Fix server logs leak (#18423)
# Introduction Previously the auth jwt stragegy would lod the whole user entity in the auth user context On an exception it would completely get logged on the pods ## Security layer - 0/ Updating the type system ( devxp only though ) - 1/ The jwt auth stragegy only load a specific sub set of the user entity - 2/ Sanitizing at the exception log level directly in case of a user context - 3/ Sanitizing at the console driver The last two sanitization could sound a bit redundant though they're still good fallback to keep in case new path occurs in the cb
This commit is contained in:
+5
-5
@@ -11,7 +11,7 @@ import { DismissReconnectAccountBannerInput } from 'src/engine/core-modules/mess
|
||||
import { TimelineThreadsWithTotalDTO } from 'src/engine/core-modules/messaging/dtos/timeline-threads-with-total.dto';
|
||||
import { GetMessagesService } from 'src/engine/core-modules/messaging/services/get-messages.service';
|
||||
import { UserService } from 'src/engine/core-modules/user/services/user.service';
|
||||
import { UserEntity } from 'src/engine/core-modules/user/user.entity';
|
||||
import { type AuthContextUser } from 'src/engine/core-modules/auth/types/auth-context.type';
|
||||
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
|
||||
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
|
||||
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
|
||||
@@ -71,7 +71,7 @@ export class TimelineMessagingResolver {
|
||||
|
||||
@Query(() => TimelineThreadsWithTotalDTO)
|
||||
async getTimelineThreadsFromPersonId(
|
||||
@AuthUser() user: UserEntity,
|
||||
@AuthUser() user: AuthContextUser,
|
||||
@AuthWorkspace() workspace: WorkspaceEntity,
|
||||
@Args() { personId, page, pageSize }: GetTimelineThreadsFromPersonIdArgs,
|
||||
) {
|
||||
@@ -98,7 +98,7 @@ export class TimelineMessagingResolver {
|
||||
|
||||
@Query(() => TimelineThreadsWithTotalDTO)
|
||||
async getTimelineThreadsFromCompanyId(
|
||||
@AuthUser() user: UserEntity,
|
||||
@AuthUser() user: AuthContextUser,
|
||||
@AuthWorkspace() workspace: WorkspaceEntity,
|
||||
@Args() { companyId, page, pageSize }: GetTimelineThreadsFromCompanyIdArgs,
|
||||
) {
|
||||
@@ -125,7 +125,7 @@ export class TimelineMessagingResolver {
|
||||
|
||||
@Query(() => TimelineThreadsWithTotalDTO)
|
||||
async getTimelineThreadsFromOpportunityId(
|
||||
@AuthUser() user: UserEntity,
|
||||
@AuthUser() user: AuthContextUser,
|
||||
@AuthWorkspace() workspace: WorkspaceEntity,
|
||||
@Args()
|
||||
{ opportunityId, page, pageSize }: GetTimelineThreadsFromOpportunityIdArgs,
|
||||
@@ -154,7 +154,7 @@ export class TimelineMessagingResolver {
|
||||
@UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
|
||||
@Mutation(() => Boolean)
|
||||
async dismissReconnectAccountBanner(
|
||||
@AuthUser() user: UserEntity,
|
||||
@AuthUser() user: AuthContextUser,
|
||||
@AuthWorkspace() workspace: WorkspaceEntity,
|
||||
@Args() { connectedAccountId }: DismissReconnectAccountBannerInput,
|
||||
): Promise<boolean> {
|
||||
|
||||
Reference in New Issue
Block a user