review fixes

backend/src/services/app-connection/hc-vault/hc-vault-connection-service.ts

@@ -1,3 +1,4 @@
+import { logger } from "@app/lib/logger";
 import { OrgServiceActor } from "@app/lib/types";
 
 import { AppConnection } from "../app-connection-enums";
@@ -18,6 +19,7 @@ export const hcVaultConnectionService = (getAppConnection: TGetAppConnectionFunc
       const mounts = await listHCVaultMounts(appConnection);
       return mounts;
     } catch (error) {
+      logger.error(error, "Failed to establish connection with Hashicorp Vault");
       return [];
     }
   };

backend/src/services/secret-sync/hc-vault/hc-vault-sync-fns.ts

@@ -1,5 +1,6 @@
 import { request } from "@app/lib/config/request";
 import { removeTrailingSlash } from "@app/lib/fn";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { getHCVaultAccessToken, getHCVaultInstanceUrl } from "@app/services/app-connection/hc-vault";
 import {
   THCVaultListVariables,
@@ -11,6 +12,8 @@ import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
 import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
 
 const listHCVaultVariables = async ({ instanceUrl, namespace, mount, accessToken, path }: THCVaultListVariables) => {
+  await blockLocalAndPrivateIpAddresses(instanceUrl);
+
   const { data } = await request.get<THCVaultListVariablesResponse>(
     `${instanceUrl}/v1/${removeTrailingSlash(mount)}/data/${path}`,
     {
@@ -32,8 +35,10 @@ const updateHCVaultVariables = async ({
   accessToken,
   mount,
   data
-}: TPostHCVaultVariable) =>
-  request.post(
+}: TPostHCVaultVariable) => {
+  await blockLocalAndPrivateIpAddresses(instanceUrl);
+
+  return request.post(
     `${instanceUrl}/v1/${removeTrailingSlash(mount)}/data/${path}`,
     {
       data
@@ -46,6 +51,7 @@ const updateHCVaultVariables = async ({
       }
     }
   );
+};
 
 export const HCVaultSyncFns = {
   syncSecrets: async (secretSync: THCVaultSyncWithCredentials, secretMap: TSecretMap) => {

docs/integrations/app-connections/hashicorp-vault.mdx

@@ -44,7 +44,7 @@ Infisical supports two methods for connecting to Hashicorp Vault.
                 <Tabs>
                     <Tab title="Secret Sync">
                         ```hcl
-                        path "demo_mount/data/demo_path/demo_subpath" {
+                        path "demo_mount/data/*" {
                           capabilities = [ "create", "read", "update" ]
                         }
 
@@ -54,10 +54,10 @@ Infisical supports two methods for connecting to Hashicorp Vault.
                         ```
 
                         - **demo_mount**: The name of the target secrets engine (e.g., 'secret', 'kv').
-                        - **demo_path/demo_subpath**: The specific path within the secrets engine where secrets are stored.
+                        - **data/\***: The path within the secrets engine used for storing secrets. The wildcard (*) grants access to all secrets within this mount point.
 
                         <Note>
-                            Ensure that you replace the policy path so that it matches with an existing KV Secrets Engine mount and path.
+                            Ensure that you replace the policy path so that it matches with an existing KV Secrets Engine mount and path. You may set a specific path instead of using the wildcard (*) for a more granular policy.
                         </Note>
                     </Tab>
                 </Tabs>
@@ -109,11 +109,11 @@ Infisical supports two methods for connecting to Hashicorp Vault.
 ## Getting Vault Instance URL
 
 <Tabs>
-    <Tab title="Self Hosted">
-        On self-hosted instances, simply copy your vault's base URL. (Ex. `https://vault.example.com`)
+<Tab title="Self Hosted">
+    For self-hosted instances, locate and copy your vault's base URL (for example: `https://vault.example.com`).
 
-        Save this value for later steps.
-    </Tab>
+    Save the URL for later steps.
+</Tab>
     <Tab title="Hashicorp Cloud Platform">
         On HCP instances, you may need to navigate to **Cluster Overview** to see your cluster URL. Save this value for later steps.
 
@@ -145,13 +145,23 @@ Infisical supports two methods for connecting to Hashicorp Vault.
 
                 ![Vault Configure Connection](/images/app-connections/hashicorp-vault/vault-infisical-connect-modal.png)
 
-                - **Name**: The name of the connection being created. Must be slug-friendly.
-                - **Description**: An optional description to provide details about this connection.
-                - **Instance URL**: The URL of your Hashicorp Vault instance.
-                - **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
-                - **Access Token**: The Access Token generated in the steps above (if using Access Token authentication method).
-                - **Role ID**: The Role ID generated in the steps above (if using AppRole authentication method).
-                - **Secret ID**: The Secret ID generated in the steps above (if using AppRole authentication method).
+                <Tabs>
+                    <Tab title="App Role">
+                        - **Name**: The name of the connection being created. Must be slug-friendly.
+                        - **Description**: An optional description to provide details about this connection.
+                        - **Instance URL**: The URL of your Hashicorp Vault instance.
+                        - **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
+                        - **Role ID**: The Role ID generated in the steps above.
+                        - **Secret ID**: The Secret ID generated in the steps above.
+                    </Tab>
+                    <Tab title="Access Token">
+                        - **Name**: The name of the connection being created. Must be slug-friendly.
+                        - **Description**: An optional description to provide details about this connection.
+                        - **Instance URL**: The URL of your Hashicorp Vault instance.
+                        - **Namespace (optional)**: The namespace within your vault. Self-hosted and enterprise clusters may not use namespaces.
+                        - **Access Token**: The Access Token generated in the steps above.
+                    </Tab>
+                </Tabs>
             </Step>
             <Step title="Connection Created">
                 Your Vault Connection is now available for use.

docs/integrations/secret-syncs/hashicorp-vault.mdx

@@ -36,7 +36,7 @@ description: "Learn how to configure a Hashicorp Vault Sync for Infisical."
                 ![Configure Destination](/images/secret-syncs/hashicorp-vault/sync-destination.png)
 
                 - **Hashicorp Vault Connection**: The Vault Connection to authenticate with.
-                - **Secrets Engine Mount**: The type of secrets engine to use (e.g., 'secret', 'kv').
+                - **Secrets Engine Mount**: The secrets engine to sync secrets with (e.g., 'secret', 'kv').
                 - **Path**: The specific path within the secrets engine where secrets will be stored.
 
                 After configuring these parameters, click the **Next** button to continue to the Sync Options step.

frontend/src/helpers/appConnections.ts

@@ -54,7 +54,7 @@ export const APP_CONNECTION_MAP: Record<
   [AppConnection.Camunda]: { name: "Camunda", image: "Camunda.png" },
   [AppConnection.Windmill]: { name: "Windmill", image: "Windmill.png" },
   [AppConnection.Auth0]: { name: "Auth0", image: "Auth0.png", size: 40 },
-  [AppConnection.HCVault]: { name: "Hashicorp Vault", image: "Vault.png" },
+  [AppConnection.HCVault]: { name: "Hashicorp Vault", image: "Vault.png", size: 65 },
   [AppConnection.LDAP]: { name: "LDAP", image: "LDAP.png", size: 65 },
   [AppConnection.TeamCity]: { name: "TeamCity", image: "TeamCity.png" }
 };