github/infisical
1
0
Fork 0
mirror of https://github.com/Infisical/infisical.git synced 2026-01-10 07:58:15 -05:00
Code Issues Packages Projects Releases Wiki Activity

refactor: update TTL validation to allow a maximum of 10 years and adjust environment variable defaults for AWS credentials

Browse Source
This commit is contained in:
Victor Santos
2025-10-27 14:51:16 -03:00
parent 7a31ea6eda
commit 5e9ff00630
3 changed files with 11 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/ee/routes/v1/dynamic-secret-router.ts
View File

@@ -72,8 +72,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
const valMs = ms(val);
if (valMs < 60 * 1000)
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
if (valMs > daysToMillisecond(1))
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
if (valMs > ms("10y"))
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
})
.nullable(),
path: z.string().describe(DYNAMIC_SECRETS.CREATE.path).trim().default("/").transform(removeTrailingSlash),

14
backend/src/lib/config/env.ts
View File

@@ -266,12 +266,8 @@ const envSchema = z
RELAY_AUTH_SECRET: zpStr(z.string().optional()),
DYNAMIC_SECRET_ALLOW_INTERNAL_IP: zodStrBool.default("false"),
DYNAMIC_SECRET_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()).default(
process.env.INF_APP_CONNECTION_AWS_ACCESS_KEY_ID
),
DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()).default(
process.env.INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
),
DYNAMIC_SECRET_AWS_ACCESS_KEY_ID: zpStr(z.string().optional()),
DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY: zpStr(z.string().optional()),
/* ----------------------------------------------------------------------------- */
/* App Connections ----------------------------------------------------------------------------- */
@@ -439,7 +435,11 @@ const envSchema = z
data.INF_APP_CONNECTION_AZURE_APP_CONFIGURATION_CLIENT_SECRET || data.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID: data.INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_ID || data.CLIENT_ID_HEROKU,
INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET:
data.INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET || data.CLIENT_SECRET_HEROKU
data.INF_APP_CONNECTION_HEROKU_OAUTH_CLIENT_SECRET || data.CLIENT_SECRET_HEROKU,
DYNAMIC_SECRET_AWS_ACCESS_KEY_ID:
data.DYNAMIC_SECRET_AWS_ACCESS_KEY_ID || data.INF_APP_CONNECTION_AWS_ACCESS_KEY_ID,
DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY:
data.DYNAMIC_SECRET_AWS_SECRET_ACCESS_KEY || data.INF_APP_CONNECTION_AWS_SECRET_ACCESS_KEY
}));
export type TEnvConfig = Readonly<z.infer<typeof envSchema>>;

5
frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AwsIamInputForm.tsx
View File

@@ -107,9 +107,8 @@ const formSchema = z.object({
const valMs = ms(val);
if (valMs < 60 * 1000)
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be a greater than 1min" });
// a day
if (valMs > 24 * 60 * 60 * 1000)
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than a day" });
if (valMs > ms("10y"))
ctx.addIssue({ code: z.ZodIssueCode.custom, message: "TTL must be less than 10 years" });
}),
name: z.string().refine((val) => val.toLowerCase() === val, "Must be lowercase"),
environment: z.object({ name: z.string(), slug: z.string() }),