refactor(ui): migrated secret endpoints of e2ee to raw

frontend/src/hooks/api/secretApprovalRequest/queries.tsx

@@ -1,3 +1,4 @@
+/* eslint-disable no-param-reassign */
 import {
   useInfiniteQuery,
   UseInfiniteQueryOptions,
@@ -12,8 +13,7 @@ import {
 import { apiRequest } from "@app/config/request";
 
 import { UserWsKeyPair } from "../keys/types";
-import { decryptSecrets } from "../secrets/queries";
-import { DecryptedSecret } from "../secrets/types";
+import { EncryptedSecret, SecretType,SecretV3RawSanitized } from "../secrets/types";
 import {
   CommitType,
   TGetSecretApprovalRequestCount,
@@ -45,6 +45,78 @@ export const secretApprovalRequestKeys = {
   ]
 };
 
+export const decryptSecrets = (
+  encryptedSecrets: EncryptedSecret[],
+  decryptFileKey: UserWsKeyPair
+) => {
+  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
+  const key = decryptAssymmetric({
+    ciphertext: decryptFileKey.encryptedKey,
+    nonce: decryptFileKey.nonce,
+    publicKey: decryptFileKey.sender.publicKey,
+    privateKey: PRIVATE_KEY
+  });
+
+  const personalSecrets: Record<string, { id: string; value: string }> = {};
+  const secrets: SecretV3RawSanitized[] = [];
+  encryptedSecrets.forEach((encSecret) => {
+    const secretKey = decryptSymmetric({
+      ciphertext: encSecret.secretKeyCiphertext,
+      iv: encSecret.secretKeyIV,
+      tag: encSecret.secretKeyTag,
+      key
+    });
+
+    const secretValue = decryptSymmetric({
+      ciphertext: encSecret.secretValueCiphertext,
+      iv: encSecret.secretValueIV,
+      tag: encSecret.secretValueTag,
+      key
+    });
+
+    const secretComment = decryptSymmetric({
+      ciphertext: encSecret.secretCommentCiphertext,
+      iv: encSecret.secretCommentIV,
+      tag: encSecret.secretCommentTag,
+      key
+    });
+
+    const decryptedSecret: SecretV3RawSanitized = {
+      id: encSecret.id,
+      env: encSecret.environment,
+      key: secretKey,
+      value: secretValue,
+      tags: encSecret.tags,
+      comment: secretComment,
+      reminderRepeatDays: encSecret.secretReminderRepeatDays,
+      reminderNote: encSecret.secretReminderNote,
+      createdAt: encSecret.createdAt,
+      updatedAt: encSecret.updatedAt,
+      version: encSecret.version,
+      skipMultilineEncoding: encSecret.skipMultilineEncoding
+    };
+
+    if (encSecret.type === SecretType.Personal) {
+      personalSecrets[decryptedSecret.key] = {
+        id: encSecret.id,
+        value: secretValue
+      };
+    } else {
+      secrets.push(decryptedSecret);
+    }
+  });
+
+  secrets.forEach((sec) => {
+    if (personalSecrets?.[sec.key]) {
+      sec.idOverride = personalSecrets[sec.key].id;
+      sec.valueOverride = personalSecrets[sec.key].value;
+      sec.overrideAction = "modified";
+    }
+  });
+
+  return secrets;
+};
+
 export const decryptSecretApprovalSecret = (
   encSecret: TSecretApprovalSecChangeData,
   decryptFileKey: UserWsKeyPair
@@ -173,7 +245,7 @@ export const useGetSecretApprovalRequestDetails = ({
     UseQueryOptions<
       TSecretApprovalRequest,
       unknown,
-      TSecretApprovalRequest<DecryptedSecret>,
+      TSecretApprovalRequest<SecretV3RawSanitized>,
       ReturnType<typeof secretApprovalRequestKeys.detail>
     >,
     "queryKey" | "queryFn"

frontend/src/hooks/api/secretImports/queries.tsx

@@ -1,10 +1,6 @@
 import { useCallback } from "react";
 import { useQueries, useQuery, UseQueryOptions } from "@tanstack/react-query";
 
-import {
-  decryptAssymmetric,
-  decryptSymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
 import {
@@ -75,7 +71,7 @@ const fetchImportedSecrets = async (
   directory?: string
 ) => {
   const { data } = await apiRequest.get<{ secrets: TImportedSecrets[] }>(
-    "/api/v1/secret-imports/secrets",
+    "/api/v1/secret-imports/secrets/raw",
     {
       params: {
         workspaceId,
@@ -107,7 +103,6 @@ const fetchImportedFolders = async ({
 
 export const useGetImportedSecretsSingleEnv = ({
   environment,
-  decryptFileKey,
   path,
   projectId,
   options = {}
@@ -123,78 +118,40 @@ export const useGetImportedSecretsSingleEnv = ({
   >;
 }) =>
   useQuery({
-    enabled:
-      Boolean(projectId) &&
-      Boolean(environment) &&
-      Boolean(decryptFileKey) &&
-      (options?.enabled ?? true),
+    enabled: Boolean(projectId) && Boolean(environment) && (options?.enabled ?? true),
     queryKey: secretImportKeys.getSecretImportSecrets({
       environment,
       path,
       projectId
     }),
     queryFn: () => fetchImportedSecrets(projectId, environment, path),
-    select: useCallback(
-      (data: TImportedSecrets[]) => {
-        const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-        const latestKey = decryptFileKey;
-        const key = decryptAssymmetric({
-          ciphertext: latestKey.encryptedKey,
-          nonce: latestKey.nonce,
-          publicKey: latestKey.sender.publicKey,
-          privateKey: PRIVATE_KEY
-        });
-
-        return data.map((el) => ({
-          environment: el.environment,
-          secretPath: el.secretPath,
-          environmentInfo: el.environmentInfo,
-          folderId: el.folderId,
-          secrets: el.secrets.map((encSecret) => {
-            const secretKey = decryptSymmetric({
-              ciphertext: encSecret.secretKeyCiphertext,
-              iv: encSecret.secretKeyIV,
-              tag: encSecret.secretKeyTag,
-              key
-            });
-
-            const secretValue = decryptSymmetric({
-              ciphertext: encSecret.secretValueCiphertext,
-              iv: encSecret.secretValueIV,
-              tag: encSecret.secretValueTag,
-              key
-            });
-
-            const secretComment = decryptSymmetric({
-              ciphertext: encSecret.secretCommentCiphertext,
-              iv: encSecret.secretCommentIV,
-              tag: encSecret.secretCommentTag,
-              key
-            });
-
-            return {
-              id: encSecret.id,
-              env: encSecret.environment,
-              key: secretKey,
-              value: secretValue,
-              tags: encSecret.tags,
-              comment: secretComment,
-              createdAt: encSecret.createdAt,
-              updatedAt: encSecret.updatedAt,
-              version: encSecret.version
-            };
-          })
-        }));
-      },
-      [decryptFileKey]
-    )
+    select: (data: TImportedSecrets[]) => {
+      return data.map((el) => ({
+        environment: el.environment,
+        secretPath: el.secretPath,
+        environmentInfo: el.environmentInfo,
+        folderId: el.folderId,
+        secrets: el.secrets.map((encSecret) => {
+          return {
+            id: encSecret.id,
+            env: encSecret.environment,
+            key: encSecret.secretKey,
+            value: encSecret.secretValue,
+            tags: encSecret.tags,
+            comment: encSecret.secretComment,
+            createdAt: encSecret.createdAt,
+            updatedAt: encSecret.updatedAt,
+            version: encSecret.version
+          };
+        })
+      }));
+    }
   });
 
 export const useGetImportedSecretsAllEnvs = ({
   projectId,
   environments,
-  path = "/",
-  decryptFileKey
+  path = "/"
 }: TGetSecretImportsAllEnvs) => {
   const secretImports = useQueries({
     queries: environments.map((env) => ({
@@ -206,60 +163,27 @@ export const useGetImportedSecretsAllEnvs = ({
       queryFn: () => fetchImportedSecrets(projectId, env, path).catch(() => []),
       enabled: Boolean(projectId) && Boolean(env),
       // eslint-disable-next-line react-hooks/rules-of-hooks
-      select: useCallback(
-        (data: TImportedSecrets[]) => {
-          const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-          const latestKey = decryptFileKey;
-          const key = decryptAssymmetric({
-            ciphertext: latestKey.encryptedKey,
-            nonce: latestKey.nonce,
-            publicKey: latestKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          });
-
-          return data.map((el) => ({
-            environment: el.environment,
-            secretPath: el.secretPath,
-            environmentInfo: el.environmentInfo,
-            folderId: el.folderId,
-            secrets: el.secrets.map((encSecret) => {
-              const secretKey = decryptSymmetric({
-                ciphertext: encSecret.secretKeyCiphertext,
-                iv: encSecret.secretKeyIV,
-                tag: encSecret.secretKeyTag,
-                key
-              });
-
-              const secretValue = decryptSymmetric({
-                ciphertext: encSecret.secretValueCiphertext,
-                iv: encSecret.secretValueIV,
-                tag: encSecret.secretValueTag,
-                key
-              });
-
-              const secretComment = decryptSymmetric({
-                ciphertext: encSecret.secretCommentCiphertext,
-                iv: encSecret.secretCommentIV,
-                tag: encSecret.secretCommentTag,
-                key
-              });
-
-              return {
-                id: encSecret.id,
-                env: encSecret.environment,
-                key: secretKey,
-                value: secretValue,
-                tags: encSecret.tags,
-                comment: secretComment,
-                createdAt: encSecret.createdAt,
-                updatedAt: encSecret.updatedAt,
-                version: encSecret.version
-              };
-            })
-          }));
-        },
-        [decryptFileKey]
-      )
+      select: (data: TImportedSecrets[]) => {
+        return data.map((el) => ({
+          environment: el.environment,
+          secretPath: el.secretPath,
+          environmentInfo: el.environmentInfo,
+          folderId: el.folderId,
+          secrets: el.secrets.map((encSecret) => {
+            return {
+              id: encSecret.id,
+              env: encSecret.environment,
+              key: encSecret.secretKey,
+              value: encSecret.secretValue,
+              tags: encSecret.tags,
+              comment: encSecret.secretComment,
+              createdAt: encSecret.createdAt,
+              updatedAt: encSecret.updatedAt,
+              version: encSecret.version
+            };
+          })
+        }));
+      }
     }))
   });
 

frontend/src/hooks/api/secretImports/types.ts

@@ -1,5 +1,4 @@
-import { UserWsKeyPair } from "../keys/types";
-import { EncryptedSecret } from "../secrets/types";
+import { SecretV3Raw } from "../secrets/types";
 import { WorkspaceEnv } from "../workspace/types";
 
 export type TSecretImport = {
@@ -28,7 +27,7 @@ export type TImportedSecrets = {
   environmentInfo: WorkspaceEnv;
   secretPath: string;
   folderId: string;
-  secrets: EncryptedSecret[];
+  secrets: SecretV3Raw[];
 };
 
 export type TGetSecretImports = {
@@ -39,7 +38,6 @@ export type TGetSecretImports = {
 
 export type TGetSecretImportsAllEnvs = {
   projectId: string;
-  decryptFileKey: UserWsKeyPair;
   path?: string;
   environments: string[];
 };
@@ -48,7 +46,6 @@ export type TGetImportedSecrets = {
   projectId: string;
   environment: string;
   path?: string;
-  decryptFileKey: UserWsKeyPair;
 };
 
 export type TuseGetImportedFoldersByEnv = {

frontend/src/hooks/api/secretSnapshots/queries.tsx

@@ -7,7 +7,7 @@ import {
 } from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
-import { DecryptedSecret, SecretType } from "../secrets/types";
+import { SecretType,SecretV3RawSanitized } from "../secrets/types";
 import {
   TGetSecretSnapshotsDTO,
   TSecretRollbackDTO,
@@ -80,7 +80,7 @@ export const useGetSnapshotSecrets = ({ decryptFileKey, snapshotId }: TSnapshotD
         privateKey: PRIVATE_KEY
       });
 
-      const sharedSecrets: DecryptedSecret[] = [];
+      const sharedSecrets: SecretV3RawSanitized[] = [];
       const personalSecrets: Record<string, { id: string; value: string }> = {};
       data.secretVersions.forEach((encSecret) => {
         const secretKey = decryptSymmetric({

frontend/src/hooks/api/secrets/mutations.tsx

@@ -1,18 +1,11 @@
-import crypto from "crypto";
-
 import { MutationOptions, useMutation, useQueryClient } from "@tanstack/react-query";
 
-import {
-  decryptAssymmetric,
-  encryptSymmetric
-} from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
 import { secretApprovalRequestKeys } from "../secretApprovalRequest/queries";
 import { secretSnapshotKeys } from "../secretSnapshots/queries";
 import { secretKeys } from "./queries";
 import {
-  CreateSecretDTO,
   TCreateSecretBatchDTO,
   TCreateSecretsV3DTO,
   TDeleteSecretBatchDTO,
@@ -22,50 +15,6 @@ import {
   TUpdateSecretsV3DTO
 } from "./types";
 
-const encryptSecret = (randomBytes: string, key: string, value?: string, comment?: string) => {
-  // encrypt key
-  const {
-    ciphertext: secretKeyCiphertext,
-    iv: secretKeyIV,
-    tag: secretKeyTag
-  } = encryptSymmetric({
-    plaintext: key,
-    key: randomBytes
-  });
-
-  // encrypt value
-  const {
-    ciphertext: secretValueCiphertext,
-    iv: secretValueIV,
-    tag: secretValueTag
-  } = encryptSymmetric({
-    plaintext: value ?? "",
-    key: randomBytes
-  });
-
-  // encrypt comment
-  const {
-    ciphertext: secretCommentCiphertext,
-    iv: secretCommentIV,
-    tag: secretCommentTag
-  } = encryptSymmetric({
-    plaintext: comment ?? "",
-    key: randomBytes
-  });
-
-  return {
-    secretKeyCiphertext,
-    secretKeyIV,
-    secretKeyTag,
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag,
-    secretCommentCiphertext,
-    secretCommentIV,
-    secretCommentTag
-  };
-};
-
 export const useCreateSecretV3 = ({
   options
 }: {
@@ -78,32 +27,20 @@ export const useCreateSecretV3 = ({
       type,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretValue,
-      latestFileKey,
       secretComment,
       skipMultilineEncoding
     }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
-        workspaceId,
-        environment,
-        type,
+      const { data } = await apiRequest.post(`/api/v3/secrets/raw/${secretKey}`, {
         secretPath,
-        ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
+        type,
+        environment,
+        workspaceId,
+        secretValue,
+        secretComment,
         skipMultilineEncoding
-      };
-      const { data } = await apiRequest.post(`/api/v3/secrets/${secretName}`, reqBody);
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -132,44 +69,30 @@ export const useUpdateSecretV3 = ({
     mutationFn: async ({
       secretPath = "/",
       type,
-      secretId,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretValue,
-      latestFileKey,
-      tags,
+      tagIds,
       secretComment,
       secretReminderRepeatDays,
       secretReminderNote,
       newSecretName,
       skipMultilineEncoding
     }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+      const { data } = await apiRequest.patch(`/api/v3/secrets/raw/${secretKey}`, {
         workspaceId,
         environment,
         type,
         secretReminderNote,
         secretReminderRepeatDays,
         secretPath,
-        secretId,
-        ...encryptSecret(randomBytes, newSecretName ?? secretName, secretValue, secretComment),
-        tags,
         skipMultilineEncoding,
-        secretName: newSecretName
-      };
-      const { data } = await apiRequest.patch(`/api/v3/secrets/${secretName}`, reqBody);
+        newSecretName,
+        secretComment,
+        tagIds,
+        secretValue
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -201,19 +124,17 @@ export const useDeleteSecretV3 = ({
       type,
       environment,
       workspaceId,
-      secretName,
+      secretKey,
       secretId
     }) => {
-      const reqBody = {
-        workspaceId,
-        environment,
-        type,
-        secretPath,
-        secretId
-      };
-
-      const { data } = await apiRequest.delete(`/api/v3/secrets/${secretName}`, {
-        data: reqBody
+      const { data } = await apiRequest.delete(`/api/v3/secrets/raw/${secretKey}`, {
+        data: {
+          workspaceId,
+          environment,
+          type,
+          secretPath,
+          secretId
+        }
       });
       return data;
     },
@@ -241,33 +162,13 @@ export const useCreateSecretBatch = ({
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TCreateSecretBatchDTO>({
-    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
+      const { data } = await apiRequest.post("/api/v3/secrets/batch/raw", {
         workspaceId,
         environment,
         secretPath,
-        secrets: secrets.map(
-          ({ secretName, secretValue, secretComment, metadata, type, skipMultilineEncoding }) => ({
-            secretName,
-            ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
-            type,
-            metadata,
-            skipMultilineEncoding
-          })
-        )
-      };
-
-      const { data } = await apiRequest.post("/api/v3/secrets/batch", reqBody);
+        secrets
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -294,33 +195,13 @@ export const useUpdateSecretBatch = ({
   const queryClient = useQueryClient();
 
   return useMutation<{}, {}, TUpdateSecretBatchDTO>({
-    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets, latestFileKey }) => {
-      const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-      const randomBytes = latestFileKey
-        ? decryptAssymmetric({
-            ciphertext: latestFileKey.encryptedKey,
-            nonce: latestFileKey.nonce,
-            publicKey: latestFileKey.sender.publicKey,
-            privateKey: PRIVATE_KEY
-          })
-        : crypto.randomBytes(16).toString("hex");
-
-      const reqBody = {
+    mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
+      const { data } = await apiRequest.patch("/api/v3/secrets/batch/raw", {
         workspaceId,
         environment,
         secretPath,
-        secrets: secrets.map(
-          ({ secretName, secretValue, secretComment, type, tags, skipMultilineEncoding }) => ({
-            secretName,
-            ...encryptSecret(randomBytes, secretName, secretValue, secretComment),
-            type,
-            tags,
-            skipMultilineEncoding
-          })
-        )
-      };
-
-      const { data } = await apiRequest.patch("/api/v3/secrets/batch", reqBody);
+        secrets
+      });
       return data;
     },
     onSuccess: (_, { workspaceId, environment, secretPath }) => {
@@ -348,15 +229,13 @@ export const useDeleteSecretBatch = ({
 
   return useMutation<{}, {}, TDeleteSecretBatchDTO>({
     mutationFn: async ({ secretPath = "/", workspaceId, environment, secrets }) => {
-      const reqBody = {
-        workspaceId,
-        environment,
-        secretPath,
-        secrets
-      };
-
-      const { data } = await apiRequest.delete("/api/v3/secrets/batch", {
-        data: reqBody
+      const { data } = await apiRequest.delete("/api/v3/secrets/batch/raw", {
+        data: {
+          workspaceId,
+          environment,
+          secretPath,
+          secrets
+        }
       });
       return data;
     },
@@ -443,7 +322,7 @@ export const useMoveSecrets = ({
   });
 };
 
-export const createSecret = async (dto: CreateSecretDTO) => {
+export const createSecret = async (dto: TCreateSecretsV3DTO) => {
   const { data } = await apiRequest.post(`/api/v3/secrets/${dto.secretKey}`, dto);
   return data;
 };

frontend/src/hooks/api/secrets/queries.tsx

@@ -8,13 +8,13 @@ import {
 } from "@app/components/utilities/cryptography/crypto";
 import { apiRequest } from "@app/config/request";
 
-import { UserWsKeyPair } from "../keys/types";
 import {
-  DecryptedSecret,
-  EncryptedSecret,
   EncryptedSecretVersion,
   GetSecretVersionsDTO,
   SecretType,
+  SecretV3Raw,
+  SecretV3RawResponse,
+  SecretV3RawSanitized,
   TGetProjectSecretsAllEnvDTO,
   TGetProjectSecretsDTO,
   TGetProjectSecretsKey
@@ -27,61 +27,49 @@ export const secretKeys = {
   getSecretVersion: (secretId: string) => [{ secretId }, "secret-versions"] as const
 };
 
-export const decryptSecrets = (
-  encryptedSecrets: EncryptedSecret[],
-  decryptFileKey: UserWsKeyPair
-) => {
-  const PRIVATE_KEY = localStorage.getItem("PRIVATE_KEY") as string;
-  const key = decryptAssymmetric({
-    ciphertext: decryptFileKey.encryptedKey,
-    nonce: decryptFileKey.nonce,
-    publicKey: decryptFileKey.sender.publicKey,
-    privateKey: PRIVATE_KEY
+export const fetchProjectSecrets = async ({
+  workspaceId,
+  environment,
+  secretPath,
+  includeImports,
+  expandSecretReferences
+}: TGetProjectSecretsKey) => {
+  const { data } = await apiRequest.get<SecretV3RawResponse>("/api/v3/secrets/raw", {
+    params: {
+      environment,
+      workspaceId,
+      secretPath,
+      expandSecretReferences,
+      include_imports: includeImports
+    }
   });
 
+  return data;
+};
+
+export const mergePersonalSecrets = (rawSecrets: SecretV3Raw[]) => {
   const personalSecrets: Record<string, { id: string; value: string }> = {};
-  const secrets: DecryptedSecret[] = [];
-  encryptedSecrets.forEach((encSecret) => {
-    const secretKey = decryptSymmetric({
-      ciphertext: encSecret.secretKeyCiphertext,
-      iv: encSecret.secretKeyIV,
-      tag: encSecret.secretKeyTag,
-      key
-    });
-
-    const secretValue = decryptSymmetric({
-      ciphertext: encSecret.secretValueCiphertext,
-      iv: encSecret.secretValueIV,
-      tag: encSecret.secretValueTag,
-      key
-    });
-
-    const secretComment = decryptSymmetric({
-      ciphertext: encSecret.secretCommentCiphertext,
-      iv: encSecret.secretCommentIV,
-      tag: encSecret.secretCommentTag,
-      key
-    });
-
-    const decryptedSecret: DecryptedSecret = {
-      id: encSecret.id,
-      env: encSecret.environment,
-      key: secretKey,
-      value: secretValue,
-      tags: encSecret.tags,
-      comment: secretComment,
-      reminderRepeatDays: encSecret.secretReminderRepeatDays,
-      reminderNote: encSecret.secretReminderNote,
-      createdAt: encSecret.createdAt,
-      updatedAt: encSecret.updatedAt,
-      version: encSecret.version,
-      skipMultilineEncoding: encSecret.skipMultilineEncoding
+  const secrets: SecretV3RawSanitized[] = [];
+  rawSecrets.forEach((el) => {
+    const decryptedSecret: SecretV3RawSanitized = {
+      id: el.id,
+      env: el.environment,
+      key: el.secretKey,
+      value: el.secretValue,
+      tags: el.tags || [],
+      comment: el.secretComment || "",
+      reminderRepeatDays: el.secretReminderRepeatDays,
+      reminderNote: el.secretReminderNote,
+      createdAt: el.createdAt,
+      updatedAt: el.updatedAt,
+      version: el.version,
+      skipMultilineEncoding: el.skipMultilineEncoding
     };
 
-    if (encSecret.type === SecretType.Personal) {
+    if (el.type === SecretType.Personal) {
       personalSecrets[decryptedSecret.key] = {
-        id: encSecret.id,
-        value: secretValue
+        id: el.id,
+        value: el.secretValue
       };
     } else {
       secrets.push(decryptedSecret);
@@ -99,33 +87,17 @@ export const decryptSecrets = (
   return secrets;
 };
 
-export const fetchProjectEncryptedSecrets = async ({
-  workspaceId,
-  environment,
-  secretPath
-}: TGetProjectSecretsKey) => {
-  const { data } = await apiRequest.get<{ secrets: EncryptedSecret[] }>("/api/v3/secrets", {
-    params: {
-      environment,
-      workspaceId,
-      secretPath
-    }
-  });
-
-  return data.secrets;
-};
 export const useGetProjectSecrets = ({
   workspaceId,
   environment,
-  decryptFileKey,
   secretPath,
   options
 }: TGetProjectSecretsDTO & {
   options?: Omit<
     UseQueryOptions<
-      EncryptedSecret[],
+      SecretV3RawResponse,
       unknown,
-      DecryptedSecret[],
+      SecretV3RawSanitized[],
       ReturnType<typeof secretKeys.getProjectSecret>
     >,
     "queryKey" | "queryFn"
@@ -134,25 +106,24 @@ export const useGetProjectSecrets = ({
   useQuery({
     ...options,
     // wait for all values to be available
-    enabled: Boolean(decryptFileKey && workspaceId && environment) && (options?.enabled ?? true),
+    enabled: Boolean(workspaceId && environment) && (options?.enabled ?? true),
     queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }),
-    queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }),
-    select: (secrets: EncryptedSecret[]) => decryptSecrets(secrets, decryptFileKey)
+    queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }),
+    select: ({ secrets }) => mergePersonalSecrets(secrets)
   });
 
 export const useGetProjectSecretsAllEnv = ({
   workspaceId,
   envs,
-  decryptFileKey,
   secretPath
 }: TGetProjectSecretsAllEnvDTO) => {
   const secrets = useQueries({
     queries: envs.map((environment) => ({
       queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }),
-      enabled: Boolean(decryptFileKey && workspaceId && environment),
-      queryFn: async () => fetchProjectEncryptedSecrets({ workspaceId, environment, secretPath }),
-      select: (secs: EncryptedSecret[]) =>
-        decryptSecrets(secs, decryptFileKey).reduce<Record<string, DecryptedSecret>>(
+      enabled: Boolean(workspaceId && environment),
+      queryFn: async () => fetchProjectSecrets({ workspaceId, environment, secretPath }),
+      select: (el: SecretV3RawResponse) =>
+        mergePersonalSecrets(el.secrets).reduce<Record<string, SecretV3RawSanitized>>(
           (prev, curr) => ({ ...prev, [curr.key]: curr }),
           {}
         )

frontend/src/hooks/api/secrets/types.ts

@@ -30,15 +30,16 @@ export type EncryptedSecret = {
   tags: WsTag[];
 };
 
-export type DecryptedSecret = {
+// both personal and shared secret stitiched together for dashboard
+export type SecretV3RawSanitized = {
   id: string;
   version: number;
   key: string;
   value: string;
-  comment: string;
+  comment?: string;
   reminderRepeatDays?: number | null;
   reminderNote?: string | null;
-  tags: WsTag[];
+  tags?: WsTag[];
   createdAt: string;
   updatedAt: string;
   env: string;
@@ -49,6 +50,35 @@ export type DecryptedSecret = {
   skipMultilineEncoding?: boolean;
 };
 
+export type SecretV3Raw = {
+  id: string;
+  _id: string;
+  workspace: string;
+  environment: string;
+  version: number;
+  type: string;
+  secretKey: string;
+  secretValue: string;
+  secretComment?: string;
+  secretReminderNote?: string;
+  secretReminderRepeatDays?: number;
+  skipMultilineEncoding?: boolean;
+  metadata?: Record<string, string>;
+  tags?: WsTag[];
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type SecretV3RawResponse = {
+  secrets: SecretV3Raw[];
+  imports: {
+    secretPath: string;
+    environment: string;
+    folderId: string;
+    secrets: SecretV3Raw[];
+  }[];
+};
+
 export type EncryptedSecretVersion = {
   id: string;
   secretId: string;
@@ -75,16 +105,15 @@ export type TGetProjectSecretsKey = {
   workspaceId: string;
   environment: string;
   secretPath?: string;
+  includeImports?: boolean;
+  expandSecretReferences?: boolean;
 };
 
-export type TGetProjectSecretsDTO = {
-  decryptFileKey: UserWsKeyPair;
-} & TGetProjectSecretsKey;
+export type TGetProjectSecretsDTO = TGetProjectSecretsKey;
 
 export type TGetProjectSecretsAllEnvDTO = {
   workspaceId: string;
   envs: string[];
-  decryptFileKey: UserWsKeyPair;
   folderId?: string;
   secretPath?: string;
   isPaused?: boolean;
@@ -98,8 +127,7 @@ export type GetSecretVersionsDTO = {
 };
 
 export type TCreateSecretsV3DTO = {
-  latestFileKey: UserWsKeyPair;
-  secretName: string;
+  secretKey: string;
   secretValue: string;
   secretComment: string;
   skipMultilineEncoding?: boolean;
@@ -110,20 +138,18 @@ export type TCreateSecretsV3DTO = {
 };
 
 export type TUpdateSecretsV3DTO = {
-  latestFileKey: UserWsKeyPair;
   workspaceId: string;
   environment: string;
-  type: SecretType;
   secretPath: string;
+  type: SecretType;
   skipMultilineEncoding?: boolean;
   newSecretName?: string;
-  secretName: string;
-  secretId?: string;
+  secretKey: string;
   secretValue: string;
   secretComment?: string;
   secretReminderRepeatDays?: number | null;
   secretReminderNote?: string | null;
-  tags?: string[];
+  tagIds?: string[];
 };
 
 export type TDeleteSecretsV3DTO = {
@@ -131,7 +157,7 @@ export type TDeleteSecretsV3DTO = {
   environment: string;
   type: SecretType;
   secretPath: string;
-  secretName: string;
+  secretKey: string;
   secretId?: string;
 };
 
@@ -139,13 +165,13 @@ export type TCreateSecretBatchDTO = {
   workspaceId: string;
   environment: string;
   secretPath: string;
-  latestFileKey: UserWsKeyPair;
   secrets: Array<{
-    secretName: string;
+    secretKey: string;
     secretValue: string;
     secretComment: string;
     skipMultilineEncoding?: boolean;
     type: SecretType;
+    tagIds?: string[];
     metadata?: {
       source?: string;
     };
@@ -156,14 +182,16 @@ export type TUpdateSecretBatchDTO = {
   workspaceId: string;
   environment: string;
   secretPath: string;
-  latestFileKey: UserWsKeyPair;
   secrets: Array<{
     type: SecretType;
-    secretName: string;
-    skipMultilineEncoding?: boolean;
+    secretKey: string;
     secretValue: string;
-    secretComment: string;
-    tags?: string[];
+    secretComment?: string;
+    skipMultilineEncoding?: boolean;
+    tagIds?: string[];
+    metadata?: {
+      source?: string;
+    };
   }>;
 };
 
@@ -172,7 +200,7 @@ export type TDeleteSecretBatchDTO = {
   environment: string;
   secretPath: string;
   secrets: Array<{
-    secretName: string;
+    secretKey: string;
     type: SecretType;
   }>;
 };
@@ -187,23 +215,3 @@ export type TMoveSecretsDTO = {
   secretIds: string[];
   shouldOverwrite: boolean;
 };
-
-export type CreateSecretDTO = {
-  workspaceId: string;
-  environment: string;
-  type: SecretType;
-  secretKey: string;
-  secretKeyCiphertext: string;
-  secretKeyIV: string;
-  secretKeyTag: string;
-  secretValueCiphertext: string;
-  secretValueIV: string;
-  secretValueTag: string;
-  secretCommentCiphertext: string;
-  secretCommentIV: string;
-  secretCommentTag: string;
-  secretPath: string;
-  metadata?: {
-    source?: string;
-  };
-};