From 627c8711dc608d4a789f479b6effae3a73e6219c Mon Sep 17 00:00:00 2001
From: Akhil Mohan <akhilmhdh@gmail.com>
Date: Wed, 17 Jan 2024 23:32:25 +0530
Subject: [PATCH] feat(infisical-pg): fixed v3 raw endpoint auto filling based
 on service token data single scoped

---
 .../src/server/routes/v3/secret-router.ts     | 31 ++++++++++++++-----
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/backend-pg/src/server/routes/v3/secret-router.ts b/backend-pg/src/server/routes/v3/secret-router.ts
index 881895090..af24873f1 100644
--- a/backend-pg/src/server/routes/v3/secret-router.ts
+++ b/backend-pg/src/server/routes/v3/secret-router.ts
@@ -1,13 +1,16 @@
+import picomatch from "picomatch";
 import { z } from "zod";
 
 import {
   SecretApprovalRequestsSchema,
   SecretsSchema,
   SecretTagsSchema,
-  SecretType
+  SecretType,
+  ServiceTokenScopes,
 } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { CommitType } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
+import { BadRequestError } from "@app/lib/errors";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
@@ -19,8 +22,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
     method: "GET",
     schema: {
       querystring: z.object({
-        workspaceId: z.string().trim(),
-        environment: z.string().trim(),
+        workspaceId: z.string().trim().optional(),
+        environment: z.string().trim().optional(),
         secretPath: z.string().trim().default("/"),
         include_imports: z
           .enum(["true", "false"])
@@ -53,12 +56,26 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       AuthMode.IDENTITY_ACCESS_TOKEN
     ]),
     handler: async (req) => {
+      // just for delivery hero usecase
+      let {secretPath,environment,workspaceId} = req.query;
+      if(req.auth.actor === ActorType.SERVICE){
+        const scope = ServiceTokenScopes.parse(req.auth.serviceToken.scopes);
+        const isSingleScope = scope.length === 1;
+        if(isSingleScope && !picomatch.scan(scope[0].secretPath).isGlob){
+          secretPath = scope[0].secretPath;
+          environment = scope[0].environment;
+          workspaceId = req.auth.serviceToken.projectId;
+        }
+      }
+
+      if(!workspaceId || !environment) throw new BadRequestError({message:"Missing workspace id or environment"})
+
       const { secrets, imports } = await server.services.secret.getSecretsRaw({
         actorId: req.permission.id,
         actor: req.permission.type,
-        environment: req.query.environment,
-        projectId: req.query.workspaceId,
-        path: req.query.secretPath,
+        environment, 
+        projectId: workspaceId as string,
+        path: secretPath,
         includeImports: req.query.include_imports
       });
 
@@ -68,7 +85,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         event: {
           type: EventType.GET_SECRETS,
           metadata: {
-            environment: req.query.environment,
+            environment,
             secretPath: req.query.secretPath,
             numberOfSecrets: secrets.length
           }