Skip to content

fix: keys setting vulns #2718

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chronark merged 3 commits into from
Dec 6, 2024
Merged

fix: keys setting vulns #2718

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
78f9c47
fix: keys setting vulns
ogzhanolguncu Dec 6, 2024
0c51ab1
fix: check workspace ownership
chronark Dec 6, 2024
b1ed43c
fix: check workspace ownership
chronark Dec 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions apps/dashboard/app/(app)/apis/[apiId]/settings/default-bytes.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ import { useForm } from "react-hook-form";
import { z } from "zod";
const formSchema = z.object({
keyAuthId: z.string(),
workspaceId: z.string(),
defaultBytes: z
.number()
.min(8, "Byte size needs to be at least 8")
Expand All @@ -30,7 +29,6 @@ const formSchema = z.object({
type Props = {
keyAuth: {
id: string;
workspaceId: string;
defaultBytes: number | undefined | null;
};
};
Expand All @@ -42,7 +40,6 @@ export const DefaultBytes: React.FC<Props> = ({ keyAuth }) => {
defaultValues: {
defaultBytes: keyAuth.defaultBytes ?? undefined,
keyAuthId: keyAuth.id,
workspaceId: keyAuth.workspaceId,
},
});

Expand Down Expand Up @@ -78,7 +75,6 @@ export const DefaultBytes: React.FC<Props> = ({ keyAuth }) => {
</CardHeader>
<CardContent>
<div className="flex flex-col space-y-2">
<input type="hidden" name="workspaceId" value={keyAuth.workspaceId} />
<input type="hidden" name="keyAuthId" value={keyAuth.id} />
<label className="hidden sr-only">Default Bytes</label>
<FormField
Expand Down
5 changes: 1 addition & 4 deletions apps/dashboard/app/(app)/apis/[apiId]/settings/default-prefix.tsx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,16 +17,15 @@ import { zodResolver } from "@hookform/resolvers/zod";
import { useRouter } from "next/navigation";
import { useForm } from "react-hook-form";
import { z } from "zod";

const formSchema = z.object({
keyAuthId: z.string(),
workspaceId: z.string(),
defaultPrefix: z.string(),
});

type Props = {
keyAuth: {
id: string;
workspaceId: string;
defaultPrefix: string | undefined | null;
};
};
Expand All @@ -38,7 +37,6 @@ export const DefaultPrefix: React.FC<Props> = ({ keyAuth }) => {
defaultValues: {
defaultPrefix: keyAuth.defaultPrefix ?? undefined,
keyAuthId: keyAuth.id,
workspaceId: keyAuth.workspaceId,
},
});

Expand Down Expand Up @@ -71,7 +69,6 @@ export const DefaultPrefix: React.FC<Props> = ({ keyAuth }) => {
</CardHeader>
<CardContent>
<div className="flex flex-col space-y-2">
<input type="hidden" name="workspaceId" value={keyAuth.workspaceId} />
<input type="hidden" name="keyAuthId" value={keyAuth.id} />
<label className="hidden sr-only">Default Prefix</label>
<FormField
Expand Down
19 changes: 11 additions & 8 deletions apps/dashboard/lib/trpc/routers/api/setDefaultBytes.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,26 +15,29 @@ export const setDefaultApiBytes = t.procedure
.max(255, "Byte size cannot exceed 255")
.optional(),
keyAuthId: z.string(),
workspaceId: z.string(),
}),
)
.mutation(async ({ ctx, input }) => {
const keyAuth = await db.query.keyAuth
.findFirst({
where: (table, { eq }) => eq(table.id, input.keyAuthId),
where: (table, { eq, and, isNull }) =>
and(eq(table.id, input.keyAuthId), isNull(table.deletedAt)),
with: {
workspace: true,
},
})
.catch((_err) => {
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
message:
"We were unable to find the KeyAuth. Please try again or contact support@unkey.dev.",
"We were unable to update the key auth. Please try again or contact support@unkey.dev",
});
});
if (!keyAuth || keyAuth.workspaceId !== input.workspaceId) {
if (!keyAuth || keyAuth.workspace.tenantId !== ctx.tenant.id) {
throw new TRPCError({
code: "NOT_FOUND",
message:
"We are unable to find the correct keyAuth. Please try again or contact support@unkey.dev",
"We are unable to find the correct key auth. Please try again or contact support@unkey.dev.",
});
}
await db
Expand All @@ -44,7 +47,7 @@ export const setDefaultApiBytes = t.procedure
.set({
defaultBytes: input.defaultBytes,
})
.where(eq(schema.keyAuth.id, input.keyAuthId))
.where(eq(schema.keyAuth.id, keyAuth.id))
.catch((_err) => {
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
Expand All @@ -53,13 +56,13 @@ export const setDefaultApiBytes = t.procedure
});
});
await insertAuditLogs(tx, {
workspaceId: keyAuth.workspaceId,
workspaceId: keyAuth.workspace.id,
actor: {
type: "user",
id: ctx.user.id,
},
event: "api.update",
description: `Changed ${keyAuth.workspaceId} default byte size for keys from ${keyAuth.defaultBytes} to ${input.defaultBytes}`,
description: `Changed ${keyAuth.id} default byte size for keys from ${keyAuth.defaultBytes} to ${input.defaultBytes}`,
resources: [
{
type: "keyAuth",
Expand Down
21 changes: 13 additions & 8 deletions apps/dashboard/lib/trpc/routers/api/setDefaultPrefix.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,35 +11,40 @@ export const setDefaultApiPrefix = t.procedure
z.object({
defaultPrefix: z.string().max(8, "Prefix can be a maximum of 8 characters"),
keyAuthId: z.string(),
workspaceId: z.string(),
}),
)
.mutation(async ({ ctx, input }) => {
const keyAuth = await db.query.keyAuth
.findFirst({
where: (table, { eq }) => eq(table.id, input.keyAuthId),
where: (table, { eq, and, isNull }) =>
and(eq(table.id, input.keyAuthId), isNull(table.deletedAt)),
with: {
workspace: true,
},
})
.catch((_err) => {
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
message: "We were unable to find KeyAuth. Please try again or contact support@unkey.dev.",
message:
"We were unable to update the key auth. Please try again or contact support@unkey.dev",
});
});
if (!keyAuth || keyAuth.workspaceId !== input.workspaceId) {
if (!keyAuth || keyAuth.workspace.tenantId !== ctx.tenant.id) {
throw new TRPCError({
code: "NOT_FOUND",
message:
"We are unable to find the correct keyAuth. Please try again or contact support@unkey.dev",
"We are unable to find the correct key auth. Please try again or contact support@unkey.dev.",
});
}

await db
.transaction(async (tx) => {
await tx
.update(schema.keyAuth)
.set({
defaultPrefix: input.defaultPrefix,
})
.where(eq(schema.keyAuth.id, input.keyAuthId))
.where(eq(schema.keyAuth.id, keyAuth.id))
.catch((_err) => {
throw new TRPCError({
code: "INTERNAL_SERVER_ERROR",
Expand All @@ -48,13 +53,13 @@ export const setDefaultApiPrefix = t.procedure
});
});
await insertAuditLogs(tx, {
workspaceId: keyAuth.workspaceId,
workspaceId: keyAuth.workspace.id,
actor: {
type: "user",
id: ctx.user.id,
},
event: "api.update",
description: `Changed ${keyAuth.workspaceId} default prefix from ${keyAuth.defaultPrefix} to ${input.defaultPrefix}`,
description: `Changed ${keyAuth.id} default prefix from ${keyAuth.defaultPrefix} to ${input.defaultPrefix}`,
resources: [
{
type: "keyAuth",
Expand Down