Merge remote-tracking branch 'origin/main' into feat/pki-ENG-3666

2026-10-18 04:58:28 +00:00 · 2025-09-22 15:52:41 -03:00
parent 53176784b3 a1dc9ec78f
commit 82f402513d
128 changed files with 5873 additions and 2385 deletions
@@ -776,7 +776,8 @@ export const registerRoutes = async (
    orgDAL,
    totpService,
    orgMembershipDAL,
-    auditLogService
+    auditLogService,
+    notificationService
  });
  const passwordService = authPaswordServiceFactory({
    tokenService,
@@ -890,7 +891,8 @@ export const registerRoutes = async (
    projectDAL,
    permissionService,
    projectUserMembershipRoleDAL,
-    projectMembershipDAL
+    projectMembershipDAL,
+    notificationService
  });

  const rateLimitService = rateLimitServiceFactory({
@@ -929,7 +931,8 @@ export const registerRoutes = async (
    projectRoleDAL,
    groupProjectDAL,
    secretReminderRecipientsDAL,
-    licenseService
+    licenseService,
+    notificationService
  });
  const projectUserAdditionalPrivilegeService = projectUserAdditionalPrivilegeServiceFactory({
    permissionService,
@@ -1096,7 +1099,9 @@ export const registerRoutes = async (
    instanceRelayConfigDAL,
    orgRelayConfigDAL,
    relayDAL,
-    kmsService
+    kmsService,
+    licenseService,
+    permissionService
  });

  const gatewayV2Service = gatewayV2ServiceFactory({
@@ -1134,7 +1139,8 @@ export const registerRoutes = async (
    appConnectionDAL,
    licenseService,
    gatewayService,
-    gatewayV2Service
+    gatewayV2Service,
+    notificationService
  });

  const secretQueueService = secretQueueFactory({
@@ -1218,7 +1224,8 @@ export const registerRoutes = async (
    projectTemplateService,
    groupProjectDAL,
    smtpService,
-    reminderService
+    reminderService,
+    notificationService
  });

  const projectEnvService = projectEnvServiceFactory({
@@ -1352,7 +1359,8 @@ export const registerRoutes = async (
    resourceMetadataDAL,
    projectMicrosoftTeamsConfigDAL,
    microsoftTeamsService,
-    folderCommitService
+    folderCommitService,
+    notificationService
  });

  const secretService = secretServiceFactory({
@@ -1803,7 +1811,8 @@ export const registerRoutes = async (
    secretV2BridgeService,
    resourceMetadataDAL,
    folderCommitService,
-    folderVersionDAL
+    folderVersionDAL,
+    notificationService
  });

  const migrationService = externalMigrationServiceFactory({
@@ -2054,7 +2063,8 @@ export const registerRoutes = async (
    queueService,
    projectDAL,
    projectMembershipDAL,
-    smtpService
+    smtpService,
+    notificationService
  });

  const secretScanningV2Queue = await secretScanningV2QueueServiceFactory({
@@ -2066,7 +2076,8 @@ export const registerRoutes = async (
    smtpService,
    kmsService,
    keyStore,
-    appConnectionDAL
+    appConnectionDAL,
+    notificationService
  });

  const secretScanningV2Service = secretScanningV2ServiceFactory({
@@ -1,16 +1,16 @@
 import { ForbiddenError } from "@casl/ability";
 import { z } from "zod";

-import { SecretFoldersSchema, SecretImportsSchema, UsersSchema } from "@app/db/schemas";
+import { SecretFoldersSchema, SecretImportsSchema, SecretType, UsersSchema } from "@app/db/schemas";
 import { RemindersSchema } from "@app/db/schemas/reminders";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
 import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
 import { SecretRotationV2Schema } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-union-schema";
 import { DASHBOARD } from "@app/lib/api-docs";
-import { BadRequestError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { OrderByDirection } from "@app/lib/types";
-import { secretsLimit } from "@app/server/config/rateLimiter";
+import { readLimit, secretsLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -111,6 +111,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
              SecretRotationV2Schema,
              z.object({
                secrets: secretRawSchema
+                  .omit({ secretValue: true })
                  .extend({
                    secretValueHidden: z.boolean(),
                    secretPath: z.string().optional(),
@@ -124,7 +125,9 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            .array()
            .optional(),
          secrets: secretRawSchema
+            .omit({ secretValue: true })
            .extend({
+              isEmpty: z.boolean(),
              secretValueHidden: z.boolean(),
              secretPath: z.string().optional(),
              secretMetadata: ResourceMetadataSchema.optional(),
@@ -219,7 +222,9 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {

      let imports: Awaited<ReturnType<typeof server.services.secretImport.getImportsMultiEnv>> | undefined;
      let folders: Awaited<ReturnType<typeof server.services.folder.getFoldersMultiEnv>> | undefined;
-      let secrets: Awaited<ReturnType<typeof server.services.secret.getSecretsRawMultiEnv>> | undefined;
+      let secrets:
+        | (Awaited<ReturnType<typeof server.services.secret.getSecretsRawMultiEnv>>[number] & { isEmpty: boolean })[]
+        | undefined;
      let dynamicSecrets:
        | Awaited<ReturnType<typeof server.services.dynamicSecret.listDynamicSecretsByEnvs>>
        | undefined;
@@ -426,43 +431,51 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
        });

        if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
-          secrets = await server.services.secret.getSecretsRawMultiEnv({
-            viewSecretValue: true,
-            actorId: req.permission.id,
-            actor: req.permission.type,
-            actorOrgId: req.permission.orgId,
-            environments,
-            actorAuthMethod: req.permission.authMethod,
-            projectId,
-            path: secretPath,
-            orderBy,
-            orderDirection,
-            search,
-            limit: remainingLimit,
-            offset: adjustedOffset,
-            isInternal: true
-          });
+          secrets = (
+            await server.services.secret.getSecretsRawMultiEnv({
+              viewSecretValue: true,
+              actorId: req.permission.id,
+              actor: req.permission.type,
+              actorOrgId: req.permission.orgId,
+              environments,
+              actorAuthMethod: req.permission.authMethod,
+              projectId,
+              path: secretPath,
+              orderBy,
+              orderDirection,
+              search,
+              limit: remainingLimit,
+              offset: adjustedOffset,
+              isInternal: true
+            })
+          ).map((secret) => ({ ...secret, isEmpty: !secret.secretValue }));
        }
      }

      if (secrets?.length || secretRotations?.length) {
        for await (const environment of environments) {
-          const secretCountFromEnv =
-            (secrets?.filter((secret) => secret.environment === environment).length ?? 0) +
-            (secretRotations
-              ?.filter((rotation) => rotation.environment.slug === environment)
-              .flatMap((rotation) => rotation.secrets.filter((secret) => Boolean(secret))).length ?? 0);
+          const secretIds = [
+            ...new Set(
+              [
+                ...(secrets?.filter((secret) => secret.environment === environment) ?? []),
+                ...(secretRotations
+                  ?.filter((rotation) => rotation.environment.slug === environment)
+                  .flatMap((rotation) => rotation.secrets.filter((secret) => Boolean(secret))) ?? [])
+              ].map((secret) => secret.id)
+            )
+          ];

-          if (secretCountFromEnv) {
+          if (secretIds) {
            await server.services.auditLog.createAuditLog({
              projectId,
              ...req.auditLogInfo,
              event: {
-                type: EventType.GET_SECRETS,
+                type: EventType.DASHBOARD_LIST_SECRETS,
                metadata: {
                  environment,
                  secretPath,
-                  numberOfSecrets: secretCountFromEnv
+                  numberOfSecrets: secretIds.length,
+                  secretIds
                }
              }
            });
@@ -473,7 +486,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
                distinctId: getTelemetryDistinctId(req),
                organizationId: req.permission.orgId,
                properties: {
-                  numberOfSecrets: secretCountFromEnv,
+                  numberOfSecrets: secretIds.length,
                  projectId,
                  environment,
                  secretPath,
@@ -584,7 +597,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
          .optional(),
        search: z.string().trim().describe(DASHBOARD.SECRET_DETAILS_LIST.search).optional(),
        tags: z.string().trim().transform(decodeURIComponent).describe(DASHBOARD.SECRET_DETAILS_LIST.tags).optional(),
-        viewSecretValue: booleanSchema.default(true),
        includeSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeSecrets),
        includeFolders: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeFolders),
        includeDynamicSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeDynamicSecrets),
@@ -606,7 +618,9 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
              SecretRotationV2Schema,
              z.object({
                secrets: secretRawSchema
+                  .omit({ secretValue: true })
                  .extend({
+                    isEmpty: z.boolean(),
                    secretValueHidden: z.boolean(),
                    secretPath: z.string().optional(),
                    secretMetadata: ResourceMetadataSchema.optional(),
@@ -619,7 +633,9 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            .array()
            .optional(),
          secrets: secretRawSchema
+            .omit({ secretValue: true })
            .extend({
+              isEmpty: z.boolean(),
              secretReminderRecipients: z
                .object({
                  user: UsersSchema.pick({ id: true, email: true, username: true }),
@@ -715,12 +731,21 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
      let folders: Awaited<ReturnType<typeof server.services.folder.getFolders>> | undefined;
      let secrets:
        | (Awaited<ReturnType<typeof server.services.secret.getSecretsRaw>>["secrets"][number] & {
+            isEmpty: boolean;
            reminder: Awaited<ReturnType<typeof server.services.reminder.getRemindersForDashboard>>[string] | null;
          })[]
        | undefined;
      let dynamicSecrets: Awaited<ReturnType<typeof server.services.dynamicSecret.listDynamicSecretsByEnv>> | undefined;
      let secretRotations:
-        | Awaited<ReturnType<typeof server.services.secretRotationV2.getDashboardSecretRotations>>
+        | (Awaited<ReturnType<typeof server.services.secretRotationV2.getDashboardSecretRotations>>[number] & {
+            secrets: (NonNullable<
+              Awaited<
+                ReturnType<typeof server.services.secretRotationV2.getDashboardSecretRotations>
+              >[number]["secrets"][number] & {
+                isEmpty: boolean;
+              }
+            > | null)[];
+          })[]
        | undefined;

      let totalImportCount: number | undefined;
@@ -822,19 +847,31 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
        );

        if (remainingLimit > 0 && totalSecretRotationCount > adjustedOffset) {
-          secretRotations = await server.services.secretRotationV2.getDashboardSecretRotations(
-            {
-              projectId,
-              search,
-              orderBy,
-              orderDirection,
-              environments: [environment],
-              secretPath,
-              limit: remainingLimit,
-              offset: adjustedOffset
-            },
-            req.permission
-          );
+          secretRotations = (
+            await server.services.secretRotationV2.getDashboardSecretRotations(
+              {
+                projectId,
+                search,
+                orderBy,
+                orderDirection,
+                environments: [environment],
+                secretPath,
+                limit: remainingLimit,
+                offset: adjustedOffset
+              },
+              req.permission
+            )
+          ).map((rotation) => ({
+            ...rotation,
+            secrets: rotation.secrets.map((secret) =>
+              secret
+                ? {
+                    ...secret,
+                    isEmpty: !secret.secretValue
+                  }
+                : secret
+            )
+          }));

          await server.services.auditLog.createAuditLog({
            projectId,
@@ -919,7 +956,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
              await server.services.secret.getSecretsRaw({
                actorId: req.permission.id,
                actor: req.permission.type,
-                viewSecretValue: req.query.viewSecretValue,
+                viewSecretValue: true,
                throwOnMissingReadValuePermission: false,
                actorOrgId: req.permission.orgId,
                environment,
@@ -943,6 +980,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {

            secrets = rawSecrets.map((secret) => ({
              ...secret,
+              isEmpty: !secret.secretValue,
              reminder: reminders[secret.id] ?? null
            }));
          }
@@ -977,19 +1015,25 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
      }));

      if (secrets?.length || secretRotations?.length) {
-        const secretCount =
-          (secrets?.length ?? 0) +
-          (secretRotations?.flatMap((rotation) => rotation.secrets.filter((secret) => Boolean(secret))).length ?? 0);
+        const secretIds = [
+          ...new Set(
+            [
+              ...(secrets ?? []),
+              ...(secretRotations?.flatMap((rotation) => rotation.secrets.filter((secret) => Boolean(secret))) ?? [])
+            ].map((secret) => secret.id)
+          )
+        ];

        await server.services.auditLog.createAuditLog({
          projectId,
          ...req.auditLogInfo,
          event: {
-            type: EventType.GET_SECRETS,
+            type: EventType.DASHBOARD_LIST_SECRETS,
            metadata: {
              environment,
              secretPath,
-              numberOfSecrets: secretCount
+              numberOfSecrets: secretIds.length,
+              secretIds
            }
          }
        });
@@ -1000,7 +1044,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            distinctId: getTelemetryDistinctId(req),
            organizationId: req.permission.orgId,
            properties: {
-              numberOfSecrets: secretCount,
+              numberOfSecrets: secretIds.length,
              projectId,
              environment,
              secretPath,
@@ -1060,6 +1104,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
            .array()
            .optional(),
          secrets: secretRawSchema
+            .omit({ secretValue: true })
            .extend({
              secretValueHidden: z.boolean(),
              secretPath: z.string().optional(),
@@ -1145,18 +1190,20 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
          );

      for await (const environment of environments) {
-        const secretCountForEnv = secrets.filter((secret) => secret.environment === environment).length;
+        const envSecrets = secrets.filter((secret) => secret.environment === environment);
+        const secretCountForEnv = envSecrets.length;

        if (secretCountForEnv) {
          await server.services.auditLog.createAuditLog({
            projectId,
            ...req.auditLogInfo,
            event: {
-              type: EventType.GET_SECRETS,
+              type: EventType.DASHBOARD_LIST_SECRETS,
              metadata: {
                environment,
                secretPath,
-                numberOfSecrets: secretCountForEnv
+                numberOfSecrets: secretCountForEnv,
+                secretIds: envSecrets.map((secret) => secret.id)
              }
            }
          });
@@ -1259,6 +1306,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
      }),
      response: {
        200: z.object({
+          // TODO(scott): omit secretValue here, but requires refactor of uploading env/copy from board
          secrets: secretRawSchema
            .extend({
              secretPath: z.string().optional(),
@@ -1310,6 +1358,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
      }),
      response: {
        200: z.object({
+          // TODO(scott): omit secretValue here, but requires refactor of uploading env/copy from board
          secrets: secretRawSchema
            .extend({
              secretValueHidden: z.boolean(),
@@ -1345,11 +1394,12 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
        projectId,
        ...req.auditLogInfo,
        event: {
-          type: EventType.GET_SECRETS,
+          type: EventType.DASHBOARD_LIST_SECRETS,
          metadata: {
            environment,
            secretPath,
-            numberOfSecrets: secrets.length
+            numberOfSecrets: secrets.length,
+            secretIds: secrets.map((secret) => secret.id)
          }
        }
      });
@@ -1373,4 +1423,256 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
      return { secrets };
    }
  });
+
+  server.route({
+    method: "GET",
+    url: "/secret-value",
+    config: {
+      rateLimit: secretsLimit
+    },
+    schema: {
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      querystring: z.object({
+        projectId: z.string().trim(),
+        environment: z.string().trim(),
+        secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
+        secretKey: z.string().trim(),
+        isOverride: z
+          .enum(["true", "false"])
+          .transform((value) => value === "true")
+          .optional()
+      }),
+      response: {
+        200: z.object({
+          valueOverride: z.string().optional(),
+          value: z.string().optional()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { secretPath, projectId, environment, secretKey, isOverride } = req.query;
+
+      // TODO (scott): just get the secret instead of searching for it in list
+      const { secrets } = await server.services.secret.getSecretsRaw({
+        actorId: req.permission.id,
+        actor: req.permission.type,
+        viewSecretValue: true,
+        throwOnMissingReadValuePermission: false,
+        actorOrgId: req.permission.orgId,
+        environment,
+        actorAuthMethod: req.permission.authMethod,
+        projectId,
+        path: secretPath,
+        search: secretKey,
+        includeTagsInSearch: true,
+        includeMetadataInSearch: true
+      });
+
+      if (isOverride) {
+        const personalSecret = secrets.find(
+          (secret) => secret.type === SecretType.Personal && secret.secretKey === secretKey
+        );
+
+        if (!personalSecret)
+          throw new BadRequestError({
+            message: `Could not find personal secret with key "${secretKey}" at secret path "${secretPath}" in environment "${environment}" for project with ID "${projectId}"`
+          });
+
+        if (personalSecret)
+          return {
+            valueOverride: personalSecret.secretValue
+          };
+      }
+
+      const sharedSecret = secrets.find(
+        (secret) => secret.type === SecretType.Shared && secret.secretKey === secretKey
+      );
+
+      if (!sharedSecret)
+        throw new BadRequestError({
+          message: `Could not find secret with key "${secretKey}" at secret path "${secretPath}" in environment "${environment}" for project with ID "${projectId}"`
+        });
+
+      // only audit if not personal
+      await server.services.auditLog.createAuditLog({
+        projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DASHBOARD_GET_SECRET_VALUE,
+          metadata: {
+            environment: req.query.environment,
+            secretPath: req.query.secretPath,
+            secretKey,
+            secretId: sharedSecret.id
+          }
+        }
+      });
+
+      return { value: sharedSecret.secretValue };
+    }
+  });
+
+  server.route({
+    url: "/secret-imports",
+    method: "GET",
+    config: {
+      rateLimit: secretsLimit
+    },
+    schema: {
+      querystring: z.object({
+        projectId: z.string().trim(),
+        environment: z.string().trim(),
+        path: z.string().trim().default("/").transform(removeTrailingSlash)
+      }),
+      response: {
+        200: z.object({
+          secrets: z
+            .object({
+              secretPath: z.string(),
+              environment: z.string(),
+              environmentInfo: z.object({
+                id: z.string(),
+                name: z.string(),
+                slug: z.string()
+              }),
+              folderId: z.string().optional(),
+              secrets: secretRawSchema.omit({ secretValue: true }).extend({ isEmpty: z.boolean() }).array()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const importedSecrets = await server.services.secretImport.getRawSecretsFromImports({
+        actorId: req.permission.id,
+        actor: req.permission.type,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.query
+      });
+
+      await server.services.auditLog.createAuditLog({
+        projectId: req.query.projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DASHBOARD_LIST_SECRETS,
+          metadata: {
+            environment: req.query.environment,
+            secretPath: req.query.path,
+            numberOfSecrets: importedSecrets.length,
+            secretIds: importedSecrets.map((secret) => secret.id)
+          }
+        }
+      });
+
+      return {
+        secrets: importedSecrets.map((importData) => ({
+          ...importData,
+          secrets: importData.secrets.map((secret) => ({
+            ...secret,
+            isEmpty: !secret.secretValue
+          }))
+        }))
+      };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/secret-versions/:secretId",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        secretId: z.string()
+      }),
+      querystring: z.object({
+        offset: z.coerce.number(),
+        limit: z.coerce.number()
+      }),
+      response: {
+        200: z.object({
+          secretVersions: secretRawSchema
+            .omit({ secretValue: true })
+            .extend({
+              secretValueHidden: z.boolean()
+            })
+            .array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const secretVersions = await server.services.secret.getSecretVersions({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        limit: req.query.limit,
+        offset: req.query.offset,
+        secretId: req.params.secretId
+      });
+
+      return { secretVersions };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/secret-versions/:secretId/value/:version",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        secretId: z.string(),
+        version: z.string()
+      }),
+
+      response: {
+        200: z.object({
+          value: z.string()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { version, secretId } = req.params;
+
+      const [secretVersion] = await server.services.secret.getSecretVersions({
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        secretId,
+        secretVersions: [version]
+      });
+
+      if (!secretVersion)
+        throw new NotFoundError({
+          message: `Could not find secret version "${version}" for secret with ID "${secretId}`
+        });
+
+      await server.services.auditLog.createAuditLog({
+        projectId: secretVersion.workspace,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.DASHBOARD_GET_SECRET_VERSION_VALUE,
+          metadata: {
+            secretId,
+            version
+          }
+        }
+      });
+
+      return { value: secretVersion.secretValue };
+    }
+  });
 };
@@ -3,8 +3,10 @@ import { z } from "zod";
 import { UserNotificationsSchema } from "@app/db/schemas/user-notifications";
 import { UnauthorizedError } from "@app/lib/errors";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
+import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";

 export const registerNotificationRouter = async (server: FastifyZodProvider) => {
  server.route({
@@ -97,6 +99,16 @@ export const registerNotificationRouter = async (server: FastifyZodProvider) =>
        ...req.body
      });

+      await server.services.telemetry.sendPostHogEvents({
+        event: PostHogEventTypes.NotificationUpdated,
+        distinctId: getTelemetryDistinctId(req),
+        organizationId: req.permission.orgId,
+        properties: {
+          notificationId: req.params.notificationId,
+          ...req.body
+        }
+      });
+
      return { notification };
    }
  });
@@ -627,7 +627,8 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
            secretId: secret.id,
            secretKey: req.params.secretName,
            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretMetadata: req.body.secretMetadata,
+            secretTags: secret.tags?.map((tag) => tag.name)
          }
        }
      });
@@ -780,7 +781,8 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
            secretId: secret.id,
            secretKey: req.params.secretName,
            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretMetadata: req.body.secretMetadata,
+            secretTags: secret.tags?.map((tag) => tag.name)
          }
        }
      });
@@ -2154,7 +2156,8 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
              secretId: secret.id,
              secretKey: secret.secretKey,
              secretVersion: secret.version,
-              secretMetadata: secretMetadataMap.get(secret.secretKey)
+              secretMetadata: secretMetadataMap.get(secret.secretKey),
+              secretTags: secret.tags?.map((tag) => tag.name)
            }))
          }
        }
@@ -2288,7 +2291,6 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
        return { approval: secretOperation.approval };
      }
      const { secrets } = secretOperation;
-
      const secretMetadataMap = new Map(
        inputSecrets.map(({ secretKey, secretMetadata }) => [secretKey, secretMetadata])
      );
@@ -2308,7 +2310,8 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
                secretPath: secret.secretPath,
                secretKey: secret.secretKey,
                secretVersion: secret.version,
-                secretMetadata: secretMetadataMap.get(secret.secretKey)
+                secretMetadata: secretMetadataMap.get(secret.secretKey),
+                secretTags: secret.tags?.map((tag) => tag.name)
              }))
          }
        }
@@ -2328,7 +2331,8 @@ export const registerDeprecatedSecretRouter = async (server: FastifyZodProvider)
                secretPath: secret.secretPath,
                secretKey: secret.secretKey,
                secretVersion: secret.version,
-                secretMetadata: secretMetadataMap.get(secret.secretKey)
+                secretMetadata: secretMetadataMap.get(secret.secretKey),
+                secretTags: secret.tags?.map((tag) => tag.name)
              }))
            }
          }
@@ -478,7 +478,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
            secretId: secret.id,
            secretKey: req.params.secretName,
            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretMetadata: req.body.secretMetadata,
+            secretTags: secret.tags?.map((tag) => tag.name)
          }
        }
      });
@@ -621,7 +622,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
            secretId: secret.id,
            secretKey: req.params.secretName,
            secretVersion: secret.version,
-            secretMetadata: req.body.secretMetadata
+            secretMetadata: req.body.secretMetadata,
+            secretTags: secret.tags?.map((tag) => tag.name)
          }
        }
      });
@@ -762,7 +764,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
      hide: false,
      tags: [ApiDocsTags.Secrets],
      body: z.object({
-        projectSlug: z.string().trim(),
+        projectId: z.string().trim(),
        sourceEnvironment: z.string().trim(),
        sourceSecretPath: z.string().trim().default("/").transform(removeTrailingSlash),
        destinationEnvironment: z.string().trim(),
@@ -911,7 +913,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
              secretId: secret.id,
              secretKey: secret.secretKey,
              secretVersion: secret.version,
-              secretMetadata: secretMetadataMap.get(secret.secretKey)
+              secretMetadata: secretMetadataMap.get(secret.secretKey),
+              secretTags: secret.tags?.map((tag) => tag.name)
            }))
          }
        }
@@ -1063,7 +1066,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
                secretPath: secret.secretPath,
                secretKey: secret.secretKey,
                secretVersion: secret.version,
-                secretMetadata: secretMetadataMap.get(secret.secretKey)
+                secretMetadata: secretMetadataMap.get(secret.secretKey),
+                secretTags: secret.tags?.map((tag) => tag.name)
              }))
          }
        }
@@ -1262,7 +1266,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
    handler: async (req) => {
      const { secretName } = req.params;
      const { secretPath, environment, projectId } = req.query;
-      const { tree, value } = await server.services.secret.getSecretReferenceTree({
+      const { tree, value, secret } = await server.services.secret.getSecretReferenceTree({
        actorId: req.permission.id,
        actor: req.permission.type,
        actorAuthMethod: req.permission.authMethod,
@@ -1273,6 +1277,21 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
        environment
      });

+      await server.services.auditLog.createAuditLog({
+        projectId,
+        ...req.auditLogInfo,
+        event: {
+          type: EventType.GET_SECRET,
+          metadata: {
+            environment,
+            secretPath,
+            secretId: secret.id,
+            secretKey: secretName,
+            secretVersion: secret.version
+          }
+        }
+      });
+
      return { tree, value };
    }
  });