From 3213dafba9ca8e5efee6927c2bd742ab981bd760 Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Wed, 17 Jan 2024 15:34:39 -0500
Subject: [PATCH] add check to make sure user can only create service token for
 secrets they have access to

---
 .../services/service-token/service-token-service.ts    | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/backend-pg/src/services/service-token/service-token-service.ts b/backend-pg/src/services/service-token/service-token-service.ts
index 3d4c74ce0..b8a3a94ce 100644
--- a/backend-pg/src/services/service-token/service-token-service.ts
+++ b/backend-pg/src/services/service-token/service-token-service.ts
@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 import bcrypt from "bcrypt";
 
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -51,6 +51,14 @@ export const serviceTokenServiceFactory = ({
       ProjectPermissionActions.Create,
       ProjectPermissionSub.ServiceTokens
     );
+    
+    scopes.forEach(({ environment, secretPath }) => {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Create,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath: secretPath })
+      );
+    })
+    
     const appCfg = getConfig();
 
     // validates env