chore: further cleanup

backend/src/lib/errors/index.ts

@@ -60,13 +60,6 @@ export class ForbiddenRequestError extends Error {
   }
 }
 
-export class ForbiddenReadSecretError extends ForbiddenRequestError {
-  constructor({ error, message }: { message?: string; error?: unknown } = {}) {
-    super({ message, error });
-    this.name = "ForbiddenReadSecretError";
-  }
-}
-
 export class BadRequestError extends Error {
   name: string;
 

backend/src/server/routes/v3/secret-router.ts

@@ -292,7 +292,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
               secrets: secretRawSchema
                 .omit({ createdAt: true, updatedAt: true })
                 .extend({
-                  // secretValueHidden: z.boolean(),
+                  // No `secretValueHidden` on imports, because imported secrets that the user doesn't have read value permission on, will be filtered out.
+                  // Therefore all returned secret imports will have the value present.
                   secretMetadata: ResourceMetadataSchema.optional()
                 })
                 .array()
@@ -2322,7 +2323,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
-  // ? No work needed, does not expose secret value.
   server.route({
     method: "POST",
     url: "/backfill-secret-references",

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -7,6 +7,7 @@ import { logger } from "@app/lib/logger";
 
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
+import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
 import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types";
@@ -649,7 +650,7 @@ export const reshapeBridgeSecret = (
 
   ...(secretValueHidden
     ? {
-        secretValue: "<hidden-by-infisical>",
+        secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK,
         secretValueHidden: true
       }
     : {

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -20,7 +20,7 @@ import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-app
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
-import { BadRequestError, ForbiddenReadSecretError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { diff, groupBy } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
@@ -987,7 +987,6 @@ export const secretV2BridgeServiceFactory = ({
       secretDAL,
       decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined),
       canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
-        // ? Question(Daniel): Will throw an error if the user doesn't have access to any of the expanded secrets.
         permission.can(
           ProjectPermissionSecretActions.ReadValue,
           subject(ProjectPermissionSub.Secrets, {
@@ -1249,8 +1248,9 @@ export const secretV2BridgeServiceFactory = ({
         ) &&
         secretType !== SecretType.Personal
       ) {
-        throw new ForbiddenReadSecretError({
+        throw new ForbiddenRequestError({
-          message: `You do not have permission to view secret value on secret with name '${secretName}'`
+          message: `You do not have permission to view secret value on secret with name '${secretName}'`,
+          name: "ForbiddenReadSecretError"
         });
       }
 

backend/src/services/secret/secret-fns.ts

@@ -51,6 +51,8 @@ import {
   TUpdateManySecretsRawFnFactory
 } from "./secret-types";
 
+export const INFISICAL_SECRET_VALUE_HIDDEN_MASK = "<hidden-by-infisical>";
+
 export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => {
   const appCfg = getConfig();
   const secretBlindIndex = await buildSecretBlindIndexFromName({
@@ -370,7 +372,7 @@ export const decryptSecretRaw = (
         tag: secret.secretValueTag,
         key
       })
-    : "<hidden-by-infisical>";
+    : INFISICAL_SECRET_VALUE_HIDDEN_MASK;
 
   let secretComment = "";
 
@@ -1214,12 +1216,10 @@ export const conditionallyHideSecretValue = (
     secretValueTag: string;
   }
 ) => {
-  const hiddenPlaceholder = "hidden-by-infisical>";
-
   return {
-    secretValueCiphertext: shouldHideValue ? hiddenPlaceholder : secretValueCiphertext,
+    secretValueCiphertext: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueCiphertext,
-    secretValueIV: shouldHideValue ? hiddenPlaceholder : secretValueIV,
+    secretValueIV: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueIV,
-    secretValueTag: shouldHideValue ? hiddenPlaceholder : secretValueTag,
+    secretValueTag: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueTag,
     secretValueHidden: shouldHideValue
   };
 };