Skip to content

Commit 832394f

Browse files
PrestigePvPPrestigePvP
committed
fix: build and comments
1 parent c369c55 commit 832394f

File tree

15 files changed

+55
-71
lines changed

15 files changed

+55
-71
lines changed

‎backend/src/@types/fastify.d.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,13 +92,13 @@ import { TIdentityAwsAuthServiceFactory } from "@app/services/identity-aws-auth/
9292
import { TIdentityAzureAuthServiceFactory } from "@app/services/identity-azure-auth/identity-azure-auth-service";
9393
import { TIdentityGcpAuthServiceFactory } from "@app/services/identity-gcp-auth/identity-gcp-auth-service";
9494
import { TIdentityJwtAuthServiceFactory } from "@app/services/identity-jwt-auth/identity-jwt-auth-service";
95-
import { TIdentitySpiffeAuthServiceFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-service";
9695
import { TIdentityKubernetesAuthServiceFactory } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-service";
9796
import { TIdentityLdapAuthServiceFactory } from "@app/services/identity-ldap-auth/identity-ldap-auth-service";
9897
import { TAllowedFields } from "@app/services/identity-ldap-auth/identity-ldap-auth-types";
9998
import { TIdentityOciAuthServiceFactory } from "@app/services/identity-oci-auth/identity-oci-auth-service";
10099
import { TIdentityOidcAuthServiceFactory } from "@app/services/identity-oidc-auth/identity-oidc-auth-service";
101100
import { TIdentityProjectServiceFactory } from "@app/services/identity-project/identity-project-service";
101+
import { TIdentitySpiffeAuthServiceFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-service";
102102
import { TIdentityTlsCertAuthServiceFactory } from "@app/services/identity-tls-cert-auth/identity-tls-cert-auth-types";
103103
import { TIdentityTokenAuthServiceFactory } from "@app/services/identity-token-auth/identity-token-auth-service";
104104
import { TIdentityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";

‎backend/src/db/schemas/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@ export * from "./identity-azure-auths";
6464
export * from "./identity-gcp-auths";
6565
export * from "./identity-group-membership";
6666
export * from "./identity-jwt-auths";
67-
export * from "./identity-spiffe-auths";
6867
export * from "./identity-kubernetes-auths";
6968
export * from "./identity-metadata";
7069
export * from "./identity-oci-auths";
@@ -73,6 +72,7 @@ export * from "./identity-org-memberships";
7372
export * from "./identity-project-additional-privilege";
7473
export * from "./identity-project-membership-role";
7574
export * from "./identity-project-memberships";
75+
export * from "./identity-spiffe-auths";
7676
export * from "./identity-tls-cert-auths";
7777
export * from "./identity-token-auths";
7878
export * from "./identity-ua-client-secrets";

‎backend/src/server/routes/index.ts‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -277,8 +277,6 @@ import { identityGcpAuthDALFactory } from "@app/services/identity-gcp-auth/ident
277277
import { identityGcpAuthServiceFactory } from "@app/services/identity-gcp-auth/identity-gcp-auth-service";
278278
import { identityJwtAuthDALFactory } from "@app/services/identity-jwt-auth/identity-jwt-auth-dal";
279279
import { identityJwtAuthServiceFactory } from "@app/services/identity-jwt-auth/identity-jwt-auth-service";
280-
import { identitySpiffeAuthDALFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-dal";
281-
import { identitySpiffeAuthServiceFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-service";
282280
import { identityKubernetesAuthDALFactory } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-dal";
283281
import { identityKubernetesAuthServiceFactory } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-service";
284282
import { identityLdapAuthDALFactory } from "@app/services/identity-ldap-auth/identity-ldap-auth-dal";
@@ -289,6 +287,8 @@ import { identityOidcAuthDALFactory } from "@app/services/identity-oidc-auth/ide
289287
import { identityOidcAuthServiceFactory } from "@app/services/identity-oidc-auth/identity-oidc-auth-service";
290288
import { identityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
291289
import { identityProjectServiceFactory } from "@app/services/identity-project/identity-project-service";
290+
import { identitySpiffeAuthDALFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-dal";
291+
import { identitySpiffeAuthServiceFactory } from "@app/services/identity-spiffe-auth/identity-spiffe-auth-service";
292292
import { identityTlsCertAuthDALFactory } from "@app/services/identity-tls-cert-auth/identity-tls-cert-auth-dal";
293293
import { identityTlsCertAuthServiceFactory } from "@app/services/identity-tls-cert-auth/identity-tls-cert-auth-service";
294294
import { identityTokenAuthDALFactory } from "@app/services/identity-token-auth/identity-token-auth-dal";
@@ -1964,7 +1964,6 @@ export const registerRoutes = async (
19641964
membershipIdentityDAL
19651965
});
19661966

1967-
19681967
const identityLdapAuthService = identityLdapAuthServiceFactory({
19691968
identityLdapAuthDAL,
19701969
orgDAL,

‎backend/src/server/routes/v1/identity-spiffe-auth-router.ts‎

Lines changed: 5 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -63,26 +63,14 @@ const CommonUpdateFields = z
6363
.array()
6464
.min(1)
6565
.describe(SPIFFE_AUTH.UPDATE.accessTokenTrustedIps),
66-
accessTokenTTL: z
67-
.number()
68-
.int()
69-
.min(0)
70-
.max(315360000)
71-
.describe(SPIFFE_AUTH.UPDATE.accessTokenTTL),
72-
accessTokenMaxTTL: z
73-
.number()
74-
.int()
75-
.min(0)
76-
.max(315360000)
77-
.describe(SPIFFE_AUTH.UPDATE.accessTokenMaxTTL),
66+
accessTokenTTL: z.number().int().min(0).max(315360000).describe(SPIFFE_AUTH.UPDATE.accessTokenTTL),
67+
accessTokenMaxTTL: z.number().int().min(0).max(315360000).describe(SPIFFE_AUTH.UPDATE.accessTokenMaxTTL),
7868
accessTokenNumUsesLimit: z.number().int().min(0).describe(SPIFFE_AUTH.UPDATE.accessTokenNumUsesLimit)
7969
})
8070
.partial();
8171

8272
const StaticConfigurationSchema = z.object({
83-
configurationType: z
84-
.literal(SpiffeConfigurationType.STATIC)
85-
.describe(SPIFFE_AUTH.ATTACH.configurationType),
73+
configurationType: z.literal(SpiffeConfigurationType.STATIC).describe(SPIFFE_AUTH.ATTACH.configurationType),
8674
caBundleJwks: z.string().min(1).describe(SPIFFE_AUTH.ATTACH.caBundleJwks),
8775
bundleEndpointUrl: z.string().optional().default(""),
8876
bundleEndpointProfile: z.nativeEnum(SpiffeBundleEndpointProfile).optional(),
@@ -91,9 +79,7 @@ const StaticConfigurationSchema = z.object({
9179
});
9280

9381
const RemoteConfigurationSchema = z.object({
94-
configurationType: z
95-
.literal(SpiffeConfigurationType.REMOTE)
96-
.describe(SPIFFE_AUTH.ATTACH.configurationType),
82+
configurationType: z.literal(SpiffeConfigurationType.REMOTE).describe(SPIFFE_AUTH.ATTACH.configurationType),
9783
caBundleJwks: z.string().optional().default(""),
9884
bundleEndpointUrl: z
9985
.string()
@@ -106,12 +92,7 @@ const RemoteConfigurationSchema = z.object({
10692
.default(SpiffeBundleEndpointProfile.HTTPS_WEB)
10793
.describe(SPIFFE_AUTH.ATTACH.bundleEndpointProfile),
10894
bundleEndpointCaCert: z.string().optional().default("").describe(SPIFFE_AUTH.ATTACH.bundleEndpointCaCert),
109-
bundleRefreshHintSeconds: z
110-
.number()
111-
.int()
112-
.min(0)
113-
.default(3600)
114-
.describe(SPIFFE_AUTH.ATTACH.bundleRefreshHintSeconds)
95+
bundleRefreshHintSeconds: z.number().int().min(0).default(3600).describe(SPIFFE_AUTH.ATTACH.bundleRefreshHintSeconds)
11596
});
11697

11798
export const registerIdentitySpiffeAuthRouter = async (server: FastifyZodProvider) => {

‎backend/src/server/routes/v1/index.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,14 @@ import { registerIdentityAwsAuthRouter } from "./identity-aws-iam-auth-router";
3838
import { registerIdentityAzureAuthRouter } from "./identity-azure-auth-router";
3939
import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router";
4040
import { registerIdentityJwtAuthRouter } from "./identity-jwt-auth-router";
41-
import { registerIdentitySpiffeAuthRouter } from "./identity-spiffe-auth-router";
4241
import { registerIdentityKubernetesRouter } from "./identity-kubernetes-auth-router";
4342
import { registerIdentityLdapAuthRouter } from "./identity-ldap-auth-router";
4443
import { registerIdentityOciAuthRouter } from "./identity-oci-auth-router";
4544
import { registerIdentityOidcAuthRouter } from "./identity-oidc-auth-router";
4645
import { registerIdentityOrgMembershipRouter } from "./identity-org-membership-router";
4746
import { registerIdentityProjectMembershipRouter } from "./identity-project-membership-router";
4847
import { registerIdentityRouter } from "./identity-router";
48+
import { registerIdentitySpiffeAuthRouter } from "./identity-spiffe-auth-router";
4949
import { registerIdentityTlsCertAuthRouter } from "./identity-tls-cert-auth-router";
5050
import { registerIdentityTokenAuthRouter } from "./identity-token-auth-router";
5151
import { registerIdentityUaRouter } from "./identity-universal-auth-router";

‎backend/src/services/identity-spiffe-auth/identity-spiffe-auth-fns.ts‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
import https from "https";
2-
32
import picomatch from "picomatch";
3+
import RE2 from "re2";
44

5-
const SPIFFE_ID_REGEX = /^spiffe:\/\/([^/]+)(\/.*)?$/;
5+
const SPIFFE_ID_REGEX = new RE2("^spiffe:\\/\\/([^/]+)(\\/.*)?");
66

77
export const isValidSpiffeId = (value: string): boolean => {
88
return SPIFFE_ID_REGEX.test(value);
99
};
1010

1111
export const extractTrustDomainFromSpiffeId = (spiffeId: string): string => {
12-
const match = spiffeId.match(SPIFFE_ID_REGEX);
12+
const match = SPIFFE_ID_REGEX.exec(spiffeId);
1313
if (!match) {
1414
throw new Error(`Invalid SPIFFE ID: ${spiffeId}`);
1515
}
@@ -26,7 +26,9 @@ export const doesSpiffeIdMatchPattern = (spiffeId: string, patterns: string): bo
2626
};
2727

2828
export const findSigningKeyInJwks = (jwksJson: string, kid: string) => {
29-
const jwks = JSON.parse(jwksJson) as { keys: Array<{ kid?: string; use?: string; kty: string; [key: string]: unknown }> };
29+
const jwks = JSON.parse(jwksJson) as {
30+
keys: Array<{ kid?: string; use?: string; kty: string; [key: string]: unknown }>;
31+
};
3032

3133
if (!jwks.keys || !Array.isArray(jwks.keys)) {
3234
throw new Error("Invalid JWKS: missing keys array");

‎backend/src/services/identity-spiffe-auth/identity-spiffe-auth-service.ts‎

Lines changed: 20 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,8 @@ import {
2828
} from "@app/lib/errors";
2929
import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
3030
import { logger } from "@app/lib/logger";
31-
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
3231
import { AuthAttemptAuthMethod, AuthAttemptAuthResult, authAttemptCounter } from "@app/lib/telemetry/metrics";
32+
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
3333

3434
import { ActorType, AuthTokenType } from "../auth/auth-type";
3535
import { TIdentityDALFactory } from "../identity/identity-dal";
@@ -104,7 +104,9 @@ const validateSpiffeClaims = (
104104
): boolean => {
105105
if (!tokenData.aud) return false;
106106

107-
const tokenAudiences: string[] = Array.isArray(tokenData.aud) ? tokenData.aud : [tokenData.aud as string];
107+
const tokenAudiences: string[] = Array.isArray(tokenData.aud)
108+
? (tokenData.aud as string[])
109+
: [tokenData.aud as string];
108110
const allowedAudiences = config.allowedAudiences
109111
.split(", ")
110112
.map((a) => a.trim())
@@ -141,13 +143,13 @@ export const identitySpiffeAuthServiceFactory = ({
141143
config: {
142144
id: string;
143145
configurationType: string;
144-
encryptedCaBundleJwks: Buffer | null;
145-
encryptedCachedBundleJwks: Buffer | null;
146-
bundleEndpointUrl: string | null;
147-
bundleEndpointProfile: string | null;
148-
encryptedBundleEndpointCaCert: Buffer | null;
149-
bundleRefreshHintSeconds: number | null;
150-
cachedBundleLastRefreshedAt: Date | string | null;
146+
encryptedCaBundleJwks?: Buffer | null;
147+
encryptedCachedBundleJwks?: Buffer | null;
148+
bundleEndpointUrl?: string | null;
149+
bundleEndpointProfile?: string | null;
150+
encryptedBundleEndpointCaCert?: Buffer | null;
151+
bundleRefreshHintSeconds?: number | null;
152+
cachedBundleLastRefreshedAt?: Date | string | null;
151153
};
152154
orgId: string;
153155
forceRefresh?: boolean;
@@ -162,7 +164,7 @@ export const identitySpiffeAuthServiceFactory = ({
162164
if (!config.encryptedCaBundleJwks) {
163165
throw new BadRequestError({ message: "Static SPIFFE auth has no CA bundle JWKS configured" });
164166
}
165-
167+
166168
return {
167169
jwksJson: orgDataKeyDecryptor({ cipherTextBlob: config.encryptedCaBundleJwks }).toString(),
168170
fromCache: false
@@ -320,7 +322,7 @@ export const identitySpiffeAuthServiceFactory = ({
320322
return newToken;
321323
});
322324

323-
let expireyOptions: { expiresIn: number } | undefined = undefined;
325+
let expireyOptions: { expiresIn: number } | undefined;
324326
const accessTokenTTL = Number(identityAccessToken.accessTokenTTL);
325327
if (accessTokenTTL > 0) {
326328
expireyOptions = { expiresIn: accessTokenTTL };
@@ -810,7 +812,13 @@ export const identitySpiffeAuthServiceFactory = ({
810812
return revokedIdentitySpiffeAuth;
811813
};
812814

813-
const refreshSpiffeBundle = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetSpiffeAuthDTO) => {
815+
const refreshSpiffeBundle = async ({
816+
identityId,
817+
actorId,
818+
actor,
819+
actorAuthMethod,
820+
actorOrgId
821+
}: TGetSpiffeAuthDTO) => {
814822
const identityMembershipOrg = await membershipIdentityDAL.getIdentityById({
815823
scopeData: {
816824
scope: AccessScope.Organization,

‎backend/src/services/identity-spiffe-auth/identity-spiffe-auth-validators.ts‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
import RE2 from "re2";
12
import { z } from "zod";
23

34
export const validateSpiffeAllowedAudiencesField = z
@@ -24,8 +25,10 @@ export const validateSpiffeAllowedIdsField = z
2425
.join(", ");
2526
});
2627

28+
const TRUST_DOMAIN_REGEX = new RE2("^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$");
29+
2730
export const validateTrustDomain = z
2831
.string()
2932
.trim()
3033
.min(1, "Trust domain is required")
31-
.regex(/^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$/, "Invalid trust domain format");
34+
.refine((val) => TRUST_DOMAIN_REGEX.test(val), "Invalid trust domain format");

‎backend/src/services/identity/identity-org-dal.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ import {
1212
TIdentityKubernetesAuths,
1313
TIdentityOciAuths,
1414
TIdentityOidcAuths,
15+
TIdentitySpiffeAuths,
1516
TIdentityTlsCertAuths,
1617
TIdentityTokenAuths,
1718
TIdentityUniversalAuths,
@@ -257,7 +258,7 @@ export const identityOrgDALFactory = (db: TDbClient) => {
257258
"paginatedIdentity.actorIdentityId",
258259
`${TableName.IdentityTlsCertAuth}.identityId`
259260
)
260-
.leftJoin(
261+
.leftJoin<TIdentitySpiffeAuths>(
261262
TableName.IdentitySpiffeAuth,
262263
"paginatedIdentity.actorIdentityId",
263264
`${TableName.IdentitySpiffeAuth}.identityId`

‎frontend/src/hooks/api/identities/mutations.tsx‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,10 @@ import {
1212
AddIdentityGcpAuthDTO,
1313
AddIdentityJwtAuthDTO,
1414
AddIdentityKubernetesAuthDTO,
15-
AddIdentitySpiffeAuthDTO,
1615
AddIdentityLdapAuthDTO,
1716
AddIdentityOciAuthDTO,
1817
AddIdentityOidcAuthDTO,
18+
AddIdentitySpiffeAuthDTO,
1919
AddIdentityTlsCertAuthDTO,
2020
AddIdentityTokenAuthDTO,
2121
AddIdentityUniversalAuthDTO,
@@ -32,10 +32,10 @@ import {
3232
DeleteIdentityGcpAuthDTO,
3333
DeleteIdentityJwtAuthDTO,
3434
DeleteIdentityKubernetesAuthDTO,
35-
DeleteIdentitySpiffeAuthDTO,
3635
DeleteIdentityLdapAuthDTO,
3736
DeleteIdentityOciAuthDTO,
3837
DeleteIdentityOidcAuthDTO,
38+
DeleteIdentitySpiffeAuthDTO,
3939
DeleteIdentityTlsCertAuthDTO,
4040
DeleteIdentityTokenAuthDTO,
4141
DeleteIdentityUniversalAuthClientSecretDTO,
@@ -47,10 +47,10 @@ import {
4747
IdentityGcpAuth,
4848
IdentityJwtAuth,
4949
IdentityKubernetesAuth,
50-
IdentitySpiffeAuth,
5150
IdentityLdapAuth,
5251
IdentityOciAuth,
5352
IdentityOidcAuth,
53+
IdentitySpiffeAuth,
5454
IdentityTlsCertAuth,
5555
IdentityTokenAuth,
5656
IdentityUniversalAuth,
@@ -62,10 +62,10 @@ import {
6262
UpdateIdentityGcpAuthDTO,
6363
UpdateIdentityJwtAuthDTO,
6464
UpdateIdentityKubernetesAuthDTO,
65-
UpdateIdentitySpiffeAuthDTO,
6665
UpdateIdentityLdapAuthDTO,
6766
UpdateIdentityOciAuthDTO,
6867
UpdateIdentityOidcAuthDTO,
68+
UpdateIdentitySpiffeAuthDTO,
6969
UpdateIdentityTlsCertAuthDTO,
7070
UpdateIdentityTokenAuthDTO,
7171
UpdateIdentityUniversalAuthDTO,

0 commit comments

Comments
 (0)