Backend pg proxy #1719
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| import { ApiProperty } from '@nestjs/swagger'; | ||
| import { IsNotEmpty, IsString } from 'class-validator'; | ||
|
|
||
| export class GetHostedConnectionCredentialsDto { | ||
| @ApiProperty() | ||
| @IsString() | ||
| @IsNotEmpty() | ||
| hostedDatabaseId: string; | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| import { ApiProperty } from '@nestjs/swagger'; | ||
|
|
||
| export class HostedConnectionCredentialsRO { | ||
| @ApiProperty() | ||
| connectionId: string; | ||
|
|
||
| @ApiProperty() | ||
| host: string; | ||
|
|
||
| @ApiProperty() | ||
| port: number; | ||
|
|
||
| @ApiProperty() | ||
| database: string; | ||
|
|
||
| @ApiProperty() | ||
| username: string; | ||
|
|
||
| @ApiProperty() | ||
| password: string; | ||
|
Comment on lines
+19
to
+20
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# Look for logging interceptors / middlewares that might serialize responses or DTOs.
rg -nP --type=ts -C3 '\b(LoggerInterceptor|intercept\s*\(|logResponse|res\.body|response\.body)\b'
# Confirm no toJSON/serializer strips sensitive fields yet.
rg -nP --type=ts -C2 '\bHostedConnectionCredentialsRO\b'Repository: rocket-admin/rocketadmin Length of output: 28104 🏁 Script executed: cat -n backend/src/microservices/saas-microservice/data-structures/hosted-connection-credentials.ro.tsRepository: rocket-admin/rocketadmin Length of output: 579 🏁 Script executed: # Check for serialization/redaction interceptors or utilities
rg -nP --type=ts -C3 '(ClassSerializerInterceptor|Exclude|Transform|toJSON|serializer)' backend/src/interceptors/Repository: rocket-admin/rocketadmin Length of output: 50 🏁 Script executed: # Check SentryInterceptor for password/sensitive field handling
cat -n backend/src/interceptors/sentry.interceptor.tsRepository: rocket-admin/rocketadmin Length of output: 1424 🏁 Script executed: # Look for password/sensitive field redaction lists or patterns
rg -nP --type=ts 'password|redact|sensitive|mask' backend/src/interceptors/Repository: rocket-admin/rocketadmin Length of output: 50 🏁 Script executed: # Check the use case implementation
cat -n backend/src/microservices/saas-microservice/use-cases/get-hosted-connection-credentials.use.case.tsRepository: rocket-admin/rocketadmin Length of output: 1958 Add The
Without explicit redaction or documentation, future changes risk accidentally leaking credentials. 🤖 Prompt for AI Agents |
||
|
|
||
| @ApiProperty() | ||
| is_frozen: boolean; | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,40 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { Inject, Injectable, NotFoundException, Scope } from '@nestjs/common'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import AbstractUseCase from '../../../common/abstract-use.case.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { IGlobalDatabaseContext } from '../../../common/application/global-database-context.interface.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { BaseType } from '../../../common/data-injection.tokens.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { Messages } from '../../../exceptions/text/messages.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { GetHostedConnectionCredentialsDto } from '../data-structures/get-hosted-connection-credentials.dto.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { HostedConnectionCredentialsRO } from '../data-structures/hosted-connection-credentials.ro.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import { IGetHostedConnectionCredentials } from './saas-use-cases.interface.js'; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| @Injectable({ scope: Scope.REQUEST }) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| export class GetHostedConnectionCredentialsUseCase | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| extends AbstractUseCase<GetHostedConnectionCredentialsDto, HostedConnectionCredentialsRO> | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| implements IGetHostedConnectionCredentials | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| constructor( | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| @Inject(BaseType.GLOBAL_DB_CONTEXT) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| protected _dbContext: IGlobalDatabaseContext, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| ) { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| super(); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| protected async implementation(inputData: GetHostedConnectionCredentialsDto): Promise<HostedConnectionCredentialsRO> { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| const connection = await this._dbContext.connectionRepository.findOne({ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| where: { id: inputData.hostedDatabaseId }, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+22
to
+25
There was a problem hiding this comment.
Suggested change
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| if (!connection) { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| throw new NotFoundException(Messages.CONNECTION_NOT_FOUND); | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+22
to
+28
There was a problem hiding this comment. No tenant/company scoping on lookup.
Recommend either: (a) require and validate a 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| return { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| connectionId: connection.id, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| host: connection.host, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| port: connection.port, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| database: connection.database, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| username: connection.username, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| password: connection.password, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| is_frozen: connection.is_frozen, | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| }; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
Comment on lines
+22
to
+39
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
# 1) See how hosted-db connection creation stores the password (encryption?).
fd -t f 'create-connection-for-hosted-db.use.case.ts' | xargs -I{} sed -n '1,220p' {}
# 2) Look for decryption helpers used elsewhere when returning connection credentials.
rg -nP -C2 '\b(decrypt|encrypt)\w*\s*\(' --type=ts -g 'backend/src/**'
# 3) See whether master/azure/connection encryption is applied on hosted connection writes.
rg -nP -C3 '(masterEncryption|azure_encryption|encryptData|decryptData)' --type=ts -g 'backend/src/**'Repository: rocket-admin/rocketadmin Length of output: 50381 🏁 Script executed: # Check ConnectionEntity definition for BeforeInsert/AfterLoad hooks
fd -t f 'connection.entity.ts' | xargs -I{} cat -n {} | head -150
# Check if there's connection-level encryption happening at entity level
rg -B5 -A5 'BeforeInsert|BeforeUpdate|AfterLoad' --type=ts -g 'backend/src/**/connection.entity.ts'
# Verify if masterEncryption should be true for hosted connections
rg -C5 'hosted.*masterEncryption|masterEncryption.*hosted' --type=ts -g 'backend/src/**'Repository: rocket-admin/rocketadmin Length of output: 8372 🏁 Script executed: # Get the complete BeforeInsert hook implementation
rg -A30 'encryptCredentialsAndGenerateNanoid' --type=ts -g 'backend/src/**/connection.entity.ts'
# Also check how decryptConnectionsCredentialsAsync works
rg -B5 -A15 'decryptConnectionsCredentialsAsync' --type=ts -g 'backend/src/**' | head -100Repository: rocket-admin/rocketadmin Length of output: 16265 🏁 Script executed: # Check the actual current implementation of get-hosted-connection-credentials.use.case.ts
cat -n backend/src/microservices/saas-microservice/use-cases/get-hosted-connection-credentials.use.case.tsRepository: rocket-admin/rocketadmin Length of output: 1958 Add missing decryption step before returning credentials. The connection password is encrypted by Follow the pattern in import { decryptConnectionCredentialsAsync } from '../../../entities/connection/utils/decrypt-connection-credentials-async.js';
protected async implementation(inputData: GetHostedConnectionCredentialsDto): Promise<HostedConnectionCredentialsRO> {
const connection = await this._dbContext.connectionRepository.findOne({
where: { id: inputData.hostedDatabaseId },
});
if (!connection) {
throw new NotFoundException(Messages.CONNECTION_NOT_FOUND);
}
await decryptConnectionCredentialsAsync(connection);
return { ... };
}🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| } | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This DTO only accepts
hostedDatabaseId. Since the SaaS auth middleware validates only that a JWT is signed (no tenant scoping), an internal caller could fetch credentials for any connection ID. Consider requiringcompanyId(or other tenant identifier) and validating the connection belongs to that tenant before returning credentials.