Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Develop #457

Merged
merged 37 commits into from
Mar 22, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
37 commits
Select commit Hold shift + click to select a range
7ad1ae2
fixed an issue with index.js
nevil-mathew Mar 13, 2024
c5d2255
Username Enumeration - generateOtp
adithyadinesh0412 Mar 18, 2024
0bc40b1
Merge pull request #442 from adithyadinesh0412/security_fixes
aks30 Mar 18, 2024
195eb24
Audit Bug - 1148 , 1152 , 1153
sumanvpacewisdom Mar 19, 2024
861c2a0
1142 -security fix, downloadableUrl API
VISHNUDAS-tunerlabs Mar 19, 2024
0e825a0
package version updated
VISHNUDAS-tunerlabs Mar 19, 2024
cfe344d
blacklisting update
adithyadinesh0412 Mar 19, 2024
5817165
Comment Changes regarding the password
sumanvpacewisdom Mar 20, 2024
817a0b9
Merge branch 'security_fixes' of https://github.com/ELEVATE-Project/u…
nevil-mathew Mar 20, 2024
22e3b95
Merge pull request #447 from adithyadinesh0412/security_fixes
nevil-mathew Mar 20, 2024
e786767
updated validators
nevil-mathew Mar 21, 2024
cf85092
updated blackList
nevil-mathew Mar 21, 2024
a607cb4
user update blacklist updated
adithyadinesh0412 Mar 21, 2024
43c466c
Merge branch 'develop' into security-1142
VISHNUDAS-tunerlabs Mar 21, 2024
c633acb
user update blacklist updated - Added roles
adithyadinesh0412 Mar 21, 2024
88c6a89
updated blacklist
nevil-mathew Mar 21, 2024
8e16452
Merge pull request #445 from ELEVATE-Project/security-1142
rakeshSgr Mar 21, 2024
8fe8f01
Merge pull request #437 from ELEVATE-Project/Code-Injection-fix
rakeshSgr Mar 21, 2024
182188c
added cloud-services to valid list
nevil-mathew Mar 21, 2024
3110061
Merge pull request #450 from ELEVATE-Project/controller-update-index
rakeshSgr Mar 21, 2024
2e1bd00
Merge branch 'develop' into audit_changes
sumanvpacewisdom Mar 22, 2024
49e3c40
Merge pull request #448 from ELEVATE-Project/validation-fix
rakeshSgr Mar 22, 2024
c2c314e
Merge pull request #444 from sumanvpacewisdom/audit_changes
rakeshSgr Mar 22, 2024
69e120f
Merge branch 'develop' of https://github.com/ELEVATE-Project/user int…
adithyadinesh0412 Mar 22, 2024
e180323
user update blacklist updated - changes
adithyadinesh0412 Mar 22, 2024
c7241ba
user update blacklist updated - changes
adithyadinesh0412 Mar 22, 2024
6858820
Merge pull request #451 from adithyadinesh0412/security_fixes
rakeshSgr Mar 22, 2024
353b1bb
Default variable changes for regex in env
sumanvpacewisdom Mar 22, 2024
d036755
Merge branch 'audit_changes' of https://github.com/sumanvpacewisdom/u…
sumanvpacewisdom Mar 22, 2024
05abd46
Merge remote-tracking branch 'upstream/develop' into audit_changes
sumanvpacewisdom Mar 22, 2024
0e1b923
Merge pull request #453 from sumanvpacewisdom/audit_changes
rakeshSgr Mar 22, 2024
03de8c7
bulk upload internal process failure fix
VISHNUDAS-tunerlabs Mar 22, 2024
d621e31
Merge pull request #454 from ELEVATE-Project/userInviteFix
rakeshSgr Mar 22, 2024
655b935
envVariables chnages
sumanvpacewisdom Mar 22, 2024
3f7a29c
Merge pull request #455 from sumanvpacewisdom/audit_changes
rakeshSgr Mar 22, 2024
d23c25b
fixed an issue with refresh token update
nevil-mathew Mar 22, 2024
fb9dfcb
Merge pull request #456 from ELEVATE-Project/refresh-token-fix
rakeshSgr Mar 22, 2024
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/.env.sample
Original file line number Diff line number Diff line change
Expand Up @@ -170,6 +170,9 @@ GENERIC_INVITATION_EMAIL_TEMPLATE_CODE=generic_invite
# Allowed host by CORS
ALLOWED_HOST = "http://examplDomain.com"

# Downloadabale url exipres after
DOWNLOAD_URL_EXPIRATION_DURATION = 120000

#database url
DATABASE_URL=postgres://postgres:postgres@localhost:5432/elevate-user

358 changes: 358 additions & 0 deletions src/constants/blacklistConfig.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,358 @@
const account = {
create: ['id', 'last_logged_in_at', 'refresh_tokens', 'organization_id'],
login: [
'id',
'email_verified',
'name',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
logout: [
'id',
'email',
'email_verified',
'name',
'password',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
generateToken: [
'id',
'email',
'email_verified',
'name',
'password',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
generateOtp: [
'id',
'email_verified',
'name',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
registrationOtp: [
'id',
'email_verified',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
resetPassword: [
'id',
'email_verified',
'name',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
changeRole: [
'id',
'email_verified',
'name',
'password',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'custom_entity_text',
'meta',
],
}
const admin = {
create: [
'id',
'email_verified',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
login: [
'id',
'email_verified',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
addOrgAdmin: [
'id',
'email_verified',
'gender',
'location',
'about',
'password',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'roles',
'custom_entity_text',
'meta',
],
deactivateUser: [
'email_verified',
'gender',
'location',
'about',
'password',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
}
const entityType = {
create: ['id', 'status', 'created_by', 'updated_by', 'organization_id', 'parent_id', 'allow_filtering'],
update: ['id', 'created_by', 'updated_by', 'allow_filtering', 'organization_id', 'parent_id'],
}

const entity = {
create: ['id', 'status', 'type', 'created_by', 'updated_by'],
update: ['id', 'entity_type_id', 'created_by', 'updated_by'],
}

const form = {
create: ['id', 'version', 'organization_id'],
update: ['id', 'version', 'organization_id'],
}

const modules = {
create: ['id'],
update: [],
}

const notification = {
create: ['id', 'created_by', 'updated_by'],
update: ['id', 'created_by', 'updated_by'],
}

const orgAdmin = {
bulkUserCreate: [
'id',
'email_verified',
'name',
'gender',
'location',
'about',
'share_link',
'status',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
updateRequestStatus: [
'id',
'email_verified',
'name',
'gender',
'location',
'about',
'share_link',
'image',
'last_logged_in_at',
'has_accepted_terms_and_conditions',
'refresh_tokens',
'languages',
'preferred_language',
'organization_id',
'roles',
'custom_entity_text',
'meta',
],
}

const organization = {
create: [
'id',
'status',
'org_admin',
'parent_id',
'related_orgs',
'in_domain_visibility',
'created_by',
'updated_by',
],
update: ['id', 'org_admin', 'parent_id', 'related_orgs', 'in_domain_visibility', 'created_by', 'updated_by'],
requestOrgRole: [
'id',
'description',
'status',
'org_admin',
'parent_id',
'related_orgs',
'in_domain_visibility',
'created_by',
'updated_by',
],
}

const permissions = {
create: ['id'],
update: ['id'],
}

const rolePermissionMapping = {
create: ['created_by'],
update: ['module', 'request_type', 'api_path', 'created_by'],
}

const userRole = {
create: ['id', 'organization_id'],
update: ['id', 'organization_id'],
}

const user = {
update: [
'id',
'share_link',
'last_logged_in_at',
'refresh_tokens',
'organization_id',
'roles',
'custom_entity_text',
'meta',
'email',
'email_verified',
'password',
'has_accepted_terms_and_conditions',
],
}

module.exports = {
account,
admin,
entityType,
entity,
form,
modules,
notification,
orgAdmin,
organization,
permissions,
rolePermissionMapping,
userRole,
user,
}
2 changes: 1 addition & 1 deletion src/constants/common.js
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ module.exports = {
'/user/v1/user-role/default',
],
notificationEmailType: 'email',
accessTokenExpiry: `${process.env.ACCESS_TOKEN_EXPIRY}d`,
accessTokenExpiry: process.env.ACCESS_TOKEN_EXPIRY,
refreshTokenExpiry: `${process.env.REFRESH_TOKEN_EXPIRY}d`,
refreshTokenExpiryInMs: Number(process.env.REFRESH_TOKEN_EXPIRY) * 24 * 60 * 60 * 1000,
refreshTokenLimit: 3,
Expand Down
Loading