feat(api): view secret value, WIP

backend/src/services/secret-import/secret-import-service.ts

@@ -5,7 +5,11 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionActions,
+  ProjectPermissionSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { getReplicationFolderName } from "@app/ee/services/secret-replication/secret-replication-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -90,7 +94,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: data.environment,
         secretPath: data.path
@@ -402,7 +406,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionSecretActions.ReadValue,
       subject(ProjectPermissionSub.Secrets, {
         environment: secretImportDoc.importEnv.slug,
         secretPath: secretImportDoc.importPath
@@ -596,7 +600,7 @@ export const secretImportServiceFactory = ({
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -647,7 +651,7 @@ export const secretImportServiceFactory = ({
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
           permission.can(
-            ProjectPermissionActions.Read,
+            ProjectPermissionSecretActions.ReadValue,
             subject(ProjectPermissionSub.Secrets, {
               environment: expandEnvironment,
               secretPath: expandSecretPath,
@@ -667,7 +671,7 @@ export const secretImportServiceFactory = ({
 
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionActions.Read,
+        ProjectPermissionSecretActions.ReadValue,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -683,7 +687,10 @@ export const secretImportServiceFactory = ({
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>
-        decryptSecretRaw({ ...encryptedSecret, workspace: projectId, environment, secretPath }, botKey)
+        decryptSecretRaw(
+          { ...encryptedSecret, workspace: projectId, environment, secretPath, secretValueHidden: false },
+          botKey
+        )
       )
     }));
   };