feat: updated folder, secret import partially and dynamic secret service

backend/src/services/secret-folder/secret-folder-fns.ts

@@ -1,6 +0,0 @@
-import { RawRule } from "@casl/ability";
-
-import { ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-
-export const shouldCheckFolderPermission = (rules: RawRule[]) =>
-  rules.some((rule) => (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders));

backend/src/services/secret-folder/secret-folder-service.ts

@@ -12,7 +12,6 @@ import { OrderByDirection } from "@app/lib/types";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
-import { shouldCheckFolderPermission } from "./secret-folder-fns";
 import {
   TCreateFolderDTO,
   TDeleteFolderDTO,
@@ -60,20 +59,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
     if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" });
@@ -161,20 +150,10 @@ export const secretFolderServiceFactory = ({
     );
 
     folders.forEach(({ environment, path: secretPath }) => {
-      // we do this because we've split Secret and SecretFolder resources
-      // previously, if one can create/update/read/delete secrets then they can do the same for folders
-      // for backwards compatibility, we handle authorization only when SecretFolders subject is used
-      if (shouldCheckFolderPermission(permission.rules)) {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-        );
-      } else {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-        );
-      }
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Edit,
+        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+      );
     });
 
     const result = await folderDAL.transaction(async (tx) =>
@@ -267,20 +246,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );
 
     const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!parentFolder) throw new NotFoundError({ message: "Secret path not found" });
@@ -351,20 +320,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
-    if (shouldCheckFolderPermission(permission.rules)) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
+    );
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
     if (!env) throw new NotFoundError({ message: "Environment not found", name: "Create folder" });

backend/src/services/secret-import/secret-import-service.ts

@@ -84,15 +84,17 @@ export const secretImportServiceFactory = ({
     // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: data.environment,
-        secretPath: data.path
+        secretPath: data.path,
+        secretName: "",
+        secretTags: []
       })
     );
     if (isReplication) {
@@ -191,7 +193,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -277,7 +279,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -342,8 +344,8 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -366,10 +368,12 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: secretImportDoc.importEnv.slug,
-        secretPath: secretImportDoc.importPath
+        secretPath: secretImportDoc.importPath,
+        secretName: "",
+        secretTags: []
       })
     );
 
@@ -414,7 +418,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -446,7 +450,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -532,7 +536,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder) return [];
@@ -540,16 +544,8 @@ export const secretImportServiceFactory = ({
     // so anything based on this order will also be in right position
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
 
-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
-          secretPath: importPath
-        })
-      )
-    );
-    return fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL });
+    // TODO(casl): update here
+    return fnSecretsFromImports({ allowedImports: secretImports, folderDAL, secretDAL, secretImportDAL });
   };
 
   const getRawSecretsFromImports = async ({
@@ -570,7 +566,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder) return [];
@@ -578,16 +574,6 @@ export const secretImportServiceFactory = ({
     // so anything based on this order will also be in right position
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
 
-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
-          secretPath: importPath
-        })
-      )
-    );
-
     const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
     if (shouldUseSecretV2Bridge) {
       const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
@@ -595,7 +581,7 @@ export const secretImportServiceFactory = ({
         projectId
       });
       const importedSecrets = await fnSecretsV2FromImports({
-        allowedImports,
+        allowedImports: secretImports,
         folderDAL,
         secretDAL: secretV2BridgeDAL,
         secretImportDAL,
@@ -610,7 +596,12 @@ export const secretImportServiceFactory = ({
         name: "bot_not_found_error"
       });
 
-    const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL });
+    const importedSecrets = await fnSecretsFromImports({
+      allowedImports: secretImports,
+      folderDAL,
+      secretDAL,
+      secretImportDAL
+    });
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>