Merge branch 'main' into ENG-2633

backend/src/lib/knex/index.ts

@@ -2,6 +2,8 @@
 import { Knex } from "knex";
 import { Tables } from "knex/types/tables";
 
+import { TableName } from "@app/db/schemas";
+
 import { DatabaseError } from "../errors";
 import { buildDynamicKnexQuery, TKnexDynamicOperator } from "./dynamic";
 
@@ -25,28 +27,41 @@ export type TFindFilter<R extends object = object> = Partial<R> & {
   $search?: Partial<{ [k in keyof R]: R[k] }>;
   $complex?: TKnexDynamicOperator<R>;
 };
+
 export const buildFindFilter =
-  <R extends object = object>({ $in, $notNull, $search, $complex, ...filter }: TFindFilter<R>) =>
+  <R extends object = object>(
+    { $in, $notNull, $search, $complex, ...filter }: TFindFilter<R>,
+    tableName?: TableName,
+    excludeKeys?: Array<keyof R>
+  ) =>
   (bd: Knex.QueryBuilder<R, R>) => {
-    void bd.where(filter);
+    const processedFilter = tableName
+      ? Object.fromEntries(
+          Object.entries(filter)
+            .filter(([key]) => !excludeKeys || !excludeKeys.includes(key as keyof R))
+            .map(([key, value]) => [`${tableName}.${key}`, value])
+        )
+      : filter;
+
+    void bd.where(processedFilter);
     if ($in) {
       Object.entries($in).forEach(([key, val]) => {
         if (val) {
-          void bd.whereIn(key as never, val as never);
+          void bd.whereIn([`${tableName ? `${tableName}.` : ""}${key}`] as never, val as never);
         }
       });
     }
 
     if ($notNull?.length) {
       $notNull.forEach((key) => {
-        void bd.whereNotNull(key as never);
+        void bd.whereNotNull([`${tableName ? `${tableName}.` : ""}${key as string}`] as never);
       });
     }
 
     if ($search) {
       Object.entries($search).forEach(([key, val]) => {
         if (val) {
-          void bd.whereILike(key as never, val as never);
+          void bd.whereILike([`${tableName ? `${tableName}.` : ""}${key}`] as never, val as never);
         }
       });
     }

backend/src/lib/validator/validate-url.ts

@@ -15,13 +15,13 @@ export const blockLocalAndPrivateIpAddresses = async (url: string) => {
 
   const validUrl = new URL(url);
   const inputHostIps: string[] = [];
-  if (isIPv4(validUrl.host)) {
-    inputHostIps.push(validUrl.host);
+  if (isIPv4(validUrl.hostname)) {
+    inputHostIps.push(validUrl.hostname);
   } else {
-    if (validUrl.host === "localhost" || validUrl.host === "host.docker.internal") {
+    if (validUrl.hostname === "localhost" || validUrl.hostname === "host.docker.internal") {
       throw new BadRequestError({ message: "Local IPs not allowed as URL" });
     }
-    const resolvedIps = await dns.resolve4(validUrl.host);
+    const resolvedIps = await dns.resolve4(validUrl.hostname);
     inputHostIps.push(...resolvedIps);
   }
   const isInternalIp = inputHostIps.some((el) => isPrivateIp(el));

backend/src/services/secret-sync/teamcity/teamcity-sync-fns.ts

@@ -10,7 +10,7 @@ import {
   TTeamCitySyncWithCredentials
 } from "@app/services/secret-sync/teamcity/teamcity-sync-types";
 
-// Note: Most variables won't be returned with a value due to them being a "password" type (starting with "env.").
+// Note: Most variables won't be returned with a value due to them being a "password" type.
 // TeamCity API returns empty string for password-type variables for security reasons.
 const listTeamCityVariables = async ({ instanceUrl, accessToken, project, buildConfig }: TTeamCityListVariables) => {
   const { data } = await request.get<TTeamCityListVariablesResponse>(
@@ -25,12 +25,16 @@ const listTeamCityVariables = async ({ instanceUrl, accessToken, project, buildC
     }
   );
 
+  // Filters for only non-inherited environment variables
   // Strips out "env." from map key, but the "name" field still has the original unaltered key.
   return Object.fromEntries(
-    data.property.map((variable) => [
-      variable.name.startsWith("env.") ? variable.name.substring(4) : variable.name,
-      { ...variable, value: variable.value || "" } // Password values will be empty strings from the API for security
-    ])
+    data.property
+      .filter((variable) => !variable.inherited)
+      .filter((variable) => variable.name.startsWith("env."))
+      .map((variable) => [
+        variable.name.substring(4),
+        { ...variable, value: variable.value || "" } // Password values will be empty strings from the API for security
+      ])
   );
 };
 

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -64,7 +64,8 @@ export const secretV2BridgeDALFactory = ({ db, keyStore }: TSecretV2DalArg) => {
   const findOne = async (filter: Partial<TSecretsV2>, tx?: Knex) => {
     try {
       const docs = await (tx || db)(TableName.SecretV2)
-        .where(filter)
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter(filter, TableName.SecretV2))
         .leftJoin(
           TableName.SecretV2JnTag,
           `${TableName.SecretV2}.id`,

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -2,7 +2,7 @@ import path from "node:path";
 
 import RE2 from "re2";
 
-import { TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas";
+import { SecretType, TableName, TSecretFolders, TSecretsV2 } from "@app/db/schemas";
 import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
@@ -720,7 +720,7 @@ export const reshapeBridgeSecret = (
   secretReminderRecipients: secret.secretReminderRecipients || [],
   ...(secretValueHidden
     ? {
-        secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK,
+        secretValue: secret.type === SecretType.Personal ? secret.value : INFISICAL_SECRET_VALUE_HIDDEN_MASK,
         secretValueHidden: true
       }
     : {