Skip to content

Commit 9d4691a

Browse files
shobhitupadhyayyshobhitupadhyayy
authored
Merge branch 'dev' into bugfix/CMG-833
2 parents e0a2ab6 + 127ca45 commit 9d4691a

52 files changed

Lines changed: 3411 additions & 1404 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,9 @@
1616
# Mono auto generated files
1717
mono_crash.*
1818

19+
# App JSON file
20+
app.json
21+
1922
# Build results
2023
[Dd]ebug/
2124
[Dd]ebugPublic/
@@ -360,7 +363,6 @@ upload-api/extracted_files*
360363
*copy*
361364
.qodo
362365
.vscode
363-
app.json
364366
# Snyk Security Extension - AI Rules (auto-generated)
365367
.cursor/rules/snyk_rules.mdc
366368
*extracted_files*

‎.talismanrc‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,4 +158,35 @@ fileignoreconfig:
158158
checksum: f3bd8c6e981ed0acf26432859b2b7e388c0d90018513005cfc674726f14fe245
159159
- filename: ui/src/components/SchemaModal/index.tsx
160160
checksum: 607a465c9cd4a504b9a81750a3f9faa0f4e11c09414354d69ec7308c11f0046a
161+
162+
fileignoreconfig:
163+
- filename: api/sso.utils.js
164+
checksum: 5d589c128c4b38f8aacd70e5d02ddd7fa8e93ff7897ca69a1258378139d1d616
165+
version: "1.0"
166+
167+
fileignoreconfig:
168+
- filename: api/package-lock.json
169+
checksum: 4d2fd1905b5933e1d2c4d178e1536422d4aac84caa9640149eab0432a75b712d
170+
- filename: api/src/services/migration.service.ts
171+
checksum: 1fdf5423840e170709c7c677c3a6a7c6ae61f373948c2ef295aa645a859c1af5
172+
- filename: api/src/services/contentMapper.service.ts
173+
checksum: 03d5dcc31b38fd435f6a4389d6891c7fc1ba27b32dc2b382b91173d84f4565f7
174+
- filename: api/src/services/globalField.service.ts
175+
checksum: b808815c7372f68fe9a5904d23be50cb0ec066592328ec1721dc3c395cbe3a2c
176+
- filename: api/src/services/taxonomy.service.ts
177+
checksum: 840ab11838ebf08df44ada0a3674dad8cc124bc8bcbc5dfd1d9c585a34e4aeda
178+
- filename: api/src/services/org.service.ts
179+
checksum: 0a50297164d7845d889fc78097164c4794a3f9cd7314c06365c8426a2a6ee52a
180+
- filename: ui/src/pages/Login/index.tsx
181+
checksum: 7f7c008586db60f1cc8df625b88bfdc5c3bb861c21e40a55fc763f0ac4a6a8d2
182+
version: "1.0"
183+
184+
fileignoreconfig:
185+
- filename: api/src/services/contentMapper.service.ts
186+
checksum: 924b124214a93a7bec4c471304f5b270d5e735d506644180273b7118f3d37dd2
187+
version: "1.0"
188+
189+
fileignoreconfig:
190+
- filename: ui/src/pages/Login/index.tsx
191+
checksum: 213c6441dc87d82ce6b97679d457ae56c6e40ef13a89bddd4f21afcf566b5576
161192
version: "1.0"

‎api/encrypt-manifest.js‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#!/usr/bin/env node
2+
3+
/**
4+
* One-time script to encrypt sensitive fields in manifest.json.
5+
*
6+
* Usage:
7+
* MANIFEST_ENCRYPT_KEY=<your-secret-key> node encrypt-manifest.js
8+
*
9+
* This will overwrite manifest.json with encrypted uid, client_id, and client_secret.
10+
* Run once, then commit the encrypted manifest.json.
11+
*/
12+
13+
const crypto = require("crypto");
14+
const fs = require("fs");
15+
const path = require("path");
16+
17+
const ALGORITHM = "aes-256-gcm";
18+
const ENC_PREFIX = "enc:";
19+
const ENCRYPT_KEY = process.env.MANIFEST_ENCRYPT_KEY;
20+
const ENCRYPT_SALT = process.env.MANIFEST_ENCRYPT_SALT;
21+
22+
if (!ENCRYPT_KEY || !ENCRYPT_SALT) {
23+
console.error("Error: MANIFEST_ENCRYPT_KEY and MANIFEST_ENCRYPT_SALT environment variables are required.");
24+
console.error("Usage: MANIFEST_ENCRYPT_KEY=<key> MANIFEST_ENCRYPT_SALT=<salt> node encrypt-manifest.js");
25+
process.exit(1);
26+
}
27+
28+
function encrypt(plaintext) {
29+
const key = crypto.scryptSync(ENCRYPT_KEY, ENCRYPT_SALT, 32);
30+
const iv = crypto.randomBytes(12);
31+
const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
32+
let encrypted = cipher.update(plaintext, "utf8", "hex");
33+
encrypted += cipher.final("hex");
34+
const authTag = cipher.getAuthTag().toString("hex");
35+
return `${ENC_PREFIX}${iv.toString("hex")}:${authTag}:${encrypted}`;
36+
}
37+
38+
const manifestPath = path.join(__dirname, "manifest.json");
39+
const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
40+
41+
let changed = false;
42+
43+
if (manifest.uid && !manifest.uid.startsWith(ENC_PREFIX)) {
44+
console.log(`Encrypting uid: ${manifest.uid.substring(0, 8)}...`);
45+
manifest.uid = encrypt(manifest.uid);
46+
changed = true;
47+
}
48+
49+
if (manifest.oauth?.client_id && !manifest.oauth.client_id.startsWith(ENC_PREFIX)) {
50+
console.log(`Encrypting oauth.client_id: ${manifest.oauth.client_id.substring(0, 8)}...`);
51+
manifest.oauth.client_id = encrypt(manifest.oauth.client_id);
52+
changed = true;
53+
}
54+
55+
if (manifest.oauth?.client_secret && !manifest.oauth.client_secret.startsWith(ENC_PREFIX)) {
56+
console.log(`Encrypting oauth.client_secret: ${manifest.oauth.client_secret.substring(0, 8)}...`);
57+
manifest.oauth.client_secret = encrypt(manifest.oauth.client_secret);
58+
changed = true;
59+
}
60+
61+
if (!changed) {
62+
console.log("All sensitive fields are already encrypted. Nothing to do.");
63+
process.exit(0);
64+
}
65+
66+
fs.writeFileSync(manifestPath, JSON.stringify(manifest, null, 4) + "\n");
67+
console.log("\nmanifest.json updated with encrypted values.");
68+
console.log("Make sure to store MANIFEST_ENCRYPT_KEY securely (e.g. in your .env file).");

‎api/manifest.json‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
{
2+
"uid": "enc:a60ee6b03d4302fcd17d2002:c1cc872f360dab3b281475c63774bf32:246e83b7b0c4ee2bda6d2703fc83",
3+
"name": "Migration Tool",
4+
"description": "",
5+
"target_type": "organization",
6+
"visibility": "private",
7+
"version": 2,
8+
"icon": "",
9+
"oauth": {
10+
"client_id": "enc:f209426a501970c548397f06:f1b577b2e6a0be867ca918b2cb25570f:721a38e64fda3e6cf31a1bfb055544d96d5f8c8b",
11+
"client_secret": "enc:ddfc3caaf24e8fedb8e375cc:bf18af2e5afc805a22136edc86b9c3dd:7ff93277172f838994f366ea91e3288fe34586aa8e88389b",
12+
"redirect_uri": "http://localhost:5001/v2/auth/save-token",
13+
"user_token_config": {
14+
"enabled": true,
15+
"scopes": [
16+
"app.manifests:read",
17+
"app.manifest:read",
18+
"app.manifest:write",
19+
"app.hosting:read",
20+
"app.hosting:write",
21+
"app.installations:read",
22+
"app.installations.management:read",
23+
"app.installations.management:write",
24+
"app.authorizations:manage",
25+
"app.authorizations.management:write",
26+
"app.requests:write",
27+
"app.requests.management:write",
28+
"scim:manage",
29+
"user.profile:read",
30+
"user:read",
31+
"user:write",
32+
"user.tfa:write",
33+
"user.assignments:read",
34+
"user.assignments:write",
35+
"user.notifications:read",
36+
"user.notifications:write",
37+
"organizations:read",
38+
"organization:read",
39+
"organization.roles:read",
40+
"organization.share:read",
41+
"organization.share:write",
42+
"organization.ownership:write",
43+
"organization.settings:write",
44+
"organization.logs:read",
45+
"organization.usage:read",
46+
"organization.jobs:read",
47+
"organization.jobs:write",
48+
"cm.stacks.management:read",
49+
"cm.stacks.management:write",
50+
"cm.stack.management:read",
51+
"cm.stack.management:write",
52+
"cm.stack.settings:read",
53+
"cm.stack.settings:write",
54+
"cm.stack:share",
55+
"cm.stack:unshare",
56+
"cm.stack.users:read",
57+
"cm.stack.users:write",
58+
"cm.stack.delivery-tokens:read",
59+
"cm.stack.delivery-tokens:write",
60+
"cm.stack.management-tokens:read",
61+
"cm.stack.management-tokens:write",
62+
"cm.content-types.management:read",
63+
"cm.content-types.management:write",
64+
"cm.content-types:import",
65+
"cm.content-types:export",
66+
"cm.content-type:read",
67+
"cm.content-type:write",
68+
"cm.content-type:copy",
69+
"cm.global-fields.management:read",
70+
"cm.global-fields.management:write",
71+
"cm.global-fields:import",
72+
"cm.global-fields:export",
73+
"cm.entries.management:read",
74+
"cm.entries.management:write",
75+
"cm.entries:import",
76+
"cm.entries:export",
77+
"cm.entry:read",
78+
"cm.entry:write",
79+
"cm.entry:publish",
80+
"cm.entry:unpublish",
81+
"cm.entry.workflow:write",
82+
"cm.webhooks.management:read",
83+
"cm.webhooks.management:write",
84+
"cm.webhooks:import",
85+
"cm.webhooks:export",
86+
"cm.webhook:read",
87+
"cm.webhook:write",
88+
"cm.assets.management:read",
89+
"cm.assets.management:write",
90+
"cm.assets.rt:read",
91+
"cm.assets.rt:write",
92+
"cm.assets:download",
93+
"cm.asset:read",
94+
"cm.asset:write",
95+
"cm.asset:publish",
96+
"cm.asset:unpublish",
97+
"cm.workflows.management:read",
98+
"cm.workflows.management:write",
99+
"cm.workflows.publishing-rules:read",
100+
"cm.workflows.publishing-rules:write",
101+
"cm.environments.management:read",
102+
"cm.environments.management:write",
103+
"cm.extensions.management:read",
104+
"cm.extensions.management:write",
105+
"cm.languages.management:read",
106+
"cm.languages.management:write",
107+
"cm.labels.management:read",
108+
"cm.labels.management:write",
109+
"cm.bulk-operations:publish",
110+
"cm.bulk-operations:unpublish",
111+
"cm.bulk-operations:add-to-release",
112+
"cm.bulk-operations:delete",
113+
"cm.bulk-operations:move-to-folder",
114+
"cm.bulk-operations:workflow",
115+
"cm.releases.management:read",
116+
"cm.releases.management:write",
117+
"cm.release:read",
118+
"cm.release:write",
119+
"cm.release:clone",
120+
"cm.release:deploy",
121+
"cm.roles.management:read",
122+
"cm.roles.management:write",
123+
"cm.audit-logs:read",
124+
"personalize:read",
125+
"personalize:manage",
126+
"cm.publish-queue.management:read",
127+
"cm.publish-queue.management:write",
128+
"cm.taxonomies.management:read",
129+
"cm.taxonomies.management:write",
130+
"cm.taxonomy.terms:read",
131+
"cm.taxonomy.terms:write",
132+
"cm.branches.management:read",
133+
"cm.branches.management:write",
134+
"cm.branches:compare-merge",
135+
"cm.branch-aliases.management:read",
136+
"cm.branch-aliases.management:write",
137+
"launch:manage",
138+
"launch.gitproviders:manage",
139+
"automationhub.projects.management:read",
140+
"automationhub.projects.management:write",
141+
"automationhub.automations:read",
142+
"automationhub.automations:write",
143+
"automationhub.executions:read",
144+
"automationhub.audit-logs:read",
145+
"automationhub.variables:read",
146+
"automationhub.variables:write",
147+
"automationhub.accounts:read",
148+
"brand-kits:read",
149+
"brand-kits:manage",
150+
"cm.variant:read",
151+
"cm.variant:write",
152+
"analytics:read",
153+
"auditlogs:read",
154+
"teams:read",
155+
"teams:write"
156+
],
157+
"allow_pkce": true
158+
},
159+
"app_token_config": {
160+
"enabled": false,
161+
"scopes": []
162+
}
163+
},
164+
"group": "user"
165+
}

0 commit comments

Comments
 (0)