Merge branch 'main' into feat/team-autonomy-product-migration

backend/src/services/secret-folder/secret-folder-service.ts

@@ -2,9 +2,10 @@ import { ForbiddenError, subject } from "@casl/ability";
 import path from "path";
 import { v4 as uuidv4, validate as uuidValidate } from "uuid";
 
-import { TSecretFoldersInsert } from "@app/db/schemas";
+import { ActionProjectType, TSecretFolders, TSecretFoldersInsert } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
 import { PgSqlLock } from "@app/keystore/keystore";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -14,6 +15,7 @@ import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 import { ChangeType, CommitType, TFolderCommitServiceFactory } from "../folder-commit/folder-commit-service";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
+import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
 import {
   TCreateFolderDTO,
@@ -34,6 +36,8 @@ type TSecretFolderServiceFactoryDep = {
   folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestFolderVersions" | "create" | "insertMany" | "find">;
   folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
+  secretApprovalPolicyService: Pick<TSecretApprovalPolicyServiceFactory, "getSecretApprovalPolicy">;
+  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "findByFolderIds">;
 };
 
 export type TSecretFolderServiceFactory = ReturnType<typeof secretFolderServiceFactory>;
@@ -45,7 +49,9 @@ export const secretFolderServiceFactory = ({
   projectEnvDAL,
   folderVersionDAL,
   folderCommitService,
-  projectDAL
+  projectDAL,
+  secretApprovalPolicyService,
+  secretV2BridgeDAL
 }: TSecretFolderServiceFactoryDep) => {
   const createFolder = async ({
     projectId,
@@ -461,6 +467,66 @@ export const secretFolderServiceFactory = ({
     return { folder: newFolder, old: folder };
   };
 
+  const $checkFolderPolicy = async ({
+    projectId,
+    environment,
+    parentId
+  }: {
+    projectId: string;
+    environment: string;
+    parentId: string;
+  }) => {
+    // get environment root folder (as it's needed to get all folders under it)
+    const rootFolder = await folderDAL.findBySecretPath(projectId, environment, "/");
+    if (!rootFolder) throw new NotFoundError({ message: `Root folder not found` });
+    // get all folders under environment root folder
+    const folderPaths = await folderDAL.findByEnvsDeep({ parentIds: [rootFolder.id] });
+
+    // create a map of folders by parent id
+    const normalizeKey = (key: string | null | undefined): string => key ?? "root";
+    const folderMap = new Map<string, (TSecretFolders & { path: string; depth: number; environment: string })[]>();
+    for (const folder of folderPaths) {
+      if (!folderMap.has(normalizeKey(folder.parentId))) {
+        folderMap.set(normalizeKey(folder.parentId), []);
+      }
+      folderMap.get(normalizeKey(folder.parentId))?.push(folder);
+    }
+
+    // Recursively collect all folders under the given parentId
+    const collectDescendants = (
+      id: string
+    ): (TSecretFolders & { path: string; depth: number; environment: string })[] => {
+      const children = folderMap.get(normalizeKey(id)) || [];
+      return [...children, ...children.flatMap((child) => collectDescendants(child.id))];
+    };
+
+    const foldersUnderParent = collectDescendants(parentId);
+
+    const folderPolicyPaths = foldersUnderParent.map((folder) => ({
+      path: folder.path,
+      id: folder.id
+    }));
+
+    // get secrets under the given folders
+    const secrets = await secretV2BridgeDAL.findByFolderIds({ folderIds: folderPolicyPaths.map((p) => p.id) });
+    for await (const folderPolicyPath of folderPolicyPaths) {
+      // eslint-disable-next-line no-continue
+      if (!secrets.some((s) => s.folderId === folderPolicyPath.id)) continue;
+      const policy = await secretApprovalPolicyService.getSecretApprovalPolicy(
+        projectId,
+        environment,
+        folderPolicyPath.path
+      );
+      // if there is a policy and there are secrets under the given folder, throw error
+      if (policy) {
+        throw new BadRequestError({
+          message: `You cannot delete the selected folder because it contains one or more secrets that are protected by the change policy "${policy.name}" at folder path "${folderPolicyPath.path}". Please remove the secrets at folder path "${folderPolicyPath.path}" and try again.`,
+          name: "DeleteFolderProtectedByPolicy"
+        });
+      }
+    }
+  };
+
   const deleteFolder = async ({
     projectId,
     actor,
@@ -494,6 +560,8 @@ export const secretFolderServiceFactory = ({
           message: `Folder with path '${secretPath}' in environment with slug '${environment}' not found`
         });
 
+      await $checkFolderPolicy({ projectId, environment, parentId: parentFolder.id });
+
       const [doc] = await folderDAL.delete(
         {
           envId: env.id,

backend/src/services/super-admin/super-admin-service.ts

@@ -5,13 +5,7 @@ import jwt from "jsonwebtoken";
 import { IdentityAuthMethod, OrgMembershipRole, TSuperAdmin, TSuperAdminUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
-import {
-  getConfig,
-  getOriginalConfig,
-  overrideEnvConfig,
-  overwriteSchema,
-  validateOverrides
-} from "@app/lib/config/env";
+import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { generateUserSrpKeys, getUserPrivateKey } from "@app/lib/crypto/srp";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -39,7 +33,6 @@ import { TInvalidateCacheQueueFactory } from "./invalidate-cache-queue";
 import { TSuperAdminDALFactory } from "./super-admin-dal";
 import {
   CacheType,
-  EnvOverrides,
   LoginMethod,
   TAdminBootstrapInstanceDTO,
   TAdminGetIdentitiesDTO,
@@ -241,45 +234,6 @@ export const superAdminServiceFactory = ({
     adminIntegrationsConfig = config;
   };
 
-  const getEnvOverrides = async () => {
-    const serverCfg = await serverCfgDAL.findById(ADMIN_CONFIG_DB_UUID);
-
-    if (!serverCfg || !serverCfg.encryptedEnvOverrides) {
-      return {};
-    }
-
-    const decrypt = kmsService.decryptWithRootKey();
-
-    const overrides = JSON.parse(decrypt(serverCfg.encryptedEnvOverrides).toString()) as Record<string, string>;
-
-    return overrides;
-  };
-
-  const getEnvOverridesOrganized = async (): Promise<EnvOverrides> => {
-    const overrides = await getEnvOverrides();
-    const ogConfig = getOriginalConfig();
-
-    return Object.fromEntries(
-      Object.entries(overwriteSchema).map(([groupKey, groupDef]) => [
-        groupKey,
-        {
-          name: groupDef.name,
-          fields: groupDef.fields.map(({ key, description }) => ({
-            key,
-            description,
-            value: overrides[key] || "",
-            hasEnvEntry: !!(ogConfig as unknown as Record<string, string | undefined>)[key]
-          }))
-        }
-      ])
-    );
-  };
-
-  const $syncEnvConfig = async () => {
-    const config = await getEnvOverrides();
-    overrideEnvConfig(config);
-  };
-
   const updateServerCfg = async (
     data: TSuperAdminUpdate & {
       slackClientId?: string;
@@ -292,7 +246,6 @@ export const superAdminServiceFactory = ({
       gitHubAppConnectionSlug?: string;
       gitHubAppConnectionId?: string;
       gitHubAppConnectionPrivateKey?: string;
-      envOverrides?: Record<string, string>;
     },
     userId: string
   ) => {
@@ -421,17 +374,6 @@ export const superAdminServiceFactory = ({
       gitHubAppConnectionSettingsUpdated = true;
     }
 
-    let envOverridesUpdated = false;
-    if (data.envOverrides !== undefined) {
-      // Verify input format
-      validateOverrides(data.envOverrides);
-
-      const encryptedEnvOverrides = encryptWithRoot(Buffer.from(JSON.stringify(data.envOverrides)));
-      updatedData.encryptedEnvOverrides = encryptedEnvOverrides;
-      updatedData.envOverrides = undefined;
-      envOverridesUpdated = true;
-    }
-
     const updatedServerCfg = await serverCfgDAL.updateById(ADMIN_CONFIG_DB_UUID, updatedData);
 
     await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(updatedServerCfg));
@@ -440,10 +382,6 @@ export const superAdminServiceFactory = ({
       await $syncAdminIntegrationConfig();
     }
 
-    if (envOverridesUpdated) {
-      await $syncEnvConfig();
-    }
-
     if (
       updatedServerCfg.encryptedMicrosoftTeamsAppId &&
       updatedServerCfg.encryptedMicrosoftTeamsClientSecret &&
@@ -876,18 +814,6 @@ export const superAdminServiceFactory = ({
     return job;
   };
 
-  const initializeEnvConfigSync = async () => {
-    logger.info("Setting up background sync process for environment overrides");
-
-    await $syncEnvConfig();
-
-    // sync every 5 minutes
-    const job = new CronJob("*/5 * * * *", $syncEnvConfig);
-    job.start();
-
-    return job;
-  };
-
   return {
     initServerCfg,
     updateServerCfg,
@@ -907,9 +833,6 @@ export const superAdminServiceFactory = ({
     getOrganizations,
     deleteOrganization,
     deleteOrganizationMembership,
-    initializeAdminIntegrationConfigSync,
-    initializeEnvConfigSync,
-    getEnvOverrides,
-    getEnvOverridesOrganized
+    initializeAdminIntegrationConfigSync
   };
 };

backend/src/services/super-admin/super-admin-types.ts

@@ -1,5 +1,3 @@
-import { TEnvConfig } from "@app/lib/config/env";
-
 export type TAdminSignUpDTO = {
   email: string;
   password: string;
@@ -76,10 +74,3 @@ export type TAdminIntegrationConfig = {
     privateKey: string;
   };
 };
-
-export interface EnvOverrides {
-  [key: string]: {
-    name: string;
-    fields: { key: keyof TEnvConfig; value: string; hasEnvEntry: boolean; description?: string }[];
-  };
-}