Merge pull request #4714 from Infisical/feature/north-flank-app-connection

feature: Add Northflank app connection + secret sync

backend/src/services/app-connection/app-connection-enums.ts

@@ -38,7 +38,8 @@ export enum AppConnection {
   Netlify = "netlify",
   Okta = "okta",
   Redis = "redis",
-  LaravelForge = "laravel-forge"
+  LaravelForge = "laravel-forge",
+  Northflank = "northflank"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -113,6 +113,11 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
 import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
 import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
 import { getNetlifyConnectionListItem, validateNetlifyConnectionCredentials } from "./netlify";
+import {
+  getNorthflankConnectionListItem,
+  NorthflankConnectionMethod,
+  validateNorthflankConnectionCredentials
+} from "./northflank";
 import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
 import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
 import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
@@ -203,6 +208,7 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
     getSupabaseConnectionListItem(),
     getDigitalOceanConnectionListItem(),
     getNetlifyConnectionListItem(),
+    getNorthflankConnectionListItem(),
     getOktaConnectionListItem(),
     getRedisConnectionListItem()
   ]
@@ -332,8 +338,9 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Checkly]: validateChecklyConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Supabase]: validateSupabaseConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.DigitalOcean]: validateDigitalOceanConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Northflank]: validateNorthflankConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
@@ -376,6 +383,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case BitbucketConnectionMethod.ApiToken:
     case ZabbixConnectionMethod.ApiToken:
     case DigitalOceanConnectionMethod.ApiToken:
+    case NorthflankConnectionMethod.ApiToken:
     case OktaConnectionMethod.ApiToken:
     case LaravelForgeConnectionMethod.ApiToken:
       return "API Token";
@@ -472,6 +480,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.Supabase]: platformManagedCredentialsNotSupported,
   [AppConnection.DigitalOcean]: platformManagedCredentialsNotSupported,
   [AppConnection.Netlify]: platformManagedCredentialsNotSupported,
+  [AppConnection.Northflank]: platformManagedCredentialsNotSupported,
   [AppConnection.Okta]: platformManagedCredentialsNotSupported,
   [AppConnection.Redis]: platformManagedCredentialsNotSupported,
   [AppConnection.LaravelForge]: platformManagedCredentialsNotSupported

backend/src/services/app-connection/app-connection-maps.ts

@@ -40,7 +40,8 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.DigitalOcean]: "DigitalOcean App Platform",
   [AppConnection.Netlify]: "Netlify",
   [AppConnection.Okta]: "Okta",
-  [AppConnection.Redis]: "Redis"
+  [AppConnection.Redis]: "Redis",
+  [AppConnection.Northflank]: "Northflank"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -83,5 +84,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.DigitalOcean]: AppConnectionPlanType.Regular,
   [AppConnection.Netlify]: AppConnectionPlanType.Regular,
   [AppConnection.Okta]: AppConnectionPlanType.Regular,
-  [AppConnection.Redis]: AppConnectionPlanType.Regular
+  [AppConnection.Redis]: AppConnectionPlanType.Regular,
+  [AppConnection.Northflank]: AppConnectionPlanType.Regular
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -96,6 +96,8 @@ import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
 import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
 import { ValidateNetlifyConnectionCredentialsSchema } from "./netlify";
 import { netlifyConnectionService } from "./netlify/netlify-connection-service";
+import { ValidateNorthflankConnectionCredentialsSchema } from "./northflank";
+import { northflankConnectionService } from "./northflank/northflank-connection-service";
 import { ValidateOktaConnectionCredentialsSchema } from "./okta";
 import { oktaConnectionService } from "./okta/okta-connection-service";
 import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
@@ -170,6 +172,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.Supabase]: ValidateSupabaseConnectionCredentialsSchema,
   [AppConnection.DigitalOcean]: ValidateDigitalOceanConnectionCredentialsSchema,
   [AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
+  [AppConnection.Northflank]: ValidateNorthflankConnectionCredentialsSchema,
   [AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
   [AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema
 };
@@ -876,6 +879,7 @@ export const appConnectionServiceFactory = ({
     supabase: supabaseConnectionService(connectAppConnectionById),
     digitalOcean: digitalOceanAppPlatformConnectionService(connectAppConnectionById),
     netlify: netlifyConnectionService(connectAppConnectionById),
+    northflank: northflankConnectionService(connectAppConnectionById),
     okta: oktaConnectionService(connectAppConnectionById),
     laravelForge: laravelForgeConnectionService(connectAppConnectionById)
   };

backend/src/services/app-connection/app-connection-types.ts

@@ -168,6 +168,12 @@ import {
   TNetlifyConnectionInput,
   TValidateNetlifyConnectionCredentialsSchema
 } from "./netlify";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankConnectionInput,
+  TValidateNorthflankConnectionCredentialsSchema
+} from "./northflank";
 import {
   TOktaConnection,
   TOktaConnectionConfig,
@@ -273,6 +279,7 @@ export type TAppConnection = { id: string } & (
   | TSupabaseConnection
   | TDigitalOceanConnection
   | TNetlifyConnection
+  | TNorthflankConnection
   | TOktaConnection
   | TRedisConnection
 );
@@ -320,6 +327,7 @@ export type TAppConnectionInput = { id: string } & (
   | TSupabaseConnectionInput
   | TDigitalOceanConnectionInput
   | TNetlifyConnectionInput
+  | TNorthflankConnectionInput
   | TOktaConnectionInput
   | TRedisConnectionInput
 );
@@ -385,6 +393,7 @@ export type TAppConnectionConfig =
   | TSupabaseConnectionConfig
   | TDigitalOceanConnectionConfig
   | TNetlifyConnectionConfig
+  | TNorthflankConnectionConfig
   | TOktaConnectionConfig
   | TRedisConnectionConfig;
 
@@ -427,6 +436,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateSupabaseConnectionCredentialsSchema
   | TValidateDigitalOceanCredentialsSchema
   | TValidateNetlifyConnectionCredentialsSchema
+  | TValidateNorthflankConnectionCredentialsSchema
   | TValidateOktaConnectionCredentialsSchema
   | TValidateRedisConnectionCredentialsSchema;
 

backend/src/services/app-connection/northflank/index.ts

@@ -0,0 +1,5 @@
+export * from "./northflank-connection-enums";
+export * from "./northflank-connection-fns";
+export * from "./northflank-connection-schemas";
+export * from "./northflank-connection-service";
+export * from "./northflank-connection-types";

backend/src/services/app-connection/northflank/northflank-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum NorthflankConnectionMethod {
+  ApiToken = "api-token"
+}

backend/src/services/app-connection/northflank/northflank-connection-fns.ts

@@ -0,0 +1,114 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { BadRequestError } from "@app/lib/errors";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+import {
+  TNorthflankConnection,
+  TNorthflankConnectionConfig,
+  TNorthflankProject,
+  TNorthflankSecretGroup
+} from "./northflank-connection-types";
+
+const NORTHFLANK_API_URL = "https://api.northflank.com";
+
+export const getNorthflankConnectionListItem = () => {
+  return {
+    name: "Northflank" as const,
+    app: AppConnection.Northflank as const,
+    methods: Object.values(NorthflankConnectionMethod)
+  };
+};
+
+export const validateNorthflankConnectionCredentials = async (config: TNorthflankConnectionConfig) => {
+  const { credentials } = config;
+
+  try {
+    await request.get(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to validate Northflank credentials: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: `Failed to validate Northflank credentials - verify API token is correct`
+    });
+  }
+
+  return credentials;
+};
+
+export const listProjects = async (appConnection: TNorthflankConnection): Promise<TNorthflankProject[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { projects }
+      }
+    } = await request.get<{ data: { projects: TNorthflankProject[] } }>(`${NORTHFLANK_API_URL}/v1/projects`, {
+      headers: {
+        Authorization: `Bearer ${credentials.apiToken}`,
+        Accept: "application/json"
+      }
+    });
+
+    return projects;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank projects: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank projects",
+      error
+    });
+  }
+};
+
+export const listSecretGroups = async (
+  appConnection: TNorthflankConnection,
+  projectId: string
+): Promise<TNorthflankSecretGroup[]> => {
+  const { credentials } = appConnection;
+
+  try {
+    const {
+      data: {
+        data: { secrets }
+      }
+    } = await request.get<{ data: { secrets: TNorthflankSecretGroup[] } }>(
+      `${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets`,
+      {
+        headers: {
+          Authorization: `Bearer ${credentials.apiToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+
+    return secrets;
+  } catch (error: unknown) {
+    if (error instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to list Northflank secret groups: ${error.message || "Unknown error"}`
+      });
+    }
+
+    throw new BadRequestError({
+      message: "Unable to list Northflank secret groups",
+      error
+    });
+  }
+};

backend/src/services/app-connection/northflank/northflank-connection-schemas.ts

@@ -0,0 +1,60 @@
+import z from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { NorthflankConnectionMethod } from "./northflank-connection-enums";
+
+export const NorthflankConnectionApiTokenCredentialsSchema = z.object({
+  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.NORTHFLANK.apiToken)
+});
+
+const BaseNorthflankConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.Northflank)
+});
+
+export const NorthflankConnectionSchema = BaseNorthflankConnectionSchema.extend({
+  method: z.literal(NorthflankConnectionMethod.ApiToken),
+  credentials: NorthflankConnectionApiTokenCredentialsSchema
+});
+
+export const SanitizedNorthflankConnectionSchema = z.discriminatedUnion("method", [
+  BaseNorthflankConnectionSchema.extend({
+    method: z.literal(NorthflankConnectionMethod.ApiToken),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.pick({})
+  })
+]);
+
+export const ValidateNorthflankConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(NorthflankConnectionMethod.ApiToken)
+      .describe(AppConnections.CREATE(AppConnection.Northflank).method),
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.Northflank).credentials
+    )
+  })
+]);
+
+export const CreateNorthflankConnectionSchema = ValidateNorthflankConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.Northflank)
+);
+
+export const UpdateNorthflankConnectionSchema = z
+  .object({
+    credentials: NorthflankConnectionApiTokenCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.Northflank).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Northflank));
+
+export const NorthflankConnectionListItemSchema = z.object({
+  name: z.literal("Northflank"),
+  app: z.literal(AppConnection.Northflank),
+  methods: z.nativeEnum(NorthflankConnectionMethod).array()
+});

backend/src/services/app-connection/northflank/northflank-connection-service.ts

@@ -0,0 +1,50 @@
+import { logger } from "@app/lib/logger";
+import { OrgServiceActor } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  listProjects as getNorthflankProjects,
+  listSecretGroups as getNorthflankSecretGroups
+} from "./northflank-connection-fns";
+import { TNorthflankConnection, TNorthflankSecretGroup } from "./northflank-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TNorthflankConnection>;
+
+export const northflankConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
+  const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const projects = await getNorthflankProjects(appConnection);
+
+      return projects;
+    } catch (error) {
+      logger.error({ error, connectionId, actor: actor.type }, "Failed to establish connection with Northflank");
+      return [];
+    }
+  };
+
+  const listSecretGroups = async (
+    connectionId: string,
+    projectId: string,
+    actor: OrgServiceActor
+  ): Promise<TNorthflankSecretGroup[]> => {
+    const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
+    try {
+      const secretGroups = await getNorthflankSecretGroups(appConnection, projectId);
+
+      return secretGroups;
+    } catch (error) {
+      logger.error({ error, connectionId, projectId, actor: actor.type }, "Failed to list Northflank secret groups");
+      return [];
+    }
+  };
+
+  return {
+    listProjects,
+    listSecretGroups
+  };
+};

backend/src/services/app-connection/northflank/northflank-connection-types.ts

@@ -0,0 +1,35 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  CreateNorthflankConnectionSchema,
+  NorthflankConnectionSchema,
+  ValidateNorthflankConnectionCredentialsSchema
+} from "./northflank-connection-schemas";
+
+export type TNorthflankConnection = z.infer<typeof NorthflankConnectionSchema>;
+
+export type TNorthflankConnectionInput = z.infer<typeof CreateNorthflankConnectionSchema> & {
+  app: AppConnection.Northflank;
+};
+
+export type TValidateNorthflankConnectionCredentialsSchema = typeof ValidateNorthflankConnectionCredentialsSchema;
+
+export type TNorthflankConnectionConfig = DiscriminativePick<
+  TNorthflankConnection,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type TNorthflankProject = {
+  id: string;
+  name: string;
+};
+
+export type TNorthflankSecretGroup = {
+  id: string;
+  name: string;
+};