From 12b447425b4dc545790547fb314f4ce912856ddb Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Thu, 20 Feb 2025 05:47:54 +0400 Subject: [PATCH] chore: further cleanup --- backend/src/lib/errors/index.ts | 7 ------- backend/src/server/routes/v3/secret-router.ts | 4 ++-- .../secret-v2-bridge/secret-v2-bridge-fns.ts | 3 ++- .../secret-v2-bridge/secret-v2-bridge-service.ts | 8 ++++---- backend/src/services/secret/secret-fns.ts | 12 ++++++------ 5 files changed, 14 insertions(+), 20 deletions(-) diff --git a/backend/src/lib/errors/index.ts b/backend/src/lib/errors/index.ts index 6b917263f..7dbffed20 100644 --- a/backend/src/lib/errors/index.ts +++ b/backend/src/lib/errors/index.ts @@ -60,13 +60,6 @@ export class ForbiddenRequestError extends Error { } } -export class ForbiddenReadSecretError extends ForbiddenRequestError { - constructor({ error, message }: { message?: string; error?: unknown } = {}) { - super({ message, error }); - this.name = "ForbiddenReadSecretError"; - } -} - export class BadRequestError extends Error { name: string; diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index ff448088e..8262a5eab 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -292,7 +292,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secrets: secretRawSchema .omit({ createdAt: true, updatedAt: true }) .extend({ - // secretValueHidden: z.boolean(), + // No `secretValueHidden` on imports, because imported secrets that the user doesn't have read value permission on, will be filtered out. + // Therefore all returned secret imports will have the value present. secretMetadata: ResourceMetadataSchema.optional() }) .array() @@ -2322,7 +2323,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { } }); - // ? No work needed, does not expose secret value. server.route({ method: "POST", url: "/backfill-secret-references", diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts index 5b7811222..3bf00c878 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts @@ -7,6 +7,7 @@ import { logger } from "@app/lib/logger"; import { TProjectEnvDALFactory } from "../project-env/project-env-dal"; import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema"; +import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns"; import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal"; import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal"; import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types"; @@ -649,7 +650,7 @@ export const reshapeBridgeSecret = ( ...(secretValueHidden ? { - secretValue: "", + secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK, secretValueHidden: true } : { diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts index 1dc4c540a..321015d19 100644 --- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts +++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts @@ -20,7 +20,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal"; import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal"; import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service"; -import { BadRequestError, ForbiddenReadSecretError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors"; import { diff, groupBy } from "@app/lib/fn"; import { setKnexStringValue } from "@app/lib/knex"; import { logger } from "@app/lib/logger"; @@ -987,7 +987,6 @@ export const secretV2BridgeServiceFactory = ({ secretDAL, decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined), canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) => - // ? Question(Daniel): Will throw an error if the user doesn't have access to any of the expanded secrets. permission.can( ProjectPermissionSecretActions.ReadValue, subject(ProjectPermissionSub.Secrets, { @@ -1249,8 +1248,9 @@ export const secretV2BridgeServiceFactory = ({ ) && secretType !== SecretType.Personal ) { - throw new ForbiddenReadSecretError({ - message: `You do not have permission to view secret value on secret with name '${secretName}'` + throw new ForbiddenRequestError({ + message: `You do not have permission to view secret value on secret with name '${secretName}'`, + name: "ForbiddenReadSecretError" }); } diff --git a/backend/src/services/secret/secret-fns.ts b/backend/src/services/secret/secret-fns.ts index 22d94dc42..084aa2ca1 100644 --- a/backend/src/services/secret/secret-fns.ts +++ b/backend/src/services/secret/secret-fns.ts @@ -51,6 +51,8 @@ import { TUpdateManySecretsRawFnFactory } from "./secret-types"; +export const INFISICAL_SECRET_VALUE_HIDDEN_MASK = ""; + export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => { const appCfg = getConfig(); const secretBlindIndex = await buildSecretBlindIndexFromName({ @@ -370,7 +372,7 @@ export const decryptSecretRaw = ( tag: secret.secretValueTag, key }) - : ""; + : INFISICAL_SECRET_VALUE_HIDDEN_MASK; let secretComment = ""; @@ -1214,12 +1216,10 @@ export const conditionallyHideSecretValue = ( secretValueTag: string; } ) => { - const hiddenPlaceholder = "hidden-by-infisical>"; - return { - secretValueCiphertext: shouldHideValue ? hiddenPlaceholder : secretValueCiphertext, - secretValueIV: shouldHideValue ? hiddenPlaceholder : secretValueIV, - secretValueTag: shouldHideValue ? hiddenPlaceholder : secretValueTag, + secretValueCiphertext: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueCiphertext, + secretValueIV: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueIV, + secretValueTag: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueTag, secretValueHidden: shouldHideValue }; };