Skip to content

Commit a95b3f8

Browse files
DanielHougaardDanielHougaard
authored
Merge pull request #43 from Infisical/daniel/custom-tls-certificate
feat: Custom TLS certificate support
2 parents 8f53312 + a0924ea commit a95b3f8

16 files changed

+103
-90
lines changed

‎crates/infisical/src/api/auth/azure_login.rs

+2-4
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ use serde::{Deserialize, Serialize};
33
use crate::{
44
constants::AZURE_METADATA_SERVICE_URL,
55
error::{api_error_handler, Result},
6+
helper::build_minimal_base_request,
67
Client,
78
};
89

@@ -17,10 +18,7 @@ pub async fn azure_login(
1718
client: &mut Client,
1819
identity_id: String,
1920
) -> Result<AccessTokenSuccessResponse> {
20-
let request_client = reqwest::Client::builder()
21-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
22-
.build()
23-
.unwrap();
21+
let request_client = build_minimal_base_request()?;
2422

2523
let metadata_request = request_client
2624
.get(AZURE_METADATA_SERVICE_URL)

‎crates/infisical/src/api/auth/gcp_id_token_login.rs

+2-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
use crate::{
22
api::auth::auth_infisical_google,
33
error::{api_error_handler, Error, Result},
4+
helper::build_minimal_base_request,
45
Client,
56
};
67

@@ -10,10 +11,7 @@ pub async fn gcp_id_token_login(
1011
client: &mut Client,
1112
identity_id: String,
1213
) -> Result<AccessTokenSuccessResponse> {
13-
let request_client = reqwest::Client::builder()
14-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
15-
.build()
16-
.unwrap();
14+
let request_client = build_minimal_base_request()?;
1715

1816
let metadata_request = request_client
1917
.get(format!(

‎crates/infisical/src/api/auth/mod.rs

+12-28
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ use serde::{Deserialize, Serialize};
66

77
use crate::{
88
error::{Error, Result},
9+
helper::build_base_request,
910
Client,
1011
};
1112

@@ -46,15 +47,10 @@ pub(self) async fn auth_infisical_google(
4647
identity_id: Option<String>,
4748
jwt: Option<String>,
4849
) -> Result<reqwest::Response> {
49-
let request_client = reqwest::Client::builder()
50-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
51-
.build()?;
50+
let url = format!("{}/api/v1/auth/gcp-auth/login", client.site_url.clone());
51+
let request_client = build_base_request(client, &url, reqwest::Method::POST).await?;
5252

5353
let request = request_client
54-
.post(format!(
55-
"{}/api/v1/auth/gcp-auth/login",
56-
client.site_url.clone()
57-
))
5854
.header(reqwest::header::ACCEPT, "application/json")
5955
.header(reqwest::header::USER_AGENT, client.user_agent.clone());
6056

@@ -72,15 +68,10 @@ pub(self) async fn auth_infisical_azure(
7268
identity_id: Option<String>,
7369
jwt: Option<String>,
7470
) -> Result<reqwest::Response> {
75-
let request_client = reqwest::Client::builder()
76-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
77-
.build()?;
71+
let url = format!("{}/api/v1/auth/azure-auth/login", client.site_url.clone());
72+
let request_client = build_base_request(client, &url, reqwest::Method::POST).await?;
7873

7974
let request = request_client
80-
.post(format!(
81-
"{}/api/v1/auth/azure-auth/login",
82-
client.site_url.clone()
83-
))
8475
.header(reqwest::header::ACCEPT, "application/json")
8576
.header(reqwest::header::USER_AGENT, client.user_agent.clone());
8677

@@ -98,15 +89,13 @@ pub(self) async fn auth_infisical_kubernetes(
9889
identity_id: Option<String>,
9990
jwt: Option<String>,
10091
) -> Result<reqwest::Response> {
101-
let request_client = reqwest::Client::builder()
102-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
103-
.build()?;
92+
let url = format!(
93+
"{}/api/v1/auth/kubernetes-auth/login",
94+
client.site_url.clone()
95+
);
96+
let request_client = build_base_request(client, &url, reqwest::Method::POST).await?;
10497

10598
let request = request_client
106-
.post(format!(
107-
"{}/api/v1/auth/kubernetes-auth/login",
108-
client.site_url.clone()
109-
))
11099
.header(reqwest::header::ACCEPT, "application/json")
111100
.header(reqwest::header::USER_AGENT, client.user_agent.clone());
112101

@@ -133,9 +122,8 @@ pub(self) async fn auth_infisical_aws(
133122
let iam_headers = base64_encode(header_json);
134123
let request_body = base64_encode(iam_data.iam_request_body.clone());
135124

136-
let request_client = reqwest::Client::builder()
137-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
138-
.build()?;
125+
let url = format!("{}/api/v1/auth/aws-auth/login", client.site_url.clone());
126+
let request_client = build_base_request(client, &url, reqwest::Method::POST).await?;
139127

140128
let mut form_data = HashMap::new();
141129

@@ -145,10 +133,6 @@ pub(self) async fn auth_infisical_aws(
145133
form_data.insert("iamRequestHeaders", Some(iam_headers));
146134

147135
let request = request_client
148-
.post(format!(
149-
"{}/api/v1/auth/aws-auth/login",
150-
client.site_url.clone()
151-
))
152136
.header(reqwest::header::ACCEPT, "application/json")
153137
.header(reqwest::header::USER_AGENT, client.user_agent.clone());
154138

‎crates/infisical/src/api/auth/universal_auth_login.rs

+2-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
use crate::{
22
error::{api_error_handler, Result},
3+
helper::build_base_request,
34
Client,
45
};
56
use log::debug;
@@ -23,12 +24,9 @@ pub async fn universal_auth_login(
2324
client.site_url.clone()
2425
);
2526

26-
let request_client = reqwest::Client::builder()
27-
.use_preconfigured_tls(rustls_platform_verifier::tls_config())
28-
.build()?;
27+
let request_client = build_base_request(client, &url, reqwest::Method::POST).await?;
2928

3029
let request = request_client
31-
.post(url)
3230
.header(reqwest::header::CONTENT_TYPE, "application/json")
3331
.header(reqwest::header::ACCEPT, "application/json")
3432
.header(reqwest::header::USER_AGENT, client.user_agent.clone());

‎crates/infisical/src/api/secrets/create_secret.rs

+2-7
Original file line numberDiff line numberDiff line change
@@ -29,12 +29,7 @@ pub async fn create_secret_request(
2929

3030
});
3131

32-
let base_request = build_base_request(client, &base_url, reqwest::Method::POST);
33-
34-
let request = match base_request {
35-
Ok(request) => request,
36-
Err(e) => return Err(e),
37-
};
32+
let base_request = build_base_request(client, &base_url, reqwest::Method::POST).await?;
3833

3934
let token = match client.auth.access_token {
4035
Some(ref token) => format!("Bearer {}", token),
@@ -46,7 +41,7 @@ pub async fn create_secret_request(
4641
debug!("Creating secret with JSON body: {:?}", json);
4742
debug!("Creating secret with url: {}", base_url);
4843

49-
let response = request.json(json).send().await?;
44+
let response = base_request.json(json).send().await?;
5045
let status = response.status();
5146

5247
if status == StatusCode::OK {

‎crates/infisical/src/api/secrets/delete_secret.rs

+2-7
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,7 @@ pub async fn delete_secret_request(
2323
"secretPath": input.path.as_ref().unwrap_or(&"/".to_string()),
2424
});
2525

26-
let base_request = build_base_request(client, &base_url, reqwest::Method::DELETE);
27-
28-
let request = match base_request {
29-
Ok(request) => request,
30-
Err(e) => return Err(e),
31-
};
26+
let base_request = build_base_request(client, &base_url, reqwest::Method::DELETE).await?;
3227

3328
let token = match client.auth.access_token {
3429
Some(ref token) => format!("Bearer {}", token),
@@ -39,7 +34,7 @@ pub async fn delete_secret_request(
3934
debug!("Creating secret with JSON body: {:?}", json);
4035
debug!("Creating secret with url: {}", base_url);
4136

42-
let response = request.json(json).send().await?;
37+
let response = base_request.json(json).send().await?;
4338
let status = response.status();
4439

4540
if status == StatusCode::OK {

‎crates/infisical/src/api/secrets/get_secret.rs

+2-7
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ pub async fn get_secret_request(
5252

5353
let url = build_url(base_url, json);
5454

55-
let base_request = build_base_request(client, &url, reqwest::Method::GET);
55+
let base_request = build_base_request(client, &url, reqwest::Method::GET).await?;
5656

5757
let token = match client.auth.access_token {
5858
Some(ref token) => format!("Bearer {}", token),
@@ -64,12 +64,7 @@ pub async fn get_secret_request(
6464
debug!("Getting secret with body: {:?}", input);
6565
debug!("Getting secret with url: {}", url);
6666

67-
let request = match base_request {
68-
Ok(request) => request,
69-
Err(e) => return Err(e),
70-
};
71-
72-
let response = request.send().await?;
67+
let response = base_request.send().await?;
7368

7469
let status = response.status();
7570

‎crates/infisical/src/api/secrets/list_secrets.rs

+2-8
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,7 @@ pub async fn list_secrets_request(
3939
});
4040

4141
let url = &build_url(base_url, json);
42-
43-
let base_request = build_base_request(client, url, reqwest::Method::GET);
44-
45-
let request = match base_request {
46-
Ok(request) => request,
47-
Err(e) => return Err(e),
48-
};
42+
let base_request = build_base_request(client, url, reqwest::Method::GET).await?;
4943

5044
let token = match client.auth.access_token {
5145
Some(ref token) => format!("Bearer {}", token),
@@ -56,7 +50,7 @@ pub async fn list_secrets_request(
5650
debug!("Creating secret with JSON body: {:?}", json);
5751
debug!("Creating secret with url: {}", url);
5852

59-
let response = request.json(json).send().await?;
53+
let response = base_request.json(json).send().await?;
6054
let status = response.status();
6155

6256
if status == StatusCode::OK {

‎crates/infisical/src/api/secrets/update_secret.rs

+2-7
Original file line numberDiff line numberDiff line change
@@ -26,14 +26,9 @@ pub async fn update_secret_request(
2626

2727
});
2828

29-
let base_request = build_base_request(client, &base_url, reqwest::Method::PATCH);
29+
let base_request = build_base_request(client, &base_url, reqwest::Method::PATCH).await?;
3030

31-
let request = match base_request {
32-
Ok(request) => request,
33-
Err(e) => return Err(e),
34-
};
35-
36-
let response = request.json(json).send().await?;
31+
let response = base_request.json(json).send().await?;
3732
let status = response.status();
3833

3934
if status == StatusCode::OK {

‎crates/infisical/src/client/client.rs

+2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ pub struct Client {
1010

1111
pub(crate) cache: Arc<Mutex<Vec<CachedSecret>>>,
1212
pub(crate) cache_ttl: u64, // No need for a mutex lock here, as we are only reading this value in the cache thread.
13+
pub(crate) ssl_certificate_path: Option<String>,
1314

1415
pub site_url: String,
1516
pub user_agent: String,
@@ -35,6 +36,7 @@ impl Client {
3536

3637
let client: Client = Self {
3738
auth: settings.auth,
39+
ssl_certificate_path: settings.ssl_certificate_path,
3840
site_url: settings
3941
.site_url
4042
.unwrap_or("https://app.infisical.com".to_string()),

‎crates/infisical/src/client/client_settings.rs

+7
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,12 @@ pub struct ClientSettings {
3636
pub cache_ttl: Option<u64>,
3737
pub user_agent: Option<String>, // We use this to identity which SDK/language was used to make a request.
3838

39+
#[schemars(
40+
description = "The SSL certificate path is an optional field that allows you to specify a custom SSL certificate to use for requests made to Infisical.
41+
This option can be substituted with the `INFISICAL_SSL_CERTIFICATE` environment variable, which should contain the certificate as a string, not the path."
42+
)]
43+
pub ssl_certificate_path: Option<String>, // Path to the SSL certificate file.
44+
3945
#[schemars(
4046
description = "Configure the authentication method to use.\n\nMake sure to only set one one method at a time to avoid conflicts and unexpected behavior."
4147
)]
@@ -46,6 +52,7 @@ pub struct ClientSettings {
4652
impl Default for ClientSettings {
4753
fn default() -> Self {
4854
Self {
55+
ssl_certificate_path: None,
4956
client_secret: None,
5057
client_id: None,
5158
access_token: None,

‎crates/infisical/src/constants.rs

+2
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,5 @@ pub const AWS_EC2_INSTANCE_IDENTITY_DOCUMENT_URL: &str =
2929
// Azure Metadata Service:
3030
pub const AZURE_METADATA_SERVICE_URL: &str =
3131
"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F";
32+
33+
pub const INFISICAL_SSL_CERTIFICATE_ENV_NAME: &str = "INFISICAL_SSL_CERTIFICATE";

‎crates/infisical/src/error.rs

+6
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,12 @@ pub enum Error {
1818
#[error("Something unexpected went wrong.")]
1919
UnknownError,
2020

21+
#[error("Failed to find SSL/TLS certificate")]
22+
SSLCertificateNotFound,
23+
24+
#[error("Invalid SSL/TLS certificate, {}", .message)]
25+
InvalidSSLCertificate { message: String },
26+
2127
#[error("Something went wrong: {}", .message)]
2228
UnknownErrorWithMessage { message: String },
2329

0 commit comments

Comments
 (0)