mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-14 06:29:37 +00:00
Merge pull request #3835 from Infisical/feat/gitlabSecretSync
feat(secret-sync): Add gitlab secret sync
This commit is contained in:
carlosmonastyrski
Generated
+67
@@ -30,6 +30,7 @@
|
||||
"@fastify/static": "^7.0.4",
|
||||
"@fastify/swagger": "^8.14.0",
|
||||
"@fastify/swagger-ui": "^2.1.0",
|
||||
"@gitbeaker/rest": "^42.5.0",
|
||||
"@google-cloud/kms": "^4.5.0",
|
||||
"@infisical/quic": "^1.0.8",
|
||||
"@node-saml/passport-saml": "^5.0.1",
|
||||
@@ -7807,6 +7808,48 @@
|
||||
"p-limit": "^3.1.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@gitbeaker/core": {
|
||||
"version": "42.5.0",
|
||||
"resolved": "https://registry.npmjs.org/@gitbeaker/core/-/core-42.5.0.tgz",
|
||||
"integrity": "sha512-rMWpOPaZi1iLiifnOIoVO57p2EmQQdfIwP4txqNyMvG4WjYP5Ez0U7jRD9Nra41x6K5kTPBZkuQcAdxVWRJcEQ==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@gitbeaker/requester-utils": "^42.5.0",
|
||||
"qs": "^6.12.2",
|
||||
"xcase": "^2.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18.20.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@gitbeaker/requester-utils": {
|
||||
"version": "42.5.0",
|
||||
"resolved": "https://registry.npmjs.org/@gitbeaker/requester-utils/-/requester-utils-42.5.0.tgz",
|
||||
"integrity": "sha512-HLdLS9LPBMVQumvroQg/4qkphLDtwDB+ygEsrD2u4oYCMUtXV4V1xaVqU4yTXjbTJ5sItOtdB43vYRkBcgueBw==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"picomatch-browser": "^2.2.6",
|
||||
"qs": "^6.12.2",
|
||||
"rate-limiter-flexible": "^4.0.1",
|
||||
"xcase": "^2.0.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18.20.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@gitbeaker/rest": {
|
||||
"version": "42.5.0",
|
||||
"resolved": "https://registry.npmjs.org/@gitbeaker/rest/-/rest-42.5.0.tgz",
|
||||
"integrity": "sha512-oC5cM6jS7aFOp0luTw5mWSRuMgdxwHRLZQ/aWkI+ETMfsprR/HyxsXfljlMY/XJ/fRxTbRJiodR5Axf66WjO3w==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@gitbeaker/core": "^42.5.0",
|
||||
"@gitbeaker/requester-utils": "^42.5.0"
|
||||
},
|
||||
"engines": {
|
||||
"node": ">=18.20.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@google-cloud/kms": {
|
||||
"version": "4.5.0",
|
||||
"resolved": "https://registry.npmjs.org/@google-cloud/kms/-/kms-4.5.0.tgz",
|
||||
@@ -24628,6 +24671,18 @@
|
||||
"url": "https://github.com/sponsors/jonschlinkert"
|
||||
}
|
||||
},
|
||||
"node_modules/picomatch-browser": {
|
||||
"version": "2.2.6",
|
||||
"resolved": "https://registry.npmjs.org/picomatch-browser/-/picomatch-browser-2.2.6.tgz",
|
||||
"integrity": "sha512-0ypsOQt9D4e3hziV8O4elD9uN0z/jtUEfxVRtNaAAtXIyUx9m/SzlO020i8YNL2aL/E6blOvvHQcin6HZlFy/w==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=8.6"
|
||||
},
|
||||
"funding": {
|
||||
"url": "https://github.com/sponsors/jonschlinkert"
|
||||
}
|
||||
},
|
||||
"node_modules/pify": {
|
||||
"version": "4.0.1",
|
||||
"resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
|
||||
@@ -25562,6 +25617,12 @@
|
||||
"node": ">= 0.6"
|
||||
}
|
||||
},
|
||||
"node_modules/rate-limiter-flexible": {
|
||||
"version": "4.0.1",
|
||||
"resolved": "https://registry.npmjs.org/rate-limiter-flexible/-/rate-limiter-flexible-4.0.1.tgz",
|
||||
"integrity": "sha512-2/dGHpDFpeA0+755oUkW+EKyklqLS9lu0go9pDsbhqQjZcxfRyJ6LA4JI0+HAdZ2bemD/oOjUeZQB2lCZqXQfQ==",
|
||||
"license": "ISC"
|
||||
},
|
||||
"node_modules/raw-body": {
|
||||
"version": "2.5.2",
|
||||
"resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
|
||||
@@ -31039,6 +31100,12 @@
|
||||
}
|
||||
}
|
||||
},
|
||||
"node_modules/xcase": {
|
||||
"version": "2.0.1",
|
||||
"resolved": "https://registry.npmjs.org/xcase/-/xcase-2.0.1.tgz",
|
||||
"integrity": "sha512-UmFXIPU+9Eg3E9m/728Bii0lAIuoc+6nbrNUKaRPJOFp91ih44qqGlWtxMB6kXFrRD6po+86ksHM5XHCfk6iPw==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/xml-crypto": {
|
||||
"version": "6.0.1",
|
||||
"resolved": "https://registry.npmjs.org/xml-crypto/-/xml-crypto-6.0.1.tgz",
|
||||
|
||||
@@ -149,6 +149,7 @@
|
||||
"@fastify/static": "^7.0.4",
|
||||
"@fastify/swagger": "^8.14.0",
|
||||
"@fastify/swagger-ui": "^2.1.0",
|
||||
"@gitbeaker/rest": "^42.5.0",
|
||||
"@google-cloud/kms": "^4.5.0",
|
||||
"@infisical/quic": "^1.0.8",
|
||||
"@node-saml/passport-saml": "^5.0.1",
|
||||
|
||||
@@ -2228,6 +2228,12 @@ export const AppConnections = {
|
||||
},
|
||||
FLYIO: {
|
||||
accessToken: "The Access Token used to access fly.io."
|
||||
},
|
||||
GITLAB: {
|
||||
instanceUrl: "The GitLab instance URL to connect with.",
|
||||
accessToken: "The Access Token used to access GitLab.",
|
||||
code: "The OAuth code to use to connect with GitLab.",
|
||||
accessTokenType: "The type of token used to connect with GitLab."
|
||||
}
|
||||
}
|
||||
};
|
||||
@@ -2402,6 +2408,17 @@ export const SecretSyncs = {
|
||||
FLYIO: {
|
||||
appId: "The ID of the Fly.io app to sync secrets to."
|
||||
},
|
||||
GITLAB: {
|
||||
projectId: "The GitLab Project ID to sync secrets to.",
|
||||
projectName: "The GitLab Project Name to sync secrets to.",
|
||||
groupId: "The GitLab Group ID to sync secrets to.",
|
||||
groupName: "The GitLab Group Name to sync secrets to.",
|
||||
scope: "The GitLab scope that secrets should be synced to. (default: project)",
|
||||
targetEnvironment: "The GitLab environment scope that secrets should be synced to. (default: *)",
|
||||
shouldProtectSecrets: "Whether variables should be protected",
|
||||
shouldMaskSecrets: "Whether variables should be masked in logs",
|
||||
shouldHideSecrets: "Whether variables should be hidden"
|
||||
},
|
||||
CLOUDFLARE_PAGES: {
|
||||
projectName: "The name of the Cloudflare Pages project to sync secrets to.",
|
||||
environment: "The environment of the Cloudflare Pages project to sync secrets to."
|
||||
|
||||
@@ -247,6 +247,10 @@ const envSchema = z
|
||||
INF_APP_CONNECTION_GITHUB_RADAR_APP_ID: zpStr(z.string().optional()),
|
||||
INF_APP_CONNECTION_GITHUB_RADAR_APP_WEBHOOK_SECRET: zpStr(z.string().optional()),
|
||||
|
||||
// gitlab oauth
|
||||
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID: zpStr(z.string().optional()),
|
||||
INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET: zpStr(z.string().optional()),
|
||||
|
||||
// gcp app
|
||||
INF_APP_CONNECTION_GCP_SERVICE_ACCOUNT_CREDENTIAL: zpStr(z.string().optional()),
|
||||
|
||||
|
||||
@@ -35,6 +35,10 @@ import {
|
||||
CamundaConnectionListItemSchema,
|
||||
SanitizedCamundaConnectionSchema
|
||||
} from "@app/services/app-connection/camunda";
|
||||
import {
|
||||
CloudflareConnectionListItemSchema,
|
||||
SanitizedCloudflareConnectionSchema
|
||||
} from "@app/services/app-connection/cloudflare/cloudflare-connection-schema";
|
||||
import {
|
||||
DatabricksConnectionListItemSchema,
|
||||
SanitizedDatabricksConnectionSchema
|
||||
@@ -46,6 +50,7 @@ import {
|
||||
GitHubRadarConnectionListItemSchema,
|
||||
SanitizedGitHubRadarConnectionSchema
|
||||
} from "@app/services/app-connection/github-radar";
|
||||
import { GitLabConnectionListItemSchema, SanitizedGitLabConnectionSchema } from "@app/services/app-connection/gitlab";
|
||||
import {
|
||||
HCVaultConnectionListItemSchema,
|
||||
SanitizedHCVaultConnectionSchema
|
||||
@@ -80,10 +85,6 @@ import {
|
||||
WindmillConnectionListItemSchema
|
||||
} from "@app/services/app-connection/windmill";
|
||||
import { AuthMode } from "@app/services/auth/auth-type";
|
||||
import {
|
||||
CloudflareConnectionListItemSchema,
|
||||
SanitizedCloudflareConnectionSchema
|
||||
} from "@app/services/app-connection/cloudflare/cloudflare-connection-schema";
|
||||
|
||||
// can't use discriminated due to multiple schemas for certain apps
|
||||
const SanitizedAppConnectionSchema = z.union([
|
||||
@@ -114,6 +115,7 @@ const SanitizedAppConnectionSchema = z.union([
|
||||
...SanitizedHerokuConnectionSchema.options,
|
||||
...SanitizedRenderConnectionSchema.options,
|
||||
...SanitizedFlyioConnectionSchema.options,
|
||||
...SanitizedGitLabConnectionSchema.options,
|
||||
...SanitizedCloudflareConnectionSchema.options
|
||||
]);
|
||||
|
||||
@@ -145,6 +147,7 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
|
||||
HerokuConnectionListItemSchema,
|
||||
RenderConnectionListItemSchema,
|
||||
FlyioConnectionListItemSchema,
|
||||
GitLabConnectionListItemSchema,
|
||||
CloudflareConnectionListItemSchema
|
||||
]);
|
||||
|
||||
|
||||
@@ -0,0 +1,90 @@
|
||||
import z from "zod";
|
||||
|
||||
import { readLimit } from "@app/server/config/rateLimiter";
|
||||
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import {
|
||||
CreateGitLabConnectionSchema,
|
||||
SanitizedGitLabConnectionSchema,
|
||||
TGitLabGroup,
|
||||
TGitLabProject,
|
||||
UpdateGitLabConnectionSchema
|
||||
} from "@app/services/app-connection/gitlab";
|
||||
import { AuthMode } from "@app/services/auth/auth-type";
|
||||
|
||||
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
|
||||
|
||||
export const registerGitLabConnectionRouter = async (server: FastifyZodProvider) => {
|
||||
registerAppConnectionEndpoints({
|
||||
app: AppConnection.GitLab,
|
||||
server,
|
||||
sanitizedResponseSchema: SanitizedGitLabConnectionSchema,
|
||||
createSchema: CreateGitLabConnectionSchema,
|
||||
updateSchema: UpdateGitLabConnectionSchema
|
||||
});
|
||||
|
||||
// The below endpoints are not exposed and for Infisical App use
|
||||
server.route({
|
||||
method: "GET",
|
||||
url: `/:connectionId/projects`,
|
||||
config: {
|
||||
rateLimit: readLimit
|
||||
},
|
||||
schema: {
|
||||
params: z.object({
|
||||
connectionId: z.string().uuid()
|
||||
}),
|
||||
response: {
|
||||
200: z
|
||||
.object({
|
||||
id: z.string(),
|
||||
name: z.string()
|
||||
})
|
||||
.array()
|
||||
}
|
||||
},
|
||||
onRequest: verifyAuth([AuthMode.JWT]),
|
||||
handler: async (req) => {
|
||||
const { connectionId } = req.params;
|
||||
|
||||
const projects: TGitLabProject[] = await server.services.appConnection.gitlab.listProjects(
|
||||
connectionId,
|
||||
req.permission
|
||||
);
|
||||
|
||||
return projects;
|
||||
}
|
||||
});
|
||||
|
||||
server.route({
|
||||
method: "GET",
|
||||
url: `/:connectionId/groups`,
|
||||
config: {
|
||||
rateLimit: readLimit
|
||||
},
|
||||
schema: {
|
||||
params: z.object({
|
||||
connectionId: z.string().uuid()
|
||||
}),
|
||||
response: {
|
||||
200: z
|
||||
.object({
|
||||
id: z.string(),
|
||||
name: z.string()
|
||||
})
|
||||
.array()
|
||||
}
|
||||
},
|
||||
onRequest: verifyAuth([AuthMode.JWT]),
|
||||
handler: async (req) => {
|
||||
const { connectionId } = req.params;
|
||||
|
||||
const groups: TGitLabGroup[] = await server.services.appConnection.gitlab.listGroups(
|
||||
connectionId,
|
||||
req.permission
|
||||
);
|
||||
|
||||
return groups;
|
||||
}
|
||||
});
|
||||
};
|
||||
@@ -10,11 +10,13 @@ import { registerAzureClientSecretsConnectionRouter } from "./azure-client-secre
|
||||
import { registerAzureDevOpsConnectionRouter } from "./azure-devops-connection-router";
|
||||
import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
|
||||
import { registerCamundaConnectionRouter } from "./camunda-connection-router";
|
||||
import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
|
||||
import { registerDatabricksConnectionRouter } from "./databricks-connection-router";
|
||||
import { registerFlyioConnectionRouter } from "./flyio-connection-router";
|
||||
import { registerGcpConnectionRouter } from "./gcp-connection-router";
|
||||
import { registerGitHubConnectionRouter } from "./github-connection-router";
|
||||
import { registerGitHubRadarConnectionRouter } from "./github-radar-connection-router";
|
||||
import { registerGitLabConnectionRouter } from "./gitlab-connection-router";
|
||||
import { registerHCVaultConnectionRouter } from "./hc-vault-connection-router";
|
||||
import { registerHerokuConnectionRouter } from "./heroku-connection-router";
|
||||
import { registerHumanitecConnectionRouter } from "./humanitec-connection-router";
|
||||
@@ -27,7 +29,6 @@ import { registerTeamCityConnectionRouter } from "./teamcity-connection-router";
|
||||
import { registerTerraformCloudConnectionRouter } from "./terraform-cloud-router";
|
||||
import { registerVercelConnectionRouter } from "./vercel-connection-router";
|
||||
import { registerWindmillConnectionRouter } from "./windmill-connection-router";
|
||||
import { registerCloudflareConnectionRouter } from "./cloudflare-connection-router";
|
||||
|
||||
export * from "./app-connection-router";
|
||||
|
||||
@@ -60,5 +61,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
|
||||
[AppConnection.Heroku]: registerHerokuConnectionRouter,
|
||||
[AppConnection.Render]: registerRenderConnectionRouter,
|
||||
[AppConnection.Flyio]: registerFlyioConnectionRouter,
|
||||
[AppConnection.GitLab]: registerGitLabConnectionRouter,
|
||||
[AppConnection.Cloudflare]: registerCloudflareConnectionRouter
|
||||
};
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
import { CreateGitLabSyncSchema, GitLabSyncSchema, UpdateGitLabSyncSchema } from "@app/services/secret-sync/gitlab";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
|
||||
import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
|
||||
|
||||
export const registerGitLabSyncRouter = async (server: FastifyZodProvider) =>
|
||||
registerSyncSecretsEndpoints({
|
||||
destination: SecretSync.GitLab,
|
||||
server,
|
||||
responseSchema: GitLabSyncSchema,
|
||||
createSchema: CreateGitLabSyncSchema,
|
||||
updateSchema: UpdateGitLabSyncSchema
|
||||
});
|
||||
@@ -13,6 +13,7 @@ import { registerDatabricksSyncRouter } from "./databricks-sync-router";
|
||||
import { registerFlyioSyncRouter } from "./flyio-sync-router";
|
||||
import { registerGcpSyncRouter } from "./gcp-sync-router";
|
||||
import { registerGitHubSyncRouter } from "./github-sync-router";
|
||||
import { registerGitLabSyncRouter } from "./gitlab-sync-router";
|
||||
import { registerHCVaultSyncRouter } from "./hc-vault-sync-router";
|
||||
import { registerHerokuSyncRouter } from "./heroku-sync-router";
|
||||
import { registerHumanitecSyncRouter } from "./humanitec-sync-router";
|
||||
@@ -45,5 +46,6 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
|
||||
[SecretSync.Heroku]: registerHerokuSyncRouter,
|
||||
[SecretSync.Render]: registerRenderSyncRouter,
|
||||
[SecretSync.Flyio]: registerFlyioSyncRouter,
|
||||
[SecretSync.GitLab]: registerGitLabSyncRouter,
|
||||
[SecretSync.CloudflarePages]: registerCloudflarePagesSyncRouter
|
||||
};
|
||||
|
||||
@@ -22,10 +22,15 @@ import {
|
||||
import { AzureDevOpsSyncListItemSchema, AzureDevOpsSyncSchema } from "@app/services/secret-sync/azure-devops";
|
||||
import { AzureKeyVaultSyncListItemSchema, AzureKeyVaultSyncSchema } from "@app/services/secret-sync/azure-key-vault";
|
||||
import { CamundaSyncListItemSchema, CamundaSyncSchema } from "@app/services/secret-sync/camunda";
|
||||
import {
|
||||
CloudflarePagesSyncListItemSchema,
|
||||
CloudflarePagesSyncSchema
|
||||
} from "@app/services/secret-sync/cloudflare-pages/cloudflare-pages-schema";
|
||||
import { DatabricksSyncListItemSchema, DatabricksSyncSchema } from "@app/services/secret-sync/databricks";
|
||||
import { FlyioSyncListItemSchema, FlyioSyncSchema } from "@app/services/secret-sync/flyio";
|
||||
import { GcpSyncListItemSchema, GcpSyncSchema } from "@app/services/secret-sync/gcp";
|
||||
import { GitHubSyncListItemSchema, GitHubSyncSchema } from "@app/services/secret-sync/github";
|
||||
import { GitLabSyncListItemSchema, GitLabSyncSchema } from "@app/services/secret-sync/gitlab";
|
||||
import { HCVaultSyncListItemSchema, HCVaultSyncSchema } from "@app/services/secret-sync/hc-vault";
|
||||
import { HerokuSyncListItemSchema, HerokuSyncSchema } from "@app/services/secret-sync/heroku";
|
||||
import { HumanitecSyncListItemSchema, HumanitecSyncSchema } from "@app/services/secret-sync/humanitec";
|
||||
@@ -34,10 +39,6 @@ import { TeamCitySyncListItemSchema, TeamCitySyncSchema } from "@app/services/se
|
||||
import { TerraformCloudSyncListItemSchema, TerraformCloudSyncSchema } from "@app/services/secret-sync/terraform-cloud";
|
||||
import { VercelSyncListItemSchema, VercelSyncSchema } from "@app/services/secret-sync/vercel";
|
||||
import { WindmillSyncListItemSchema, WindmillSyncSchema } from "@app/services/secret-sync/windmill";
|
||||
import {
|
||||
CloudflarePagesSyncListItemSchema,
|
||||
CloudflarePagesSyncSchema
|
||||
} from "@app/services/secret-sync/cloudflare-pages/cloudflare-pages-schema";
|
||||
|
||||
const SecretSyncSchema = z.discriminatedUnion("destination", [
|
||||
AwsParameterStoreSyncSchema,
|
||||
@@ -60,6 +61,7 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
|
||||
HerokuSyncSchema,
|
||||
RenderSyncSchema,
|
||||
FlyioSyncSchema,
|
||||
GitLabSyncSchema,
|
||||
CloudflarePagesSyncSchema
|
||||
]);
|
||||
|
||||
@@ -84,6 +86,7 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
|
||||
HerokuSyncListItemSchema,
|
||||
RenderSyncListItemSchema,
|
||||
FlyioSyncListItemSchema,
|
||||
GitLabSyncListItemSchema,
|
||||
CloudflarePagesSyncListItemSchema
|
||||
]);
|
||||
|
||||
|
||||
@@ -26,6 +26,7 @@ export enum AppConnection {
|
||||
Heroku = "heroku",
|
||||
Render = "render",
|
||||
Flyio = "flyio",
|
||||
GitLab = "gitlab",
|
||||
Cloudflare = "cloudflare"
|
||||
}
|
||||
|
||||
|
||||
@@ -51,6 +51,11 @@ import {
|
||||
validateAzureKeyVaultConnectionCredentials
|
||||
} from "./azure-key-vault";
|
||||
import { CamundaConnectionMethod, getCamundaConnectionListItem, validateCamundaConnectionCredentials } from "./camunda";
|
||||
import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
|
||||
import {
|
||||
getCloudflareConnectionListItem,
|
||||
validateCloudflareConnectionCredentials
|
||||
} from "./cloudflare/cloudflare-connection-fns";
|
||||
import {
|
||||
DatabricksConnectionMethod,
|
||||
getDatabricksConnectionListItem,
|
||||
@@ -64,6 +69,7 @@ import {
|
||||
GitHubRadarConnectionMethod,
|
||||
validateGitHubRadarConnectionCredentials
|
||||
} from "./github-radar";
|
||||
import { getGitLabConnectionListItem, GitLabConnectionMethod, validateGitLabConnectionCredentials } from "./gitlab";
|
||||
import {
|
||||
getHCVaultConnectionListItem,
|
||||
HCVaultConnectionMethod,
|
||||
@@ -99,11 +105,6 @@ import {
|
||||
validateWindmillConnectionCredentials,
|
||||
WindmillConnectionMethod
|
||||
} from "./windmill";
|
||||
import {
|
||||
getCloudflareConnectionListItem,
|
||||
validateCloudflareConnectionCredentials
|
||||
} from "./cloudflare/cloudflare-connection-fns";
|
||||
import { CloudflareConnectionMethod } from "./cloudflare/cloudflare-connection-enum";
|
||||
|
||||
export const listAppConnectionOptions = () => {
|
||||
return [
|
||||
@@ -134,6 +135,7 @@ export const listAppConnectionOptions = () => {
|
||||
getHerokuConnectionListItem(),
|
||||
getRenderConnectionListItem(),
|
||||
getFlyioConnectionListItem(),
|
||||
getGitLabConnectionListItem(),
|
||||
getCloudflareConnectionListItem()
|
||||
].sort((a, b) => a.name.localeCompare(b.name));
|
||||
};
|
||||
@@ -213,6 +215,7 @@ export const validateAppConnectionCredentials = async (
|
||||
[AppConnection.Heroku]: validateHerokuConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Render]: validateRenderConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Flyio]: validateFlyioConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.GitLab]: validateGitLabConnectionCredentials as TAppConnectionCredentialsValidator,
|
||||
[AppConnection.Cloudflare]: validateCloudflareConnectionCredentials as TAppConnectionCredentialsValidator
|
||||
};
|
||||
|
||||
@@ -230,6 +233,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
|
||||
case GitHubConnectionMethod.OAuth:
|
||||
case AzureDevOpsConnectionMethod.OAuth:
|
||||
case HerokuConnectionMethod.OAuth:
|
||||
case GitLabConnectionMethod.OAuth:
|
||||
return "OAuth";
|
||||
case HerokuConnectionMethod.AuthToken:
|
||||
return "Auth Token";
|
||||
@@ -327,6 +331,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
|
||||
[AppConnection.Heroku]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Render]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Flyio]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.GitLab]: platformManagedCredentialsNotSupported,
|
||||
[AppConnection.Cloudflare]: platformManagedCredentialsNotSupported
|
||||
};
|
||||
|
||||
|
||||
@@ -28,6 +28,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
|
||||
[AppConnection.Heroku]: "Heroku",
|
||||
[AppConnection.Render]: "Render",
|
||||
[AppConnection.Flyio]: "Fly.io",
|
||||
[AppConnection.GitLab]: "GitLab",
|
||||
[AppConnection.Cloudflare]: "Cloudflare"
|
||||
};
|
||||
|
||||
@@ -59,5 +60,6 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
|
||||
[AppConnection.Heroku]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Render]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Flyio]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.GitLab]: AppConnectionPlanType.Regular,
|
||||
[AppConnection.Cloudflare]: AppConnectionPlanType.Regular
|
||||
};
|
||||
|
||||
@@ -58,6 +58,8 @@ import { gcpConnectionService } from "./gcp/gcp-connection-service";
|
||||
import { ValidateGitHubConnectionCredentialsSchema } from "./github";
|
||||
import { githubConnectionService } from "./github/github-connection-service";
|
||||
import { ValidateGitHubRadarConnectionCredentialsSchema } from "./github-radar";
|
||||
import { ValidateGitLabConnectionCredentialsSchema } from "./gitlab";
|
||||
import { gitlabConnectionService } from "./gitlab/gitlab-connection-service";
|
||||
import { ValidateHCVaultConnectionCredentialsSchema } from "./hc-vault";
|
||||
import { hcVaultConnectionService } from "./hc-vault/hc-vault-connection-service";
|
||||
import { ValidateHerokuConnectionCredentialsSchema } from "./heroku";
|
||||
@@ -116,6 +118,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
|
||||
[AppConnection.Heroku]: ValidateHerokuConnectionCredentialsSchema,
|
||||
[AppConnection.Render]: ValidateRenderConnectionCredentialsSchema,
|
||||
[AppConnection.Flyio]: ValidateFlyioConnectionCredentialsSchema,
|
||||
[AppConnection.GitLab]: ValidateGitLabConnectionCredentialsSchema,
|
||||
[AppConnection.Cloudflare]: ValidateCloudflareConnectionCredentialsSchema
|
||||
};
|
||||
|
||||
@@ -524,7 +527,8 @@ export const appConnectionServiceFactory = ({
|
||||
onepass: onePassConnectionService(connectAppConnectionById),
|
||||
heroku: herokuConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
|
||||
render: renderConnectionService(connectAppConnectionById),
|
||||
cloudflare: cloudflareConnectionService(connectAppConnectionById),
|
||||
flyio: flyioConnectionService(connectAppConnectionById)
|
||||
flyio: flyioConnectionService(connectAppConnectionById),
|
||||
gitlab: gitlabConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
|
||||
cloudflare: cloudflareConnectionService(connectAppConnectionById)
|
||||
};
|
||||
};
|
||||
|
||||
@@ -62,6 +62,12 @@ import {
|
||||
TCamundaConnectionInput,
|
||||
TValidateCamundaConnectionCredentialsSchema
|
||||
} from "./camunda";
|
||||
import {
|
||||
TCloudflareConnection,
|
||||
TCloudflareConnectionConfig,
|
||||
TCloudflareConnectionInput,
|
||||
TValidateCloudflareConnectionCredentialsSchema
|
||||
} from "./cloudflare/cloudflare-connection-types";
|
||||
import {
|
||||
TDatabricksConnection,
|
||||
TDatabricksConnectionConfig,
|
||||
@@ -92,6 +98,12 @@ import {
|
||||
TGitHubRadarConnectionInput,
|
||||
TValidateGitHubRadarConnectionCredentialsSchema
|
||||
} from "./github-radar";
|
||||
import {
|
||||
TGitLabConnection,
|
||||
TGitLabConnectionConfig,
|
||||
TGitLabConnectionInput,
|
||||
TValidateGitLabConnectionCredentialsSchema
|
||||
} from "./gitlab";
|
||||
import {
|
||||
THCVaultConnection,
|
||||
THCVaultConnectionConfig,
|
||||
@@ -153,12 +165,6 @@ import {
|
||||
TWindmillConnectionConfig,
|
||||
TWindmillConnectionInput
|
||||
} from "./windmill";
|
||||
import {
|
||||
TCloudflareConnection,
|
||||
TCloudflareConnectionConfig,
|
||||
TCloudflareConnectionInput,
|
||||
TValidateCloudflareConnectionCredentialsSchema
|
||||
} from "./cloudflare/cloudflare-connection-types";
|
||||
|
||||
export type TAppConnection = { id: string } & (
|
||||
| TAwsConnection
|
||||
@@ -188,6 +194,7 @@ export type TAppConnection = { id: string } & (
|
||||
| THerokuConnection
|
||||
| TRenderConnection
|
||||
| TFlyioConnection
|
||||
| TGitLabConnection
|
||||
| TCloudflareConnection
|
||||
);
|
||||
|
||||
@@ -223,6 +230,7 @@ export type TAppConnectionInput = { id: string } & (
|
||||
| THerokuConnectionInput
|
||||
| TRenderConnectionInput
|
||||
| TFlyioConnectionInput
|
||||
| TGitLabConnectionInput
|
||||
| TCloudflareConnectionInput
|
||||
);
|
||||
|
||||
@@ -266,6 +274,7 @@ export type TAppConnectionConfig =
|
||||
| THerokuConnectionConfig
|
||||
| TRenderConnectionConfig
|
||||
| TFlyioConnectionConfig
|
||||
| TGitLabConnectionConfig
|
||||
| TCloudflareConnectionConfig;
|
||||
|
||||
export type TValidateAppConnectionCredentialsSchema =
|
||||
@@ -296,6 +305,7 @@ export type TValidateAppConnectionCredentialsSchema =
|
||||
| TValidateHerokuConnectionCredentialsSchema
|
||||
| TValidateRenderConnectionCredentialsSchema
|
||||
| TValidateFlyioConnectionCredentialsSchema
|
||||
| TValidateGitLabConnectionCredentialsSchema
|
||||
| TValidateCloudflareConnectionCredentialsSchema;
|
||||
|
||||
export type TListAwsConnectionKmsKeys = {
|
||||
|
||||
@@ -0,0 +1,9 @@
|
||||
export enum GitLabConnectionMethod {
|
||||
OAuth = "oauth",
|
||||
AccessToken = "access-token"
|
||||
}
|
||||
|
||||
export enum GitLabAccessTokenType {
|
||||
Project = "project",
|
||||
Personal = "personal"
|
||||
}
|
||||
@@ -0,0 +1,351 @@
|
||||
/* eslint-disable no-await-in-loop */
|
||||
import { GitbeakerRequestError, Gitlab } from "@gitbeaker/rest";
|
||||
import { AxiosError } from "axios";
|
||||
|
||||
import { getConfig } from "@app/lib/config/env";
|
||||
import { request } from "@app/lib/config/request";
|
||||
import { BadRequestError, InternalServerError } from "@app/lib/errors";
|
||||
import { removeTrailingSlash } from "@app/lib/fn";
|
||||
import { logger } from "@app/lib/logger";
|
||||
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { encryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
|
||||
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
|
||||
import { TAppConnectionDALFactory } from "../app-connection-dal";
|
||||
import { GitLabAccessTokenType, GitLabConnectionMethod } from "./gitlab-connection-enums";
|
||||
import { TGitLabConnection, TGitLabConnectionConfig, TGitLabGroup, TGitLabProject } from "./gitlab-connection-types";
|
||||
|
||||
interface GitLabOAuthTokenResponse {
|
||||
access_token: string;
|
||||
token_type: string;
|
||||
expires_in: number;
|
||||
refresh_token: string;
|
||||
created_at: number;
|
||||
scope?: string;
|
||||
}
|
||||
|
||||
export const getGitLabConnectionListItem = () => {
|
||||
const { INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID } = getConfig();
|
||||
|
||||
return {
|
||||
name: "GitLab" as const,
|
||||
app: AppConnection.GitLab as const,
|
||||
methods: Object.values(GitLabConnectionMethod) as [
|
||||
GitLabConnectionMethod.AccessToken,
|
||||
GitLabConnectionMethod.OAuth
|
||||
],
|
||||
oauthClientId: INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID
|
||||
};
|
||||
};
|
||||
|
||||
export const getGitLabInstanceUrl = async (instanceUrl?: string) => {
|
||||
const gitLabInstanceUrl = instanceUrl ? removeTrailingSlash(instanceUrl) : IntegrationUrls.GITLAB_URL;
|
||||
|
||||
await blockLocalAndPrivateIpAddresses(gitLabInstanceUrl);
|
||||
|
||||
return gitLabInstanceUrl;
|
||||
};
|
||||
|
||||
export const getGitLabClient = async (accessToken: string, instanceUrl?: string, isOAuth = false) => {
|
||||
const host = await getGitLabInstanceUrl(instanceUrl);
|
||||
|
||||
const client = new Gitlab<true>({
|
||||
host,
|
||||
...(isOAuth ? { oauthToken: accessToken } : { token: accessToken }),
|
||||
camelize: true
|
||||
});
|
||||
|
||||
return client;
|
||||
};
|
||||
|
||||
export const refreshGitLabToken = async (
|
||||
refreshToken: string,
|
||||
appId: string,
|
||||
orgId: string,
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">,
|
||||
instanceUrl?: string
|
||||
): Promise<string> => {
|
||||
const { INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID, INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET, SITE_URL } =
|
||||
getConfig();
|
||||
if (!INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET || !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID || !SITE_URL) {
|
||||
throw new InternalServerError({
|
||||
message: `GitLab environment variables have not been configured`
|
||||
});
|
||||
}
|
||||
|
||||
const payload = new URLSearchParams({
|
||||
grant_type: "refresh_token",
|
||||
refresh_token: refreshToken,
|
||||
client_id: INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID,
|
||||
client_secret: INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET,
|
||||
redirect_uri: `${SITE_URL}/organization/app-connections/gitlab/oauth/callback`
|
||||
});
|
||||
|
||||
try {
|
||||
const url = await getGitLabInstanceUrl(instanceUrl);
|
||||
const { data } = await request.post<GitLabOAuthTokenResponse>(`${url}/oauth/token`, payload.toString(), {
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
Accept: "application/json"
|
||||
}
|
||||
});
|
||||
|
||||
const expiresAt = new Date(Date.now() + data.expires_in * 1000 - 600000);
|
||||
|
||||
const encryptedCredentials = await encryptAppConnectionCredentials({
|
||||
credentials: {
|
||||
instanceUrl,
|
||||
tokenType: data.token_type,
|
||||
createdAt: new Date(data.created_at * 1000).toISOString(),
|
||||
refreshToken: data.refresh_token,
|
||||
accessToken: data.access_token,
|
||||
expiresAt
|
||||
},
|
||||
orgId,
|
||||
kmsService
|
||||
});
|
||||
|
||||
await appConnectionDAL.updateById(appId, { encryptedCredentials });
|
||||
return data.access_token;
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof AxiosError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to refresh GitLab token: ${error.message}`
|
||||
});
|
||||
}
|
||||
throw new BadRequestError({
|
||||
message: "Unable to refresh GitLab token"
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const exchangeGitLabOAuthCode = async (
|
||||
code: string,
|
||||
instanceUrl?: string
|
||||
): Promise<GitLabOAuthTokenResponse> => {
|
||||
const { INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID, INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET, SITE_URL } =
|
||||
getConfig();
|
||||
if (!INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET || !INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID || !SITE_URL) {
|
||||
throw new InternalServerError({
|
||||
message: `GitLab environment variables have not been configured`
|
||||
});
|
||||
}
|
||||
|
||||
try {
|
||||
const payload = new URLSearchParams({
|
||||
grant_type: "authorization_code",
|
||||
code,
|
||||
client_id: INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_ID,
|
||||
client_secret: INF_APP_CONNECTION_GITLAB_OAUTH_CLIENT_SECRET,
|
||||
redirect_uri: `${SITE_URL}/organization/app-connections/gitlab/oauth/callback`
|
||||
});
|
||||
const url = await getGitLabInstanceUrl(instanceUrl);
|
||||
|
||||
const response = await request.post<GitLabOAuthTokenResponse>(`${url}/oauth/token`, payload.toString(), {
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
Accept: "application/json"
|
||||
}
|
||||
});
|
||||
|
||||
if (!response.data) {
|
||||
throw new InternalServerError({
|
||||
message: "Failed to exchange OAuth code: Empty response"
|
||||
});
|
||||
}
|
||||
|
||||
return response.data;
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof AxiosError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to exchange OAuth code: ${error.message}`
|
||||
});
|
||||
}
|
||||
throw new BadRequestError({
|
||||
message: "Unable to exchange OAuth code"
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const validateGitLabConnectionCredentials = async (config: TGitLabConnectionConfig) => {
|
||||
const { credentials: inputCredentials, method } = config;
|
||||
|
||||
let accessToken: string;
|
||||
let oauthData: GitLabOAuthTokenResponse | null = null;
|
||||
|
||||
if (method === GitLabConnectionMethod.OAuth && "code" in inputCredentials) {
|
||||
oauthData = await exchangeGitLabOAuthCode(inputCredentials.code, inputCredentials.instanceUrl);
|
||||
accessToken = oauthData.access_token;
|
||||
} else if (method === GitLabConnectionMethod.AccessToken && "accessToken" in inputCredentials) {
|
||||
accessToken = inputCredentials.accessToken;
|
||||
} else {
|
||||
throw new BadRequestError({
|
||||
message: "Invalid credentials for the selected connection method"
|
||||
});
|
||||
}
|
||||
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
inputCredentials.instanceUrl,
|
||||
method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
await client.Users.showCurrentUser();
|
||||
} catch (error: unknown) {
|
||||
logger.error(error, "Error validating GitLab connection credentials");
|
||||
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to validate credentials: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
});
|
||||
}
|
||||
|
||||
throw new BadRequestError({
|
||||
message: `Failed to validate credentials: ${(error as Error)?.message || "verify credentials"}`
|
||||
});
|
||||
}
|
||||
|
||||
if (method === GitLabConnectionMethod.OAuth && oauthData) {
|
||||
return {
|
||||
accessToken,
|
||||
instanceUrl: inputCredentials.instanceUrl,
|
||||
refreshToken: oauthData.refresh_token,
|
||||
expiresAt: new Date(Date.now() + oauthData.expires_in * 1000 - 60000),
|
||||
tokenType: oauthData.token_type,
|
||||
createdAt: new Date(oauthData.created_at * 1000)
|
||||
};
|
||||
}
|
||||
|
||||
return inputCredentials;
|
||||
};
|
||||
|
||||
export const listGitLabProjects = async ({
|
||||
appConnection,
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
}: {
|
||||
appConnection: TGitLabConnection;
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
}): Promise<TGitLabProject[]> => {
|
||||
let { accessToken } = appConnection.credentials;
|
||||
|
||||
if (
|
||||
appConnection.method === GitLabConnectionMethod.OAuth &&
|
||||
appConnection.credentials.refreshToken &&
|
||||
new Date(appConnection.credentials.expiresAt) < new Date()
|
||||
) {
|
||||
accessToken = await refreshGitLabToken(
|
||||
appConnection.credentials.refreshToken,
|
||||
appConnection.id,
|
||||
appConnection.orgId,
|
||||
appConnectionDAL,
|
||||
kmsService,
|
||||
appConnection.credentials.instanceUrl
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
appConnection.credentials.instanceUrl,
|
||||
appConnection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
const projects = await client.Projects.all({
|
||||
archived: false,
|
||||
includePendingDelete: false,
|
||||
membership: true,
|
||||
includeHidden: false,
|
||||
imported: false
|
||||
});
|
||||
|
||||
return projects.map((project) => ({
|
||||
name: project.pathWithNamespace,
|
||||
id: project.id.toString()
|
||||
}));
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to fetch GitLab projects: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
});
|
||||
}
|
||||
|
||||
if (error instanceof InternalServerError) {
|
||||
throw error;
|
||||
}
|
||||
|
||||
throw new InternalServerError({
|
||||
message: "Unable to fetch GitLab projects"
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const listGitLabGroups = async ({
|
||||
appConnection,
|
||||
appConnectionDAL,
|
||||
kmsService
|
||||
}: {
|
||||
appConnection: TGitLabConnection;
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
}): Promise<TGitLabGroup[]> => {
|
||||
let { accessToken } = appConnection.credentials;
|
||||
|
||||
if (
|
||||
appConnection.method === GitLabConnectionMethod.AccessToken &&
|
||||
appConnection.credentials.accessTokenType === GitLabAccessTokenType.Project
|
||||
) {
|
||||
return [];
|
||||
}
|
||||
|
||||
if (
|
||||
appConnection.method === GitLabConnectionMethod.OAuth &&
|
||||
appConnection.credentials.refreshToken &&
|
||||
new Date(appConnection.credentials.expiresAt) < new Date()
|
||||
) {
|
||||
accessToken = await refreshGitLabToken(
|
||||
appConnection.credentials.refreshToken,
|
||||
appConnection.id,
|
||||
appConnection.orgId,
|
||||
appConnectionDAL,
|
||||
kmsService,
|
||||
appConnection.credentials.instanceUrl
|
||||
);
|
||||
}
|
||||
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
appConnection.credentials.instanceUrl,
|
||||
appConnection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
|
||||
const groups = await client.Groups.all({
|
||||
orderBy: "name",
|
||||
sort: "asc",
|
||||
minAccessLevel: 50
|
||||
});
|
||||
|
||||
return groups.map((group) => ({
|
||||
id: group.id.toString(),
|
||||
name: group.name
|
||||
}));
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new BadRequestError({
|
||||
message: `Failed to fetch GitLab groups: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
});
|
||||
}
|
||||
|
||||
if (error instanceof InternalServerError) {
|
||||
throw error;
|
||||
}
|
||||
|
||||
throw new InternalServerError({
|
||||
message: "Unable to fetch GitLab groups"
|
||||
});
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,138 @@
|
||||
import z from "zod";
|
||||
|
||||
import { AppConnections } from "@app/lib/api-docs";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import {
|
||||
BaseAppConnectionSchema,
|
||||
GenericCreateAppConnectionFieldsSchema,
|
||||
GenericUpdateAppConnectionFieldsSchema
|
||||
} from "@app/services/app-connection/app-connection-schemas";
|
||||
|
||||
import { GitLabAccessTokenType, GitLabConnectionMethod } from "./gitlab-connection-enums";
|
||||
|
||||
export const GitLabConnectionAccessTokenCredentialsSchema = z.object({
|
||||
accessToken: z
|
||||
.string()
|
||||
.trim()
|
||||
.min(1, "Access Token required")
|
||||
.describe(AppConnections.CREDENTIALS.GITLAB.accessToken),
|
||||
instanceUrl: z
|
||||
.string()
|
||||
.trim()
|
||||
.url("Invalid Instance URL")
|
||||
.optional()
|
||||
.describe(AppConnections.CREDENTIALS.GITLAB.instanceUrl),
|
||||
accessTokenType: z.nativeEnum(GitLabAccessTokenType).describe(AppConnections.CREDENTIALS.GITLAB.accessTokenType)
|
||||
});
|
||||
|
||||
export const GitLabConnectionOAuthCredentialsSchema = z.object({
|
||||
code: z.string().trim().min(1, "OAuth code required").describe(AppConnections.CREDENTIALS.GITLAB.code),
|
||||
instanceUrl: z
|
||||
.string()
|
||||
.trim()
|
||||
.url("Invalid Instance URL")
|
||||
.optional()
|
||||
.describe(AppConnections.CREDENTIALS.GITLAB.instanceUrl)
|
||||
});
|
||||
|
||||
export const GitLabConnectionOAuthOutputCredentialsSchema = z.object({
|
||||
accessToken: z.string().trim(),
|
||||
refreshToken: z.string().trim(),
|
||||
expiresAt: z.date(),
|
||||
tokenType: z.string().optional().default("bearer"),
|
||||
createdAt: z.string().optional(),
|
||||
instanceUrl: z
|
||||
.string()
|
||||
.trim()
|
||||
.url("Invalid Instance URL")
|
||||
.optional()
|
||||
.describe(AppConnections.CREDENTIALS.GITLAB.instanceUrl)
|
||||
});
|
||||
|
||||
export const GitLabConnectionRefreshTokenCredentialsSchema = z.object({
|
||||
refreshToken: z.string().trim().min(1, "Refresh token required"),
|
||||
instanceUrl: z
|
||||
.string()
|
||||
.trim()
|
||||
.url("Invalid Instance URL")
|
||||
.optional()
|
||||
.describe(AppConnections.CREDENTIALS.GITLAB.instanceUrl)
|
||||
});
|
||||
|
||||
const BaseGitLabConnectionSchema = BaseAppConnectionSchema.extend({
|
||||
app: z.literal(AppConnection.GitLab)
|
||||
});
|
||||
|
||||
export const GitLabConnectionSchema = z.intersection(
|
||||
BaseGitLabConnectionSchema,
|
||||
z.discriminatedUnion("method", [
|
||||
z.object({
|
||||
method: z.literal(GitLabConnectionMethod.AccessToken),
|
||||
credentials: GitLabConnectionAccessTokenCredentialsSchema
|
||||
}),
|
||||
z.object({
|
||||
method: z.literal(GitLabConnectionMethod.OAuth),
|
||||
credentials: GitLabConnectionOAuthOutputCredentialsSchema
|
||||
})
|
||||
])
|
||||
);
|
||||
|
||||
export const SanitizedGitLabConnectionSchema = z.discriminatedUnion("method", [
|
||||
BaseGitLabConnectionSchema.extend({
|
||||
method: z.literal(GitLabConnectionMethod.AccessToken),
|
||||
credentials: GitLabConnectionAccessTokenCredentialsSchema.pick({
|
||||
instanceUrl: true,
|
||||
accessTokenType: true
|
||||
})
|
||||
}),
|
||||
BaseGitLabConnectionSchema.extend({
|
||||
method: z.literal(GitLabConnectionMethod.OAuth),
|
||||
credentials: GitLabConnectionOAuthOutputCredentialsSchema.pick({
|
||||
instanceUrl: true
|
||||
})
|
||||
})
|
||||
]);
|
||||
|
||||
export const ValidateGitLabConnectionCredentialsSchema = z.discriminatedUnion("method", [
|
||||
z.object({
|
||||
method: z.literal(GitLabConnectionMethod.AccessToken).describe(AppConnections.CREATE(AppConnection.GitLab).method),
|
||||
credentials: GitLabConnectionAccessTokenCredentialsSchema.describe(
|
||||
AppConnections.CREATE(AppConnection.GitLab).credentials
|
||||
)
|
||||
}),
|
||||
z.object({
|
||||
method: z.literal(GitLabConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.GitLab).method),
|
||||
credentials: z
|
||||
.union([
|
||||
GitLabConnectionOAuthCredentialsSchema,
|
||||
GitLabConnectionRefreshTokenCredentialsSchema,
|
||||
GitLabConnectionOAuthOutputCredentialsSchema
|
||||
])
|
||||
.describe(AppConnections.CREATE(AppConnection.GitLab).credentials)
|
||||
})
|
||||
]);
|
||||
|
||||
export const CreateGitLabConnectionSchema = ValidateGitLabConnectionCredentialsSchema.and(
|
||||
GenericCreateAppConnectionFieldsSchema(AppConnection.GitLab)
|
||||
);
|
||||
|
||||
export const UpdateGitLabConnectionSchema = z
|
||||
.object({
|
||||
credentials: z
|
||||
.union([
|
||||
GitLabConnectionAccessTokenCredentialsSchema,
|
||||
GitLabConnectionOAuthOutputCredentialsSchema,
|
||||
GitLabConnectionRefreshTokenCredentialsSchema,
|
||||
GitLabConnectionOAuthCredentialsSchema
|
||||
])
|
||||
.optional()
|
||||
.describe(AppConnections.UPDATE(AppConnection.GitLab).credentials)
|
||||
})
|
||||
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.GitLab));
|
||||
|
||||
export const GitLabConnectionListItemSchema = z.object({
|
||||
name: z.literal("GitLab"),
|
||||
app: z.literal(AppConnection.GitLab),
|
||||
methods: z.nativeEnum(GitLabConnectionMethod).array(),
|
||||
oauthClientId: z.string().optional()
|
||||
});
|
||||
@@ -0,0 +1,47 @@
|
||||
import { logger } from "@app/lib/logger";
|
||||
import { OrgServiceActor } from "@app/lib/types";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
|
||||
import { TAppConnectionDALFactory } from "../app-connection-dal";
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import { listGitLabGroups, listGitLabProjects } from "./gitlab-connection-fns";
|
||||
import { TGitLabConnection } from "./gitlab-connection-types";
|
||||
|
||||
type TGetAppConnectionFunc = (
|
||||
app: AppConnection,
|
||||
connectionId: string,
|
||||
actor: OrgServiceActor
|
||||
) => Promise<TGitLabConnection>;
|
||||
|
||||
export const gitlabConnectionService = (
|
||||
getAppConnection: TGetAppConnectionFunc,
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
|
||||
) => {
|
||||
const listProjects = async (connectionId: string, actor: OrgServiceActor) => {
|
||||
try {
|
||||
const appConnection = await getAppConnection(AppConnection.GitLab, connectionId, actor);
|
||||
const projects = await listGitLabProjects({ appConnection, appConnectionDAL, kmsService });
|
||||
return projects;
|
||||
} catch (error) {
|
||||
logger.error(error, `Failed to establish connection with GitLab for app ${connectionId}`);
|
||||
return [];
|
||||
}
|
||||
};
|
||||
|
||||
const listGroups = async (connectionId: string, actor: OrgServiceActor) => {
|
||||
try {
|
||||
const appConnection = await getAppConnection(AppConnection.GitLab, connectionId, actor);
|
||||
const groups = await listGitLabGroups({ appConnection, appConnectionDAL, kmsService });
|
||||
return groups;
|
||||
} catch (error) {
|
||||
logger.error(error, `Failed to establish connection with GitLab for app ${connectionId}`);
|
||||
return [];
|
||||
}
|
||||
};
|
||||
|
||||
return {
|
||||
listProjects,
|
||||
listGroups
|
||||
};
|
||||
};
|
||||
@@ -0,0 +1,56 @@
|
||||
import z from "zod";
|
||||
|
||||
import { DiscriminativePick } from "@app/lib/types";
|
||||
|
||||
import { AppConnection } from "../app-connection-enums";
|
||||
import {
|
||||
CreateGitLabConnectionSchema,
|
||||
GitLabConnectionSchema,
|
||||
ValidateGitLabConnectionCredentialsSchema
|
||||
} from "./gitlab-connection-schemas";
|
||||
|
||||
export type TGitLabConnection = z.infer<typeof GitLabConnectionSchema>;
|
||||
|
||||
export type TGitLabConnectionInput = z.infer<typeof CreateGitLabConnectionSchema> & {
|
||||
app: AppConnection.GitLab;
|
||||
};
|
||||
|
||||
export type TValidateGitLabConnectionCredentialsSchema = typeof ValidateGitLabConnectionCredentialsSchema;
|
||||
|
||||
export type TGitLabConnectionConfig = DiscriminativePick<TGitLabConnectionInput, "method" | "app" | "credentials"> & {
|
||||
orgId: string;
|
||||
};
|
||||
|
||||
export type TGitLabProject = {
|
||||
name: string;
|
||||
id: string;
|
||||
};
|
||||
|
||||
export type TGitLabAccessTokenCredentials = {
|
||||
accessToken: string;
|
||||
instanceUrl: string;
|
||||
};
|
||||
|
||||
export type TGitLabOAuthCredentials = {
|
||||
accessToken: string;
|
||||
refreshToken: string;
|
||||
expiresAt: Date;
|
||||
tokenType?: string;
|
||||
createdAt?: Date;
|
||||
instanceUrl: string;
|
||||
};
|
||||
|
||||
export type TGitLabOAuthCodeCredentials = {
|
||||
code: string;
|
||||
instanceUrl: string;
|
||||
};
|
||||
|
||||
export type TGitLabRefreshTokenCredentials = {
|
||||
refreshToken: string;
|
||||
instanceUrl: string;
|
||||
};
|
||||
|
||||
export interface TGitLabGroup {
|
||||
id: string;
|
||||
name: string;
|
||||
}
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./gitlab-connection-enums";
|
||||
export * from "./gitlab-connection-fns";
|
||||
export * from "./gitlab-connection-schemas";
|
||||
export * from "./gitlab-connection-types";
|
||||
@@ -0,0 +1,10 @@
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
export const GITLAB_SYNC_LIST_OPTION: TSecretSyncListItem = {
|
||||
name: "GitLab",
|
||||
destination: SecretSync.GitLab,
|
||||
connection: AppConnection.GitLab,
|
||||
canImportSecrets: false
|
||||
};
|
||||
@@ -0,0 +1,4 @@
|
||||
export enum GitLabSyncScope {
|
||||
Project = "project",
|
||||
Group = "group"
|
||||
}
|
||||
@@ -0,0 +1,452 @@
|
||||
/* eslint-disable no-await-in-loop */
|
||||
import { GitbeakerRequestError } from "@gitbeaker/rest";
|
||||
|
||||
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
|
||||
import {
|
||||
getGitLabClient,
|
||||
GitLabConnectionMethod,
|
||||
refreshGitLabToken,
|
||||
TGitLabConnection
|
||||
} from "@app/services/app-connection/gitlab";
|
||||
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
|
||||
import { TGitLabSyncWithCredentials, TGitLabVariable } from "@app/services/secret-sync/gitlab/gitlab-sync-types";
|
||||
import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
|
||||
import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
|
||||
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { SECRET_SYNC_NAME_MAP } from "../secret-sync-maps";
|
||||
import { GitLabSyncScope } from "./gitlab-sync-enums";
|
||||
|
||||
interface TGitLabVariablePayload {
|
||||
key?: string;
|
||||
value: string;
|
||||
variable_type?: "env_var" | "file";
|
||||
environment_scope?: string;
|
||||
protected?: boolean;
|
||||
masked?: boolean;
|
||||
masked_and_hidden?: boolean;
|
||||
description?: string;
|
||||
}
|
||||
|
||||
interface TGitLabVariableCreate extends TGitLabVariablePayload {
|
||||
key: string;
|
||||
}
|
||||
|
||||
interface TGitLabVariableUpdate extends Omit<TGitLabVariablePayload, "key"> {}
|
||||
|
||||
type TGitLabSyncFactoryDeps = {
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">;
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
|
||||
};
|
||||
|
||||
const getValidAccessToken = async (
|
||||
connection: TGitLabConnection,
|
||||
appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
|
||||
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
|
||||
): Promise<string> => {
|
||||
if (
|
||||
connection.method === GitLabConnectionMethod.OAuth &&
|
||||
connection.credentials.refreshToken &&
|
||||
new Date(connection.credentials.expiresAt) < new Date()
|
||||
) {
|
||||
const accessToken = await refreshGitLabToken(
|
||||
connection.credentials.refreshToken,
|
||||
connection.id,
|
||||
connection.orgId,
|
||||
appConnectionDAL,
|
||||
kmsService,
|
||||
connection.credentials.instanceUrl
|
||||
);
|
||||
return accessToken;
|
||||
}
|
||||
return connection.credentials.accessToken;
|
||||
};
|
||||
|
||||
const getGitLabVariables = async ({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
targetEnvironment
|
||||
}: {
|
||||
accessToken: string;
|
||||
connection: TGitLabConnection;
|
||||
scope: GitLabSyncScope;
|
||||
resourceId: string;
|
||||
targetEnvironment?: string;
|
||||
}): Promise<TGitLabVariable[]> => {
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
connection.credentials.instanceUrl,
|
||||
connection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
|
||||
let variables: TGitLabVariable[] = [];
|
||||
|
||||
if (scope === GitLabSyncScope.Project) {
|
||||
variables = await client.ProjectVariables.all(resourceId);
|
||||
} else {
|
||||
variables = await client.GroupVariables.all(resourceId);
|
||||
}
|
||||
|
||||
if (targetEnvironment) {
|
||||
variables = variables.filter((v) => v.environmentScope === targetEnvironment);
|
||||
}
|
||||
|
||||
return variables;
|
||||
} catch (error) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new SecretSyncError({
|
||||
error: new Error(
|
||||
`Failed to fetch variables: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
)
|
||||
});
|
||||
}
|
||||
throw new SecretSyncError({
|
||||
error
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const createGitLabVariable = async ({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
variable
|
||||
}: {
|
||||
accessToken: string;
|
||||
connection: TGitLabConnection;
|
||||
scope: GitLabSyncScope;
|
||||
resourceId: string;
|
||||
variable: TGitLabVariableCreate;
|
||||
}): Promise<void> => {
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
connection.credentials.instanceUrl,
|
||||
connection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
|
||||
const payload = {
|
||||
key: variable.key,
|
||||
value: variable.value,
|
||||
variableType: "env_var",
|
||||
environmentScope: variable.environment_scope || "*",
|
||||
protected: variable.protected || false,
|
||||
masked: variable.masked || false,
|
||||
masked_and_hidden: variable.masked_and_hidden || false,
|
||||
raw: false
|
||||
};
|
||||
|
||||
if (scope === GitLabSyncScope.Project) {
|
||||
await client.ProjectVariables.create(resourceId, payload.key, payload.value, {
|
||||
variableType: "env_var",
|
||||
environmentScope: payload.environmentScope,
|
||||
protected: payload.protected,
|
||||
masked: payload.masked,
|
||||
masked_and_hidden: payload.masked_and_hidden,
|
||||
raw: false
|
||||
});
|
||||
} else {
|
||||
await client.GroupVariables.create(resourceId, payload.key, payload.value, {
|
||||
variableType: "env_var",
|
||||
environmentScope: payload.environmentScope,
|
||||
protected: payload.protected,
|
||||
masked: payload.masked,
|
||||
...(payload.masked_and_hidden && { masked_and_hidden: payload.masked_and_hidden }),
|
||||
raw: false
|
||||
});
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new SecretSyncError({
|
||||
error: new Error(
|
||||
`Failed to create variable: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
),
|
||||
secretKey: variable.key
|
||||
});
|
||||
}
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: variable.key
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const updateGitLabVariable = async ({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
key,
|
||||
variable,
|
||||
targetEnvironment
|
||||
}: {
|
||||
accessToken: string;
|
||||
connection: TGitLabConnection;
|
||||
scope: GitLabSyncScope;
|
||||
resourceId: string;
|
||||
key: string;
|
||||
variable: TGitLabVariableUpdate;
|
||||
targetEnvironment?: string;
|
||||
}): Promise<void> => {
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
connection.credentials.instanceUrl,
|
||||
connection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
|
||||
const options = {
|
||||
...(variable.environment_scope && { environmentScope: variable.environment_scope }),
|
||||
...(variable.protected !== undefined && { protected: variable.protected }),
|
||||
...(variable.masked !== undefined && { masked: variable.masked })
|
||||
};
|
||||
|
||||
if (targetEnvironment) {
|
||||
options.environmentScope = targetEnvironment;
|
||||
}
|
||||
|
||||
if (scope === GitLabSyncScope.Project) {
|
||||
await client.ProjectVariables.edit(resourceId, key, variable.value, {
|
||||
...options,
|
||||
filter: { environment_scope: targetEnvironment || "*" }
|
||||
});
|
||||
} else {
|
||||
await client.GroupVariables.edit(resourceId, key, variable.value, {
|
||||
...options,
|
||||
filter: { environment_scope: targetEnvironment || "*" }
|
||||
});
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new SecretSyncError({
|
||||
error: new Error(
|
||||
`Failed to update variable: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
),
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
const deleteGitLabVariable = async ({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
key,
|
||||
targetEnvironment,
|
||||
allVariables
|
||||
}: {
|
||||
accessToken: string;
|
||||
connection: TGitLabConnection;
|
||||
scope: GitLabSyncScope;
|
||||
resourceId: string;
|
||||
key: string;
|
||||
targetEnvironment?: string;
|
||||
allVariables?: TGitLabVariable[];
|
||||
}): Promise<void> => {
|
||||
if (allVariables && !allVariables.find((v) => v.key === key)) {
|
||||
return;
|
||||
}
|
||||
try {
|
||||
const client = await getGitLabClient(
|
||||
accessToken,
|
||||
connection.credentials.instanceUrl,
|
||||
connection.method === GitLabConnectionMethod.OAuth
|
||||
);
|
||||
|
||||
const options: { filter?: { environment_scope: string } } = {};
|
||||
if (targetEnvironment) {
|
||||
options.filter = { environment_scope: targetEnvironment || "*" };
|
||||
}
|
||||
|
||||
if (scope === GitLabSyncScope.Project) {
|
||||
await client.ProjectVariables.remove(resourceId, key, options);
|
||||
} else {
|
||||
await client.GroupVariables.remove(resourceId, key);
|
||||
}
|
||||
} catch (error: unknown) {
|
||||
if (error instanceof GitbeakerRequestError) {
|
||||
throw new SecretSyncError({
|
||||
error: new Error(
|
||||
`Failed to delete variable: ${error.message ?? "Unknown error"}${error.cause?.description && error.message !== "Unauthorized" ? `. Cause: ${error.cause.description}` : ""}`
|
||||
),
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
};
|
||||
|
||||
export const GitLabSyncFns = {
|
||||
syncSecrets: async (
|
||||
secretSync: TGitLabSyncWithCredentials,
|
||||
secretMap: TSecretMap,
|
||||
{ appConnectionDAL, kmsService }: TGitLabSyncFactoryDeps
|
||||
): Promise<void> => {
|
||||
const { connection, environment, destinationConfig } = secretSync;
|
||||
const { scope, targetEnvironment } = destinationConfig;
|
||||
|
||||
const resourceId = scope === GitLabSyncScope.Project ? destinationConfig.projectId : destinationConfig.groupId;
|
||||
|
||||
const accessToken = await getValidAccessToken(connection, appConnectionDAL, kmsService);
|
||||
|
||||
try {
|
||||
const currentVariables = await getGitLabVariables({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
targetEnvironment
|
||||
});
|
||||
|
||||
const currentVariableMap = new Map(currentVariables.map((v) => [v.key, v]));
|
||||
|
||||
for (const [key, { value }] of Object.entries(secretMap)) {
|
||||
if (value?.length < 8 && destinationConfig.shouldMaskSecrets) {
|
||||
throw new SecretSyncError({
|
||||
message: `Secret ${key} is too short to be masked. GitLab requires a minimum of 8 characters for masked secrets.`,
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
try {
|
||||
const existingVariable = currentVariableMap.get(key);
|
||||
|
||||
if (existingVariable) {
|
||||
if (
|
||||
existingVariable.value !== value ||
|
||||
existingVariable.environmentScope !== targetEnvironment ||
|
||||
existingVariable.protected !== destinationConfig.shouldProtectSecrets ||
|
||||
existingVariable.masked !== destinationConfig.shouldMaskSecrets
|
||||
) {
|
||||
await updateGitLabVariable({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
key,
|
||||
variable: {
|
||||
value,
|
||||
environment_scope: targetEnvironment,
|
||||
protected: destinationConfig.shouldProtectSecrets,
|
||||
masked: destinationConfig.shouldMaskSecrets || existingVariable.hidden
|
||||
},
|
||||
targetEnvironment
|
||||
});
|
||||
}
|
||||
} else {
|
||||
await createGitLabVariable({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
variable: {
|
||||
key,
|
||||
value,
|
||||
variable_type: "env_var",
|
||||
environment_scope: targetEnvironment || "*",
|
||||
protected: destinationConfig.shouldProtectSecrets || false,
|
||||
masked: destinationConfig.shouldMaskSecrets || false,
|
||||
masked_and_hidden: destinationConfig.shouldHideSecrets || false
|
||||
}
|
||||
});
|
||||
}
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
if (!secretSync.syncOptions.disableSecretDeletion) {
|
||||
for (const variable of currentVariables) {
|
||||
try {
|
||||
const shouldDelete =
|
||||
matchesSchema(variable.key, environment?.slug || "", secretSync.syncOptions.keySchema) &&
|
||||
!(variable.key in secretMap);
|
||||
|
||||
if (shouldDelete) {
|
||||
await deleteGitLabVariable({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
key: variable.key,
|
||||
targetEnvironment
|
||||
});
|
||||
}
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: variable.key
|
||||
});
|
||||
}
|
||||
}
|
||||
}
|
||||
} catch (error) {
|
||||
if (error instanceof SecretSyncError) {
|
||||
throw error;
|
||||
}
|
||||
throw new SecretSyncError({
|
||||
message: "Failed to sync secrets",
|
||||
error
|
||||
});
|
||||
}
|
||||
},
|
||||
|
||||
removeSecrets: async (
|
||||
secretSync: TGitLabSyncWithCredentials,
|
||||
secretMap: TSecretMap,
|
||||
{ appConnectionDAL, kmsService }: TGitLabSyncFactoryDeps
|
||||
): Promise<void> => {
|
||||
const { connection, destinationConfig } = secretSync;
|
||||
const { scope, targetEnvironment } = destinationConfig;
|
||||
|
||||
const resourceId = scope === GitLabSyncScope.Project ? destinationConfig.projectId : destinationConfig.groupId;
|
||||
|
||||
const accessToken = await getValidAccessToken(connection, appConnectionDAL, kmsService);
|
||||
|
||||
const allVariables = await getGitLabVariables({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
targetEnvironment
|
||||
});
|
||||
|
||||
for (const key of Object.keys(secretMap)) {
|
||||
try {
|
||||
await deleteGitLabVariable({
|
||||
accessToken,
|
||||
connection,
|
||||
scope,
|
||||
resourceId,
|
||||
key,
|
||||
targetEnvironment,
|
||||
allVariables
|
||||
});
|
||||
} catch (error) {
|
||||
throw new SecretSyncError({
|
||||
error,
|
||||
secretKey: key
|
||||
});
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
getSecrets: async (secretSync: TGitLabSyncWithCredentials): Promise<TSecretMap> => {
|
||||
throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
|
||||
}
|
||||
};
|
||||
@@ -0,0 +1,97 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { SecretSyncs } from "@app/lib/api-docs";
|
||||
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
|
||||
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
|
||||
import {
|
||||
BaseSecretSyncSchema,
|
||||
GenericCreateSecretSyncFieldsSchema,
|
||||
GenericUpdateSecretSyncFieldsSchema
|
||||
} from "@app/services/secret-sync/secret-sync-schemas";
|
||||
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
|
||||
|
||||
import { GitLabSyncScope } from "./gitlab-sync-enums";
|
||||
|
||||
const GitLabSyncDestinationConfigSchema = z.discriminatedUnion("scope", [
|
||||
z.object({
|
||||
scope: z.literal(GitLabSyncScope.Project).describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.scope),
|
||||
projectId: z.string().min(1, "Project ID is required").describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.projectId),
|
||||
projectName: z
|
||||
.string()
|
||||
.min(1, "Project name is required")
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.projectName),
|
||||
targetEnvironment: z
|
||||
.string()
|
||||
.optional()
|
||||
.default("*")
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.targetEnvironment),
|
||||
shouldProtectSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldProtectSecrets),
|
||||
shouldMaskSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldMaskSecrets),
|
||||
shouldHideSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldHideSecrets)
|
||||
}),
|
||||
z.object({
|
||||
scope: z.literal(GitLabSyncScope.Group).describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.scope),
|
||||
groupId: z.string().min(1, "Group ID is required").describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.groupId),
|
||||
groupName: z.string().min(1, "Group name is required").describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.groupName),
|
||||
targetEnvironment: z
|
||||
.string()
|
||||
.optional()
|
||||
.default("*")
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.targetEnvironment),
|
||||
shouldProtectSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldProtectSecrets),
|
||||
shouldMaskSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldMaskSecrets),
|
||||
shouldHideSecrets: z
|
||||
.boolean()
|
||||
.optional()
|
||||
.default(false)
|
||||
.describe(SecretSyncs.DESTINATION_CONFIG.GITLAB.shouldHideSecrets)
|
||||
})
|
||||
]);
|
||||
|
||||
const GitLabSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
|
||||
|
||||
export const GitLabSyncSchema = BaseSecretSyncSchema(SecretSync.GitLab, GitLabSyncOptionsConfig).extend({
|
||||
destination: z.literal(SecretSync.GitLab),
|
||||
destinationConfig: GitLabSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const CreateGitLabSyncSchema = GenericCreateSecretSyncFieldsSchema(
|
||||
SecretSync.GitLab,
|
||||
GitLabSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: GitLabSyncDestinationConfigSchema
|
||||
});
|
||||
|
||||
export const UpdateGitLabSyncSchema = GenericUpdateSecretSyncFieldsSchema(
|
||||
SecretSync.GitLab,
|
||||
GitLabSyncOptionsConfig
|
||||
).extend({
|
||||
destinationConfig: GitLabSyncDestinationConfigSchema.optional()
|
||||
});
|
||||
|
||||
export const GitLabSyncListItemSchema = z.object({
|
||||
name: z.literal("GitLab"),
|
||||
connection: z.literal(AppConnection.GitLab),
|
||||
destination: z.literal(SecretSync.GitLab),
|
||||
canImportSecrets: z.literal(false)
|
||||
});
|
||||
@@ -0,0 +1,58 @@
|
||||
import { z } from "zod";
|
||||
|
||||
import { TGitLabConnection } from "@app/services/app-connection/gitlab";
|
||||
|
||||
import { CreateGitLabSyncSchema, GitLabSyncListItemSchema, GitLabSyncSchema } from "./gitlab-sync-schemas";
|
||||
|
||||
export type TGitLabSync = z.infer<typeof GitLabSyncSchema>;
|
||||
export type TGitLabSyncInput = z.infer<typeof CreateGitLabSyncSchema>;
|
||||
export type TGitLabSyncListItem = z.infer<typeof GitLabSyncListItemSchema>;
|
||||
|
||||
export type TGitLabSyncWithCredentials = TGitLabSync & {
|
||||
connection: TGitLabConnection;
|
||||
};
|
||||
|
||||
export type TGitLabVariable = {
|
||||
key: string;
|
||||
value: string;
|
||||
protected: boolean;
|
||||
masked: boolean;
|
||||
environmentScope?: string;
|
||||
hidden?: boolean;
|
||||
};
|
||||
|
||||
export type TGitLabVariableCreate = {
|
||||
key: string;
|
||||
value: string;
|
||||
variable_type?: "env_var" | "file";
|
||||
protected?: boolean;
|
||||
masked?: boolean;
|
||||
raw?: boolean;
|
||||
environment_scope?: string;
|
||||
description?: string;
|
||||
};
|
||||
|
||||
export type TGitLabVariableUpdate = {
|
||||
value: string;
|
||||
variable_type?: "env_var" | "file";
|
||||
protected?: boolean;
|
||||
masked?: boolean;
|
||||
raw?: boolean;
|
||||
environment_scope?: string;
|
||||
description?: string | null;
|
||||
};
|
||||
|
||||
export type TGitLabListVariables = {
|
||||
accessToken: string;
|
||||
projectId: string;
|
||||
environmentScope?: string;
|
||||
};
|
||||
|
||||
export type TGitLabCreateVariable = TGitLabListVariables & {
|
||||
variable: TGitLabVariableCreate;
|
||||
};
|
||||
|
||||
export type TGitLabUpdateVariable = TGitLabListVariables & {
|
||||
key: string;
|
||||
variable: TGitLabVariableUpdate;
|
||||
};
|
||||
@@ -0,0 +1,4 @@
|
||||
export * from "./gitlab-sync-constants";
|
||||
export * from "./gitlab-sync-fns";
|
||||
export * from "./gitlab-sync-schemas";
|
||||
export * from "./gitlab-sync-types";
|
||||
@@ -19,6 +19,7 @@ export enum SecretSync {
|
||||
Heroku = "heroku",
|
||||
Render = "render",
|
||||
Flyio = "flyio",
|
||||
GitLab = "gitlab",
|
||||
CloudflarePages = "cloudflare-pages"
|
||||
}
|
||||
|
||||
|
||||
@@ -34,6 +34,7 @@ import { CloudflarePagesSyncFns } from "./cloudflare-pages/cloudflare-pages-fns"
|
||||
import { FLYIO_SYNC_LIST_OPTION, FlyioSyncFns } from "./flyio";
|
||||
import { GCP_SYNC_LIST_OPTION } from "./gcp";
|
||||
import { GcpSyncFns } from "./gcp/gcp-sync-fns";
|
||||
import { GITLAB_SYNC_LIST_OPTION, GitLabSyncFns } from "./gitlab";
|
||||
import { HC_VAULT_SYNC_LIST_OPTION, HCVaultSyncFns } from "./hc-vault";
|
||||
import { HEROKU_SYNC_LIST_OPTION, HerokuSyncFns } from "./heroku";
|
||||
import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
|
||||
@@ -66,6 +67,7 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
|
||||
[SecretSync.Heroku]: HEROKU_SYNC_LIST_OPTION,
|
||||
[SecretSync.Render]: RENDER_SYNC_LIST_OPTION,
|
||||
[SecretSync.Flyio]: FLYIO_SYNC_LIST_OPTION,
|
||||
[SecretSync.GitLab]: GITLAB_SYNC_LIST_OPTION,
|
||||
[SecretSync.CloudflarePages]: CLOUDFLARE_PAGES_SYNC_LIST_OPTION
|
||||
};
|
||||
|
||||
@@ -230,6 +232,8 @@ export const SecretSyncFns = {
|
||||
return RenderSyncFns.syncSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.Flyio:
|
||||
return FlyioSyncFns.syncSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.GitLab:
|
||||
return GitLabSyncFns.syncSecrets(secretSync, schemaSecretMap, { appConnectionDAL, kmsService });
|
||||
case SecretSync.CloudflarePages:
|
||||
return CloudflarePagesSyncFns.syncSecrets(secretSync, schemaSecretMap);
|
||||
default:
|
||||
@@ -318,6 +322,9 @@ export const SecretSyncFns = {
|
||||
case SecretSync.Flyio:
|
||||
secretMap = await FlyioSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
case SecretSync.GitLab:
|
||||
secretMap = await GitLabSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
case SecretSync.CloudflarePages:
|
||||
secretMap = await CloudflarePagesSyncFns.getSecrets(secretSync);
|
||||
break;
|
||||
@@ -394,6 +401,8 @@ export const SecretSyncFns = {
|
||||
return RenderSyncFns.removeSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.Flyio:
|
||||
return FlyioSyncFns.removeSecrets(secretSync, schemaSecretMap);
|
||||
case SecretSync.GitLab:
|
||||
return GitLabSyncFns.removeSecrets(secretSync, schemaSecretMap, { appConnectionDAL, kmsService });
|
||||
case SecretSync.CloudflarePages:
|
||||
return CloudflarePagesSyncFns.removeSecrets(secretSync, schemaSecretMap);
|
||||
default:
|
||||
|
||||
@@ -22,6 +22,7 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
|
||||
[SecretSync.Heroku]: "Heroku",
|
||||
[SecretSync.Render]: "Render",
|
||||
[SecretSync.Flyio]: "Fly.io",
|
||||
[SecretSync.GitLab]: "GitLab",
|
||||
[SecretSync.CloudflarePages]: "Cloudflare Pages"
|
||||
};
|
||||
|
||||
@@ -46,6 +47,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
|
||||
[SecretSync.Heroku]: AppConnection.Heroku,
|
||||
[SecretSync.Render]: AppConnection.Render,
|
||||
[SecretSync.Flyio]: AppConnection.Flyio,
|
||||
[SecretSync.GitLab]: AppConnection.GitLab,
|
||||
[SecretSync.CloudflarePages]: AppConnection.Cloudflare
|
||||
};
|
||||
|
||||
@@ -70,5 +72,6 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
|
||||
[SecretSync.Heroku]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.Render]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.Flyio]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.GitLab]: SecretSyncPlanType.Regular,
|
||||
[SecretSync.CloudflarePages]: SecretSyncPlanType.Regular
|
||||
};
|
||||
|
||||
@@ -72,8 +72,15 @@ import {
|
||||
TAzureKeyVaultSyncListItem,
|
||||
TAzureKeyVaultSyncWithCredentials
|
||||
} from "./azure-key-vault";
|
||||
import {
|
||||
TCloudflarePagesSync,
|
||||
TCloudflarePagesSyncInput,
|
||||
TCloudflarePagesSyncListItem,
|
||||
TCloudflarePagesSyncWithCredentials
|
||||
} from "./cloudflare-pages/cloudflare-pages-types";
|
||||
import { TFlyioSync, TFlyioSyncInput, TFlyioSyncListItem, TFlyioSyncWithCredentials } from "./flyio/flyio-sync-types";
|
||||
import { TGcpSync, TGcpSyncInput, TGcpSyncListItem, TGcpSyncWithCredentials } from "./gcp";
|
||||
import { TGitLabSync, TGitLabSyncInput, TGitLabSyncListItem, TGitLabSyncWithCredentials } from "./gitlab";
|
||||
import {
|
||||
THCVaultSync,
|
||||
THCVaultSyncInput,
|
||||
@@ -106,12 +113,6 @@ import {
|
||||
TTerraformCloudSyncWithCredentials
|
||||
} from "./terraform-cloud";
|
||||
import { TVercelSync, TVercelSyncInput, TVercelSyncListItem, TVercelSyncWithCredentials } from "./vercel";
|
||||
import {
|
||||
TCloudflarePagesSync,
|
||||
TCloudflarePagesSyncInput,
|
||||
TCloudflarePagesSyncListItem,
|
||||
TCloudflarePagesSyncWithCredentials
|
||||
} from "./cloudflare-pages/cloudflare-pages-types";
|
||||
|
||||
export type TSecretSync =
|
||||
| TAwsParameterStoreSync
|
||||
@@ -134,6 +135,7 @@ export type TSecretSync =
|
||||
| THerokuSync
|
||||
| TRenderSync
|
||||
| TFlyioSync
|
||||
| TGitLabSync
|
||||
| TCloudflarePagesSync;
|
||||
|
||||
export type TSecretSyncWithCredentials =
|
||||
@@ -157,6 +159,7 @@ export type TSecretSyncWithCredentials =
|
||||
| THerokuSyncWithCredentials
|
||||
| TRenderSyncWithCredentials
|
||||
| TFlyioSyncWithCredentials
|
||||
| TGitLabSyncWithCredentials
|
||||
| TCloudflarePagesSyncWithCredentials;
|
||||
|
||||
export type TSecretSyncInput =
|
||||
@@ -180,6 +183,7 @@ export type TSecretSyncInput =
|
||||
| THerokuSyncInput
|
||||
| TRenderSyncInput
|
||||
| TFlyioSyncInput
|
||||
| TGitLabSyncInput
|
||||
| TCloudflarePagesSyncInput;
|
||||
|
||||
export type TSecretSyncListItem =
|
||||
@@ -203,6 +207,7 @@ export type TSecretSyncListItem =
|
||||
| THerokuSyncListItem
|
||||
| TRenderSyncListItem
|
||||
| TFlyioSyncListItem
|
||||
| TGitLabSyncListItem
|
||||
| TCloudflarePagesSyncListItem;
|
||||
|
||||
export type TSyncOptionsConfig = {
|
||||
|
||||
Reference in New Issue
Block a user