Merge pull request #4684 from Infisical/fix/adds-forceDelete-flag-to-folder-deletion

[ENG-3811] fix: adds delete protection in folder deletion with resources

backend/e2e-test/routes/v2/secret-folder.spec.ts

@@ -18,7 +18,7 @@ const createFolder = async (dto: { path: string; name: string }) => {
   return res.json().folder;
 };
 
-const deleteFolder = async (dto: { path: string; id: string }) => {
+const deleteFolder = async (dto: { path: string; id: string; forceDelete?: boolean }) => {
   const res = await testServer.inject({
     method: "DELETE",
     url: `/api/v2/folders/${dto.id}`,
@@ -28,7 +28,8 @@ const deleteFolder = async (dto: { path: string; id: string }) => {
     body: {
       projectId: seedData1.project.id,
       environment: seedData1.environment.slug,
-      path: dto.path
+      path: dto.path,
+      forceDelete: dto.forceDelete ?? false
     }
   });
   expect(res.statusCode).toBe(200);
@@ -86,7 +87,7 @@ describe("Secret Folder Router", async () => {
       folders: expect.arrayContaining(expected.folders.map((el) => expect.objectContaining(el)))
     });
 
-    await Promise.all(newFolders.map(({ id }) => deleteFolder({ path, id })));
+    await Promise.all(newFolders.map(({ id }) => deleteFolder({ path, id, forceDelete: true })));
   });
 
   test("Update a deep folder", async () => {

backend/src/lib/api-docs/constants.ts

@@ -949,7 +949,8 @@ export const FOLDERS = {
     projectId: "The ID of the project to delete the folder from.",
     environment: "The slug of the environment where the folder is located.",
     directory: "The directory of the folder to delete. (Deprecated in favor of path)",
-    path: "The path of the folder to delete."
+    path: "The path of the folder to delete.",
+    forceDelete: "Whether to force delete the folder even if it contains resources."
   }
 } as const;
 

backend/src/server/routes/index.ts

@@ -1344,7 +1344,8 @@ export const registerRoutes = async (
     projectDAL,
     folderCommitService,
     secretApprovalPolicyService,
-    secretV2BridgeDAL
+    secretV2BridgeDAL,
+    dynamicSecretDAL
   });
 
   const secretImportService = secretImportServiceFactory({

backend/src/server/routes/v1/deprecated-secret-folder-router.ts

@@ -318,7 +318,8 @@ export const registerDeprecatedSecretFolderRouter = async (server: FastifyZodPro
         ...req.body,
         projectId: req.body.workspaceId,
         idOrName: req.params.folderIdOrName,
-        path
+        path,
+        forceDelete: true
       });
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,

backend/src/server/routes/v2/secret-folder-router.ts

@@ -263,7 +263,8 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
           .default("/")
           .transform(prefixWithSlash) // Transformations get skipped if path is undefined
           .transform(removeTrailingSlash)
-          .describe(FOLDERS.DELETE.path)
+          .describe(FOLDERS.DELETE.path),
+        forceDelete: z.boolean().optional().default(false).describe(FOLDERS.DELETE.forceDelete)
       }),
       response: {
         200: z.object({
@@ -279,7 +280,8 @@ export const registerSecretFolderRouter = async (server: FastifyZodProvider) =>
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
         ...req.body,
-        idOrName: req.params.folderIdOrName
+        idOrName: req.params.folderIdOrName,
+        forceDelete: req.body.forceDelete
       });
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,

backend/src/services/secret-folder/secret-folder-service.ts

@@ -5,6 +5,7 @@ import path from "path";
 import { v4 as uuidv4, validate as uuidValidate } from "uuid";
 
 import { ActionProjectType, TProjectEnvironments, TSecretFolders, TSecretFoldersInsert } from "@app/db/schemas";
+import { TDynamicSecretDALFactory } from "@app/ee/services/dynamic-secret/dynamic-secret-dal";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
@@ -48,7 +49,11 @@ type TSecretFolderServiceFactoryDep = {
   folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
   secretApprovalPolicyService: Pick<TSecretApprovalPolicyServiceFactory, "getSecretApprovalPolicy">;
-  secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "findByFolderIds" | "invalidateSecretCacheByProjectId">;
+  secretV2BridgeDAL: Pick<
+    TSecretV2BridgeDALFactory,
+    "findByFolderIds" | "invalidateSecretCacheByProjectId" | "findOne"
+  >;
+  dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findOne">;
 };
 
 export type TSecretFolderServiceFactory = ReturnType<typeof secretFolderServiceFactory>;
@@ -62,7 +67,8 @@ export const secretFolderServiceFactory = ({
   folderCommitService,
   projectDAL,
   secretApprovalPolicyService,
-  secretV2BridgeDAL
+  secretV2BridgeDAL,
+  dynamicSecretDAL
 }: TSecretFolderServiceFactoryDep) => {
   const createFolder = async ({
     projectId,
@@ -645,7 +651,8 @@ export const secretFolderServiceFactory = ({
     actorAuthMethod,
     environment,
     path: secretPath,
-    idOrName
+    idOrName,
+    forceDelete = false
   }: TDeleteFolderDTO) => {
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -697,6 +704,22 @@ export const secretFolderServiceFactory = ({
         throw new NotFoundError({ message: `Folder with ID '${idOrName}' not found` });
       }
 
+      // Check if folder contains resources (secrets, dynamic secrets, subfolders)
+      if (!forceDelete) {
+        const error = new BadRequestError({
+          message: `Cannot delete folder "${folderToDelete.name}" because it contains resources. Use forceDelete=true to delete it forcefully.`,
+          name: "deleteFolder"
+        });
+        const secretV2 = await secretV2BridgeDAL.findOne({ folderId: folderToDelete.id }).catch(() => null);
+        if (secretV2) throw error;
+
+        const dynamicSecret = await dynamicSecretDAL.findOne({ folderId: folderToDelete.id }).catch(() => null);
+        if (dynamicSecret) throw error;
+
+        const subfolder = await folderDAL.findOne({ parentId: folderToDelete.id }).catch(() => null);
+        if (subfolder) throw error;
+      }
+
       const [doc] = await folderDAL.delete(
         {
           envId: env.id,

backend/src/services/secret-folder/secret-folder-types.ts

@@ -37,6 +37,7 @@ export type TDeleteFolderDTO = {
   environment: string;
   path: string;
   idOrName: string;
+  forceDelete?: boolean;
 } & TProjectPermission;
 
 export type TGetFolderDTO = {

frontend/src/hooks/api/secretFolders/queries.tsx

@@ -218,12 +218,13 @@ export const useDeleteFolder = () => {
   const queryClient = useQueryClient();
 
   return useMutation<object, object, TDeleteFolderDTO>({
-    mutationFn: async ({ path = "/", folderId, environment, projectId }) => {
+    mutationFn: async ({ path = "/", folderId, environment, projectId, forceDelete = true }) => {
       const { data } = await apiRequest.delete(`/api/v2/folders/${folderId}`, {
         data: {
           environment,
           projectId,
-          path
+          path,
+          forceDelete
         }
       });
       return data;

frontend/src/hooks/api/secretFolders/types.ts

@@ -59,6 +59,7 @@ export type TDeleteFolderDTO = {
   environment: string;
   folderId: string;
   path?: string;
+  forceDelete?: boolean;
 };
 
 export type TUpdateFolderBatchDTO = {