feat: review comments over dynamic-secrets, folder read, neq removed in backend, contain in tag

2026-09-22 13:39:35 +00:00 · 2024-10-16 11:14:21 +05:30
parent c8410ac6f3
commit 0c3024819c
8 changed files with 33 additions and 22 deletions
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
@@ -228,7 +228,7 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Edit,
+      ProjectPermissionDynamicSecretActions.Delete,
      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

@@ -284,6 +284,10 @@ export const dynamicSecretServiceFactory = ({
      actorAuthMethod,
      actorOrgId
    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionDynamicSecretActions.Read,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
+    );
    ForbiddenError.from(permission).throwUnlessCan(
      ProjectPermissionDynamicSecretActions.Edit,
      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
@@ -331,7 +335,7 @@ export const dynamicSecretServiceFactory = ({
      // verify user has access to each env in request
      environmentSlugs.forEach((environmentSlug) =>
        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionDynamicSecretActions.Lease,
+          ProjectPermissionDynamicSecretActions.Read,
          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
        )
      );
@@ -367,7 +371,7 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Lease,
+      ProjectPermissionDynamicSecretActions.Read,
      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

@@ -413,7 +417,7 @@ export const dynamicSecretServiceFactory = ({
      actorOrgId
    );
    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Lease,
+      ProjectPermissionDynamicSecretActions.Read,
      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
    );

@@ -455,7 +459,7 @@ export const dynamicSecretServiceFactory = ({
      // verify user has access to each env in request
      environmentSlugs.forEach((environmentSlug) =>
        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionDynamicSecretActions.Lease,
+          ProjectPermissionDynamicSecretActions.Read,
          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
        )
      );
--- a/backend/src/ee/services/license/license-fns.ts
+++ b/backend/src/ee/services/license/license-fns.ts
@@ -21,7 +21,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
  secretVersioning: true,
  pitRecovery: false,
  ipAllowlisting: false,
-  rbac: false,
+  rbac: true,
  customRateLimits: false,
  customAlerts: false,
  auditLogs: false,
--- a/frontend/src/components/permissions/GlobPermissionInfo.tsx
+++ b/frontend/src/components/permissions/GlobPermissionInfo.tsx
@@ -10,7 +10,7 @@ export const GlobPermissionInfo = () => {

  return (
    <div>
-      <div className="mt-2">A glob pattern uses wildcards to match file names or paths.</div>
+      <div className="mt-2">A glob pattern uses wildcards to match resources or paths.</div>
      <div>
        <FormControl label="Glob pattern" helperText="Examples: /{a,b}, DB_**">
          <Input value={pattern} onChange={(e) => setPattern(e.target.value)} />
@@ -19,7 +19,7 @@ export const GlobPermissionInfo = () => {
      <div>
        <FormControl
          label="Test string"
-          helperText="Type value to test"
+          helperText="Type a value to test glob match"
          isError={
            pattern && text ? !picomatch.isMatch(text, pattern, { strictSlashes: false }) : false
          }
--- a/frontend/src/context/ProjectPermissionContext/types.ts
+++ b/frontend/src/context/ProjectPermissionContext/types.ts
@@ -29,7 +29,7 @@ export enum PermissionConditionOperators {
  $ALL = "$all",
  $REGEX = "$regex",
  $EQ = "$eq",
-  $NEQ = "$neq",
+  $NEQ = "$ne",
  $GLOB = "$glob"
 }

@@ -45,7 +45,7 @@ export type TPermissionConditionOperators = {
 export type TPermissionCondition = Record<
  string,
  | string
-  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $neq: string; $glob: string }
+  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $ne: string; $glob: string }
 >;

 export enum ProjectPermissionSub {
--- a/frontend/src/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils.ts
+++ b/frontend/src/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils.ts
@@ -370,7 +370,6 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
  [ProjectPermissionSub.SecretFolders]: {
    title: "Secret Folders",
    actions: [
-      { label: "Read", value: "read" },
      { label: "Create", value: "create" },
      { label: "Modify", value: "edit" },
      { label: "Remove", value: "delete" }
@@ -392,7 +391,7 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
      { label: "Create", value: "create" },
      { label: "Modify", value: "edit" },
      { label: "Remove", value: "delete" },
-      { label: "Lease", value: "lease" }
+      { label: "Manage Leases", value: "lease" }
    ]
  },
  [ProjectPermissionSub.Cmek]: {
--- a/frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/GeneralPermissionConditions.tsx
+++ b/frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/GeneralPermissionConditions.tsx
@@ -50,11 +50,12 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
      </p>
      <div className="mt-2 flex flex-col space-y-2">
        {items.fields.map((el, index) => {
-          const condition = watch(`permissions.secrets.${position}.conditions.${index}`) as {
-            lhs: string;
-            rhs: string;
-            operator: string;
-          };
+          const condition =
+            (watch(`permissions.${type}.${position}.conditions.${index}`) as {
+              lhs: string;
+              rhs: string;
+              operator: string;
+            }) || {};
          return (
            <div
              key={el.id}
@@ -86,7 +87,7 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
              <div className="flex w-36 items-center space-x-2">
                <Controller
                  control={control}
-                  name={`permissions.secrets.${position}.conditions.${index}.operator`}
+                  name={`permissions.${type}.${position}.conditions.${index}.operator`}
                  render={({ field, fieldState: { error } }) => (
                    <FormControl
                      isError={Boolean(error?.message)}
@@ -108,7 +109,7 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
                  <Tooltip
                    asChild
                    content={getConditionOperatorHelperInfo(
-                      condition.operator as PermissionConditionOperators
+                      condition?.operator as PermissionConditionOperators
                    )}
                    className="max-w-xs"
                  >
--- a/frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/SecretPermissionConditions.tsx
+++ b/frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/SecretPermissionConditions.tsx
@@ -28,6 +28,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
  const {
    control,
    watch,
+    setValue,
    formState: { errors }
  } = useFormContext<TFormSchema>();
  const items = useFieldArray({
@@ -66,7 +67,13 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                      <Select
                        defaultValue={field.value}
                        {...field}
-                        onValueChange={(e) => field.onChange(e)}
+                        onValueChange={(e) => {
+                          setValue(
+                            `permissions.secrets.${position}.conditions.${index}.operator`,
+                            PermissionConditionOperators.$IN as never
+                          );
+                          field.onChange(e);
+                        }}
                        className="w-full"
                      >
                        <SelectItem value="environment">Environment Slug</SelectItem>
@@ -103,7 +110,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                  <Tooltip
                    asChild
                    content={getConditionOperatorHelperInfo(
-                      condition.operator as PermissionConditionOperators
+                      condition?.operator as PermissionConditionOperators
                    )}
                    className="max-w-xs"
                  >
--- a/frontend/src/views/SecretMainPage/SecretMainPage.tsx
+++ b/frontend/src/views/SecretMainPage/SecretMainPage.tsx
@@ -94,7 +94,7 @@ export const SecretMainPage = () => {
  );

  const canReadDynamicSecret = permission.can(
-    ProjectPermissionDynamicSecretActions.Lease,
+    ProjectPermissionDynamicSecretActions.Read,
    subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })
  );