Revert "Revert "Permission phase 2""

This reverts commit 8b9244b079.
2026-10-15 08:34:52 +00:00 · 2024-10-25 00:59:38 +05:30
parent 45b9de63f0
commit 93218d5a3f
100 changed files with 3390 additions and 1615 deletions
@@ -27,6 +27,7 @@ type TSecretImportSecretsV2 = {
    slug: string;
    name: string;
  };
+  id: string;
  folderId: string | undefined;
  importFolderId: string;
  secrets: (TSecretsV2 & {
@@ -139,24 +140,22 @@ export const fnSecretsFromImports = async ({
  return secrets;
 };

+/* eslint-disable no-await-in-loop, no-continue */
 export const fnSecretsV2FromImports = async ({
-  allowedImports: possibleCyclicImports,
+  secretImports: rootSecretImports,
  folderDAL,
  secretDAL,
  secretImportDAL,
-  depth = 0,
-  cyclicDetector = new Set(),
  decryptor,
-  expandSecretReferences
+  expandSecretReferences,
+  hasSecretAccess
 }: {
-  allowedImports: (Omit<TSecretImports, "importEnv"> & {
+  secretImports: (Omit<TSecretImports, "importEnv"> & {
    importEnv: { id: string; slug: string; name: string };
  })[];
  folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
  secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
  secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
-  depth?: number;
-  cyclicDetector?: Set<string>;
  decryptor: (value?: Buffer | null) => string;
  expandSecretReferences?: (inputSecret: {
    value?: string;
@@ -164,92 +163,107 @@ export const fnSecretsV2FromImports = async ({
    secretPath: string;
    environment: string;
  }) => Promise<string | undefined>;
+  hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
-  // avoid going more than a depth
-  if (depth >= LEVEL_BREAK) return [];
+  const cyclicDetector = new Set();
+  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
+    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
+  ];

-  const allowedImports = possibleCyclicImports.filter(
-    ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
-  );
+  const processedImports: TSecretImportSecretsV2[] = [];

-  const importedFolders = (
-    await folderDAL.findByManySecretPath(
-      allowedImports.map(({ importEnv, importPath }) => ({
+  while (stack.length) {
+    const { secretImports, depth, parentImportedSecrets } = stack.pop()!;
+
+    if (depth > LEVEL_BREAK) continue;
+    const sanitizedImports = secretImports.filter(
+      ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
+    );
+
+    if (!sanitizedImports.length) continue;
+
+    const importedFolders = await folderDAL.findByManySecretPath(
+      sanitizedImports.map(({ importEnv, importPath }) => ({
        envId: importEnv.id,
        secretPath: importPath
      }))
-    )
-  ).filter(Boolean); // remove undefined ones
-  if (!importedFolders.length) {
-    return [];
-  }
+    );
+    if (!importedFolders.length) continue;

-  const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
-  const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
-  const importedSecrets = await secretDAL.find(
-    {
-      $in: { folderId: importedFolderIds },
-      type: SecretType.Shared
-    },
-    {
-      sort: [["id", "asc"]]
-    }
-  );
+    const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
+    const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);

-  const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
+    const importedSecrets = await secretDAL.find(
+      {
+        $in: { folderId: importedFolderIds },
+        type: SecretType.Shared
+      },
+      {
+        sort: [["id", "asc"]]
+      }
+    );
+    const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);

-  allowedImports.forEach(({ importPath, importEnv }) => {
-    cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
-  });
-  // now we need to check recursively deeper imports made inside other imports
-  // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
-  const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
-  let secretsFromDeeperImports: TSecretImportSecretsV2[] = [];
-  if (deeperImports.length) {
-    secretsFromDeeperImports = await fnSecretsV2FromImports({
-      allowedImports: deeperImports.filter(({ isReplication }) => !isReplication),
-      secretImportDAL,
-      folderDAL,
-      secretDAL,
-      depth: depth + 1,
-      cyclicDetector,
-      decryptor,
-      expandSecretReferences
+    sanitizedImports.forEach(({ importPath, importEnv }) => {
+      cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
+    });
+    // now we need to check recursively deeper imports made inside other imports
+    // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
+    const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
+    const deeperImportsGroupByFolderId = groupBy(deeperImports, (i) => i.folderId);
+
+    const isFirstIteration = !processedImports.length;
+    sanitizedImports.forEach(({ importPath, importEnv, id, folderId }, i) => {
+      const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
+      const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
+        .filter((item) =>
+          hasSecretAccess(
+            importEnv.slug,
+            importPath,
+            item.key,
+            item.tags.map((el) => el.slug)
+          )
+        )
+        .map((item) => ({
+          ...item,
+          secretKey: item.key,
+          secretValue: decryptor(item.encryptedValue),
+          secretComment: decryptor(item.encryptedComment),
+          environment: importEnv.slug,
+          workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+          _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+        }));
+
+      if (deeperImportsGroupByFolderId?.[sourceImportFolder?.id || ""]) {
+        stack.push({
+          secretImports: deeperImportsGroupByFolderId[sourceImportFolder?.id || ""],
+          depth: depth + 1,
+          parentImportedSecrets: secretsWithDuplicate
+        });
+      }
+
+      if (isFirstIteration) {
+        processedImports.push({
+          secretPath: importPath,
+          environment: importEnv.slug,
+          environmentInfo: importEnv,
+          folderId: importedFolders?.[i]?.id,
+          id,
+          importFolderId: folderId,
+          secrets: secretsWithDuplicate
+        });
+      } else {
+        parentImportedSecrets.push(...secretsWithDuplicate);
+      }
    });
  }
-  const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId);
-
-  const processedImports = allowedImports.map(({ importPath, importEnv, id, folderId }, i) => {
-    const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
-    const folderDeeperImportSecrets =
-      secretsFromdeeperImportGroupedByFolderId?.[sourceImportFolder?.id || ""]?.[0]?.secrets || [];
-    const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
-      .map((item) => ({
-        ...item,
-        secretKey: item.key,
-        secretValue: decryptor(item.encryptedValue),
-        secretComment: decryptor(item.encryptedComment),
-        environment: importEnv.slug,
-        workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-        _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-      }))
-      .concat(folderDeeperImportSecrets);
-
-    return {
-      secretPath: importPath,
-      environment: importEnv.slug,
-      environmentInfo: importEnv,
-      folderId: importedFolders?.[i]?.id,
-      id,
-      importFolderId: folderId,
-      secrets: unique(secretsWithDuplicate, (el) => el.secretKey)
-    };
-  });
-
+  /* eslint-enable */
  if (expandSecretReferences) {
    await Promise.allSettled(
-      processedImports.map((processedImport) =>
-        Promise.allSettled(
+      processedImports.map((processedImport) => {
+        // eslint-disable-next-line
+        processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
+        return Promise.allSettled(
          processedImport.secrets.map(async (decryptedSecret, index) => {
            const expandedSecretValue = await expandSecretReferences({
              value: decryptedSecret.secretValue,
@@ -260,8 +274,8 @@ export const fnSecretsV2FromImports = async ({
            // eslint-disable-next-line no-param-reassign
            processedImport.secrets[index].secretValue = expandedSecretValue || "";
          })
-        )
-      )
+        );
+      })
    );
  }