From 67119794455f7baa59ce7792ef24904aab1c9105 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Tue, 31 Jan 2023 09:24:55 -0800 Subject: [PATCH] Disallow service token creation based on permission --- .../controllers/v2/serviceTokenDataController.ts | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/backend/src/controllers/v2/serviceTokenDataController.ts b/backend/src/controllers/v2/serviceTokenDataController.ts index 83c8fea940..780bae9a49 100644 --- a/backend/src/controllers/v2/serviceTokenDataController.ts +++ b/backend/src/controllers/v2/serviceTokenDataController.ts @@ -8,6 +8,8 @@ import { import { SALT_ROUNDS } from '../../config'; +import { userHasWorkspaceAccess } from '../../ee/helpers/checkMembershipPermissions'; +import { ABILITY_READ } from '../../variables/organization'; /** * Return service token data associated with service token on request @@ -37,6 +39,11 @@ export const createServiceTokenData = async (req: Request, res: Response) => { expiresIn } = req.body; + const hasAccess = await userHasWorkspaceAccess(req.user, workspaceId, environment, ABILITY_READ) + if (!hasAccess) { + throw UnauthorizedRequestError({ message: "You do not have the necessary permission(s) perform this action" }) + } + const secret = crypto.randomBytes(16).toString('hex'); const secretHash = await bcrypt.hash(secret, SALT_ROUNDS); @@ -100,4 +107,8 @@ export const deleteServiceTokenData = async (req: Request, res: Response) => { return res.status(200).send({ serviceTokenData }); -} \ No newline at end of file +} + +function UnauthorizedRequestError(arg0: { message: string; }) { + throw new Error('Function not implemented.'); +}