feat(api): view secret value, WIP

backend/src/db/migrations/20250218020306_backfill-secret-permissions-with-readvalue.ts

@@ -0,0 +1,36 @@
+import { selectAllTableCols } from "@app/lib/knex";
+import { Knex } from "knex";
+import { TableName } from "../schemas";
+
+// [["read,create","secrets",{"environment":{"$eq":"dev"}}],
+//  ["read,edit,create","secrets",{"environment":{"$eq":"staging"}}],
+//  ["read,create","secrets",{"environment":{"$eq":"prod"}},1],
+//  ["edit,delete,create","secret-folders",{}],
+//  ["read,edit,delete,create","secret-imports",{}],
+//  ["read,edit,delete,create","member"],
+//  ["read,edit,delete,create","role"],
+//  ["read,edit,delete,create","integrations"],
+//  ["read,edit","settings"],
+//  ["edit,delete","workspace"],
+//  ["read,edit,delete,create","tags"],
+//  ["read,create,edit,delete,sync-secrets,import-secrets,remove-secrets","secret-syncs"]]
+
+// enum ProjectPermissionSub {
+//   Secrets = "secrets"
+// }
+
+export async function up(knex: Knex): Promise<void> {
+  const projectRoles = await knex(TableName.ProjectRoles).select(selectAllTableCols(TableName.ProjectRoles));
+
+  for (const projectRole of projectRoles) {
+    const { _, permissions } = projectRole;
+
+    const parsedPermissions = JSON.parse(permissions as string) as Record<string, string>[]; // contains array of permissions.
+
+    for (const parsedPermission of parsedPermissions) {
+      console.log(parsedPermission);
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {}

backend/src/ee/routes/v1/secret-router.ts

@@ -1,6 +1,6 @@
 import z from "zod";
 
-import { ProjectPermissionActions } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
 import { RAW_SECRETS } from "@app/lib/api-docs";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { readLimit } from "@app/server/config/rateLimiter";
@@ -9,7 +9,7 @@ import { AuthMode } from "@app/services/auth/auth-type";
 
 const AccessListEntrySchema = z
   .object({
-    allowedActions: z.nativeEnum(ProjectPermissionActions).array(),
+    allowedActions: z.nativeEnum(ProjectPermissionSecretActions).array(),
     id: z.string(),
     membershipId: z.string(),
     name: z.string()

backend/src/ee/services/permission/project-permission.ts

@@ -17,6 +17,14 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
+export enum ProjectPermissionSecretActions {
+  DescribeSecret = "read",
+  ReadValue = "readValue",
+  Create = "create",
+  Edit = "edit",
+  Delete = "delete"
+}
+
 export enum ProjectPermissionCmekActions {
   Read = "read",
   Create = "create",
@@ -115,7 +123,7 @@ export type IdentityManagementSubjectFields = {
 
 export type ProjectPermissionSet =
   | [
-      ProjectPermissionActions,
+      ProjectPermissionSecretActions,
       ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SecretSubjectFields)
     ]
   | [
@@ -433,7 +441,7 @@ export const ProjectPermissionV1Schema = z.discriminatedUnion("subject", [
   z.object({
     subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretActions).describe(
       "Describe what action an entity can take."
     ),
     conditions: SecretConditionV1Schema.describe(
@@ -460,7 +468,7 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
   z.object({
     subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretActions).describe(
       "Describe what action an entity can take."
     ),
     conditions: SecretConditionV2Schema.describe(
@@ -517,7 +525,6 @@ const buildAdminPermissionRules = () => {
 
   // Admins get full access to everything
   [
-    ProjectPermissionSub.Secrets,
     ProjectPermissionSub.SecretFolders,
     ProjectPermissionSub.SecretImports,
     ProjectPermissionSub.SecretApproval,
@@ -550,10 +557,21 @@ const buildAdminPermissionRules = () => {
         ProjectPermissionActions.Create,
         ProjectPermissionActions.Delete
       ],
-      el as ProjectPermissionSub
+      el
     );
   });
 
+  can(
+    [
+      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionSecretActions.ReadValue,
+      ProjectPermissionSecretActions.Create,
+      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionSecretActions.Delete
+    ],
+    ProjectPermissionSub.Secrets
+  );
+
   can(
     [
       ProjectPermissionDynamicSecretActions.ReadRootCredential,
@@ -613,10 +631,11 @@ const buildMemberPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionActions.Read,
-      ProjectPermissionActions.Edit,
-      ProjectPermissionActions.Create,
-      ProjectPermissionActions.Delete
+      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionSecretActions.ReadValue,
+      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionSecretActions.Create,
+      ProjectPermissionSecretActions.Delete
     ],
     ProjectPermissionSub.Secrets
   );
@@ -788,7 +807,8 @@ export const projectMemberPermissions = buildMemberPermissionRules();
 const buildViewerPermissionRules = () => {
   const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  // ? Q(Daniel): Should the viewer role be allowed to read values? Currently not allowed in permission below.
+  can(ProjectPermissionSecretActions.DescribeSecret, ProjectPermissionSub.Secrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
   can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
@@ -831,6 +851,8 @@ export const buildServiceTokenProjectPermission = (
 ) => {
   const canWrite = permission.includes("write");
   const canRead = permission.includes("read");
+  const canReadValue = permission.includes("readValue");
+
   const { can, build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
   scopes.forEach(({ secretPath, environment }) => {
     [ProjectPermissionSub.Secrets, ProjectPermissionSub.SecretImports, ProjectPermissionSub.SecretFolders].forEach(
@@ -860,6 +882,14 @@ export const buildServiceTokenProjectPermission = (
             environment
           });
         }
+
+        if (subject === ProjectPermissionSub.Secrets && canReadValue) {
+          // @ts-expect-error type
+          can(ProjectPermissionSecretActions.ReadValue, subject as ProjectPermissionSub.Secrets, {
+            secretPath: { $glob: secretPath },
+            environment
+          });
+        }
       }
     );
   });

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -58,7 +58,7 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { ProjectPermissionSecretActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TSecretApprovalPolicyDALFactory } from "../secret-approval-policy/secret-approval-policy-dal";
 import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";
 import { TSecretApprovalRequestDALFactory } from "./secret-approval-request-dal";
@@ -88,7 +88,12 @@ type TSecretApprovalRequestServiceFactoryDep = {
   secretDAL: TSecretDALFactory;
   secretTagDAL: Pick<
     TSecretTagDALFactory,
-    "findManyTagsById" | "saveTagsToSecret" | "deleteTagsManySecret" | "saveTagsToSecretV2" | "deleteTagsToSecretV2"
+    | "findManyTagsById"
+    | "saveTagsToSecret"
+    | "deleteTagsManySecret"
+    | "saveTagsToSecretV2"
+    | "deleteTagsToSecretV2"
+    | "find"
   >;
   secretBlindIndexDAL: Pick<TSecretBlindIndexDALFactory, "findOne">;
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
@@ -914,7 +919,7 @@ export const secretApprovalRequestServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -1001,6 +1006,7 @@ export const secretApprovalRequestServiceFactory = ({
               : keyName2BlindIndex[secretName];
           // add tags
           if (tagIds?.length) commitTagIds[keyName2BlindIndex[secretName]] = tagIds;
+
           return {
             ...latestSecretVersions[secretId],
             ...el,
@@ -1363,9 +1369,9 @@ export const secretApprovalRequestServiceFactory = ({
     const tagsGroupById = groupBy(tags, (i) => i.id);
 
     commits.forEach((commit) => {
-      let action = ProjectPermissionActions.Create;
-      if (commit.op === SecretOperations.Update) action = ProjectPermissionActions.Edit;
-      if (commit.op === SecretOperations.Delete) action = ProjectPermissionActions.Delete;
+      let action = ProjectPermissionSecretActions.Create;
+      if (commit.op === SecretOperations.Update) action = ProjectPermissionSecretActions.Edit;
+      if (commit.op === SecretOperations.Delete) action = ProjectPermissionSecretActions.Delete;
 
       ForbiddenError.from(permission).throwUnlessCan(
         action,

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -15,7 +15,11 @@ import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "../permission/project-permission";
 import { TSecretRotationDALFactory } from "./secret-rotation-dal";
 import { TSecretRotationQueueFactory } from "./secret-rotation-queue";
 import { TSecretRotationEncData } from "./secret-rotation-queue/secret-rotation-queue-types";
@@ -106,7 +110,7 @@ export const secretRotationServiceFactory = ({
       });
     }
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -22,7 +22,11 @@ import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/se
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "../permission/project-permission";
 import {
   TGetSnapshotDataDTO,
   TProjectSnapshotCountDTO,
@@ -97,7 +101,7 @@ export const secretSnapshotServiceFactory = ({
 
     // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -134,7 +138,7 @@ export const secretSnapshotServiceFactory = ({
 
     // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -224,7 +228,7 @@ export const secretSnapshotServiceFactory = ({
 
     // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: snapshotDetails.environment.slug,
         secretPath: fullFolderPath

backend/src/lib/api-docs/constants.ts

@@ -666,6 +666,7 @@ export const SECRETS = {
     secretPath: "The path of the secret to attach tags to.",
     type: "The type of the secret to attach tags to. (shared/personal)",
     environment: "The slug of the environment where the secret is located",
+    viewSecretValue: "Whether or not to retrieve the secret value.",
     projectSlug: "The slug of the project where the secret is located.",
     tagSlugs: "An array of existing tag slugs to attach to the secret."
   },
@@ -689,6 +690,7 @@ export const RAW_SECRETS = {
       "The slug of the project to list secrets from. This parameter is only applicable by machine identities.",
     environment: "The slug of the environment to list secrets from.",
     secretPath: "The secret path to list secrets from.",
+    viewSecretValue: "Whether or not to retrieve the secret value.",
     includeImports: "Weather to include imported secrets or not.",
     tagSlugs: "The comma separated tag slugs to filter secrets.",
     metadataFilter:
@@ -717,6 +719,7 @@ export const RAW_SECRETS = {
     secretPath: "The path of the secret to get.",
     version: "The version of the secret to get.",
     type: "The type of the secret to get.",
+    viewSecretValue: "Whether or not to retrieve the secret value.",
     includeImports: "Weather to include imported secrets or not."
   },
   UPDATE: {

backend/src/lib/errors/index.ts

@@ -1,3 +1,6 @@
+// eslint-disable-next-line max-classes-per-file
+import { AnyAbility, ForbiddenError } from "@casl/ability";
+
 /* eslint-disable max-classes-per-file */
 export class DatabaseError extends Error {
   name: string;
@@ -59,6 +62,13 @@ export class ForbiddenRequestError extends Error {
   }
 }
 
+export class ForbiddenReadSecretError extends ForbiddenRequestError {
+  constructor({ error, message }: { message?: string; error?: unknown } = {}) {
+    super({ message, error });
+    this.name = "ForbiddenReadSecretError";
+  }
+}
+
 export class BadRequestError extends Error {
   name: string;
 

backend/src/server/routes/v1/dashboard-router.ts

@@ -116,6 +116,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           dynamicSecrets: SanitizedDynamicSecretSchema.extend({ environment: z.string() }).array().optional(),
           secrets: secretRawSchema
             .extend({
+              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
               tags: SecretTagsSchema.pick({
@@ -294,6 +295,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
 
         if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
           secrets = await server.services.secret.getSecretsRawMultiEnv({
+            viewSecretValue: true,
             actorId: req.permission.id,
             actor: req.permission.type,
             actorOrgId: req.permission.orgId,
@@ -393,6 +395,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           .optional(),
         search: z.string().trim().describe(DASHBOARD.SECRET_DETAILS_LIST.search).optional(),
         tags: z.string().trim().transform(decodeURIComponent).describe(DASHBOARD.SECRET_DETAILS_LIST.tags).optional(),
+        viewSecretValue: booleanSchema.default(true),
         includeSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeSecrets),
         includeFolders: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeFolders),
         includeDynamicSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeDynamicSecrets),
@@ -410,6 +413,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           dynamicSecrets: SanitizedDynamicSecretSchema.array().optional(),
           secrets: secretRawSchema
             .extend({
+              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
               tags: SecretTagsSchema.pick({
@@ -600,10 +604,18 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             tagSlugs: tags
           });
 
+          console.log("totalSecretCount", totalSecretCount);
+          console.log("adjustedOffset", adjustedOffset);
+          console.log("remainingLimit", remainingLimit);
+
+          console.log("will resolve to true", remainingLimit > 0 && totalSecretCount > adjustedOffset);
+
           if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
+            console.log("before running");
             const secretsRaw = await server.services.secret.getSecretsRaw({
               actorId: req.permission.id,
               actor: req.permission.type,
+              viewSecretValue: req.query.viewSecretValue,
               actorOrgId: req.permission.orgId,
               environment,
               actorAuthMethod: req.permission.authMethod,
@@ -617,6 +629,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
               tagSlugs: tags
             });
 
+            console.log("secretsRaw", secretsRaw);
             secrets = secretsRaw.secrets;
 
             await server.services.auditLog.createAuditLog({
@@ -649,6 +662,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           }
         }
       } catch (error) {
+        console.log(error);
         if (!(error instanceof ForbiddenError)) {
           throw error;
         }
@@ -862,12 +876,14 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         projectId: z.string().trim(),
         environment: z.string().trim(),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        keys: z.string().trim().transform(decodeURIComponent)
+        keys: z.string().trim().transform(decodeURIComponent),
+        viewSecretValue: booleanSchema.default(true)
       }),
       response: {
         200: z.object({
           secrets: secretRawSchema
             .extend({
+              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
               tags: SecretTagsSchema.pick({
@@ -886,7 +902,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const { secretPath, projectId, environment } = req.query;
+      const { secretPath, projectId, environment, viewSecretValue } = req.query;
 
       const keys = req.query.keys?.split(",").filter((key) => Boolean(key.trim())) ?? [];
       if (!keys.length) throw new BadRequestError({ message: "One or more keys required" });
@@ -895,6 +911,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         actorId: req.permission.id,
         actor: req.permission.type,
         actorOrgId: req.permission.orgId,
+        viewSecretValue,
         environment,
         actorAuthMethod: req.permission.authMethod,
         projectId,

backend/src/server/routes/v3/login-router.ts

@@ -77,6 +77,8 @@ export const registerLoginRouter = async (server: FastifyZodProvider) => {
         secure: cfg.HTTPS_ENABLED
       });
 
+      console.log("access token", tokens.access);
+
       return { token: tokens.access, isMfaEnabled: false };
     }
   });

backend/src/server/routes/v3/secret-router.ts

@@ -31,6 +31,14 @@ const SecretReferenceNode = z.object({
   environment: z.string(),
   secretPath: z.string()
 });
+
+const convertStringBoolean = (defaultValue: boolean = false) => {
+  return z
+    .enum(["true", "false"])
+    .default(defaultValue ? "true" : "false")
+    .transform((value) => value === "true");
+};
+
 type TSecretReferenceNode = z.infer<typeof SecretReferenceNode> & { children: TSecretReferenceNode[] };
 
 const SecretReferenceNodeTree: z.ZodType<TSecretReferenceNode> = SecretReferenceNode.extend({
@@ -45,6 +53,7 @@ const SecretNameSchema = BaseSecretNameSchema.refine(
 ).refine((el) => !el.includes(":"), "Secret name cannot contain colon.");
 
 export const registerSecretRouter = async (server: FastifyZodProvider) => {
+  // ! Note(Daniel): (Tags) Does not support secrets v2. Request will fail if user doesn't have read value permission.
   server.route({
     method: "POST",
     url: "/tags/:secretName",
@@ -64,6 +73,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       body: z.object({
         projectSlug: z.string().trim().describe(SECRETS.ATTACH_TAGS.projectSlug),
         environment: z.string().trim().describe(SECRETS.ATTACH_TAGS.environment),
+        viewSecretValue: convertStringBoolean(true).describe(SECRETS.ATTACH_TAGS.viewSecretValue),
         secretPath: z
           .string()
           .trim()
@@ -108,6 +118,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ! Note(Daniel): (Tags) Does not support secrets v2. Request will fail if user doesn't have read value permission.
   server.route({
     method: "DELETE",
     url: "/tags/:secretName",
@@ -169,6 +180,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Note(Daniel): (Secrets) Done for v2 secrets AND normal secrets GET /raw
   server.route({
     method: "GET",
     url: "/raw",
@@ -247,21 +259,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         workspaceSlug: z.string().trim().optional().describe(RAW_SECRETS.LIST.workspaceSlug),
         environment: z.string().trim().optional().describe(RAW_SECRETS.LIST.environment),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash).describe(RAW_SECRETS.LIST.secretPath),
-        expandSecretReferences: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
-          .describe(RAW_SECRETS.LIST.expand),
-        recursive: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
-          .describe(RAW_SECRETS.LIST.recursive),
-        include_imports: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
-          .describe(RAW_SECRETS.LIST.includeImports),
+        viewSecretValue: convertStringBoolean(true).describe(RAW_SECRETS.LIST.viewSecretValue),
+        expandSecretReferences: convertStringBoolean().describe(RAW_SECRETS.LIST.expand),
+        recursive: convertStringBoolean().describe(RAW_SECRETS.LIST.recursive),
+        include_imports: convertStringBoolean().describe(RAW_SECRETS.LIST.includeImports),
         tagSlugs: z
           .string()
           .describe(RAW_SECRETS.LIST.tagSlugs)
@@ -274,6 +275,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           secrets: secretRawSchema
             .extend({
               secretPath: z.string().optional(),
+              secretValueHidden: z.boolean(),
               secretMetadata: ResourceMetadataSchema.optional(),
               tags: SecretTagsSchema.pick({
                 id: true,
@@ -293,6 +295,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
               secrets: secretRawSchema
                 .omit({ createdAt: true, updatedAt: true })
                 .extend({
+                  // secretValueHidden: z.boolean(),
                   secretMetadata: ResourceMetadataSchema.optional()
                 })
                 .array()
@@ -342,6 +345,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         expandSecretReferences: req.query.expandSecretReferences,
         actorAuthMethod: req.permission.authMethod,
         projectId: workspaceId,
+        viewSecretValue: req.query.viewSecretValue,
         path: secretPath,
         metadataFilter: req.query.metadataFilter,
         includeImports: req.query.include_imports,
@@ -376,10 +380,12 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           }
         });
       }
+
       return { secrets, imports };
     }
   });
 
+  // !!!!!!!!!!!!!!!!!!!!! Note(Daniel): (Secrets) Done for v2 secrets -- GET /raw/:secretName
   server.route({
     method: "GET",
     url: "/raw/:secretName",
@@ -403,20 +409,14 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash).describe(RAW_SECRETS.GET.secretPath),
         version: z.coerce.number().optional().describe(RAW_SECRETS.GET.version),
         type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.GET.type),
-        expandSecretReferences: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
-          .describe(RAW_SECRETS.GET.expand),
-        include_imports: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
-          .describe(RAW_SECRETS.GET.includeImports)
+        viewSecretValue: convertStringBoolean(true).describe(RAW_SECRETS.GET.viewSecretValue),
+        expandSecretReferences: convertStringBoolean().describe(RAW_SECRETS.GET.expand),
+        include_imports: convertStringBoolean().describe(RAW_SECRETS.GET.includeImports)
       }),
       response: {
         200: z.object({
           secret: secretRawSchema.extend({
+            secretValueHidden: z.boolean(),
             tags: SecretTagsSchema.pick({
               id: true,
               slug: true,
@@ -456,6 +456,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         expandSecretReferences: req.query.expandSecretReferences,
         environment,
         projectId: workspaceId,
+        viewSecretValue: req.query.viewSecretValue,
         projectSlug: workspaceSlug,
         path: secretPath,
         secretName: req.params.secretName,
@@ -498,6 +499,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ? Note(Daniel): No modify, if user has Create permissions it will return the value they created for this secret --- POST /raw/:secretName
   server.route({
     method: "POST",
     url: "/raw/:secretName",
@@ -611,6 +613,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ? Note(Daniel): Will NOT throw an error. If the user has access to read value, it will return value.
+  // ? Note(Daniel): If user does NOT have access to read value, it will return <hidden-by-infisical> for the value, but succeed with update.
+  // !!!!! Done for both secret types. For legacy secrets, it will return <hidden-by-infisical> if no read value permission is present.
   server.route({
     method: "PATCH",
     url: "/raw/:secretName",
@@ -728,6 +733,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ? Note(Daniel): Will NOT throw an error. If the user has access to read value, it will return the deleted value
+  // ? Note(Daniel): If user does NOT have access to read value, it will return <hidden> for the value, but succeed with delete.
+  // !!!!! Done for both secret types. For legacy secrets, it will return <hidden> if no read value permission is present. --- /raw/:secretName
   server.route({
     method: "DELETE",
     url: "/raw/:secretName",
@@ -758,7 +766,9 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secret: secretRawSchema
+            secret: secretRawSchema.extend({
+              secretValueHidden: z.boolean()
+            })
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -780,6 +790,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       if (secretOperation.type === SecretProtectionType.Approval) {
         return { approval: secretOperation.approval };
       }
+
       const { secret } = secretOperation;
 
       await server.services.auditLog.createAuditLog({
@@ -814,6 +825,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Will throw without the `readValue` permission, just like before.
   server.route({
     method: "GET",
     url: "/",
@@ -928,6 +940,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Will throw without the `readValue` permission, just like before.
   server.route({
     method: "GET",
     url: "/:secretName",
@@ -942,12 +955,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         workspaceId: z.string().trim(),
         environment: z.string().trim(),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
+        viewSecretValue: convertStringBoolean(true),
         type: z.nativeEnum(SecretType).default(SecretType.Shared),
         version: z.coerce.number().optional(),
-        include_imports: z
-          .enum(["true", "false"])
-          .default("false")
-          .transform((value) => value === "true")
+        include_imports: convertStringBoolean()
       }),
       response: {
         200: z.object({
@@ -1009,6 +1020,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Will work exactly like before. It will not attempt to hide the secret value, because the user creating this secret will already know the value upon creation.
   server.route({
     url: "/:secretName",
     method: "POST",
@@ -1180,6 +1192,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Will work like before, EXCEPT, if the user doesn't have the `readValue` permission, the secret value will be marked as "<hidden-by-infisical>"
   server.route({
     method: "PATCH",
     url: "/:secretName",
@@ -1218,6 +1231,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           z.object({
             secret: SecretsSchema.omit({ secretBlindIndex: true }).merge(
               z.object({
+                secretValueHidden: z.boolean(),
                 _id: z.string(),
                 workspace: z.string(),
                 environment: z.string()
@@ -1367,6 +1381,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Will work like before, EXCEPT, if the user doesn't have the `readValue` permission, the secret value will be marked as "<hidden-by-infisical>"
   server.route({
     method: "DELETE",
     url: "/:secretName",
@@ -1491,6 +1506,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ? No need for update, as this endpoint does not expose any values.
   server.route({
     method: "POST",
     url: "/move",
@@ -1546,6 +1562,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. This will works exactly like before. It will not attempt to hide the secret value, because the user creating this secret will already know the value(s) upon creation.
   server.route({
     method: "POST",
     url: "/batch",
@@ -1672,6 +1689,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Works as before, EXCEPT if the user doesn't have the `readValue` permission, the secret value(s) will be marked as "<hidden-by-infisical>"
   server.route({
     method: "PATCH",
     url: "/batch",
@@ -1705,7 +1723,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: SecretsSchema.omit({ secretBlindIndex: true }).array()
+            secrets: SecretsSchema.omit({ secretBlindIndex: true }).extend({ secretValueHidden: z.boolean() }).array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -1798,6 +1816,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // !!!! Done. Works as before, EXCEPT if the user doesn't have the `readValue` permission, the secret value(s) will be marked as "<hidden-by-infisical>"
   server.route({
     method: "DELETE",
     url: "/batch",
@@ -1820,7 +1839,11 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: SecretsSchema.omit({ secretBlindIndex: true }).array()
+            secrets: SecretsSchema.omit({ secretBlindIndex: true })
+              .extend({
+                secretValueHidden: z.boolean()
+              })
+              .array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -1912,6 +1935,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ! (Daniel): Done. Will not attempt to hide secret value because this is a create operation.
   server.route({
     method: "POST",
     url: "/batch/raw",
@@ -2018,6 +2042,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ! Done. Works as before, except if the user doesn't have the `readValue` permission, the secret value(s) will be marked as "<hidden-by-infisical>"
   server.route({
     method: "PATCH",
     url: "/batch/raw",
@@ -2082,7 +2107,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: secretRawSchema.array()
+            secrets: secretRawSchema.extend({ secretValueHidden: z.boolean() }).array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -2170,6 +2195,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ! (Daniel): Done. Works as before, except if the user doesn't have the `readValue` permission, the secret value(s) will be marked as "<hidden-by-infisical>"
   server.route({
     method: "DELETE",
     url: "/batch/raw",
@@ -2204,7 +2230,11 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: secretRawSchema.array()
+            secrets: secretRawSchema
+              .extend({
+                secretValueHidden: z.boolean()
+              })
+              .array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -2262,6 +2292,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ! IMPORTANT: CHANGED BEHAVIOR -> Now this endpoint will throw a descriptive error if the user doesn't have access to the value of the secret itself.
   server.route({
     method: "GET",
     url: "/raw/:secretName/secret-reference-tree",
@@ -2314,6 +2345,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  // ? No work needed, does not expose secret value.
   server.route({
     method: "POST",
     url: "/backfill-secret-references",

backend/src/services/external-migration/external-migration-fns.ts

@@ -33,7 +33,7 @@ export type TImportDataIntoInfisicalDTO = {
 
   secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
 
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany">;

backend/src/services/external-migration/external-migration-queue.ts

@@ -29,7 +29,7 @@ export type TExternalMigrationQueueFactoryDep = {
 
   secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
 
   folderDAL: Pick<TSecretFolderDALFactory, "create" | "findBySecretPath" | "findOne" | "findById">;

backend/src/services/integration/integration-service.ts

@@ -2,7 +2,11 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
 
@@ -92,7 +96,7 @@ export const integrationServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: sourceEnvironment,
         secretPath
@@ -175,7 +179,7 @@ export const integrationServiceFactory = ({
 
     if (environment || secretPath) {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: newEnvironment,
           secretPath: newSecretPath

backend/src/services/project/project-service.ts

@@ -11,7 +11,11 @@ import {
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { InfisicalProjectTemplate } from "@app/ee/services/project-template/project-template-types";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
@@ -747,7 +751,10 @@ export const projectServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.Any
     });
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionSub.Secrets
+    );
 
     const project = await projectDAL.findProjectById(projectId);
 

backend/src/services/secret-import/secret-import-service.ts

@@ -5,7 +5,11 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { getReplicationFolderName } from "@app/ee/services/secret-replication/secret-replication-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -90,7 +94,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: data.environment,
         secretPath: data.path
@@ -402,7 +406,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: secretImportDoc.importEnv.slug,
         secretPath: secretImportDoc.importPath
@@ -596,7 +600,7 @@ export const secretImportServiceFactory = ({
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -647,7 +651,7 @@ export const secretImportServiceFactory = ({
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
           permission.can(
-            ProjectPermissionActions.Read,
+            ProjectPermissionSecretActions.ReadValue,
             subject(ProjectPermissionSub.Secrets, {
               environment: expandEnvironment,
               secretPath: expandSecretPath,
@@ -667,7 +671,7 @@ export const secretImportServiceFactory = ({
 
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -683,7 +687,10 @@ export const secretImportServiceFactory = ({
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>
-        decryptSecretRaw({ ...encryptedSecret, workspace: projectId, environment, secretPath }, botKey)
+        decryptSecretRaw(
+          { ...encryptedSecret, workspace: projectId, environment, secretPath, secretValueHidden: false },
+          botKey
+        )
       )
     }));
   };

backend/src/services/secret-sync/secret-sync-service.ts

@@ -3,7 +3,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
-  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
   ProjectPermissionSecretSyncActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
@@ -179,7 +179,7 @@ export const secretSyncServiceFactory = ({
     );
 
     ForbiddenError.from(projectPermission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath
@@ -270,7 +270,7 @@ export const secretSyncServiceFactory = ({
         throw new BadRequestError({ message: "Must specify both source environment and secret path" });
 
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: updatedEnvironment,
           secretPath: updatedSecretPath

backend/src/services/secret-tag/secret-tag-dal.ts

@@ -47,6 +47,7 @@ export const secretTagDALFactory = (db: TDbClient) => {
       throw new DatabaseError({ error, name: "Find all by ids" });
     }
   };
+
   return {
     ...secretTagOrm,
     saveTagsToSecret: secretJnTagOrm.insertMany,

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -102,6 +102,19 @@ export const fnSecretBulkInsert = async ({
       [`${TableName.SecretV2}Id` as const]: newSecretGroupedByKeyName[key][0].id
     }))
   );
+
+  const secretTags = await secretTagDAL.find({
+    $in: {
+      id: newSecretTags.map((el) => el.secret_tagsId)
+    }
+  });
+
+  const secretTagsWithSlugs = await secretTagDAL.find({
+    $in: {
+      id: secretTags.map((el) => el.id)
+    }
+  });
+
   const secretVersions = await secretVersionDAL.insertMany(
     sanitizedInputSecrets.map((el) => ({
       ...el,
@@ -137,6 +150,7 @@ export const fnSecretBulkInsert = async ({
   if (newSecretTags.length) {
     const secTags = await secretTagDAL.saveTagsToSecretV2(newSecretTags, tx);
     const secVersionsGroupBySecId = groupBy(secretVersions, (i) => i.secretId);
+
     const newSecretVersionTags = secTags.flatMap(({ secrets_v2Id, secret_tagsId }) => ({
       [`${TableName.SecretVersionV2}Id` as const]: secVersionsGroupBySecId[secrets_v2Id][0].id,
       [`${TableName.SecretTag}Id` as const]: secret_tagsId
@@ -623,13 +637,13 @@ export const reshapeBridgeSecret = (
       name: string;
     }[];
     secretMetadata?: ResourceMetadataDTO;
-  }
+  },
+  secretValueHidden?: boolean
 ) => ({
   secretKey: secret.key,
   secretPath,
   workspace: workspaceId,
   environment,
-  secretValue: secret.value || "",
   secretComment: secret.comment || "",
   version: secret.version,
   type: secret.type,
@@ -643,5 +657,15 @@ export const reshapeBridgeSecret = (
   metadata: secret.metadata,
   secretMetadata: secret.secretMetadata,
   createdAt: secret.createdAt,
-  updatedAt: secret.updatedAt
+  updatedAt: secret.updatedAt,
+
+  ...(secretValueHidden
+    ? {
+        secretValue: "<hidden-by-infisical>",
+        secretValueHidden: true
+      }
+    : {
+        secretValue: secret.value || "",
+        secretValueHidden: false
+      })
 });

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -11,12 +11,16 @@ import {
   TSecretsV2
 } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { BadRequestError, ForbiddenReadSecretError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { diff, groupBy } from "@app/lib/fn";
 import { setKnexStringValue } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
@@ -252,7 +256,7 @@ export const secretV2BridgeServiceFactory = ({
     const { secretName, type, ...inputSecretData } = inputSecret;
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionSecretActions.Create,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath,
@@ -271,8 +275,8 @@ export const secretV2BridgeServiceFactory = ({
       type: KmsDataKey.SecretManager,
       projectId
     });
-    const secret = await secretDAL.transaction((tx) =>
-      fnSecretBulkInsert({
+    const secret = await secretDAL.transaction(async (tx) => {
+      const [createdSecret] = await fnSecretBulkInsert({
         folderId,
         orgId: actorOrgId,
         inputSecrets: [
@@ -302,8 +306,10 @@ export const secretV2BridgeServiceFactory = ({
         secretTagDAL,
         secretVersionTagDAL,
         tx
-      })
-    );
+      });
+
+      return createdSecret;
+    });
 
     if (inputSecret.type === SecretType.Shared) {
       await snapshotService.performSnapshot(folderId);
@@ -318,7 +324,7 @@ export const secretV2BridgeServiceFactory = ({
     }
 
     return reshapeBridgeSecret(projectId, environment, secretPath, {
-      ...secret[0],
+      ...secret,
       value: inputSecret.secretValue,
       comment: inputSecret.secretComment || ""
     });
@@ -390,7 +396,7 @@ export const secretV2BridgeServiceFactory = ({
     }
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath,
@@ -407,7 +413,7 @@ export const secretV2BridgeServiceFactory = ({
 
     // now check with new ids
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath,
@@ -424,7 +430,7 @@ export const secretV2BridgeServiceFactory = ({
       });
       if (doesNewNameSecretExist) throw new BadRequestError({ message: "Secret with the new name already exist" });
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
+        ProjectPermissionSecretActions.Edit,
         subject(ProjectPermissionSub.Secrets, {
           environment,
           secretPath,
@@ -507,11 +513,27 @@ export const secretV2BridgeServiceFactory = ({
       });
     }
 
-    return reshapeBridgeSecret(projectId, environment, secretPath, {
-      ...updatedSecret[0],
-      value: inputSecret.secretValue || "",
-      comment: inputSecret.secretComment || ""
-    });
+    const secretValueHidden = !permission.can(
+      ProjectPermissionSecretActions.ReadValue,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath,
+        secretName: inputSecret.secretName, // ! Note(Daniel): We are checking for the EXISTING secret name, not the new secret name.
+        secretTags: tags?.map((el) => el.slug) // ! Note(Daniel): Same here
+      })
+    );
+
+    return reshapeBridgeSecret(
+      projectId,
+      environment,
+      secretPath,
+      {
+        ...updatedSecret[0],
+        value: inputSecret.secretValue || "",
+        comment: inputSecret.secretComment || ""
+      },
+      secretValueHidden
+    );
   };
 
   const deleteSecret = async ({
@@ -557,7 +579,7 @@ export const secretV2BridgeServiceFactory = ({
     });
     if (!secretToDelete) throw new NotFoundError({ message: "Secret not found" });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionSecretActions.Delete,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath,
@@ -599,15 +621,32 @@ export const secretV2BridgeServiceFactory = ({
       type: KmsDataKey.SecretManager,
       projectId
     });
-    return reshapeBridgeSecret(projectId, environment, secretPath, {
-      ...deletedSecret[0],
-      value: deletedSecret[0].encryptedValue
-        ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedValue }).toString()
-        : "",
-      comment: deletedSecret[0].encryptedComment
-        ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedComment }).toString()
-        : ""
-    });
+
+    const secretValueHidden = !permission.can(
+      ProjectPermissionSecretActions.ReadValue,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath,
+        secretName: secretToDelete.key,
+        secretTags: secretToDelete.tags?.map((el) => el.slug)
+      })
+    );
+
+    return reshapeBridgeSecret(
+      projectId,
+      environment,
+      secretPath,
+      {
+        ...deletedSecret[0],
+        value: deletedSecret[0].encryptedValue
+          ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedValue }).toString()
+          : "",
+        comment: deletedSecret[0].encryptedComment
+          ? secretManagerDecryptor({ cipherTextBlob: deletedSecret[0].encryptedComment }).toString()
+          : ""
+      },
+      secretValueHidden
+    );
   };
 
   // get unique secrets count for multiple envs
@@ -635,7 +674,10 @@ export const secretV2BridgeServiceFactory = ({
         actionProjectType: ActionProjectType.SecretManager
       });
 
-      ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionSecretActions.DescribeSecret,
+        ProjectPermissionSub.Secrets
+      );
     }
 
     const folders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, path);
@@ -682,7 +724,10 @@ export const secretV2BridgeServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionSub.Secrets
+    );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder) return 0;
@@ -693,7 +738,7 @@ export const secretV2BridgeServiceFactory = ({
   };
 
   const getSecretsByFolderMappings = async (
-    { projectId, userId, filters, folderMappings }: TGetSecretsRawByFolderMappingsDTO,
+    { projectId, userId, filters, folderMappings, filterByAction }: TGetSecretsRawByFolderMappingsDTO,
     projectPermission: Awaited<ReturnType<typeof permissionService.getProjectPermission>>["permission"]
   ) => {
     const groupedFolderMappings = groupBy(folderMappings, (folderMapping) => folderMapping.folderId);
@@ -710,10 +755,13 @@ export const secretV2BridgeServiceFactory = ({
       projectId
     });
 
+    // eslint-disable-next-line no-param-reassign
+    if (!filterByAction) filterByAction = ProjectPermissionSecretActions.ReadValue;
+
     const decryptedSecrets = secrets
       .filter((el) =>
         projectPermission.can(
-          ProjectPermissionActions.Read,
+          filterByAction as ProjectPermissionSecretActions, // ? Typescript assumes that filterByAction may be undefined, which is not true, so we are casting it to ProjectPermissionSecretActions
           subject(ProjectPermissionSub.Secrets, {
             environment: groupedFolderMappings[el.folderId][0].environment,
             secretPath: groupedFolderMappings[el.folderId][0].path,
@@ -722,8 +770,19 @@ export const secretV2BridgeServiceFactory = ({
           })
         )
       )
-      .map((secret) =>
-        reshapeBridgeSecret(
+      .map((secret) => {
+        // Note(Daniel): This is only relevant if the filterAction isn't set to ReadValue. This is needed for the frontend.
+        const secretValueHidden = !projectPermission.can(
+          ProjectPermissionSecretActions.ReadValue,
+          subject(ProjectPermissionSub.Secrets, {
+            environment: groupedFolderMappings[secret.folderId][0].environment,
+            secretPath: groupedFolderMappings[secret.folderId][0].path,
+            secretName: secret.key,
+            secretTags: secret.tags.map((i) => i.slug)
+          })
+        );
+
+        return reshapeBridgeSecret(
           projectId,
           groupedFolderMappings[secret.folderId][0].environment,
           groupedFolderMappings[secret.folderId][0].path,
@@ -735,9 +794,10 @@ export const secretV2BridgeServiceFactory = ({
             comment: secret.encryptedComment
               ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
               : ""
-          }
-        )
-      );
+          },
+          secretValueHidden
+        );
+      });
 
     return decryptedSecrets;
   };
@@ -766,7 +826,10 @@ export const secretV2BridgeServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     if (!isInternal) {
-      ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionSecretActions.DescribeSecret,
+        ProjectPermissionSub.Secrets
+      );
     }
 
     const folders = await folderDAL.findBySecretPathMultiEnv(projectId, environments, path);
@@ -786,7 +849,8 @@ export const secretV2BridgeServiceFactory = ({
         projectId,
         folderMappings,
         filters: params,
-        userId: actorId
+        userId: actorId,
+        filterByAction: ProjectPermissionSecretActions.DescribeSecret
       },
       permission
     );
@@ -801,6 +865,7 @@ export const secretV2BridgeServiceFactory = ({
     projectId,
     actor,
     actorOrgId,
+    viewSecretValue,
     actorAuthMethod,
     includeImports,
     recursive,
@@ -816,7 +881,14 @@ export const secretV2BridgeServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionSecretActions.DescribeSecret,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath: path,
+        secretTags: params.tagSlugs
+      })
+    );
 
     let paths: { folderId: string; path: string }[] = [];
 
@@ -854,28 +926,58 @@ export const secretV2BridgeServiceFactory = ({
     });
 
     const decryptedSecrets = secrets
-      .filter((el) =>
-        permission.can(
-          ProjectPermissionActions.Read,
+      .filter((el) => {
+        if (viewSecretValue) {
+          ForbiddenError.from(permission).throwUnlessCan(
+            ProjectPermissionSecretActions.ReadValue,
+            subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath: groupedPaths[el.folderId][0].path,
+              secretName: el.key,
+              secretTags: el.tags.map((i) => i.slug)
+            })
+          );
+        }
+
+        return permission.can(
+          ProjectPermissionSecretActions.DescribeSecret,
           subject(ProjectPermissionSub.Secrets, {
             environment,
             secretPath: groupedPaths[el.folderId][0].path,
             secretName: el.key,
             secretTags: el.tags.map((i) => i.slug)
           })
-        )
-      )
-      .map((secret) =>
-        reshapeBridgeSecret(projectId, environment, groupedPaths[secret.folderId][0].path, {
-          ...secret,
-          value: secret.encryptedValue
-            ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString()
-            : "",
-          comment: secret.encryptedComment
-            ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
-            : ""
-        })
-      );
+        );
+      })
+      .map((secret) => {
+        const secretValueHidden =
+          !viewSecretValue ||
+          !permission.can(
+            ProjectPermissionSecretActions.ReadValue,
+            subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath: groupedPaths[secret.folderId][0].path,
+              secretName: secret.key,
+              secretTags: secret.tags.map((i) => i.slug)
+            })
+          );
+
+        return reshapeBridgeSecret(
+          projectId,
+          environment,
+          groupedPaths[secret.folderId][0].path,
+          {
+            ...secret,
+            value: secret.encryptedValue
+              ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString()
+              : "",
+            comment: secret.encryptedComment
+              ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
+              : ""
+          },
+          secretValueHidden
+        );
+      });
 
     const { expandSecretReferences } = expandSecretReferencesFactory({
       projectId,
@@ -883,8 +985,9 @@ export const secretV2BridgeServiceFactory = ({
       secretDAL,
       decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined),
       canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
+        // ? Question(Daniel): Will throw an error if the user doesn't have access to any of the expanded secrets.
         permission.can(
-          ProjectPermissionActions.Read,
+          ProjectPermissionSecretActions.ReadValue,
           subject(ProjectPermissionSub.Secrets, {
             environment: expandEnvironment,
             secretPath: expandSecretPath,
@@ -929,16 +1032,28 @@ export const secretV2BridgeServiceFactory = ({
       secretImportDAL,
       expandSecretReferences,
       decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
-      hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
-        permission.can(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.Secrets, {
-            environment: expandEnvironment,
-            secretPath: expandSecretPath,
-            secretName: expandSecretKey,
-            secretTags: expandSecretTags
-          })
-        )
+      hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) => {
+        return (
+          permission.can(
+            ProjectPermissionSecretActions.ReadValue,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: expandEnvironment,
+              secretPath: expandSecretPath,
+              secretName: expandSecretKey,
+              secretTags: expandSecretTags
+            })
+          ) &&
+          permission.can(
+            ProjectPermissionSecretActions.DescribeSecret,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: expandEnvironment,
+              secretPath: expandSecretPath,
+              secretName: expandSecretKey,
+              secretTags: expandSecretTags
+            })
+          )
+        );
+      }
     });
 
     return {
@@ -958,6 +1073,7 @@ export const secretV2BridgeServiceFactory = ({
     type,
     secretName,
     version,
+    viewSecretValue,
     includeImports,
     expandSecretReferences: shouldExpandSecretReferences
   }: TGetASecretDTO) => {
@@ -1019,7 +1135,7 @@ export const secretV2BridgeServiceFactory = ({
           ));
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.DescribeSecret,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath: path,
@@ -1028,26 +1144,31 @@ export const secretV2BridgeServiceFactory = ({
       })
     );
 
+    // this will throw if the user doesn't have read value permission no matter what
+    // because if its an expansion, it will fully depend on the value.
     const { expandSecretReferences } = expandSecretReferencesFactory({
       projectId,
       folderDAL,
       secretDAL,
       decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined),
-      canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
-        permission.can(
-          ProjectPermissionActions.Read,
+      canExpandValue: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) => {
+        return permission.can(
+          ProjectPermissionSecretActions.ReadValue,
           subject(ProjectPermissionSub.Secrets, {
             environment: expandEnvironment,
             secretPath: expandSecretPath,
             secretName: expandSecretKey,
             secretTags: expandSecretTags
           })
-        )
+        );
+      }
     });
 
     // now if secret is not found
     // then search for imported secrets
     // here we consider the import order also thus starting from bottom
+
+    // currently filters out the secrets that the user doesn't have access to read value on
     if (!secret && includeImports) {
       const secretImports = await secretImportDAL.find({ folderId, isReplication: false });
       const importedSecrets = await fnSecretsV2FromImports({
@@ -1057,16 +1178,28 @@ export const secretV2BridgeServiceFactory = ({
         secretImportDAL,
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         expandSecretReferences: shouldExpandSecretReferences ? expandSecretReferences : undefined,
-        hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
-          permission.can(
-            ProjectPermissionActions.Read,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: expandEnvironment,
-              secretPath: expandSecretPath,
-              secretName: expandSecretKey,
-              secretTags: expandSecretTags
-            })
-          )
+        hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) => {
+          return (
+            permission.can(
+              ProjectPermissionSecretActions.ReadValue,
+              subject(ProjectPermissionSub.Secrets, {
+                environment: expandEnvironment,
+                secretPath: expandSecretPath,
+                secretName: expandSecretKey,
+                secretTags: expandSecretTags
+              })
+            ) &&
+            permission.can(
+              ProjectPermissionSecretActions.DescribeSecret,
+              subject(ProjectPermissionSub.Secrets, {
+                environment: expandEnvironment,
+                secretPath: expandSecretPath,
+                secretName: expandSecretKey,
+                secretTags: expandSecretTags
+              })
+            )
+          );
+        }
       });
 
       for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
@@ -1099,13 +1232,41 @@ export const secretV2BridgeServiceFactory = ({
       secretValue = expandedSecretValue || "";
     }
 
-    return reshapeBridgeSecret(projectId, environment, path, {
-      ...secret,
-      value: secretValue,
-      comment: secret.encryptedComment
-        ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
-        : ""
-    });
+    let secretValueHidden = true;
+
+    if (viewSecretValue) {
+      if (
+        !permission.can(
+          ProjectPermissionSecretActions.ReadValue,
+          subject(ProjectPermissionSub.Secrets, {
+            environment,
+            secretPath: path,
+            secretName,
+            secretTags: (secret?.tags || []).map((el) => el.slug)
+          })
+        )
+      ) {
+        throw new ForbiddenReadSecretError({
+          message: `You do not have permission to view secret value on secret with name '${secretName}'`
+        });
+      }
+
+      secretValueHidden = false;
+    }
+
+    return reshapeBridgeSecret(
+      projectId,
+      environment,
+      path,
+      {
+        ...secret,
+        value: secretValue,
+        comment: secret.encryptedComment
+          ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedComment }).toString()
+          : ""
+      },
+      secretValueHidden
+    );
   };
 
   const createManySecret = async ({
@@ -1173,7 +1334,7 @@ export const secretV2BridgeServiceFactory = ({
 
     inputSecrets.forEach((el) => {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
+        ProjectPermissionSecretActions.Create,
         subject(ProjectPermissionSub.Secrets, {
           environment,
           secretPath,
@@ -1201,8 +1362,8 @@ export const secretV2BridgeServiceFactory = ({
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId });
 
-    const newSecrets = await secretDAL.transaction(async (tx) =>
-      fnSecretBulkInsert({
+    const newSecrets = await secretDAL.transaction(async (tx) => {
+      const createdSecrets = await fnSecretBulkInsert({
         inputSecrets: inputSecrets.map((el) => {
           const references = secretReferencesGroupByInputSecretKey[el.secretKey]?.nestedReferences;
 
@@ -1231,8 +1392,19 @@ export const secretV2BridgeServiceFactory = ({
         secretTagDAL,
         secretVersionTagDAL,
         tx
-      })
-    );
+      });
+
+      const secs = await secretDAL.find(
+        {
+          $in: {
+            id: createdSecrets.map((el) => el.id)
+          }
+        },
+        { tx }
+      );
+
+      return secs;
+    });
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
@@ -1244,13 +1416,29 @@ export const secretV2BridgeServiceFactory = ({
       environmentSlug: folder.environment.slug
     });
 
-    return newSecrets.map((el) =>
-      reshapeBridgeSecret(projectId, environment, secretPath, {
-        ...el,
-        value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
-        comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
-      })
-    );
+    return newSecrets.map((el) => {
+      const secretValueHidden = !permission.can(
+        ProjectPermissionSecretActions.ReadValue,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName: el.key,
+          secretTags: el.tags.map((i) => i.slug)
+        })
+      );
+
+      return reshapeBridgeSecret(
+        projectId,
+        environment,
+        secretPath,
+        {
+          ...el,
+          value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
+          comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
+        },
+        secretValueHidden
+      );
+    });
   };
 
   const updateManySecret = async ({
@@ -1293,7 +1481,17 @@ export const secretV2BridgeServiceFactory = ({
     const { encryptor: secretManagerEncryptor, decryptor: secretManagerDecryptor } =
       await kmsService.createCipherPairWithDataKey({ type: KmsDataKey.SecretManager, projectId });
 
-    const updatedSecrets: Array<TSecretsV2 & { secretPath: string }> = [];
+    const updatedSecrets: Array<
+      TSecretsV2 & {
+        secretPath: string;
+        tags: {
+          id: string;
+          slug: string;
+          color?: string | null;
+          name: string;
+        }[];
+      }
+    > = [];
     await secretDAL.transaction(async (tx) => {
       for await (const folder of folders) {
         if (!folder) throw new NotFoundError({ message: "Folder not found" });
@@ -1344,7 +1542,7 @@ export const secretV2BridgeServiceFactory = ({
 
         secretsToUpdateInDB.forEach((el) => {
           ForbiddenError.from(permission).throwUnlessCan(
-            ProjectPermissionActions.Edit,
+            ProjectPermissionSecretActions.Edit,
             subject(ProjectPermissionSub.Secrets, {
               environment,
               secretPath,
@@ -1364,7 +1562,7 @@ export const secretV2BridgeServiceFactory = ({
         if (updateMode === SecretUpdateMode.Upsert) {
           secretsToCreate.forEach((el) => {
             ForbiddenError.from(permission).throwUnlessCan(
-              ProjectPermissionActions.Create,
+              ProjectPermissionSecretActions.Create,
               subject(ProjectPermissionSub.Secrets, {
                 environment,
                 secretPath,
@@ -1378,7 +1576,7 @@ export const secretV2BridgeServiceFactory = ({
         // check again to avoid non authorized tags are removed
         secretsToUpdate.forEach((el) => {
           ForbiddenError.from(permission).throwUnlessCan(
-            ProjectPermissionActions.Edit,
+            ProjectPermissionSecretActions.Edit,
             subject(ProjectPermissionSub.Secrets, {
               environment,
               secretPath,
@@ -1430,7 +1628,7 @@ export const secretV2BridgeServiceFactory = ({
 
           secretsWithNewName.forEach((el) => {
             ForbiddenError.from(permission).throwUnlessCan(
-              ProjectPermissionActions.Create,
+              ProjectPermissionSecretActions.Create,
               subject(ProjectPermissionSub.Secrets, {
                 environment,
                 secretPath,
@@ -1455,7 +1653,7 @@ export const secretV2BridgeServiceFactory = ({
         });
         await $validateSecretReferences(projectId, permission, secretReferences, tx);
 
-        const bulkUpdatedSecrets = await fnSecretBulkUpdate({
+        const bulkUpdatedSecretsRes = await fnSecretBulkUpdate({
           folderId,
           orgId: actorOrgId,
           tx,
@@ -1492,9 +1690,21 @@ export const secretV2BridgeServiceFactory = ({
           secretVersionTagDAL,
           resourceMetadataDAL
         });
+
+        const bulkUpdatedSecrets = await secretDAL.find(
+          {
+            $in: {
+              id: bulkUpdatedSecretsRes.map((el) => el.id)
+            }
+          },
+          {
+            tx
+          }
+        );
+
         updatedSecrets.push(...bulkUpdatedSecrets.map((el) => ({ ...el, secretPath: folder.path })));
         if (updateMode === SecretUpdateMode.Upsert) {
-          const bulkInsertedSecrets = await fnSecretBulkInsert({
+          const bulkInsertedSecretsRes = await fnSecretBulkInsert({
             inputSecrets: secretsToCreate.map((el) => {
               const references = secretReferencesGroupByInputSecretKey[el.secretKey]?.nestedReferences;
 
@@ -1524,6 +1734,16 @@ export const secretV2BridgeServiceFactory = ({
             secretVersionTagDAL,
             tx
           });
+
+          const bulkInsertedSecrets = await secretDAL.find(
+            {
+              $in: {
+                id: bulkInsertedSecretsRes.map((el) => el.id)
+              }
+            },
+            { tx }
+          );
+
           updatedSecrets.push(...bulkInsertedSecrets.map((el) => ({ ...el, secretPath: folder.path })));
         }
       }
@@ -1545,13 +1765,33 @@ export const secretV2BridgeServiceFactory = ({
       )
     );
 
-    return updatedSecrets.map((el) =>
-      reshapeBridgeSecret(projectId, environment, el.secretPath, {
-        ...el,
-        value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
-        comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
-      })
-    );
+    return updatedSecrets.map((el) => {
+      const secretValueHidden = !permission.can(
+        ProjectPermissionSecretActions.ReadValue,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath: el.secretPath,
+          secretName: el.key,
+          secretTags: el.tags.map((i) => i.slug)
+        })
+      );
+
+      return {
+        ...reshapeBridgeSecret(
+          projectId,
+          environment,
+          el.secretPath,
+          {
+            ...el,
+            value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
+            comment: el.encryptedComment
+              ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString()
+              : ""
+          },
+          secretValueHidden
+        )
+      };
+    });
   };
 
   const deleteManySecret = async ({
@@ -1613,7 +1853,7 @@ export const secretV2BridgeServiceFactory = ({
       });
     secretsToDelete.forEach((el) => {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
+        ProjectPermissionSecretActions.Delete,
         subject(ProjectPermissionSub.Secrets, {
           environment,
           secretPath,
@@ -1652,13 +1892,35 @@ export const secretV2BridgeServiceFactory = ({
       type: KmsDataKey.SecretManager,
       projectId
     });
-    return secretsDeleted.map((el) =>
-      reshapeBridgeSecret(projectId, environment, secretPath, {
-        ...el,
-        value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
-        comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
-      })
-    );
+    return secretsDeleted.map((el) => {
+      const secretToDeleteMatch = secretsToDelete.find(
+        (i) => i.key === el.key && (i.type || SecretType.Shared) === el.type
+      );
+
+      const secretValueHidden =
+        !secretToDeleteMatch ||
+        !permission.can(
+          ProjectPermissionSecretActions.ReadValue,
+          subject(ProjectPermissionSub.Secrets, {
+            environment,
+            secretPath,
+            secretName: el.key,
+            secretTags: secretToDeleteMatch.tags?.map((i) => i.slug)
+          })
+        );
+
+      return reshapeBridgeSecret(
+        projectId,
+        environment,
+        secretPath,
+        {
+          ...el,
+          value: el.encryptedValue ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString() : "",
+          comment: el.encryptedComment ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString() : ""
+        },
+        secretValueHidden
+      );
+    });
   };
 
   const getSecretVersions = async ({
@@ -1689,6 +1951,7 @@ export const secretV2BridgeServiceFactory = ({
       type: KmsDataKey.SecretManager,
       projectId: folder.projectId
     });
+
     const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] });
     return secretVersions.map((el) =>
       reshapeBridgeSecret(folder.projectId, folder.environment.envSlug, "/", {
@@ -1793,7 +2056,7 @@ export const secretV2BridgeServiceFactory = ({
     });
     sourceSecrets.forEach((secret) => {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
+        ProjectPermissionSecretActions.Delete,
         subject(ProjectPermissionSub.Secrets, {
           environment: sourceEnvironment,
           secretPath: sourceSecretPath,
@@ -1876,7 +2139,7 @@ export const secretV2BridgeServiceFactory = ({
       // permission check whether can create or edit the ones in the destination folder
       locallyCreatedSecrets.forEach((secret) => {
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Create,
+          ProjectPermissionSecretActions.Create,
           subject(ProjectPermissionSub.Secrets, {
             environment: destinationEnvironment,
             secretPath: destinationEnvironment,
@@ -1888,7 +2151,7 @@ export const secretV2BridgeServiceFactory = ({
 
       locallyUpdatedSecrets.forEach((secret) => {
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
+          ProjectPermissionSecretActions.Edit,
           subject(ProjectPermissionSub.Secrets, {
             environment: destinationEnvironment,
             secretPath: destinationEnvironment,
@@ -2125,7 +2388,7 @@ export const secretV2BridgeServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.DescribeSecret,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -2149,7 +2412,7 @@ export const secretV2BridgeServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.DescribeSecret,
       subject(ProjectPermissionSub.Secrets, {
         environment,
         secretPath,
@@ -2158,7 +2421,7 @@ export const secretV2BridgeServiceFactory = ({
       })
     );
 
-    const secretValue = secret.encryptedValue
+    const decryptedSecretValue = secret.encryptedValue
       ? secretManagerDecryptor({ cipherTextBlob: secret.encryptedValue }).toString()
       : "";
 
@@ -2169,7 +2432,7 @@ export const secretV2BridgeServiceFactory = ({
       decryptSecretValue: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : undefined),
       canExpandValue: (expandEnvironment, expandSecretPath, expandSecretName, expandSecretTags) =>
         permission.can(
-          ProjectPermissionActions.Read,
+          ProjectPermissionSecretActions.ReadValue,
           subject(ProjectPermissionSub.Secrets, {
             environment: expandEnvironment,
             secretPath: expandSecretPath,
@@ -2179,10 +2442,26 @@ export const secretV2BridgeServiceFactory = ({
         )
     });
 
+    if (
+      !permission.can(
+        ProjectPermissionSecretActions.ReadValue,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName,
+          secretTags: (secret?.tags || []).map((el) => el.slug)
+        })
+      )
+    ) {
+      throw new ForbiddenRequestError({
+        message: `Unable to get secret reference tree for secret with key '${secretName}', because you don't have permission to view secret value.`
+      });
+    }
+
     const { expandedValue, stackTrace } = await getExpandedSecretStackTrace({
       environment,
       secretPath,
-      value: secretValue
+      value: decryptedSecretValue
     });
 
     return { tree: stackTrace, value: expandedValue };

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -1,6 +1,7 @@
 import { Knex } from "knex";
 
 import { SecretType, TSecretsV2, TSecretsV2Insert, TSecretsV2Update } from "@app/db/schemas";
+import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
 import { OrderByDirection, TProjectPermission } from "@app/lib/types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
@@ -36,6 +37,7 @@ export type TGetSecretsDTO = {
   includeImports?: boolean;
   recursive?: boolean;
   tagSlugs?: string[];
+  viewSecretValue: boolean;
   metadataFilter?: {
     key?: string;
     value?: string;
@@ -57,6 +59,7 @@ export type TGetASecretDTO = {
   includeImports?: boolean;
   version?: number;
   projectId: string;
+  viewSecretValue: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TCreateSecretDTO = TProjectPermission & {
@@ -166,7 +169,7 @@ export type TFnSecretBulkInsert = {
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany">;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
 };
 
@@ -190,7 +193,7 @@ export type TFnSecretBulkUpdate = {
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "upsertSecretReferences">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   tx?: Knex;
 };
@@ -332,4 +335,5 @@ export type TGetSecretsRawByFolderMappingsDTO = {
   folderMappings: { folderId: string; path: string; environment: string }[];
   userId: string;
   filters: TFindSecretsByFolderIdsFilter;
+  filterByAction?: ProjectPermissionSecretActions;
 };

backend/src/services/secret/secret-fns.ts

@@ -13,7 +13,7 @@ import {
   TSecrets
 } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionSecretActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import {
   buildSecretBlindIndexFromName,
@@ -190,7 +190,7 @@ export const recursivelyGetSecretPaths = ({
     const allowedPaths = paths.filter(
       (folder) =>
         permission.can(
-          ProjectPermissionActions.Read,
+          ProjectPermissionSecretActions.ReadValue,
           subject(ProjectPermissionSub.Secrets, {
             environment,
             secretPath: folder.path
@@ -344,6 +344,7 @@ export const interpolateSecrets = ({ projectId, secretEncKey, secretDAL, folderD
 
 export const decryptSecretRaw = (
   secret: TSecrets & {
+    secretValueHidden: boolean;
     workspace: string;
     environment: string;
     secretPath: string;
@@ -362,12 +363,14 @@ export const decryptSecretRaw = (
     key
   });
 
-  const secretValue = decryptSymmetric128BitHexKeyUTF8({
-    ciphertext: secret.secretValueCiphertext,
-    iv: secret.secretValueIV,
-    tag: secret.secretValueTag,
-    key
-  });
+  const secretValue = !secret.secretValueHidden
+    ? decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretValueCiphertext,
+        iv: secret.secretValueIV,
+        tag: secret.secretValueTag,
+        key
+      })
+    : "<hidden-by-infisical>";
 
   let secretComment = "";
 
@@ -385,6 +388,7 @@ export const decryptSecretRaw = (
     secretPath: secret.secretPath,
     workspace: secret.workspace,
     environment: secret.environment,
+    secretValueHidden: secret.secretValueHidden,
     secretValue,
     secretComment,
     version: secret.version,
@@ -1197,3 +1201,25 @@ export const fnDeleteProjectSecretReminders = async (
     }
   }
 };
+
+export const conditionallyHideSecretValue = (
+  shouldHideValue: boolean,
+  {
+    secretValueCiphertext,
+    secretValueIV,
+    secretValueTag
+  }: {
+    secretValueCiphertext: string;
+    secretValueIV: string;
+    secretValueTag: string;
+  }
+) => {
+  const hiddenPlaceholder = "hidden-by-infisical>";
+
+  return {
+    secretValueCiphertext: shouldHideValue ? hiddenPlaceholder : secretValueCiphertext,
+    secretValueIV: shouldHideValue ? hiddenPlaceholder : secretValueIV,
+    secretValueTag: shouldHideValue ? hiddenPlaceholder : secretValueTag,
+    secretValueHidden: shouldHideValue
+  };
+};

backend/src/services/secret/secret-service.ts

@@ -13,7 +13,11 @@ import {
 } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
@@ -48,6 +52,7 @@ import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bri
 import { TGetSecretReferencesTreeDTO } from "../secret-v2-bridge/secret-v2-bridge-types";
 import { TSecretDALFactory } from "./secret-dal";
 import {
+  conditionallyHideSecretValue,
   decryptSecretRaw,
   fnSecretBlindIndexCheck,
   fnSecretBulkDelete,
@@ -204,7 +209,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionSecretActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -322,7 +327,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -444,7 +449,22 @@ export const secretServiceFactory = ({
         environmentSlug: folder.environment.slug
       });
     }
-    return { ...updatedSecret[0], workspace: projectId, environment, secretPath: path };
+
+    const secretValueHidden = !permission.can(
+      ProjectPermissionSecretActions.ReadValue,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath: path
+      })
+    );
+
+    return {
+      ...updatedSecret[0],
+      ...conditionallyHideSecretValue(secretValueHidden, updatedSecret[0]),
+      workspace: projectId,
+      environment,
+      secretPath: path
+    };
   };
 
   const deleteSecret = async ({
@@ -467,7 +487,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionSecretActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -540,7 +560,19 @@ export const secretServiceFactory = ({
       });
     }
 
-    return { ...deletedSecret[0], _id: deletedSecret[0].id, workspace: projectId, environment, secretPath: path };
+    const secretValueHidden = !permission.can(
+      ProjectPermissionSecretActions.ReadValue,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+    );
+
+    return {
+      ...deletedSecret[0],
+      ...conditionallyHideSecretValue(secretValueHidden, deletedSecret[0]),
+      _id: deletedSecret[0].id,
+      workspace: projectId,
+      environment,
+      secretPath: path
+    };
   };
 
   const getSecrets = async ({
@@ -589,7 +621,7 @@ export const secretServiceFactory = ({
       paths = deepPaths.map(({ folderId, path: p }) => ({ folderId, path: p }));
     } else {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
       );
 
@@ -614,7 +646,7 @@ export const secretServiceFactory = ({
         actor === ActorType.SERVICE
           ? true
           : permission.can(
-              ProjectPermissionActions.Read,
+              ProjectPermissionSecretActions.ReadValue,
               subject(ProjectPermissionSub.Secrets, {
                 environment: importEnv.slug,
                 secretPath: importPath
@@ -671,7 +703,7 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
@@ -721,7 +753,7 @@ export const secretServiceFactory = ({
         actor === ActorType.SERVICE
           ? true
           : permission.can(
-              ProjectPermissionActions.Read,
+              ProjectPermissionSecretActions.ReadValue,
               subject(ProjectPermissionSub.Secrets, {
                 environment: importEnv.slug,
                 secretPath: importPath
@@ -739,6 +771,7 @@ export const secretServiceFactory = ({
           if (secretBlindIndex === importedSecrets[i].secrets[j].secretBlindIndex) {
             return {
               ...importedSecrets[i].secrets[j],
+              secretValueHidden: false,
               workspace: projectId,
               environment: importedSecrets[i].environment,
               secretPath: importedSecrets[i].secretPath
@@ -749,7 +782,13 @@ export const secretServiceFactory = ({
     }
     if (!secret) throw new NotFoundError({ message: `Secret with name '${secretName}' not found` });
 
-    return { ...secret, workspace: projectId, environment, secretPath: path };
+    return {
+      ...secret,
+      secretValueHidden: false, // Always false because we check permission at the beginning of the function
+      workspace: projectId,
+      environment,
+      secretPath: path
+    };
   };
 
   const createManySecret = async ({
@@ -771,7 +810,7 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionSecretActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -859,7 +898,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -901,8 +940,8 @@ export const secretServiceFactory = ({
     if (tagIds.length !== tags.length) throw new NotFoundError({ message: "One or more tags not found" });
 
     const references = await getSecretReference(projectId);
-    const secrets = await secretDAL.transaction(async (tx) =>
-      fnSecretBulkUpdate({
+    const secrets = await secretDAL.transaction(async (tx) => {
+      const updatedSecrets = await fnSecretBulkUpdate({
         folderId,
         projectId,
         tx,
@@ -932,8 +971,18 @@ export const secretServiceFactory = ({
         secretVersionDAL,
         secretTagDAL,
         secretVersionTagDAL
-      })
-    );
+      });
+
+      const secretValueHidden = !permission.can(
+        ProjectPermissionSecretActions.Edit,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+      );
+
+      return updatedSecrets.map((secret) => ({
+        ...secret,
+        ...conditionallyHideSecretValue(secretValueHidden, secret)
+      }));
+    });
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
@@ -967,7 +1016,7 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionSecretActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -1019,7 +1068,15 @@ export const secretServiceFactory = ({
         }
       }
 
-      return secrets;
+      const secretValueHidden = !permission.can(
+        ProjectPermissionSecretActions.ReadValue,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+      );
+
+      return secrets.map((secret) => ({
+        ...secret,
+        ...conditionallyHideSecretValue(secretValueHidden, secret)
+      }));
     });
 
     await snapshotService.performSnapshot(folderId);
@@ -1180,6 +1237,7 @@ export const secretServiceFactory = ({
       secretName,
       path: secretPath,
       environment,
+      viewSecretValue: false,
       type: "shared"
     });
 
@@ -1194,10 +1252,11 @@ export const secretServiceFactory = ({
         | (typeof groupPermissions)[number]
     ) => {
       const allowedActions = [
-        ProjectPermissionActions.Read,
-        ProjectPermissionActions.Delete,
-        ProjectPermissionActions.Create,
-        ProjectPermissionActions.Edit
+        ProjectPermissionSecretActions.DescribeSecret,
+        ProjectPermissionSecretActions.ReadValue,
+        ProjectPermissionSecretActions.Delete,
+        ProjectPermissionSecretActions.Create,
+        ProjectPermissionSecretActions.Edit
       ].filter((action) =>
         entityPermission.permission.can(
           action,
@@ -1234,6 +1293,7 @@ export const secretServiceFactory = ({
     actorId,
     actorOrgId,
     actorAuthMethod,
+    viewSecretValue,
     environment,
     includeImports,
     expandSecretReferences,
@@ -1249,6 +1309,7 @@ export const secretServiceFactory = ({
         actorId,
         actor,
         actorOrgId,
+        viewSecretValue,
         environment,
         path,
         recursive,
@@ -1285,14 +1346,20 @@ export const secretServiceFactory = ({
       recursive
     });
 
-    const decryptedSecrets = secrets.map((el) => decryptSecretRaw(el, botKey));
+    const decryptedSecrets = secrets.map((el) => decryptSecretRaw({ ...el, secretValueHidden: false }, botKey));
     const filteredSecrets = tagSlugs.length
       ? decryptedSecrets.filter((secret) => Boolean(secret.tags?.find((el) => tagSlugs.includes(el.slug))))
       : decryptedSecrets;
     const processedImports = (imports || [])?.map(({ secrets: importedSecrets, ...el }) => {
       const decryptedImportSecrets = importedSecrets.map((sec) =>
         decryptSecretRaw(
-          { ...sec, environment: el.environment, workspace: projectId, secretPath: el.secretPath },
+          {
+            ...sec,
+            environment: el.environment,
+            workspace: projectId,
+            secretPath: el.secretPath,
+            secretValueHidden: false
+          },
           botKey
         )
       );
@@ -1387,6 +1454,7 @@ export const secretServiceFactory = ({
     path,
     actor,
     environment,
+    viewSecretValue,
     projectId: workspaceId,
     expandSecretReferences,
     projectSlug,
@@ -1406,6 +1474,7 @@ export const secretServiceFactory = ({
         includeImports,
         actorAuthMethod,
         path,
+        viewSecretValue,
         actorOrgId,
         actor,
         actorId,
@@ -1436,6 +1505,7 @@ export const secretServiceFactory = ({
         message: `Project bot for project with ID '${projectId}' not found. Please upgrade your project.`,
         name: "bot_not_found_error"
       });
+
     const decryptedSecret = decryptSecretRaw(encryptedSecret, botKey);
 
     if (expandSecretReferences) {
@@ -1454,7 +1524,10 @@ export const secretServiceFactory = ({
       decryptedSecret.secretValue = expandedSecretValue || "";
     }
 
-    return { secretMetadata: undefined, ...decryptedSecret };
+    return {
+      secretMetadata: undefined,
+      ...decryptedSecret
+    };
   };
 
   const createSecretRaw = async ({
@@ -1605,7 +1678,16 @@ export const secretServiceFactory = ({
       tags: tagIds
     });
 
-    return { type: SecretProtectionType.Direct as const, secret: decryptSecretRaw(secret, botKey) };
+    return {
+      type: SecretProtectionType.Direct as const,
+      secret: decryptSecretRaw(
+        {
+          ...secret,
+          secretValueHidden: false
+        },
+        botKey
+      )
+    };
   };
 
   const updateSecretRaw = async ({
@@ -2001,7 +2083,7 @@ export const secretServiceFactory = ({
     return {
       type: SecretProtectionType.Direct as const,
       secrets: secrets.map((secret) =>
-        decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey)
+        decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath, secretValueHidden: false }, botKey)
       )
     };
   };
@@ -2307,6 +2389,7 @@ export const secretServiceFactory = ({
     return secretVersions.map((el) =>
       decryptSecretRaw(
         {
+          secretValueHidden: false,
           ...el,
           workspace: folder.projectId,
           environment: folder.environment.envSlug,
@@ -2340,7 +2423,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -2446,7 +2529,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionSecretActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -2637,29 +2720,33 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: sourceEnvironment,
-        secretPath: sourceSecretPath
-      })
-    );
+    const permissionChecks = [
+      {
+        action: ProjectPermissionSecretActions.Delete,
+        subject: {
+          environment: sourceEnvironment,
+          secretPath: sourceSecretPath
+        }
+      },
+      {
+        action: ProjectPermissionSecretActions.Create,
+        subject: {
+          environment: destinationEnvironment,
+          secretPath: destinationSecretPath
+        }
+      },
+      {
+        action: ProjectPermissionSecretActions.Edit,
+        subject: {
+          environment: destinationEnvironment,
+          secretPath: destinationSecretPath
+        }
+      }
+    ] as const;
 
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: destinationEnvironment,
-        secretPath: destinationSecretPath
-      })
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, {
-        environment: destinationEnvironment,
-        secretPath: destinationSecretPath
-      })
-    );
+    for (const { action, subject: permissionSubject } of permissionChecks) {
+      ForbiddenError.from(permission).throwUnlessCan(action, subject(ProjectPermissionSub.Secrets, permissionSubject));
+    }
 
     const { botKey } = await projectBotService.getBotKey(project.id);
     if (!botKey) {

backend/src/services/secret/secret-types.ts

@@ -180,6 +180,7 @@ export type TGetSecretsRawDTO = {
   expandSecretReferences?: boolean;
   path: string;
   environment: string;
+  viewSecretValue: boolean;
   includeImports?: boolean;
   recursive?: boolean;
   tagSlugs?: string[];
@@ -205,6 +206,7 @@ export type TGetASecretRawDTO = {
   secretName: string;
   path: string;
   environment: string;
+  viewSecretValue: boolean;
   expandSecretReferences?: boolean;
   type: "shared" | "personal";
   includeImports?: boolean;

backend/src/services/service-token/service-token-service.ts

@@ -5,7 +5,11 @@ import bcrypt from "bcrypt";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 
@@ -67,7 +71,7 @@ export const serviceTokenServiceFactory = ({
 
     scopes.forEach(({ environment, secretPath }) => {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
+        ProjectPermissionSecretActions.Create,
         subject(ProjectPermissionSub.Secrets, { environment, secretPath })
       );
     });