awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #4714 from Infisical/feature/north-flank-app-connection

Browse Source 
feature: Add Northflank app connection + secret sync
This commit is contained in:
Victor Hugo dos Santos
2025-10-31 08:37:28 -03:00
committed by GitHub
parent 6b54f296b1 062960c827
commit 07278e249f
94 changed files with 1571 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
backend/src/lib/api-docs/constants.ts
View File

@@ -2348,6 +2348,9 @@ export const AppConnections = {
RAILWAY: {
apiToken: "The API token used to authenticate with Railway."
},
NORTHFLANK: {
apiToken: "The API token used to authenticate with Northflank."
},
CHECKLY: {
apiKey: "The API key used to authenticate with Checkly."
},
@@ -2620,6 +2623,12 @@ export const SecretSyncs = {
siteName: "The name of the Netlify site to sync secrets to.",
siteId: "The ID of the Netlify site to sync secrets to.",
context: "The Netlify context to sync secrets to."
},
NORTHFLANK: {
projectId: "The ID of the Northflank project to sync secrets to.",
projectName: "The name of the Northflank project to sync secrets to.",
secretGroupId: "The ID of the Northflank secret group to sync secrets to.",
secretGroupName: "The name of the Northflank secret group to sync secrets to."
}
}
};

6
backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
View File

@@ -88,6 +88,10 @@ import {
NetlifyConnectionListItemSchema,
SanitizedNetlifyConnectionSchema
} from "@app/services/app-connection/netlify";
import {
NorthflankConnectionListItemSchema,
SanitizedNorthflankConnectionSchema
} from "@app/services/app-connection/northflank";
import { OktaConnectionListItemSchema, SanitizedOktaConnectionSchema } from "@app/services/app-connection/okta";
import {
PostgresConnectionListItemSchema,
@@ -160,6 +164,7 @@ const SanitizedAppConnectionSchema = z.union([
...SanitizedSupabaseConnectionSchema.options,
...SanitizedDigitalOceanConnectionSchema.options,
...SanitizedNetlifyConnectionSchema.options,
...SanitizedNorthflankConnectionSchema.options,
...SanitizedOktaConnectionSchema.options,
...SanitizedAzureADCSConnectionSchema.options,
...SanitizedRedisConnectionSchema.options,
@@ -203,6 +208,7 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
SupabaseConnectionListItemSchema,
DigitalOceanConnectionListItemSchema,
NetlifyConnectionListItemSchema,
NorthflankConnectionListItemSchema,
OktaConnectionListItemSchema,
AzureADCSConnectionListItemSchema,
RedisConnectionListItemSchema,

2
backend/src/server/routes/v1/app-connection-routers/index.ts
View File

@@ -29,6 +29,7 @@ import { registerLdapConnectionRouter } from "./ldap-connection-router";
import { registerMsSqlConnectionRouter } from "./mssql-connection-router";
import { registerMySqlConnectionRouter } from "./mysql-connection-router";
import { registerNetlifyConnectionRouter } from "./netlify-connection-router";
import { registerNorthflankConnectionRouter } from "./northflank-connection-router";
import { registerOktaConnectionRouter } from "./okta-connection-router";
import { registerPostgresConnectionRouter } from "./postgres-connection-router";
import { registerRailwayConnectionRouter } from "./railway-connection-router";
@@ -83,6 +84,7 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
[AppConnection.Supabase]: registerSupabaseConnectionRouter,
[AppConnection.DigitalOcean]: registerDigitalOceanConnectionRouter,
[AppConnection.Netlify]: registerNetlifyConnectionRouter,
[AppConnection.Northflank]: registerNorthflankConnectionRouter,
[AppConnection.Okta]: registerOktaConnectionRouter,
[AppConnection.Redis]: registerRedisConnectionRouter
};

87
backend/src/server/routes/v1/app-connection-routers/northflank-connection-router.ts Normal file
View File

@@ -0,0 +1,87 @@
import { z } from "zod";
import { readLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateNorthflankConnectionSchema,
SanitizedNorthflankConnectionSchema,
UpdateNorthflankConnectionSchema
} from "@app/services/app-connection/northflank";
import { AuthMode } from "@app/services/auth/auth-type";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerNorthflankConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.Northflank,
server,
sanitizedResponseSchema: SanitizedNorthflankConnectionSchema,
createSchema: CreateNorthflankConnectionSchema,
updateSchema: UpdateNorthflankConnectionSchema
});
// The below endpoints are not exposed and for Infisical App use
server.route({
method: "GET",
url: `/:connectionId/projects`,
config: {
rateLimit: readLimit
},
schema: {
params: z.object({
connectionId: z.string().uuid()
}),
response: {
200: z.object({
projects: z
.object({
name: z.string(),
id: z.string()
})
.array()
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { connectionId } = req.params;
const projects = await server.services.appConnection.northflank.listProjects(connectionId, req.permission);
return { projects };
}
});
server.route({
method: "GET",
url: `/:connectionId/projects/:projectId/secret-groups`,
config: {
rateLimit: readLimit
},
schema: {
params: z.object({
connectionId: z.string().uuid(),
projectId: z.string()
}),
response: {
200: z.object({
secretGroups: z
.object({
name: z.string(),
id: z.string()
})
.array()
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { connectionId, projectId } = req.params;
const secretGroups = await server.services.appConnection.northflank.listSecretGroups(
connectionId,
projectId,
req.permission
);
return { secretGroups };
}
});
};

2
backend/src/server/routes/v1/secret-sync-routers/index.ts
View File

@@ -23,6 +23,7 @@ import { registerHerokuSyncRouter } from "./heroku-sync-router";
import { registerHumanitecSyncRouter } from "./humanitec-sync-router";
import { registerLaravelForgeSyncRouter } from "./laravel-forge-sync-router";
import { registerNetlifySyncRouter } from "./netlify-sync-router";
import { registerNorthflankSyncRouter } from "./northflank-sync-router";
import { registerRailwaySyncRouter } from "./railway-sync-router";
import { registerRenderSyncRouter } from "./render-sync-router";
import { registerSupabaseSyncRouter } from "./supabase-sync-router";
@@ -64,6 +65,7 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
[SecretSync.Checkly]: registerChecklySyncRouter,
[SecretSync.DigitalOceanAppPlatform]: registerDigitalOceanAppPlatformSyncRouter,
[SecretSync.Netlify]: registerNetlifySyncRouter,
[SecretSync.Northflank]: registerNorthflankSyncRouter,
[SecretSync.Bitbucket]: registerBitbucketSyncRouter,
[SecretSync.LaravelForge]: registerLaravelForgeSyncRouter
};

17
backend/src/server/routes/v1/secret-sync-routers/northflank-sync-router.ts Normal file
View File

@@ -0,0 +1,17 @@
import {
CreateNorthflankSyncSchema,
NorthflankSyncSchema,
UpdateNorthflankSyncSchema
} from "@app/services/secret-sync/northflank";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
export const registerNorthflankSyncRouter = async (server: FastifyZodProvider) =>
registerSyncSecretsEndpoints({
destination: SecretSync.Northflank,
server,
responseSchema: NorthflankSyncSchema,
createSchema: CreateNorthflankSyncSchema,
updateSchema: UpdateNorthflankSyncSchema
});

3
backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts
View File

@@ -46,6 +46,7 @@ import { HerokuSyncListItemSchema, HerokuSyncSchema } from "@app/services/secret
import { HumanitecSyncListItemSchema, HumanitecSyncSchema } from "@app/services/secret-sync/humanitec";
import { LaravelForgeSyncListItemSchema, LaravelForgeSyncSchema } from "@app/services/secret-sync/laravel-forge";
import { NetlifySyncListItemSchema, NetlifySyncSchema } from "@app/services/secret-sync/netlify";
import { NorthflankSyncListItemSchema, NorthflankSyncSchema } from "@app/services/secret-sync/northflank";
import { RailwaySyncListItemSchema, RailwaySyncSchema } from "@app/services/secret-sync/railway/railway-sync-schemas";
import { RenderSyncListItemSchema, RenderSyncSchema } from "@app/services/secret-sync/render/render-sync-schemas";
import { SupabaseSyncListItemSchema, SupabaseSyncSchema } from "@app/services/secret-sync/supabase";
@@ -85,6 +86,7 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
ChecklySyncSchema,
DigitalOceanAppPlatformSyncSchema,
NetlifySyncSchema,
NorthflankSyncSchema,
BitbucketSyncSchema,
LaravelForgeSyncSchema
]);
@@ -119,6 +121,7 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
ChecklySyncListItemSchema,
SupabaseSyncListItemSchema,
NetlifySyncListItemSchema,
NorthflankSyncListItemSchema,
BitbucketSyncListItemSchema,
LaravelForgeSyncListItemSchema
]);

3
backend/src/services/app-connection/app-connection-enums.ts
View File

@@ -38,7 +38,8 @@ export enum AppConnection {
Netlify = "netlify",
Okta = "okta",
Redis = "redis",
LaravelForge = "laravel-forge"
LaravelForge = "laravel-forge",
Northflank = "northflank"
}
export enum AWSRegion {

11
backend/src/services/app-connection/app-connection-fns.ts
View File

@@ -113,6 +113,11 @@ import { getMsSqlConnectionListItem, MsSqlConnectionMethod } from "./mssql";
import { MySqlConnectionMethod } from "./mysql/mysql-connection-enums";
import { getMySqlConnectionListItem } from "./mysql/mysql-connection-fns";
import { getNetlifyConnectionListItem, validateNetlifyConnectionCredentials } from "./netlify";
import {
getNorthflankConnectionListItem,
NorthflankConnectionMethod,
validateNorthflankConnectionCredentials
} from "./northflank";
import { getOktaConnectionListItem, OktaConnectionMethod, validateOktaConnectionCredentials } from "./okta";
import { getPostgresConnectionListItem, PostgresConnectionMethod } from "./postgres";
import { getRailwayConnectionListItem, validateRailwayConnectionCredentials } from "./railway";
@@ -203,6 +208,7 @@ export const listAppConnectionOptions = (projectType?: ProjectType) => {
getSupabaseConnectionListItem(),
getDigitalOceanConnectionListItem(),
getNetlifyConnectionListItem(),
getNorthflankConnectionListItem(),
getOktaConnectionListItem(),
getRedisConnectionListItem()
]
@@ -332,8 +338,9 @@ export const validateAppConnectionCredentials = async (
[AppConnection.Checkly]: validateChecklyConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Supabase]: validateSupabaseConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.DigitalOcean]: validateDigitalOceanConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Netlify]: validateNetlifyConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Northflank]: validateNorthflankConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Okta]: validateOktaConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Redis]: validateRedisConnectionCredentials as TAppConnectionCredentialsValidator
};
@@ -376,6 +383,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
case BitbucketConnectionMethod.ApiToken:
case ZabbixConnectionMethod.ApiToken:
case DigitalOceanConnectionMethod.ApiToken:
case NorthflankConnectionMethod.ApiToken:
case OktaConnectionMethod.ApiToken:
case LaravelForgeConnectionMethod.ApiToken:
return "API Token";
@@ -472,6 +480,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
[AppConnection.Supabase]: platformManagedCredentialsNotSupported,
[AppConnection.DigitalOcean]: platformManagedCredentialsNotSupported,
[AppConnection.Netlify]: platformManagedCredentialsNotSupported,
[AppConnection.Northflank]: platformManagedCredentialsNotSupported,
[AppConnection.Okta]: platformManagedCredentialsNotSupported,
[AppConnection.Redis]: platformManagedCredentialsNotSupported,
[AppConnection.LaravelForge]: platformManagedCredentialsNotSupported

6
backend/src/services/app-connection/app-connection-maps.ts
View File

@@ -40,7 +40,8 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
[AppConnection.DigitalOcean]: "DigitalOcean App Platform",
[AppConnection.Netlify]: "Netlify",
[AppConnection.Okta]: "Okta",
[AppConnection.Redis]: "Redis"
[AppConnection.Redis]: "Redis",
[AppConnection.Northflank]: "Northflank"
};
export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -83,5 +84,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
[AppConnection.DigitalOcean]: AppConnectionPlanType.Regular,
[AppConnection.Netlify]: AppConnectionPlanType.Regular,
[AppConnection.Okta]: AppConnectionPlanType.Regular,
[AppConnection.Redis]: AppConnectionPlanType.Regular
[AppConnection.Redis]: AppConnectionPlanType.Regular,
[AppConnection.Northflank]: AppConnectionPlanType.Regular
};

4
backend/src/services/app-connection/app-connection-service.ts
View File

@@ -96,6 +96,8 @@ import { ValidateMsSqlConnectionCredentialsSchema } from "./mssql";
import { ValidateMySqlConnectionCredentialsSchema } from "./mysql";
import { ValidateNetlifyConnectionCredentialsSchema } from "./netlify";
import { netlifyConnectionService } from "./netlify/netlify-connection-service";
import { ValidateNorthflankConnectionCredentialsSchema } from "./northflank";
import { northflankConnectionService } from "./northflank/northflank-connection-service";
import { ValidateOktaConnectionCredentialsSchema } from "./okta";
import { oktaConnectionService } from "./okta/okta-connection-service";
import { ValidatePostgresConnectionCredentialsSchema } from "./postgres";
@@ -170,6 +172,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
[AppConnection.Supabase]: ValidateSupabaseConnectionCredentialsSchema,
[AppConnection.DigitalOcean]: ValidateDigitalOceanConnectionCredentialsSchema,
[AppConnection.Netlify]: ValidateNetlifyConnectionCredentialsSchema,
[AppConnection.Northflank]: ValidateNorthflankConnectionCredentialsSchema,
[AppConnection.Okta]: ValidateOktaConnectionCredentialsSchema,
[AppConnection.Redis]: ValidateRedisConnectionCredentialsSchema
};
@@ -876,6 +879,7 @@ export const appConnectionServiceFactory = ({
supabase: supabaseConnectionService(connectAppConnectionById),
digitalOcean: digitalOceanAppPlatformConnectionService(connectAppConnectionById),
netlify: netlifyConnectionService(connectAppConnectionById),
northflank: northflankConnectionService(connectAppConnectionById),
okta: oktaConnectionService(connectAppConnectionById),
laravelForge: laravelForgeConnectionService(connectAppConnectionById)
};

10
backend/src/services/app-connection/app-connection-types.ts
View File

@@ -168,6 +168,12 @@ import {
TNetlifyConnectionInput,
TValidateNetlifyConnectionCredentialsSchema
} from "./netlify";
import {
TNorthflankConnection,
TNorthflankConnectionConfig,
TNorthflankConnectionInput,
TValidateNorthflankConnectionCredentialsSchema
} from "./northflank";
import {
TOktaConnection,
TOktaConnectionConfig,
@@ -273,6 +279,7 @@ export type TAppConnection = { id: string } & (
| TSupabaseConnection
| TDigitalOceanConnection
| TNetlifyConnection
| TNorthflankConnection
| TOktaConnection
| TRedisConnection
);
@@ -320,6 +327,7 @@ export type TAppConnectionInput = { id: string } & (
| TSupabaseConnectionInput
| TDigitalOceanConnectionInput
| TNetlifyConnectionInput
| TNorthflankConnectionInput
| TOktaConnectionInput
| TRedisConnectionInput
);
@@ -385,6 +393,7 @@ export type TAppConnectionConfig =
| TSupabaseConnectionConfig
| TDigitalOceanConnectionConfig
| TNetlifyConnectionConfig
| TNorthflankConnectionConfig
| TOktaConnectionConfig
| TRedisConnectionConfig;
@@ -427,6 +436,7 @@ export type TValidateAppConnectionCredentialsSchema =
| TValidateSupabaseConnectionCredentialsSchema
| TValidateDigitalOceanCredentialsSchema
| TValidateNetlifyConnectionCredentialsSchema
| TValidateNorthflankConnectionCredentialsSchema
| TValidateOktaConnectionCredentialsSchema
| TValidateRedisConnectionCredentialsSchema;

5
backend/src/services/app-connection/northflank/index.ts Normal file
View File

@@ -0,0 +1,5 @@
export * from "./northflank-connection-enums";
export * from "./northflank-connection-fns";
export * from "./northflank-connection-schemas";
export * from "./northflank-connection-service";
export * from "./northflank-connection-types";

3
backend/src/services/app-connection/northflank/northflank-connection-enums.ts Normal file
View File

@@ -0,0 +1,3 @@
export enum NorthflankConnectionMethod {
ApiToken = "api-token"
}

114
backend/src/services/app-connection/northflank/northflank-connection-fns.ts Normal file
View File

@@ -0,0 +1,114 @@
import { AxiosError } from "axios";
import { request } from "@app/lib/config/request";
import { BadRequestError } from "@app/lib/errors";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { NorthflankConnectionMethod } from "./northflank-connection-enums";
import {
TNorthflankConnection,
TNorthflankConnectionConfig,
TNorthflankProject,
TNorthflankSecretGroup
} from "./northflank-connection-types";
const NORTHFLANK_API_URL = "https://api.northflank.com";
export const getNorthflankConnectionListItem = () => {
return {
name: "Northflank" as const,
app: AppConnection.Northflank as const,
methods: Object.values(NorthflankConnectionMethod)
};
};
export const validateNorthflankConnectionCredentials = async (config: TNorthflankConnectionConfig) => {
const { credentials } = config;
try {
await request.get(`${NORTHFLANK_API_URL}/v1/projects`, {
headers: {
Authorization: `Bearer ${credentials.apiToken}`,
Accept: "application/json"
}
});
} catch (error: unknown) {
if (error instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to validate Northflank credentials: ${error.message || "Unknown error"}`
});
}
throw new BadRequestError({
message: `Failed to validate Northflank credentials - verify API token is correct`
});
}
return credentials;
};
export const listProjects = async (appConnection: TNorthflankConnection): Promise<TNorthflankProject[]> => {
const { credentials } = appConnection;
try {
const {
data: {
data: { projects }
}
} = await request.get<{ data: { projects: TNorthflankProject[] } }>(`${NORTHFLANK_API_URL}/v1/projects`, {
headers: {
Authorization: `Bearer ${credentials.apiToken}`,
Accept: "application/json"
}
});
return projects;
} catch (error: unknown) {
if (error instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to list Northflank projects: ${error.message || "Unknown error"}`
});
}
throw new BadRequestError({
message: "Unable to list Northflank projects",
error
});
}
};
export const listSecretGroups = async (
appConnection: TNorthflankConnection,
projectId: string
): Promise<TNorthflankSecretGroup[]> => {
const { credentials } = appConnection;
try {
const {
data: {
data: { secrets }
}
} = await request.get<{ data: { secrets: TNorthflankSecretGroup[] } }>(
`${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets`,
{
headers: {
Authorization: `Bearer ${credentials.apiToken}`,
Accept: "application/json"
}
}
);
return secrets;
} catch (error: unknown) {
if (error instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to list Northflank secret groups: ${error.message || "Unknown error"}`
});
}
throw new BadRequestError({
message: "Unable to list Northflank secret groups",
error
});
}
};

60
backend/src/services/app-connection/northflank/northflank-connection-schemas.ts Normal file
View File

@@ -0,0 +1,60 @@
import z from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { NorthflankConnectionMethod } from "./northflank-connection-enums";
export const NorthflankConnectionApiTokenCredentialsSchema = z.object({
apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.NORTHFLANK.apiToken)
});
const BaseNorthflankConnectionSchema = BaseAppConnectionSchema.extend({
app: z.literal(AppConnection.Northflank)
});
export const NorthflankConnectionSchema = BaseNorthflankConnectionSchema.extend({
method: z.literal(NorthflankConnectionMethod.ApiToken),
credentials: NorthflankConnectionApiTokenCredentialsSchema
});
export const SanitizedNorthflankConnectionSchema = z.discriminatedUnion("method", [
BaseNorthflankConnectionSchema.extend({
method: z.literal(NorthflankConnectionMethod.ApiToken),
credentials: NorthflankConnectionApiTokenCredentialsSchema.pick({})
})
]);
export const ValidateNorthflankConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(NorthflankConnectionMethod.ApiToken)
.describe(AppConnections.CREATE(AppConnection.Northflank).method),
credentials: NorthflankConnectionApiTokenCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.Northflank).credentials
)
})
]);
export const CreateNorthflankConnectionSchema = ValidateNorthflankConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.Northflank)
);
export const UpdateNorthflankConnectionSchema = z
.object({
credentials: NorthflankConnectionApiTokenCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.Northflank).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Northflank));
export const NorthflankConnectionListItemSchema = z.object({
name: z.literal("Northflank"),
app: z.literal(AppConnection.Northflank),
methods: z.nativeEnum(NorthflankConnectionMethod).array()
});

50
backend/src/services/app-connection/northflank/northflank-connection-service.ts Normal file
View File

@@ -0,0 +1,50 @@
import { logger } from "@app/lib/logger";
import { OrgServiceActor } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
listProjects as getNorthflankProjects,
listSecretGroups as getNorthflankSecretGroups
} from "./northflank-connection-fns";
import { TNorthflankConnection, TNorthflankSecretGroup } from "./northflank-connection-types";
type TGetAppConnectionFunc = (
app: AppConnection,
connectionId: string,
actor: OrgServiceActor
) => Promise<TNorthflankConnection>;
export const northflankConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
try {
const projects = await getNorthflankProjects(appConnection);
return projects;
} catch (error) {
logger.error({ error, connectionId, actor: actor.type }, "Failed to establish connection with Northflank");
return [];
}
};
const listSecretGroups = async (
connectionId: string,
projectId: string,
actor: OrgServiceActor
): Promise<TNorthflankSecretGroup[]> => {
const appConnection = await getAppConnection(AppConnection.Northflank, connectionId, actor);
try {
const secretGroups = await getNorthflankSecretGroups(appConnection, projectId);
return secretGroups;
} catch (error) {
logger.error({ error, connectionId, projectId, actor: actor.type }, "Failed to list Northflank secret groups");
return [];
}
};
return {
listProjects,
listSecretGroups
};
};

35
backend/src/services/app-connection/northflank/northflank-connection-types.ts Normal file
View File

@@ -0,0 +1,35 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
CreateNorthflankConnectionSchema,
NorthflankConnectionSchema,
ValidateNorthflankConnectionCredentialsSchema
} from "./northflank-connection-schemas";
export type TNorthflankConnection = z.infer<typeof NorthflankConnectionSchema>;
export type TNorthflankConnectionInput = z.infer<typeof CreateNorthflankConnectionSchema> & {
app: AppConnection.Northflank;
};
export type TValidateNorthflankConnectionCredentialsSchema = typeof ValidateNorthflankConnectionCredentialsSchema;
export type TNorthflankConnectionConfig = DiscriminativePick<
TNorthflankConnection,
"method" | "app" | "credentials"
> & {
orgId: string;
};
export type TNorthflankProject = {
id: string;
name: string;
};
export type TNorthflankSecretGroup = {
id: string;
name: string;
};

4
backend/src/services/secret-sync/northflank/index.ts Normal file
View File

@@ -0,0 +1,4 @@
export * from "./northflank-sync-constants";
export * from "./northflank-sync-fns";
export * from "./northflank-sync-schemas";
export * from "./northflank-sync-types";

10
backend/src/services/secret-sync/northflank/northflank-sync-constants.ts Normal file
View File

@@ -0,0 +1,10 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
export const NORTHFLANK_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Northflank",
destination: SecretSync.Northflank,
connection: AppConnection.Northflank,
canImportSecrets: true
};

165
backend/src/services/secret-sync/northflank/northflank-sync-fns.ts Normal file
View File

@@ -0,0 +1,165 @@
import { AxiosError } from "axios";
import { request } from "@app/lib/config/request";
import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
import { SecretSyncError } from "../secret-sync-errors";
import { TNorthflankSyncWithCredentials } from "./northflank-sync-types";
const NORTHFLANK_API_URL = "https://api.northflank.com";
const buildNorthflankAPIErrorMessage = (error: unknown): string => {
let errorMessage = "Northflank API returned an error.";
if (error && typeof error === "object" && "response" in error) {
const axiosError = error as AxiosError;
if (axiosError.response?.data) {
// This is the shape of the error response from the Northflank API
const responseData = axiosError.response.data as {
error?: { message?: string; details?: Record<string, string[]> };
message?: string;
};
const errorParts = [];
if (responseData.error?.message) {
errorParts.push(responseData.error.message);
} else if (responseData.message) {
errorParts.push(responseData.message);
}
if (responseData.error?.details) {
const { details } = responseData.error;
// Flatten the details object into a string
Object.entries(details).forEach(([field, fieldErrors]) => {
if (Array.isArray(fieldErrors)) {
fieldErrors.forEach((fieldError) => errorParts.push(`${field}: ${fieldError}`));
} else {
errorParts.push(`${field}: ${String(fieldErrors)}`);
}
});
}
errorMessage += ` ${errorParts.join(". ")}`;
}
}
return errorMessage;
};
const getNorthflankSecrets = async (secretSync: TNorthflankSyncWithCredentials): Promise<Record<string, string>> => {
const {
destinationConfig: { projectId, secretGroupId },
connection: {
credentials: { apiToken }
}
} = secretSync;
try {
const {
data: {
data: {
secrets: { variables }
}
}
} = await request.get<{
data: {
secrets: {
variables: Record<string, string>;
};
};
}>(`${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}/details`, {
headers: {
Authorization: `Bearer ${apiToken}`,
Accept: "application/json"
}
});
return variables;
} catch (error: unknown) {
throw new SecretSyncError({
error,
message: `Failed to fetch Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
});
}
};
const updateNorthflankSecrets = async (
secretSync: TNorthflankSyncWithCredentials,
variables: Record<string, string>
): Promise<void> => {
const {
destinationConfig: { projectId, secretGroupId },
connection: {
credentials: { apiToken }
}
} = secretSync;
try {
await request.patch(
`${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}`,
{
secrets: {
variables
}
},
{
headers: {
Authorization: `Bearer ${apiToken}`,
Accept: "application/json"
}
}
);
} catch (error: unknown) {
throw new SecretSyncError({
error,
message: `Failed to update Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
});
}
};
export const NorthflankSyncFns = {
syncSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
const northflankSecrets = await getNorthflankSecrets(secretSync);
const updatedVariables: Record<string, string> = {};
for (const [key, value] of Object.entries(northflankSecrets)) {
const shouldKeep =
!secretMap[key] && // this prevents duplicates from infisical secrets, because we add all of them to the updateVariables in the next loop
(secretSync.syncOptions.disableSecretDeletion ||
!matchesSchema(key, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema));
if (shouldKeep) {
updatedVariables[key] = value;
}
}
for (const [key, { value }] of Object.entries(secretMap)) {
updatedVariables[key] = value;
}
await updateNorthflankSecrets(secretSync, updatedVariables);
},
getSecrets: async (secretSync: TNorthflankSyncWithCredentials): Promise<TSecretMap> => {
const northflankSecrets = await getNorthflankSecrets(secretSync);
return Object.fromEntries(Object.entries(northflankSecrets).map(([key, value]) => [key, { value }]));
},
removeSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
const northflankSecrets = await getNorthflankSecrets(secretSync);
const updatedVariables: Record<string, string> = {};
for (const [key, value] of Object.entries(northflankSecrets)) {
if (!(key in secretMap)) {
updatedVariables[key] = value;
}
}
await updateNorthflankSecrets(secretSync, updatedVariables);
}
};

54
backend/src/services/secret-sync/northflank/northflank-sync-schemas.ts Normal file
View File

@@ -0,0 +1,54 @@
import { z } from "zod";
import { SecretSyncs } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import {
BaseSecretSyncSchema,
GenericCreateSecretSyncFieldsSchema,
GenericUpdateSecretSyncFieldsSchema
} from "@app/services/secret-sync/secret-sync-schemas";
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
const NorthflankSyncDestinationConfigSchema = z.object({
projectId: z
.string()
.trim()
.min(1, "Project ID is required")
.describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectId),
projectName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectName),
secretGroupId: z
.string()
.trim()
.min(1, "Secret Group ID is required")
.describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupId),
secretGroupName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupName)
});
const NorthflankSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
export const NorthflankSyncSchema = BaseSecretSyncSchema(SecretSync.Northflank, NorthflankSyncOptionsConfig).extend({
destination: z.literal(SecretSync.Northflank),
destinationConfig: NorthflankSyncDestinationConfigSchema
});
export const CreateNorthflankSyncSchema = GenericCreateSecretSyncFieldsSchema(
SecretSync.Northflank,
NorthflankSyncOptionsConfig
).extend({
destinationConfig: NorthflankSyncDestinationConfigSchema
});
export const UpdateNorthflankSyncSchema = GenericUpdateSecretSyncFieldsSchema(
SecretSync.Northflank,
NorthflankSyncOptionsConfig
).extend({
destinationConfig: NorthflankSyncDestinationConfigSchema.optional()
});
export const NorthflankSyncListItemSchema = z.object({
name: z.literal("Northflank"),
connection: z.literal(AppConnection.Northflank),
destination: z.literal(SecretSync.Northflank),
canImportSecrets: z.literal(true)
});

19
backend/src/services/secret-sync/northflank/northflank-sync-types.ts Normal file
View File

@@ -0,0 +1,19 @@
import { z } from "zod";
import { TNorthflankConnection } from "@app/services/app-connection/northflank";
import {
CreateNorthflankSyncSchema,
NorthflankSyncListItemSchema,
NorthflankSyncSchema
} from "./northflank-sync-schemas";
export type TNorthflankSyncListItem = z.infer<typeof NorthflankSyncListItemSchema>;
export type TNorthflankSync = z.infer<typeof NorthflankSyncSchema>;
export type TNorthflankSyncInput = z.infer<typeof CreateNorthflankSyncSchema>;
export type TNorthflankSyncWithCredentials = TNorthflankSync & {
connection: TNorthflankConnection;
};

1
backend/src/services/secret-sync/secret-sync-enums.ts
View File

@@ -28,6 +28,7 @@ export enum SecretSync {
Checkly = "checkly",
DigitalOceanAppPlatform = "digital-ocean-app-platform",
Netlify = "netlify",
Northflank = "northflank",
Bitbucket = "bitbucket",
LaravelForge = "laravel-forge"
}

9
backend/src/services/secret-sync/secret-sync-fns.ts
View File

@@ -52,6 +52,7 @@ import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
import { LARAVEL_FORGE_SYNC_LIST_OPTION } from "./laravel-forge";
import { LaravelForgeSyncFns } from "./laravel-forge/laravel-forge-sync-fns";
import { NETLIFY_SYNC_LIST_OPTION, NetlifySyncFns } from "./netlify";
import { NORTHFLANK_SYNC_LIST_OPTION, NorthflankSyncFns } from "./northflank";
import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
import { RailwaySyncFns } from "./railway/railway-sync-fns";
import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
@@ -93,6 +94,7 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
[SecretSync.Checkly]: CHECKLY_SYNC_LIST_OPTION,
[SecretSync.DigitalOceanAppPlatform]: DIGITAL_OCEAN_APP_PLATFORM_SYNC_LIST_OPTION,
[SecretSync.Netlify]: NETLIFY_SYNC_LIST_OPTION,
[SecretSync.Northflank]: NORTHFLANK_SYNC_LIST_OPTION,
[SecretSync.Bitbucket]: BITBUCKET_SYNC_LIST_OPTION,
[SecretSync.LaravelForge]: LARAVEL_FORGE_SYNC_LIST_OPTION
};
@@ -278,6 +280,8 @@ export const SecretSyncFns = {
return DigitalOceanAppPlatformSyncFns.syncSecrets(secretSync, schemaSecretMap);
case SecretSync.Netlify:
return NetlifySyncFns.syncSecrets(secretSync, schemaSecretMap);
case SecretSync.Northflank:
return NorthflankSyncFns.syncSecrets(secretSync, schemaSecretMap);
case SecretSync.Bitbucket:
return BitbucketSyncFns.syncSecrets(secretSync, schemaSecretMap);
case SecretSync.LaravelForge:
@@ -395,6 +399,9 @@ export const SecretSyncFns = {
case SecretSync.Netlify:
secretMap = await NetlifySyncFns.getSecrets(secretSync);
break;
case SecretSync.Northflank:
secretMap = await NorthflankSyncFns.getSecrets(secretSync);
break;
case SecretSync.Bitbucket:
secretMap = await BitbucketSyncFns.getSecrets(secretSync);
break;
@@ -492,6 +499,8 @@ export const SecretSyncFns = {
return DigitalOceanAppPlatformSyncFns.removeSecrets(secretSync, schemaSecretMap);
case SecretSync.Netlify:
return NetlifySyncFns.removeSecrets(secretSync, schemaSecretMap);
case SecretSync.Northflank:
return NorthflankSyncFns.removeSecrets(secretSync, schemaSecretMap);
case SecretSync.Bitbucket:
return BitbucketSyncFns.removeSecrets(secretSync, schemaSecretMap);
case SecretSync.LaravelForge:

5
backend/src/services/secret-sync/secret-sync-maps.ts
View File

@@ -32,6 +32,7 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
[SecretSync.Checkly]: "Checkly",
[SecretSync.DigitalOceanAppPlatform]: "Digital Ocean App Platform",
[SecretSync.Netlify]: "Netlify",
[SecretSync.Northflank]: "Northflank",
[SecretSync.Bitbucket]: "Bitbucket",
[SecretSync.LaravelForge]: "Laravel Forge"
};
@@ -66,6 +67,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.Checkly]: AppConnection.Checkly,
[SecretSync.DigitalOceanAppPlatform]: AppConnection.DigitalOcean,
[SecretSync.Netlify]: AppConnection.Netlify,
[SecretSync.Northflank]: AppConnection.Northflank,
[SecretSync.Bitbucket]: AppConnection.Bitbucket,
[SecretSync.LaravelForge]: AppConnection.LaravelForge
};
@@ -100,6 +102,7 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
[SecretSync.Checkly]: SecretSyncPlanType.Regular,
[SecretSync.DigitalOceanAppPlatform]: SecretSyncPlanType.Regular,
[SecretSync.Netlify]: SecretSyncPlanType.Regular,
[SecretSync.Northflank]: SecretSyncPlanType.Regular,
[SecretSync.Bitbucket]: SecretSyncPlanType.Regular,
[SecretSync.LaravelForge]: SecretSyncPlanType.Regular
};
@@ -143,6 +146,7 @@ export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
[SecretSync.Checkly]: ["groupName", "accountName"],
[SecretSync.DigitalOceanAppPlatform]: ["appName"],
[SecretSync.Netlify]: ["accountName", "siteName"],
[SecretSync.Northflank]: [],
[SecretSync.Bitbucket]: [],
[SecretSync.LaravelForge]: []
};
@@ -203,6 +207,7 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
[SecretSync.Checkly]: defaultDuplicateCheck,
[SecretSync.DigitalOceanAppPlatform]: defaultDuplicateCheck,
[SecretSync.Netlify]: defaultDuplicateCheck,
[SecretSync.Northflank]: defaultDuplicateCheck,
[SecretSync.Bitbucket]: defaultDuplicateCheck,
[SecretSync.LaravelForge]: defaultDuplicateCheck
};

10
backend/src/services/secret-sync/secret-sync-types.ts
View File

@@ -124,6 +124,12 @@ import {
TLaravelForgeSyncWithCredentials
} from "./laravel-forge";
import { TNetlifySync, TNetlifySyncInput, TNetlifySyncListItem, TNetlifySyncWithCredentials } from "./netlify";
import {
TNorthflankSync,
TNorthflankSyncInput,
TNorthflankSyncListItem,
TNorthflankSyncWithCredentials
} from "./northflank";
import {
TRailwaySync,
TRailwaySyncInput,
@@ -187,6 +193,7 @@ export type TSecretSync =
| TChecklySync
| TSupabaseSync
| TNetlifySync
| TNorthflankSync
| TBitbucketSync;
export type TSecretSyncWithCredentials =
@@ -219,6 +226,7 @@ export type TSecretSyncWithCredentials =
| TSupabaseSyncWithCredentials
| TDigitalOceanAppPlatformSyncWithCredentials
| TNetlifySyncWithCredentials
| TNorthflankSyncWithCredentials
| TBitbucketSyncWithCredentials
| TLaravelForgeSyncWithCredentials;
@@ -252,6 +260,7 @@ export type TSecretSyncInput =
| TSupabaseSyncInput
| TDigitalOceanAppPlatformSyncInput
| TNetlifySyncInput
| TNorthflankSyncInput
| TBitbucketSyncInput
| TLaravelForgeSyncInput;
@@ -286,6 +295,7 @@ export type TSecretSyncListItem =
| TSupabaseSyncListItem
| TDigitalOceanAppPlatformSyncListItem
| TNetlifySyncListItem
| TNorthflankSyncListItem
| TBitbucketSyncListItem;
export type TSyncOptionsConfig = {

4
docs/api-reference/endpoints/app-connections/northflank/available.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Available"
openapi: "GET /api/v1/app-connections/northflank/available"
---

8
docs/api-reference/endpoints/app-connections/northflank/create.mdx Normal file
View File

@@ -0,0 +1,8 @@
---
title: "Create"
openapi: "POST /api/v1/app-connections/northflank"
---
<Note>
Check out the configuration docs for [Northflank Connections](/integrations/app-connections/northflank) to learn how to obtain the required credentials.
</Note>

4
docs/api-reference/endpoints/app-connections/northflank/delete.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/app-connections/northflank/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/northflank/get-by-id.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by ID"
openapi: "GET /api/v1/app-connections/northflank/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/northflank/get-by-name.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by Name"
openapi: "GET /api/v1/app-connections/northflank/connection-name/{connectionName}"
---

4
docs/api-reference/endpoints/app-connections/northflank/list.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/app-connections/northflank"
---

4
docs/api-reference/endpoints/app-connections/northflank/update.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Update"
openapi: "PATCH /api/v1/app-connections/northflank/{connectionId}"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/create.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Create"
openapi: "POST /api/v1/secret-syncs/northflank"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/delete.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/secret-syncs/northflank/{syncId}"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/get-by-id.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by ID"
openapi: "GET /api/v1/secret-syncs/northflank/{syncId}"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/get-by-name.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by Name"
openapi: "GET /api/v1/secret-syncs/northflank/sync-name/{syncName}"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/import-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Import Secrets"
openapi: "POST /api/v1/secret-syncs/northflank/{syncId}/import-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/list.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/secret-syncs/northflank"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/remove-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Remove Secrets"
openapi: "POST /api/v1/secret-syncs/northflank/{syncId}/remove-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/sync-secrets.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Sync Secrets"
openapi: "POST /api/v1/secret-syncs/northflank/{syncId}/sync-secrets"
---

4
docs/api-reference/endpoints/secret-syncs/northflank/update.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Update"
openapi: "PATCH /api/v1/secret-syncs/northflank/{syncId}"
---

28
docs/docs.json
View File

@@ -130,6 +130,7 @@
"integrations/app-connections/mssql",
"integrations/app-connections/mysql",
"integrations/app-connections/netlify",
"integrations/app-connections/northflank",
"integrations/app-connections/oci",
"integrations/app-connections/okta",
"integrations/app-connections/oracledb",
@@ -552,6 +553,7 @@
"integrations/secret-syncs/humanitec",
"integrations/secret-syncs/laravel-forge",
"integrations/secret-syncs/netlify",
"integrations/secret-syncs/northflank",
"integrations/secret-syncs/oci-vault",
"integrations/secret-syncs/railway",
"integrations/secret-syncs/render",
@@ -1848,6 +1850,18 @@
"api-reference/endpoints/app-connections/netlify/delete"
]
},
{
"group": "Northflank",
"pages": [
"api-reference/endpoints/app-connections/northflank/list",
"api-reference/endpoints/app-connections/northflank/available",
"api-reference/endpoints/app-connections/northflank/get-by-id",
"api-reference/endpoints/app-connections/northflank/get-by-name",
"api-reference/endpoints/app-connections/northflank/create",
"api-reference/endpoints/app-connections/northflank/update",
"api-reference/endpoints/app-connections/northflank/delete"
]
},
{
"group": "OCI",
"pages": [
@@ -2306,6 +2320,20 @@
"api-reference/endpoints/secret-syncs/netlify/remove-secrets"
]
},
{
"group": "Northflank",
"pages": [
"api-reference/endpoints/secret-syncs/northflank/list",
"api-reference/endpoints/secret-syncs/northflank/get-by-id",
"api-reference/endpoints/secret-syncs/northflank/get-by-name",
"api-reference/endpoints/secret-syncs/northflank/create",
"api-reference/endpoints/secret-syncs/northflank/update",
"api-reference/endpoints/secret-syncs/northflank/delete",
"api-reference/endpoints/secret-syncs/northflank/sync-secrets",
"api-reference/endpoints/secret-syncs/northflank/import-secrets",
"api-reference/endpoints/secret-syncs/northflank/remove-secrets"
]
},
{
"group": "OCI",
"pages": [

BIN
docs/images/app-connections/northflank/northflank-app-connection-form.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 124 KiB

BIN
docs/images/app-connections/northflank/northflank-app-connection-generated.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 98 KiB

BIN
docs/images/app-connections/northflank/northflank-app-connection-option.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 167 KiB

BIN
docs/images/app-connections/northflank/step-1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 254 KiB

BIN
docs/images/app-connections/northflank/step-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 174 KiB

BIN
docs/images/app-connections/northflank/step-3.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 207 KiB

BIN
docs/images/app-connections/northflank/step-4-1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 194 KiB

BIN
docs/images/app-connections/northflank/step-4-2.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 178 KiB

BIN
docs/images/app-connections/northflank/step-5.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 172 KiB

BIN
docs/images/app-connections/northflank/step-6.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 178 KiB

BIN
docs/images/app-connections/northflank/step-7.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 154 KiB

BIN
docs/images/secret-syncs/northflank/configure-destination.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 129 KiB

BIN
docs/images/secret-syncs/northflank/configure-details.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 114 KiB

BIN
docs/images/secret-syncs/northflank/configure-source.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 107 KiB

BIN
docs/images/secret-syncs/northflank/configure-sync-options.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 132 KiB

BIN
docs/images/secret-syncs/northflank/review-configuration.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 131 KiB

BIN
docs/images/secret-syncs/northflank/select-option.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 142 KiB

BIN
docs/images/secret-syncs/northflank/sync-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 105 KiB

125
docs/integrations/app-connections/northflank.mdx Normal file
View File

@@ -0,0 +1,125 @@
---
title: "Northflank Connection"
description: "Learn how to configure a Northflank Connection for Infisical."
---
Infisical supports the use of [API Tokens](https://northflank.com/docs/v1/api/use-the-api) to connect with Northflank.
<Tip>
Infisical recommends creating a specific API role for the app connection and only giving access to projects that will use the integration.
</Tip>
## Create a Northflank API Token
<Steps>
<Step title="Create an API Role">
Navigate to your team page and click **Create token**.
![Create API Role](/images/app-connections/northflank/step-1.png)
Click on **Create API role**.
![Create API Role](/images/app-connections/northflank/step-2.png)
Select all the projects you want this role to have access to, or leave this unchecked if you want to give access to all projects.
![Create API Role](/images/app-connections/northflank/step-3.png)
Add the **Projects** -> **Manage** -> **Read** permission.
![Create API Role](/images/app-connections/northflank/step-4-1.png)
Add the **Config & Secrets** -> **Secret Groups** -> **List**, **Update** and **Read Values** permissions.
![Create API Role](/images/app-connections/northflank/step-4-2.png)
Scroll to the bottom and save the API role.
</Step>
<Step title="Create an API Token">
Click on the **API** -> **Tokens** menu on the left and then click the **Create API token** button.
![Create API Token](/images/app-connections/northflank/step-5.png)
Give a name to the API token and click the **Use role** button for the new API role you just created.
![Create API Token](/images/app-connections/northflank/step-6.png)
Click the **View API token** icon to view and copy your token.
![Create API Token](/images/app-connections/northflank/step-7.png)
</Step>
</Steps>
## Create a Northflank Connection in Infisical
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Navigate to App Connections">
In your Infisical dashboard, navigate to the **App Connections** page in the desired project.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Select Northflank Connection">
Click **+ Add Connection** and choose **Northflank Connection** from the list of integrations.
![Select Northflank Connection](/images/app-connections/northflank/northflank-app-connection-option.png)
</Step>
<Step title="Fill out the Northflank Connection form">
Complete the form by providing:
- A descriptive name for the connection
- An optional description
- The API Token from the previous step
![Northflank Connection Modal](/images/app-connections/northflank/northflank-app-connection-form.png)
</Step>
<Step title="Connection created">
After submitting the form, your **Northflank Connection** will be successfully created and ready to use with your Infisical project.
![Northflank Connection Created](/images/app-connections/northflank/northflank-app-connection-generated.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a Northflank Connection via API, send a request to the [Create Northflank Connection](/api-reference/endpoints/app-connections/northflank/create) endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/northflank \
--header 'Content-Type: application/json' \
--data '{
"name": "my-northflank-connection",
"method": "api-token",
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"credentials": {
"apiToken": "[API TOKEN]"
}
}'
```
### Sample response
```bash Response
{
"appConnection": {
"id": "a1b2c3d4-5678-90ab-cdef-1234567890ab",
"name": "my-northflank-connection",
"description": null,
"projectId": "abcdef12-3456-7890-abcd-ef1234567890",
"version": 1,
"orgId": "abcdef12-3456-7890-abcd-ef1234567890",
"createdAt": "2025-01-23T10:15:00.000Z",
"updatedAt": "2025-01-23T10:15:00.000Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "d41d8cd98f00b204e9800998ecf8427e",
"app": "northflank",
"method": "api-token",
"credentials": {}
}
}
```
</Tab>
</Tabs>

160
docs/integrations/secret-syncs/northflank.mdx Normal file
View File

@@ -0,0 +1,160 @@
---
title: "Northflank Sync"
description: "Learn how to configure a Northflank Sync for Infisical."
---
**Prerequisites:**
- Create a [Northflank Connection](/integrations/app-connections/northflank)
<Tabs>
<Tab title="Infisical UI">
<Steps>
<Step title="Add Sync">
Navigate to **Project** > **Integrations** and select the **Secret Syncs** tab. Click on the **Add Sync** button.
![Secret Syncs Tab](/images/secret-syncs/general/secret-sync-tab.png)
</Step>
<Step title="Select 'Northflank'">
![Select Northflank](/images/secret-syncs/northflank/select-option.png)
</Step>
<Step title="Configure source">
Configure the **Source** from where secrets should be retrieved, then click **Next**.
![Configure Source](/images/secret-syncs/northflank/configure-source.png)
- **Environment**: The project environment to retrieve secrets from.
- **Secret Path**: The folder path to retrieve secrets from.
<Tip>
If you need to sync secrets from multiple folder locations, check out [secret imports](/documentation/platform/secret-reference#secret-imports).
</Tip>
</Step>
<Step title="Configure destination">
Configure the **Destination** to where secrets should be deployed, then click **Next**.
![Configure Destination](/images/secret-syncs/northflank/configure-destination.png)
- **Northflank Connection**: The Northflank Connection to authenticate with.
- **Project**: The Northflank project to sync secrets to.
- **Secret Group**: The Northflank secret group to sync secrets to.
</Step>
<Step title="Configure sync options">
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.
![Configure Sync Options](/images/secret-syncs/northflank/configure-sync-options.png)
- **Initial Sync Behavior**: Determines how Infisical should resolve the initial sync.
- **Overwrite Destination Secrets**: Removes any secrets at the destination endpoint not present in Infisical.
- **Import Destination Secrets - Prioritize Infisical Values**: Imports any secrets present in the Northflank destination prior to syncing, prioritizing values from Infisical over Northflank when keys conflict.
- **Import Destination Secrets - Prioritize Northflank Values**: Imports any secrets present in the Northflank destination prior to syncing, prioritizing values from Northflank over Infisical when keys conflict.
- **Key Schema**: Template that determines how secret names are transformed when syncing, using `{{secretKey}}` as a placeholder for the original secret name and `{{environment}}` for the environment.
<Note>
We highly recommend using a Key Schema to ensure that Infisical only manages the specific keys you intend, keeping everything else untouched.
</Note>
- **Auto-Sync Enabled**: If enabled, secrets will automatically be synced from the source location when changes occur. Disable to enforce manual syncing only.
- **Disable Secret Deletion**: If enabled, Infisical will not remove secrets from the sync destination. Enable this option if you intend to manage some secrets manually outside of Infisical.
</Step>
<Step title="Configure details">
Configure the **Details** of your Northflank Sync, then click **Next**.
![Configure Details](/images/secret-syncs/northflank/configure-details.png)
- **Name**: The name of your sync. Must be slug-friendly.
- **Description**: An optional description for your sync.
</Step>
<Step title="Review configuration">
Review your Northflank Sync configuration, then click **Create Sync**.
![Review Configuration](/images/secret-syncs/northflank/review-configuration.png)
</Step>
<Step title="Sync created">
If enabled, your Northflank Sync will begin syncing your secrets to the destination endpoint.
![Sync Created](/images/secret-syncs/northflank/sync-created.png)
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a **Northflank Sync**, make an API request to the [Create Northflank Sync](/api-reference/endpoints/secret-syncs/northflank/create) API endpoint.
### Sample request
```bash Request
curl --request POST \
--url https://app.infisical.com/api/v1/secret-syncs/northflank \
--header 'Content-Type: application/json' \
--data '{
"name": "my-northflank-sync",
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"description": "an example sync",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"environment": "dev",
"secretPath": "/my-secrets",
"isAutoSyncEnabled": true,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}"
},
"destinationConfig": {
"projectId": "my-project-id",
"secretGroupId": "my-secret-group-id"
}
}'
```
### Sample response
```json Response
{
"secretSync": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "my-northflank-sync",
"description": "an example sync",
"isAutoSyncEnabled": true,
"version": 1,
"folderId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connectionId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"createdAt": "2023-11-07T05:31:56Z",
"updatedAt": "2023-11-07T05:31:56Z",
"syncStatus": "succeeded",
"lastSyncJobId": "123",
"lastSyncMessage": null,
"lastSyncedAt": "2023-11-07T05:31:56Z",
"importStatus": null,
"lastImportJobId": null,
"lastImportMessage": null,
"lastImportedAt": null,
"removeStatus": null,
"lastRemoveJobId": null,
"lastRemoveMessage": null,
"lastRemovedAt": null,
"syncOptions": {
"initialSyncBehavior": "overwrite-destination",
"keySchema": "INFISICAL_{{secretKey}}",
"disableSecretDeletion": false
},
"projectId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"connection": {
"app": "northflank",
"name": "my-northflank-connection",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"environment": {
"slug": "dev",
"name": "Development",
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a"
},
"folder": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"path": "/my-secrets"
},
"destination": "northflank",
"destinationConfig": {
"projectId": "my-project-id",
"secretGroupId": "my-secret-group-id"
}
}
}
```
</Tab>
</Tabs>

1
docs/snippets/AppConnectionsBrowser.jsx
View File

@@ -47,6 +47,7 @@ export const AppConnectionsBrowser = () => {
{"name": "Auth0", "slug": "auth0", "path": "/integrations/app-connections/auth0", "description": "Learn how to connect your Auth0 to pull secrets from Infisical.", "category": "Identity & Auth"},
{"name": "Okta", "slug": "okta", "path": "/integrations/app-connections/okta", "description": "Learn how to connect your Okta to pull secrets from Infisical.", "category": "Identity & Auth"},
{"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/app-connections/laravel-forge", "description": "Learn how to connect your Laravel Forge to pull secrets from Infisical.", "category": "Hosting"},
{"name": "Northflank", "slug": "northflank", "path": "/integrations/app-connections/northflank", "description": "Learn how to connect your Northflank projects to pull secrets from Infisical.", "category": "Hosting"}
].sort(function(a, b) {
return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
});

3
docs/snippets/SecretSyncsBrowser.jsx
View File

@@ -37,7 +37,8 @@ export const SecretSyncsBrowser = () => {
{"name": "Humanitec", "slug": "humanitec", "path": "/integrations/secret-syncs/humanitec", "description": "Learn how to sync secrets from Infisical to Humanitec.", "category": "DevOps Tools"},
{"name": "OCI Vault", "slug": "oci-vault", "path": "/integrations/secret-syncs/oci-vault", "description": "Learn how to sync secrets from Infisical to OCI Vault.", "category": "Cloud Providers"},
{"name": "Zabbix", "slug": "zabbix", "path": "/integrations/secret-syncs/zabbix", "description": "Learn how to sync secrets from Infisical to Zabbix.", "category": "Monitoring"},
{"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/secret-syncs/laravel-forge", "description": "Learn how to sync secrets from Infisical to Laravel Forge.", "category": "Hosting"}
{"name": "Laravel Forge", "slug": "laravel-forge", "path": "/integrations/secret-syncs/laravel-forge", "description": "Learn how to sync secrets from Infisical to Laravel Forge.", "category": "Hosting"},
{"name": "Northflank", "slug": "northflank", "path": "/integrations/secret-syncs/northflank", "description": "Learn how to sync secrets from Infisical to Northflank projects.", "category": "Hosting"}
].sort(function(a, b) {
return a.name.toLowerCase().localeCompare(b.name.toLowerCase());
});

123
frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/NorthflankSyncFields.tsx Normal file
View File

@@ -0,0 +1,123 @@
import { Controller, useFormContext, useWatch } from "react-hook-form";
import { SingleValue } from "react-select";
import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
import { FilterableSelect, FormControl, Tooltip } from "@app/components/v2";
import {
TNorthflankProject,
TNorthflankSecretGroup,
useNorthflankConnectionListProjects,
useNorthflankConnectionListSecretGroups
} from "@app/hooks/api/appConnections/northflank";
import { SecretSync } from "@app/hooks/api/secretSyncs";
import { TSecretSyncForm } from "../schemas";
export const NorthflankSyncFields = () => {
const { control, setValue } = useFormContext<
TSecretSyncForm & { destination: SecretSync.Northflank }
>();
const connectionId = useWatch({ name: "connection.id", control });
const projectId = useWatch({ name: "destinationConfig.projectId", control });
const { data: projects = [], isPending: isProjectsLoading } = useNorthflankConnectionListProjects(
connectionId,
{
enabled: Boolean(connectionId)
}
);
const { data: secretGroups = [], isPending: isSecretGroupsLoading } =
useNorthflankConnectionListSecretGroups(connectionId, projectId, {
enabled: Boolean(connectionId) && Boolean(projectId)
});
return (
<>
<SecretSyncConnectionField
onChange={() => {
setValue("destinationConfig.projectId", "");
setValue("destinationConfig.projectName", "");
setValue("destinationConfig.secretGroupId", "");
setValue("destinationConfig.secretGroupName", "");
}}
/>
<Controller
name="destinationConfig.projectId"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
isError={Boolean(error)}
errorText={error?.message}
label="Project"
isRequired
helperText={
<Tooltip content="Ensure the project exists in the connection's Northflank team and the connection has access to it.">
<div>
<span>Don&#39;t see the project you&#39;re looking for?</span>{" "}
<FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
</div>
</Tooltip>
}
>
<FilterableSelect
menuPlacement="top"
isLoading={isProjectsLoading && Boolean(connectionId)}
isDisabled={!connectionId}
value={projects.find((p) => p.id === value) ?? null}
onChange={(option) => {
const v = option as SingleValue<TNorthflankProject>;
onChange(v?.id ?? null);
setValue("destinationConfig.projectName", v?.name ?? "");
setValue("destinationConfig.secretGroupId", "");
setValue("destinationConfig.secretGroupName", "");
}}
options={projects}
placeholder="Select a project..."
getOptionLabel={(option) => option.name}
getOptionValue={(option) => option.id}
/>
</FormControl>
)}
/>
<Controller
name="destinationConfig.secretGroupId"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
isError={Boolean(error)}
errorText={error?.message}
label="Secret Group"
isRequired
helperText={
<Tooltip content="Ensure the secret group exists in the connection's Northflank project and the connection has access to it.">
<div>
<span>Don&#39;t see the secret group you&#39;re looking for?</span>{" "}
<FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
</div>
</Tooltip>
}
>
<FilterableSelect
isLoading={isSecretGroupsLoading && Boolean(projectId)}
isDisabled={!projectId}
value={secretGroups.find((sg) => sg.id === value) ?? null}
onChange={(option) => {
const v = option as SingleValue<TNorthflankSecretGroup>;
onChange(v?.id ?? null);
setValue("destinationConfig.secretGroupName", v?.name ?? "");
}}
options={secretGroups}
placeholder="Select a secret group..."
getOptionLabel={(option) => option.name}
getOptionValue={(option) => option.id}
/>
</FormControl>
)}
/>
</>
);
};

3
frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
View File

@@ -25,6 +25,7 @@ import { HerokuSyncFields } from "./HerokuSyncFields";
import { HumanitecSyncFields } from "./HumanitecSyncFields";
import { LaravelForgeSyncFields } from "./LaravelForgeSyncFields";
import { NetlifySyncFields } from "./NetlifySyncFields";
import { NorthflankSyncFields } from "./NorthflankSyncFields";
import { OCIVaultSyncFields } from "./OCIVaultSyncFields";
import { RailwaySyncFields } from "./RailwaySyncFields";
import { RenderSyncFields } from "./RenderSyncFields";
@@ -103,6 +104,8 @@ export const SecretSyncDestinationFields = () => {
return <BitbucketSyncFields />;
case SecretSync.LaravelForge:
return <LaravelForgeSyncFields />;
case SecretSync.Northflank:
return <NorthflankSyncFields />;
default:
throw new Error(`Unhandled Destination Config Field: ${destination}`);
}

1
frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
View File

@@ -68,6 +68,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
case SecretSync.Supabase:
case SecretSync.DigitalOceanAppPlatform:
case SecretSync.Netlify:
case SecretSync.Northflank:
case SecretSync.Bitbucket:
case SecretSync.LaravelForge:
AdditionalSyncOptionsFieldsComponent = null;

20
frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/NorthflankSyncReviewFields.tsx Normal file
View File

@@ -0,0 +1,20 @@
import { useFormContext } from "react-hook-form";
import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
import { GenericFieldLabel } from "@app/components/v2";
import { SecretSync } from "@app/hooks/api/secretSyncs";
export const NorthflankSyncReviewFields = () => {
const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Northflank }>();
const projectName = watch("destinationConfig.projectName");
const projectId = watch("destinationConfig.projectId");
const secretGroupName = watch("destinationConfig.secretGroupName");
const secretGroupId = watch("destinationConfig.secretGroupId");
return (
<>
<GenericFieldLabel label="Project">{projectName || projectId}</GenericFieldLabel>
<GenericFieldLabel label="Secret Group">{secretGroupName || secretGroupId}</GenericFieldLabel>
</>
);
};

4
frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
View File

@@ -37,6 +37,7 @@ import { HerokuSyncReviewFields } from "./HerokuSyncReviewFields";
import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
import { LaravelForgeSyncReviewFields } from "./LaravelForgeSyncReviewFields";
import { NetlifySyncReviewFields } from "./NetlifySyncReviewFields";
import { NorthflankSyncReviewFields } from "./NorthflankSyncReviewFields";
import { OCIVaultSyncReviewFields } from "./OCIVaultSyncReviewFields";
import { OnePassSyncReviewFields } from "./OnePassSyncReviewFields";
import { RailwaySyncReviewFields } from "./RailwaySyncReviewFields";
@@ -167,6 +168,9 @@ export const SecretSyncReviewFields = () => {
case SecretSync.Netlify:
DestinationFieldsComponent = <NetlifySyncReviewFields />;
break;
case SecretSync.Northflank:
DestinationFieldsComponent = <NorthflankSyncReviewFields />;
break;
case SecretSync.Bitbucket:
DestinationFieldsComponent = <BitbucketSyncReviewFields />;
break;

16
frontend/src/components/secret-syncs/forms/schemas/northflank-sync-destination-schema.ts Normal file
View File

@@ -0,0 +1,16 @@
import { z } from "zod";
import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
import { SecretSync } from "@app/hooks/api/secretSyncs";
export const NorthflankSyncDestinationSchema = BaseSecretSyncSchema().merge(
z.object({
destination: z.literal(SecretSync.Northflank),
destinationConfig: z.object({
projectId: z.string().trim().min(1, "Project ID is required"),
projectName: z.string().trim().optional(),
secretGroupId: z.string().trim().min(1, "Secret Group ID is required"),
secretGroupName: z.string().trim().optional()
})
})
);

2
frontend/src/components/secret-syncs/forms/schemas/secret-sync-schema.ts
View File

@@ -22,6 +22,7 @@ import { HerokuSyncDestinationSchema } from "./heroku-sync-destination-schema";
import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
import { LaravelForgeSyncDestinationSchema } from "./laravel-forge-sync-destination-schema";
import { NetlifySyncDestinationSchema } from "./netlify-sync-destination-schema";
import { NorthflankSyncDestinationSchema } from "./northflank-sync-destination-schema";
import { OCIVaultSyncDestinationSchema } from "./oci-vault-sync-destination-schema";
import { RailwaySyncDestinationSchema } from "./railway-sync-destination-schema";
import { RenderSyncDestinationSchema } from "./render-sync-destination-schema";
@@ -62,6 +63,7 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
ChecklySyncDestinationSchema,
DigitalOceanAppPlatformSyncDestinationSchema,
NetlifySyncDestinationSchema,
NorthflankSyncDestinationSchema,
BitbucketSyncDestinationSchema,
LaravelForgeSyncDestinationSchema
]);

3
frontend/src/helpers/appConnections.ts
View File

@@ -50,6 +50,7 @@ import { DigitalOceanConnectionMethod } from "@app/hooks/api/appConnections/type
import { HerokuConnectionMethod } from "@app/hooks/api/appConnections/types/heroku-connection";
import { LaravelForgeConnectionMethod } from "@app/hooks/api/appConnections/types/laravel-forge-connection";
import { NetlifyConnectionMethod } from "@app/hooks/api/appConnections/types/netlify-connection";
import { NorthflankConnectionMethod } from "@app/hooks/api/appConnections/types/northflank-connection";
import { OCIConnectionMethod } from "@app/hooks/api/appConnections/types/oci-connection";
import { RailwayConnectionMethod } from "@app/hooks/api/appConnections/types/railway-connection";
import { RenderConnectionMethod } from "@app/hooks/api/appConnections/types/render-connection";
@@ -121,6 +122,7 @@ export const APP_CONNECTION_MAP: Record<
name: "Netlify",
image: "Netlify.png"
},
[AppConnection.Northflank]: { name: "Northflank", image: "Northflank.png" },
[AppConnection.Okta]: { name: "Okta", image: "Okta.png" },
[AppConnection.Redis]: { name: "Redis", image: "Redis.png" },
[AppConnection.LaravelForge]: {
@@ -164,6 +166,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
case BitbucketConnectionMethod.ApiToken:
case ZabbixConnectionMethod.ApiToken:
case DigitalOceanConnectionMethod.ApiToken:
case NorthflankConnectionMethod.ApiToken:
case OktaConnectionMethod.ApiToken:
case LaravelForgeConnectionMethod.ApiToken:
return { name: "API Token", icon: faKey };

5
frontend/src/helpers/secretSyncs.ts
View File

@@ -114,6 +114,10 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
name: "Bitbucket",
image: "Bitbucket.png"
},
[SecretSync.Northflank]: {
name: "Northflank",
image: "Northflank.png"
},
[SecretSync.LaravelForge]: {
name: "Laravel Forge",
image: "Laravel Forge.png"
@@ -150,6 +154,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.Checkly]: AppConnection.Checkly,
[SecretSync.DigitalOceanAppPlatform]: AppConnection.DigitalOcean,
[SecretSync.Netlify]: AppConnection.Netlify,
[SecretSync.Northflank]: AppConnection.Northflank,
[SecretSync.Bitbucket]: AppConnection.Bitbucket,
[SecretSync.LaravelForge]: AppConnection.LaravelForge
};

1
frontend/src/hooks/api/appConnections/enums.ts
View File

@@ -36,6 +36,7 @@ export enum AppConnection {
Supabase = "supabase",
DigitalOcean = "digital-ocean",
Netlify = "netlify",
Northflank = "northflank",
Okta = "okta",
Redis = "redis",
LaravelForge = "laravel-forge"

2
frontend/src/hooks/api/appConnections/northflank/index.ts Normal file
View File

@@ -0,0 +1,2 @@
export * from "./queries";
export * from "./types";

65
frontend/src/hooks/api/appConnections/northflank/queries.tsx Normal file
View File

@@ -0,0 +1,65 @@
import { useQuery, UseQueryOptions } from "@tanstack/react-query";
import { apiRequest } from "@app/config/request";
import { appConnectionKeys } from "@app/hooks/api/appConnections";
import { TNorthflankProject, TNorthflankSecretGroup } from "./types";
const northflankConnectionKeys = {
all: [...appConnectionKeys.all, "northflank"] as const,
listProjects: (connectionId: string) =>
[...northflankConnectionKeys.all, "projects", connectionId] as const,
listSecretGroups: (connectionId: string, projectId: string) =>
[...northflankConnectionKeys.all, "secret-groups", connectionId, projectId] as const
};
export const useNorthflankConnectionListProjects = (
connectionId: string,
options?: Omit<
UseQueryOptions<
TNorthflankProject[],
unknown,
TNorthflankProject[],
ReturnType<typeof northflankConnectionKeys.listProjects>
>,
"queryKey" | "queryFn"
>
) => {
return useQuery({
queryKey: northflankConnectionKeys.listProjects(connectionId),
queryFn: async () => {
const { data } = await apiRequest.get<{ projects: TNorthflankProject[] }>(
`/api/v1/app-connections/northflank/${connectionId}/projects`
);
return data.projects;
},
...options
});
};
export const useNorthflankConnectionListSecretGroups = (
connectionId: string,
projectId: string,
options?: Omit<
UseQueryOptions<
TNorthflankSecretGroup[],
unknown,
TNorthflankSecretGroup[],
ReturnType<typeof northflankConnectionKeys.listSecretGroups>
>,
"queryKey" | "queryFn"
>
) => {
return useQuery({
queryKey: northflankConnectionKeys.listSecretGroups(connectionId, projectId),
queryFn: async () => {
const { data } = await apiRequest.get<{ secretGroups: TNorthflankSecretGroup[] }>(
`/api/v1/app-connections/northflank/${connectionId}/projects/${projectId}/secret-groups`
);
return data.secretGroups;
},
...options
});
};

9
frontend/src/hooks/api/appConnections/northflank/types.ts Normal file
View File

@@ -0,0 +1,9 @@
export type TNorthflankProject = {
id: string;
name: string;
};
export type TNorthflankSecretGroup = {
id: string;
name: string;
};

6
frontend/src/hooks/api/appConnections/types/app-options.ts
View File

@@ -168,6 +168,10 @@ export type TLaravelForgeConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.LaravelForge;
};
export type TNorthflankConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.Northflank;
};
export type TAzureAdCsConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.AzureADCS;
};
@@ -213,6 +217,7 @@ export type TAppConnectionOption =
| TSupabaseConnectionOption
| TDigitalOceanConnectionOption
| TNetlifyConnectionOption
| TNorthflankConnectionOption
| TOktaConnectionOption
| TAzureAdCsConnectionOption
| TLaravelForgeConnectionOption;
@@ -254,6 +259,7 @@ export type TAppConnectionOptionMap = {
[AppConnection.Supabase]: TSupabaseConnectionOption;
[AppConnection.DigitalOcean]: TDigitalOceanConnectionOption;
[AppConnection.Netlify]: TNetlifyConnectionOption;
[AppConnection.Northflank]: TNorthflankConnectionOption;
[AppConnection.Okta]: TOktaConnectionOption;
[AppConnection.AzureADCS]: TAzureAdCsConnectionOption;
[AppConnection.Redis]: TRedisConnectionOption;

4
frontend/src/hooks/api/appConnections/types/index.ts
View File

@@ -27,6 +27,7 @@ import { TLdapConnection } from "./ldap-connection";
import { TMsSqlConnection } from "./mssql-connection";
import { TMySqlConnection } from "./mysql-connection";
import { TNetlifyConnection } from "./netlify-connection";
import { TNorthflankConnection } from "./northflank-connection";
import { TOCIConnection } from "./oci-connection";
import { TOktaConnection } from "./okta-connection";
import { TOracleDBConnection } from "./oracledb-connection";
@@ -66,6 +67,8 @@ export * from "./laravel-forge-connection";
export * from "./ldap-connection";
export * from "./mssql-connection";
export * from "./mysql-connection";
export * from "./netlify-connection";
export * from "./northflank-connection";
export * from "./oci-connection";
export * from "./okta-connection";
export * from "./oracledb-connection";
@@ -119,6 +122,7 @@ export type TAppConnection =
| TSupabaseConnection
| TDigitalOceanConnection
| TNetlifyConnection
| TNorthflankConnection
| TOktaConnection
| TRedisConnection;

13
frontend/src/hooks/api/appConnections/types/northflank-connection.ts Normal file
View File

@@ -0,0 +1,13 @@
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
export enum NorthflankConnectionMethod {
ApiToken = "api-token"
}
export type TNorthflankConnection = TRootAppConnection & { app: AppConnection.Northflank } & {
method: NorthflankConnectionMethod.ApiToken;
credentials: {
apiToken: string;
};
};

1
frontend/src/hooks/api/secretSyncs/enums.ts
View File

@@ -28,6 +28,7 @@ export enum SecretSync {
Checkly = "checkly",
DigitalOceanAppPlatform = "digital-ocean-app-platform",
Netlify = "netlify",
Northflank = "northflank",
Bitbucket = "bitbucket",
LaravelForge = "laravel-forge"
}

2
frontend/src/hooks/api/secretSyncs/types/index.ts
View File

@@ -23,6 +23,7 @@ import { THerokuSync } from "./heroku-sync";
import { THumanitecSync } from "./humanitec-sync";
import { TLaravelForgeSync } from "./laravel-forge-sync";
import { TNetlifySync } from "./netlify-sync";
import { TNorthflankSync } from "./northflank-sync";
import { TOCIVaultSync } from "./oci-vault-sync";
import { TRailwaySync } from "./railway-sync";
import { TRenderSync } from "./render-sync";
@@ -70,6 +71,7 @@ export type TSecretSync =
| TSupabaseSync
| TDigitalOceanAppPlatformSync
| TNetlifySync
| TNorthflankSync
| TBitbucketSync
| TLaravelForgeSync;

19
frontend/src/hooks/api/secretSyncs/types/northflank-sync.ts Normal file
View File

@@ -0,0 +1,19 @@
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { SecretSync } from "@app/hooks/api/secretSyncs";
import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
export type TNorthflankSync = TRootSecretSync & {
destination: SecretSync.Northflank;
destinationConfig: {
projectId: string;
projectName?: string;
secretGroupId: string;
secretGroupName?: string;
};
connection: {
app: AppConnection.Northflank;
name: string;
id: string;
};
};

5
frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AppConnectionForm.tsx
View File

@@ -36,6 +36,7 @@ import { LdapConnectionForm } from "./LdapConnectionForm";
import { MsSqlConnectionForm } from "./MsSqlConnectionForm";
import { MySqlConnectionForm } from "./MySqlConnectionForm";
import { NetlifyConnectionForm } from "./NetlifyConnectionForm";
import { NorthflankConnectionForm } from "./NorthflankConnectionForm";
import { OCIConnectionForm } from "./OCIConnectionForm";
import { OktaConnectionForm } from "./OktaConnectionForm";
import { OracleDBConnectionForm } from "./OracleDBConnectionForm";
@@ -169,6 +170,8 @@ const CreateForm = ({ app, onComplete, projectId }: CreateFormProps) => {
return <DigitalOceanConnectionForm onSubmit={onSubmit} />;
case AppConnection.Netlify:
return <NetlifyConnectionForm onSubmit={onSubmit} />;
case AppConnection.Northflank:
return <NorthflankConnectionForm onSubmit={onSubmit} />;
case AppConnection.Okta:
return <OktaConnectionForm onSubmit={onSubmit} />;
case AppConnection.Redis:
@@ -330,6 +333,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
return <SupabaseConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
case AppConnection.DigitalOcean:
return <DigitalOceanConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
case AppConnection.Northflank:
return <NorthflankConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
case AppConnection.Okta:
return <OktaConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
case AppConnection.Redis:

135
frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/NorthflankConnectionForm.tsx Normal file
View File

@@ -0,0 +1,135 @@
import { Controller, FormProvider, useForm } from "react-hook-form";
import { zodResolver } from "@hookform/resolvers/zod";
import { z } from "zod";
import {
Button,
FormControl,
ModalClose,
SecretInput,
Select,
SelectItem
} from "@app/components/v2";
import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import {
NorthflankConnectionMethod,
TNorthflankConnection
} from "@app/hooks/api/appConnections/types/northflank-connection";
import {
genericAppConnectionFieldsSchema,
GenericAppConnectionsFields
} from "./GenericAppConnectionFields";
type Props = {
appConnection?: TNorthflankConnection;
onSubmit: (formData: FormData) => void;
};
const rootSchema = genericAppConnectionFieldsSchema.extend({
app: z.literal(AppConnection.Northflank)
});
const formSchema = z.discriminatedUnion("method", [
rootSchema.extend({
method: z.literal(NorthflankConnectionMethod.ApiToken),
credentials: z.object({
apiToken: z.string().trim().min(1, "API Token required")
})
})
]);
type FormData = z.infer<typeof formSchema>;
export const NorthflankConnectionForm = ({ appConnection, onSubmit }: Props) => {
const isUpdate = Boolean(appConnection);
const form = useForm<FormData>({
resolver: zodResolver(formSchema),
defaultValues: appConnection ?? {
app: AppConnection.Northflank,
method: NorthflankConnectionMethod.ApiToken
}
});
const {
handleSubmit,
control,
formState: { isSubmitting, isDirty }
} = form;
return (
<FormProvider {...form}>
<form onSubmit={handleSubmit(onSubmit)}>
{!isUpdate && <GenericAppConnectionsFields />}
<Controller
name="method"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
tooltipText={`The method you would like to use to connect with ${
APP_CONNECTION_MAP[AppConnection.Northflank].name
}. This field cannot be changed after creation.`}
errorText={error?.message}
isError={Boolean(error?.message)}
label="Method"
>
<Select
isDisabled={isUpdate}
value={value}
onValueChange={(val) => onChange(val)}
className="w-full border border-mineshaft-500"
position="popper"
dropdownContainerClassName="max-w-none"
>
{Object.values(NorthflankConnectionMethod).map((method) => {
return (
<SelectItem value={method} key={method}>
{getAppConnectionMethodDetails(method).name}
</SelectItem>
);
})}
</Select>
</FormControl>
)}
/>
<Controller
name="credentials.apiToken"
control={control}
shouldUnregister
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
errorText={error?.message}
isError={Boolean(error?.message)}
label="API Token"
>
<SecretInput
containerClassName="text-gray-400 group-focus-within:border-primary-400/50! border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
value={value}
onChange={(e) => onChange(e.target.value)}
/>
</FormControl>
)}
/>
<div className="mt-8 flex items-center">
<Button
className="mr-4"
size="sm"
type="submit"
colorSchema="secondary"
isLoading={isSubmitting}
isDisabled={isSubmitting || !isDirty}
>
{isUpdate ? "Update Credentials" : "Connect to Northflank"}
</Button>
<ModalClose asChild>
<Button colorSchema="secondary" variant="plain">
Cancel
</Button>
</ModalClose>
</div>
</form>
</FormProvider>
);
};

1
frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionList.tsx
View File

@@ -72,6 +72,7 @@ export const AppConnectionsSelect = ({ onSelect, projectType }: Props) => {
return (
<button
key={option.app}
type="button"
onClick={() =>
enterprise && !subscription.enterpriseAppConnections

14
frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/NorthflankSyncDestinationCol.tsx Normal file
View File

@@ -0,0 +1,14 @@
import { TNorthflankSync } from "@app/hooks/api/secretSyncs/types/northflank-sync";
import { getSecretSyncDestinationColValues } from "../helpers";
import { SecretSyncTableCell } from "../SecretSyncTableCell";
type Props = {
secretSync: TNorthflankSync;
};
export const NorthflankSyncDestinationCol = ({ secretSync }: Props) => {
const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
};

3
frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
View File

@@ -22,6 +22,7 @@ import { HerokuSyncDestinationCol } from "./HerokuSyncDestinationCol";
import { HumanitecSyncDestinationCol } from "./HumanitecSyncDestinationCol";
import { LaravelForgeSyncDestinationCol } from "./LaravelForgeSyncDestinationCol";
import { NetlifySyncDestinationCol } from "./NetlifySyncDestinationCol";
import { NorthflankSyncDestinationCol } from "./NorthflankSyncDestinationCol";
import { OCIVaultSyncDestinationCol } from "./OCIVaultSyncDestinationCol";
import { RailwaySyncDestinationCol } from "./RailwaySyncDestinationCol";
import { RenderSyncDestinationCol } from "./RenderSyncDestinationCol";
@@ -96,6 +97,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
return <DigitalOceanAppPlatformSyncDestinationCol secretSync={secretSync} />;
case SecretSync.Netlify:
return <NetlifySyncDestinationCol secretSync={secretSync} />;
case SecretSync.Northflank:
return <NorthflankSyncDestinationCol secretSync={secretSync} />;
case SecretSync.Bitbucket:
return <BitbucketSyncDestinationCol secretSync={secretSync} />;
case SecretSync.LaravelForge:

4
frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
View File

@@ -194,6 +194,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
primaryText = destinationConfig.workspaceSlug;
secondaryText = destinationConfig.repositorySlug;
break;
case SecretSync.Northflank:
primaryText = destinationConfig.projectName || destinationConfig.projectId;
secondaryText = destinationConfig.secretGroupName || destinationConfig.secretGroupId;
break;
case SecretSync.LaravelForge:
primaryText = destinationConfig.siteName || destinationConfig.siteId;
secondaryText = destinationConfig.orgName || destinationConfig.orgSlug;

21
frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/NorthflankSyncDestinationSection.tsx Normal file
View File

@@ -0,0 +1,21 @@
import { GenericFieldLabel } from "@app/components/secret-syncs";
import { TNorthflankSync } from "@app/hooks/api/secretSyncs/types/northflank-sync";
type Props = {
secretSync: TNorthflankSync;
};
export const NorthflankSyncDestinationSection = ({ secretSync }: Props) => {
const { destinationConfig } = secretSync;
return (
<>
<GenericFieldLabel label="Project">
{destinationConfig.projectName || destinationConfig.projectId}
</GenericFieldLabel>
<GenericFieldLabel label="Secret Group">
{destinationConfig.secretGroupName || destinationConfig.secretGroupId}
</GenericFieldLabel>
</>
);
};

4
frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
View File

@@ -33,6 +33,7 @@ import { HerokuSyncDestinationSection } from "./HerokuSyncDestinationSection";
import { HumanitecSyncDestinationSection } from "./HumanitecSyncDestinationSection";
import { LaravelForgeSyncDestinationSection } from "./LaravelForgeSyncDestinationSection";
import { NetlifySyncDestinationSection } from "./NetlifySyncDestinationSection";
import { NorthflankSyncDestinationSection } from "./NorthflankSyncDestinationSection";
import { OCIVaultSyncDestinationSection } from "./OCIVaultSyncDestinationSection";
import { RailwaySyncDestinationSection } from "./RailwaySyncDestinationSection";
import { RenderSyncDestinationSection } from "./RenderSyncDestinationSection";
@@ -146,6 +147,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
case SecretSync.Netlify:
DestinationComponents = <NetlifySyncDestinationSection secretSync={secretSync} />;
break;
case SecretSync.Northflank:
DestinationComponents = <NorthflankSyncDestinationSection secretSync={secretSync} />;
break;
case SecretSync.Bitbucket:
DestinationComponents = <BitbucketSyncDestinationSection secretSync={secretSync} />;
break;

1
frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
View File

@@ -71,6 +71,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
case SecretSync.Checkly:
case SecretSync.DigitalOceanAppPlatform:
case SecretSync.Netlify:
case SecretSync.Northflank:
case SecretSync.Bitbucket:
case SecretSync.LaravelForge:
AdditionalSyncOptionsComponent = null;