mirror of
https://github.com/andwati/dokploy.git
synced 2026-10-20 20:14:29 +00:00
c968a2755e
* fix: strip credentials from service-level API responses
Registry passwords and S3 destination credentials were being returned
in service `.one` tRPC endpoints to any user with service-level read
access. Reported by Nihon Kohden Corporation security team.
- Strip registry `password` from `findApplicationById` via Drizzle `columns: { password: false }`
- Strip destination `accessKey`/`secretAccessKey` from all DB service finders (postgres, mysql, mariadb, mongo, libsql, compose, backup, volume-backups)
- Add `findRegistryByIdWithCredentials` for internal use only
- Builders and upload utils now load registry credentials by ID at execution time
- `createRollback` enriches `fullContext` with registry credentials before persisting to DB so rollback execution has what it needs
- Remove `findApplicationByIdWithCredentials` and `ApplicationNestedWithCredentials` — no longer needed
- Backup execution utils load full destination via `findDestinationById` at runtime instead of reading from the joined relation
* [autofix.ci] apply automated fixes
---------
Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>
135 lines
2.3 KiB
TypeScript
135 lines
2.3 KiB
TypeScript
import { TRPCError } from "@trpc/server";
|
|
import { eq } from "drizzle-orm";
|
|
import type { z } from "zod";
|
|
import { db } from "../db";
|
|
import {
|
|
type createVolumeBackupSchema,
|
|
type updateVolumeBackupSchema,
|
|
volumeBackups,
|
|
} from "../db/schema";
|
|
|
|
export const findVolumeBackupById = async (volumeBackupId: string) => {
|
|
const volumeBackup = await db.query.volumeBackups.findFirst({
|
|
where: eq(volumeBackups.volumeBackupId, volumeBackupId),
|
|
with: {
|
|
application: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
postgres: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
mysql: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
mariadb: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
mongo: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
redis: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
compose: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
libsql: {
|
|
with: {
|
|
environment: {
|
|
with: {
|
|
project: true,
|
|
},
|
|
},
|
|
},
|
|
},
|
|
destination: {
|
|
columns: {
|
|
accessKey: false,
|
|
secretAccessKey: false,
|
|
},
|
|
},
|
|
},
|
|
});
|
|
|
|
if (!volumeBackup) {
|
|
throw new TRPCError({
|
|
code: "NOT_FOUND",
|
|
message: "Volume backup not found",
|
|
});
|
|
}
|
|
|
|
return volumeBackup;
|
|
};
|
|
|
|
export const createVolumeBackup = async (
|
|
volumeBackup: z.infer<typeof createVolumeBackupSchema>,
|
|
) => {
|
|
const newVolumeBackup = await db
|
|
.insert(volumeBackups)
|
|
.values(volumeBackup as typeof volumeBackups.$inferInsert)
|
|
.returning()
|
|
.then((e) => e[0]);
|
|
|
|
return newVolumeBackup;
|
|
};
|
|
|
|
export const removeVolumeBackup = async (volumeBackupId: string) => {
|
|
await db
|
|
.delete(volumeBackups)
|
|
.where(eq(volumeBackups.volumeBackupId, volumeBackupId));
|
|
};
|
|
|
|
export const updateVolumeBackup = async (
|
|
volumeBackupId: string,
|
|
volumeBackup: z.infer<typeof updateVolumeBackupSchema>,
|
|
) => {
|
|
return await db
|
|
.update(volumeBackups)
|
|
.set(volumeBackup as Partial<typeof volumeBackups.$inferInsert>)
|
|
.where(eq(volumeBackups.volumeBackupId, volumeBackupId))
|
|
.returning()
|
|
.then((e) => e[0]);
|
|
};
|