awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 21:51:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add Humanitec secret sync integration

Browse Source
This commit is contained in:
carlosmonastyrski
2025-03-12 16:23:59 -03:00
parent 765be2d99d
commit 79d8a9debb
57 changed files with 1117 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/secret-sync/humanitec/humanitec-sync-constants.ts
+10
View File
@@ -0,0 +1,10 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
export const HUMANITEC_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Humanitec",
destination: SecretSync.Humanitec,
connection: AppConnection.Humanitec,
canImportSecrets: false
};
backend/src/services/secret-sync/humanitec/humanitec-sync-fns.ts
+160
View File
@@ -0,0 +1,160 @@
import { request } from "@app/lib/config/request";
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
import { HumanitecSecret, THumanitecSyncWithCredentials } from "./humanitec-sync-types";
const getHumanitecSecrets = async (secretSync: THumanitecSyncWithCredentials) => {
const {
destinationConfig,
connection: {
credentials: { accessKeyId }
}
} = secretSync;
const { data } = await request.get<HumanitecSecret[]>(
`${IntegrationUrls.HUMANITEC_API_URL}/orgs/${destinationConfig.org}/apps/${destinationConfig.app}/envs/${destinationConfig.env}/values`,
{
headers: {
Authorization: `Bearer ${accessKeyId}`,
"Accept-Encoding": "application/json"
}
}
);
return data;
};
const deleteSecret = async (secretSync: THumanitecSyncWithCredentials, encryptedSecret: HumanitecSecret) => {
const {
destinationConfig,
connection: {
credentials: { accessKeyId }
}
} = secretSync;
try {
await request.delete(
`${IntegrationUrls.HUMANITEC_API_URL}/orgs/${destinationConfig.org}/apps/${destinationConfig.app}/envs/${destinationConfig.env}/values/${encryptedSecret.key}`,
{
headers: {
Authorization: `Bearer ${accessKeyId}`,
"Accept-Encoding": "application/json"
}
}
);
} catch (error) {
throw new SecretSyncError({
error,
secretKey: encryptedSecret.key
});
}
};
const createSecret = async (secretSync: THumanitecSyncWithCredentials, secretMap: TSecretMap, key: string) => {
try {
const {
destinationConfig,
connection: {
credentials: { accessKeyId }
}
} = secretSync;
await request.post(
`${IntegrationUrls.HUMANITEC_API_URL}/orgs/${destinationConfig.org}/apps/${destinationConfig.app}/values`,
{
key,
value: "",
description: secretMap[key].comment || ""
},
{
headers: {
Authorization: `Bearer ${accessKeyId}`,
"Accept-Encoding": "application/json"
}
}
);
await request.patch(
`${IntegrationUrls.HUMANITEC_API_URL}/orgs/${destinationConfig.org}/apps/${destinationConfig.app}/envs/${destinationConfig.env}/values/${key}`,
{
value: secretMap[key].value,
description: secretMap[key].comment || ""
},
{
headers: {
Authorization: `Bearer ${accessKeyId}`,
"Accept-Encoding": "application/json"
}
}
);
} catch (error) {
throw new SecretSyncError({
error,
secretKey: key
});
}
};
const updateSecret = async (secretSync: THumanitecSyncWithCredentials, secretMap: TSecretMap, key: string) => {
try {
const {
destinationConfig,
connection: {
credentials: { accessKeyId }
}
} = secretSync;
await request.patch(
`${IntegrationUrls.HUMANITEC_API_URL}/orgs/${destinationConfig.org}/apps/${destinationConfig.app}/envs/${destinationConfig.env}/values/${key}`,
{
value: secretMap[key].value,
description: secretMap[key].comment
},
{
headers: {
Authorization: `Bearer ${accessKeyId}`,
"Accept-Encoding": "application/json"
}
}
);
} catch (error) {
throw new SecretSyncError({
error,
secretKey: key
});
}
};
export const HumanitecSyncFns = {
syncSecrets: async (secretSync: THumanitecSyncWithCredentials, secretMap: TSecretMap) => {
const humanitecSecrets = await getHumanitecSecrets(secretSync);
const humanitecSecretsKeys = new Set(humanitecSecrets.map((s) => s.key));
for await (const key of Object.keys(secretMap)) {
if (!humanitecSecretsKeys.has(key)) {
await createSecret(secretSync, secretMap, key);
} else {
await updateSecret(secretSync, secretMap, key);
}
}
for await (const humanitecSecret of humanitecSecrets) {
if (!secretMap[humanitecSecret.key]) {
await deleteSecret(secretSync, humanitecSecret);
}
}
},
getSecrets: async (secretSync: THumanitecSyncWithCredentials): Promise<TSecretMap> => {
throw new Error(`${SECRET_SYNC_NAME_MAP[secretSync.destination]} does not support importing secrets.`);
},
removeSecrets: async (secretSync: THumanitecSyncWithCredentials, secretMap: TSecretMap) => {
const encryptedSecrets = await getHumanitecSecrets(secretSync);
for await (const encryptedSecret of encryptedSecrets) {
if (encryptedSecret.key in secretMap) {
await deleteSecret(secretSync, encryptedSecret);
}
}
}
};
backend/src/services/secret-sync/humanitec/humanitec-sync-schemas.ts
+45
View File
@@ -0,0 +1,45 @@
import { z } from "zod";
import { SecretSyncs } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
import {
BaseSecretSyncSchema,
GenericCreateSecretSyncFieldsSchema,
GenericUpdateSecretSyncFieldsSchema
} from "@app/services/secret-sync/secret-sync-schemas";
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
const HumanitecSyncDestinationConfigSchema = z.object({
app: z.string().min(1, "App ID is required").describe(SecretSyncs.DESTINATION_CONFIG.HUMANITEC.app),
org: z.string().min(1, "Org ID is required").describe(SecretSyncs.DESTINATION_CONFIG.HUMANITEC.org),
env: z.string().min(1, "Env ID is required").describe(SecretSyncs.DESTINATION_CONFIG.HUMANITEC.env)
});
const HumanitecSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
export const HumanitecSyncSchema = BaseSecretSyncSchema(SecretSync.Humanitec, HumanitecSyncOptionsConfig).extend({
destination: z.literal(SecretSync.Humanitec),
destinationConfig: HumanitecSyncDestinationConfigSchema
});
export const CreateHumanitecSyncSchema = GenericCreateSecretSyncFieldsSchema(
SecretSync.Humanitec,
HumanitecSyncOptionsConfig
).extend({
destinationConfig: HumanitecSyncDestinationConfigSchema
});
export const UpdateHumanitecSyncSchema = GenericUpdateSecretSyncFieldsSchema(
SecretSync.Humanitec,
HumanitecSyncOptionsConfig
).extend({
destinationConfig: HumanitecSyncDestinationConfigSchema.optional()
});
export const HumanitecSyncListItemSchema = z.object({
name: z.literal("Humanitec"),
connection: z.literal(AppConnection.Humanitec),
destination: z.literal(SecretSync.Humanitec),
canImportSecrets: z.literal(false)
});
backend/src/services/secret-sync/humanitec/humanitec-sync-types.ts
+23
View File
@@ -0,0 +1,23 @@
import z from "zod";
import { THumanitecConnection } from "@app/services/app-connection/humanitec";
import { CreateHumanitecSyncSchema, HumanitecSyncListItemSchema, HumanitecSyncSchema } from "./humanitec-sync-schemas";
export type THumanitecSyncListItem = z.infer<typeof HumanitecSyncListItemSchema>;
export type THumanitecSync = z.infer<typeof HumanitecSyncSchema>;
export type THumanitecSyncInput = z.infer<typeof CreateHumanitecSyncSchema>;
export type THumanitecSyncWithCredentials = THumanitecSync & {
connection: THumanitecConnection;
};
export type HumanitecSecret = {
description: string;
is_secret: boolean;
key: string;
source: "app" | "env";
value: string;
};
backend/src/services/secret-sync/humanitec/index.ts
+4
View File
@@ -0,0 +1,4 @@
export * from "./humanitec-sync-constants";
export * from "./humanitec-sync-fns";
export * from "./humanitec-sync-schemas";
export * from "./humanitec-sync-types";
backend/src/services/secret-sync/secret-sync-enums.ts
+2 -1
View File
@@ -5,7 +5,8 @@ export enum SecretSync {
GCPSecretManager = "gcp-secret-manager",
AzureKeyVault = "azure-key-vault",
AzureAppConfiguration = "azure-app-configuration",
Databricks = "databricks"
Databricks = "databricks",
Humanitec = "humanitec"
}
export enum SecretSyncInitialSyncBehavior {
backend/src/services/secret-sync/secret-sync-fns.ts
+11 -1
View File
@@ -24,6 +24,8 @@ import { AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION, azureAppConfigurationSyncFact
import { AZURE_KEY_VAULT_SYNC_LIST_OPTION, azureKeyVaultSyncFactory } from "./azure-key-vault";
import { GCP_SYNC_LIST_OPTION } from "./gcp";
import { GcpSyncFns } from "./gcp/gcp-sync-fns";
import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
[SecretSync.AWSParameterStore]: AWS_PARAMETER_STORE_SYNC_LIST_OPTION,
@@ -32,7 +34,8 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
[SecretSync.GCPSecretManager]: GCP_SYNC_LIST_OPTION,
[SecretSync.AzureKeyVault]: AZURE_KEY_VAULT_SYNC_LIST_OPTION,
[SecretSync.AzureAppConfiguration]: AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION,
[SecretSync.Databricks]: DATABRICKS_SYNC_LIST_OPTION
[SecretSync.Databricks]: DATABRICKS_SYNC_LIST_OPTION,
[SecretSync.Humanitec]: HUMANITEC_SYNC_LIST_OPTION
};
export const listSecretSyncOptions = () => {
@@ -116,6 +119,8 @@ export const SecretSyncFns = {
appConnectionDAL,
kmsService
}).syncSecrets(secretSync, secretMap);
case SecretSync.Humanitec:
return HumanitecSyncFns.syncSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -157,6 +162,9 @@ export const SecretSyncFns = {
appConnectionDAL,
kmsService
}).getSecrets(secretSync);
case SecretSync.Humanitec:
secretMap = await HumanitecSyncFns.getSecrets(secretSync);
break;
default:
throw new Error(
`Unhandled sync destination for get secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -197,6 +205,8 @@ export const SecretSyncFns = {
appConnectionDAL,
kmsService
}).removeSecrets(secretSync, secretMap);
case SecretSync.Humanitec:
return HumanitecSyncFns.removeSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
backend/src/services/secret-sync/secret-sync-maps.ts
+4 -2
View File
@@ -8,7 +8,8 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
[SecretSync.GCPSecretManager]: "GCP Secret Manager",
[SecretSync.AzureKeyVault]: "Azure Key Vault",
[SecretSync.AzureAppConfiguration]: "Azure App Configuration",
[SecretSync.Databricks]: "Databricks"
[SecretSync.Databricks]: "Databricks",
[SecretSync.Humanitec]: "Humanitec"
};
export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
@@ -18,5 +19,6 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.GCPSecretManager]: AppConnection.GCP,
[SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
[SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration,
[SecretSync.Databricks]: AppConnection.Databricks
[SecretSync.Databricks]: AppConnection.Databricks,
[SecretSync.Humanitec]: AppConnection.Humanitec
};
backend/src/services/secret-sync/secret-sync-types.ts
+14 -4
View File
@@ -43,6 +43,12 @@ import {
TAzureKeyVaultSyncWithCredentials
} from "./azure-key-vault";
import { TGcpSync, TGcpSyncInput, TGcpSyncListItem, TGcpSyncWithCredentials } from "./gcp";
import {
THumanitecSync,
THumanitecSyncInput,
THumanitecSyncListItem,
THumanitecSyncWithCredentials
} from "./humanitec";
export type TSecretSync =
| TAwsParameterStoreSync
@@ -51,7 +57,8 @@ export type TSecretSync =
| TGcpSync
| TAzureKeyVaultSync
| TAzureAppConfigurationSync
| TDatabricksSync;
| TDatabricksSync
| THumanitecSync;
export type TSecretSyncWithCredentials =
| TAwsParameterStoreSyncWithCredentials
@@ -60,7 +67,8 @@ export type TSecretSyncWithCredentials =
| TGcpSyncWithCredentials
| TAzureKeyVaultSyncWithCredentials
| TAzureAppConfigurationSyncWithCredentials
| TDatabricksSyncWithCredentials;
| TDatabricksSyncWithCredentials
| THumanitecSyncWithCredentials;
export type TSecretSyncInput =
| TAwsParameterStoreSyncInput
@@ -69,7 +77,8 @@ export type TSecretSyncInput =
| TGcpSyncInput
| TAzureKeyVaultSyncInput
| TAzureAppConfigurationSyncInput
| TDatabricksSyncInput;
| TDatabricksSyncInput
| THumanitecSyncInput;
export type TSecretSyncListItem =
| TAwsParameterStoreSyncListItem
@@ -78,7 +87,8 @@ export type TSecretSyncListItem =
| TGcpSyncListItem
| TAzureKeyVaultSyncListItem
| TAzureAppConfigurationSyncListItem
| TDatabricksSyncListItem;
| TDatabricksSyncListItem
| THumanitecSyncListItem;
export type TSyncOptionsConfig = {
canImportSecrets: boolean;