Address PR comments

backend/src/ee/services/dynamic-secret/providers/couchbase.ts

@@ -51,6 +51,57 @@ const sanitizeCouchbaseUsername = (username: string): string => {
   return sanitized;
 };
 
+/**
+ * Normalizes bucket configuration to handle wildcard (*) access consistently.
+ *
+ * Key behaviors:
+ * - If "*" appears anywhere (string or array), grants access to ALL buckets, scopes, and collections
+ *
+ * @param buckets - Either a string or array of bucket configurations
+ * @returns Normalized bucket resources for Couchbase API
+ */
+const normalizeBucketConfiguration = (
+  buckets:
+    | string
+    | Array<{
+        name: string;
+        scopes?: Array<{
+          name: string;
+          collections?: string[];
+        }>;
+      }>
+) => {
+  if (typeof buckets === "string") {
+    // Simple string format - either "*" or comma-separated bucket names
+    const bucketNames = buckets
+      .split(",")
+      .map((bucket) => bucket.trim())
+      .filter((bucket) => bucket.length > 0);
+
+    // If "*" is present anywhere, grant access to all buckets, scopes, and collections
+    if (bucketNames.includes("*") || buckets === "*") {
+      return [{ name: "*" }];
+    }
+    return bucketNames.map((bucketName) => ({ name: bucketName }));
+  }
+
+  // Array of bucket objects with scopes and collections
+  // Check if any bucket is "*" - if so, grant access to all buckets, scopes, and collections
+  const hasWildcardBucket = buckets.some((bucket) => bucket.name === "*");
+
+  if (hasWildcardBucket) {
+    return [{ name: "*" }];
+  }
+
+  return buckets.map((bucket) => ({
+    name: bucket.name,
+    scopes: bucket.scopes?.map((scope) => ({
+      name: scope.name,
+      collections: scope.collections || []
+    }))
+  }));
+};
+
 const generateUsername = (usernameTemplate?: string | null, identity?: { name: string }) => {
   const randomUsername = alphaNumericNanoId(12);
   if (!usernameTemplate) return sanitizeCouchbaseUsername(randomUsername);
@@ -184,28 +235,7 @@ export const CouchbaseProvider = (): TDynamicProviderFns => {
 
     const createUserUrl = `${providerInputs.url}/v4/organizations/${providerInputs.orgId}/projects/${providerInputs.projectId}/clusters/${providerInputs.clusterId}/users`;
 
-    let bucketResources;
-
-    if (typeof providerInputs.buckets === "string") {
-      // Simple string format - either "*" or comma-separated bucket names
-      const bucketNames =
-        providerInputs.buckets === "*"
-          ? ["*"]
-          : providerInputs.buckets
-              .split(",")
-              .map((bucket) => bucket.trim())
-              .filter((bucket) => bucket.length > 0);
-      bucketResources = bucketNames.map((bucketName) => ({ name: bucketName }));
-    } else {
-      // Array of bucket objects with scopes and collections
-      bucketResources = providerInputs.buckets.map((bucket) => ({
-        name: bucket.name,
-        scopes: bucket.scopes?.map((scope) => ({
-          name: scope.name,
-          collections: scope.collections || []
-        }))
-      }));
-    }
+    const bucketResources = normalizeBucketConfiguration(providerInputs.buckets);
 
     const userData: TCreateCouchbaseUser = {
       name: username,

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -513,24 +513,50 @@ export const DynamicSecretCouchbaseSchema = z.object({
   roles: z.array(z.string().trim().min(1)).min(1).describe("Roles to assign to the user"),
   buckets: z
     .union([
-      z.string().trim().min(1).default("*"),
-      z.array(
-        z.object({
-          name: z.string().trim().min(1).describe("Bucket name"),
-          scopes: z
-            .array(
-              z.object({
-                name: z.string().trim().min(1).describe("Scope name"),
-                collections: z.array(z.string().trim().min(1)).optional().describe("Collection names")
-              })
-            )
-            .optional()
-            .describe("Scopes within the bucket")
-        })
-      )
+      z
+        .string()
+        .trim()
+        .min(1)
+        .default("*")
+        .refine((val) => {
+          if (val.includes(",")) {
+            const buckets = val
+              .split(",")
+              .map((b) => b.trim())
+              .filter((b) => b.length > 0);
+            if (buckets.includes("*") && buckets.length > 1) {
+              return false;
+            }
+          }
+          return true;
+        }, "Cannot combine '*' with other bucket names"),
+      z
+        .array(
+          z.object({
+            name: z.string().trim().min(1).describe("Bucket name"),
+            scopes: z
+              .array(
+                z.object({
+                  name: z.string().trim().min(1).describe("Scope name"),
+                  collections: z.array(z.string().trim().min(1)).optional().describe("Collection names")
+                })
+              )
+              .optional()
+              .describe("Scopes within the bucket")
+          })
+        )
+        .refine((buckets) => {
+          const hasWildcard = buckets.some((bucket) => bucket.name === "*");
+          if (hasWildcard && buckets.length > 1) {
+            return false;
+          }
+          return true;
+        }, "Cannot combine '*' bucket with other buckets")
     ])
     .default("*")
-    .describe("Bucket configuration: '*' for all buckets or array of bucket objects with scopes and collections"),
+    .describe(
+      "Bucket configuration: '*' for all buckets, scopes, and collections or array of bucket objects with specific scopes and collections"
+    ),
   passwordRequirements: z
     .object({
       length: z.number().min(8, "Password must be at least 8 characters").max(128),