devstack/authorizer
4
0
Fork 0
Code Pull Requests Actions Activity

fix(server): add old secret check for admin secret update

Browse Source
This commit is contained in:
Lakhan Samani 2022-01-17 13:20:32 +05:30
parent c15b65b473
commit 3b4d0d9769
5 changed files with 19 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
server/graph/generated/generated.go
View File

@ -1093,7 +1093,7 @@ type Env {
input UpdateEnvInput { input UpdateEnvInput {
ADMIN_SECRET: String ADMIN_SECRET: String
CONFIRM_ADMIN_SECRET: String OLD_ADMIN_SECRET: String
DATABASE_TYPE: String DATABASE_TYPE: String
DATABASE_URL: String DATABASE_URL: String
DATABASE_NAME: String DATABASE_NAME: String
@ -6258,11 +6258,11 @@ func (ec *executionContext) unmarshalInputUpdateEnvInput(ctx context.Context, ob
if err != nil { if err != nil {
return it, err return it, err
} }
case "CONFIRM_ADMIN_SECRET": case "OLD_ADMIN_SECRET":
var err error var err error
ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("CONFIRM_ADMIN_SECRET")) ctx := graphql.WithPathContext(ctx, graphql.NewPathWithField("OLD_ADMIN_SECRET"))
it.ConfirmAdminSecret, err = ec.unmarshalOString2ᚖstring(ctx, v) it.OldAdminSecret, err = ec.unmarshalOString2ᚖstring(ctx, v)
if err != nil { if err != nil {
return it, err return it, err
} }

2
server/graph/model/models_gen.go
View File

@ -119,7 +119,7 @@ type SignUpInput struct {
type UpdateEnvInput struct { type UpdateEnvInput struct {
AdminSecret *string `json:"ADMIN_SECRET"` AdminSecret *string `json:"ADMIN_SECRET"`
ConfirmAdminSecret *string `json:"CONFIRM_ADMIN_SECRET"` OldAdminSecret *string `json:"OLD_ADMIN_SECRET"`
DatabaseType *string `json:"DATABASE_TYPE"` DatabaseType *string `json:"DATABASE_TYPE"`
DatabaseURL *string `json:"DATABASE_URL"` DatabaseURL *string `json:"DATABASE_URL"`
DatabaseName *string `json:"DATABASE_NAME"` DatabaseName *string `json:"DATABASE_NAME"`

2
server/graph/schema.graphqls
View File

@ -100,7 +100,7 @@ type Env {
input UpdateEnvInput { input UpdateEnvInput {
ADMIN_SECRET: String ADMIN_SECRET: String
CONFIRM_ADMIN_SECRET: String OLD_ADMIN_SECRET: String
DATABASE_TYPE: String DATABASE_TYPE: String
DATABASE_URL: String DATABASE_URL: String
DATABASE_NAME: String DATABASE_NAME: String

6
server/graph/schema.resolvers.go
View File

@ -105,7 +105,5 @@ func (r *Resolver) Mutation() generated.MutationResolver { return &mutationResol
// Query returns generated.QueryResolver implementation. // Query returns generated.QueryResolver implementation.
func (r *Resolver) Query() generated.QueryResolver { return &queryResolver{r} } func (r *Resolver) Query() generated.QueryResolver { return &queryResolver{r} }
type ( type mutationResolver struct{ *Resolver }
mutationResolver struct{ *Resolver } type queryResolver struct{ *Resolver }
queryResolver struct{ *Resolver }
)

11
server/resolvers/update_env.go
View File

@ -3,6 +3,7 @@ package resolvers
import ( import (
"context" "context"
"encoding/json" "encoding/json"
"errors"
"fmt" "fmt"
"log" "log"
"reflect" "reflect"
@ -12,6 +13,7 @@ import (
"github.com/authorizerdev/authorizer/server/envstore" "github.com/authorizerdev/authorizer/server/envstore"
"github.com/authorizerdev/authorizer/server/graph/model" "github.com/authorizerdev/authorizer/server/graph/model"
"github.com/authorizerdev/authorizer/server/utils" "github.com/authorizerdev/authorizer/server/utils"
"golang.org/x/crypto/bcrypt"
) )
// UpdateEnvResolver is a resolver for update config mutation // UpdateEnvResolver is a resolver for update config mutation
@ -89,6 +91,15 @@ func UpdateEnvResolver(ctx context.Context, params model.UpdateEnvInput) (*model
// in case of admin secret change update the cookie with new hash // in case of admin secret change update the cookie with new hash
if params.AdminSecret != nil { if params.AdminSecret != nil {
if params.OldAdminSecret == nil {
return res, errors.New("admin secret and old admin secret are required for secret change")
}
err := bcrypt.CompareHashAndPassword([]byte(*params.OldAdminSecret), []byte(envstore.EnvInMemoryStoreObj.GetEnvVariable(constants.EnvKeyAdminSecret).(string)))
if err != nil {
return res, errors.New("old admin secret is not correct")
}
hashedKey, err := utils.EncryptPassword(envstore.EnvInMemoryStoreObj.GetEnvVariable(constants.EnvKeyAdminSecret).(string)) hashedKey, err := utils.EncryptPassword(envstore.EnvInMemoryStoreObj.GetEnvVariable(constants.EnvKeyAdminSecret).(string))
if err != nil { if err != nil {
return res, err return res, err