feat: review comments over dynamic-secrets, folder read, neq removed in backend, contain in tag

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -228,7 +228,7 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Edit,
+      ProjectPermissionDynamicSecretActions.Delete,
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
@@ -284,6 +284,10 @@ export const dynamicSecretServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionDynamicSecretActions.Read,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
+    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionDynamicSecretActions.Edit,
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
@@ -331,7 +335,7 @@ export const dynamicSecretServiceFactory = ({
       // verify user has access to each env in request
       environmentSlugs.forEach((environmentSlug) =>
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionDynamicSecretActions.Lease,
+          ProjectPermissionDynamicSecretActions.Read,
           subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
         )
       );
@@ -367,7 +371,7 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Lease,
+      ProjectPermissionDynamicSecretActions.Read,
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
@@ -413,7 +417,7 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionDynamicSecretActions.Lease,
+      ProjectPermissionDynamicSecretActions.Read,
       subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
@@ -455,7 +459,7 @@ export const dynamicSecretServiceFactory = ({
       // verify user has access to each env in request
       environmentSlugs.forEach((environmentSlug) =>
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionDynamicSecretActions.Lease,
+          ProjectPermissionDynamicSecretActions.Read,
           subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
         )
       );

backend/src/ee/services/license/license-fns.ts

@@ -21,7 +21,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   secretVersioning: true,
   pitRecovery: false,
   ipAllowlisting: false,
-  rbac: false,
+  rbac: true,
   customRateLimits: false,
   customAlerts: false,
   auditLogs: false,

frontend/src/components/permissions/GlobPermissionInfo.tsx

@@ -10,7 +10,7 @@ export const GlobPermissionInfo = () => {
 
   return (
     <div>
-      <div className="mt-2">A glob pattern uses wildcards to match file names or paths.</div>
+      <div className="mt-2">A glob pattern uses wildcards to match resources or paths.</div>
       <div>
         <FormControl label="Glob pattern" helperText="Examples: /{a,b}, DB_**">
           <Input value={pattern} onChange={(e) => setPattern(e.target.value)} />
@@ -19,7 +19,7 @@ export const GlobPermissionInfo = () => {
       <div>
         <FormControl
           label="Test string"
-          helperText="Type value to test"
+          helperText="Type a value to test glob match"
           isError={
             pattern && text ? !picomatch.isMatch(text, pattern, { strictSlashes: false }) : false
           }

frontend/src/context/ProjectPermissionContext/types.ts

@@ -29,7 +29,7 @@ export enum PermissionConditionOperators {
   $ALL = "$all",
   $REGEX = "$regex",
   $EQ = "$eq",
-  $NEQ = "$neq",
+  $NEQ = "$ne",
   $GLOB = "$glob"
 }
 
@@ -45,7 +45,7 @@ export type TPermissionConditionOperators = {
 export type TPermissionCondition = Record<
   string,
   | string
-  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $neq: string; $glob: string }
+  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $ne: string; $glob: string }
 >;
 
 export enum ProjectPermissionSub {

frontend/src/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils.ts

@@ -370,7 +370,6 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
   [ProjectPermissionSub.SecretFolders]: {
     title: "Secret Folders",
     actions: [
-      { label: "Read", value: "read" },
       { label: "Create", value: "create" },
       { label: "Modify", value: "edit" },
       { label: "Remove", value: "delete" }
@@ -392,7 +391,7 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       { label: "Create", value: "create" },
       { label: "Modify", value: "edit" },
       { label: "Remove", value: "delete" },
-      { label: "Lease", value: "lease" }
+      { label: "Manage Leases", value: "lease" }
     ]
   },
   [ProjectPermissionSub.Cmek]: {

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/GeneralPermissionConditions.tsx

@@ -50,11 +50,12 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
       </p>
       <div className="mt-2 flex flex-col space-y-2">
         {items.fields.map((el, index) => {
-          const condition = watch(`permissions.secrets.${position}.conditions.${index}`) as {
+          const condition =
-            lhs: string;
+            (watch(`permissions.${type}.${position}.conditions.${index}`) as {
-            rhs: string;
+              lhs: string;
-            operator: string;
+              rhs: string;
-          };
+              operator: string;
+            }) || {};
           return (
             <div
               key={el.id}
@@ -86,7 +87,7 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
               <div className="flex w-36 items-center space-x-2">
                 <Controller
                   control={control}
-                  name={`permissions.secrets.${position}.conditions.${index}.operator`}
+                  name={`permissions.${type}.${position}.conditions.${index}.operator`}
                   render={({ field, fieldState: { error } }) => (
                     <FormControl
                       isError={Boolean(error?.message)}
@@ -108,7 +109,7 @@ export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }:
                   <Tooltip
                     asChild
                     content={getConditionOperatorHelperInfo(
-                      condition.operator as PermissionConditionOperators
+                      condition?.operator as PermissionConditionOperators
                     )}
                     className="max-w-xs"
                   >

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/SecretPermissionConditions.tsx

@@ -28,6 +28,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
   const {
     control,
     watch,
+    setValue,
     formState: { errors }
   } = useFormContext<TFormSchema>();
   const items = useFieldArray({
@@ -66,7 +67,13 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                       <Select
                         defaultValue={field.value}
                         {...field}
-                        onValueChange={(e) => field.onChange(e)}
+                        onValueChange={(e) => {
+                          setValue(
+                            `permissions.secrets.${position}.conditions.${index}.operator`,
+                            PermissionConditionOperators.$IN as never
+                          );
+                          field.onChange(e);
+                        }}
                         className="w-full"
                       >
                         <SelectItem value="environment">Environment Slug</SelectItem>
@@ -103,7 +110,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                   <Tooltip
                     asChild
                     content={getConditionOperatorHelperInfo(
-                      condition.operator as PermissionConditionOperators
+                      condition?.operator as PermissionConditionOperators
                     )}
                     className="max-w-xs"
                   >

frontend/src/views/SecretMainPage/SecretMainPage.tsx

@@ -94,7 +94,7 @@ export const SecretMainPage = () => {
   );
 
   const canReadDynamicSecret = permission.can(
-    ProjectPermissionDynamicSecretActions.Lease,
+    ProjectPermissionDynamicSecretActions.Read,
     subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })
   );