fix: missing permision check

backend/src/server/routes/v1/dashboard-router.ts

@@ -853,7 +853,8 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         200: z.object({
           secrets: secretRawSchema
             .extend({
-              secretPath: z.string().optional()
+              secretPath: z.string().optional(),
+              secretValueHidden: z.boolean()
             })
             .array()
             .optional()

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -2672,6 +2672,15 @@ export const secretV2BridgeServiceFactory = ({
         return true;
       })
       .map((secret) => {
+        const secretValueHidden =
+          filterByAction === ProjectPermissionSecretActions.DescribeSecret &&
+          !hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
+            environment,
+            secretPath,
+            secretName: secret.key,
+            secretTags: secret.tags.map((i) => i.slug)
+          });
+
         return reshapeBridgeSecret(
           projectId,
           environment,
@@ -2685,7 +2694,7 @@ export const secretV2BridgeServiceFactory = ({
               ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
               : ""
           },
-          false
+          secretValueHidden
         );
       });