awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: further cleanup

Browse Source
This commit is contained in:
Daniel Hougaard
2025-02-20 05:47:54 +04:00
parent 9cb1a31287
commit 12b447425b
5 changed files with 14 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
backend/src/lib/errors/index.ts
View File

@@ -60,13 +60,6 @@ export class ForbiddenRequestError extends Error {
}
}
export class ForbiddenReadSecretError extends ForbiddenRequestError {
constructor({ error, message }: { message?: string; error?: unknown } = {}) {
super({ message, error });
this.name = "ForbiddenReadSecretError";
}
}
export class BadRequestError extends Error {
name: string;

4
backend/src/server/routes/v3/secret-router.ts
View File

@@ -292,7 +292,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
secrets: secretRawSchema
.omit({ createdAt: true, updatedAt: true })
.extend({
// secretValueHidden: z.boolean(),
// No `secretValueHidden` on imports, because imported secrets that the user doesn't have read value permission on, will be filtered out.
// Therefore all returned secret imports will have the value present.
secretMetadata: ResourceMetadataSchema.optional()
})
.array()
@@ -2322,7 +2323,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
}
});
// ? No work needed, does not expose secret value.
server.route({
method: "POST",
url: "/backfill-secret-references",

3
backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
View File

@@ -7,6 +7,7 @@ import { logger } from "@app/lib/logger";
import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types";
@@ -649,7 +650,7 @@ export const reshapeBridgeSecret = (
...(secretValueHidden
? {
secretValue: "<hidden-by-infisical>",
secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK,
secretValueHidden: true
}
: {

8
backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
View File

@@ -20,7 +20,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app
import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
import { BadRequestError, ForbiddenReadSecretError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { diff, groupBy } from "@app/lib/fn";
import { setKnexStringValue } from "@app/lib/knex";
import { logger } from "@app/lib/logger";
@@ -987,7 +987,6 @@ export const secretV2BridgeServiceFactory = ({
secretDAL,
decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined),
canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
// ? Question(Daniel): Will throw an error if the user doesn't have access to any of the expanded secrets.
permission.can(
ProjectPermissionSecretActions.ReadValue,
subject(ProjectPermissionSub.Secrets, {
@@ -1249,8 +1248,9 @@ export const secretV2BridgeServiceFactory = ({
) &&
secretType !== SecretType.Personal
) {
throw new ForbiddenReadSecretError({
message: `You do not have permission to view secret value on secret with name '${secretName}'`
throw new ForbiddenRequestError({
message: `You do not have permission to view secret value on secret with name '${secretName}'`,
name: "ForbiddenReadSecretError"
});
}

12
backend/src/services/secret/secret-fns.ts
View File

@@ -51,6 +51,8 @@ import {
TUpdateManySecretsRawFnFactory
} from "./secret-types";
export const INFISICAL_SECRET_VALUE_HIDDEN_MASK = "<hidden-by-infisical>";
export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => {
const appCfg = getConfig();
const secretBlindIndex = await buildSecretBlindIndexFromName({
@@ -370,7 +372,7 @@ export const decryptSecretRaw = (
tag: secret.secretValueTag,
key
})
: "<hidden-by-infisical>";
: INFISICAL_SECRET_VALUE_HIDDEN_MASK;
let secretComment = "";
@@ -1214,12 +1216,10 @@ export const conditionallyHideSecretValue = (
secretValueTag: string;
}
) => {
const hiddenPlaceholder = "hidden-by-infisical>";
return {
secretValueCiphertext: shouldHideValue ? hiddenPlaceholder : secretValueCiphertext,
secretValueIV: shouldHideValue ? hiddenPlaceholder : secretValueIV,
secretValueTag: shouldHideValue ? hiddenPlaceholder : secretValueTag,
secretValueCiphertext: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueCiphertext,
secretValueIV: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueIV,
secretValueTag: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueTag,
secretValueHidden: shouldHideValue
};
};