From 71c55d5a53ed547395158ec07009d547f521e66d Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Tue, 15 Apr 2025 22:42:38 +0800
Subject: [PATCH] misc: addressed review comments

---
 .../dynamic-secret-lease-service.ts             | 12 ++++++------
 .../dynamic-secret/dynamic-secret-dal.ts        |  4 ++--
 .../dynamic-secret/dynamic-secret-service.ts    | 17 ++++++++++++++---
 .../SecretDashboardPage/SecretDashboardPage.tsx |  2 +-
 4 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
index ab6b8686c..88f2d90f1 100644
--- a/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
+++ b/backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts
@@ -31,7 +31,7 @@ import {
 
 type TDynamicSecretLeaseServiceFactoryDep = {
   dynamicSecretLeaseDAL: TDynamicSecretLeaseDALFactory;
-  dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findOne" | "findOneWithMetadata">;
+  dynamicSecretDAL: Pick<TDynamicSecretDALFactory, "findOne">;
   dynamicSecretProviders: Record<DynamicSecretProviders, TDynamicProviderFns>;
   dynamicSecretQueueService: TDynamicSecretLeaseQueueServiceFactory;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -92,7 +92,7 @@ export const dynamicSecretLeaseServiceFactory = ({
         message: `Folder with path '${path}' in environment with slug '${environmentSlug}' not found`
       });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({ name, folderId: folder.id });
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg)
       throw new NotFoundError({
         message: `Dynamic secret with name '${name}' in folder with path '${path}' not found`
@@ -188,7 +188,7 @@ export const dynamicSecretLeaseServiceFactory = ({
       throw new NotFoundError({ message: `Dynamic secret lease with ID '${leaseId}' not found` });
     }
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({
       id: dynamicSecretLease.dynamicSecretId,
       folderId: folder.id
     });
@@ -274,7 +274,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     if (!dynamicSecretLease || dynamicSecretLease.dynamicSecret.folderId !== folder.id)
       throw new NotFoundError({ message: `Dynamic secret lease with ID '${leaseId}' not found` });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({
       id: dynamicSecretLease.dynamicSecretId,
       folderId: folder.id
     });
@@ -349,7 +349,7 @@ export const dynamicSecretLeaseServiceFactory = ({
         message: `Folder with path '${path}' in environment with slug '${environmentSlug}' not found`
       });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({ name, folderId: folder.id });
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg)
       throw new NotFoundError({
         message: `Dynamic secret with name '${name}' in folder with path '${path}' not found`
@@ -398,7 +398,7 @@ export const dynamicSecretLeaseServiceFactory = ({
     if (!dynamicSecretLease)
       throw new NotFoundError({ message: `Dynamic secret lease with ID '${leaseId}' not found` });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({
       id: dynamicSecretLease.dynamicSecretId,
       folderId: folder.id
     });
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
index d779103ef..d7f78c3b1 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-dal.ts
@@ -20,7 +20,7 @@ export type TDynamicSecretDALFactory = ReturnType<typeof dynamicSecretDALFactory
 export const dynamicSecretDALFactory = (db: TDbClient) => {
   const orm = ormify(db, TableName.DynamicSecret);
 
-  const findOneWithMetadata = async (filter: TFindFilter<TDynamicSecrets>, tx?: Knex) => {
+  const findOne = async (filter: TFindFilter<TDynamicSecrets>, tx?: Knex) => {
     const query = (tx || db.replicaNode())(TableName.DynamicSecret)
       .leftJoin(
         TableName.ResourceMetadata,
@@ -178,5 +178,5 @@ export const dynamicSecretDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...orm, listDynamicSecretsByFolderIds, findOneWithMetadata, findWithMetadata };
+  return { ...orm, listDynamicSecretsByFolderIds, findOne, findWithMetadata };
 };
diff --git a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
index 64364627b..44c18b001 100644
--- a/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
+++ b/backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts
@@ -209,7 +209,7 @@ export const dynamicSecretServiceFactory = ({
     if (!folder)
       throw new NotFoundError({ message: `Folder with path '${path}' in environment '${environmentSlug}' not found` });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({ name, folderId: folder.id });
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg) {
       throw new NotFoundError({
         message: `Dynamic secret with name '${name}' in folder '${folder.path}' not found`
@@ -225,6 +225,17 @@ export const dynamicSecretServiceFactory = ({
       })
     );
 
+    if (metadata) {
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionDynamicSecretActions.EditRootCredential,
+        subject(ProjectPermissionSub.DynamicSecrets, {
+          environment: environmentSlug,
+          secretPath: path,
+          metadata
+        })
+      );
+    }
+
     if (newName) {
       const existingDynamicSecret = await dynamicSecretDAL.findOne({ name: newName, folderId: folder.id });
       if (existingDynamicSecret)
@@ -332,7 +343,7 @@ export const dynamicSecretServiceFactory = ({
     if (!folder)
       throw new NotFoundError({ message: `Folder with path '${path}' in environment '${environmentSlug}' not found` });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({ name, folderId: folder.id });
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg) {
       throw new NotFoundError({ message: `Dynamic secret with name '${name}' in folder '${folder.path}' not found` });
     }
@@ -398,7 +409,7 @@ export const dynamicSecretServiceFactory = ({
     if (!folder)
       throw new NotFoundError({ message: `Folder with path '${path}' in environment '${environmentSlug}' not found` });
 
-    const dynamicSecretCfg = await dynamicSecretDAL.findOneWithMetadata({ name, folderId: folder.id });
+    const dynamicSecretCfg = await dynamicSecretDAL.findOne({ name, folderId: folder.id });
     if (!dynamicSecretCfg) {
       throw new NotFoundError({ message: `Dynamic secret with name '${name} in folder '${path}' not found` });
     }
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx
index cc53a0531..17ad8fe10 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx
@@ -529,7 +529,7 @@ const Page = () => {
                   isProtectedBranch={isProtectedBranch}
                 />
               )}
-              {canReadSecret && <SecretNoAccessListView count={noAccessSecretCount} />}
+              {noAccessSecretCount > 0 && <SecretNoAccessListView count={noAccessSecretCount} />}
               {!canReadSecret &&
                 !canReadDynamicSecret &&
                 !canReadSecretImports &&