mirror of
https://github.com/whyour/qinglong.git
synced 2026-11-07 01:27:39 +08:00
* fix(security): restrict task environment controls and app scopes * fix(security): preserve legacy scopes and add read-only access * feat(security): add read-only scopes for remaining resources * fix(security): reject apps scope grants in app API * fix(security): protect system app and task file boundaries * fix: block case-variant secret paths and task runner env overrides
55 lines
1.1 KiB
TypeScript
55 lines
1.1 KiB
TypeScript
import { sequelize } from '.';
|
|
import { DataTypes, Model, ModelDefined } from 'sequelize';
|
|
|
|
export class App {
|
|
name: string;
|
|
scopes: AppScope[];
|
|
client_id: string;
|
|
client_secret: string;
|
|
tokens?: AppToken[];
|
|
id?: number;
|
|
|
|
constructor(options: App) {
|
|
this.name = options.name;
|
|
this.scopes = options.scopes;
|
|
this.client_id = options.client_id;
|
|
this.client_secret = options.client_secret;
|
|
this.id = options.id;
|
|
}
|
|
}
|
|
|
|
export interface AppToken {
|
|
value: string;
|
|
type?: 'Bearer';
|
|
expiration: number;
|
|
}
|
|
|
|
export type AppScope =
|
|
| 'crons'
|
|
| 'crons:read'
|
|
| 'subscriptions'
|
|
| 'subscriptions:read'
|
|
| 'envs'
|
|
| 'envs:read'
|
|
| 'configs'
|
|
| 'configs:read'
|
|
| 'scripts'
|
|
| 'scripts:read'
|
|
| 'logs'
|
|
| 'logs:read'
|
|
| 'dependencies'
|
|
| 'dependencies:read'
|
|
| 'dashboard'
|
|
| 'dashboard:read'
|
|
| 'system'
|
|
| 'apps';
|
|
|
|
export interface AppInstance extends Model<App, App>, App {}
|
|
export const AppModel = sequelize.define<AppInstance>('App', {
|
|
name: { type: DataTypes.STRING, unique: 'name' },
|
|
scopes: DataTypes.JSON,
|
|
client_id: DataTypes.STRING,
|
|
client_secret: DataTypes.STRING,
|
|
tokens: DataTypes.JSON,
|
|
});
|