feat(server): added limit to leases creation and support for force delete when external system fails to comply

backend/src/lib/config/env.ts

@@ -18,6 +18,7 @@ const envSchema = z
     DB_CONNECTION_URI: zpStr(z.string().describe("Postgres database connection string")).default(
       `postgresql://${process.env.DB_USER}:${process.env.DB_PASSWORD}@${process.env.DB_HOST}:${process.env.DB_PORT}/${process.env.DB_NAME}`
     ),
+    MAX_LEASE_LIMIT: z.coerce.number().default(10000),
     DB_ROOT_CERT: zpStr(z.string().describe("Postgres database base64-encoded CA cert").optional()),
     DB_HOST: zpStr(z.string().describe("Postgres database host").optional()),
     DB_PORT: zpStr(z.string().describe("Postgres database port").optional()).default("5432"),

backend/src/server/routes/v1/dynamic-secret-lease-router.ts

@@ -62,7 +62,8 @@ export const registerDynamicSecretLeaseRouter = async (server: FastifyZodProvide
       body: z.object({
         projectSlug: z.string().min(1),
         path: z.string().min(1).trim().default("/").transform(removeTrailingSlash),
-        environment: z.string().min(1)
+        environment: z.string().min(1),
+        isForced: z.boolean().default(false)
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/dynamic-secret-router.ts

@@ -132,7 +132,8 @@ export const registerDynamicSecretRouter = async (server: FastifyZodProvider) =>
       body: z.object({
         projectSlug: z.string().min(1),
         path: z.string().trim().default("/").transform(removeTrailingSlash),
-        environment: z.string().min(1)
+        environment: z.string().min(1),
+        isForced: z.boolean().default(false)
       }),
       response: {
         200: z.object({

backend/src/services/dynamic-secret-lease/dynamic-secret-lease-dal.ts

@@ -10,6 +10,15 @@ export type TDynamicSecretLeaseDALFactory = ReturnType<typeof dynamicSecretLease
 export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.DynamicSecretLease);
 
+  const countLeasesForDynamicSecret = async (dynamicSecretId: string, tx?: Knex) => {
+    try {
+      const doc = await (tx || db)(TableName.DynamicSecretLease).count("*").where({ dynamicSecretId }).first();
+      return parseInt(doc || "0", 10);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "DynamicSecretCountLeases" });
+    }
+  };
+
   const findById = async (id: string, tx?: Knex) => {
     try {
       const doc = await (tx || db)(TableName.DynamicSecretLease)
@@ -67,5 +76,5 @@ export const dynamicSecretLeaseDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...orm, findById };
+  return { ...orm, findById, countLeasesForDynamicSecret };
 };

backend/src/services/dynamic-secret-lease/dynamic-secret-lease-queue.ts

@@ -112,8 +112,8 @@ export const dynamicSecretLeaseQueueServiceFactory = ({
             })
           ) as object;
 
-          await Promise.allSettled(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id)));
+          await Promise.all(dynamicSecretLeases.map(({ id }) => unsetLeaseRevocation(id)));
-          await Promise.allSettled(
+          await Promise.all(
             dynamicSecretLeases.map(({ externalEntityId }) =>
               selectedProvider.revoke(decryptedStoredInput, externalEntityId)
             )

backend/src/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -4,6 +4,7 @@ import ms from "ms";
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
 
@@ -14,6 +15,7 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TDynamicSecretLeaseDALFactory } from "./dynamic-secret-lease-dal";
 import { TDynamicSecretLeaseQueueServiceFactory } from "./dynamic-secret-lease-queue";
 import {
+  DynamicSecretLeaseStatus,
   TCreateDynamicSecretLeaseDTO,
   TDeleteDynamicSecretLeaseDTO,
   TDetailsDynamicSecretLeaseDTO,
@@ -53,6 +55,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     actorAuthMethod,
     ttl
   }: TCreateDynamicSecretLeaseDTO) => {
+    const appCfg = getConfig();
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
 
@@ -75,6 +78,10 @@ export const dynamicSecretLeaseServiceFactory = ({
     const dynamicSecretCfg = await dynamicSecretDAL.findOne({ slug, folderId: folder.id });
     if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" });
 
+    const totalLeasesTaken = await dynamicSecretLeaseDAL.countLeasesForDynamicSecret(dynamicSecretCfg.id);
+    if (totalLeasesTaken >= appCfg.MAX_LEASE_LIMIT)
+      throw new BadRequestError({ message: `Max lease limit reached. Limit: ${appCfg.MAX_LEASE_LIMIT}` });
+
     const selectedProvider = dynamicSecretProviders[dynamicSecretCfg.type as DynamicSecretProviders];
     const decryptedStoredInput = JSON.parse(
       infisicalSymmetricDecrypt({
@@ -179,7 +186,8 @@ export const dynamicSecretLeaseServiceFactory = ({
     actor,
     actorId,
     actorOrgId,
-    actorAuthMethod
+    actorAuthMethod,
+    isForced
   }: TDeleteDynamicSecretLeaseDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
@@ -214,7 +222,21 @@ export const dynamicSecretLeaseServiceFactory = ({
       })
     ) as object;
 
-    await selectedProvider.revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId);
+    const revokeResponse = await selectedProvider
+      .revoke(decryptedStoredInput, dynamicSecretLease.externalEntityId)
+      .catch(async (err) => {
+        // only propogate this error if forced is false
+        if (!isForced) return { error: err as Error };
+      });
+
+    if ((revokeResponse as { error?: Error })?.error) {
+      const { error } = revokeResponse as { error?: Error };
+      const deletedDynamicSecretLease = await dynamicSecretLeaseDAL.updateById(dynamicSecretLease.id, {
+        status: DynamicSecretLeaseStatus.FailedDeletion,
+        statusDetails: error?.message?.slice(0, 255)
+      });
+      return deletedDynamicSecretLease;
+    }
 
     await dynamicSecretQueueService.unsetLeaseRevocation(dynamicSecretLease.id);
     const deletedDynamicSecretLease = await dynamicSecretLeaseDAL.deleteById(dynamicSecretLease.id);

backend/src/services/dynamic-secret-lease/dynamic-secret-lease-types.ts

@@ -31,6 +31,7 @@ export type TDeleteDynamicSecretLeaseDTO = {
   path: string;
   environment: string;
   projectSlug: string;
+  isForced?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TRenewDynamicSecretLeaseDTO = {

backend/src/services/dynamic-secret/dynamic-secret-service.ts

@@ -25,7 +25,10 @@ type TDynamicSecretServiceFactoryDep = {
   dynamicSecretDAL: TDynamicSecretDALFactory;
   dynamicSecretLeaseDAL: Pick<TDynamicSecretLeaseDALFactory, "find">;
   dynamicSecretProviders: Record<DynamicSecretProviders, TDynamicProviderFns>;
-  dynamicSecretQueueService: Pick<TDynamicSecretLeaseQueueServiceFactory, "pruneDynamicSecret">;
+  dynamicSecretQueueService: Pick<
+    TDynamicSecretLeaseQueueServiceFactory,
+    "pruneDynamicSecret" | "unsetLeaseRevocation"
+  >;
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
@@ -80,6 +83,10 @@ export const dynamicSecretServiceFactory = ({
 
     const selectedProvider = dynamicSecretProviders[provider.type];
     const inputs = await selectedProvider.validateProviderInputs(provider.inputs);
+
+    const isConnected = await selectedProvider.validateConnection(provider.inputs);
+    if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
+
     const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(inputs));
     const dynamicSecretCfg = await dynamicSecretDAL.create({
       type: provider.type,
@@ -151,6 +158,10 @@ export const dynamicSecretServiceFactory = ({
     ) as object;
     const newInput = { ...decryptedStoredInput, ...(inputs || {}) };
     const updatedInput = await selectedProvider.validateProviderInputs(newInput);
+
+    const isConnected = await selectedProvider.validateConnection(newInput);
+    if (!isConnected) throw new BadRequestError({ message: "Provider connection failed" });
+
     const encryptedInput = infisicalSymmetricEncypt(JSON.stringify(updatedInput));
     const updatedDynamicCfg = await dynamicSecretDAL.updateById(dynamicSecretCfg.id, {
       inputIV: encryptedInput.iv,
@@ -176,7 +187,8 @@ export const dynamicSecretServiceFactory = ({
     projectSlug,
     slug,
     path,
-    environment
+    environment,
+    isForced
   }: TDeleteDynamicSecretDTO) => {
     const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
     if (!project) throw new BadRequestError({ message: "Project not found" });
@@ -202,6 +214,16 @@ export const dynamicSecretServiceFactory = ({
     if (!dynamicSecretCfg) throw new BadRequestError({ message: "Dynamic secret not found" });
 
     const leases = await dynamicSecretLeaseDAL.find({ dynamicSecretId: dynamicSecretCfg.id });
+    // when not forced we check with the external system to first remove the things
+    // we introduce a forced concept because consider the external lease got deleted by some other external like a human or another system
+    // this allows user to clean up it from infisical
+    if (isForced) {
+      // clear all queues for lease revocations
+      await Promise.all(leases.map(({ id: leaseId }) => dynamicSecretQueueService.unsetLeaseRevocation(leaseId)));
+
+      const deletedDynamicSecretCfg = await dynamicSecretDAL.deleteById(dynamicSecretCfg.id);
+      return deletedDynamicSecretCfg;
+    }
     // if leases exist we should flag it as deleting and then remove leases in background
     // then delete the main one
     if (leases.length) {

backend/src/services/dynamic-secret/dynamic-secret-types.ts

@@ -37,6 +37,7 @@ export type TDeleteDynamicSecretDTO = {
   path: string;
   environment: string;
   projectSlug: string;
+  isForced?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TDetailsDynamicSecretDTO = {

backend/src/services/dynamic-secret/providers/models.ts

@@ -27,6 +27,7 @@ export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [
 
 export type TDynamicProviderFns = {
   create: (inputs: unknown, expireAt: number) => Promise<{ entityId: string; data: unknown }>;
+  validateConnection: (inputs: unknown) => Promise<boolean>;
   validateProviderInputs: (inputs: object) => Promise<unknown>;
   revoke: (inputs: unknown, entityId: string) => Promise<{ entityId: string }>;
   renew: (inputs: unknown, entityId: string, expireAt: number) => Promise<{ entityId: string }>;

backend/src/services/dynamic-secret/providers/sql-database.ts

@@ -46,6 +46,17 @@ export const SqlDatabaseProvider = (): TDynamicProviderFns => {
     return db;
   };
 
+  const validateConnection = async (inputs: unknown) => {
+    const providerInputs = await validateProviderInputs(inputs);
+    const db = await getClient(providerInputs);
+    const isConnected = await db
+      .raw("SELECT NOW()")
+      .then(() => true)
+      .catch(() => false);
+    await db.destroy();
+    return isConnected;
+  };
+
   const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     const db = await getClient(providerInputs);
@@ -94,6 +105,7 @@ export const SqlDatabaseProvider = (): TDynamicProviderFns => {
 
   return {
     validateProviderInputs,
+    validateConnection,
     create,
     revoke,
     renew