From 497761a0e5d24c47face9c416caaaa2d86fe6a56 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Tue, 11 Mar 2025 05:44:28 +0400
Subject: [PATCH] fix: missing permision check

---
 backend/src/server/routes/v1/dashboard-router.ts      |  3 ++-
 .../secret-v2-bridge/secret-v2-bridge-service.ts      | 11 ++++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/backend/src/server/routes/v1/dashboard-router.ts b/backend/src/server/routes/v1/dashboard-router.ts
index 392fcf5d9..db61594a2 100644
--- a/backend/src/server/routes/v1/dashboard-router.ts
+++ b/backend/src/server/routes/v1/dashboard-router.ts
@@ -853,7 +853,8 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         200: z.object({
           secrets: secretRawSchema
             .extend({
-              secretPath: z.string().optional()
+              secretPath: z.string().optional(),
+              secretValueHidden: z.boolean()
             })
             .array()
             .optional()
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index c66fdddf1..09b3a50cb 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -2672,6 +2672,15 @@ export const secretV2BridgeServiceFactory = ({
         return true;
       })
       .map((secret) => {
+        const secretValueHidden =
+          filterByAction === ProjectPermissionSecretActions.DescribeSecret &&
+          !hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
+            environment,
+            secretPath,
+            secretName: secret.key,
+            secretTags: secret.tags.map((i) => i.slug)
+          });
+
         return reshapeBridgeSecret(
           projectId,
           environment,
@@ -2685,7 +2694,7 @@ export const secretV2BridgeServiceFactory = ({
               ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
               : ""
           },
-          false
+          secretValueHidden
         );
       });