|
||||
@ -192,23 +93,17 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
|
||||
query: { include_imports: includeImports }
|
||||
} = validatedData;
|
||||
|
||||
logger.info(
|
||||
`getSecretsRaw: fetch raw secrets [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [includeImports=${includeImports}]`
|
||||
);
|
||||
|
||||
if (req.authData.authPayload instanceof ServiceTokenData) {
|
||||
// if the service token has single scope, it will get all secrets for that scope by default
|
||||
const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
|
||||
if (
|
||||
serviceTokenDetails &&
|
||||
serviceTokenDetails.scopes.length == 1 &&
|
||||
!containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
|
||||
) {
|
||||
const scope = serviceTokenDetails.scopes[0];
|
||||
secretPath = scope.secretPath;
|
||||
environment = scope.environment;
|
||||
workspaceId = serviceTokenDetails.workspace.toString();
|
||||
}
|
||||
// if the service token has single scope, it will get all secrets for that scope by default
|
||||
const serviceTokenDetails: IServiceTokenData = req?.serviceTokenData;
|
||||
if (
|
||||
serviceTokenDetails &&
|
||||
serviceTokenDetails.scopes.length == 1 &&
|
||||
!containsGlobPatterns(serviceTokenDetails.scopes[0].secretPath)
|
||||
) {
|
||||
const scope = serviceTokenDetails.scopes[0];
|
||||
secretPath = scope.secretPath;
|
||||
environment = scope.environment;
|
||||
workspaceId = serviceTokenDetails.workspace.toString();
|
||||
}
|
||||
|
||||
if (!environment || !workspaceId)
|
||||
@ -252,21 +147,21 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
|
||||
);
|
||||
return res.status(200).send({
|
||||
secrets: secrets.map((secret) =>
|
||||
repackageSecretToRaw({
|
||||
repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
})
|
||||
),
|
||||
imports: importedSecrets.map((el) => ({
|
||||
...el,
|
||||
secrets: el.secrets.map((secret) => repackageSecretToRaw({ secret, key }))
|
||||
secrets: el.secrets.map((secret) => repackageSecretV3ToRaw({ secret, key }))
|
||||
}))
|
||||
});
|
||||
}
|
||||
|
||||
return res.status(200).send({
|
||||
secrets: secrets.map((secret) => {
|
||||
const rep = repackageSecretToRaw({
|
||||
const rep = repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
@ -352,10 +247,6 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
params: { secretName }
|
||||
} = await validateRequest(reqValidator.GetSecretByNameRawV3, req);
|
||||
|
||||
logger.info(
|
||||
`getSecretByNameRaw: fetch raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [include_imports=${include_imports}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -379,7 +270,7 @@ export const getSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: repackageSecretToRaw({
|
||||
secret: repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
})
|
||||
@ -479,10 +370,6 @@ export const createSecretRaw = async (req: Request, res: Response) => {
|
||||
}
|
||||
} = await validateRequest(reqValidator.CreateSecretRawV3, req);
|
||||
|
||||
logger.info(
|
||||
`createSecretRaw: create a secret raw by name and value [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -529,19 +416,11 @@ export const createSecretRaw = async (req: Request, res: Response) => {
|
||||
skipMultilineEncoding
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
const secretWithoutBlindIndex = secret.toObject();
|
||||
delete secretWithoutBlindIndex.secretBlindIndex;
|
||||
|
||||
return res.status(200).send({
|
||||
secret: repackageSecretToRaw({
|
||||
secret: repackageSecretV3ToRaw({
|
||||
secret: secretWithoutBlindIndex,
|
||||
key
|
||||
})
|
||||
@ -628,10 +507,6 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
body: { workspaceId, environment, secretValue, secretPath, type, skipMultilineEncoding }
|
||||
} = await validateRequest(reqValidator.UpdateSecretByNameRawV3, req);
|
||||
|
||||
logger.info(
|
||||
`updateSecretByNameRaw: update raw secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}] [skipMultilineEncoding=${skipMultilineEncoding}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -662,16 +537,8 @@ export const updateSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
skipMultilineEncoding
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: repackageSecretToRaw({
|
||||
secret: repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
})
|
||||
@ -754,10 +621,6 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
body: { environment, secretPath, type, workspaceId }
|
||||
} = await validateRequest(reqValidator.DeleteSecretByNameRawV3, req);
|
||||
|
||||
logger.info(
|
||||
`deleteSecretByNameRaw: delete a secret by name [environment=${environment}] [workspaceId=${workspaceId}] [secretPath=${secretPath}] [type=${type}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -788,7 +651,7 @@ export const deleteSecretByNameRaw = async (req: Request, res: Response) => {
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: repackageSecretToRaw({
|
||||
secret: repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
})
|
||||
@ -811,10 +674,6 @@ export const getSecrets = async (req: Request, res: Response) => {
|
||||
query: { secretPath }
|
||||
} = validatedData;
|
||||
|
||||
logger.info(
|
||||
`getSecrets: fetch encrypted secrets [environment=${environment}] [workspaceId=${workspaceId}] [includeImports=${includeImports}]`
|
||||
);
|
||||
|
||||
const { authVerifier: permissionCheckFn } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -869,10 +728,6 @@ export const getSecretByName = async (req: Request, res: Response) => {
|
||||
params: { secretName }
|
||||
} = await validateRequest(reqValidator.GetSecretByNameV3, req);
|
||||
|
||||
logger.info(
|
||||
`getSecretByName: get a single secret by name [environment=${environment}] [workspaceId=${workspaceId}] [include_imports=${include_imports}] [type=${type}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
@ -923,11 +778,7 @@ export const createSecret = async (req: Request, res: Response) => {
|
||||
params: { secretName }
|
||||
} = await validateRequest(reqValidator.CreateSecretV3, req);
|
||||
|
||||
logger.info(
|
||||
`createSecret: create an encrypted secret [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -935,46 +786,35 @@ export const createSecret = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Create
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
authData: req.authData,
|
||||
data: {
|
||||
[CommitType.CREATE]: [
|
||||
{
|
||||
secretName,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretCommentCiphertext,
|
||||
skipMultilineEncoding,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
secretKeyIV
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
authData: req.authData,
|
||||
data: {
|
||||
[CommitType.CREATE]: [
|
||||
{
|
||||
secretName,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretCommentCiphertext,
|
||||
skipMultilineEncoding,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
secretKeyIV
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -998,14 +838,6 @@ export const createSecret = async (req: Request, res: Response) => {
|
||||
skipMultilineEncoding
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
const secretWithoutBlindIndex = secret.toObject();
|
||||
delete secretWithoutBlindIndex.secretBlindIndex;
|
||||
|
||||
@ -1038,22 +870,16 @@ export const updateSecretByName = async (req: Request, res: Response) => {
|
||||
secretKeyIV,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
skipMultilineEncoding,
|
||||
secretReminderRepeatDays,
|
||||
secretReminderNote
|
||||
skipMultilineEncoding
|
||||
},
|
||||
params: { secretName }
|
||||
} = await validateRequest(reqValidator.UpdateSecretByNameV3, req);
|
||||
|
||||
logger.info(
|
||||
`updateSecretByName: update a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [skipMultilineEncoding=${skipMultilineEncoding}] [type=${type}]`
|
||||
);
|
||||
|
||||
if (newSecretName && (!secretKeyIV || !secretKeyTag || !secretKeyCiphertext)) {
|
||||
throw BadRequestError({ message: "Missing encrypted key" });
|
||||
}
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -1061,83 +887,37 @@ export const updateSecretByName = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Edit
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
authData: req.authData,
|
||||
data: {
|
||||
[CommitType.UPDATE]: [
|
||||
{
|
||||
secretName,
|
||||
newSecretName,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
tags,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretCommentCiphertext,
|
||||
skipMultilineEncoding,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
secretKeyIV
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (type !== "personal") {
|
||||
const existingSecret = await SecretService.getSecret({
|
||||
secretName,
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
type,
|
||||
secretPath,
|
||||
authData: req.authData
|
||||
});
|
||||
|
||||
if (secretReminderRepeatDays !== undefined) {
|
||||
if (
|
||||
(secretReminderRepeatDays &&
|
||||
existingSecret.secretReminderRepeatDays !== secretReminderRepeatDays) ||
|
||||
(secretReminderNote && existingSecret.secretReminderNote !== secretReminderNote)
|
||||
) {
|
||||
await createReminder(existingSecret, {
|
||||
_id: existingSecret._id,
|
||||
secretReminderRepeatDays,
|
||||
secretReminderNote,
|
||||
workspace: existingSecret.workspace
|
||||
});
|
||||
} else if (
|
||||
secretReminderRepeatDays === null &&
|
||||
secretReminderNote === null &&
|
||||
existingSecret.secretReminderRepeatDays
|
||||
) {
|
||||
await deleteReminder({
|
||||
_id: existingSecret._id,
|
||||
secretReminderRepeatDays: existingSecret.secretReminderRepeatDays
|
||||
});
|
||||
}
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
authData: req.authData,
|
||||
data: {
|
||||
[CommitType.UPDATE]: [
|
||||
{
|
||||
secretName,
|
||||
newSecretName,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
tags,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretCommentCiphertext,
|
||||
skipMultilineEncoding,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
secretKeyIV
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -1151,8 +931,6 @@ export const updateSecretByName = async (req: Request, res: Response) => {
|
||||
newSecretName,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretReminderRepeatDays,
|
||||
secretReminderNote,
|
||||
secretValueTag,
|
||||
secretPath,
|
||||
tags,
|
||||
@ -1165,14 +943,6 @@ export const updateSecretByName = async (req: Request, res: Response) => {
|
||||
secretKeyIV
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret
|
||||
});
|
||||
@ -1189,11 +959,7 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
|
||||
params: { secretName }
|
||||
} = await validateRequest(reqValidator.DeleteSecretByNameV3, req);
|
||||
|
||||
logger.info(
|
||||
`deleteSecretByName: delete a encrypted secret by name [environment=${environment}] [workspaceId=${workspaceId}] [type=${type}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -1201,36 +967,25 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Delete
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership && type !== "personal") {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
authData: req.authData,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.DELETE]: [
|
||||
{
|
||||
secretName
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
secretPath,
|
||||
authData: req.authData,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.DELETE]: [
|
||||
{
|
||||
secretName
|
||||
}
|
||||
]
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -1244,14 +999,6 @@ export const deleteSecretByName = async (req: Request, res: Response) => {
|
||||
secretPath
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret
|
||||
});
|
||||
@ -1262,11 +1009,7 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
body: { secrets, secretPath, environment, workspaceId }
|
||||
} = await validateRequest(reqValidator.CreateSecretByNameBatchV3, req);
|
||||
|
||||
logger.info(
|
||||
`createSecretByNameBatch: create a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -1274,32 +1017,21 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Create
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
authData: req.authData,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.CREATE]: secrets.filter(({ type }) => type === "shared")
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
secretPath,
|
||||
authData: req.authData,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.CREATE]: secrets.filter(({ type }) => type === "shared")
|
||||
}
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -1311,14 +1043,6 @@ export const createSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
authData: req.authData
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secrets: createdSecrets
|
||||
});
|
||||
@ -1329,11 +1053,7 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
body: { secrets, secretPath, environment, workspaceId }
|
||||
} = await validateRequest(reqValidator.UpdateSecretByNameBatchV3, req);
|
||||
|
||||
logger.info(
|
||||
`updateSecretByNameBatch: update a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -1341,32 +1061,21 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Edit
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
|
||||
},
|
||||
authData: req.authData
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.UPDATE]: secrets.filter(({ type }) => type === "shared")
|
||||
},
|
||||
authData: req.authData
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -1378,14 +1087,6 @@ export const updateSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
authData: req.authData
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secrets: updatedSecrets
|
||||
});
|
||||
@ -1396,11 +1097,7 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
body: { secrets, secretPath, environment, workspaceId }
|
||||
} = await validateRequest(reqValidator.DeleteSecretByNameBatchV3, req);
|
||||
|
||||
logger.info(
|
||||
`deleteSecretByNameBatch: delete a list of secrets by their names [environment=${environment}] [workspaceId=${workspaceId}] [secretsLength=${secrets?.length}]`
|
||||
);
|
||||
|
||||
await checkSecretsPermission({
|
||||
const { membership } = await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
@ -1408,32 +1105,21 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
secretAction: ProjectPermissionActions.Delete
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(
|
||||
if (membership) {
|
||||
const secretApprovalPolicy = await getSecretPolicyOfBoard(workspaceId, environment, secretPath);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath
|
||||
);
|
||||
if (secretApprovalPolicy) {
|
||||
const secretApprovalRequest = await generateSecretApprovalRequest({
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
|
||||
},
|
||||
authData: req.authData
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
secretPath,
|
||||
policy: secretApprovalPolicy,
|
||||
commiterMembershipId: membership._id.toString(),
|
||||
data: {
|
||||
[CommitType.DELETE]: secrets.filter(({ type }) => type === "shared")
|
||||
},
|
||||
authData: req.authData
|
||||
});
|
||||
return res.send({ approval: secretApprovalRequest });
|
||||
}
|
||||
}
|
||||
|
||||
@ -1445,15 +1131,7 @@ export const deleteSecretByNameBatch = async (req: Request, res: Response) => {
|
||||
authData: req.authData
|
||||
});
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secrets: deletedSecrets
|
||||
});
|
||||
};
|
||||
};
|
||||
@ -1,9 +1,9 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
import { Membership, Secret, ServiceTokenDataV3, User } from "../../models";
|
||||
import { Secret, ServiceTokenDataV3 } from "../../models";
|
||||
import { SecretService } from "../../services";
|
||||
import { getAuthDataProjectPermissions } from "../../ee/services/ProjectRoleService";
|
||||
import { getUserProjectPermissions } from "../../ee/services/ProjectRoleService";
|
||||
import { UnauthorizedRequestError } from "../../utils/errors";
|
||||
import * as reqValidator from "../../validation/workspace";
|
||||
|
||||
@ -19,22 +19,9 @@ export const getWorkspaceBlindIndexStatus = async (req: Request, res: Response)
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceBlinkIndexStatusV3, req);
|
||||
|
||||
await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
}
|
||||
const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
|
||||
const secretsWithoutBlindIndex = await Secret.countDocuments({
|
||||
workspace: new Types.ObjectId(workspaceId),
|
||||
@ -54,22 +41,9 @@ export const getWorkspaceSecrets = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetWorkspaceSecretsV3, req);
|
||||
|
||||
await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
}
|
||||
const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
|
||||
const secrets = await Secret.find({
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
@ -91,22 +65,9 @@ export const nameWorkspaceSecrets = async (req: Request, res: Response) => {
|
||||
body: { secretsToUpdate }
|
||||
} = await validateRequest(reqValidator.NameWorkspaceSecretsV3, req);
|
||||
|
||||
await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
}
|
||||
const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
if (membership.role !== "admin")
|
||||
throw UnauthorizedRequestError({ message: "User must be an admin" });
|
||||
|
||||
// get secret blind index salt
|
||||
const salt = await SecretService.getSecretBlindIndexSalt({
|
||||
@ -148,7 +109,7 @@ export const getWorkspaceServiceTokenData = async (req: Request, res: Response)
|
||||
|
||||
const serviceTokenData = await ServiceTokenDataV3.find({
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
}).populate("customRole");
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
serviceTokenData
|
||||
|
||||
42
backend/src/controllers/v4/environmentsController.ts
Normal file
42
backend/src/controllers/v4/environmentsController.ts
Normal file
@ -0,0 +1,42 @@
|
||||
import { Request, Response } from "express";
|
||||
// import { validateRequest } from "../../helpers/validation";
|
||||
// import * as reqValidator from "../../validation/environments";
|
||||
|
||||
/**
|
||||
* Create environment with name [environmentName] and slug [environmentSlug]
|
||||
* in project with id [projectId]
|
||||
* @param req
|
||||
* @param res
|
||||
*/
|
||||
export const createEnvironment = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
|
||||
/**
|
||||
* Return list of environments in project with id [projectId]
|
||||
* @param req
|
||||
* @param res
|
||||
*/
|
||||
export const getEnvironments = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete environment with name [environmentName] and slug [environmentSlug]
|
||||
* in project with id [projectId]
|
||||
* @param req
|
||||
* @param res
|
||||
*/
|
||||
export const updateEnvironment = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete environment with name [environmentName] and slug [environmentSlug]
|
||||
* in project with id [projectId]
|
||||
* @param req
|
||||
* @param res
|
||||
*/
|
||||
export const deleteEnvironment = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
87
backend/src/controllers/v4/foldersController.ts
Normal file
87
backend/src/controllers/v4/foldersController.ts
Normal file
@ -0,0 +1,87 @@
|
||||
import { Request, Response } from "express";
|
||||
// import { Types } from "mongoose";
|
||||
// import { FolderVersion } from "../../ee/models";
|
||||
// import { Folder } from "../../models";
|
||||
// import { appendFolder } from "../../services/FolderService";
|
||||
// import { validateRequest } from "../../helpers/validation";
|
||||
// import * as reqValidator from "../../validation/folders";
|
||||
// import { ResourceNotFoundError } from "../../utils/errors";
|
||||
|
||||
/**
|
||||
*
|
||||
* Return list of folders in project with id [projectId]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const getFolders = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* Create folder with name [folderName] in project with id [projectId]
|
||||
* under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const createFolder = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
|
||||
// const {
|
||||
// body: {
|
||||
// folderName,
|
||||
// projectId,
|
||||
// environmentSlug,
|
||||
// path
|
||||
// }
|
||||
// } = await validateRequest(reqValidator.CreateFolderV2, req);
|
||||
|
||||
// // get folder
|
||||
|
||||
// const folders = await Folder.findOne({
|
||||
// workspace: new Types.ObjectId(projectId),
|
||||
// environment: environmentSlug
|
||||
// });
|
||||
|
||||
// if (!folders) throw ResourceNotFoundError();
|
||||
|
||||
// const { parent, child: folder, hasCreated } = appendFolder(folders.nodes, { folderName, directory: path });
|
||||
|
||||
// if (!hasCreated) return res.json({ folder });
|
||||
|
||||
// await Folder.findByIdAndUpdate(folders._id, folders);
|
||||
|
||||
// await new FolderVersion({
|
||||
// project: new Types.ObjectId(projectId),
|
||||
// nodes: parent
|
||||
// }).save();
|
||||
|
||||
// return res.status(200).send({
|
||||
// folder
|
||||
// });
|
||||
}
|
||||
|
||||
/**
|
||||
*
|
||||
* Update folder with name [folderName] in project with id [projectId]
|
||||
* under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const updateFolder = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete folder with name [folderName] in project with id [projectId]
|
||||
* under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const deleteFolder = async (req: Request, res: Response) => {
|
||||
// TODO
|
||||
}
|
||||
9
backend/src/controllers/v4/index.ts
Normal file
9
backend/src/controllers/v4/index.ts
Normal file
@ -0,0 +1,9 @@
|
||||
import * as secretsController from "./secretsController";
|
||||
import * as environmentsController from "./environmentsController";
|
||||
import * as foldersController from "./foldersController";
|
||||
|
||||
export {
|
||||
secretsController,
|
||||
environmentsController,
|
||||
foldersController
|
||||
}
|
||||
353
backend/src/controllers/v4/secretsController.ts
Normal file
353
backend/src/controllers/v4/secretsController.ts
Normal file
@ -0,0 +1,353 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { BotService, SecretService } from "../../services";
|
||||
import { getAllImportedSecrets } from "../../services/SecretImportService";
|
||||
import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
|
||||
import { ProjectPermissionActions } from "../../ee/services/ProjectRoleService";
|
||||
import { checkSecretsPermission, packageSecretV4 } from "../../helpers";
|
||||
import { validateRequest } from "../../helpers/validation";
|
||||
import * as reqValidator from "../../validation/secrets";
|
||||
import { getFolderIdFromServiceToken } from "../../services/FolderService";
|
||||
|
||||
/**
|
||||
* Get secrets in project with id
|
||||
* [projectId]under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const getSecrets = async (req: Request, res: Response) => {
|
||||
const {
|
||||
query: {
|
||||
projectId,
|
||||
environmentSlug,
|
||||
path,
|
||||
includeImports
|
||||
}
|
||||
} = await validateRequest(reqValidator.GetSecretsV4, req);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId: projectId,
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
secretAction: ProjectPermissionActions.Read
|
||||
});
|
||||
|
||||
const secrets = await SecretService.getSecrets({
|
||||
workspaceId: new Types.ObjectId(projectId),
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
authData: req.authData
|
||||
});
|
||||
|
||||
const key = await BotService.getWorkspaceKeyWithBot({
|
||||
workspaceId: new Types.ObjectId(projectId)
|
||||
});
|
||||
|
||||
let packagedSecrets = secrets.map((secret) => packageSecretV4({
|
||||
secret,
|
||||
key
|
||||
}));
|
||||
|
||||
const folderId = await getFolderIdFromServiceToken(projectId, environmentSlug, path);
|
||||
|
||||
if (includeImports) {
|
||||
const importGroups = await getAllImportedSecrets(
|
||||
projectId,
|
||||
environmentSlug,
|
||||
folderId,
|
||||
() => true
|
||||
);
|
||||
|
||||
importGroups.forEach((importGroup) => {
|
||||
packagedSecrets = packagedSecrets.concat(
|
||||
importGroup.secrets.map((secret) => packageSecretV4({ secret, key }))
|
||||
);
|
||||
});
|
||||
}
|
||||
|
||||
return res.status(200).send({
|
||||
secrets: packagedSecrets
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Get secret named [secretName] in project with id
|
||||
* [projectId]under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const getSecret = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: {
|
||||
secretName
|
||||
},
|
||||
query: {
|
||||
projectId,
|
||||
environmentSlug,
|
||||
path,
|
||||
type,
|
||||
includeImports
|
||||
}
|
||||
} = await validateRequest(reqValidator.GetSecretV4, req);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId: projectId,
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
secretAction: ProjectPermissionActions.Read
|
||||
});
|
||||
|
||||
const secret = await SecretService.getSecret({
|
||||
secretName,
|
||||
workspaceId: new Types.ObjectId(projectId),
|
||||
environment: environmentSlug,
|
||||
type,
|
||||
secretPath: path,
|
||||
authData: req.authData,
|
||||
include_imports: includeImports
|
||||
});
|
||||
|
||||
const key = await BotService.getWorkspaceKeyWithBot({
|
||||
workspaceId: new Types.ObjectId(projectId)
|
||||
});
|
||||
|
||||
const packagedSecret = packageSecretV4({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: packagedSecret
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Create secret named [secretName] in project with id
|
||||
* [projectId]under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const createSecret = async (req: Request, res: Response) =>{
|
||||
const {
|
||||
params: {
|
||||
secretName
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
environmentSlug,
|
||||
path,
|
||||
type,
|
||||
secretValue,
|
||||
secretComment,
|
||||
skipMultilineEncoding
|
||||
}
|
||||
} = await validateRequest(reqValidator.CreateSecretV4, req);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId: projectId,
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
secretAction: ProjectPermissionActions.Create
|
||||
});
|
||||
|
||||
const key = await BotService.getWorkspaceKeyWithBot({
|
||||
workspaceId: new Types.ObjectId(projectId)
|
||||
});
|
||||
|
||||
const {
|
||||
ciphertext: secretKeyCiphertext,
|
||||
iv: secretKeyIV,
|
||||
tag: secretKeyTag
|
||||
} = encryptSymmetric128BitHexKeyUTF8({
|
||||
plaintext: secretName,
|
||||
key
|
||||
});
|
||||
|
||||
const {
|
||||
ciphertext: secretValueCiphertext,
|
||||
iv: secretValueIV,
|
||||
tag: secretValueTag
|
||||
} = encryptSymmetric128BitHexKeyUTF8({
|
||||
plaintext: secretValue,
|
||||
key
|
||||
});
|
||||
|
||||
const {
|
||||
ciphertext: secretCommentCiphertext,
|
||||
iv: secretCommentIV,
|
||||
tag: secretCommentTag
|
||||
} = encryptSymmetric128BitHexKeyUTF8({
|
||||
plaintext: secretComment,
|
||||
key
|
||||
});
|
||||
|
||||
const secret = await SecretService.createSecret({
|
||||
secretName,
|
||||
workspaceId: new Types.ObjectId(projectId),
|
||||
environment: environmentSlug,
|
||||
type,
|
||||
authData: req.authData,
|
||||
secretKeyCiphertext,
|
||||
secretKeyIV,
|
||||
secretKeyTag,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretPath: path,
|
||||
secretCommentCiphertext,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
skipMultilineEncoding
|
||||
});
|
||||
|
||||
const packagedSecret = packageSecretV4({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: packagedSecret
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Create secret named [secretName] in project with id
|
||||
* [projectId]under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const updateSecret = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: {
|
||||
secretName
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
environmentSlug,
|
||||
path,
|
||||
type,
|
||||
secretValue,
|
||||
secretComment,
|
||||
skipMultilineEncoding
|
||||
}
|
||||
} = await validateRequest(reqValidator.UpdateSecretV4, req);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId: projectId,
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
secretAction: ProjectPermissionActions.Edit
|
||||
});
|
||||
|
||||
const key = await BotService.getWorkspaceKeyWithBot({
|
||||
workspaceId: new Types.ObjectId(projectId)
|
||||
});
|
||||
|
||||
let secretValueCiphertext, secretValueIV, secretValueTag;
|
||||
if (secretValue) {
|
||||
const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
|
||||
plaintext: secretValue,
|
||||
key
|
||||
});
|
||||
|
||||
secretValueCiphertext = ciphertext;
|
||||
secretValueIV = iv;
|
||||
secretValueTag = tag;
|
||||
}
|
||||
|
||||
let secretCommentCiphertext, secretCommentIV, secretCommentTag;
|
||||
if (secretComment) {
|
||||
const { ciphertext, iv, tag } = encryptSymmetric128BitHexKeyUTF8({
|
||||
plaintext: secretComment,
|
||||
key
|
||||
});
|
||||
|
||||
secretCommentCiphertext = ciphertext;
|
||||
secretCommentIV = iv;
|
||||
secretCommentTag = tag;
|
||||
}
|
||||
|
||||
const secret = await SecretService.updateSecret({
|
||||
secretName,
|
||||
workspaceId: new Types.ObjectId(projectId),
|
||||
environment: environmentSlug,
|
||||
type,
|
||||
authData: req.authData,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretCommentCiphertext,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretPath: path,
|
||||
skipMultilineEncoding
|
||||
});
|
||||
|
||||
const packagedSecret = packageSecretV4({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: packagedSecret
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Delete secret named [secretName] in project with id
|
||||
* [projectId]under path [path]
|
||||
* @param req
|
||||
* @param res
|
||||
* @returns
|
||||
*/
|
||||
export const deleteSecret = async (req: Request, res: Response) => {
|
||||
const {
|
||||
params: {
|
||||
secretName
|
||||
},
|
||||
body: {
|
||||
projectId,
|
||||
environmentSlug,
|
||||
path,
|
||||
type
|
||||
}
|
||||
} = await validateRequest(reqValidator.DeleteSecretV4, req);
|
||||
|
||||
await checkSecretsPermission({
|
||||
authData: req.authData,
|
||||
workspaceId: projectId,
|
||||
environment: environmentSlug,
|
||||
secretPath: path,
|
||||
secretAction: ProjectPermissionActions.Delete
|
||||
});
|
||||
|
||||
const key = await BotService.getWorkspaceKeyWithBot({
|
||||
workspaceId: new Types.ObjectId(projectId)
|
||||
});
|
||||
|
||||
const { secret } = await SecretService.deleteSecret({
|
||||
secretName,
|
||||
workspaceId: new Types.ObjectId(projectId),
|
||||
environment: environmentSlug,
|
||||
type,
|
||||
authData: req.authData,
|
||||
secretPath: path
|
||||
});
|
||||
|
||||
const packagedSecret = packageSecretV4({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
|
||||
return res.status(200).send({
|
||||
secret: packagedSecret
|
||||
});
|
||||
}
|
||||
@ -1,6 +1,4 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { Membership, User } from "../../../models";
|
||||
import {
|
||||
CreateRoleSchema,
|
||||
DeleteRoleSchema,
|
||||
@ -13,7 +11,7 @@ import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
adminProjectPermissions,
|
||||
getAuthDataProjectPermissions,
|
||||
getUserProjectPermissions,
|
||||
memberProjectPermissions,
|
||||
viewerProjectPermission
|
||||
} from "../../services/ProjectRoleService";
|
||||
@ -41,10 +39,7 @@ export const createRole = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "user doesn't have the permission." });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
|
||||
if (permission.cannot(ProjectPermissionActions.Create, ProjectPermissionSub.Role)) {
|
||||
throw BadRequestError({ message: "User doesn't have the permission." });
|
||||
}
|
||||
@ -87,11 +82,7 @@ export const updateRole = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "User doesn't have the org permission." });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
|
||||
if (permission.cannot(ProjectPermissionActions.Edit, ProjectPermissionSub.Role)) {
|
||||
throw BadRequestError({ message: "User doesn't have the workspace permission." });
|
||||
}
|
||||
@ -143,11 +134,7 @@ export const deleteRole = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "User doesn't have the org permission." });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: role.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user.id, role.workspace.toString());
|
||||
if (permission.cannot(ProjectPermissionActions.Delete, ProjectPermissionSub.Role)) {
|
||||
throw BadRequestError({ message: "User doesn't have the workspace permission." });
|
||||
}
|
||||
@ -175,11 +162,7 @@ export const getRoles = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "User doesn't have the org permission." });
|
||||
}
|
||||
} else {
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user.id, workspaceId);
|
||||
if (permission.cannot(ProjectPermissionActions.Read, ProjectPermissionSub.Role)) {
|
||||
throw BadRequestError({ message: "User doesn't have the workspace permission." });
|
||||
}
|
||||
@ -244,19 +227,7 @@ export const getUserWorkspacePermissions = async (req: Request, res: Response) =
|
||||
const {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(GetUserProjectPermission, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
let membership;
|
||||
if (req.authData.authPayload instanceof User) {
|
||||
membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
})
|
||||
}
|
||||
const { permission, membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
|
||||
res.status(200).json({
|
||||
data: {
|
||||
|
||||
@ -1,11 +1,10 @@
|
||||
import { Types } from "mongoose";
|
||||
import { ForbiddenError, subject } from "@casl/ability";
|
||||
import { Request, Response } from "express";
|
||||
import { nanoid } from "nanoid";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { validateRequest } from "../../../helpers/validation";
|
||||
import { SecretApprovalPolicy } from "../../models/secretApprovalPolicy";
|
||||
@ -20,11 +19,7 @@ export const createSecretApprovalPolicy = async (req: Request, res: Response) =>
|
||||
body: { approvals, secretPath, approvers, environment, workspaceId, name }
|
||||
} = await validateRequest(reqValidator.CreateSecretApprovalRule, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.SecretApproval
|
||||
@ -54,11 +49,10 @@ export const updateSecretApprovalPolicy = async (req: Request, res: Response) =>
|
||||
const secretApproval = await SecretApprovalPolicy.findById(id);
|
||||
if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: secretApproval.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApproval.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.SecretApproval
|
||||
@ -84,11 +78,10 @@ export const deleteSecretApprovalPolicy = async (req: Request, res: Response) =>
|
||||
const secretApproval = await SecretApprovalPolicy.findById(id);
|
||||
if (!secretApproval) throw ERR_SECRET_APPROVAL_NOT_FOUND;
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: secretApproval.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApproval.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.SecretApproval
|
||||
@ -106,11 +99,7 @@ export const getSecretApprovalPolicy = async (req: Request, res: Response) => {
|
||||
query: { workspaceId }
|
||||
} = await validateRequest(reqValidator.GetSecretApprovalRuleList, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretApproval
|
||||
@ -128,11 +117,7 @@ export const getSecretApprovalPolicyOfBoard = async (req: Request, res: Response
|
||||
query: { workspaceId, environment, secretPath }
|
||||
} = await validateRequest(reqValidator.GetSecretApprovalPolicyOfABoard, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
subject(ProjectPermissionSub.Secrets, { secretPath, environment })
|
||||
|
||||
@ -1,6 +1,7 @@
|
||||
import { Request, Response } from "express";
|
||||
import { getUserProjectPermissions } from "../../services/ProjectRoleService";
|
||||
import { validateRequest } from "../../../helpers/validation";
|
||||
import { Folder, Membership, User } from "../../../models";
|
||||
import { Folder } from "../../../models";
|
||||
import { ApprovalStatus, SecretApprovalRequest } from "../../models/secretApprovalRequest";
|
||||
import * as reqValidator from "../../validation/secretApprovalRequest";
|
||||
import { getFolderWithPathFromId } from "../../../services/FolderService";
|
||||
@ -16,15 +17,7 @@ export const getSecretApprovalRequestCount = async (req: Request, res: Response)
|
||||
query: { workspaceId }
|
||||
} = await validateRequest(reqValidator.getSecretApprovalRequestCount, req);
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
const approvalRequestCount = await SecretApprovalRequest.aggregate([
|
||||
{
|
||||
$match: {
|
||||
@ -72,14 +65,7 @@ export const getSecretApprovalRequests = async (req: Request, res: Response) =>
|
||||
query: { status, committer, workspaceId, environment, limit, offset }
|
||||
} = await validateRequest(reqValidator.getSecretApprovalRequests, req);
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
const { membership } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
|
||||
const query = {
|
||||
workspace: new Types.ObjectId(workspaceId),
|
||||
@ -162,15 +148,10 @@ export const getSecretApprovalRequestDetails = async (req: Request, res: Respons
|
||||
if (!secretApprovalRequest)
|
||||
throw BadRequestError({ message: "Secret approval request not found" });
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: secretApprovalRequest.workspace
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
const { membership } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApprovalRequest.workspace.toString()
|
||||
);
|
||||
// allow to fetch only if its admin or is the committer or approver
|
||||
if (
|
||||
membership.role !== "admin" &&
|
||||
@ -209,15 +190,10 @@ export const updateSecretApprovalReviewStatus = async (req: Request, res: Respon
|
||||
if (!secretApprovalRequest)
|
||||
throw BadRequestError({ message: "Secret approval request not found" });
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: secretApprovalRequest.workspace
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
const { membership } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApprovalRequest.workspace.toString()
|
||||
);
|
||||
if (
|
||||
membership.role !== "admin" &&
|
||||
secretApprovalRequest.committer !== membership.id &&
|
||||
@ -251,15 +227,10 @@ export const mergeSecretApprovalRequest = async (req: Request, res: Response) =>
|
||||
if (!secretApprovalRequest)
|
||||
throw BadRequestError({ message: "Secret approval request not found" });
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: secretApprovalRequest.workspace
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
|
||||
const { membership } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApprovalRequest.workspace.toString()
|
||||
);
|
||||
if (
|
||||
membership.role !== "admin" &&
|
||||
secretApprovalRequest.committer !== membership.id &&
|
||||
@ -301,14 +272,10 @@ export const updateSecretApprovalRequestStatus = async (req: Request, res: Respo
|
||||
if (!secretApprovalRequest)
|
||||
throw BadRequestError({ message: "Secret approval request not found" });
|
||||
|
||||
if (!(req.authData.authPayload instanceof User)) return;
|
||||
|
||||
const membership = await Membership.findOne({
|
||||
user: req.authData.authPayload._id,
|
||||
workspace: secretApprovalRequest.workspace
|
||||
});
|
||||
|
||||
if (!membership) throw UnauthorizedRequestError();
|
||||
const { membership } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretApprovalRequest.workspace.toString()
|
||||
);
|
||||
|
||||
if (
|
||||
membership.role !== "admin" &&
|
||||
|
||||
@ -5,7 +5,7 @@ import { Folder, Secret } from "../../../models";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { BadRequestError } from "../../../utils/errors";
|
||||
import * as reqValidator from "../../../validation";
|
||||
@ -74,11 +74,7 @@ export const getSecretVersions = async (req: Request, res: Response) => {
|
||||
throw BadRequestError({ message: "Failed to find secret" });
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: secret.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, secret.workspace.toString());
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
@ -161,12 +157,10 @@ export const rollbackSecretVersion = async (req: Request, res: Response) => {
|
||||
if (!toBeUpdatedSec) {
|
||||
throw BadRequestError({ message: "Failed to find secret" });
|
||||
}
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: toBeUpdatedSec.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
toBeUpdatedSec.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
|
||||
@ -1,12 +1,11 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { validateRequest } from "../../../helpers/validation";
|
||||
import * as reqValidator from "../../validation/secretRotation";
|
||||
import * as secretRotationService from "../../secretRotation/service";
|
||||
import {
|
||||
getUserProjectPermissions,
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
ProjectPermissionSub
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
|
||||
@ -24,11 +23,7 @@ export const createSecretRotation = async (req: Request, res: Response) => {
|
||||
}
|
||||
} = await validateRequest(reqValidator.createSecretRotationV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.SecretRotation
|
||||
@ -54,12 +49,7 @@ export const restartSecretRotations = async (req: Request, res: Response) => {
|
||||
} = await validateRequest(reqValidator.restartSecretRotationV1, req);
|
||||
|
||||
const doc = await secretRotationService.getSecretRotationById({ id });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: doc.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, doc.workspace.toString());
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.SecretRotation
|
||||
@ -75,12 +65,7 @@ export const deleteSecretRotations = async (req: Request, res: Response) => {
|
||||
} = await validateRequest(reqValidator.removeSecretRotationV1, req);
|
||||
|
||||
const doc = await secretRotationService.getSecretRotationById({ id });
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: doc.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, doc.workspace.toString());
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.SecretRotation
|
||||
@ -95,11 +80,7 @@ export const getSecretRotations = async (req: Request, res: Response) => {
|
||||
query: { workspaceId }
|
||||
} = await validateRequest(reqValidator.getSecretRotationV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRotation
|
||||
|
||||
@ -1,12 +1,11 @@
|
||||
import { Request, Response } from "express";
|
||||
import { Types } from "mongoose";
|
||||
import { validateRequest } from "../../../helpers/validation";
|
||||
import * as reqValidator from "../../validation/secretRotationProvider";
|
||||
import * as secretRotationProviderService from "../../secretRotation/service";
|
||||
import {
|
||||
getUserProjectPermissions,
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
ProjectPermissionSub
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
|
||||
@ -15,11 +14,7 @@ export const getProviderTemplates = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(reqValidator.getSecretRotationProvidersV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRotation
|
||||
|
||||
@ -4,7 +4,7 @@ import { validateRequest } from "../../../helpers/validation";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../services/ProjectRoleService";
|
||||
import * as reqValidator from "../../../validation/secretSnapshot";
|
||||
import { ISecretVersion, SecretSnapshot, TFolderRootVersionSchema } from "../../models";
|
||||
@ -33,11 +33,10 @@ export const getSecretSnapshot = async (req: Request, res: Response) => {
|
||||
|
||||
if (!secretSnapshot) throw new Error("Failed to find secret snapshot");
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: secretSnapshot.workspace
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
secretSnapshot.workspace.toString()
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
|
||||
@ -27,6 +27,7 @@ import {
|
||||
} from "../../models";
|
||||
import { EESecretService } from "../../services";
|
||||
import { getLatestSecretVersionIds } from "../../helpers/secretVersion";
|
||||
// import Folder, { TFolderSchema } from "../../../models/folder";
|
||||
import { getFolderByPath, searchByFolderId } from "../../../services/FolderService";
|
||||
import { EEAuditLogService, EELicenseService } from "../../services";
|
||||
import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
|
||||
@ -45,7 +46,7 @@ import {
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { BadRequestError } from "../../../utils/errors";
|
||||
@ -106,11 +107,7 @@ export const getWorkspaceSecretSnapshots = async (req: Request, res: Response) =
|
||||
query: { environment, directory, offset, limit }
|
||||
} = await validateRequest(GetWorkspaceSecretSnapshotsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
@ -151,11 +148,7 @@ export const getWorkspaceSecretSnapshotsCount = async (req: Request, res: Respon
|
||||
query: { environment, directory }
|
||||
} = await validateRequest(GetWorkspaceSecretSnapshotsCountV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
@ -245,11 +238,7 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
|
||||
body: { directory, environment, version }
|
||||
} = await validateRequest(RollbackWorkspaceSecretSnapshotV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.SecretRollback
|
||||
@ -578,97 +567,17 @@ export const rollbackWorkspaceSecretSnapshot = async (req: Request, res: Respons
|
||||
* @param res
|
||||
*/
|
||||
export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
|
||||
/*
|
||||
#swagger.summary = 'Return audit logs'
|
||||
#swagger.description = 'Return audit logs'
|
||||
|
||||
#swagger.security = [{
|
||||
"apiKeyAuth": []
|
||||
}]
|
||||
|
||||
#swagger.parameters['workspaceId'] = {
|
||||
"description": "ID of the workspace where to get folders from",
|
||||
"required": true,
|
||||
"type": "string",
|
||||
"in": "path"
|
||||
}
|
||||
|
||||
#swagger.parameters['offset'] = {
|
||||
"description": "Number of logs to skip before starting to return logs for pagination",
|
||||
"required": false,
|
||||
"type": "string"
|
||||
}
|
||||
|
||||
#swagger.parameters['limit'] = {
|
||||
"description": "Maximum number of logs to return for pagination",
|
||||
"required": false,
|
||||
"type": "string"
|
||||
}
|
||||
|
||||
#swagger.parameters['startDate'] = {
|
||||
"description": "Filter logs from this date in ISO-8601 format",
|
||||
"required": false,
|
||||
"type": "string"
|
||||
}
|
||||
|
||||
#swagger.parameters['endDate'] = {
|
||||
"description": "Filter logs till this date in ISO-8601 format",
|
||||
"required": false,
|
||||
"type": "string"
|
||||
}
|
||||
|
||||
#swagger.parameters['eventType'] = {
|
||||
"description": "Filter by type of event such as get-secrets, get-secret, create-secret, update-secret, delete-secret, etc.",
|
||||
"required": false,
|
||||
"type": "string",
|
||||
}
|
||||
|
||||
#swagger.parameters['userAgentType'] = {
|
||||
"description": "Filter by type of user agent such as web, cli, k8-operator, or other",
|
||||
"required": false,
|
||||
"type": "string",
|
||||
}
|
||||
|
||||
#swagger.parameters['actor'] = {
|
||||
"description": "Filter by actor such as user or service",
|
||||
"required": false,
|
||||
"type": "string"
|
||||
}
|
||||
|
||||
#swagger.responses[200] = {
|
||||
content: {
|
||||
"application/json": {
|
||||
schema: {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"auditLogs": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
$ref: "#/components/schemas/AuditLog",
|
||||
},
|
||||
"description": "List of audit log"
|
||||
},
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
*/
|
||||
const {
|
||||
query: { limit, offset, endDate, eventType, startDate, userAgentType, actor },
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(GetWorkspaceAuditLogsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.AuditLogs
|
||||
);
|
||||
|
||||
|
||||
const query = {
|
||||
workspace: new Types.ObjectId(workspaceId),
|
||||
...(eventType
|
||||
@ -702,9 +611,14 @@ export const getWorkspaceAuditLogs = async (req: Request, res: Response) => {
|
||||
}
|
||||
: {})
|
||||
};
|
||||
|
||||
const auditLogs = await AuditLog.find(query).sort({ createdAt: -1 }).skip(offset).limit(limit);
|
||||
|
||||
const totalCount = await AuditLog.countDocuments(query);
|
||||
|
||||
return res.status(200).send({
|
||||
auditLogs
|
||||
auditLogs,
|
||||
totalCount
|
||||
});
|
||||
};
|
||||
|
||||
@ -718,11 +632,7 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(GetWorkspaceAuditLogActorFilterOptsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.AuditLogs
|
||||
@ -756,7 +666,7 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
|
||||
name: serviceTokenData.name
|
||||
}
|
||||
}));
|
||||
|
||||
|
||||
const serviceV3Actors: ServiceActorV3[] = (
|
||||
await ServiceTokenDataV3.find({
|
||||
workspace: new Types.ObjectId(workspaceId)
|
||||
@ -768,8 +678,12 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
|
||||
name: serviceTokenData.name
|
||||
}
|
||||
}));
|
||||
|
||||
const actors = [...userActors, ...serviceActors, ...serviceV3Actors];
|
||||
|
||||
const actors = [
|
||||
...userActors,
|
||||
...serviceActors,
|
||||
...serviceV3Actors
|
||||
];
|
||||
|
||||
return res.status(200).send({
|
||||
actors
|
||||
@ -786,11 +700,7 @@ export const getWorkspaceTrustedIps = async (req: Request, res: Response) => {
|
||||
params: { workspaceId }
|
||||
} = await validateRequest(GetWorkspaceTrustedIpsV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Read,
|
||||
ProjectPermissionSub.IpAllowList
|
||||
@ -816,11 +726,7 @@ export const addWorkspaceTrustedIp = async (req: Request, res: Response) => {
|
||||
body: { comment, isActive, ipAddress: ip }
|
||||
} = await validateRequest(AddWorkspaceTrustedIpV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.IpAllowList
|
||||
@ -886,11 +792,7 @@ export const updateWorkspaceTrustedIp = async (req: Request, res: Response) => {
|
||||
body: { ipAddress: ip, comment }
|
||||
} = await validateRequest(UpdateWorkspaceTrustedIpV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
ProjectPermissionSub.IpAllowList
|
||||
@ -982,11 +884,7 @@ export const deleteWorkspaceTrustedIp = async (req: Request, res: Response) => {
|
||||
params: { workspaceId, trustedIpId }
|
||||
} = await validateRequest(DeleteWorkspaceTrustedIpV1, req);
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
ProjectPermissionSub.IpAllowList
|
||||
|
||||
@ -8,11 +8,13 @@ import {
|
||||
ServiceTokenDataV3Key,
|
||||
Workspace
|
||||
} from "../../../models";
|
||||
import { IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
|
||||
import {
|
||||
IServiceTokenV3Scope,
|
||||
IServiceTokenV3TrustedIp
|
||||
} from "../../../models/serviceTokenDataV3";
|
||||
import {
|
||||
ActorType,
|
||||
EventType,
|
||||
Role
|
||||
EventType
|
||||
} from "../../models";
|
||||
import { validateRequest } from "../../../helpers/validation";
|
||||
import * as reqValidator from "../../../validation/serviceTokenDataV3";
|
||||
@ -20,14 +22,14 @@ import { createToken } from "../../../helpers/auth";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getAuthDataProjectPermissions
|
||||
getUserProjectPermissions
|
||||
} from "../../services/ProjectRoleService";
|
||||
import { ForbiddenError } from "@casl/ability";
|
||||
import { BadRequestError, ResourceNotFoundError, UnauthorizedRequestError } from "../../../utils/errors";
|
||||
import { extractIPDetails, isValidIpOrCidr } from "../../../utils/ip";
|
||||
import { EEAuditLogService, EELicenseService } from "../../services";
|
||||
import { getAuthSecret } from "../../../config";
|
||||
import { ADMIN, AuthTokenType, CUSTOM, MEMBER, VIEWER } from "../../../variables";
|
||||
import { AuthTokenType } from "../../../variables";
|
||||
|
||||
/**
|
||||
* Return project key for service token V3
|
||||
@ -161,7 +163,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
name,
|
||||
workspaceId,
|
||||
publicKey,
|
||||
role,
|
||||
scopes,
|
||||
trustedIps,
|
||||
expiresIn,
|
||||
accessTokenTTL,
|
||||
@ -170,11 +172,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
nonce, // for ServiceTokenDataV3Key
|
||||
}
|
||||
} = await validateRequest(reqValidator.CreateServiceTokenV3, req);
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: new Types.ObjectId(workspaceId)
|
||||
});
|
||||
|
||||
const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Create,
|
||||
ProjectPermissionSub.ServiceTokens
|
||||
@ -183,19 +181,6 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
const workspace = await Workspace.findById(workspaceId);
|
||||
if (!workspace) throw BadRequestError({ message: "Workspace not found" });
|
||||
|
||||
const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
|
||||
|
||||
let customRole;
|
||||
if (isCustomRole) {
|
||||
customRole = await Role.findOne({
|
||||
slug: role,
|
||||
isOrgRole: false,
|
||||
workspace: workspace._id
|
||||
});
|
||||
|
||||
if (!customRole) throw BadRequestError({ message: "Role not found" });
|
||||
}
|
||||
|
||||
const plan = await EELicenseService.getPlan(workspace.organization);
|
||||
|
||||
// validate trusted ips
|
||||
@ -234,8 +219,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
accessTokenUsageCount: 0,
|
||||
tokenVersion: 1,
|
||||
trustedIps: reformattedTrustedIps,
|
||||
role: isCustomRole ? CUSTOM : role,
|
||||
customRole,
|
||||
scopes,
|
||||
isActive,
|
||||
expiresAt,
|
||||
accessTokenTTL,
|
||||
@ -266,7 +250,7 @@ export const createServiceTokenData = async (req: Request, res: Response) => {
|
||||
metadata: {
|
||||
name,
|
||||
isActive,
|
||||
role,
|
||||
scopes: scopes as Array<IServiceTokenV3Scope>,
|
||||
trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
|
||||
expiresAt
|
||||
}
|
||||
@ -294,7 +278,7 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
|
||||
body: {
|
||||
name,
|
||||
isActive,
|
||||
role,
|
||||
scopes,
|
||||
trustedIps,
|
||||
expiresIn,
|
||||
accessTokenTTL,
|
||||
@ -307,10 +291,10 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
|
||||
message: "Service token not found"
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: serviceTokenData.workspace
|
||||
});
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
serviceTokenData.workspace.toString()
|
||||
);
|
||||
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Edit,
|
||||
@ -320,20 +304,6 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
|
||||
const workspace = await Workspace.findById(serviceTokenData.workspace);
|
||||
if (!workspace) throw BadRequestError({ message: "Workspace not found" });
|
||||
|
||||
let customRole;
|
||||
if (role) {
|
||||
const isCustomRole = ![ADMIN, MEMBER, VIEWER].includes(role);
|
||||
if (isCustomRole) {
|
||||
customRole = await Role.findOne({
|
||||
slug: role,
|
||||
isOrgRole: false,
|
||||
workspace: workspace._id
|
||||
});
|
||||
|
||||
if (!customRole) throw BadRequestError({ message: "Role not found" });
|
||||
}
|
||||
}
|
||||
|
||||
const plan = await EELicenseService.getPlan(workspace.organization);
|
||||
|
||||
// validate trusted ips
|
||||
@ -365,15 +335,7 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
|
||||
{
|
||||
name,
|
||||
isActive,
|
||||
role: customRole ? CUSTOM : role,
|
||||
...(customRole ? {
|
||||
customRole
|
||||
} : {}),
|
||||
...(role && !customRole ? { // non-custom role
|
||||
$unset: {
|
||||
customRole: 1
|
||||
}
|
||||
} : {}),
|
||||
scopes,
|
||||
trustedIps: reformattedTrustedIps,
|
||||
expiresAt,
|
||||
accessTokenTTL,
|
||||
@ -395,7 +357,7 @@ export const updateServiceTokenData = async (req: Request, res: Response) => {
|
||||
metadata: {
|
||||
name: serviceTokenData.name,
|
||||
isActive,
|
||||
role,
|
||||
scopes: scopes as Array<IServiceTokenV3Scope>,
|
||||
trustedIps: reformattedTrustedIps as Array<IServiceTokenV3TrustedIp>,
|
||||
expiresAt
|
||||
}
|
||||
@ -426,10 +388,10 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
|
||||
message: "Service token not found"
|
||||
});
|
||||
|
||||
const { permission } = await getAuthDataProjectPermissions({
|
||||
authData: req.authData,
|
||||
workspaceId: serviceTokenData.workspace
|
||||
});
|
||||
const { permission } = await getUserProjectPermissions(
|
||||
req.user._id,
|
||||
serviceTokenData.workspace.toString()
|
||||
);
|
||||
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
ProjectPermissionActions.Delete,
|
||||
@ -453,7 +415,7 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => {
|
||||
metadata: {
|
||||
name: serviceTokenData.name,
|
||||
isActive: serviceTokenData.isActive,
|
||||
role: serviceTokenData.role,
|
||||
scopes: serviceTokenData.scopes as Array<IServiceTokenV3Scope>,
|
||||
trustedIps: serviceTokenData.trustedIps as Array<IServiceTokenV3TrustedIp>,
|
||||
expiresAt: serviceTokenData.expiresAt
|
||||
}
|
||||
|
||||
@ -1,70 +1,76 @@
|
||||
import { Schema, Types, model } from "mongoose";
|
||||
import { ActorType, EventType, UserAgentType } from "./enums";
|
||||
import { Actor, Event } from "./types";
|
||||
import {
|
||||
ActorType,
|
||||
EventType,
|
||||
UserAgentType
|
||||
} from "./enums";
|
||||
import {
|
||||
Actor,
|
||||
Event
|
||||
} from "./types";
|
||||
|
||||
export interface IAuditLog {
|
||||
actor: Actor;
|
||||
organization: Types.ObjectId;
|
||||
workspace: Types.ObjectId;
|
||||
ipAddress: string;
|
||||
event: Event;
|
||||
userAgent: string;
|
||||
userAgentType: UserAgentType;
|
||||
expiresAt: Date;
|
||||
actor: Actor;
|
||||
organization: Types.ObjectId;
|
||||
workspace: Types.ObjectId;
|
||||
ipAddress: string;
|
||||
event: Event;
|
||||
userAgent: string;
|
||||
userAgentType: UserAgentType;
|
||||
expiresAt: Date;
|
||||
}
|
||||
|
||||
const auditLogSchema = new Schema<IAuditLog>(
|
||||
{
|
||||
actor: {
|
||||
type: {
|
||||
type: String,
|
||||
enum: ActorType,
|
||||
required: true
|
||||
},
|
||||
metadata: {
|
||||
type: Schema.Types.Mixed
|
||||
}
|
||||
{
|
||||
actor: {
|
||||
type: {
|
||||
type: String,
|
||||
enum: ActorType,
|
||||
required: true
|
||||
},
|
||||
metadata: {
|
||||
type: Schema.Types.Mixed
|
||||
}
|
||||
},
|
||||
organization: {
|
||||
type: Schema.Types.ObjectId,
|
||||
required: false
|
||||
},
|
||||
workspace: {
|
||||
type: Schema.Types.ObjectId,
|
||||
required: false
|
||||
},
|
||||
ipAddress: {
|
||||
type: String,
|
||||
required: true
|
||||
},
|
||||
event: {
|
||||
type: {
|
||||
type: String,
|
||||
enum: EventType,
|
||||
required: true
|
||||
},
|
||||
metadata: {
|
||||
type: Schema.Types.Mixed
|
||||
}
|
||||
},
|
||||
userAgent: {
|
||||
type: String,
|
||||
required: true
|
||||
},
|
||||
userAgentType: {
|
||||
type: String,
|
||||
enum: UserAgentType,
|
||||
required: true
|
||||
},
|
||||
expiresAt: {
|
||||
type: Date,
|
||||
expires: 0
|
||||
}
|
||||
},
|
||||
organization: {
|
||||
type: Schema.Types.ObjectId,
|
||||
required: false
|
||||
},
|
||||
workspace: {
|
||||
type: Schema.Types.ObjectId,
|
||||
required: false,
|
||||
index: true
|
||||
},
|
||||
ipAddress: {
|
||||
type: String,
|
||||
required: true
|
||||
},
|
||||
event: {
|
||||
type: {
|
||||
type: String,
|
||||
enum: EventType,
|
||||
required: true
|
||||
},
|
||||
metadata: {
|
||||
type: Schema.Types.Mixed
|
||||
}
|
||||
},
|
||||
userAgent: {
|
||||
type: String,
|
||||
required: true
|
||||
},
|
||||
userAgentType: {
|
||||
type: String,
|
||||
enum: UserAgentType,
|
||||
required: true
|
||||
},
|
||||
expiresAt: {
|
||||
type: Date,
|
||||
expires: 0
|
||||
{
|
||||
timestamps: true
|
||||
}
|
||||
},
|
||||
{
|
||||
timestamps: true
|
||||
}
|
||||
);
|
||||
|
||||
export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema);
|
||||
export const AuditLog = model<IAuditLog>("AuditLog", auditLogSchema);
|
||||
|
||||
@ -2,7 +2,7 @@ export enum ActorType {
|
||||
USER = "user",
|
||||
SERVICE = "service",
|
||||
SERVICE_V3 = "service-v3",
|
||||
// Machine = "machine"
|
||||
Machine = "machine"
|
||||
}
|
||||
|
||||
export enum UserAgentType {
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
import { ActorType, EventType } from "./enums";
|
||||
import { IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
|
||||
import { IServiceTokenV3Scope, IServiceTokenV3TrustedIp } from "../../../models/serviceTokenDataV3";
|
||||
|
||||
interface UserActorMetadata {
|
||||
userId: string;
|
||||
@ -26,11 +26,11 @@ export interface ServiceActorV3 {
|
||||
metadata: ServiceActorMetadata;
|
||||
}
|
||||
|
||||
// export interface MachineActor {
|
||||
// type: ActorType.Machine;
|
||||
// }
|
||||
export interface MachineActor {
|
||||
type: ActorType.Machine;
|
||||
}
|
||||
|
||||
export type Actor = UserActor | ServiceActor | ServiceActorV3;
|
||||
export type Actor = UserActor | ServiceActor | ServiceActorV3 | MachineActor;
|
||||
|
||||
interface GetSecretsEvent {
|
||||
type: EventType.GET_SECRETS;
|
||||
@ -225,7 +225,7 @@ interface CreateServiceTokenV3Event {
|
||||
metadata: {
|
||||
name: string;
|
||||
isActive: boolean;
|
||||
role: string;
|
||||
scopes: Array<IServiceTokenV3Scope>;
|
||||
trustedIps: Array<IServiceTokenV3TrustedIp>;
|
||||
expiresAt?: Date;
|
||||
};
|
||||
@ -236,7 +236,7 @@ interface UpdateServiceTokenV3Event {
|
||||
metadata: {
|
||||
name?: string;
|
||||
isActive?: boolean;
|
||||
role?: string;
|
||||
scopes?: Array<IServiceTokenV3Scope>;
|
||||
trustedIps?: Array<IServiceTokenV3TrustedIp>;
|
||||
expiresAt?: Date;
|
||||
};
|
||||
@ -247,7 +247,7 @@ interface DeleteServiceTokenV3Event {
|
||||
metadata: {
|
||||
name: string;
|
||||
isActive: boolean;
|
||||
role: string;
|
||||
scopes: Array<IServiceTokenV3Scope>;
|
||||
expiresAt?: Date;
|
||||
trustedIps: Array<IServiceTokenV3TrustedIp>;
|
||||
};
|
||||
|
||||
@ -1,4 +1,3 @@
|
||||
import { Types } from "mongoose";
|
||||
import {
|
||||
AbilityBuilder,
|
||||
ForcedSubject,
|
||||
@ -7,14 +6,11 @@ import {
|
||||
buildMongoQueryMatcher,
|
||||
createMongoAbility
|
||||
} from "@casl/ability";
|
||||
import { UnauthorizedRequestError } from "../../utils/errors";
|
||||
import { Membership } from "../../models";
|
||||
import { IRole } from "../models/role";
|
||||
import { BadRequestError, UnauthorizedRequestError } from "../../utils/errors";
|
||||
import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
|
||||
import picomatch from "picomatch";
|
||||
import { AuthData } from "../../interfaces/middleware";
|
||||
import { ActorType, IRole } from "../models";
|
||||
import { Membership, ServiceTokenData, ServiceTokenDataV3 } from "../../models";
|
||||
import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../../variables";
|
||||
import { checkIPAgainstBlocklist } from "../../utils/ip";
|
||||
|
||||
const $glob: FieldInstruction<string> = {
|
||||
type: "field",
|
||||
@ -243,89 +239,31 @@ const buildViewerPermission = () => {
|
||||
|
||||
export const viewerProjectPermission = buildViewerPermission();
|
||||
|
||||
/**
|
||||
* Return permissions for user/service pertaining to workspace with id [workspaceId]
|
||||
*
|
||||
* Note: should not rely on this function for ST V2 authorization logic
|
||||
* b/c ST V2 does not support role-based access control
|
||||
*/
|
||||
export const getAuthDataProjectPermissions = async ({
|
||||
authData,
|
||||
workspaceId
|
||||
}: {
|
||||
authData: AuthData;
|
||||
workspaceId: Types.ObjectId;
|
||||
}) => {
|
||||
let role: "admin" | "member" | "viewer" | "custom";
|
||||
let customRole;
|
||||
|
||||
switch (authData.actor.type) {
|
||||
case ActorType.USER: {
|
||||
const membership = await Membership.findOne({
|
||||
user: authData.authPayload._id,
|
||||
workspace: workspaceId
|
||||
})
|
||||
.populate<{
|
||||
customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
|
||||
}>("customRole")
|
||||
.exec();
|
||||
|
||||
if (!membership || (membership.role === "custom" && !membership.customRole)) {
|
||||
throw UnauthorizedRequestError();
|
||||
}
|
||||
|
||||
role = membership.role;
|
||||
customRole = membership.customRole;
|
||||
break;
|
||||
}
|
||||
case ActorType.SERVICE: {
|
||||
const serviceTokenData = await ServiceTokenData.findById(authData.authPayload._id);
|
||||
if (!serviceTokenData || !serviceTokenData.workspace.equals(workspaceId)) throw UnauthorizedRequestError();
|
||||
role = "viewer";
|
||||
break;
|
||||
}
|
||||
case ActorType.SERVICE_V3: {
|
||||
const serviceTokenData = await ServiceTokenDataV3
|
||||
.findById(authData.authPayload._id)
|
||||
.populate<{
|
||||
customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
|
||||
}>("customRole")
|
||||
.exec();
|
||||
|
||||
if (!serviceTokenData || (serviceTokenData.role === "custom" && !serviceTokenData.customRole)) {
|
||||
throw UnauthorizedRequestError();
|
||||
}
|
||||
export const getUserProjectPermissions = async (userId: string, workspaceId: string) => {
|
||||
// TODO(akhilmhdh): speed this up by pulling from cache later
|
||||
const membership = await Membership.findOne({
|
||||
user: userId,
|
||||
workspace: workspaceId
|
||||
})
|
||||
.populate<{
|
||||
customRole: IRole & { permissions: RawRuleOf<MongoAbility<ProjectPermissionSet>>[] };
|
||||
}>("customRole")
|
||||
.exec();
|
||||
|
||||
checkIPAgainstBlocklist({
|
||||
ipAddress: authData.ipAddress,
|
||||
trustedIps: serviceTokenData.trustedIps
|
||||
});
|
||||
|
||||
role = serviceTokenData.role;
|
||||
customRole = serviceTokenData.customRole;
|
||||
break;
|
||||
}
|
||||
default:
|
||||
throw UnauthorizedRequestError();
|
||||
if (!membership || (membership.role === "custom" && !membership.customRole)) {
|
||||
throw UnauthorizedRequestError({ message: "User doesn't belong to organization" });
|
||||
}
|
||||
|
||||
switch (role) {
|
||||
case ADMIN:
|
||||
return { permission: adminProjectPermissions };
|
||||
case MEMBER:
|
||||
return { permission: memberProjectPermissions };
|
||||
case VIEWER:
|
||||
return { permission: viewerProjectPermission };
|
||||
case CUSTOM: {
|
||||
if (!customRole) throw UnauthorizedRequestError();
|
||||
return {
|
||||
permission: createMongoAbility<ProjectPermissionSet>(
|
||||
customRole.permissions,
|
||||
{ conditionsMatcher }
|
||||
)
|
||||
};
|
||||
}
|
||||
default:
|
||||
throw UnauthorizedRequestError();
|
||||
if (membership.role === "admin") return { permission: adminProjectPermissions, membership };
|
||||
if (membership.role === "member") return { permission: memberProjectPermissions, membership };
|
||||
if (membership.role === "viewer") return { permission: viewerProjectPermission, membership };
|
||||
|
||||
if (membership.role === "custom") {
|
||||
const permission = createMongoAbility<ProjectPermissionSet>(membership.customRole.permissions, {
|
||||
conditionsMatcher
|
||||
});
|
||||
return { permission, membership };
|
||||
}
|
||||
}
|
||||
|
||||
throw BadRequestError({ message: "User role not found" });
|
||||
};
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
import { Types } from "mongoose";
|
||||
import { EVENT_PULL_SECRETS, EVENT_PUSH_SECRETS } from "../variables";
|
||||
import { EVENT_PUSH_SECRETS } from "../variables";
|
||||
|
||||
interface PushSecret {
|
||||
ciphertextKey: string;
|
||||
@ -37,18 +37,4 @@ const eventPushSecrets = ({
|
||||
};
|
||||
};
|
||||
|
||||
/**
|
||||
* Return event for pulling secrets
|
||||
* @param {Object} obj
|
||||
* @param {String} obj.workspaceId - id of workspace to pull secrets from
|
||||
* @returns
|
||||
*/
|
||||
const eventPullSecrets = ({ workspaceId }: { workspaceId: string }) => {
|
||||
return {
|
||||
name: EVENT_PULL_SECRETS,
|
||||
workspaceId,
|
||||
payload: {}
|
||||
};
|
||||
};
|
||||
|
||||
export { eventPushSecrets };
|
||||
|
||||
@ -1,58 +0,0 @@
|
||||
import { ISecret } from "../models";
|
||||
import {
|
||||
createRecurringSecretReminder,
|
||||
deleteRecurringSecretReminder,
|
||||
updateRecurringSecretReminder
|
||||
} from "../queues/reminders/sendSecretReminders";
|
||||
|
||||
type TPartialSecret = Pick<
|
||||
ISecret,
|
||||
"_id" | "secretReminderRepeatDays" | "secretReminderNote" | "workspace"
|
||||
>;
|
||||
type TPartialSecretDeleteReminder = Pick<ISecret, "_id" | "secretReminderRepeatDays">;
|
||||
|
||||
export const createReminder = async (oldSecret: TPartialSecret, newSecret: TPartialSecret) => {
|
||||
if (oldSecret._id !== newSecret._id) {
|
||||
throw new Error("Secret id's don't match");
|
||||
}
|
||||
|
||||
if (!newSecret.secretReminderRepeatDays) {
|
||||
throw new Error("No repeat days provided");
|
||||
}
|
||||
|
||||
const secretId = oldSecret._id.toString();
|
||||
const workspaceId = oldSecret.workspace.toString();
|
||||
|
||||
if (oldSecret.secretReminderRepeatDays) {
|
||||
// This will first delete the existing recurring job, and then create a new one.
|
||||
await updateRecurringSecretReminder({
|
||||
workspaceId,
|
||||
secretId,
|
||||
repeatDays: newSecret.secretReminderRepeatDays,
|
||||
note: newSecret.secretReminderNote
|
||||
});
|
||||
} else {
|
||||
// This will create a new recurring job.
|
||||
await createRecurringSecretReminder({
|
||||
workspaceId,
|
||||
secretId,
|
||||
repeatDays: newSecret.secretReminderRepeatDays,
|
||||
note: newSecret.secretReminderNote
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const deleteReminder = async (secret: TPartialSecretDeleteReminder) => {
|
||||
if (!secret._id) {
|
||||
throw new Error("No secret id provided");
|
||||
}
|
||||
|
||||
if (!secret.secretReminderRepeatDays) {
|
||||
throw new Error("No repeat days provided");
|
||||
}
|
||||
|
||||
await deleteRecurringSecretReminder({
|
||||
secretId: secret._id.toString(),
|
||||
repeatDays: secret.secretReminderRepeatDays
|
||||
});
|
||||
};
|
||||
@ -11,14 +11,17 @@ import {
|
||||
} from "../interfaces/services/SecretService";
|
||||
import {
|
||||
Folder,
|
||||
IMembership,
|
||||
ISecret,
|
||||
IServiceTokenData,
|
||||
IServiceTokenDataV3,
|
||||
Secret,
|
||||
SecretBlindIndexData,
|
||||
ServiceTokenData,
|
||||
TFolderRootSchema
|
||||
} from "../models";
|
||||
import { EventType, SecretVersion } from "../ee/models";
|
||||
import { Permission } from "../models/serviceTokenDataV3";
|
||||
import { ActorType, EventType, IRole, SecretVersion } from "../ee/models";
|
||||
import {
|
||||
BadRequestError,
|
||||
InternalServerError,
|
||||
@ -31,6 +34,8 @@ import {
|
||||
ENCODING_SCHEME_BASE64,
|
||||
ENCODING_SCHEME_UTF8,
|
||||
K8_USER_AGENT_NAME,
|
||||
PERMISSION_READ_SECRETS,
|
||||
PERMISSION_WRITE_SECRETS,
|
||||
SECRET_PERSONAL,
|
||||
SECRET_SHARED
|
||||
} from "../variables";
|
||||
@ -40,7 +45,8 @@ import {
|
||||
decryptSymmetric128BitHexKeyUTF8,
|
||||
encryptSymmetric128BitHexKeyUTF8
|
||||
} from "../utils/crypto";
|
||||
import { TelemetryService } from "../services";
|
||||
import { EventService, TelemetryService } from "../services";
|
||||
import { eventPushSecrets } from "../events";
|
||||
import { client, getEncryptionKey, getRootEncryptionKey } from "../config";
|
||||
import { EEAuditLogService, EESecretService } from "../ee/services";
|
||||
import { getAuthDataPayloadUserObj } from "../utils/authn/helpers";
|
||||
@ -48,6 +54,148 @@ import { getFolderByPath, getFolderIdFromServiceToken } from "../services/Folder
|
||||
import picomatch from "picomatch";
|
||||
import path from "path";
|
||||
import { getAnImportedSecret } from "../services/SecretImportService";
|
||||
import { AuthData } from "../interfaces/middleware";
|
||||
import {
|
||||
ProjectPermissionActions,
|
||||
ProjectPermissionSub,
|
||||
getUserProjectPermissions
|
||||
} from "../ee/services/ProjectRoleService";
|
||||
import { ForbiddenError, subject } from "@casl/ability";
|
||||
import {
|
||||
validateServiceTokenDataClientForWorkspace,
|
||||
validateServiceTokenDataV3ClientForWorkspace
|
||||
} from "../validation";
|
||||
|
||||
export const checkSecretsPermission = async ({
|
||||
authData,
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath,
|
||||
secretAction
|
||||
}: {
|
||||
authData: AuthData;
|
||||
workspaceId: string;
|
||||
environment: string;
|
||||
secretPath: string;
|
||||
secretAction: ProjectPermissionActions; // CRUD
|
||||
}): Promise<{
|
||||
authVerifier: (env: string, secPath: string) => boolean;
|
||||
membership?: Omit<IMembership, "customRole"> & { customRole: IRole };
|
||||
}> => {
|
||||
let STV2RequiredPermissions = [];
|
||||
let STV3RequiredPermissions: Permission[] = [];
|
||||
|
||||
switch (secretAction) {
|
||||
case ProjectPermissionActions.Create:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
STV3RequiredPermissions = [Permission.WRITE];
|
||||
break;
|
||||
case ProjectPermissionActions.Read:
|
||||
STV2RequiredPermissions = [PERMISSION_READ_SECRETS];
|
||||
STV3RequiredPermissions = [Permission.READ];
|
||||
break;
|
||||
case ProjectPermissionActions.Edit:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
STV3RequiredPermissions = [Permission.WRITE];
|
||||
break;
|
||||
case ProjectPermissionActions.Delete:
|
||||
STV2RequiredPermissions = [PERMISSION_WRITE_SECRETS];
|
||||
STV3RequiredPermissions = [Permission.WRITE];
|
||||
break;
|
||||
}
|
||||
|
||||
switch (authData.actor.type) {
|
||||
case ActorType.USER: {
|
||||
const { permission, membership } = await getUserProjectPermissions(
|
||||
authData.actor.metadata.userId,
|
||||
workspaceId
|
||||
);
|
||||
ForbiddenError.from(permission).throwUnlessCan(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, { environment, secretPath })
|
||||
);
|
||||
return {
|
||||
authVerifier: (env: string, secPath: string) =>
|
||||
permission.can(
|
||||
secretAction,
|
||||
subject(ProjectPermissionSub.Secrets, {
|
||||
environment: env,
|
||||
secretPath: secPath
|
||||
})
|
||||
),
|
||||
membership
|
||||
};
|
||||
}
|
||||
case ActorType.SERVICE: {
|
||||
await validateServiceTokenDataClientForWorkspace({
|
||||
serviceTokenData: authData.authPayload as IServiceTokenData,
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath,
|
||||
requiredPermissions: STV2RequiredPermissions
|
||||
});
|
||||
return { authVerifier: () => true };
|
||||
}
|
||||
case ActorType.SERVICE_V3: {
|
||||
await validateServiceTokenDataV3ClientForWorkspace({
|
||||
authData,
|
||||
serviceTokenData: authData.authPayload as IServiceTokenDataV3,
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath,
|
||||
requiredPermissions: STV3RequiredPermissions
|
||||
});
|
||||
return {
|
||||
authVerifier: (env: string, secPath: string) =>
|
||||
isValidScopeV3({
|
||||
authPayload: authData.authPayload as IServiceTokenDataV3,
|
||||
environment: env,
|
||||
secretPath: secPath,
|
||||
requiredPermissions: STV3RequiredPermissions
|
||||
})
|
||||
};
|
||||
}
|
||||
default: {
|
||||
throw UnauthorizedRequestError();
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
/**
|
||||
* Validate scope for service token v3
|
||||
* @param authPayload
|
||||
* @param environment
|
||||
* @param secretPath
|
||||
* @returns
|
||||
*/
|
||||
export const isValidScopeV3 = ({
|
||||
authPayload,
|
||||
environment,
|
||||
secretPath,
|
||||
requiredPermissions
|
||||
}: {
|
||||
authPayload: IServiceTokenDataV3;
|
||||
environment: string;
|
||||
secretPath: string;
|
||||
requiredPermissions: Permission[];
|
||||
}) => {
|
||||
const { scopes } = authPayload;
|
||||
|
||||
const validScope = scopes.find(
|
||||
(scope) =>
|
||||
picomatch.isMatch(secretPath, scope.secretPath, { strictSlashes: false }) &&
|
||||
scope.environment === environment
|
||||
);
|
||||
|
||||
if (
|
||||
validScope &&
|
||||
!requiredPermissions.every((permission) => validScope.permissions.includes(permission))
|
||||
) {
|
||||
return false;
|
||||
}
|
||||
|
||||
return Boolean(validScope);
|
||||
};
|
||||
|
||||
/**
|
||||
* Validate scope for service token v2
|
||||
@ -81,13 +229,12 @@ const ERR_FOLDER_NOT_FOUND = BadRequestError({ message: "Folder not found" });
|
||||
|
||||
/**
|
||||
* Returns an object containing secret [secret] but with its value, key, comment decrypted.
|
||||
*
|
||||
* Precondition: the workspace for secret [secret] must have E2EE disabled
|
||||
* @param {ISecret} secret - secret to repackage to raw
|
||||
* @param {String} key - symmetric key to use to decrypt secret
|
||||
* @returns
|
||||
*/
|
||||
export const repackageSecretToRaw = ({ secret, key }: { secret: ISecret; key: string }) => {
|
||||
export const repackageSecretV3ToRaw = ({ secret, key }: { secret: ISecret; key: string }) => {
|
||||
const secretKey = decryptSymmetric128BitHexKeyUTF8({
|
||||
ciphertext: secret.secretKeyCiphertext,
|
||||
iv: secret.secretKeyIV,
|
||||
@ -122,7 +269,8 @@ export const repackageSecretToRaw = ({ secret, key }: { secret: ISecret; key: st
|
||||
user: secret.user,
|
||||
secretKey,
|
||||
secretValue,
|
||||
secretComment
|
||||
secretComment,
|
||||
skipMultilineEncoding: secret.skipMultilineEncoding
|
||||
};
|
||||
};
|
||||
|
||||
@ -479,6 +627,14 @@ export const createSecretHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return secret;
|
||||
};
|
||||
|
||||
@ -574,20 +730,18 @@ export const getSecretsHelper = async ({
|
||||
const approximateForNoneCapturedEvents = secrets.length * 10;
|
||||
|
||||
if (shouldCapture) {
|
||||
if (workspaceId.toString() != "650e71fbae3e6c8572f436d4") {
|
||||
postHogClient.capture({
|
||||
event: "secrets pulled",
|
||||
distinctId: await TelemetryService.getDistinctId({ authData }),
|
||||
properties: {
|
||||
numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
|
||||
environment,
|
||||
workspaceId,
|
||||
folderId,
|
||||
channel: authData.userAgentType,
|
||||
userAgent: authData.userAgent
|
||||
}
|
||||
});
|
||||
}
|
||||
postHogClient.capture({
|
||||
event: "secrets pulled",
|
||||
distinctId: await TelemetryService.getDistinctId({ authData }),
|
||||
properties: {
|
||||
numberOfSecrets: shouldRecordK8Event ? approximateForNoneCapturedEvents : secrets.length,
|
||||
environment,
|
||||
workspaceId,
|
||||
folderId,
|
||||
channel: authData.userAgentType,
|
||||
userAgent: authData.userAgent
|
||||
}
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
@ -719,9 +873,7 @@ export const updateSecretHelper = async ({
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretPath,
|
||||
secretReminderRepeatDays,
|
||||
secretReminderNote,
|
||||
tags,
|
||||
tags, // maybe this can accept just a secretComment?
|
||||
secretCommentCiphertext,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
@ -785,10 +937,6 @@ export const updateSecretHelper = async ({
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
secretCommentCiphertext,
|
||||
|
||||
secretReminderRepeatDays,
|
||||
secretReminderNote,
|
||||
|
||||
skipMultilineEncoding,
|
||||
secretBlindIndex: newSecretNameBlindIndex,
|
||||
secretKeyIV,
|
||||
@ -820,6 +968,9 @@ export const updateSecretHelper = async ({
|
||||
secretKeyIV,
|
||||
secretKeyTag,
|
||||
secretKeyCiphertext,
|
||||
secretCommentCiphertext,
|
||||
secretCommentIV,
|
||||
secretCommentTag,
|
||||
tags,
|
||||
skipMultilineEncoding,
|
||||
secretBlindIndex: newSecretNameBlindIndex,
|
||||
@ -847,9 +998,12 @@ export const updateSecretHelper = async ({
|
||||
secretKeyCiphertext: secret.secretKeyCiphertext,
|
||||
secretKeyIV: secret.secretKeyIV,
|
||||
secretKeyTag: secret.secretKeyTag,
|
||||
secretValueCiphertext,
|
||||
secretValueIV,
|
||||
secretValueTag,
|
||||
secretValueCiphertext: secret.secretValueCiphertext,
|
||||
secretValueIV: secret.secretValueIV,
|
||||
secretValueTag: secret.secretValueTag,
|
||||
secretCommentCiphertext: secret.secretCommentCiphertext,
|
||||
secretCommentIV: secret.secretCommentIV,
|
||||
secretCommentTag: secret.secretCommentTag,
|
||||
skipMultilineEncoding,
|
||||
algorithm: ALGORITHM_AES_256_GCM,
|
||||
keyEncoding: ENCODING_SCHEME_UTF8
|
||||
@ -903,6 +1057,14 @@ export const updateSecretHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return secret;
|
||||
};
|
||||
|
||||
@ -1030,6 +1192,14 @@ export const deleteSecretHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return {
|
||||
secrets,
|
||||
secret
|
||||
@ -1377,6 +1547,14 @@ export const createSecretBatchHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return newlyCreatedSecrets;
|
||||
};
|
||||
|
||||
@ -1572,6 +1750,14 @@ export const updateSecretBatchHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return;
|
||||
};
|
||||
|
||||
@ -1695,7 +1881,54 @@ export const deleteSecretBatchHelper = async ({
|
||||
});
|
||||
}
|
||||
|
||||
await EventService.handleEvent({
|
||||
event: eventPushSecrets({
|
||||
workspaceId: new Types.ObjectId(workspaceId),
|
||||
environment,
|
||||
secretPath
|
||||
})
|
||||
});
|
||||
|
||||
return {
|
||||
secrets: deletedSecrets
|
||||
};
|
||||
};
|
||||
|
||||
// --- v4/secrets helpers
|
||||
export const packageSecretV4 = ({
|
||||
secret,
|
||||
key
|
||||
}: {
|
||||
secret: ISecret;
|
||||
key: string;
|
||||
}) => {
|
||||
|
||||
const {
|
||||
_id,
|
||||
version,
|
||||
workspace,
|
||||
type,
|
||||
environment,
|
||||
user,
|
||||
secretKey,
|
||||
secretValue,
|
||||
secretComment,
|
||||
skipMultilineEncoding
|
||||
} = repackageSecretV3ToRaw({
|
||||
secret,
|
||||
key
|
||||
});
|
||||
|
||||
return ({
|
||||
_id,
|
||||
version,
|
||||
projectId: workspace,
|
||||
environmentSlug: environment,
|
||||
type,
|
||||
user,
|
||||
secretName: secretKey,
|
||||
secretValue,
|
||||
secretComment,
|
||||
skipMultilineEncoding
|
||||
});
|
||||
}
|
||||
@ -2,10 +2,10 @@ import dotenv from "dotenv";
|
||||
dotenv.config();
|
||||
import express from "express";
|
||||
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
||||
import "express-async-errors";
|
||||
require("express-async-errors");
|
||||
import helmet from "helmet";
|
||||
import cors from "cors";
|
||||
import { initLogger, logger } from "./utils/logging";
|
||||
import { logger } from "./utils/logging";
|
||||
import httpLogger from "pino-http";
|
||||
import { DatabaseService } from "./services";
|
||||
import { EELicenseService, GithubSecretScanningService } from "./ee/services";
|
||||
@ -77,6 +77,9 @@ import {
|
||||
users as v3UsersRouter,
|
||||
workspaces as v3WorkspacesRouter
|
||||
} from "./routes/v3";
|
||||
import {
|
||||
secrets as v4SecretsRouter
|
||||
} from "./routes/v4";
|
||||
import { healthCheck } from "./routes/status";
|
||||
// import { getLogger } from "./utils/logger";
|
||||
import { RouteNotFoundError } from "./utils/errors";
|
||||
@ -97,17 +100,13 @@ import { githubPushEventSecretScan } from "./queues/secret-scanning/githubScanPu
|
||||
const SmeeClient = require("smee-client"); // eslint-disable-line
|
||||
import path from "path";
|
||||
import { serverConfigInit } from "./config/serverConfig";
|
||||
import { initRedis } from "./services/RedisService";
|
||||
|
||||
let handler: null | any = null;
|
||||
|
||||
const main = async () => {
|
||||
await initLogger();
|
||||
|
||||
const port = await getPort();
|
||||
|
||||
// initializing the database connection + redis
|
||||
await initRedis()
|
||||
// initializing the database connection
|
||||
await DatabaseService.initDatabase(await getMongoURL());
|
||||
const serverCfg = await serverConfigInit();
|
||||
await setup();
|
||||
@ -256,6 +255,9 @@ const main = async () => {
|
||||
app.use("/api/v3/workspaces", v3WorkspacesRouter);
|
||||
app.use("/api/v3/signup", v3SignupRouter);
|
||||
app.use("/api/v3/us", v3UsersRouter);
|
||||
|
||||
// v4 routes (user-facing)
|
||||
app.use("/api/v4/secrets", v4SecretsRouter);
|
||||
|
||||
// api docs
|
||||
app.use("/api-docs", swaggerUi.serve, swaggerUi.setup(swaggerFile));
|
||||
|
||||
@ -10,8 +10,6 @@ import {
|
||||
INTEGRATION_CIRCLECI_API_URL,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_PAGES_API_URL,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS_API_URL,
|
||||
INTEGRATION_CLOUD_66,
|
||||
INTEGRATION_CLOUD_66_API_URL,
|
||||
INTEGRATION_CODEFRESH,
|
||||
@ -188,12 +186,6 @@ const getApps = async ({
|
||||
accountId: accessId
|
||||
});
|
||||
break;
|
||||
case INTEGRATION_CLOUDFLARE_WORKERS:
|
||||
apps = await getAppsCloudflareWorkers({
|
||||
accessToken,
|
||||
accountId: accessId
|
||||
});
|
||||
break;
|
||||
case INTEGRATION_NORTHFLANK:
|
||||
apps = await getAppsNorthflank({
|
||||
accessToken
|
||||
@ -976,40 +968,6 @@ const getAppsCloudflarePages = async ({
|
||||
return apps;
|
||||
};
|
||||
|
||||
/**
|
||||
* Return list of projects for the Cloudflare Workers integration
|
||||
* @param {Object} obj
|
||||
* @param {String} obj.accessToken - api key for the Cloudflare API
|
||||
* @returns {Object[]} apps - Cloudflare Workers projects
|
||||
* @returns {String} apps.id - Id of Cloudflare Workers project
|
||||
* @returns {String} apps.name - Id of Cloudflare Workers project (Cloudflare workers API does not return the name)
|
||||
*/
|
||||
const getAppsCloudflareWorkers = async ({
|
||||
accessToken,
|
||||
accountId
|
||||
}: {
|
||||
accessToken: string;
|
||||
accountId?: string;
|
||||
}) => {
|
||||
const { data } = await standardRequest.get(
|
||||
`${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accountId}/workers/services`,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json"
|
||||
}
|
||||
}
|
||||
);
|
||||
|
||||
const apps = data.result.map((a: any) => {
|
||||
return {
|
||||
name: a.id,
|
||||
appId: a.id
|
||||
};
|
||||
});
|
||||
return apps;
|
||||
};
|
||||
|
||||
/**
|
||||
* Return list of repositories for the BitBucket integration based on provided BitBucket workspace
|
||||
* @param {Object} obj
|
||||
|
||||
@ -18,8 +18,6 @@ import {
|
||||
INTEGRATION_CIRCLECI_API_URL,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_PAGES_API_URL,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS_API_URL,
|
||||
INTEGRATION_CLOUD_66,
|
||||
INTEGRATION_CLOUD_66_API_URL,
|
||||
INTEGRATION_CODEFRESH,
|
||||
@ -264,14 +262,6 @@ const syncSecrets = async ({
|
||||
accessToken
|
||||
});
|
||||
break;
|
||||
case INTEGRATION_CLOUDFLARE_WORKERS:
|
||||
await syncSecretsCloudflareWorkers({
|
||||
integration,
|
||||
secrets,
|
||||
accessId,
|
||||
accessToken
|
||||
});
|
||||
break;
|
||||
case INTEGRATION_CODEFRESH:
|
||||
await syncSecretsCodefresh({
|
||||
integration,
|
||||
@ -2756,98 +2746,6 @@ const syncSecretsCloudflarePages = async ({
|
||||
);
|
||||
};
|
||||
|
||||
/**
|
||||
* Sync/push [secrets] to Cloudflare Workers project with name [integration.app]
|
||||
* @param {Object} obj
|
||||
* @param {IIntegration} obj.integration - integration details
|
||||
* @param {Object} obj.secrets - secrets to push to integration (object where keys are secret keys and values are secret values)
|
||||
* @param {String} obj.accessToken - API token for Cloudflare workers
|
||||
*/
|
||||
const syncSecretsCloudflareWorkers = async ({
|
||||
integration,
|
||||
secrets,
|
||||
accessId,
|
||||
accessToken
|
||||
}: {
|
||||
integration: IIntegration;
|
||||
secrets: Record<string, { value: string; comment?: string }>;
|
||||
accessId: string | null;
|
||||
accessToken: string;
|
||||
}) => {
|
||||
// get secrets from cloudflare workers
|
||||
const getSecretsRes = (
|
||||
await standardRequest.get(
|
||||
`${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets`,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json"
|
||||
}
|
||||
}
|
||||
)
|
||||
).data.result;
|
||||
|
||||
const secretsObj: any = getSecretKeyValuePair(secrets);
|
||||
|
||||
for (const [key, val] of Object.entries(secretsObj)) {
|
||||
secretsObj[key] = { type: "secret_text", value: val };
|
||||
}
|
||||
|
||||
// get deleted secrets list
|
||||
const deletedSecretKeys: string[] = [];
|
||||
if (getSecretsRes) {
|
||||
getSecretsRes.forEach((secretRes: any) => {
|
||||
if (!(Object.keys(secrets).includes(secretRes.name))) {
|
||||
deletedSecretKeys.push(secretRes.name);
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
deletedSecretKeys.forEach(async (secretKey) => {
|
||||
await standardRequest.delete(
|
||||
`${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets/${secretKey}`,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json"
|
||||
}
|
||||
}
|
||||
);
|
||||
});
|
||||
|
||||
interface ConvertedSecret {
|
||||
name: string;
|
||||
text: string;
|
||||
type: string;
|
||||
}
|
||||
|
||||
interface SecretsObj {
|
||||
[key: string]: {
|
||||
type: string;
|
||||
value: string;
|
||||
};
|
||||
}
|
||||
|
||||
const data: ConvertedSecret[] = Object.entries(secretsObj as SecretsObj).map(([name, secret]) => ({
|
||||
name,
|
||||
text: secret.value,
|
||||
type: "secret_text"
|
||||
}));
|
||||
|
||||
data.forEach(async (secret) => {
|
||||
await standardRequest.put(
|
||||
`${INTEGRATION_CLOUDFLARE_WORKERS_API_URL}/client/v4/accounts/${accessId}/workers/scripts/${integration.app}/secrets`,
|
||||
secret,
|
||||
{
|
||||
headers: {
|
||||
Authorization: `Bearer ${accessToken}`,
|
||||
Accept: "application/json"
|
||||
}
|
||||
}
|
||||
);
|
||||
})
|
||||
};
|
||||
|
||||
/**
|
||||
* Sync/push [secrets] to BitBucket repo with name [integration.app]
|
||||
* @param {Object} obj
|
||||
|
||||
@ -51,17 +51,13 @@ export interface UpdateSecretParams {
|
||||
environment: string;
|
||||
type: "shared" | "personal";
|
||||
authData: AuthData;
|
||||
secretValueCiphertext: string;
|
||||
secretValueIV: string;
|
||||
secretValueTag: string;
|
||||
secretValueCiphertext?: string;
|
||||
secretValueIV?: string;
|
||||
secretValueTag?: string;
|
||||
secretPath: string;
|
||||
secretCommentCiphertext?: string;
|
||||
secretCommentIV?: string;
|
||||
secretCommentTag?: string;
|
||||
|
||||
secretReminderRepeatDays?: number | null;
|
||||
secretReminderNote?: string | null;
|
||||
|
||||
skipMultilineEncoding?: boolean;
|
||||
tags?: string[];
|
||||
}
|
||||
|
||||
@ -15,7 +15,7 @@ export const requestErrorHandler: ErrorRequestHandler = async (
|
||||
if (res.headersSent) return next();
|
||||
|
||||
let error: RequestError;
|
||||
|
||||
|
||||
switch (true) {
|
||||
case err instanceof TokenExpiredError:
|
||||
error = UnauthorizedRequestError({ stack: err.stack, message: "Token expired" });
|
||||
@ -31,7 +31,7 @@ export const requestErrorHandler: ErrorRequestHandler = async (
|
||||
break;
|
||||
}
|
||||
|
||||
logger[mapToPinoLogLevel(error.level)]({ msg: error });
|
||||
logger[mapToPinoLogLevel(error.level)](error);
|
||||
|
||||
if (req.user) {
|
||||
Sentry.setUser({ email: (req.user as any).email });
|
||||
|
||||
@ -6,7 +6,6 @@ import {
|
||||
INTEGRATION_CHECKLY,
|
||||
INTEGRATION_CIRCLECI,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CLOUD_66,
|
||||
INTEGRATION_CODEFRESH,
|
||||
INTEGRATION_DIGITAL_OCEAN_APP_PLATFORM,
|
||||
@ -72,7 +71,6 @@ export interface IIntegration {
|
||||
| "teamcity"
|
||||
| "hashicorp-vault"
|
||||
| "cloudflare-pages"
|
||||
| "cloudflare-workers"
|
||||
| "bitbucket"
|
||||
| "codefresh"
|
||||
| "digital-ocean-app-platform"
|
||||
@ -181,7 +179,6 @@ const integrationSchema = new Schema<IIntegration>(
|
||||
INTEGRATION_TEAMCITY,
|
||||
INTEGRATION_HASHICORP_VAULT,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CODEFRESH,
|
||||
INTEGRATION_WINDMILL,
|
||||
INTEGRATION_BITBUCKET,
|
||||
|
||||
@ -8,7 +8,6 @@ import {
|
||||
INTEGRATION_BITBUCKET,
|
||||
INTEGRATION_CIRCLECI,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CLOUD_66,
|
||||
INTEGRATION_CODEFRESH,
|
||||
INTEGRATION_DIGITAL_OCEAN_APP_PLATFORM,
|
||||
@ -56,7 +55,6 @@ export interface IIntegrationAuth extends Document {
|
||||
| "checkly"
|
||||
| "qovery"
|
||||
| "cloudflare-pages"
|
||||
| "cloudflare-workers"
|
||||
| "codefresh"
|
||||
| "digital-ocean-app-platform"
|
||||
| "bitbucket"
|
||||
@ -115,7 +113,6 @@ const integrationAuthSchema = new Schema<IIntegrationAuth>(
|
||||
INTEGRATION_TERRAFORM_CLOUD,
|
||||
INTEGRATION_HASHICORP_VAULT,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CODEFRESH,
|
||||
INTEGRATION_WINDMILL,
|
||||
INTEGRATION_BITBUCKET,
|
||||
|
||||
@ -27,12 +27,6 @@ export interface ISecret {
|
||||
secretCommentIV?: string;
|
||||
secretCommentTag?: string;
|
||||
secretCommentHash?: string;
|
||||
|
||||
// ? NOTE: This works great for workspace-level reminders.
|
||||
// ? If we want to do it on a user-basis, we should ideally have a seperate model for reminders.
|
||||
secretReminderRepeatDays?: number | null;
|
||||
secretReminderNote?: string | null;
|
||||
|
||||
skipMultilineEncoding?: boolean;
|
||||
algorithm: "aes-256-gcm";
|
||||
keyEncoding: "utf8" | "base64";
|
||||
@ -124,23 +118,11 @@ const secretSchema = new Schema<ISecret>(
|
||||
type: String,
|
||||
required: false
|
||||
},
|
||||
|
||||
secretReminderRepeatDays: {
|
||||
type: Number,
|
||||
required: false,
|
||||
default: null
|
||||
},
|
||||
secretReminderNote: {
|
||||
type: String,
|
||||
required: false,
|
||||
default: null
|
||||
},
|
||||
|
||||
skipMultilineEncoding: {
|
||||
type: Boolean,
|
||||
default: false,
|
||||
required: false
|
||||
},
|
||||
|
||||
algorithm: {
|
||||
// the encryption algorithm used
|
||||
type: String,
|
||||
|
||||
@ -1,6 +1,16 @@
|
||||
import { Document, Schema, Types, model } from "mongoose";
|
||||
import { IPType } from "../ee/models";
|
||||
import { ADMIN, CUSTOM, MEMBER, VIEWER } from "../variables";
|
||||
|
||||
export enum Permission {
|
||||
READ = "read",
|
||||
WRITE = "write"
|
||||
}
|
||||
|
||||
export interface IServiceTokenV3Scope {
|
||||
environment: string;
|
||||
secretPath: string;
|
||||
permissions: Permission[];
|
||||
}
|
||||
|
||||
export interface IServiceTokenV3TrustedIp {
|
||||
ipAddress: string;
|
||||
@ -23,8 +33,7 @@ export interface IServiceTokenDataV3 extends Document {
|
||||
isRefreshTokenRotationEnabled: boolean;
|
||||
expiresAt?: Date;
|
||||
accessTokenTTL: number;
|
||||
role: "admin" | "member" | "viewer" | "custom";
|
||||
customRole: Types.ObjectId;
|
||||
scopes: Array<IServiceTokenV3Scope>;
|
||||
trustedIps: Array<IServiceTokenV3TrustedIp>;
|
||||
}
|
||||
|
||||
@ -91,15 +100,28 @@ const serviceTokenDataV3Schema = new Schema(
|
||||
default: 7200,
|
||||
required: true
|
||||
},
|
||||
role: {
|
||||
type: String,
|
||||
enum: [ADMIN, MEMBER, VIEWER, CUSTOM],
|
||||
scopes: {
|
||||
type: [
|
||||
{
|
||||
environment: {
|
||||
type: String,
|
||||
required: true
|
||||
},
|
||||
secretPath: {
|
||||
type: String,
|
||||
default: "/",
|
||||
required: true
|
||||
},
|
||||
permissions: {
|
||||
type: [String],
|
||||
enum: [Permission.READ, Permission.WRITE],
|
||||
default: [Permission.READ],
|
||||
required: true
|
||||
}
|
||||
}
|
||||
],
|
||||
required: true
|
||||
},
|
||||
customRole: {
|
||||
type: Schema.Types.ObjectId,
|
||||
ref: "Role"
|
||||
},
|
||||
trustedIps: {
|
||||
type: [
|
||||
{
|
||||
|
||||
@ -1,83 +0,0 @@
|
||||
import Queue, { Job } from "bull";
|
||||
import { IUser, Membership, Organization, Workspace } from "../../models";
|
||||
import { Types } from "mongoose";
|
||||
import { sendMail } from "../../helpers";
|
||||
|
||||
type TSendSecretReminders = {
|
||||
workspaceId: string;
|
||||
secretId: string;
|
||||
repeatDays: number;
|
||||
note: string | undefined | null;
|
||||
};
|
||||
|
||||
type TDeleteSecretReminder = {
|
||||
secretId: string;
|
||||
repeatDays: number;
|
||||
};
|
||||
|
||||
const DAY_IN_MS = 86400000;
|
||||
|
||||
export const sendSecretReminders = new Queue(
|
||||
"send-secret-reminders",
|
||||
process.env.REDIS_URL as string
|
||||
);
|
||||
|
||||
sendSecretReminders.process(async (job: Job<TSendSecretReminders>) => {
|
||||
const { workspaceId }: TSendSecretReminders = job.data;
|
||||
|
||||
const workspace = await Workspace.findById(new Types.ObjectId(workspaceId));
|
||||
const organization = await Organization.findById(new Types.ObjectId(workspace?.organization));
|
||||
|
||||
if (!workspace) {
|
||||
throw new Error("Workspace for reminder not found");
|
||||
}
|
||||
if (!organization) {
|
||||
throw new Error("Organization for reminder not found");
|
||||
}
|
||||
|
||||
const memberships = await Membership.find({
|
||||
workspace: workspaceId
|
||||
}).populate<{ user: IUser }>("user");
|
||||
|
||||
await sendMail({
|
||||
template: "secretReminder.handlebars",
|
||||
subjectLine: "Infisical secret reminder",
|
||||
recipients: [...memberships.map((membership) => membership.user.email)],
|
||||
substitutions: {
|
||||
reminderNote: job.data.note, // May not be present.
|
||||
workspaceName: workspace.name,
|
||||
organizationName: organization.name
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
export const createRecurringSecretReminder = (jobDetails: TSendSecretReminders) => {
|
||||
const repeat = jobDetails.repeatDays * DAY_IN_MS;
|
||||
|
||||
return sendSecretReminders.add(jobDetails, {
|
||||
delay: repeat,
|
||||
repeat: {
|
||||
every: repeat
|
||||
},
|
||||
jobId: `reminder-${jobDetails.secretId}`,
|
||||
removeOnComplete: true,
|
||||
removeOnFail: {
|
||||
count: 20
|
||||
}
|
||||
});
|
||||
};
|
||||
|
||||
export const deleteRecurringSecretReminder = (jobDetails: TDeleteSecretReminder) => {
|
||||
const repeat = jobDetails.repeatDays * DAY_IN_MS;
|
||||
|
||||
return sendSecretReminders.removeRepeatable({
|
||||
every: repeat,
|
||||
jobId: `reminder-${jobDetails.secretId}`
|
||||
});
|
||||
};
|
||||
|
||||
export const updateRecurringSecretReminder = async (jobDetails: TSendSecretReminders) => {
|
||||
// We need to delete the potentially existing reminder job first, or the new one won't be created.
|
||||
await deleteRecurringSecretReminder(jobDetails);
|
||||
await createRecurringSecretReminder(jobDetails);
|
||||
};
|
||||
@ -36,4 +36,12 @@ router.delete(
|
||||
environmentController.deleteWorkspaceEnvironment
|
||||
);
|
||||
|
||||
router.get(
|
||||
"/:workspaceId/environments",
|
||||
requireAuth({
|
||||
acceptedAuthModes: [AuthMode.JWT, AuthMode.API_KEY]
|
||||
}),
|
||||
environmentController.getAllAccessibleEnvironmentsOfWorkspace
|
||||
);
|
||||
|
||||
export default router;
|
||||
|
||||
39
backend/src/routes/v4/environments.ts
Normal file
39
backend/src/routes/v4/environments.ts
Normal file
@ -0,0 +1,39 @@
|
||||
import express from "express";
|
||||
const router = express.Router();
|
||||
import { requireAuth } from "../../middleware";
|
||||
import { environmentsController } from "../../controllers/v4";
|
||||
// import { AuthMode } from "../../variables";
|
||||
|
||||
router.post(
|
||||
"/",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
environmentsController.createEnvironment
|
||||
);
|
||||
|
||||
router.get(
|
||||
"/",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
environmentsController.getEnvironments
|
||||
);
|
||||
|
||||
router.patch(
|
||||
"/:environmentSlug",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
environmentsController.updateEnvironment
|
||||
);
|
||||
|
||||
router.delete(
|
||||
"/:environmentSlug",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
environmentsController.deleteEnvironment
|
||||
)
|
||||
|
||||
export default router;
|
||||
39
backend/src/routes/v4/folders.ts
Normal file
39
backend/src/routes/v4/folders.ts
Normal file
@ -0,0 +1,39 @@
|
||||
import express from "express";
|
||||
const router = express.Router();
|
||||
import { requireAuth} from "../../middleware";
|
||||
import { foldersController } from "../../controllers/v4";
|
||||
// import { AuthMode } from "../../variables";
|
||||
|
||||
router.post(
|
||||
"/",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
foldersController.createFolder
|
||||
);
|
||||
|
||||
router.get(
|
||||
"/",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
foldersController.getFolders
|
||||
);
|
||||
|
||||
router.patch(
|
||||
":/folderName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
foldersController.updateFolder
|
||||
);
|
||||
|
||||
router.delete(
|
||||
"/:folderName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
foldersController.deleteFolder
|
||||
);
|
||||
|
||||
export default router;
|
||||
5
backend/src/routes/v4/index.ts
Normal file
5
backend/src/routes/v4/index.ts
Normal file
@ -0,0 +1,5 @@
|
||||
import secrets from "./secrets";
|
||||
|
||||
export {
|
||||
secrets
|
||||
}
|
||||
46
backend/src/routes/v4/secrets.ts
Normal file
46
backend/src/routes/v4/secrets.ts
Normal file
@ -0,0 +1,46 @@
|
||||
import express from "express";
|
||||
const router = express.Router();
|
||||
import { requireAuth} from "../../middleware";
|
||||
import { secretsController } from "../../controllers/v4";
|
||||
|
||||
router.get(
|
||||
"/",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
secretsController.getSecrets
|
||||
);
|
||||
|
||||
router.get(
|
||||
"/:secretName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
secretsController.getSecret
|
||||
);
|
||||
|
||||
router.post(
|
||||
"/:secretName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
secretsController.createSecret
|
||||
);
|
||||
|
||||
router.patch(
|
||||
"/:secretName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
secretsController.updateSecret
|
||||
);
|
||||
|
||||
router.delete(
|
||||
"/:secretName",
|
||||
requireAuth({
|
||||
acceptedAuthModes: []
|
||||
}),
|
||||
secretsController.deleteSecret
|
||||
);
|
||||
|
||||
export default router;
|
||||
@ -3,14 +3,11 @@ import { logger } from "../utils/logging";
|
||||
|
||||
let redisClient: TRedis | null;
|
||||
|
||||
export const initRedis = async () => {
|
||||
if (process.env.REDIS_URL) {
|
||||
redisClient = new Redis(process.env.REDIS_URL as string);
|
||||
} else {
|
||||
logger.warn("Redis URL not set, skipping Redis initialization.");
|
||||
redisClient = null;
|
||||
}
|
||||
if (process.env.REDIS_URL) {
|
||||
redisClient = new Redis(process.env.REDIS_URL as string);
|
||||
} else {
|
||||
logger.warn("Redis URL not set, skipping Redis initialization.");
|
||||
redisClient = null;
|
||||
}
|
||||
|
||||
|
||||
export { redisClient };
|
||||
|
||||
@ -1,19 +0,0 @@
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta http-equiv="x-ua-compatible" content="ie=edge">
|
||||
<title>Secret Reminder</title>
|
||||
</head>
|
||||
|
||||
<body>
|
||||
<h2>Infisical</h2>
|
||||
<h2>You have a new secret reminder!</h2>
|
||||
<p>You have a new secret reminder from workspace "{{workspaceName}}", in {{organizationName}}</p>
|
||||
{{#if reminderNote}}
|
||||
<p>Here's the note included with the reminder: {{reminderNote}}</p>
|
||||
{{/if}}
|
||||
</body>
|
||||
|
||||
</html>
|
||||
@ -1 +1 @@
|
||||
export { logger, initLogger } from "./logger";
|
||||
export { logger } from "./logger";
|
||||
@ -1,69 +1,15 @@
|
||||
import pino, { Logger } from "pino";
|
||||
import { getAwsCloudWatchLog, getNodeEnv } from "../../config";
|
||||
import pino from "pino";
|
||||
|
||||
export let logger: Logger;
|
||||
|
||||
// https://github.com/pinojs/pino/blob/master/lib/levels.js#L13-L20
|
||||
const logLevelToSeverityLookup: Record<string, string> = {
|
||||
"10": "TRACE",
|
||||
"20": "DEBUG",
|
||||
"30": "INFO",
|
||||
"40": "WARNING",
|
||||
"50": "ERROR",
|
||||
"60": "CRITICAL"
|
||||
}
|
||||
|
||||
export const initLogger = async () => {
|
||||
const awsCloudWatchLogCfg = await getAwsCloudWatchLog();
|
||||
const nodeEnv = await getNodeEnv();
|
||||
const isProduction = nodeEnv === "production";
|
||||
const targets: pino.TransportMultiOptions["targets"][number][] = [
|
||||
isProduction
|
||||
? { level: "info", target: "pino/file", options: {} }
|
||||
: {
|
||||
level: "info",
|
||||
target: "pino-pretty", // must be installed separately
|
||||
options: {
|
||||
colorize: true
|
||||
}
|
||||
}
|
||||
];
|
||||
|
||||
if (awsCloudWatchLogCfg) {
|
||||
targets.push({
|
||||
target: "@serdnam/pino-cloudwatch-transport",
|
||||
level: "info",
|
||||
options: {
|
||||
logGroupName: awsCloudWatchLogCfg.logGroupName,
|
||||
logStreamName: awsCloudWatchLogCfg.logGroupName,
|
||||
awsRegion: awsCloudWatchLogCfg.region,
|
||||
awsAccessKeyId: awsCloudWatchLogCfg.accessKeyId,
|
||||
awsSecretAccessKey: awsCloudWatchLogCfg.accessKeySecret,
|
||||
interval: awsCloudWatchLogCfg.interval
|
||||
}
|
||||
});
|
||||
}
|
||||
|
||||
const transport = pino.transport({
|
||||
targets
|
||||
});
|
||||
|
||||
logger = pino(
|
||||
{
|
||||
mixin(_context, level) {
|
||||
return { "severity": logLevelToSeverityLookup[level] || logLevelToSeverityLookup["30"] }
|
||||
},
|
||||
level: process.env.PINO_LOG_LEVEL || "info",
|
||||
formatters: {
|
||||
bindings: (bindings) => {
|
||||
return {
|
||||
export const logger = pino({
|
||||
level: process.env.PINO_LOG_LEVEL || "trace",
|
||||
timestamp: pino.stdTimeFunctions.isoTime,
|
||||
formatters: {
|
||||
bindings: (bindings) => {
|
||||
return {
|
||||
pid: bindings.pid,
|
||||
hostname: bindings.hostname
|
||||
// node_version: process.version
|
||||
};
|
||||
}
|
||||
}
|
||||
};
|
||||
},
|
||||
transport
|
||||
);
|
||||
};
|
||||
}
|
||||
});
|
||||
@ -47,3 +47,39 @@ export const ReorderWorkspaceEnvironmentsV2 = z.object({
|
||||
otherEnvironmentName: z.string().trim()
|
||||
})
|
||||
});
|
||||
|
||||
export const CreateEnvironmentV4 = z.object({
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
environmentName: z.string().trim()
|
||||
})
|
||||
});
|
||||
|
||||
export const GetEnvironmentsV4 = z.object({
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
environmentName: z.string().trim()
|
||||
})
|
||||
});
|
||||
|
||||
export const UpdateEnvironmentV4 = z.object({
|
||||
params: z.object({
|
||||
environmentSlug: z.string().trim(),
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentName: z.string().trim().optional(),
|
||||
newEnvironmentSlug: z.string().trim().optional()
|
||||
})
|
||||
});
|
||||
|
||||
export const DeleteEnvironmentV4 = z.object({
|
||||
params: z.object({
|
||||
environmentSlug: z.string().trim()
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim()
|
||||
})
|
||||
});
|
||||
@ -39,3 +39,12 @@ export const GetFoldersV1 = z.object({
|
||||
directory: z.string().trim().default("/")
|
||||
})
|
||||
});
|
||||
|
||||
export const CreateFolderV2 = z.object({
|
||||
body: z.object({
|
||||
folderName: z.string().trim(),
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/")
|
||||
})
|
||||
});
|
||||
@ -10,6 +10,7 @@ import { AuthData } from "../interfaces/middleware";
|
||||
import { ActorType } from "../ee/models";
|
||||
import { z } from "zod";
|
||||
import { SECRET_PERSONAL, SECRET_SHARED } from "../variables";
|
||||
|
||||
/**
|
||||
* Validate authenticated clients for secrets with id [secretId] based
|
||||
* on any known permissions.
|
||||
@ -259,7 +260,6 @@ export const CreateSecretRawV3 = z.object({
|
||||
.string()
|
||||
.transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())),
|
||||
secretComment: z.string().trim().optional().default(""),
|
||||
|
||||
skipMultilineEncoding: z.boolean().optional(),
|
||||
type: z.enum([SECRET_SHARED, SECRET_PERSONAL])
|
||||
}),
|
||||
@ -275,7 +275,6 @@ export const UpdateSecretByNameRawV3 = z.object({
|
||||
body: z.object({
|
||||
workspaceId: z.string().trim(),
|
||||
environment: z.string().trim(),
|
||||
|
||||
secretValue: z
|
||||
.string()
|
||||
.transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())),
|
||||
@ -361,10 +360,6 @@ export const UpdateSecretByNameV3 = z.object({
|
||||
secretCommentCiphertext: z.string().trim().optional(),
|
||||
secretCommentIV: z.string().trim().optional(),
|
||||
secretCommentTag: z.string().trim().optional(),
|
||||
|
||||
secretReminderRepeatDays: z.number().min(1).max(365).optional().nullable(),
|
||||
secretReminderNote: z.string().trim().nullable().optional(),
|
||||
|
||||
tags: z.string().array().optional(),
|
||||
skipMultilineEncoding: z.boolean().optional(),
|
||||
// to update secret name
|
||||
@ -454,3 +449,80 @@ export const DeleteSecretByNameBatchV3 = z.object({
|
||||
.min(1)
|
||||
})
|
||||
});
|
||||
|
||||
export const GetSecretsV4 = z.object({
|
||||
query: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/"),
|
||||
includeImports: z
|
||||
.enum(["true", "false"])
|
||||
.default("false")
|
||||
.transform((value) => value === "true")
|
||||
})
|
||||
});
|
||||
|
||||
export const GetSecretV4 = z.object({
|
||||
params: z.object({
|
||||
secretName: z.string().trim()
|
||||
}),
|
||||
query: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/"),
|
||||
type: z.enum([SECRET_SHARED, SECRET_PERSONAL]).default(SECRET_PERSONAL),
|
||||
includeImports: z
|
||||
.enum(["true", "false"])
|
||||
.default("true")
|
||||
.transform((value) => value === "true")
|
||||
})
|
||||
});
|
||||
|
||||
export const CreateSecretV4 = z.object({
|
||||
params: z.object({
|
||||
secretName: z.string().trim()
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/"),
|
||||
type: z.enum([SECRET_SHARED, SECRET_PERSONAL]).default(SECRET_SHARED),
|
||||
secretValue: z
|
||||
.string()
|
||||
.transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim())),
|
||||
secretComment: z.string().trim().optional().default(""),
|
||||
skipMultilineEncoding: z.boolean().optional().default(false),
|
||||
})
|
||||
});
|
||||
|
||||
export const UpdateSecretV4 = z.object({
|
||||
params: z.object({
|
||||
secretName: z.string().trim()
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/"),
|
||||
type: z.enum([SECRET_SHARED, SECRET_PERSONAL]).default(SECRET_SHARED),
|
||||
secretValue: z
|
||||
.string()
|
||||
.transform((val) => (val.at(-1) === "\n" ? `${val.trim()}\n` : val.trim()))
|
||||
.optional(),
|
||||
secretComment: z.string().trim().optional(),
|
||||
skipMultilineEncoding: z.boolean().optional()
|
||||
})
|
||||
});
|
||||
|
||||
export const DeleteSecretV4 = z.object({
|
||||
params: z.object({
|
||||
secretName: z.string().trim()
|
||||
}),
|
||||
body: z.object({
|
||||
projectId: z.string().trim(),
|
||||
environmentSlug: z.string().trim(),
|
||||
path: z.string().trim().default("/"),
|
||||
type: z.enum([SECRET_SHARED, SECRET_PERSONAL]).default(SECRET_SHARED)
|
||||
})
|
||||
});
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,64 @@
|
||||
import { Types } from "mongoose";
|
||||
import { IServiceTokenDataV3 } from "../models";
|
||||
import { Permission } from "../models/serviceTokenDataV3";
|
||||
import { z } from "zod";
|
||||
import { MEMBER } from "../variables";
|
||||
import { UnauthorizedRequestError } from "../utils/errors";
|
||||
import { isValidScopeV3 } from "../helpers";
|
||||
import { AuthData } from "../interfaces/middleware";
|
||||
import { checkIPAgainstBlocklist } from "../utils/ip";
|
||||
|
||||
/**
|
||||
* Validate that service token (client) can access workspace
|
||||
* with id [workspaceId] and its environment [environment] with required permissions
|
||||
* [requiredPermissions]
|
||||
* @param {Object} obj
|
||||
* @param {ServiceTokenData} obj.serviceTokenData - service token client
|
||||
* @param {Types.ObjectId} obj.workspaceId - id of workspace to validate against
|
||||
* @param {String} environment - (optional) environment in workspace to validate against
|
||||
* @param {String[]} acceptedPermissions - accepted permissions as part of the endpoint
|
||||
*/
|
||||
export const validateServiceTokenDataV3ClientForWorkspace = async ({
|
||||
authData,
|
||||
serviceTokenData,
|
||||
workspaceId,
|
||||
environment,
|
||||
secretPath = "/",
|
||||
requiredPermissions
|
||||
}: {
|
||||
authData: AuthData;
|
||||
serviceTokenData: IServiceTokenDataV3;
|
||||
workspaceId: Types.ObjectId;
|
||||
environment?: string;
|
||||
secretPath?: string;
|
||||
requiredPermissions: Permission[];
|
||||
}) => {
|
||||
|
||||
// validate ST V3 IP address
|
||||
checkIPAgainstBlocklist({
|
||||
ipAddress: authData.ipAddress,
|
||||
trustedIps: serviceTokenData.trustedIps
|
||||
});
|
||||
|
||||
if (!serviceTokenData.workspace.equals(workspaceId)) {
|
||||
// case: invalid workspaceId passed
|
||||
throw UnauthorizedRequestError({
|
||||
message: "Failed service token authorization for the given workspace"
|
||||
});
|
||||
}
|
||||
|
||||
if (environment) {
|
||||
const isValid = isValidScopeV3({
|
||||
authPayload: serviceTokenData,
|
||||
environment,
|
||||
secretPath,
|
||||
requiredPermissions
|
||||
});
|
||||
|
||||
if (!isValid) throw UnauthorizedRequestError({
|
||||
message: "Failed service token authorization for the given workspace"
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const RefreshTokenV3 = z.object({
|
||||
body: z.object({
|
||||
@ -12,14 +71,20 @@ export const CreateServiceTokenV3 = z.object({
|
||||
name: z.string().trim(),
|
||||
workspaceId: z.string().trim(),
|
||||
publicKey: z.string().trim(),
|
||||
role: z.string().trim().min(1).default(MEMBER),
|
||||
trustedIps: z // TODO: provide default
|
||||
scopes: z
|
||||
.object({
|
||||
permissions: z.enum(["read", "write"]).array(),
|
||||
environment: z.string().trim(),
|
||||
secretPath: z.string().trim()
|
||||
})
|
||||
.array()
|
||||
.min(1),
|
||||
trustedIps: z
|
||||
.object({
|
||||
ipAddress: z.string().trim(),
|
||||
})
|
||||
.array()
|
||||
.min(1)
|
||||
.default([{ ipAddress: "0.0.0.0/0" }]),
|
||||
.min(1),
|
||||
expiresIn: z.number().optional(),
|
||||
accessTokenTTL: z.number().int().min(1),
|
||||
encryptedKey: z.string().trim(),
|
||||
@ -35,7 +100,15 @@ export const UpdateServiceTokenV3 = z.object({
|
||||
body: z.object({
|
||||
name: z.string().trim().optional(),
|
||||
isActive: z.boolean().optional(),
|
||||
role: z.string().trim().min(1).optional(),
|
||||
scopes: z
|
||||
.object({
|
||||
permissions: z.enum(["read", "write"]).array(),
|
||||
environment: z.string().trim(),
|
||||
secretPath: z.string().trim()
|
||||
})
|
||||
.array()
|
||||
.min(1)
|
||||
.optional(),
|
||||
trustedIps: z
|
||||
.object({
|
||||
ipAddress: z.string().trim()
|
||||
|
||||
@ -58,7 +58,7 @@ export const validateClientForWorkspace = async ({
|
||||
environment,
|
||||
requiredPermissions
|
||||
});
|
||||
return { membership, workspace };
|
||||
return { membership, workspace};
|
||||
case ActorType.SERVICE_V3:
|
||||
throw UnauthorizedRequestError({
|
||||
message: "Failed service token authorization for organization"
|
||||
@ -121,8 +121,8 @@ export const GetWorkspaceAuditLogsV1 = z.object({
|
||||
userAgentType: z.nativeEnum(UserAgentType).nullable().optional(),
|
||||
startDate: z.string().datetime().nullable().optional(),
|
||||
endDate: z.string().datetime().nullable().optional(),
|
||||
offset: z.coerce.number().default(0),
|
||||
limit: z.coerce.number().default(20),
|
||||
offset: z.coerce.number(),
|
||||
limit: z.coerce.number(),
|
||||
actor: z.string().nullish().optional()
|
||||
})
|
||||
});
|
||||
@ -309,4 +309,4 @@ export const GetWorkspaceServiceTokenDataV3 = z.object({
|
||||
params: z.object({
|
||||
workspaceId: z.string().trim()
|
||||
})
|
||||
});
|
||||
});
|
||||
@ -32,7 +32,6 @@ export const INTEGRATION_QOVERY = "qovery";
|
||||
export const INTEGRATION_TERRAFORM_CLOUD = "terraform-cloud";
|
||||
export const INTEGRATION_HASHICORP_VAULT = "hashicorp-vault";
|
||||
export const INTEGRATION_CLOUDFLARE_PAGES = "cloudflare-pages";
|
||||
export const INTEGRATION_CLOUDFLARE_WORKERS = "cloudflare-workers";
|
||||
export const INTEGRATION_BITBUCKET = "bitbucket";
|
||||
export const INTEGRATION_CODEFRESH = "codefresh";
|
||||
export const INTEGRATION_WINDMILL = "windmill";
|
||||
@ -60,7 +59,6 @@ export const INTEGRATION_SET = new Set([
|
||||
INTEGRATION_TERRAFORM_CLOUD,
|
||||
INTEGRATION_HASHICORP_VAULT,
|
||||
INTEGRATION_CLOUDFLARE_PAGES,
|
||||
INTEGRATION_CLOUDFLARE_WORKERS,
|
||||
INTEGRATION_CODEFRESH,
|
||||
INTEGRATION_WINDMILL,
|
||||
INTEGRATION_BITBUCKET,
|
||||
@ -103,7 +101,6 @@ export const INTEGRATION_CHECKLY_API_URL = "https://api.checklyhq.com";
|
||||
export const INTEGRATION_QOVERY_API_URL = "https://api.qovery.com";
|
||||
export const INTEGRATION_TERRAFORM_CLOUD_API_URL = "https://app.terraform.io";
|
||||
export const INTEGRATION_CLOUDFLARE_PAGES_API_URL = "https://api.cloudflare.com";
|
||||
export const INTEGRATION_CLOUDFLARE_WORKERS_API_URL = "https://api.cloudflare.com";
|
||||
export const INTEGRATION_BITBUCKET_API_URL = "https://api.bitbucket.org";
|
||||
export const INTEGRATION_CODEFRESH_API_URL = "https://g.codefresh.io/api";
|
||||
export const INTEGRATION_WINDMILL_API_URL = "https://app.windmill.dev/api";
|
||||
@ -319,15 +316,6 @@ export const getIntegrationOptions = async () => {
|
||||
clientId: "",
|
||||
docsLink: ""
|
||||
},
|
||||
{
|
||||
name: "Cloudflare Workers",
|
||||
slug: "cloudflare-workers",
|
||||
image: "Cloudflare.png",
|
||||
isAvailable: true,
|
||||
type: "pat",
|
||||
clientId: "",
|
||||
docsLink: ""
|
||||
},
|
||||
{
|
||||
name: "BitBucket",
|
||||
slug: "bitbucket",
|
||||
|
||||
@ -12,32 +12,32 @@ const generateOpenAPISpec = async () => {
|
||||
const doc = {
|
||||
info: {
|
||||
title: "Infisical API",
|
||||
description: "List of all available APIs that can be consumed"
|
||||
description: "List of all available APIs that can be consumed",
|
||||
},
|
||||
host: ["https://infisical.com"],
|
||||
servers: [
|
||||
{
|
||||
url: "https://app.infisical.com",
|
||||
description: "Production server"
|
||||
description: "Production server",
|
||||
},
|
||||
{
|
||||
url: "http://localhost:8080",
|
||||
description: "Local server"
|
||||
}
|
||||
description: "Local server",
|
||||
},
|
||||
],
|
||||
securityDefinitions: {
|
||||
bearerAuth: {
|
||||
type: "http",
|
||||
scheme: "bearer",
|
||||
bearerFormat: "JWT",
|
||||
description: "A service token in Infisical"
|
||||
description: "A service token in Infisical",
|
||||
},
|
||||
apiKeyAuth: {
|
||||
type: "apiKey",
|
||||
in: "header",
|
||||
name: "X-API-Key",
|
||||
description: "An API Key in Infisical"
|
||||
}
|
||||
description: "An API Key in Infisical",
|
||||
},
|
||||
},
|
||||
definitions: {
|
||||
CurrentUser: {
|
||||
@ -50,7 +50,7 @@ const generateOpenAPISpec = async () => {
|
||||
iv: "iv_of_enc_nacl_private_key",
|
||||
tag: "tag_of_enc_nacl_private_key",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
Membership: {
|
||||
user: {
|
||||
@ -60,10 +60,10 @@ const generateOpenAPISpec = async () => {
|
||||
lastName: "Doe",
|
||||
publicKey: "johns_nacl_public_key",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
workspace: "",
|
||||
role: "admin"
|
||||
role: "admin",
|
||||
},
|
||||
MembershipOrg: {
|
||||
user: {
|
||||
@ -73,35 +73,33 @@ const generateOpenAPISpec = async () => {
|
||||
lastName: "Doe",
|
||||
publicKey: "johns_nacl_public_key",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
organization: "",
|
||||
role: "owner",
|
||||
status: "accepted"
|
||||
status: "accepted",
|
||||
},
|
||||
Organization: {
|
||||
_id: "",
|
||||
name: "Acme Corp.",
|
||||
customerId: ""
|
||||
customerId: "",
|
||||
},
|
||||
Project: {
|
||||
name: "My Project",
|
||||
organization: "",
|
||||
environments: [
|
||||
{
|
||||
name: "development",
|
||||
slug: "dev"
|
||||
}
|
||||
]
|
||||
environments: [{
|
||||
name: "development",
|
||||
slug: "dev",
|
||||
}],
|
||||
},
|
||||
ProjectKey: {
|
||||
encryptedkey: "",
|
||||
nonce: "",
|
||||
sender: {
|
||||
publicKey: "senders_nacl_public_key"
|
||||
publicKey: "senders_nacl_public_key",
|
||||
},
|
||||
receiver: "",
|
||||
workspace: ""
|
||||
workspace: "",
|
||||
},
|
||||
CreateSecret: {
|
||||
type: "shared",
|
||||
@ -113,7 +111,7 @@ const generateOpenAPISpec = async () => {
|
||||
secretValueTag: "",
|
||||
secretCommentCiphertext: "",
|
||||
secretCommentIV: "",
|
||||
secretCommentTag: ""
|
||||
secretCommentTag: "",
|
||||
},
|
||||
UpdateSecret: {
|
||||
id: "",
|
||||
@ -125,12 +123,12 @@ const generateOpenAPISpec = async () => {
|
||||
secretValueTag: "",
|
||||
secretCommentCiphertext: "",
|
||||
secretCommentIV: "",
|
||||
secretCommentTag: ""
|
||||
secretCommentTag: "",
|
||||
},
|
||||
Secret: {
|
||||
_id: "",
|
||||
version: 1,
|
||||
workspace: "",
|
||||
workspace : "",
|
||||
type: "shared",
|
||||
user: null,
|
||||
secretKeyCiphertext: "",
|
||||
@ -143,7 +141,7 @@ const generateOpenAPISpec = async () => {
|
||||
secretCommentIV: "",
|
||||
secretCommentTag: "",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
RawSecret: {
|
||||
_id: "abc123",
|
||||
@ -169,10 +167,12 @@ const generateOpenAPISpec = async () => {
|
||||
_id: "",
|
||||
email: "johndoe@gmail.com",
|
||||
firstName: "John",
|
||||
lastName: "Doe"
|
||||
lastName: "Doe",
|
||||
},
|
||||
workspace: "",
|
||||
actionNames: ["addSecrets"],
|
||||
actionNames: [
|
||||
"addSecrets",
|
||||
],
|
||||
actions: [
|
||||
{
|
||||
name: "addSecrets",
|
||||
@ -181,24 +181,24 @@ const generateOpenAPISpec = async () => {
|
||||
payload: [
|
||||
{
|
||||
oldSecretVersion: "",
|
||||
newSecretVersion: ""
|
||||
}
|
||||
]
|
||||
}
|
||||
newSecretVersion: "",
|
||||
},
|
||||
],
|
||||
},
|
||||
],
|
||||
channel: "cli",
|
||||
ipAddress: "192.168.0.1",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
SecretSnapshot: {
|
||||
workspace: "",
|
||||
version: 1,
|
||||
secretVersions: [
|
||||
{
|
||||
_id: ""
|
||||
}
|
||||
]
|
||||
_id: "",
|
||||
},
|
||||
],
|
||||
},
|
||||
SecretVersion: {
|
||||
_id: "",
|
||||
@ -214,7 +214,7 @@ const generateOpenAPISpec = async () => {
|
||||
secretKeyTag: "",
|
||||
secretValueCiphertext: "",
|
||||
secretValueIV: "",
|
||||
secretValueTag: ""
|
||||
secretValueTag: "",
|
||||
},
|
||||
ServiceTokenData: {
|
||||
_id: "",
|
||||
@ -224,32 +224,16 @@ const generateOpenAPISpec = async () => {
|
||||
user: {
|
||||
_id: "",
|
||||
firstName: "",
|
||||
lastName: ""
|
||||
lastName: "",
|
||||
},
|
||||
expiresAt: "2023-01-13T14:16:12.210Z",
|
||||
encryptedKey: "",
|
||||
iv: "",
|
||||
tag: "",
|
||||
updatedAt: "2023-01-13T14:16:12.210Z",
|
||||
createdAt: "2023-01-13T14:16:12.210Z"
|
||||
createdAt: "2023-01-13T14:16:12.210Z",
|
||||
},
|
||||
AuditLog: {
|
||||
actor: {
|
||||
type: "",
|
||||
metadata: {}
|
||||
},
|
||||
organization: "",
|
||||
workspace: "",
|
||||
ipAddress: "",
|
||||
event: {
|
||||
type: "",
|
||||
metadata: {}
|
||||
},
|
||||
userAgent: "",
|
||||
userAgentType: "",
|
||||
expiresAt: ""
|
||||
}
|
||||
}
|
||||
},
|
||||
};
|
||||
|
||||
const outputJSONFile = "../spec.json";
|
||||
@ -259,6 +243,6 @@ const generateOpenAPISpec = async () => {
|
||||
const spec = await swaggerAutogen(outputJSONFile, endpointsFiles, doc);
|
||||
|
||||
await fs.writeFile(outputYAMLFile, yaml.dump(spec.data));
|
||||
};
|
||||
}
|
||||
|
||||
generateOpenAPISpec();
|
||||
generateOpenAPISpec();
|
||||
@ -15,9 +15,6 @@
|
||||
"skipLibCheck": true,
|
||||
"typeRoots": ["./src/types", "./node_modules/@types"]
|
||||
},
|
||||
"ts-node": {
|
||||
"swc": true
|
||||
},
|
||||
"include": ["src/**/*"],
|
||||
"exclude": ["node_modules"]
|
||||
}
|
||||
|
||||
@ -1,17 +0,0 @@
|
||||
infisical:
|
||||
address: "http://localhost:8080"
|
||||
auth:
|
||||
type: "token"
|
||||
config:
|
||||
token-path: "./role-id"
|
||||
sinks:
|
||||
- type: "file"
|
||||
config:
|
||||
path: "/Users/maidulislam/Desktop/test/infisical-token"
|
||||
- type: "file"
|
||||
config:
|
||||
path: "access-token"
|
||||
- type: "file"
|
||||
config:
|
||||
path: "maiduls-access-token"
|
||||
templates:
|
||||
@ -3,7 +3,6 @@ package api
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"strings"
|
||||
|
||||
"github.com/Infisical/infisical-merge/packages/config"
|
||||
"github.com/go-resty/resty/v2"
|
||||
@ -261,70 +260,6 @@ func CallGetSecretsV3(httpClient *resty.Client, request GetEncryptedSecretsV3Req
|
||||
return secretsResponse, nil
|
||||
}
|
||||
|
||||
func CallGetFoldersV1(httpClient *resty.Client, request GetFoldersV1Request) (GetFoldersV1Response, error) {
|
||||
var foldersResponse GetFoldersV1Response
|
||||
httpRequest := httpClient.
|
||||
R().
|
||||
SetResult(&foldersResponse).
|
||||
SetHeader("User-Agent", USER_AGENT).
|
||||
SetQueryParam("environment", request.Environment).
|
||||
SetQueryParam("workspaceId", request.WorkspaceId).
|
||||
SetQueryParam("directory", request.FoldersPath)
|
||||
|
||||
response, err := httpRequest.Get(fmt.Sprintf("%v/v1/folders", config.INFISICAL_URL))
|
||||
|
||||
if err != nil {
|
||||
return GetFoldersV1Response{}, fmt.Errorf("CallGetFoldersV1: Unable to complete api request [err=%v]", err)
|
||||
}
|
||||
|
||||
if response.IsError() {
|
||||
return GetFoldersV1Response{}, fmt.Errorf("CallGetFoldersV1: Unsuccessful [response=%s]", response)
|
||||
}
|
||||
|
||||
return foldersResponse, nil
|
||||
}
|
||||
|
||||
func CallCreateFolderV1(httpClient *resty.Client, request CreateFolderV1Request) (CreateFolderV1Response, error) {
|
||||
var folderResponse CreateFolderV1Response
|
||||
httpRequest := httpClient.
|
||||
R().
|
||||
SetResult(&folderResponse).
|
||||
SetHeader("User-Agent", USER_AGENT).
|
||||
SetBody(request)
|
||||
|
||||
response, err := httpRequest.Post(fmt.Sprintf("%v/v1/folders", config.INFISICAL_URL))
|
||||
if err != nil {
|
||||
return CreateFolderV1Response{}, fmt.Errorf("CallCreateFolderV1: Unable to complete api request [err=%s]", err)
|
||||
}
|
||||
|
||||
if response.IsError() {
|
||||
return CreateFolderV1Response{}, fmt.Errorf("CallCreateFolderV1: Unsuccessful [response=%s]", response.String())
|
||||
}
|
||||
|
||||
return folderResponse, nil
|
||||
}
|
||||
|
||||
func CallDeleteFolderV1(httpClient *resty.Client, request DeleteFolderV1Request) (DeleteFolderV1Response, error) {
|
||||
var folderResponse DeleteFolderV1Response
|
||||
|
||||
httpRequest := httpClient.
|
||||
R().
|
||||
SetResult(&folderResponse).
|
||||
SetHeader("User-Agent", USER_AGENT).
|
||||
SetBody(request)
|
||||
|
||||
response, err := httpRequest.Delete(fmt.Sprintf("%v/v1/folders/%v", config.INFISICAL_URL, request.FolderName))
|
||||
if err != nil {
|
||||
return DeleteFolderV1Response{}, fmt.Errorf("CallDeleteFolderV1: Unable to complete api request [err=%s]", err)
|
||||
}
|
||||
|
||||
if response.IsError() {
|
||||
return DeleteFolderV1Response{}, fmt.Errorf("CallDeleteFolderV1: Unsuccessful [response=%s]", response.String())
|
||||
}
|
||||
|
||||
return folderResponse, nil
|
||||
}
|
||||
|
||||
func CallCreateSecretsV3(httpClient *resty.Client, request CreateSecretV3Request) error {
|
||||
var secretsResponse GetEncryptedSecretsV3Response
|
||||
response, err := httpClient.
|
||||
@ -424,50 +359,3 @@ func CallCreateServiceToken(httpClient *resty.Client, request CreateServiceToken
|
||||
|
||||
return createServiceTokenResponse, nil
|
||||
}
|
||||
|
||||
func CallServiceTokenV3Refresh(httpClient *resty.Client, request ServiceTokenV3RefreshTokenRequest) (ServiceTokenV3RefreshTokenResponse, error) {
|
||||
var serviceTokenV3RefreshTokenResponse ServiceTokenV3RefreshTokenResponse
|
||||
response, err := httpClient.
|
||||
R().
|
||||
SetResult(&serviceTokenV3RefreshTokenResponse).
|
||||
SetHeader("User-Agent", USER_AGENT).
|
||||
SetBody(request).
|
||||
Post(fmt.Sprintf("%v/v3/service-token/me/token", config.INFISICAL_URL))
|
||||
|
||||
if err != nil {
|
||||
return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unable to complete api request [err=%s]", err)
|
||||
}
|
||||
|
||||
if response.IsError() {
|
||||
return ServiceTokenV3RefreshTokenResponse{}, fmt.Errorf("CallServiceTokenV3Refresh: Unsuccessful response [%v %v] [status-code=%v] [response=%v]", response.Request.Method, response.Request.URL, response.StatusCode(), response.String())
|
||||
}
|
||||
|
||||
return serviceTokenV3RefreshTokenResponse, nil
|
||||
}
|
||||
|
||||
func CallGetRawSecretsV3(httpClient *resty.Client, request GetRawSecretsV3Request) (GetRawSecretsV3Response, error) {
|
||||
var getRawSecretsV3Response GetRawSecretsV3Response
|
||||
response, err := httpClient.
|
||||
R().
|
||||
SetResult(&getRawSecretsV3Response).
|
||||
SetHeader("User-Agent", USER_AGENT).
|
||||
SetBody(request).
|
||||
SetQueryParam("workspaceId", request.WorkspaceId).
|
||||
SetQueryParam("environment", request.Environment).
|
||||
SetQueryParam("include_imports", "false").
|
||||
Get(fmt.Sprintf("%v/v3/secrets/raw", config.INFISICAL_URL))
|
||||
|
||||
if err != nil {
|
||||
return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unable to complete api request [err=%w]", err)
|
||||
}
|
||||
|
||||
if response.IsError() && strings.Contains(response.String(), "Failed to find bot key") {
|
||||
return GetRawSecretsV3Response{}, fmt.Errorf("project with id %s is a legacy project type, please navigate to project settings and disable end to end encryption then try again", request.WorkspaceId)
|
||||
}
|
||||
|
||||
if response.IsError() {
|
||||
return GetRawSecretsV3Response{}, fmt.Errorf("CallGetRawSecretsV3: Unsuccessful response [%v %v] [status-code=%v]", response.Request.Method, response.Request.URL, response.StatusCode())
|
||||
}
|
||||
|
||||
return getRawSecretsV3Response, nil
|
||||
}
|
||||
|
||||
@ -278,47 +278,6 @@ type GetEncryptedSecretsV3Request struct {
|
||||
IncludeImport bool `json:"include_imports"`
|
||||
}
|
||||
|
||||
type GetFoldersV1Request struct {
|
||||
Environment string `json:"environment"`
|
||||
WorkspaceId string `json:"workspaceId"`
|
||||
FoldersPath string `json:"foldersPath"`
|
||||
}
|
||||
|
||||
type GetFoldersV1Response struct {
|
||||
Folders []struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
} `json:"folders"`
|
||||
}
|
||||
|
||||
type CreateFolderV1Request struct {
|
||||
FolderName string `json:"folderName"`
|
||||
WorkspaceId string `json:"workspaceId"`
|
||||
Environment string `json:"environment"`
|
||||
Directory string `json:"directory"`
|
||||
}
|
||||
|
||||
type CreateFolderV1Response struct {
|
||||
Folder struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
} `json:"folder"`
|
||||
}
|
||||
|
||||
type DeleteFolderV1Request struct {
|
||||
FolderName string `json:"folderName"`
|
||||
WorkspaceId string `json:"workspaceId"`
|
||||
Environment string `json:"environment"`
|
||||
Directory string `json:"directory"`
|
||||
}
|
||||
|
||||
type DeleteFolderV1Response struct {
|
||||
Folders []struct {
|
||||
ID string `json:"id"`
|
||||
Name string `json:"name"`
|
||||
} `json:"folders"`
|
||||
}
|
||||
|
||||
type EncryptedSecretV3 struct {
|
||||
ID string `json:"_id"`
|
||||
Version int `json:"version"`
|
||||
@ -462,34 +421,3 @@ type CreateServiceTokenResponse struct {
|
||||
ServiceToken string `json:"serviceToken"`
|
||||
ServiceTokenData ServiceTokenData `json:"serviceTokenData"`
|
||||
}
|
||||
|
||||
type ServiceTokenV3RefreshTokenRequest struct {
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
}
|
||||
type ServiceTokenV3RefreshTokenResponse struct {
|
||||
RefreshToken string `json:"refresh_token"`
|
||||
AccessToken string `json:"access_token"`
|
||||
ExpiresIn int `json:"expires_in"`
|
||||
TokenType string `json:"token_type"`
|
||||
}
|
||||
|
||||
type GetRawSecretsV3Request struct {
|
||||
Environment string `json:"environment"`
|
||||
WorkspaceId string `json:"workspaceId"`
|
||||
SecretPath string `json:"secretPath"`
|
||||
IncludeImport bool `json:"include_imports"`
|
||||
}
|
||||
|
||||
type GetRawSecretsV3Response struct {
|
||||
Secrets []struct {
|
||||
ID string `json:"_id"`
|
||||
Version int `json:"version"`
|
||||
Workspace string `json:"workspace"`
|
||||
Type string `json:"type"`
|
||||
Environment string `json:"environment"`
|
||||
SecretKey string `json:"secretKey"`
|
||||
SecretValue string `json:"secretValue"`
|
||||
SecretComment string `json:"secretComment"`
|
||||
} `json:"secrets"`
|
||||
Imports []any `json:"imports"`
|
||||
}
|
||||
|
||||
@ -1,327 +0,0 @@
|
||||
/*
|
||||
Copyright (c) 2023 Infisical Inc.
|
||||
*/
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"os/signal"
|
||||
"strings"
|
||||
"syscall"
|
||||
"text/template"
|
||||
"time"
|
||||
|
||||
"github.com/rs/zerolog/log"
|
||||
"gopkg.in/yaml.v2"
|
||||
|
||||
"github.com/Infisical/infisical-merge/packages/api"
|
||||
"github.com/Infisical/infisical-merge/packages/config"
|
||||
"github.com/Infisical/infisical-merge/packages/models"
|
||||
"github.com/Infisical/infisical-merge/packages/util"
|
||||
"github.com/go-resty/resty/v2"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
const DEFAULT_INFISICAL_CLOUD_URL = "https://app.infisical.com"
|
||||
|
||||
type Config struct {
|
||||
Infisical InfisicalConfig `yaml:"infisical"`
|
||||
Auth AuthConfig `yaml:"auth"`
|
||||
Sinks []Sink `yaml:"sinks"`
|
||||
Templates []Template `yaml:"templates"`
|
||||
}
|
||||
|
||||
type InfisicalConfig struct {
|
||||
Address string `yaml:"address"`
|
||||
}
|
||||
|
||||
type AuthConfig struct {
|
||||
Type string `yaml:"type"`
|
||||
Config interface{} `yaml:"config"`
|
||||
}
|
||||
|
||||
type TokenAuthConfig struct {
|
||||
TokenPath string `yaml:"token-path"`
|
||||
}
|
||||
|
||||
type OAuthConfig struct {
|
||||
ClientID string `yaml:"client-id"`
|
||||
ClientSecret string `yaml:"client-secret"`
|
||||
}
|
||||
|
||||
type Sink struct {
|
||||
Type string `yaml:"type"`
|
||||
Config SinkDetails `yaml:"config"`
|
||||
}
|
||||
|
||||
type SinkDetails struct {
|
||||
Path string `yaml:"path"`
|
||||
}
|
||||
|
||||
type Template struct {
|
||||
SourcePath string `yaml:"source-path"`
|
||||
DestinationPath string `yaml:"destination-path"`
|
||||
}
|
||||
|
||||
func ReadFile(filePath string) ([]byte, error) {
|
||||
return ioutil.ReadFile(filePath)
|
||||
}
|
||||
|
||||
func FileExists(filepath string) bool {
|
||||
info, err := os.Stat(filepath)
|
||||
if os.IsNotExist(err) {
|
||||
return false
|
||||
}
|
||||
return !info.IsDir()
|
||||
}
|
||||
|
||||
// WriteToFile writes data to the specified file path.
|
||||
func WriteBytesToFile(data *bytes.Buffer, outputPath string) error {
|
||||
outputFile, err := os.Create(outputPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer outputFile.Close()
|
||||
|
||||
_, err = outputFile.Write(data.Bytes())
|
||||
return err
|
||||
}
|
||||
|
||||
func appendAPIEndpoint(address string) string {
|
||||
// Ensure the address does not already end with "/api"
|
||||
if strings.HasSuffix(address, "/api") {
|
||||
return address
|
||||
}
|
||||
|
||||
// Check if the address ends with a slash and append accordingly
|
||||
if address[len(address)-1] == '/' {
|
||||
return address + "api"
|
||||
}
|
||||
return address + "/api"
|
||||
}
|
||||
|
||||
func ParseAgentConfig(filePath string) (*Config, error) {
|
||||
data, err := ioutil.ReadFile(filePath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var rawConfig struct {
|
||||
Infisical InfisicalConfig `yaml:"infisical"`
|
||||
Auth struct {
|
||||
Type string `yaml:"type"`
|
||||
Config map[string]interface{} `yaml:"config"`
|
||||
} `yaml:"auth"`
|
||||
Sinks []Sink `yaml:"sinks"`
|
||||
Templates []Template `yaml:"templates"`
|
||||
}
|
||||
|
||||
if err := yaml.Unmarshal(data, &rawConfig); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// Set defaults
|
||||
if rawConfig.Infisical.Address == "" {
|
||||
rawConfig.Infisical.Address = DEFAULT_INFISICAL_CLOUD_URL
|
||||
}
|
||||
|
||||
config.INFISICAL_URL = appendAPIEndpoint(rawConfig.Infisical.Address)
|
||||
|
||||
log.Info().Msgf("Infisical instance address set to %s", rawConfig.Infisical.Address)
|
||||
|
||||
config := &Config{
|
||||
Infisical: rawConfig.Infisical,
|
||||
Auth: AuthConfig{
|
||||
Type: rawConfig.Auth.Type,
|
||||
},
|
||||
Sinks: rawConfig.Sinks,
|
||||
Templates: rawConfig.Templates,
|
||||
}
|
||||
|
||||
// Marshal and then unmarshal the config based on the type
|
||||
configBytes, err := yaml.Marshal(rawConfig.Auth.Config)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
switch rawConfig.Auth.Type {
|
||||
case "token":
|
||||
var tokenConfig TokenAuthConfig
|
||||
if err := yaml.Unmarshal(configBytes, &tokenConfig); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
config.Auth.Config = tokenConfig
|
||||
case "oauth": // aws, gcp, k8s service account, etc
|
||||
var oauthConfig OAuthConfig
|
||||
if err := yaml.Unmarshal(configBytes, &oauthConfig); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
config.Auth.Config = oauthConfig
|
||||
default:
|
||||
return nil, fmt.Errorf("unknown auth type: %s", rawConfig.Auth.Type)
|
||||
}
|
||||
|
||||
return config, nil
|
||||
}
|
||||
|
||||
func secretTemplateFunction(accessToken string) func(string, string, string) ([]models.SingleEnvironmentVariable, error) {
|
||||
return func(projectID, envSlug, secretPath string) ([]models.SingleEnvironmentVariable, error) {
|
||||
secrets, err := util.GetPlainTextSecretsViaMachineIdentity(accessToken, projectID, envSlug, secretPath, false)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return secrets, nil
|
||||
}
|
||||
}
|
||||
|
||||
func ProcessTemplate(templatePath string, data interface{}, accessToken string) (*bytes.Buffer, error) {
|
||||
// custom template function to fetch secrets from Infisical
|
||||
secretFunction := secretTemplateFunction(accessToken)
|
||||
funcs := template.FuncMap{
|
||||
"secret": secretFunction,
|
||||
}
|
||||
|
||||
tmpl, err := template.New(templatePath).Funcs(funcs).ParseFiles(templatePath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var buf bytes.Buffer
|
||||
if err := tmpl.Execute(&buf, data); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &buf, nil
|
||||
}
|
||||
|
||||
func refreshTokenAndProcessTemplate(refreshToken string, config *Config, errChan chan error) {
|
||||
for {
|
||||
httpClient := resty.New()
|
||||
httpClient.SetRetryCount(10000).
|
||||
SetRetryMaxWaitTime(20 * time.Second).
|
||||
SetRetryWaitTime(5 * time.Second)
|
||||
|
||||
tokenResponse, err := api.CallServiceTokenV3Refresh(httpClient, api.ServiceTokenV3RefreshTokenRequest{RefreshToken: refreshToken})
|
||||
if err != nil {
|
||||
errChan <- fmt.Errorf("unable to complete renewal because [%s]", err)
|
||||
}
|
||||
|
||||
for _, sinkFile := range config.Sinks {
|
||||
if sinkFile.Type == "file" {
|
||||
err = ioutil.WriteFile(sinkFile.Config.Path, []byte(tokenResponse.AccessToken), 0644)
|
||||
if err != nil {
|
||||
errChan <- err
|
||||
return
|
||||
}
|
||||
} else {
|
||||
errChan <- errors.New("unsupported sink type. Only 'file' type is supported")
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
refreshToken = tokenResponse.RefreshToken
|
||||
nextRefreshCycle := time.Duration(tokenResponse.ExpiresIn-5) * time.Second // when the next access refresh will happen
|
||||
|
||||
d, err := time.ParseDuration(nextRefreshCycle.String())
|
||||
if err != nil {
|
||||
errChan <- fmt.Errorf("unable to parse refresh time because %s", err)
|
||||
return
|
||||
}
|
||||
|
||||
log.Info().Msgf("token refreshed and saved to selected path; next cycle will occur in %s", d.String())
|
||||
|
||||
for _, secretTemplate := range config.Templates {
|
||||
processedTemplate, err := ProcessTemplate(secretTemplate.SourcePath, nil, tokenResponse.AccessToken)
|
||||
if err != nil {
|
||||
errChan <- err
|
||||
return
|
||||
}
|
||||
|
||||
if err := WriteBytesToFile(processedTemplate, secretTemplate.DestinationPath); err != nil {
|
||||
errChan <- err
|
||||
return
|
||||
}
|
||||
|
||||
log.Info().Msgf("secret template at path %s has been rendered and saved to path %s", secretTemplate.SourcePath, secretTemplate.DestinationPath)
|
||||
}
|
||||
|
||||
time.Sleep(nextRefreshCycle)
|
||||
}
|
||||
}
|
||||
|
||||
// runCmd represents the run command
|
||||
var agentCmd = &cobra.Command{
|
||||
Example: `
|
||||
infisical agent
|
||||
`,
|
||||
Use: "agent",
|
||||
Short: "Used to launch a client daemon that streamlines authentication and secret retrieval processes in some environments",
|
||||
DisableFlagsInUseLine: true,
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
|
||||
log.Info().Msg("starting Infisical agent...")
|
||||
|
||||
configPath, err := cmd.Flags().GetString("config")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse flag config")
|
||||
}
|
||||
|
||||
if !FileExists(configPath) {
|
||||
log.Error().Msgf("Unable to locate %s. The provided agent config file path is either missing or incorrect", configPath)
|
||||
return
|
||||
}
|
||||
|
||||
agentConfig, err := ParseAgentConfig(configPath)
|
||||
if err != nil {
|
||||
log.Error().Msgf("Unable to prase %s because %v. Please ensure that is follows the Infisical Agent config structure", configPath, err)
|
||||
return
|
||||
}
|
||||
|
||||
errChan := make(chan error)
|
||||
sigChan := make(chan os.Signal, 1)
|
||||
|
||||
signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
|
||||
|
||||
switch configAuthType := agentConfig.Auth.Config.(type) {
|
||||
case TokenAuthConfig:
|
||||
content, err := ReadFile(configAuthType.TokenPath)
|
||||
if err != nil {
|
||||
log.Error().Msgf("unable to read initial token from file path %s because %v", configAuthType.TokenPath, err)
|
||||
return
|
||||
}
|
||||
|
||||
refreshToken := string(content)
|
||||
go refreshTokenAndProcessTemplate(refreshToken, agentConfig, errChan)
|
||||
|
||||
case OAuthConfig:
|
||||
// future auth types
|
||||
default:
|
||||
log.Error().Msgf("unknown auth config type. Only 'file' type is supported")
|
||||
return
|
||||
}
|
||||
|
||||
select {
|
||||
case err := <-errChan:
|
||||
log.Fatal().Msgf("agent stopped due to error: %v", err)
|
||||
os.Exit(1)
|
||||
case <-sigChan:
|
||||
log.Info().Msg("agent is gracefully shutting...")
|
||||
os.Exit(1)
|
||||
}
|
||||
|
||||
},
|
||||
}
|
||||
|
||||
func init() {
|
||||
agentCmd.SetHelpFunc(func(command *cobra.Command, strings []string) {
|
||||
command.Flags().MarkHidden("domain")
|
||||
command.Parent().HelpFunc()(command, strings)
|
||||
})
|
||||
agentCmd.Flags().String("config", "agent-config.yaml", "The path to agent config yaml file")
|
||||
rootCmd.AddCommand(agentCmd)
|
||||
}
|
||||
@ -1,164 +0,0 @@
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
"github.com/Infisical/infisical-merge/packages/models"
|
||||
"github.com/Infisical/infisical-merge/packages/util"
|
||||
"github.com/Infisical/infisical-merge/packages/visualize"
|
||||
"github.com/posthog/posthog-go"
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var folderCmd = &cobra.Command{
|
||||
Use: "folders",
|
||||
Short: "Create, delete, and list folders",
|
||||
DisableFlagsInUseLine: true,
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
cmd.Help()
|
||||
},
|
||||
}
|
||||
|
||||
var getCmd = &cobra.Command{
|
||||
Use: "get",
|
||||
Short: "Get folders in a directory",
|
||||
PersistentPreRun: func(cmd *cobra.Command, args []string) {
|
||||
util.RequireLocalWorkspaceFile()
|
||||
util.RequireLogin()
|
||||
},
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
|
||||
environmentName, _ := cmd.Flags().GetString("env")
|
||||
if !cmd.Flags().Changed("env") {
|
||||
environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
|
||||
if environmentFromWorkspace != "" {
|
||||
environmentName = environmentFromWorkspace
|
||||
}
|
||||
}
|
||||
|
||||
infisicalToken, err := cmd.Flags().GetString("token")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse flag")
|
||||
}
|
||||
|
||||
foldersPath, err := cmd.Flags().GetString("path")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse flag")
|
||||
}
|
||||
|
||||
folders, err := util.GetAllFolders(models.GetAllFoldersParameters{Environment: environmentName, InfisicalToken: infisicalToken, FoldersPath: foldersPath})
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to get folders")
|
||||
}
|
||||
|
||||
visualize.PrintAllFoldersDetails(folders, foldersPath)
|
||||
Telemetry.CaptureEvent("cli-command:folders get", posthog.NewProperties().Set("folderCount", len(folders)).Set("version", util.CLI_VERSION))
|
||||
},
|
||||
}
|
||||
|
||||
var createCmd = &cobra.Command{
|
||||
Use: "create",
|
||||
Short: "Create a folder",
|
||||
PersistentPreRun: func(cmd *cobra.Command, args []string) {
|
||||
util.RequireLogin()
|
||||
util.RequireLocalWorkspaceFile()
|
||||
},
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
environmentName, _ := cmd.Flags().GetString("env")
|
||||
if !cmd.Flags().Changed("env") {
|
||||
environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
|
||||
if environmentFromWorkspace != "" {
|
||||
environmentName = environmentFromWorkspace
|
||||
}
|
||||
}
|
||||
|
||||
folderPath, err := cmd.Flags().GetString("path")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse flag")
|
||||
}
|
||||
|
||||
folderName, err := cmd.Flags().GetString("name")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse name flag")
|
||||
}
|
||||
|
||||
if folderName == "" {
|
||||
util.HandleError(fmt.Errorf("Invalid folder name"), "Folder name cannot be empty")
|
||||
}
|
||||
|
||||
workspaceFile, err := util.GetWorkSpaceFromFile()
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to get workspace file")
|
||||
}
|
||||
|
||||
params := models.CreateFolderParameters{
|
||||
FolderName: folderName,
|
||||
WorkspaceId: workspaceFile.WorkspaceId,
|
||||
Environment: environmentName,
|
||||
FolderPath: folderPath,
|
||||
}
|
||||
|
||||
_, err = util.CreateFolder(params)
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to create folder")
|
||||
}
|
||||
|
||||
util.PrintSuccessMessage(fmt.Sprintf("folder named `%s` created in path %s", folderName, folderPath))
|
||||
|
||||
Telemetry.CaptureEvent("cli-command:folders create", posthog.NewProperties().Set("version", util.CLI_VERSION))
|
||||
},
|
||||
}
|
||||
|
||||
var deleteCmd = &cobra.Command{
|
||||
Use: "delete",
|
||||
Short: "Delete a folder",
|
||||
PersistentPreRun: func(cmd *cobra.Command, args []string) {
|
||||
util.RequireLogin()
|
||||
util.RequireLocalWorkspaceFile()
|
||||
},
|
||||
Run: func(cmd *cobra.Command, args []string) {
|
||||
|
||||
environmentName, _ := cmd.Flags().GetString("env")
|
||||
if !cmd.Flags().Changed("env") {
|
||||
environmentFromWorkspace := util.GetEnvFromWorkspaceFile()
|
||||
if environmentFromWorkspace != "" {
|
||||
environmentName = environmentFromWorkspace
|
||||
}
|
||||
}
|
||||
|
||||
folderPath, err := cmd.Flags().GetString("path")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse flag")
|
||||
}
|
||||
|
||||
folderName, err := cmd.Flags().GetString("name")
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to parse name flag")
|
||||
}
|
||||
|
||||
if folderName == "" {
|
||||
util.HandleError(fmt.Errorf("Invalid folder name"), "Folder name cannot be empty")
|
||||
}
|
||||
|
||||
workspaceFile, err := util.GetWorkSpaceFromFile()
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to get workspace file")
|
||||
}
|
||||
|
||||
params := models.DeleteFolderParameters{
|
||||
FolderName: folderName,
|
||||
WorkspaceId: workspaceFile.WorkspaceId,
|
||||
Environment: environmentName,
|
||||
FolderPath: folderPath,
|
||||
}
|
||||
|
||||
_, err = util.DeleteFolder(params)
|
||||
if err != nil {
|
||||
util.HandleError(err, "Unable to delete folder")
|
||||
}
|
||||
|
||||
util.PrintSuccessMessage(fmt.Sprintf("folder named `%s` deleted in path %s", folderName, folderPath))
|
||||
|
||||
Telemetry.CaptureEvent("cli-command:folders delete", posthog.NewProperties().Set("version", util.CLI_VERSION))
|
||||
},
|
||||
}
|
||||
@ -679,28 +679,6 @@ func init() {
|
||||
util.RequireLocalWorkspaceFile()
|
||||
}
|
||||
|
||||
// *** Folders sub command ***
|
||||
folderCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
|
||||
|
||||
// Add getCmd, createCmd and deleteCmd flags here
|
||||
getCmd.Flags().StringP("path", "p", "/", "The path from where folders should be fetched from")
|
||||
getCmd.Flags().String("token", "", "Fetch folders using the infisical token")
|
||||
folderCmd.AddCommand(getCmd)
|
||||
|
||||
// Add createCmd flags here
|
||||
createCmd.Flags().StringP("path", "p", "/", "Path to where the folder should be created")
|
||||
createCmd.Flags().StringP("name", "n", "", "Name of the folder to be created in selected `--path`")
|
||||
folderCmd.AddCommand(createCmd)
|
||||
|
||||
// Add deleteCmd flags here
|
||||
deleteCmd.Flags().StringP("path", "p", "/", "Path to the folder to be deleted")
|
||||
deleteCmd.Flags().StringP("name", "n", "", "Name of the folder to be deleted within selected `--path`")
|
||||
folderCmd.AddCommand(deleteCmd)
|
||||
|
||||
secretsCmd.AddCommand(folderCmd)
|
||||
|
||||
// ** End of folders sub command
|
||||
|
||||
secretsCmd.Flags().String("token", "", "Fetch secrets using the Infisical Token")
|
||||
secretsCmd.PersistentFlags().String("env", "dev", "Used to select the environment name on which actions should be taken on")
|
||||
secretsCmd.Flags().Bool("expand", true, "Parse shell parameter expansions in your secrets")
|
||||
|
||||
@ -34,11 +34,6 @@ type SingleEnvironmentVariable struct {
|
||||
Comment string `json:"comment"`
|
||||
}
|
||||
|
||||
type SingleFolder struct {
|
||||
ID string `json:"_id"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
type Workspace struct {
|
||||
ID string `json:"_id"`
|
||||
Name string `json:"name"`
|
||||
@ -68,26 +63,3 @@ type GetAllSecretsParameters struct {
|
||||
SecretsPath string
|
||||
IncludeImport bool
|
||||
}
|
||||
|
||||
type GetAllFoldersParameters struct {
|
||||
WorkspaceId string
|
||||
Environment string
|
||||
FoldersPath string
|
||||
InfisicalToken string
|
||||
}
|
||||
|
||||
type CreateFolderParameters struct {
|
||||
FolderName string
|
||||
WorkspaceId string
|
||||
Environment string
|
||||
FolderPath string
|
||||
InfisicalToken string
|
||||
}
|
||||
|
||||
type DeleteFolderParameters struct {
|
||||
FolderName string
|
||||
WorkspaceId string
|
||||
Environment string
|
||||
FolderPath string
|
||||
InfisicalToken string
|
||||
}
|
||||
|
||||
@ -1,212 +0,0 @@
|
||||
package util
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"strings"
|
||||
|
||||
"github.com/Infisical/infisical-merge/packages/api"
|
||||
"github.com/Infisical/infisical-merge/packages/models"
|
||||
"github.com/go-resty/resty/v2"
|
||||
"github.com/rs/zerolog/log"
|
||||
)
|
||||
|
||||
func GetAllFolders(params models.GetAllFoldersParameters) ([]models.SingleFolder, error) {
|
||||
|
||||
if params.InfisicalToken == "" {
|
||||
params.InfisicalToken = os.Getenv(INFISICAL_TOKEN_NAME)
|
||||
}
|
||||
|
||||
var foldersToReturn []models.SingleFolder
|
||||
var folderErr error
|
||||
if params.InfisicalToken == "" {
|
||||
|
||||
log.Debug().Msg("GetAllFolders: Trying to fetch folders using logged in details")
|
||||
|
||||
loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if loggedInUserDetails.LoginExpired {
|
||||
PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
|
||||
}
|
||||
|
||||
workspaceFile, err := GetWorkSpaceFromFile()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if params.WorkspaceId != "" {
|
||||
workspaceFile.WorkspaceId = params.WorkspaceId
|
||||
}
|
||||
|
||||
folders, err := GetFoldersViaJTW(loggedInUserDetails.UserCredentials.JTWToken, workspaceFile.WorkspaceId, params.Environment, params.FoldersPath)
|
||||
folderErr = err
|
||||
foldersToReturn = folders
|
||||
} else {
|
||||
// get folders via service token
|
||||
folders, err := GetFoldersViaServiceToken(params.InfisicalToken, params.WorkspaceId, params.Environment, params.FoldersPath)
|
||||
folderErr = err
|
||||
foldersToReturn = folders
|
||||
}
|
||||
return foldersToReturn, folderErr
|
||||
}
|
||||
|
||||
func GetFoldersViaJTW(JTWToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
|
||||
// set up resty client
|
||||
httpClient := resty.New()
|
||||
httpClient.SetAuthToken(JTWToken).
|
||||
SetHeader("Accept", "application/json")
|
||||
|
||||
getFoldersRequest := api.GetFoldersV1Request{
|
||||
WorkspaceId: workspaceId,
|
||||
Environment: environmentName,
|
||||
FoldersPath: foldersPath,
|
||||
}
|
||||
|
||||
apiResponse, err := api.CallGetFoldersV1(httpClient, getFoldersRequest)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var folders []models.SingleFolder
|
||||
|
||||
for _, folder := range apiResponse.Folders {
|
||||
folders = append(folders, models.SingleFolder{
|
||||
Name: folder.Name,
|
||||
ID: folder.ID,
|
||||
})
|
||||
}
|
||||
|
||||
return folders, nil
|
||||
}
|
||||
|
||||
func GetFoldersViaServiceToken(fullServiceToken string, workspaceId string, environmentName string, foldersPath string) ([]models.SingleFolder, error) {
|
||||
serviceTokenParts := strings.SplitN(fullServiceToken, ".", 4)
|
||||
if len(serviceTokenParts) < 4 {
|
||||
return nil, fmt.Errorf("invalid service token entered. Please double check your service token and try again")
|
||||
}
|
||||
|
||||
serviceToken := fmt.Sprintf("%v.%v.%v", serviceTokenParts[0], serviceTokenParts[1], serviceTokenParts[2])
|
||||
|
||||
httpClient := resty.New()
|
||||
|
||||
httpClient.SetAuthToken(serviceToken).
|
||||
SetHeader("Accept", "application/json")
|
||||
|
||||
serviceTokenDetails, err := api.CallGetServiceTokenDetailsV2(httpClient)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to get service token details. [err=%v]", err)
|
||||
}
|
||||
|
||||
// if multiple scopes are there then user needs to specify which environment and folder path
|
||||
if environmentName == "" {
|
||||
if len(serviceTokenDetails.Scopes) != 1 {
|
||||
return nil, fmt.Errorf("you need to provide the --env for multiple environment scoped token")
|
||||
} else {
|
||||
environmentName = serviceTokenDetails.Scopes[0].Environment
|
||||
}
|
||||
}
|
||||
|
||||
getFoldersRequest := api.GetFoldersV1Request{
|
||||
WorkspaceId: serviceTokenDetails.Workspace,
|
||||
Environment: environmentName,
|
||||
FoldersPath: foldersPath,
|
||||
}
|
||||
|
||||
apiResponse, err := api.CallGetFoldersV1(httpClient, getFoldersRequest)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to get folders. [err=%v]", err)
|
||||
}
|
||||
|
||||
var folders []models.SingleFolder
|
||||
|
||||
for _, folder := range apiResponse.Folders {
|
||||
folders = append(folders, models.SingleFolder{
|
||||
Name: folder.Name,
|
||||
ID: folder.ID,
|
||||
})
|
||||
}
|
||||
|
||||
return folders, nil
|
||||
}
|
||||
|
||||
// CreateFolder creates a folder in Infisical
|
||||
func CreateFolder(params models.CreateFolderParameters) (models.SingleFolder, error) {
|
||||
loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
|
||||
if err != nil {
|
||||
return models.SingleFolder{}, err
|
||||
}
|
||||
|
||||
if loggedInUserDetails.LoginExpired {
|
||||
PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
|
||||
}
|
||||
|
||||
// set up resty client
|
||||
httpClient := resty.New()
|
||||
httpClient.
|
||||
SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken).
|
||||
SetHeader("Accept", "application/json").
|
||||
SetHeader("Content-Type", "application/json")
|
||||
|
||||
createFolderRequest := api.CreateFolderV1Request{
|
||||
WorkspaceId: params.WorkspaceId,
|
||||
Environment: params.Environment,
|
||||
FolderName: params.FolderName,
|
||||
Directory: params.FolderPath,
|
||||
}
|
||||
|
||||
apiResponse, err := api.CallCreateFolderV1(httpClient, createFolderRequest)
|
||||
if err != nil {
|
||||
return models.SingleFolder{}, err
|
||||
}
|
||||
|
||||
folder := apiResponse.Folder
|
||||
|
||||
return models.SingleFolder{
|
||||
Name: folder.Name,
|
||||
ID: folder.ID,
|
||||
}, nil
|
||||
}
|
||||
|
||||
func DeleteFolder(params models.DeleteFolderParameters) ([]models.SingleFolder, error) {
|
||||
loggedInUserDetails, err := GetCurrentLoggedInUserDetails()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if loggedInUserDetails.LoginExpired {
|
||||
PrintErrorMessageAndExit("Your login session has expired, please run [infisical login] and try again")
|
||||
}
|
||||
|
||||
// set up resty client
|
||||
httpClient := resty.New()
|
||||
httpClient.
|
||||
SetAuthToken(loggedInUserDetails.UserCredentials.JTWToken).
|
||||
SetHeader("Accept", "application/json").
|
||||
SetHeader("Content-Type", "application/json")
|
||||
|
||||
deleteFolderRequest := api.DeleteFolderV1Request{
|
||||
WorkspaceId: params.WorkspaceId,
|
||||
Environment: params.Environment,
|
||||
FolderName: params.FolderName,
|
||||
Directory: params.FolderPath,
|
||||
}
|
||||
|
||||
apiResponse, err := api.CallDeleteFolderV1(httpClient, deleteFolderRequest)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
var folders []models.SingleFolder
|
||||
|
||||
for _, folder := range apiResponse.Folders {
|
||||
folders = append(folders, models.SingleFolder{
|
||||
Name: folder.Name,
|
||||
ID: folder.ID,
|
||||
})
|
||||
}
|
||||
|
||||
return folders, nil
|
||||
}
|
||||
@ -152,46 +152,6 @@ func GetPlainTextSecretsViaJTW(JTWToken string, receiversPrivateKey string, work
|
||||
return plainTextSecrets, nil
|
||||
}
|
||||
|
||||
func GetPlainTextSecretsViaMachineIdentity(accessToken string, workspaceId string, environmentName string, secretsPath string, includeImports bool) ([]models.SingleEnvironmentVariable, error) {
|
||||
httpClient := resty.New()
|
||||
httpClient.SetAuthToken(accessToken).
|
||||
SetHeader("Accept", "application/json")
|
||||
|
||||
getSecretsRequest := api.GetEncryptedSecretsV3Request{
|
||||
WorkspaceId: workspaceId,
|
||||
Environment: environmentName,
|
||||
IncludeImport: includeImports,
|
||||
// TagSlugs: tagSlugs,
|
||||
}
|
||||
|
||||
if secretsPath != "" {
|
||||
getSecretsRequest.SecretPath = secretsPath
|
||||
}
|
||||
|
||||
rawSecrets, err := api.CallGetRawSecretsV3(httpClient, api.GetRawSecretsV3Request{WorkspaceId: workspaceId, SecretPath: environmentName, Environment: environmentName})
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
plainTextSecrets := []models.SingleEnvironmentVariable{}
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to decrypt your secrets [err=%v]", err)
|
||||
}
|
||||
|
||||
for _, secret := range rawSecrets.Secrets {
|
||||
plainTextSecrets = append(plainTextSecrets, models.SingleEnvironmentVariable{Key: secret.SecretKey, Value: secret.SecretValue})
|
||||
}
|
||||
|
||||
// if includeImports {
|
||||
// plainTextSecrets, err = InjectImportedSecret(plainTextWorkspaceKey, plainTextSecrets, encryptedSecrets.ImportedSecrets)
|
||||
// if err != nil {
|
||||
// return nil, err
|
||||
// }
|
||||
// }
|
||||
|
||||
return plainTextSecrets, nil
|
||||
}
|
||||
|
||||
func InjectImportedSecret(plainTextWorkspaceKey []byte, secrets []models.SingleEnvironmentVariable, importedSecrets []api.ImportedSecretV3) ([]models.SingleEnvironmentVariable, error) {
|
||||
if importedSecrets == nil {
|
||||
return secrets, nil
|
||||
|
||||
@ -1,14 +0,0 @@
|
||||
package visualize
|
||||
|
||||
import "github.com/Infisical/infisical-merge/packages/models"
|
||||
|
||||
func PrintAllFoldersDetails(folders []models.SingleFolder, path string) {
|
||||
rows := [][3]string{}
|
||||
for _, folder := range folders {
|
||||
rows = append(rows, [...]string{folder.Name, path, folder.ID})
|
||||
}
|
||||
|
||||
headers := [...]string{"FOLDER NAME", "PATH", "FOLDER ID"}
|
||||
|
||||
Table(headers, rows)
|
||||
}
|
||||
@ -1,5 +0,0 @@
|
||||
{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }}
|
||||
{{- range . }}
|
||||
{{ .Key }}={{ .Value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
@ -1,4 +0,0 @@
|
||||
---
|
||||
title: "Export"
|
||||
openapi: "GET /api/v1/workspace/{workspaceId}/audit-logs"
|
||||
---
|
||||
@ -1,4 +1,4 @@
|
||||
---
|
||||
title: "Create"
|
||||
openapi: "POST /api/v1/workspace/{workspaceId}/environments"
|
||||
---
|
||||
openapi: "POST /api/v2/workspace/{workspaceId}/environments"
|
||||
---
|
||||
@ -4,34 +4,16 @@ title: "Changelog"
|
||||
|
||||
The changelog below reflects new product developments and updates on a monthly basis.
|
||||
|
||||
## November 2023
|
||||
## September
|
||||
|
||||
- Replaced internal [Winston](https://github.com/winstonjs/winston) with [Pino](https://github.com/pinojs/pino) logging library with external logging to AWS CloudWatch
|
||||
- Added admin panel to self-hosting experience.
|
||||
- Released [secret rotation](https://infisical.com/docs/documentation/platform/secret-rotation/overview) feature with preliminary support for rotating [SendGrid](https://infisical.com/docs/documentation/platform/secret-rotation/sendgrid), [PostgreSQL/CockroachDB](https://infisical.com/docs/documentation/platform/secret-rotation/postgres), and [MySQL/MariaDB](https://infisical.com/docs/documentation/platform/secret-rotation/mysql) credentials.
|
||||
- Released secret reminders feature.
|
||||
|
||||
## October 2023
|
||||
|
||||
- Added support for [GitLab SSO](https://infisical.com/docs/documentation/platform/sso/gitlab).
|
||||
- Became SOC 2 (Type II) certified.
|
||||
- Reduced required JWT configuration from 5-6 secrets to 1 secret for self-hosting Infisical.
|
||||
- Compacted Infisical into 1 Docker image.
|
||||
- Added native [Hasura Cloud integration](https://infisical.com/docs/integrations/cloud/hasura-cloud).
|
||||
- Updated resource deletion logic for user, organization, and project deletion.
|
||||
|
||||
## September 2023
|
||||
|
||||
- Released [secret approvals](https://infisical.com/docs/documentation/platform/pr-workflows) feature.
|
||||
- Released an update to access controls; every user role now clearly defines and enforces a certain set of conditions across Infisical.
|
||||
- Updated UI/UX for integrations.
|
||||
- Added a native integration with [Qovery](https://infisical.com/docs/integrations/cloud/qovery).
|
||||
- Added service token generation capability for the CLI.
|
||||
|
||||
## August 2023
|
||||
|
||||
- Release Audit Logs V2.
|
||||
- Add support for [GitHub SSO](https://infisical.com/docs/documentation/platform/sso/github).
|
||||
- Add support for GitHub SSO.
|
||||
- Enable users to opt in for multiple authentication methods.
|
||||
- Improved password requirements including check against [Have I Been Pwnd Password API](https://haveibeenpwned.com/Passwords).
|
||||
- Added native [GCP Secret Manager integration](https://infisical.com/docs/integrations/cloud/gcp-secret-manager)
|
||||
@ -49,8 +31,8 @@ The changelog below reflects new product developments and updates on a monthly b
|
||||
- Added native [Terraform Cloud integration](https://infisical.com/docs/integrations/cloud/terraform-cloud).
|
||||
- Added native [Northflank integration](https://infisical.com/docs/integrations/cloud/northflank).
|
||||
- Added native [Windmill integration](https://infisical.com/docs/integrations/cloud/windmill).
|
||||
- Added support for [Google SSO](https://infisical.com/docs/documentation/platform/sso/google)
|
||||
- Added support for [Okta](https://infisical.com/docs/documentation/platform/sso/okta), [Azure AD](https://infisical.com/docs/documentation/platform/sso/azure), and [JumpCloud](https://infisical.com/docs/documentation/platform/sso/jumpcloud) [SAML](https://infisical.com/docs/documentation/platform/saml) authentication.
|
||||
- Added support for Google SSO.
|
||||
- Added support for [Okta](https://infisical.com/docs/documentation/platform/sso/okta), [Azure AD](https://infisical.com/docs/documentation/platform/sso/azure), and JumpCloud [SAML](https://infisical.com/docs/documentation/platform/saml) authentication.
|
||||
- Released [folders / path-based secret storage](https://infisical.com/docs/documentation/platform/folder).
|
||||
- Released [webhooks](https://infisical.com/docs/documentation/platform/webhooks).
|
||||
|
||||
|
||||
@ -134,73 +134,6 @@ $ infisical secrets set STRIPE_API_KEY=sjdgwkeudyjwe DOMAIN=example.com HASH=jeb
|
||||
</Accordion>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical secrets folders">
|
||||
This command allows you to fetch, create and delete folders from within a path from a given project.
|
||||
|
||||
```bash
|
||||
$ infisical secrets folders
|
||||
```
|
||||
|
||||
### sub commands
|
||||
<Accordion title="get">
|
||||
Used to fetch all folders within a path in a given project
|
||||
```
|
||||
infisical secrets folders get --path=/some/path/to/folder
|
||||
```
|
||||
#### Flags
|
||||
<Accordion title="--path">
|
||||
The path from where folders should be fetched from
|
||||
|
||||
Default value: `/`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--token">
|
||||
Fetch folders using the Infisical service token
|
||||
|
||||
Default value: ``
|
||||
</Accordion>
|
||||
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="create">
|
||||
Used to create a folder by name within a path.
|
||||
```
|
||||
infisical secrets folders create --path=/some/path/to/folder --name=folder-name
|
||||
```
|
||||
### Flags
|
||||
<Accordion title="--path">
|
||||
Path to where the folder should be created
|
||||
|
||||
Default value: `/`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--name">
|
||||
Name of the folder to be created in selected `--path`
|
||||
|
||||
Default value: ``
|
||||
</Accordion>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="delete">
|
||||
Used to delete a folder by name within a path.
|
||||
```
|
||||
infisical secrets folders delete --path=/some/path/to/folder --name=folder-name
|
||||
```
|
||||
### Flags
|
||||
<Accordion title="--path">
|
||||
Path to where the folder should be created
|
||||
|
||||
Default value: `/`
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="--name">
|
||||
Name of the folder to be deleted within selected `--path`
|
||||
|
||||
Default value: ``
|
||||
</Accordion>
|
||||
</Accordion>
|
||||
</Accordion>
|
||||
|
||||
<Accordion title="infisical secrets generate-example-env">
|
||||
This command allows you to generate an example .env file from your secrets and with their associated comments and tags. This is useful when you would like to let
|
||||
others who work on the project but do not use Infisical become aware of the required environment variables and their intended values.
|
||||
|
||||
@ -63,7 +63,7 @@ representative at an online or offline event.
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported to the community leaders responsible for enforcement at
|
||||
team@infisical.com.
|
||||
[INSERT CONTACT METHOD].
|
||||
All complaints will be reviewed and investigated promptly and fairly.
|
||||
|
||||
All community leaders are obligated to respect the privacy and security of the
|
||||
|
||||
@ -1,33 +0,0 @@
|
||||
---
|
||||
title: "PR Workflows"
|
||||
description: "Infisical PR Workflows allows you to create a set of policies to control secret operations."
|
||||
---
|
||||
|
||||
## Problem at hand
|
||||
|
||||
Updating secrets in high-stakes environments (e.g., production) can have a number of problematic issues:
|
||||
- Most developers should not have access to secrets in production environments. Yet, they are the ones who often need to add new secrets or change the existing ones. Many organizations have in-house policies with regards to what person should be contacted in the case of needing to make changes to secrets. This slows down software development lifecycle and distracts engineers from working on things that matter the most.
|
||||
- As a general rule, before making changes in production environments, those changes have to be looked over by at least another person. An extra pair of eyes can help reduce the risk of human error and make sure that the change will not affect the application in an unintended way.
|
||||
- After making updates to secrets, the corresponding applications need to be redeployed with the right set of secrets and configurations. This process is often not automated and hence prone to human error.
|
||||
|
||||
## Solution
|
||||
|
||||
As a wide-spread software engineering practice, developers have to submit their code as a PR that needs to be approved before the code is merged into the main branch.
|
||||
|
||||
In a similar way, to solve the above-mentioned issues, Infisical provides a feature called `PR Workflows` for secret management. This is a set of policies and workflows that help advance access controls, compliance procedures, and stability of a particular environment. In other words, **PR Workflows** help you secure, stabilize, and streamline the change of secrets in high-stakes environments.
|
||||
|
||||
### Setting a policy
|
||||
|
||||
First, you would need to create a set of policies for a certain environment. In the example below you can see a generic policy for a production environment. In this case, any user who submits a change to `prod` would first have to get an approval by a predefined user (or multiple users).
|
||||
|
||||
|
||||
|
||||
### Example of updating secrets with PR workflows
|
||||
|
||||
When a user submits a change to an enviropnment that is under a particular policy, a corresponsing change request will go to a predefined approver (or multiple approvers).
|
||||
|
||||
|
||||
|
||||
An approver is notified by email and/or Slack as soon as the request is initiated. In the Infisical Dashboard, they will be able to `approve` and `merge` (or `deny`) a request for a change in a particular environment. After that, depending on the workflows setup, the change will be automatically propagated to the right applications (e.g., using [Infisical Kubernetes Operator](https://infisical.com/docs/integrations/platforms/kubernetes)).
|
||||
|
||||
|
||||
@ -1,31 +0,0 @@
|
||||
---
|
||||
title: "Role-based Access Controls"
|
||||
description: "Infisical's Role-based Acccess Controls enable creating permissions for user and machine identities to restrict access to resources and the range of actions that can performed."
|
||||
---
|
||||
|
||||
### General access controls
|
||||
|
||||
Access Control Policies provide a highly granular declarative way to grant or forbid access to certain resources and operations in Infisical. In general, access controls can be split up across projects and organizations.
|
||||
|
||||
### Organization-level access controls
|
||||
|
||||
By default, every user in a organization is either an **admin** or a **member**.
|
||||
|
||||
Admins are able to perform every action with the organization, including adding and removing organization members, managing access controls, setting up security settings, and creating new projects. Members, on the other hand, are restricted from removing organization members, modifying billing information, updating access controls, and performing a number of other actions.
|
||||
|
||||
Overall, organization-level access controls are significantly of administrative nature. Access to projects, secrets and other sensitive data is specified on the project level.
|
||||
|
||||
|
||||
|
||||
### Project-level access controls
|
||||
|
||||
By default, every user in a project is either a **viewer**, **developer**, or an **admin**. Each of these roles comes with a varying access to different features and resources inside projects. As such, **admins** by default have access to all environments, folders, secrets, and actions within the project. At the same time, **developers** are restricted from performing project control actions, updating PR Workflow policies, managing roles/members, and more. Lastly, **viewer** is the most limiting default role on the project level – it forbids developers to perform any action and rather shows them in the read-only mode.
|
||||
|
||||
### Creating custom roles
|
||||
|
||||
By creating custom roles, you are able to adjust permissions to the needs of your organization. This can be useful for:
|
||||
- Creating superadmin roles, roles specific to SRE engineers, etc.
|
||||
- Restricting access of users to specific secrets, folders, and environments.
|
||||
- Embedding these specific roles into [PR Workflow policies](https://infisical.com/docs/documentation/platform/pr-workflows)
|
||||
|
||||
|
||||
Binary file not shown.
|
Before 
(image error) Size: 733 KiB |
Binary file not shown.
|
Before 
(image error) Size: 48 KiB |
Binary file not shown.
|
Before 
(image error) Size: 287 KiB |
Binary file not shown.
|
Before 
(image error) Size: 130 KiB |
Binary file not shown.
|
Before 
(image error) Size: 196 KiB |
Binary file not shown.
|
Before 
(image error) Size: 108 KiB |
Binary file not shown.
|
Before 
(image error) Size: 280 KiB |
Binary file not shown.
|
Before 
(image error) Size: 336 KiB |
@ -1,93 +0,0 @@
|
||||
---
|
||||
title: "Infisical Agent"
|
||||
---
|
||||
|
||||
Infisical Agent is a client daemon that simplifies the adoption of Infisical by providing a more scalable and user-friendly approach for applications to interact with Infisical.
|
||||
It eliminates the need to modify application logic by enabling clients to decide how they want their secrets rendered through the use of templates.
|
||||
|
||||
<img height="200" src="../images/agent/infisical-agent-diagram.png" />
|
||||
|
||||
### Key features:
|
||||
- Token renewal: Automatically authenticates with Infisical and deposits renewed access tokens at specified path for applications to consume
|
||||
- Templating: Renders secrets via user provided templates to desired formats for applications to consume
|
||||
|
||||
### Token renewal
|
||||
The Infisical agent can help manage the life cycle of access tokens. The token renewal process is split into two main components: a Method, which is the authentication process suitable for your current setup, and Sinks, which are the places where the agent deposits the new access token whenever it receives updates.
|
||||
|
||||
When the Infisical Agent is started, it will attempt to obtain a valid access token using the authentication method you have configured. If the agent is unable to fetch a valid token, the agent will keep trying, increasing the time between each attempt.
|
||||
|
||||
Once a access token is successfully fetched, the agent will make sure the access token stays valid, continuing to renew it before it expires.
|
||||
|
||||
Every time the agent successfully retrieves a new access token, it writes the new token to the Sinks you've configured.
|
||||
|
||||
<Info>
|
||||
Access tokens can be utilized with Infisical SDKs or directly in API requests to retrieve secrets from Infisical
|
||||
</Info>
|
||||
|
||||
### Templating
|
||||
The Infisical agent can help deliver formatted secrets to your application in a variety of environments. To achieve this, the agent will retrieve secrets from Infisical, format them using a specified template, and then save these formatted secrets to a designated file path.
|
||||
|
||||
Templating process is done through the use of Go language's [text/template feature](https://pkg.go.dev/text/template). Multiple template definitions can be set in the agent configuration file to generate a variety of formatted secret files.
|
||||
|
||||
When the agent is started and templates are defined in the agent configuration file, the agent will attempt to acquire a valid access token using the set authentication method outlined in the agent's configuration.
|
||||
If this initial attempt is unsuccessful, the agent will momentarily pauses before continuing to make more attempts.
|
||||
|
||||
Once the agent successfully obtains a valid access token, the agent proceeds to fetch the secrets from Infisical using it.
|
||||
It then formats these secrets using the user provided templates and writes the formatted data to configured file paths.
|
||||
|
||||
## Agent configuration file
|
||||
|
||||
To set up the authentication method for token renewal and to define secret templates, the Infisical agent requires a YAML configuration file containing properties defined below.
|
||||
While specifying an authentication method is mandatory to start the agent, configuring sinks and secret templates are optional.
|
||||
|
||||
| Field | Description |
|
||||
| ---------------------------- | ----------- |
|
||||
| `infisical.address` | The URL of the Infisical service. Default: `"https://app.infisical.com"`. |
|
||||
| `auth.type` | The type of authentication method used. Only `"token"` type is currently available |
|
||||
| `auth.config.token-path` | The file path where the initial token for authentication is stored. |
|
||||
| `sinks[].type` | The type of sink in a list of sinks. Each item specifies a sink type. Currently, only `"file"` type is available. |
|
||||
| `sinks[].config.path` | The file path where the access token should be stored for each sink in the list. |
|
||||
| `templates[].source-path` | The path to the template file that should be used to render secrets. |
|
||||
| `templates[].destination-path` | The path where the rendered secrets from the source template will be saved to. |
|
||||
|
||||
|
||||
## Quick start Infisical Agent
|
||||
To install the Infisical agent, you must first install the [Infisical CLI](../cli/overview) in the desired environment where you'd like the agent to run. This is because the Infisical agent is a sub-command of the Infisical CLI.
|
||||
|
||||
Once you have the CLI installed, you will need to create a agent configuration file in yaml.
|
||||
|
||||
```yaml example-agent-config-file.yaml
|
||||
infisical:
|
||||
address: "https://app.infisical.com"
|
||||
auth:
|
||||
type: "token"
|
||||
config:
|
||||
token-path: "/path/to/initial/token"
|
||||
sinks:
|
||||
- type: "file"
|
||||
config:
|
||||
path: "/some/path/to/store/access-token/file-name"
|
||||
templates:
|
||||
- source-path: my-dot-ev-secret-template
|
||||
destination-path: /some/path/.env
|
||||
```
|
||||
|
||||
Above is an example agent configuration file that defines the token authentication method, one sink location (where to deposit access tokens after renewal) and a secret template.
|
||||
|
||||
|
||||
```text my-dot-ev-secret-template
|
||||
{{- with secret "6553ccb2b7da580d7f6e7260" "dev" "/" }}
|
||||
{{- range . }}
|
||||
{{ .Key }}={{ .Value }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
```
|
||||
|
||||
The secret template above will be used to render the secrets where the key and the value are separated by `=` sign. You'll notice that a custom function named `secret` is used to fetch the secrets.
|
||||
This function takes the following arguments: `secret "<project-id>" "<environment-slug>" "<secret-path>"`.
|
||||
|
||||
```bash
|
||||
infisical agent --config example-agent-config-file.yaml
|
||||
```
|
||||
|
||||
After defining the agent configuration file, run the command above pointing to the path where the agent configuration is located.
|
||||
@ -1,43 +0,0 @@
|
||||
---
|
||||
title: "Cloudflare Workers"
|
||||
description: "How to sync secrets from Infisical to Cloudflare Workers"
|
||||
---
|
||||
|
||||
Prerequisites:
|
||||
|
||||
- Set up and add envars to [Infisical Cloud](https://app.infisical.com)
|
||||
|
||||
## Navigate to your project's integrations tab
|
||||
|
||||
|
||||
|
||||
## Authorize Infisical for Cloudflare Workers
|
||||
|
||||
Obtain a Cloudflare [API token](https://dash.cloudflare.com/profile/api-tokens) and [Account ID](https://developers.cloudflare.com/fundamentals/get-started/basic-tasks/find-account-and-zone-ids/):
|
||||
|
||||
1. Create a new [API token](https://dash.cloudflare.com/profile/api-tokens) in My Profile > API Tokens
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
2. Copy your [Account ID](https://developers.cloudflare.com/fundamentals/get-started/basic-tasks/find-account-and-zone-ids/) from Account > Workers & Pages > Overview
|
||||
|
||||
|
||||
|
||||
Press on the Cloudflare Workers tile and input your Cloudflare API token and account ID to grant Infisical access to your Cloudflare Workers.
|
||||
|
||||
|
||||
|
||||
<Info>
|
||||
If this is your project's first cloud integration, then you'll have to grant
|
||||
Infisical access to your project's environment variables. Although this step
|
||||
breaks E2EE, it's necessary for Infisical to sync the environment variables to
|
||||
the cloud platform.
|
||||
</Info>
|
||||
|
||||
## Start integration
|
||||
|
||||
Select which Infisical environment secrets you want to sync to Cloudflare Workers and press create integration to start syncing secrets.
|
||||
|
||||
|
||||
@ -26,7 +26,6 @@ Missing an integration? [Throw in a request](https://github.com/Infisical/infisi
|
||||
| [Supabase](/integrations/cloud/supabase) | Cloud | Available |
|
||||
| [Northflank](/integrations/cloud/northflank) | Cloud | Available |
|
||||
| [Cloudflare Pages](/integrations/cloud/cloudflare-pages) | Cloud | Available |
|
||||
| [Cloudflare Workers](/integrations/cloud/cloudflare-workers) | Cloud | Available |
|
||||
| [Checkly](/integrations/cloud/checkly) | Cloud | Available |
|
||||
| [Qovery](/integrations/cloud/qovery) | Cloud | Available |
|
||||
| [HashiCorp Vault](/integrations/cloud/hashicorp-vault) | Cloud | Available |
|
||||
|
||||
@ -135,7 +135,7 @@ Lastly, Infisical enforces strong password requirements according to the guidanc
|
||||
|
||||
## Role-based access control (RBAC)
|
||||
|
||||
[Infisical's RBAC](https://infisical.com/docs/documentation/platform/role-based-access-controls) feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members.
|
||||
Infisical's RBAC feature enables organization owners and administrators to manage fine-grained access policies for members of their organization in Infisical; with RBAC, administrators can define custom roles with permission sets to be conveniently assigned to other members.
|
||||
|
||||
For example, you can define a role provisioning access to secrets in a specific project and environment in it with read-only permissions; the role can be assigned to members of an organization in Infisical.
|
||||
|
||||
|
||||
@ -119,8 +119,6 @@
|
||||
"documentation/platform/audit-logs",
|
||||
"documentation/platform/token",
|
||||
"documentation/platform/mfa",
|
||||
"documentation/platform/pr-workflows",
|
||||
"documentation/platform/role-based-access-controls",
|
||||
{
|
||||
"group": "Secret Rotation",
|
||||
"pages": [
|
||||
@ -197,12 +195,6 @@
|
||||
"cli/faq"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Agent",
|
||||
"pages": [
|
||||
"infisical-agent/overview"
|
||||
]
|
||||
},
|
||||
{
|
||||
"group": "Integrations",
|
||||
"pages": ["integrations/overview"]
|
||||
@ -250,7 +242,6 @@
|
||||
"integrations/cloud/hasura-cloud",
|
||||
"integrations/cloud/terraform-cloud",
|
||||
"integrations/cloud/cloudflare-pages",
|
||||
"integrations/cloud/cloudflare-workers",
|
||||
"integrations/cloud/qovery",
|
||||
"integrations/cloud/hashicorp-vault",
|
||||
"integrations/cloud/azure-key-vault",
|
||||
@ -389,10 +380,6 @@
|
||||
{
|
||||
"group": "Service Tokens",
|
||||
"pages": ["api-reference/endpoints/service-tokens/get"]
|
||||
},
|
||||
{
|
||||
"group": "Audit Logs",
|
||||
"pages": ["api-reference/endpoints/audit-logs/export-audit-log"]
|
||||
}
|
||||
]
|
||||
},
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user