make getUnauthenticatedEndpointsSensitiveData param by ctx (#85)

metlo-labs · Nov 8, 2022 · 3ff05fe · 3ff05fe
1 parent 10dd6ad
commit 3ff05fe
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 9 deletions.
diff --git a/backend/src/services/jobs/check-unauthenticated-endpoints.ts b/backend/src/services/jobs/check-unauthenticated-endpoints.ts
@@ -17,7 +17,7 @@ const checkForUnauthenticatedEndpoints = async (
     await queryRunner.connect()
     await queryRunner.query(updateUnauthenticatedEndpoints)
     const endpointsToAlert = await queryRunner.query(
-      getUnauthenticatedEndpointsSensitiveData,
+      getUnauthenticatedEndpointsSensitiveData(ctx),
       [
         DataSection.RESPONSE_BODY,
         DataTag.PII,

diff --git a/backend/src/services/jobs/queries.ts b/backend/src/services/jobs/queries.ts
@@ -1,3 +1,6 @@
+import { Alert, ApiEndpoint, DataField } from "models"
+import { MetloContext } from "types"
+
 export const aggregateTracesDataHourlyQuery = `
   INSERT INTO aggregate_trace_data_hourly ("apiEndpointUuid", "hour", "numCalls")
   SELECT
@@ -26,25 +29,23 @@ export const updateUnauthenticatedEndpoints = `
   )
 `
 
-export const getUnauthenticatedEndpointsSensitiveData = `
+export const getUnauthenticatedEndpointsSensitiveData = (ctx: MetloContext) => `
   With endpoints AS (
-    SELECT
+    SELECT DISTINCT
       endpoint.uuid,
       endpoint.path,
       endpoint.method,
       endpoint.host
     FROM
-      "api_endpoint" "endpoint"
-      LEFT JOIN "data_field" "field" ON "field" ."apiEndpointUuid" = "endpoint" ."uuid"
+      ${ApiEndpoint.getTableName(ctx)} "endpoint"
+      LEFT JOIN ${DataField.getTableName(ctx)} "field" ON "field" ."apiEndpointUuid" = "endpoint" ."uuid"
     WHERE
       (
         endpoint."isAuthenticatedDetected" = FALSE
         OR endpoint."isAuthenticatedUserSet" = FALSE
       )
       AND field."dataSection" = $1
       AND field."dataTag" = $2
-    GROUP BY
-      1
   )
   SELECT
     *
@@ -54,8 +55,7 @@ export const getUnauthenticatedEndpointsSensitiveData = `
     endpoints.uuid NOT IN (
       SELECT
         "apiEndpointUuid"
-      FROM
-        alert
+      FROM ${Alert.getTableName(ctx)} alert
       WHERE
         alert."apiEndpointUuid" = endpoints.uuid
         AND alert.type = $3