feat: switched to actor and actorId for replication

backend/src/services/secret/secret-queue.ts

@@ -354,7 +354,8 @@ export const secretQueueFactory = ({
       secrets,
       folderId,
       excludeReplication,
-      membershipId
+      actorId,
+      actor
     } = job.data;
     await queueService.queue(
       QueueName.SecretWebhook,
@@ -380,7 +381,8 @@ export const secretQueueFactory = ({
         secretPath,
         folderId,
         secrets,
-        membershipId,
+        actorId,
+        actor,
         excludeReplication,
         environmentSlug: environment
       });

backend/src/services/secret/secret-service.ts

@@ -149,7 +149,7 @@ export const secretServiceFactory = ({
     projectId,
     ...inputSecret
   }: TCreateSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -238,9 +238,9 @@ export const secretServiceFactory = ({
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
       secretPath: path,
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      folderId: folder.id,
+      actorId,
+      actor,
       projectId,
       environmentSlug: folder.environment.slug,
       environmentId: folder.envId,
@@ -265,7 +265,7 @@ export const secretServiceFactory = ({
     projectId,
     ...inputSecret
   }: TUpdateSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -381,9 +381,8 @@ export const secretServiceFactory = ({
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      actor,
+      actorId,
       secretPath: path,
       folderId: folder.id,
       projectId,
@@ -410,7 +409,7 @@ export const secretServiceFactory = ({
     projectId,
     ...inputSecret
   }: TDeleteSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -466,9 +465,8 @@ export const secretServiceFactory = ({
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      actor,
+      actorId,
       secretPath: path,
       folderId: folder.id,
       projectId,
@@ -703,7 +701,7 @@ export const secretServiceFactory = ({
     projectId,
     secrets: inputSecrets
   }: TCreateBulkSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -768,9 +766,8 @@ export const secretServiceFactory = ({
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      actor,
+      actorId,
       secretPath: path,
       folderId: folder.id,
       projectId,
@@ -792,7 +789,7 @@ export const secretServiceFactory = ({
     projectId,
     secrets: inputSecrets
   }: TUpdateBulkSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -878,9 +875,8 @@ export const secretServiceFactory = ({
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      actor,
+      actorId,
       secretPath: path,
       folderId: folder.id,
       projectId,
@@ -902,7 +898,7 @@ export const secretServiceFactory = ({
     actorAuthMethod,
     actorOrgId
   }: TDeleteBulkSecretDTO) => {
-    const { permission, membership } = await permissionService.getProjectPermission(
+    const { permission } = await permissionService.getProjectPermission(
       actor,
       actorId,
       projectId,
@@ -952,9 +948,8 @@ export const secretServiceFactory = ({
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
-      // if secret service reached means there was no secret policy
-      // TODO(akhilmhdh): The policy based replication will fail if machine identity is used.
-      membershipId: membership?.id as string,
+      actor,
+      actorId,
       secretPath: path,
       folderId: folder.id,
       projectId,

backend/src/services/secret/secret-types.ts

@@ -11,6 +11,8 @@ import { TSecretBlindIndexDALFactory } from "@app/services/secret-blind-index/se
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
 import { TSecretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";
 
+import { ActorType } from "../auth/auth-type";
+
 type TPartialSecret = Pick<TSecrets, "id" | "secretReminderRepeatDays" | "secretReminderNote">;
 
 type TPartialInputSecret = Pick<TSecrets, "type" | "secretReminderNote" | "secretReminderRepeatDays" | "id">;
@@ -388,7 +390,8 @@ export type TSyncSecretsDTO<T extends boolean = false> = {
   : {
       environmentId: string;
       folderId: string;
-      membershipId: string;
+      actor: ActorType;
+      actorId: string;
       // used for import creation to trigger replication
       pickOnlyImportIds?: string[];
       secrets: {