Revert "Permission phase 2"

backend/src/services/secret-import/secret-import-fns.ts

@@ -27,7 +27,6 @@ type TSecretImportSecretsV2 = {
     slug: string;
     name: string;
   };
-  id: string;
   folderId: string | undefined;
   importFolderId: string;
   secrets: (TSecretsV2 & {
@@ -140,22 +139,24 @@ export const fnSecretsFromImports = async ({
   return secrets;
 };
 
-/* eslint-disable no-await-in-loop, no-continue */
 export const fnSecretsV2FromImports = async ({
-  secretImports: rootSecretImports,
+  allowedImports: possibleCyclicImports,
   folderDAL,
   secretDAL,
   secretImportDAL,
+  depth = 0,
+  cyclicDetector = new Set(),
   decryptor,
-  expandSecretReferences,
-  hasSecretAccess
+  expandSecretReferences
 }: {
-  secretImports: (Omit<TSecretImports, "importEnv"> & {
+  allowedImports: (Omit<TSecretImports, "importEnv"> & {
     importEnv: { id: string; slug: string; name: string };
   })[];
   folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
   secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
+  depth?: number;
+  cyclicDetector?: Set<string>;
   decryptor: (value?: Buffer | null) => string;
   expandSecretReferences?: (inputSecret: {
     value?: string;
@@ -163,107 +164,92 @@ export const fnSecretsV2FromImports = async ({
     secretPath: string;
     environment: string;
   }) => Promise<string | undefined>;
-  hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
-  const cyclicDetector = new Set();
-  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
-    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
-  ];
+  // avoid going more than a depth
+  if (depth >= LEVEL_BREAK) return [];
 
-  const processedImports: TSecretImportSecretsV2[] = [];
+  const allowedImports = possibleCyclicImports.filter(
+    ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
+  );
 
-  while (stack.length) {
-    const { secretImports, depth, parentImportedSecrets } = stack.pop()!;
-
-    if (depth > LEVEL_BREAK) continue;
-    const sanitizedImports = secretImports.filter(
-      ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
-    );
-
-    if (!sanitizedImports.length) continue;
-
-    const importedFolders = await folderDAL.findByManySecretPath(
-      sanitizedImports.map(({ importEnv, importPath }) => ({
+  const importedFolders = (
+    await folderDAL.findByManySecretPath(
+      allowedImports.map(({ importEnv, importPath }) => ({
         envId: importEnv.id,
         secretPath: importPath
       }))
-    );
-    if (!importedFolders.length) continue;
+    )
+  ).filter(Boolean); // remove undefined ones
+  if (!importedFolders.length) {
+    return [];
+  }
 
-    const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
-    const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
+  const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
+  const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
+  const importedSecrets = await secretDAL.find(
+    {
+      $in: { folderId: importedFolderIds },
+      type: SecretType.Shared
+    },
+    {
+      sort: [["id", "asc"]]
+    }
+  );
 
-    const importedSecrets = await secretDAL.find(
-      {
-        $in: { folderId: importedFolderIds },
-        type: SecretType.Shared
-      },
-      {
-        sort: [["id", "asc"]]
-      }
-    );
-    const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
+  const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
 
-    sanitizedImports.forEach(({ importPath, importEnv }) => {
-      cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
-    });
-    // now we need to check recursively deeper imports made inside other imports
-    // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
-    const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
-    const deeperImportsGroupByFolderId = groupBy(deeperImports, (i) => i.folderId);
-
-    const isFirstIteration = !processedImports.length;
-    sanitizedImports.forEach(({ importPath, importEnv, id, folderId }, i) => {
-      const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
-      const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
-        .filter((item) =>
-          hasSecretAccess(
-            importEnv.slug,
-            importPath,
-            item.key,
-            item.tags.map((el) => el.slug)
-          )
-        )
-        .map((item) => ({
-          ...item,
-          secretKey: item.key,
-          secretValue: decryptor(item.encryptedValue),
-          secretComment: decryptor(item.encryptedComment),
-          environment: importEnv.slug,
-          workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-          _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-        }));
-
-      if (deeperImportsGroupByFolderId?.[sourceImportFolder?.id || ""]) {
-        stack.push({
-          secretImports: deeperImportsGroupByFolderId[sourceImportFolder?.id || ""],
-          depth: depth + 1,
-          parentImportedSecrets: secretsWithDuplicate
-        });
-      }
-
-      if (isFirstIteration) {
-        processedImports.push({
-          secretPath: importPath,
-          environment: importEnv.slug,
-          environmentInfo: importEnv,
-          folderId: importedFolders?.[i]?.id,
-          id,
-          importFolderId: folderId,
-          secrets: secretsWithDuplicate
-        });
-      } else {
-        parentImportedSecrets.push(...secretsWithDuplicate);
-      }
+  allowedImports.forEach(({ importPath, importEnv }) => {
+    cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
+  });
+  // now we need to check recursively deeper imports made inside other imports
+  // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
+  const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
+  let secretsFromDeeperImports: TSecretImportSecretsV2[] = [];
+  if (deeperImports.length) {
+    secretsFromDeeperImports = await fnSecretsV2FromImports({
+      allowedImports: deeperImports.filter(({ isReplication }) => !isReplication),
+      secretImportDAL,
+      folderDAL,
+      secretDAL,
+      depth: depth + 1,
+      cyclicDetector,
+      decryptor,
+      expandSecretReferences
     });
   }
-  /* eslint-enable */
+  const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId);
+
+  const processedImports = allowedImports.map(({ importPath, importEnv, id, folderId }, i) => {
+    const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
+    const folderDeeperImportSecrets =
+      secretsFromdeeperImportGroupedByFolderId?.[sourceImportFolder?.id || ""]?.[0]?.secrets || [];
+    const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
+      .map((item) => ({
+        ...item,
+        secretKey: item.key,
+        secretValue: decryptor(item.encryptedValue),
+        secretComment: decryptor(item.encryptedComment),
+        environment: importEnv.slug,
+        workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+        _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+      }))
+      .concat(folderDeeperImportSecrets);
+
+    return {
+      secretPath: importPath,
+      environment: importEnv.slug,
+      environmentInfo: importEnv,
+      folderId: importedFolders?.[i]?.id,
+      id,
+      importFolderId: folderId,
+      secrets: unique(secretsWithDuplicate, (el) => el.secretKey)
+    };
+  });
+
   if (expandSecretReferences) {
     await Promise.allSettled(
-      processedImports.map((processedImport) => {
-        // eslint-disable-next-line
-        processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
-        return Promise.allSettled(
+      processedImports.map((processedImport) =>
+        Promise.allSettled(
           processedImport.secrets.map(async (decryptedSecret, index) => {
             const expandedSecretValue = await expandSecretReferences({
               value: decryptedSecret.secretValue,
@@ -274,8 +260,8 @@ export const fnSecretsV2FromImports = async ({
             // eslint-disable-next-line no-param-reassign
             processedImport.secrets[index].secretValue = expandedSecretValue || "";
           })
-        );
-      })
+        )
+      )
     );
   }