Revert "Revert "Permission phase 2""

This reverts commit 8b9244b079.

backend/e2e-test/routes/v3/secret-reference.spec.ts

@@ -56,7 +56,10 @@ describe("Secret expansion", () => {
       }
     ];
 
-    await Promise.all(secrets.map((el) => createSecretV2(el)));
+    for (const secret of secrets) {
+      // eslint-disable-next-line no-await-in-loop
+      await createSecretV2(secret);
+    }
 
     const expandedSecret = await getSecretByNameV2({
       environmentSlug: seedData1.environment.slug,
@@ -123,7 +126,10 @@ describe("Secret expansion", () => {
       }
     ];
 
-    await Promise.all(secrets.map((el) => createSecretV2(el)));
+    for (const secret of secrets) {
+      // eslint-disable-next-line no-await-in-loop
+      await createSecretV2(secret);
+    }
 
     const expandedSecret = await getSecretByNameV2({
       environmentSlug: seedData1.environment.slug,
@@ -190,7 +196,11 @@ describe("Secret expansion", () => {
       }
     ];
 
-    await Promise.all(secrets.map((el) => createSecretV2(el)));
+    for (const secret of secrets) {
+      // eslint-disable-next-line no-await-in-loop
+      await createSecretV2(secret);
+    }
+
     const secretImportFromProdToDev = await createSecretImport({
       environmentSlug: seedData1.environment.slug,
       workspaceId: projectId,
@@ -275,7 +285,11 @@ describe("Secret expansion", () => {
         }
       ];
 
-      await Promise.all(secrets.map((el) => createSecretV2(el)));
+      for (const secret of secrets) {
+        // eslint-disable-next-line no-await-in-loop
+        await createSecretV2(secret);
+      }
+
       const secretImportFromProdToDev = await createSecretImport({
         environmentSlug: seedData1.environment.slug,
         workspaceId: projectId,

backend/src/db/migrations/20240925100349_managed-secret-sharing.ts

@@ -4,27 +4,40 @@ import { TableName } from "../schemas";
 
 export async function up(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.SecretSharing)) {
+    const hasEncryptedSecret = await knex.schema.hasColumn(TableName.SecretSharing, "encryptedSecret");
+    const hasIdentifier = await knex.schema.hasColumn(TableName.SecretSharing, "identifier");
+
     await knex.schema.alterTable(TableName.SecretSharing, (t) => {
       t.string("iv").nullable().alter();
       t.string("tag").nullable().alter();
       t.string("encryptedValue").nullable().alter();
 
-      t.binary("encryptedSecret").nullable();
+      if (!hasEncryptedSecret) {
+        t.binary("encryptedSecret").nullable();
+      }
       t.string("hashedHex").nullable().alter();
 
-      t.string("identifier", 64).nullable();
+      if (!hasIdentifier) {
-      t.unique("identifier");
+        t.string("identifier", 64).nullable();
-      t.index("identifier");
+        t.unique("identifier");
+        t.index("identifier");
+      }
     });
   }
 }
 
 export async function down(knex: Knex): Promise<void> {
+  const hasEncryptedSecret = await knex.schema.hasColumn(TableName.SecretSharing, "encryptedSecret");
+  const hasIdentifier = await knex.schema.hasColumn(TableName.SecretSharing, "identifier");
   if (await knex.schema.hasTable(TableName.SecretSharing)) {
     await knex.schema.alterTable(TableName.SecretSharing, (t) => {
-      t.dropColumn("encryptedSecret");
+      if (hasEncryptedSecret) {
+        t.dropColumn("encryptedSecret");
+      }
 
-      t.dropColumn("identifier");
+      if (hasIdentifier) {
+        t.dropColumn("identifier");
+      }
     });
   }
 }

backend/src/db/migrations/20241003220151_kms-key-cmek-alterations.ts

@@ -7,15 +7,18 @@ export async function up(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.KmsKey)) {
     const hasOrgId = await knex.schema.hasColumn(TableName.KmsKey, "orgId");
     const hasSlug = await knex.schema.hasColumn(TableName.KmsKey, "slug");
+    const hasProjectId = await knex.schema.hasColumn(TableName.KmsKey, "projectId");
 
     // drop constraint if exists (won't exist if rolled back, see below)
     await dropConstraintIfExists(TableName.KmsKey, "kms_keys_orgid_slug_unique", knex);
 
     // projectId for CMEK functionality
     await knex.schema.alterTable(TableName.KmsKey, (table) => {
-      table.string("projectId").nullable().references("id").inTable(TableName.Project).onDelete("CASCADE");
+      if (!hasProjectId) {
+        table.string("projectId").nullable().references("id").inTable(TableName.Project).onDelete("CASCADE");
+      }
 
-      if (hasOrgId) {
+      if (hasOrgId && hasSlug) {
         table.unique(["orgId", "projectId", "slug"]);
       }
 
@@ -30,6 +33,7 @@ export async function down(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.KmsKey)) {
     const hasOrgId = await knex.schema.hasColumn(TableName.KmsKey, "orgId");
     const hasName = await knex.schema.hasColumn(TableName.KmsKey, "name");
+    const hasProjectId = await knex.schema.hasColumn(TableName.KmsKey, "projectId");
 
     // remove projectId for CMEK functionality
     await knex.schema.alterTable(TableName.KmsKey, (table) => {
@@ -40,7 +44,9 @@ export async function down(knex: Knex): Promise<void> {
       if (hasOrgId) {
         table.dropUnique(["orgId", "projectId", "slug"]);
       }
-      table.dropColumn("projectId");
+      if (hasProjectId) {
+        table.dropColumn("projectId");
+      }
     });
   }
 }

backend/src/db/migrations/20241008172622_project-permission-split.ts

@@ -0,0 +1,101 @@
+/* eslint-disable no-await-in-loop */
+import { packRules, unpackRules } from "@casl/ability/extra";
+import { Knex } from "knex";
+
+import {
+  backfillPermissionV1SchemaToV2Schema,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
+
+import { TableName } from "../schemas";
+
+const CHUNK_SIZE = 1000;
+export async function up(knex: Knex): Promise<void> {
+  const hasVersion = await knex.schema.hasColumn(TableName.ProjectRoles, "version");
+  if (!hasVersion) {
+    await knex.schema.alterTable(TableName.ProjectRoles, (t) => {
+      t.integer("version").defaultTo(1).notNullable();
+    });
+
+    const docs = await knex(TableName.ProjectRoles).select("*");
+    const updatedDocs = docs
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (updatedDocs.length) {
+      for (let i = 0; i < updatedDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.ProjectRoles).insert(chunk).onConflict("id").merge();
+      }
+    }
+
+    // secret permission is split into multiple ones like secrets, folders, imports and dynamic-secrets
+    // so we just find all the privileges with respective mapping and map it as needed
+    const identityPrivileges = await knex(TableName.IdentityProjectAdditionalPrivilege).select("*");
+    const updatedIdentityPrivilegesDocs = identityPrivileges
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets) &&
+          !permissionString.includes(ProjectPermissionSub.SecretFolders)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (updatedIdentityPrivilegesDocs.length) {
+      for (let i = 0; i < updatedIdentityPrivilegesDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedIdentityPrivilegesDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.IdentityProjectAdditionalPrivilege).insert(chunk).onConflict("id").merge();
+      }
+    }
+
+    const userPrivileges = await knex(TableName.ProjectUserAdditionalPrivilege).select("*");
+    const updatedUserPrivilegeDocs = userPrivileges
+      .filter((i) => {
+        const permissionString = JSON.stringify(i.permissions || []);
+        return (
+          !permissionString.includes(ProjectPermissionSub.SecretImports) &&
+          !permissionString.includes(ProjectPermissionSub.DynamicSecrets) &&
+          !permissionString.includes(ProjectPermissionSub.SecretFolders)
+        );
+      })
+      .map((el) => ({
+        ...el,
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(unpackRules(el.permissions))))
+      }));
+    if (docs.length) {
+      for (let i = 0; i < updatedUserPrivilegeDocs.length; i += CHUNK_SIZE) {
+        const chunk = updatedUserPrivilegeDocs.slice(i, i + CHUNK_SIZE);
+        await knex(TableName.ProjectUserAdditionalPrivilege).insert(chunk).onConflict("id").merge();
+      }
+    }
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasVersion = await knex.schema.hasColumn(TableName.ProjectRoles, "version");
+  if (hasVersion) {
+    await knex.schema.alterTable(TableName.ProjectRoles, (t) => {
+      t.dropColumn("version");
+    });
+
+    // permission change can be ignored
+  }
+}

backend/src/ee/routes/v1/identity-project-additional-privilege-router.ts

@@ -4,6 +4,7 @@ import ms from "ms";
 import { z } from "zod";
 
 import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-types";
+import { backfillPermissionV1SchemaToV2Schema } from "@app/ee/services/permission/project-permission";
 import { IDENTITY_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -79,7 +80,9 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         ...req.body,
         slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
         isTemporary: false,
-        permissions: JSON.stringify(packRules(permission))
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
       });
       return { privilege };
     }
@@ -159,7 +162,9 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         ...req.body,
         slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
         isTemporary: true,
-        permissions: JSON.stringify(packRules(permission))
+        // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+        // @ts-ignore-error this is valid ts
+        permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
       });
       return { privilege };
     }
@@ -244,7 +249,11 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         projectSlug: req.body.projectSlug,
         data: {
           ...updatedInfo,
-          permissions: permission ? JSON.stringify(packRules(permission)) : undefined
+          permissions: permission
+            ? // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+              // @ts-ignore-error this is valid ts
+              JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(permission)))
+            : undefined
         }
       });
       return { privilege };

backend/src/ee/routes/v1/project-role-router.ts

@@ -3,7 +3,10 @@ import slugify from "@sindresorhus/slugify";
 import { z } from "zod";
 
 import { ProjectMembershipRole, ProjectMembershipsSchema, ProjectRolesSchema } from "@app/db/schemas";
-import { ProjectPermissionSchema } from "@app/ee/services/permission/project-permission";
+import {
+  backfillPermissionV1SchemaToV2Schema,
+  ProjectPermissionV1Schema
+} from "@app/ee/services/permission/project-permission";
 import { PROJECT_ROLE } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -43,7 +46,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
           .describe(PROJECT_ROLE.CREATE.slug),
         name: z.string().min(1).trim().describe(PROJECT_ROLE.CREATE.name),
         description: z.string().trim().optional().describe(PROJECT_ROLE.CREATE.description),
-        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.CREATE.permissions)
+        permissions: ProjectPermissionV1Schema.array().describe(PROJECT_ROLE.CREATE.permissions)
       }),
       response: {
         200: z.object({
@@ -61,7 +64,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
         projectSlug: req.params.projectSlug,
         data: {
           ...req.body,
-          permissions: JSON.stringify(packRules(req.body.permissions))
+          permissions: JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions)))
         }
       });
       return { role };
@@ -103,7 +106,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
           }),
         name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
         description: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.description),
-        permissions: ProjectPermissionSchema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
+        permissions: ProjectPermissionV1Schema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
       }),
       response: {
         200: z.object({
@@ -122,7 +125,9 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
         roleId: req.params.roleId,
         data: {
           ...req.body,
-          permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
+          permissions: req.body.permissions
+            ? JSON.stringify(packRules(backfillPermissionV1SchemaToV2Schema(req.body.permissions)))
+            : undefined
         }
       });
       return { role };

backend/src/ee/routes/v1/user-additional-privilege-router.ts

@@ -1,13 +1,16 @@
+import { packRules } from "@casl/ability/extra";
 import slugify from "@sindresorhus/slugify";
 import ms from "ms";
 import { z } from "zod";
 
 import { ProjectUserAdditionalPrivilegeSchema } from "@app/db/schemas";
+import { backfillPermissionV1SchemaToV2Schema } from "@app/ee/services/permission/project-permission";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
 import { PROJECT_USER_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { ProjectSpecificPrivilegePermissionSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodProvider) => {
@@ -31,7 +34,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
           })
           .optional()
           .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.slug),
-        permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions)
+        permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+          PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions
+        )
       }),
       response: {
         200: z.object({
@@ -49,7 +54,17 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
         ...req.body,
         slug: req.body.slug ? slugify(req.body.slug) : slugify(alphaNumericNanoId(12)),
         isTemporary: false,
-        permissions: JSON.stringify(req.body.permissions)
+        permissions: JSON.stringify(
+          packRules(
+            backfillPermissionV1SchemaToV2Schema(
+              req.body.permissions.actions.map((action) => ({
+                action,
+                subject: req.body.permissions.subject,
+                conditions: req.body.permissions.conditions
+              }))
+            )
+          )
+        )
       });
       return { privilege };
     }
@@ -75,7 +90,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
           })
           .optional()
           .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.slug),
-        permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions),
+        permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+          PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions
+        ),
         temporaryMode: z
           .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
           .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.temporaryMode),
@@ -104,7 +121,17 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
         ...req.body,
         slug: req.body.slug ? slugify(req.body.slug) : `privilege-${slugify(alphaNumericNanoId(12))}`,
         isTemporary: true,
-        permissions: JSON.stringify(req.body.permissions)
+        permissions: JSON.stringify(
+          packRules(
+            backfillPermissionV1SchemaToV2Schema(
+              req.body.permissions.actions.map((action) => ({
+                action,
+                subject: req.body.permissions.subject,
+                conditions: req.body.permissions.conditions
+              }))
+            )
+          )
+        )
       });
       return { privilege };
     }
@@ -131,7 +158,9 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
               message: "Slug must be a valid slug"
             })
             .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.slug),
-          permissions: z.any().array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions),
+          permissions: ProjectSpecificPrivilegePermissionSchema.describe(
+            PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions
+          ).optional(),
           isTemporary: z.boolean().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.isTemporary),
           temporaryMode: z
             .nativeEnum(ProjectUserAdditionalPrivilegeTemporaryMode)
@@ -160,7 +189,19 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
         actorOrgId: req.permission.orgId,
         actorAuthMethod: req.permission.authMethod,
         ...req.body,
-        permissions: req.body.permissions ? JSON.stringify(req.body.permissions) : undefined,
+        permissions: req.body.permissions
+          ? JSON.stringify(
+              packRules(
+                backfillPermissionV1SchemaToV2Schema(
+                  req.body.permissions.actions.map((action) => ({
+                    action,
+                    subject: req.body.permissions!.subject,
+                    conditions: req.body.permissions!.conditions
+                  }))
+                )
+              )
+            )
+          : undefined,
         privilegeId: req.params.privilegeId
       });
       return { privilege };

backend/src/ee/routes/v2/index.ts

@@ -0,0 +1,11 @@
+import { registerProjectRoleRouter } from "./project-role-router";
+
+export const registerV2EERoutes = async (server: FastifyZodProvider) => {
+  // org role starts with organization
+  await server.register(
+    async (projectRouter) => {
+      await projectRouter.register(registerProjectRoleRouter);
+    },
+    { prefix: "/workspace" }
+  );
+};

backend/src/ee/routes/v2/project-role-router.ts

@@ -0,0 +1,272 @@
+import { packRules } from "@casl/ability/extra";
+import slugify from "@sindresorhus/slugify";
+import { z } from "zod";
+
+import { ProjectMembershipRole, ProjectMembershipsSchema, ProjectRolesSchema } from "@app/db/schemas";
+import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
+import { PROJECT_ROLE } from "@app/lib/api-docs";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { SanitizedRoleSchema } from "@app/server/routes/sanitizedSchemas";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/:projectSlug/roles",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Create a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.CREATE.projectSlug)
+      }),
+      body: z.object({
+        slug: z
+          .string()
+          .toLowerCase()
+          .trim()
+          .min(1)
+          .refine(
+            (val) => !Object.values(ProjectMembershipRole).includes(val as ProjectMembershipRole),
+            "Please choose a different slug, the slug you have entered is reserved"
+          )
+          .refine((v) => slugify(v) === v, {
+            message: "Slug must be a valid"
+          })
+          .describe(PROJECT_ROLE.CREATE.slug),
+        name: z.string().min(1).trim().describe(PROJECT_ROLE.CREATE.name),
+        description: z.string().trim().optional().describe(PROJECT_ROLE.CREATE.description),
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.CREATE.permissions)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.createRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        data: {
+          ...req.body,
+          permissions: JSON.stringify(packRules(req.body.permissions))
+        }
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:projectSlug/roles/:roleId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Update a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.UPDATE.projectSlug),
+        roleId: z.string().trim().describe(PROJECT_ROLE.UPDATE.roleId)
+      }),
+      body: z.object({
+        slug: z
+          .string()
+          .toLowerCase()
+          .trim()
+          .optional()
+          .describe(PROJECT_ROLE.UPDATE.slug)
+          .refine(
+            (val) =>
+              typeof val === "undefined" ||
+              !Object.values(ProjectMembershipRole).includes(val as ProjectMembershipRole),
+            "Please choose a different slug, the slug you have entered is reserved"
+          )
+          .refine((val) => typeof val === "undefined" || slugify(val) === val, {
+            message: "Slug must be a valid"
+          }),
+        name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
+        description: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.description),
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.updateRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleId: req.params.roleId,
+        data: {
+          ...req.body,
+          permissions: req.body.permissions ? JSON.stringify(packRules(req.body.permissions)) : undefined
+        }
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "DELETE",
+    url: "/:projectSlug/roles/:roleId",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      description: "Delete a project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.DELETE.projectSlug),
+        roleId: z.string().trim().describe(PROJECT_ROLE.DELETE.roleId)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.deleteRole({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleId: req.params.roleId
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectSlug/roles",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      description: "List project role",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.LIST.projectSlug)
+      }),
+      response: {
+        200: z.object({
+          roles: ProjectRolesSchema.omit({ permissions: true }).array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const roles = await server.services.projectRole.listRoles({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug
+      });
+      return { roles };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectSlug/roles/slug/:roleSlug",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        projectSlug: z.string().trim().describe(PROJECT_ROLE.GET_ROLE_BY_SLUG.projectSlug),
+        roleSlug: z.string().trim().describe(PROJECT_ROLE.GET_ROLE_BY_SLUG.roleSlug)
+      }),
+      response: {
+        200: z.object({
+          role: SanitizedRoleSchema
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const role = await server.services.projectRole.getRoleBySlug({
+        actorAuthMethod: req.permission.authMethod,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actor: req.permission.type,
+        projectSlug: req.params.projectSlug,
+        roleSlug: req.params.roleSlug
+      });
+      return { role };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:projectId/permissions",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        projectId: z.string().trim()
+      }),
+      response: {
+        200: z.object({
+          data: z.object({
+            membership: ProjectMembershipsSchema.extend({
+              roles: z
+                .object({
+                  role: z.string()
+                })
+                .array()
+            }),
+            permissions: z.any().array()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { permissions, membership } = await server.services.projectRole.getUserPermission(
+        req.permission.id,
+        req.params.projectId,
+        req.permission.authMethod,
+        req.permission.orgId
+      );
+
+      return { data: { permissions, membership } };
+    }
+  });
+};

backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts

@@ -14,7 +14,7 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => {
 
   const accessApprovalPolicyFindQuery = async (
     tx: Knex,
-    filter: TFindFilter<TAccessApprovalPolicies>,
+    filter: TFindFilter<TAccessApprovalPolicies & { projectId: string }>,
     customFilter?: {
       policyId?: string;
     }

backend/src/ee/services/access-approval-policy/access-approval-policy-fns.ts

@@ -1,36 +0,0 @@
-import { ForbiddenError, subject } from "@casl/ability";
-
-import { ActorType } from "@app/services/auth/auth-type";
-
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
-import { TIsApproversValid } from "./access-approval-policy-types";
-
-export const isApproversValid = async ({
-  userIds,
-  projectId,
-  orgId,
-  envSlug,
-  actorAuthMethod,
-  secretPath,
-  permissionService
-}: TIsApproversValid) => {
-  try {
-    for await (const userId of userIds) {
-      const { permission: approverPermission } = await permissionService.getProjectPermission(
-        ActorType.USER,
-        userId,
-        projectId,
-        actorAuthMethod,
-        orgId
-      );
-
-      ForbiddenError.from(approverPermission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.Secrets, { environment: envSlug, secretPath })
-      );
-    }
-  } catch {
-    return false;
-  }
-  return true;
-};

backend/src/ee/services/access-approval-policy/access-approval-policy-service.ts

@@ -11,7 +11,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TAccessApprovalPolicyApproverDALFactory } from "./access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "./access-approval-policy-dal";
-import { isApproversValid } from "./access-approval-policy-fns";
 import {
   ApproverType,
   TCreateAccessApprovalPolicy,
@@ -134,22 +133,6 @@ export const accessApprovalPolicyServiceFactory = ({
       .map((user) => user.id);
     verifyAllApprovers.push(...verifyGroupApprovers);
 
-    const approversValid = await isApproversValid({
-      projectId: project.id,
-      orgId: actorOrgId,
-      envSlug: environment,
-      secretPath,
-      actorAuthMethod,
-      permissionService,
-      userIds: verifyAllApprovers
-    });
-
-    if (!approversValid) {
-      throw new BadRequestError({
-        message: "One or more approvers doesn't have access to be specified secret path"
-      });
-    }
-
     const accessApproval = await accessApprovalPolicyDAL.transaction(async (tx) => {
       const doc = await accessApprovalPolicyDAL.create(
         {
@@ -293,22 +276,6 @@ export const accessApprovalPolicyServiceFactory = ({
           userApproverIds = userApproverIds.concat(approverUsers.map((user) => user.id));
         }
 
-        const approversValid = await isApproversValid({
-          projectId: accessApprovalPolicy.projectId,
-          orgId: actorOrgId,
-          envSlug: accessApprovalPolicy.environment.slug,
-          secretPath: doc.secretPath!,
-          actorAuthMethod,
-          permissionService,
-          userIds: userApproverIds
-        });
-
-        if (!approversValid) {
-          throw new BadRequestError({
-            message: "One or more approvers doesn't have access to be specified secret path"
-          });
-        }
-
         await accessApprovalPolicyApproverDAL.insertMany(
           userApproverIds.map((userId) => ({
             approverUserId: userId,
@@ -319,45 +286,6 @@ export const accessApprovalPolicyServiceFactory = ({
       }
 
       if (groupApprovers) {
-        const usersPromises: Promise<
-          {
-            id: string;
-            email: string | null | undefined;
-            username: string;
-            firstName: string | null | undefined;
-            lastName: string | null | undefined;
-            isPartOfGroup: boolean;
-          }[]
-        >[] = [];
-
-        for (const groupId of groupApprovers) {
-          usersPromises.push(
-            groupDAL
-              .findAllGroupPossibleMembers({ orgId: actorOrgId, groupId, offset: 0 })
-              .then((group) => group.members)
-          );
-        }
-        const verifyGroupApprovers = (await Promise.all(usersPromises))
-          .flat()
-          .filter((user) => user.isPartOfGroup)
-          .map((user) => user.id);
-
-        const approversValid = await isApproversValid({
-          projectId: accessApprovalPolicy.projectId,
-          orgId: actorOrgId,
-          envSlug: accessApprovalPolicy.environment.slug,
-          secretPath: doc.secretPath!,
-          actorAuthMethod,
-          permissionService,
-          userIds: verifyGroupApprovers
-        });
-
-        if (!approversValid) {
-          throw new BadRequestError({
-            message: "One or more approvers doesn't have access to be specified secret path"
-          });
-        }
-
         await accessApprovalPolicyApproverDAL.insertMany(
           groupApprovers.map((groupId) => ({
             approverGroupId: groupId,

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -17,7 +17,6 @@ import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-policy/access-approval-policy-approver-dal";
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
-import { isApproversValid } from "../access-approval-policy/access-approval-policy-fns";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -78,7 +77,6 @@ export const accessApprovalRequestServiceFactory = ({
   permissionService,
   accessApprovalRequestDAL,
   accessApprovalRequestReviewerDAL,
-  projectMembershipDAL,
   accessApprovalPolicyDAL,
   accessApprovalPolicyApproverDAL,
   additionalPrivilegeDAL,
@@ -331,22 +329,6 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
     }
 
-    const reviewerProjectMembership = await projectMembershipDAL.findById(membership.id);
-
-    const approversValid = await isApproversValid({
-      projectId: accessApprovalRequest.projectId,
-      orgId: actorOrgId,
-      envSlug: accessApprovalRequest.environment,
-      secretPath: accessApprovalRequest.policy.secretPath!,
-      actorAuthMethod,
-      permissionService,
-      userIds: [reviewerProjectMembership.userId]
-    });
-
-    if (!approversValid) {
-      throw new ForbiddenRequestError({ message: "You don't have access to approve this request" });
-    }
-
     const existingReviews = await accessApprovalRequestReviewerDAL.find({ requestId: accessApprovalRequest.id });
     if (existingReviews.some((review) => review.status === ApprovalStatus.REJECTED)) {
       throw new BadRequestError({ message: "The request has already been rejected by another reviewer" });

backend/src/ee/services/dynamic-secret-lease/dynamic-secret-lease-service.ts

@@ -4,7 +4,10 @@ import ms from "ms";
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -72,8 +75,8 @@ export const dynamicSecretLeaseServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionDynamicSecretActions.Lease,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -151,8 +154,8 @@ export const dynamicSecretLeaseServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionDynamicSecretActions.Lease,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -230,8 +233,8 @@ export const dynamicSecretLeaseServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Delete,
+      ProjectPermissionDynamicSecretActions.Lease,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -299,8 +302,8 @@ export const dynamicSecretLeaseServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionDynamicSecretActions.Lease,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -341,8 +344,8 @@ export const dynamicSecretLeaseServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionDynamicSecretActions.Lease,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);

backend/src/ee/services/dynamic-secret/dynamic-secret-service.ts

@@ -3,7 +3,10 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { SecretKeyEncoding } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection } from "@app/lib/types";
@@ -77,8 +80,8 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -148,8 +151,8 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -231,8 +234,8 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -291,8 +294,12 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Edit,
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -340,8 +347,8 @@ export const dynamicSecretServiceFactory = ({
       // verify user has access to each env in request
       environmentSlugs.forEach((environmentSlug) =>
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Read,
+          ProjectPermissionDynamicSecretActions.ReadRootCredential,
-          subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
         )
       );
     }
@@ -380,8 +387,8 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -428,8 +435,8 @@ export const dynamicSecretServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
-      subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+      subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environmentSlug, path);
@@ -471,8 +478,8 @@ export const dynamicSecretServiceFactory = ({
       // verify user has access to each env in request
       environmentSlugs.forEach((environmentSlug) =>
         ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Read,
+          ProjectPermissionDynamicSecretActions.ReadRootCredential,
-          subject(ProjectPermissionSub.Secrets, { environment: environmentSlug, secretPath: path })
+          subject(ProjectPermissionSub.DynamicSecrets, { environment: environmentSlug, secretPath: path })
         )
       );
     }

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -1,10 +1,10 @@
 import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
-import { z } from "zod";
 
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
@@ -32,16 +32,6 @@ export type TIdentityProjectAdditionalPrivilegeServiceFactory = ReturnType<
   typeof identityProjectAdditionalPrivilegeServiceFactory
 >;
 
-// TODO(akhilmhdh): move this to more centralized
-export const UnpackedPermissionSchema = z.object({
-  subject: z
-    .union([z.string().min(1), z.string().array()])
-    .transform((el) => (typeof el !== "string" ? el[0] : el))
-    .optional(),
-  action: z.union([z.string().min(1), z.string().array()]).transform((el) => (typeof el === "string" ? [el] : el)),
-  conditions: z.unknown().optional()
-});
-
 const unpackPermissions = (permissions: unknown) =>
   UnpackedPermissionSchema.array().parse(
     unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
@@ -207,7 +197,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     });
     return {
       ...additionalPrivilege,
-
       permissions: unpackPermissions(additionalPrivilege.permissions)
     };
   };
@@ -335,7 +324,6 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     });
     return identityPrivileges.map((el) => ({
       ...el,
-
       permissions: unpackPermissions(el.permissions)
     }));
   };

backend/src/ee/services/permission/permission-service.ts

@@ -67,7 +67,7 @@ export const permissionServiceFactory = ({
             throw new NotFoundError({ name: "OrgRoleInvalid", message: `Organization role '${role}' not found` });
         }
       })
-      .reduce((curr, prev) => prev.concat(curr), []);
+      .reduce((prev, curr) => prev.concat(curr), []);
 
     return createMongoAbility<OrgPermissionSet>(rules, {
       conditionsMatcher
@@ -98,7 +98,7 @@ export const permissionServiceFactory = ({
             });
         }
       })
-      .reduce((curr, prev) => prev.concat(curr), []);
+      .reduce((prev, curr) => prev.concat(curr), []);
 
     return rules;
   };

backend/src/ee/services/permission/permission-types.ts

@@ -11,8 +11,8 @@ export enum PermissionConditionOperators {
 }
 
 export const PermissionConditionSchema = {
-  [PermissionConditionOperators.$IN]: z.string().min(1).array(),
+  [PermissionConditionOperators.$IN]: z.string().trim().min(1).array(),
-  [PermissionConditionOperators.$ALL]: z.string().min(1).array(),
+  [PermissionConditionOperators.$ALL]: z.string().trim().min(1).array(),
   [PermissionConditionOperators.$REGEX]: z
     .string()
     .min(1)

backend/src/ee/services/permission/project-permission.ts

@@ -1,9 +1,8 @@
 import { AbilityBuilder, createMongoAbility, ForcedSubject, MongoAbility } from "@casl/ability";
 import { z } from "zod";
 
-import { TableName } from "@app/db/schemas";
 import { conditionsMatcher } from "@app/lib/casl";
-import { BadRequestError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 
 import { PermissionConditionOperators, PermissionConditionSchema } from "./permission-types";
 
@@ -23,6 +22,14 @@ export enum ProjectPermissionCmekActions {
   Decrypt = "decrypt"
 }
 
+export enum ProjectPermissionDynamicSecretActions {
+  ReadRootCredential = "read-root-credential",
+  CreateRootCredential = "create-root-credential",
+  EditRootCredential = "edit-root-credential",
+  DeleteRootCredential = "delete-root-credential",
+  Lease = "lease"
+}
+
 export enum ProjectPermissionSub {
   Role = "role",
   Member = "member",
@@ -38,6 +45,8 @@ export enum ProjectPermissionSub {
   Project = "workspace",
   Secrets = "secrets",
   SecretFolders = "secret-folders",
+  SecretImports = "secret-imports",
+  DynamicSecrets = "dynamic-secrets",
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
@@ -54,19 +63,8 @@ export enum ProjectPermissionSub {
 export type SecretSubjectFields = {
   environment: string;
   secretPath: string;
-  // secretName: string;
+  secretName?: string;
-  // secretTags: string[];
+  secretTags?: string[];
-};
-
-export const CaslSecretsV2SubjectKnexMapper = (field: string) => {
-  switch (field) {
-    case "secretName":
-      return `${TableName.SecretV2}.key`;
-    case "secretTags":
-      return `${TableName.SecretTag}.slug`;
-    default:
-      break;
-  }
 };
 
 export type SecretFolderSubjectFields = {
@@ -74,6 +72,16 @@ export type SecretFolderSubjectFields = {
   secretPath: string;
 };
 
+export type DynamicSecretSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
+export type SecretImportSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
 export type ProjectPermissionSet =
   | [
       ProjectPermissionActions,
@@ -86,6 +94,20 @@ export type ProjectPermissionSet =
         | (ForcedSubject<ProjectPermissionSub.SecretFolders> & SecretFolderSubjectFields)
       )
     ]
+  | [
+      ProjectPermissionDynamicSecretActions,
+      (
+        | ProjectPermissionSub.DynamicSecrets
+        | (ForcedSubject<ProjectPermissionSub.DynamicSecrets> & DynamicSecretSubjectFields)
+      )
+    ]
+  | [
+      ProjectPermissionActions,
+      (
+        | ProjectPermissionSub.SecretImports
+        | (ForcedSubject<ProjectPermissionSub.SecretImports> & SecretImportSubjectFields)
+      )
+    ]
   | [ProjectPermissionActions, ProjectPermissionSub.Role]
   | [ProjectPermissionActions, ProjectPermissionSub.Tags]
   | [ProjectPermissionActions, ProjectPermissionSub.Member]
@@ -120,7 +142,9 @@ const CASL_ACTION_SCHEMA_NATIVE_ENUM = <ACTION extends z.EnumLike>(actions: ACTI
 const CASL_ACTION_SCHEMA_ENUM = <ACTION extends z.EnumValues>(actions: ACTION) =>
   z.union([z.enum(actions), z.enum(actions).array().min(1)]).transform((el) => (typeof el === "string" ? [el] : el));
 
-const SecretConditionSchema = z
+// akhilmhdh: don't modify this for v2
+// if you want to update create a new schema
+const SecretConditionV1Schema = z
   .object({
     environment: z.union([
       z.string(),
@@ -146,16 +170,50 @@ const SecretConditionSchema = z
   })
   .partial();
 
-export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
+const SecretConditionV2Schema = z
-  z.object({
+  .object({
-    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
+    environment: z.union([
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      z.string(),
-      "Describe what action an entity can take."
+      z
-    ),
+        .object({
-    conditions: SecretConditionSchema.describe(
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
-      "When specified, only matching conditions will be allowed to access given resource."
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
-    ).optional()
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
-  }),
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretPath: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretName: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$NEQ]: PermissionConditionSchema[PermissionConditionOperators.$NEQ],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB]
+        })
+        .partial()
+    ]),
+    secretTags: z
+      .object({
+        [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+      })
+      .partial()
+  })
+  .partial();
+
+const GeneralPermissionSchema = [
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
@@ -259,7 +317,7 @@ export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
     )
   }),
   z.object({
-    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to. "),
+    subject: z.literal(ProjectPermissionSub.CertificateTemplates).describe("The entity this permission pertains to."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
       "Describe what action an entity can take."
     )
@@ -288,18 +346,78 @@ export const ProjectPermissionSchema = z.discriminatedUnion("subject", [
       "Describe what action an entity can take."
     )
   }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_ENUM([ProjectPermissionActions.Read]).describe(
-      "Describe what action an entity can take."
-    )
-  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.Cmek).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCmekActions).describe(
       "Describe what action an entity can take."
     )
   })
+];
+
+export const ProjectPermissionV1Schema = z.discriminatedUnion("subject", [
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_ENUM([ProjectPermissionActions.Read]).describe(
+      "Describe what action an entity can take."
+    )
+  }),
+  ...GeneralPermissionSchema
+]);
+
+export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
+  z.object({
+    subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV2Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretFolders).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.SecretImports).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.DynamicSecrets).describe("The entity this permission pertains to."),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionDynamicSecretActions).describe(
+      "Describe what action an entity can take."
+    ),
+    conditions: SecretConditionV1Schema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
+  ...GeneralPermissionSchema
 ]);
 
 const buildAdminPermissionRules = () => {
@@ -308,6 +426,8 @@ const buildAdminPermissionRules = () => {
   // Admins get full access to everything
   [
     ProjectPermissionSub.Secrets,
+    ProjectPermissionSub.SecretFolders,
+    ProjectPermissionSub.SecretImports,
     ProjectPermissionSub.SecretApproval,
     ProjectPermissionSub.SecretRotation,
     ProjectPermissionSub.Member,
@@ -339,6 +459,17 @@ const buildAdminPermissionRules = () => {
     );
   });
 
+  can(
+    [
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
+      ProjectPermissionDynamicSecretActions.Lease
+    ],
+    ProjectPermissionSub.DynamicSecrets
+  );
+
   can([ProjectPermissionActions.Edit, ProjectPermissionActions.Delete], ProjectPermissionSub.Project);
   can([ProjectPermissionActions.Read, ProjectPermissionActions.Create], ProjectPermissionSub.SecretRollback);
   can([ProjectPermissionActions.Edit], ProjectPermissionSub.Kms);
@@ -370,6 +501,34 @@ const buildMemberPermissionRules = () => {
     ],
     ProjectPermissionSub.Secrets
   );
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
+    ],
+    ProjectPermissionSub.SecretFolders
+  );
+  can(
+    [
+      ProjectPermissionDynamicSecretActions.ReadRootCredential,
+      ProjectPermissionDynamicSecretActions.EditRootCredential,
+      ProjectPermissionDynamicSecretActions.CreateRootCredential,
+      ProjectPermissionDynamicSecretActions.DeleteRootCredential,
+      ProjectPermissionDynamicSecretActions.Lease
+    ],
+    ProjectPermissionSub.DynamicSecrets
+  );
+  can(
+    [
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
+    ],
+    ProjectPermissionSub.SecretImports
+  );
 
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretApproval);
   can([ProjectPermissionActions.Read], ProjectPermissionSub.SecretRotation);
@@ -493,6 +652,9 @@ const buildViewerPermissionRules = () => {
   const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
 
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
+  can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretApproval);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRotation);
@@ -595,17 +757,52 @@ export const isAtLeastAsPrivilegedWorkspace = (
 };
 /* eslint-enable */
 
-export const SecretV2SubjectFieldMapper = (arg: string) => {
+export const backfillPermissionV1SchemaToV2Schema = (data: z.infer<typeof ProjectPermissionV1Schema>[]) => {
-  switch (arg) {
+  const formattedData = UnpackedPermissionSchema.array().parse(data);
-    case "environment":
+  const secretSubjects = formattedData.filter((el) => el.subject === ProjectPermissionSub.Secrets);
-      return null;
+
-    case "secretPath":
+  // this means the folder permission as readonly is set
-      return null;
+  const hasReadOnlyFolder = formattedData.filter((el) => el.subject === ProjectPermissionSub.SecretFolders);
-    case "secretName":
+  const secretImportPolicies = secretSubjects.map(({ subject, ...el }) => ({
-      return `${TableName.SecretV2}.key`;
+    ...el,
-    case "secretTags":
+    subject: ProjectPermissionSub.SecretImports as const
-      return `${TableName.SecretTag}.slug`;
+  }));
-    default:
+
-      throw new BadRequestError({ message: `Invalid dynamic knex operator field: ${arg}` });
+  const secretFolderPolicies = secretSubjects.map(({ subject, ...el }) => ({
-  }
+    ...el,
+    subject: ProjectPermissionSub.SecretFolders
+  }));
+
+  const dynamicSecretPolicies = secretSubjects.map(({ subject, ...el }) => {
+    const action = el.action.map((e) => {
+      switch (e) {
+        case ProjectPermissionActions.Edit:
+          return ProjectPermissionDynamicSecretActions.EditRootCredential;
+        case ProjectPermissionActions.Create:
+          return ProjectPermissionDynamicSecretActions.CreateRootCredential;
+        case ProjectPermissionActions.Delete:
+          return ProjectPermissionDynamicSecretActions.DeleteRootCredential;
+        case ProjectPermissionActions.Read:
+          return ProjectPermissionDynamicSecretActions.ReadRootCredential;
+        default:
+          return ProjectPermissionDynamicSecretActions.ReadRootCredential;
+      }
+    });
+
+    return {
+      ...el,
+      action: el.action.includes(ProjectPermissionActions.Edit)
+        ? [...action, ProjectPermissionDynamicSecretActions.Lease]
+        : action,
+      subject: ProjectPermissionSub.DynamicSecrets
+    };
+  });
+
+  return formattedData.concat(
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore-error this is valid ts
+    secretImportPolicies,
+    dynamicSecretPolicies,
+    hasReadOnlyFolder.length ? [] : secretFolderPolicies
+  );
 };

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -1,11 +1,13 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
+import { PackRule, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
 
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 import { TProjectMembershipDALFactory } from "@app/services/project-membership/project-membership-dal";
 
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSet, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "./project-user-additional-privilege-dal";
 import {
   ProjectUserAdditionalPrivilegeTemporaryMode,
@@ -26,6 +28,11 @@ export type TProjectUserAdditionalPrivilegeServiceFactory = ReturnType<
   typeof projectUserAdditionalPrivilegeServiceFactory
 >;
 
+const unpackPermissions = (permissions: unknown) =>
+  UnpackedPermissionSchema.array().parse(
+    unpackRules((permissions || []) as PackRule<RawRuleOf<MongoAbility<ProjectPermissionSet>>>[])
+  );
+
 export const projectUserAdditionalPrivilegeServiceFactory = ({
   projectUserAdditionalPrivilegeDAL,
   projectMembershipDAL,
@@ -68,7 +75,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
         slug,
         permissions: customPermission
       });
-      return additionalPrivilege;
+      return {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      };
     }
 
     const relativeTempAllocatedTimeInMs = ms(dto.temporaryRange);
@@ -83,7 +93,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       temporaryAccessStartTime: new Date(dto.temporaryAccessStartTime),
       temporaryAccessEndTime: new Date(new Date(dto.temporaryAccessStartTime).getTime() + relativeTempAllocatedTimeInMs)
     });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: unpackPermissions(additionalPrivilege.permissions)
+    };
   };
 
   const updateById = async ({
@@ -136,7 +149,11 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
         temporaryAccessStartTime: new Date(temporaryAccessStartTime || ""),
         temporaryAccessEndTime: new Date(new Date(temporaryAccessStartTime || "").getTime() + ms(temporaryRange || ""))
       });
-      return additionalPrivilege;
+
+      return {
+        ...additionalPrivilege,
+        permissions: unpackPermissions(additionalPrivilege.permissions)
+      };
     }
 
     const additionalPrivilege = await projectUserAdditionalPrivilegeDAL.updateById(userPrivilege.id, {
@@ -147,7 +164,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       temporaryRange: null,
       temporaryMode: null
     });
-    return additionalPrivilege;
+    return {
+      ...additionalPrivilege,
+      permissions: unpackPermissions(additionalPrivilege.permissions)
+    };
   };
 
   const deleteById = async ({ actorId, actor, actorOrgId, actorAuthMethod, privilegeId }: TDeleteUserPrivilegeDTO) => {
@@ -174,7 +194,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Member);
 
     const deletedPrivilege = await projectUserAdditionalPrivilegeDAL.deleteById(userPrivilege.id);
-    return deletedPrivilege;
+    return {
+      ...deletedPrivilege,
+      permissions: unpackPermissions(deletedPrivilege.permissions)
+    };
   };
 
   const getPrivilegeDetailsById = async ({
@@ -206,7 +229,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
 
-    return userPrivilege;
+    return {
+      ...userPrivilege,
+      permissions: unpackPermissions(userPrivilege.permissions)
+    };
   };
 
   const listPrivileges = async ({
@@ -233,7 +259,10 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
       userId: projectMembership.userId,
       projectId: projectMembership.projectId
     });
-    return userPrivileges;
+    return userPrivileges.map((el) => ({
+      ...el,
+      permissions: unpackPermissions(el.permissions)
+    }));
   };
 
   return {

backend/src/ee/services/secret-approval-policy/secret-approval-policy-dal.ts

@@ -14,7 +14,7 @@ export const secretApprovalPolicyDALFactory = (db: TDbClient) => {
 
   const secretApprovalPolicyFindQuery = (
     tx: Knex,
-    filter: TFindFilter<TSecretApprovalPolicies>,
+    filter: TFindFilter<TSecretApprovalPolicies & { projectId: string }>,
     customFilter?: {
       sapId?: string;
     }

backend/src/ee/services/secret-approval-policy/secret-approval-policy-service.ts

@@ -1,4 +1,4 @@
-import { ForbiddenError, subject } from "@casl/ability";
+import { ForbiddenError } from "@casl/ability";
 import picomatch from "picomatch";
 
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -356,17 +356,8 @@ export const secretApprovalPolicyServiceFactory = ({
     environment,
     secretPath
   }: TGetBoardSapDTO) => {
-    const { permission } = await permissionService.getProjectPermission(
+    await permissionService.getProjectPermission(actor, actorId, projectId, actorAuthMethod, actorOrgId);
-      actor,
+
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { secretPath, environment })
-    );
     return getSecretApprovalPolicy(projectId, environment, secretPath);
   };
 

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -43,7 +43,7 @@ import {
   fnSecretBulkDelete as fnSecretV2BridgeBulkDelete,
   fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
   fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
+  getAllSecretReferences as getAllSecretReferencesV2Bridge
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
@@ -531,11 +531,11 @@ export const secretApprovalRequestServiceFactory = ({
                 skipMultilineEncoding: el.skipMultilineEncoding,
                 key: el.key,
                 references: el.encryptedValue
-                  ? getAllNestedSecretReferencesV2Bridge(
+                  ? getAllSecretReferencesV2Bridge(
                       secretManagerDecryptor({
                         cipherTextBlob: el.encryptedValue
                       }).toString()
-                    )
+                    ).nestedReferences
                   : [],
                 type: SecretType.Shared
               })),
@@ -555,11 +555,11 @@ export const secretApprovalRequestServiceFactory = ({
                     ? {
                         encryptedValue: el.encryptedValue as Buffer,
                         references: el.encryptedValue
-                          ? getAllNestedSecretReferencesV2Bridge(
+                          ? getAllSecretReferencesV2Bridge(
                               secretManagerDecryptor({
                                 cipherTextBlob: el.encryptedValue
                               }).toString()
-                            )
+                            ).nestedReferences
                           : []
                       }
                     : {};
@@ -1143,10 +1143,6 @@ export const secretApprovalRequestServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-    );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder)
@@ -1309,7 +1305,24 @@ export const secretApprovalRequestServiceFactory = ({
 
     const tagIds = unique(Object.values(commitTagIds).flat());
     const tags = tagIds.length ? await secretTagDAL.findManyTagsById(projectId, tagIds) : [];
-    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "One or more tags not found" });
+    if (tagIds.length !== tags.length) throw new NotFoundError({ message: "Tag not found" });
+    const tagsGroupById = groupBy(tags, (i) => i.id);
+
+    commits.forEach((commit) => {
+      let action = ProjectPermissionActions.Create;
+      if (commit.op === SecretOperations.Update) action = ProjectPermissionActions.Edit;
+      if (commit.op === SecretOperations.Delete) action = ProjectPermissionActions.Delete;
+
+      ForbiddenError.from(permission).throwUnlessCan(
+        action,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName: commit.key,
+          secretTags: commitTagIds?.[commit.key]?.map((secretTagId) => tagsGroupById[secretTagId][0].slug)
+        })
+      );
+    });
 
     const secretApprovalRequest = await secretApprovalRequestDAL.transaction(async (tx) => {
       const doc = await secretApprovalRequestDAL.create(

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -28,8 +28,7 @@ import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret
 import {
   fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
   fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences,
+  getAllSecretReferences
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
@@ -253,11 +252,12 @@ export const secretReplicationServiceFactory = ({
       const sourceLocalSecrets = await secretV2BridgeDAL.find({ folderId: folder.id, type: SecretType.Shared });
       const sourceSecretImports = await secretImportDAL.find({ folderId: folder.id });
       const sourceImportedSecrets = await fnSecretsV2FromImports({
-        allowedImports: sourceSecretImports,
+        secretImports: sourceSecretImports,
         secretDAL: secretV2BridgeDAL,
         folderDAL,
         secretImportDAL,
-        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : "")
+        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
+        hasSecretAccess: () => true
       });
       // secrets that gets replicated across imports
       const sourceDecryptedLocalSecrets = sourceLocalSecrets.map((el) => ({
@@ -419,7 +419,7 @@ export const secretReplicationServiceFactory = ({
                         encryptedValue: doc.encryptedValue,
                         encryptedComment: doc.encryptedComment,
                         skipMultilineEncoding: doc.skipMultilineEncoding,
-                        references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : []
+                        references: doc.secretValue ? getAllSecretReferences(doc.secretValue).nestedReferences : []
                       };
                     })
                   });
@@ -445,7 +445,7 @@ export const secretReplicationServiceFactory = ({
                           encryptedValue: doc.encryptedValue as Buffer,
                           encryptedComment: doc.encryptedComment,
                           skipMultilineEncoding: doc.skipMultilineEncoding,
-                          references: doc.secretValue ? getAllNestedSecretReferencesV2Bridge(doc.secretValue) : []
+                          references: doc.secretValue ? getAllSecretReferences(doc.secretValue).nestedReferences : []
                         }
                       };
                     })
@@ -694,7 +694,7 @@ export const secretReplicationServiceFactory = ({
                       secretCommentTag: doc.secretCommentTag,
                       secretCommentCiphertext: doc.secretCommentCiphertext,
                       skipMultilineEncoding: doc.skipMultilineEncoding,
-                      references: getAllNestedSecretReferences(doc.secretValue)
+                      references: getAllSecretReferences(doc.secretValue).nestedReferences
                     };
                   })
                 });
@@ -730,7 +730,7 @@ export const secretReplicationServiceFactory = ({
                         secretCommentTag: doc.secretCommentTag,
                         secretCommentCiphertext: doc.secretCommentCiphertext,
                         skipMultilineEncoding: doc.skipMultilineEncoding,
-                        references: getAllNestedSecretReferences(doc.secretValue)
+                        references: getAllSecretReferences(doc.secretValue).nestedReferences
                       }
                     };
                   })

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -1,7 +1,7 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import Ajv from "ajv";
 
-import { ProjectVersion } from "@app/db/schemas";
+import { ProjectVersion, TableName } from "@app/db/schemas";
 import { decryptSymmetric128BitHexKeyUTF8, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
@@ -103,13 +103,14 @@ export const secretRotationServiceFactory = ({
       ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
+
     const project = await projectDAL.findById(projectId);
     const shouldUseBridge = project.version === ProjectVersion.V3;
 
     if (shouldUseBridge) {
       const selectedSecrets = await secretV2BridgeDAL.find({
         folderId: folder.id,
-        $in: { id: Object.values(outputs) }
+        $in: { [`${TableName.SecretV2}.id` as "id"]: Object.values(outputs) }
       });
       if (selectedSecrets.length !== Object.values(outputs).length)
         throw new NotFoundError({ message: `Secrets not found in folder with ID '${folder.id}'` });

backend/src/lib/casl/knex.ts

@@ -1,111 +0,0 @@
-import { AnyAbility, ExtractSubjectType } from "@casl/ability";
-import { AbilityQuery, rulesToQuery } from "@casl/ability/extra";
-import { Tables } from "knex/types/tables";
-
-import { BadRequestError, UnauthorizedError } from "../errors";
-import { TKnexDynamicOperator } from "../knex/dynamic";
-
-type TBuildKnexQueryFromCaslDTO<K extends AnyAbility> = {
-  ability: K;
-  subject: ExtractSubjectType<Parameters<K["rulesFor"]>[1]>;
-  action: Parameters<K["rulesFor"]>[0];
-};
-
-export const buildKnexQueryFromCaslOperators = <K extends AnyAbility>({
-  ability,
-  subject,
-  action
-}: TBuildKnexQueryFromCaslDTO<K>) => {
-  const query = rulesToQuery(ability, action, subject, (rule) => {
-    if (!rule.ast) throw new Error("Ast not defined");
-    return rule.ast;
-  });
-
-  if (query === null) throw new UnauthorizedError({ message: `You don't have permission to do ${action} ${subject}` });
-  return query;
-};
-
-type TFieldMapper<T extends keyof Tables> = {
-  [K in T]: `${K}.${Exclude<keyof Tables[K]["base"], symbol>}`;
-}[T];
-
-type TFormatCaslFieldsWithTableNames<T extends keyof Tables> = {
-  // handle if any missing operator else throw error let the app break because this is executing again the db
-  missingOperatorCallback?: (operator: string) => void;
-  fieldMapping: (arg: string) => TFieldMapper<T> | null;
-  dynamicQuery: TKnexDynamicOperator;
-};
-
-export const formatCaslOperatorFieldsWithTableNames = <T extends keyof Tables>({
-  missingOperatorCallback = (arg) => {
-    throw new BadRequestError({ message: `Unknown permission operator: ${arg}` });
-  },
-  dynamicQuery: dynamicQueryAst,
-  fieldMapping
-}: TFormatCaslFieldsWithTableNames<T>) => {
-  const stack: [TKnexDynamicOperator, TKnexDynamicOperator | null][] = [[dynamicQueryAst, null]];
-
-  while (stack.length) {
-    const [filterAst, parentAst] = stack.pop()!;
-
-    if (filterAst.operator === "and" || filterAst.operator === "or" || filterAst.operator === "not") {
-      filterAst.value.forEach((el) => {
-        stack.push([el, filterAst]);
-      });
-
-      // eslint-disable-next-line no-continue
-      continue;
-    }
-
-    if (
-      filterAst.operator === "eq" ||
-      filterAst.operator === "ne" ||
-      filterAst.operator === "in" ||
-      filterAst.operator === "endsWith" ||
-      filterAst.operator === "startsWith"
-    ) {
-      const attrPath = fieldMapping(filterAst.field);
-      if (attrPath) {
-        filterAst.field = attrPath;
-      } else if (parentAst && Array.isArray(parentAst.value)) {
-        parentAst.value = parentAst.value.filter((childAst) => childAst !== filterAst) as string[];
-      } else throw new Error("Unknown casl field");
-      // eslint-disable-next-line no-continue
-      continue;
-    }
-
-    if (parentAst && Array.isArray(parentAst.value)) {
-      parentAst.value = parentAst.value.filter((childAst) => childAst !== filterAst) as string[];
-    } else {
-      missingOperatorCallback?.(filterAst.operator);
-    }
-  }
-  return dynamicQueryAst;
-};
-
-export const convertCaslOperatorToKnexOperator = <T extends keyof Tables>(
-  caslKnexOperators: AbilityQuery,
-  fieldMapping: (arg: string) => TFieldMapper<T> | null
-) => {
-  const value = [];
-  if (caslKnexOperators.$and) {
-    value.push({
-      operator: "not" as const,
-      value: caslKnexOperators.$and as TKnexDynamicOperator[]
-    });
-  }
-  if (caslKnexOperators.$or) {
-    value.push({
-      operator: "or" as const,
-      value: caslKnexOperators.$or as TKnexDynamicOperator[]
-    });
-  }
-
-  return formatCaslOperatorFieldsWithTableNames({
-    dynamicQuery: {
-      operator: "and",
-      value
-    },
-    fieldMapping
-  });
-};

backend/src/lib/fn/array.ts

@@ -81,3 +81,25 @@ export const chunkArray = <T>(array: T[], chunkSize: number): T[][] => {
   }
   return chunks;
 };
+
+/*
+ * Returns all items from the first list that
+ * do not exist in the second list.
+ */
+export const diff = <T>(
+  root: readonly T[],
+  other: readonly T[],
+  identity: (item: T) => string | number | symbol = (t: T) => t as unknown as string | number | symbol
+): T[] => {
+  if (!root?.length && !other?.length) return [];
+  if (root?.length === undefined) return [...other];
+  if (!other?.length) return [...root];
+  const bKeys = other.reduce(
+    (acc, item) => {
+      acc[identity(item)] = true;
+      return acc;
+    },
+    {} as Record<string | number | symbol, boolean>
+  );
+  return root.filter((a) => !bKeys[identity(a)]);
+};

backend/src/lib/knex/dynamic.ts

@@ -2,32 +2,31 @@ import { Knex } from "knex";
 
 import { UnauthorizedError } from "../errors";
 
-type TKnexDynamicPrimitiveOperator = {
+type TKnexDynamicPrimitiveOperator<T extends object> = {
   operator: "eq" | "ne" | "startsWith" | "endsWith";
   value: string;
-  field: string;
+  field: Extract<keyof T, string>;
 };
 
-type TKnexDynamicInOperator = {
+type TKnexDynamicInOperator<T extends object> = {
   operator: "in";
   value: string[] | number[];
-  field: string;
+  field: Extract<keyof T, string>;
 };
 
-type TKnexNonGroupOperator = TKnexDynamicInOperator | TKnexDynamicPrimitiveOperator;
+type TKnexNonGroupOperator<T extends object> = TKnexDynamicInOperator<T> | TKnexDynamicPrimitiveOperator<T>;
 
-type TKnexGroupOperator = {
+type TKnexGroupOperator<T extends object> = {
   operator: "and" | "or" | "not";
-  value: (TKnexNonGroupOperator | TKnexGroupOperator)[];
+  value: (TKnexNonGroupOperator<T> | TKnexGroupOperator<T>)[];
 };
 
-// akhilmhdh: This is still in pending state and not yet ready. If you want to use it ping me.
+export type TKnexDynamicOperator<T extends object> = TKnexGroupOperator<T> | TKnexNonGroupOperator<T>;
-// used when you need to write a complex query with the orm
-// use it when you need complex or and and condition - most of the time not needed
-// majorly used with casl permission to filter data based on permission
-export type TKnexDynamicOperator = TKnexGroupOperator | TKnexNonGroupOperator;
 
-export const buildDynamicKnexQuery = (dynamicQuery: TKnexDynamicOperator, rootQueryBuild: Knex.QueryBuilder) => {
+export const buildDynamicKnexQuery = <T extends object>(
+  rootQueryBuild: Knex.QueryBuilder,
+  dynamicQuery: TKnexDynamicOperator<T>
+) => {
   const stack = [{ filterAst: dynamicQuery, queryBuilder: rootQueryBuild }];
 
   while (stack.length) {
@@ -50,34 +49,25 @@ export const buildDynamicKnexQuery = (dynamicQuery: TKnexDynamicOperator, rootQu
         break;
       }
       case "and": {
-        void queryBuilder.andWhere((subQueryBuilder) => {
+        filterAst.value.forEach((el) => {
-          filterAst.value.forEach((el) => {
+          void queryBuilder.andWhere((subQueryBuilder) => {
-            stack.push({
+            buildDynamicKnexQuery(subQueryBuilder, el);
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
           });
         });
         break;
       }
       case "or": {
-        void queryBuilder.orWhere((subQueryBuilder) => {
+        filterAst.value.forEach((el) => {
-          filterAst.value.forEach((el) => {
+          void queryBuilder.orWhere((subQueryBuilder) => {
-            stack.push({
+            buildDynamicKnexQuery(subQueryBuilder, el);
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
           });
         });
         break;
       }
       case "not": {
-        void queryBuilder.whereNot((subQueryBuilder) => {
+        filterAst.value.forEach((el) => {
-          filterAst.value.forEach((el) => {
+          void queryBuilder.whereNot((subQueryBuilder) => {
-            stack.push({
+            buildDynamicKnexQuery(subQueryBuilder, el);
-              queryBuilder: subQueryBuilder,
-              filterAst: el
-            });
           });
         });
         break;

backend/src/lib/knex/index.ts

@@ -3,6 +3,7 @@ import { Knex } from "knex";
 import { Tables } from "knex/types/tables";
 
 import { DatabaseError } from "../errors";
+import { buildDynamicKnexQuery, TKnexDynamicOperator } from "./dynamic";
 
 export * from "./connection";
 export * from "./join";
@@ -20,9 +21,10 @@ export const withTransaction = <K extends object>(db: Knex, dal: K) => ({
 export type TFindFilter<R extends object = object> = Partial<R> & {
   $in?: Partial<{ [k in keyof R]: R[k][] }>;
   $search?: Partial<{ [k in keyof R]: R[k] }>;
+  $complex?: TKnexDynamicOperator<R>;
 };
 export const buildFindFilter =
-  <R extends object = object>({ $in, $search, ...filter }: TFindFilter<R>) =>
+  <R extends object = object>({ $in, $search, $complex, ...filter }: TFindFilter<R>) =>
   (bd: Knex.QueryBuilder<R, R>) => {
     void bd.where(filter);
     if ($in) {
@@ -39,6 +41,9 @@ export const buildFindFilter =
         }
       });
     }
+    if ($complex) {
+      return buildDynamicKnexQuery(bd, $complex);
+    }
     return bd;
   };
 

backend/src/server/plugins/error-handler.ts

@@ -63,7 +63,7 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
       void res.status(HttpStatusCodes.Forbidden).send({
         statusCode: HttpStatusCodes.Forbidden,
         error: "PermissionDenied",
-        message: `You are not allowed to ${error.action} on ${error.subjectType}`
+        message: `You are not allowed to ${error.action} on ${error.subjectType} - ${JSON.stringify(error.subject)}`
       });
     } else if (error instanceof ForbiddenRequestError) {
       void res.status(HttpStatusCodes.Forbidden).send({

backend/src/server/routes/index.ts

@@ -5,6 +5,7 @@ import { z } from "zod";
 
 import { registerCertificateEstRouter } from "@app/ee/routes/est/certificate-est-router";
 import { registerV1EERoutes } from "@app/ee/routes/v1";
+import { registerV2EERoutes } from "@app/ee/routes/v2";
 import { accessApprovalPolicyApproverDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-approver-dal";
 import { accessApprovalPolicyDALFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-dal";
 import { accessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-service";
@@ -1422,7 +1423,13 @@ export const registerRoutes = async (
     },
     { prefix: "/api/v1" }
   );
-  await server.register(registerV2Routes, { prefix: "/api/v2" });
+  await server.register(
+    async (v2Server) => {
+      await v2Server.register(registerV2EERoutes);
+      await v2Server.register(registerV2Routes);
+    },
+    { prefix: "/api/v2" }
+  );
   await server.register(registerV3Routes, { prefix: "/api/v3" });
 
   server.addHook("onClose", async () => {

backend/src/server/routes/sanitizedSchemas.ts

@@ -9,9 +9,10 @@ import {
   SecretApprovalPoliciesSchema,
   UsersSchema
 } from "@app/db/schemas";
-import { UnpackedPermissionSchema } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 
+import { UnpackedPermissionSchema } from "./santizedSchemas/permission";
+
 // sometimes the return data must be santizied to avoid leaking important values
 // always prefer pick over omit in zod
 export const integrationAuthPubSchema = IntegrationAuthsSchema.pick({

backend/src/server/routes/santizedSchemas/permission.ts

@@ -0,0 +1,11 @@
+import { z } from "zod";
+
+export const UnpackedPermissionSchema = z.object({
+  subject: z
+    .union([z.string().min(1), z.string().array()])
+    .transform((el) => (typeof el !== "string" ? el[0] : el))
+    .optional(),
+  action: z.union([z.string().min(1), z.string().array()]).transform((el) => (typeof el === "string" ? [el] : el)),
+  conditions: z.unknown().optional(),
+  inverted: z.boolean().optional()
+});

backend/src/server/routes/v1/dashboard-router.ts

@@ -3,7 +3,10 @@ import { z } from "zod";
 
 import { SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import {
+  ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSub
+} from "@app/ee/services/permission/project-permission";
 import { DASHBOARD } from "@app/lib/api-docs";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
@@ -192,15 +195,15 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         req.permission.orgId
       );
 
-      const permissiveEnvs = // filter envs user has access to
+      const allowedDynamicSecretEnvironments = // filter envs user has access to
         environments.filter((environment) =>
           permission.can(
-            ProjectPermissionActions.Read,
+            ProjectPermissionDynamicSecretActions.Lease,
-            subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+            subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })
           )
         );
 
-      if (includeDynamicSecrets && permissiveEnvs.length) {
+      if (includeDynamicSecrets && allowedDynamicSecretEnvironments.length) {
         // this is the unique count, ie duplicate secrets across envs only count as 1
         totalDynamicSecretCount = await server.services.dynamicSecret.getCountMultiEnv({
           actor: req.permission.type,
@@ -209,7 +212,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           actorOrgId: req.permission.orgId,
           projectId,
           search,
-          environmentSlugs: permissiveEnvs,
+          environmentSlugs: allowedDynamicSecretEnvironments,
           path: secretPath,
           isInternal: true
         });
@@ -224,7 +227,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             search,
             orderBy,
             orderDirection,
-            environmentSlugs: permissiveEnvs,
+            environmentSlugs: allowedDynamicSecretEnvironments,
             path: secretPath,
             limit: remainingLimit,
             offset: adjustedOffset,
@@ -241,13 +244,13 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         }
       }
 
-      if (includeSecrets && permissiveEnvs.length) {
+      if (includeSecrets) {
         // this is the unique count, ie duplicate secrets across envs only count as 1
         totalSecretCount = await server.services.secret.getSecretsCountMultiEnv({
           actorId: req.permission.id,
           actor: req.permission.type,
           actorOrgId: req.permission.orgId,
-          environments: permissiveEnvs,
+          environments,
           actorAuthMethod: req.permission.authMethod,
           projectId,
           path: secretPath,
@@ -260,7 +263,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             actorId: req.permission.id,
             actor: req.permission.type,
             actorOrgId: req.permission.orgId,
-            environments: permissiveEnvs,
+            environments,
             actorAuthMethod: req.permission.authMethod,
             projectId,
             path: secretPath,
@@ -272,7 +275,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             isInternal: true
           });
 
-          for await (const environment of permissiveEnvs) {
+          for await (const environment of environments) {
             const secretCountFromEnv = secrets.filter((secret) => secret.environment === environment).length;
 
             if (secretCountFromEnv) {

backend/src/services/external-migration/external-migration-fns.ts

@@ -19,7 +19,7 @@ import { TProjectEnvServiceFactory } from "../project-env/project-env-service";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretTagDALFactory } from "../secret-tag/secret-tag-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
-import { fnSecretBulkInsert, getAllNestedSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
+import { fnSecretBulkInsert, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
 import type { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bridge-service";
 import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
@@ -242,7 +242,7 @@ export const importDataIntoInfisicalFn = async ({
           }
           await fnSecretBulkInsert({
             inputSecrets: secretBatch.map((el) => {
-              const references = getAllNestedSecretReferences(el.secretValue);
+              const references = getAllSecretReferences(el.secretValue).nestedReferences;
 
               return {
                 version: 1,

backend/src/services/integration-auth/integration-delete-secret.ts

@@ -67,7 +67,8 @@ const getIntegrationSecretsV2 = async (
     folderDAL,
     secretDAL: secretV2BridgeDAL,
     secretImportDAL,
-    allowedImports: secretImports
+    secretImports,
+    hasSecretAccess: () => true
   });
 
   for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {

backend/src/services/integration/integration-service.ts

@@ -90,7 +90,10 @@ export const integrationServiceFactory = ({
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment: sourceEnvironment, secretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath
+      })
     );
 
     const folder = await folderDAL.findBySecretPath(integrationAuth.projectId, sourceEnvironment, secretPath);
@@ -167,7 +170,10 @@ export const integrationServiceFactory = ({
     if (environment || secretPath) {
       ForbiddenError.from(permission).throwUnlessCan(
         ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, { environment: newEnvironment, secretPath: newSecretPath })
+        subject(ProjectPermissionSub.Secrets, {
+          environment: newEnvironment,
+          secretPath: newSecretPath
+        })
       );
     }
 

backend/src/services/project-role/project-role-service.ts

@@ -2,7 +2,6 @@ import { ForbiddenError, MongoAbility, RawRuleOf } from "@casl/ability";
 import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 
 import { ProjectMembershipRole } from "@app/db/schemas";
-import { UnpackedPermissionSchema } from "@app/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
   ProjectPermissionActions,
@@ -10,6 +9,7 @@ import {
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { UnpackedPermissionSchema } from "@app/server/routes/santizedSchemas/permission";
 
 import { ActorAuthMethod } from "../auth/auth-type";
 import { TIdentityProjectMembershipRoleDALFactory } from "../identity-project/identity-project-membership-role-dal";

backend/src/services/secret-folder/secret-folder-fns.ts

@@ -1,6 +0,0 @@
-import { RawRule } from "@casl/ability";
-
-import { ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-
-export const shouldCheckFolderPermission = (rules: RawRule[]) =>
-  rules.some((rule) => (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders));

backend/src/services/secret-folder/secret-folder-service.ts

@@ -12,7 +12,6 @@ import { OrderByDirection } from "@app/lib/types";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TSecretFolderDALFactory } from "./secret-folder-dal";
-import { shouldCheckFolderPermission } from "./secret-folder-fns";
 import {
   TCreateFolderDTO,
   TDeleteFolderDTO,
@@ -60,20 +59,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
+    ForbiddenError.from(permission).throwUnlessCan(
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
+      ProjectPermissionActions.Create,
-    // for backwards compatibility, we handle authorization only when SecretFolders subject is used
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-    if (shouldCheckFolderPermission(permission.rules)) {
+    );
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Create,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
     if (!env) {
@@ -169,20 +158,10 @@ export const secretFolderServiceFactory = ({
     );
 
     folders.forEach(({ environment, path: secretPath }) => {
-      // we do this because we've split Secret and SecretFolder resources
+      ForbiddenError.from(permission).throwUnlessCan(
-      // previously, if one can create/update/read/delete secrets then they can do the same for folders
+        ProjectPermissionActions.Edit,
-      // for backwards compatibility, we handle authorization only when SecretFolders subject is used
+        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      if (shouldCheckFolderPermission(permission.rules)) {
+      );
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-        );
-      } else {
-        ForbiddenError.from(permission).throwUnlessCan(
-          ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-        );
-      }
     });
 
     const result = await folderDAL.transaction(async (tx) =>
@@ -287,20 +266,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
+    ForbiddenError.from(permission).throwUnlessCan(
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
+      ProjectPermissionActions.Edit,
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-    if (shouldCheckFolderPermission(permission.rules)) {
+    );
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
 
     const parentFolder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!parentFolder)
@@ -377,20 +346,10 @@ export const secretFolderServiceFactory = ({
       actorOrgId
     );
 
-    // we do this because we've split Secret and SecretFolder resources
+    ForbiddenError.from(permission).throwUnlessCan(
-    // previously, if one can create/update/read/delete secrets then they can do the same for folders
+      ProjectPermissionActions.Delete,
-    // for backwards compatibility, we handle authorization differently only when SecretFolders subject is used
+      subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-    if (shouldCheckFolderPermission(permission.rules)) {
+    );
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Delete,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
-    }
 
     const env = await projectEnvDAL.findOne({ projectId, slug: environment });
     if (!env) throw new NotFoundError({ message: `Environment with slug '${environment}' not found` });

backend/src/services/secret-import/secret-import-fns.ts

@@ -27,6 +27,7 @@ type TSecretImportSecretsV2 = {
     slug: string;
     name: string;
   };
+  id: string;
   folderId: string | undefined;
   importFolderId: string;
   secrets: (TSecretsV2 & {
@@ -139,24 +140,22 @@ export const fnSecretsFromImports = async ({
   return secrets;
 };
 
+/* eslint-disable no-await-in-loop, no-continue */
 export const fnSecretsV2FromImports = async ({
-  allowedImports: possibleCyclicImports,
+  secretImports: rootSecretImports,
   folderDAL,
   secretDAL,
   secretImportDAL,
-  depth = 0,
-  cyclicDetector = new Set(),
   decryptor,
-  expandSecretReferences
+  expandSecretReferences,
+  hasSecretAccess
 }: {
-  allowedImports: (Omit<TSecretImports, "importEnv"> & {
+  secretImports: (Omit<TSecretImports, "importEnv"> & {
     importEnv: { id: string; slug: string; name: string };
   })[];
   folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
   secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
-  depth?: number;
-  cyclicDetector?: Set<string>;
   decryptor: (value?: Buffer | null) => string;
   expandSecretReferences?: (inputSecret: {
     value?: string;
@@ -164,92 +163,107 @@ export const fnSecretsV2FromImports = async ({
     secretPath: string;
     environment: string;
   }) => Promise<string | undefined>;
+  hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
-  // avoid going more than a depth
+  const cyclicDetector = new Set();
-  if (depth >= LEVEL_BREAK) return [];
+  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
+    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
+  ];
 
-  const allowedImports = possibleCyclicImports.filter(
+  const processedImports: TSecretImportSecretsV2[] = [];
-    ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
-  );
 
-  const importedFolders = (
+  while (stack.length) {
-    await folderDAL.findByManySecretPath(
+    const { secretImports, depth, parentImportedSecrets } = stack.pop()!;
-      allowedImports.map(({ importEnv, importPath }) => ({
+
+    if (depth > LEVEL_BREAK) continue;
+    const sanitizedImports = secretImports.filter(
+      ({ importPath, importEnv }) => !cyclicDetector.has(getImportUniqKey(importEnv.slug, importPath))
+    );
+
+    if (!sanitizedImports.length) continue;
+
+    const importedFolders = await folderDAL.findByManySecretPath(
+      sanitizedImports.map(({ importEnv, importPath }) => ({
         envId: importEnv.id,
         secretPath: importPath
       }))
-    )
+    );
-  ).filter(Boolean); // remove undefined ones
+    if (!importedFolders.length) continue;
-  if (!importedFolders.length) {
-    return [];
-  }
 
-  const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
+    const importedFolderIds = importedFolders.map((el) => el?.id) as string[];
-  const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
+    const importedFolderGroupBySourceImport = groupBy(importedFolders, (i) => `${i?.envId}-${i?.path}`);
-  const importedSecrets = await secretDAL.find(
-    {
-      $in: { folderId: importedFolderIds },
-      type: SecretType.Shared
-    },
-    {
-      sort: [["id", "asc"]]
-    }
-  );
 
-  const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
+    const importedSecrets = await secretDAL.find(
+      {
+        $in: { folderId: importedFolderIds },
+        type: SecretType.Shared
+      },
+      {
+        sort: [["id", "asc"]]
+      }
+    );
+    const importedSecretsGroupByFolderId = groupBy(importedSecrets, (i) => i.folderId);
 
-  allowedImports.forEach(({ importPath, importEnv }) => {
+    sanitizedImports.forEach(({ importPath, importEnv }) => {
-    cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
+      cyclicDetector.add(getImportUniqKey(importEnv.slug, importPath));
-  });
+    });
-  // now we need to check recursively deeper imports made inside other imports
+    // now we need to check recursively deeper imports made inside other imports
-  // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
+    // we go level wise meaning we take all imports of a tree level and then go deeper ones level by level
-  const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
+    const deeperImports = await secretImportDAL.findByFolderIds(importedFolderIds);
-  let secretsFromDeeperImports: TSecretImportSecretsV2[] = [];
+    const deeperImportsGroupByFolderId = groupBy(deeperImports, (i) => i.folderId);
-  if (deeperImports.length) {
+
-    secretsFromDeeperImports = await fnSecretsV2FromImports({
+    const isFirstIteration = !processedImports.length;
-      allowedImports: deeperImports.filter(({ isReplication }) => !isReplication),
+    sanitizedImports.forEach(({ importPath, importEnv, id, folderId }, i) => {
-      secretImportDAL,
+      const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
-      folderDAL,
+      const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
-      secretDAL,
+        .filter((item) =>
-      depth: depth + 1,
+          hasSecretAccess(
-      cyclicDetector,
+            importEnv.slug,
-      decryptor,
+            importPath,
-      expandSecretReferences
+            item.key,
+            item.tags.map((el) => el.slug)
+          )
+        )
+        .map((item) => ({
+          ...item,
+          secretKey: item.key,
+          secretValue: decryptor(item.encryptedValue),
+          secretComment: decryptor(item.encryptedComment),
+          environment: importEnv.slug,
+          workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+          _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
+        }));
+
+      if (deeperImportsGroupByFolderId?.[sourceImportFolder?.id || ""]) {
+        stack.push({
+          secretImports: deeperImportsGroupByFolderId[sourceImportFolder?.id || ""],
+          depth: depth + 1,
+          parentImportedSecrets: secretsWithDuplicate
+        });
+      }
+
+      if (isFirstIteration) {
+        processedImports.push({
+          secretPath: importPath,
+          environment: importEnv.slug,
+          environmentInfo: importEnv,
+          folderId: importedFolders?.[i]?.id,
+          id,
+          importFolderId: folderId,
+          secrets: secretsWithDuplicate
+        });
+      } else {
+        parentImportedSecrets.push(...secretsWithDuplicate);
+      }
     });
   }
-  const secretsFromdeeperImportGroupedByFolderId = groupBy(secretsFromDeeperImports, (i) => i.importFolderId);
+  /* eslint-enable */
-
-  const processedImports = allowedImports.map(({ importPath, importEnv, id, folderId }, i) => {
-    const sourceImportFolder = importedFolderGroupBySourceImport[`${importEnv.id}-${importPath}`]?.[0];
-    const folderDeeperImportSecrets =
-      secretsFromdeeperImportGroupedByFolderId?.[sourceImportFolder?.id || ""]?.[0]?.secrets || [];
-    const secretsWithDuplicate = (importedSecretsGroupByFolderId?.[importedFolders?.[i]?.id as string] || [])
-      .map((item) => ({
-        ...item,
-        secretKey: item.key,
-        secretValue: decryptor(item.encryptedValue),
-        secretComment: decryptor(item.encryptedComment),
-        environment: importEnv.slug,
-        workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-        _id: item.id // The old Python SDK depends on the _id field being returned. We return this to keep the older Python SDK versions backwards compatible with the new Postgres backend.
-      }))
-      .concat(folderDeeperImportSecrets);
-
-    return {
-      secretPath: importPath,
-      environment: importEnv.slug,
-      environmentInfo: importEnv,
-      folderId: importedFolders?.[i]?.id,
-      id,
-      importFolderId: folderId,
-      secrets: unique(secretsWithDuplicate, (el) => el.secretKey)
-    };
-  });
-
   if (expandSecretReferences) {
     await Promise.allSettled(
-      processedImports.map((processedImport) =>
+      processedImports.map((processedImport) => {
-        Promise.allSettled(
+        // eslint-disable-next-line
+        processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
+        return Promise.allSettled(
           processedImport.secrets.map(async (decryptedSecret, index) => {
             const expandedSecretValue = await expandSecretReferences({
               value: decryptedSecret.secretValue,
@@ -260,8 +274,8 @@ export const fnSecretsV2FromImports = async ({
             // eslint-disable-next-line no-param-reassign
             processedImport.secrets[index].secretValue = expandedSecretValue || "";
           })
-        )
+        );
-      )
+      })
     );
   }
 

backend/src/services/secret-import/secret-import-service.ts

@@ -84,12 +84,12 @@ export const secretImportServiceFactory = ({
     // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: data.environment,
         secretPath: data.path
@@ -198,7 +198,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -292,7 +292,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -364,8 +364,8 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import into destination  path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const plan = await licenseService.getPlan(actorOrgId);
@@ -393,7 +393,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: secretImportDoc.importEnv.slug,
         secretPath: secretImportDoc.importPath
@@ -441,7 +441,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -476,7 +476,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
@@ -526,7 +526,7 @@ export const secretImportServiceFactory = ({
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, {
+      subject(ProjectPermissionSub.SecretImports, {
         environment: folder.environment.envSlug,
         secretPath: folderWithPath.path
       })
@@ -573,20 +573,19 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder) return [];
     // this will already order by position
     // so anything based on this order will also be in right position
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
-
+    const allowedImports = secretImports.filter((el) =>
-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
       permission.can(
         ProjectPermissionActions.Read,
         subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
+          environment: el.importEnv.slug,
-          secretPath: importPath
+          secretPath: el.importPath
         })
       )
     );
@@ -611,7 +610,7 @@ export const secretImportServiceFactory = ({
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
     );
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
     if (!folder) return [];
@@ -619,16 +618,6 @@ export const secretImportServiceFactory = ({
     // so anything based on this order will also be in right position
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
 
-    const allowedImports = secretImports.filter(({ importEnv, importPath }) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: importEnv.slug,
-          secretPath: importPath
-        })
-      )
-    );
-
     const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
     if (shouldUseSecretV2Bridge) {
       const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
@@ -636,11 +625,21 @@ export const secretImportServiceFactory = ({
         projectId
       });
       const importedSecrets = await fnSecretsV2FromImports({
-        allowedImports,
+        secretImports,
         folderDAL,
         secretDAL: secretV2BridgeDAL,
         secretImportDAL,
-        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : "")
+        decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
+        hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
+          permission.can(
+            ProjectPermissionActions.Read,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: expandEnvironment,
+              secretPath: expandSecretPath,
+              secretName: expandSecretKey,
+              secretTags: expandSecretTags
+            })
+          )
       });
       return importedSecrets;
     }
@@ -651,7 +650,21 @@ export const secretImportServiceFactory = ({
         name: "bot_not_found_error"
       });
 
-    const importedSecrets = await fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL });
+    const allowedImports = secretImports.filter((el) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: el.importEnv.slug,
+          secretPath: el.importPath
+        })
+      )
+    );
+    const importedSecrets = await fnSecretsFromImports({
+      allowedImports,
+      folderDAL,
+      secretDAL,
+      secretImportDAL
+    });
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -4,7 +4,14 @@ import { validate as uuidValidate } from "uuid";
 import { TDbClient } from "@app/db";
 import { SecretsV2Schema, SecretType, TableName, TSecretsV2, TSecretsV2Update } from "@app/db/schemas";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
+import {
+  buildFindFilter,
+  ormify,
+  selectAllTableCols,
+  sqlNestRelationships,
+  TFindFilter,
+  TFindOpt
+} from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
 
@@ -13,6 +20,97 @@ export type TSecretV2BridgeDALFactory = ReturnType<typeof secretV2BridgeDALFacto
 export const secretV2BridgeDALFactory = (db: TDbClient) => {
   const secretOrm = ormify(db, TableName.SecretV2);
 
+  const findOne = async (filter: Partial<TSecretsV2>, tx?: Knex) => {
+    try {
+      const docs = await (tx || db)(TableName.SecretV2)
+        .where(filter)
+        .leftJoin(
+          TableName.SecretV2JnTag,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
+        )
+        .leftJoin(
+          TableName.SecretTag,
+          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
+          `${TableName.SecretTag}.id`
+        )
+        .select(selectAllTableCols(TableName.SecretV2))
+        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
+        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
+
+      const data = sqlNestRelationships({
+        data: docs,
+        key: "id",
+        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        childrenMapper: [
+          {
+            key: "tagId",
+            label: "tags" as const,
+            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
+              id,
+              color,
+              slug,
+              name: slug
+            })
+          }
+        ]
+      });
+      return data?.[0];
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.SecretV2}: FindOne` });
+    }
+  };
+
+  const find = async (filter: TFindFilter<TSecretsV2>, { offset, limit, sort, tx }: TFindOpt<TSecretsV2> = {}) => {
+    try {
+      const query = (tx || db)(TableName.SecretV2)
+        // eslint-disable-next-line @typescript-eslint/no-misused-promises
+        .where(buildFindFilter(filter))
+        .leftJoin(
+          TableName.SecretV2JnTag,
+          `${TableName.SecretV2}.id`,
+          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
+        )
+        .leftJoin(
+          TableName.SecretTag,
+          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
+          `${TableName.SecretTag}.id`
+        )
+        .select(selectAllTableCols(TableName.SecretV2))
+        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
+        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
+        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
+      if (limit) void query.limit(limit);
+      if (offset) void query.offset(offset);
+      if (sort) {
+        void query.orderBy(sort.map(([column, order, nulls]) => ({ column: column as string, order, nulls })));
+      }
+
+      const docs = await query;
+      const data = sqlNestRelationships({
+        data: docs,
+        key: "id",
+        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
+        childrenMapper: [
+          {
+            key: "tagId",
+            label: "tags" as const,
+            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
+              id,
+              color,
+              slug,
+              name: slug
+            })
+          }
+        ]
+      });
+      return data;
+    } catch (error) {
+      throw new DatabaseError({ error, name: `${TableName.SecretV2}: Find` });
+    }
+  };
+
   const update = async (filter: Partial<TSecretsV2>, data: Omit<TSecretsV2Update, "version">, tx?: Knex) => {
     try {
       const sec = await (tx || db)(TableName.SecretV2)
@@ -484,6 +582,8 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
     upsertSecretReferences,
     findReferencedSecretReferences,
     findAllProjectSecretValues,
-    countByFolderIds
+    countByFolderIds,
+    findOne,
+    find
   };
 };

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -30,9 +30,10 @@ export const shouldUseSecretV2Bridge = (version: number) => version === 3;
  * //   { environment: 'prod', secretPath: '/anotherFolder' }
  * // ]
  */
-export const getAllNestedSecretReferences = (maybeSecretReference: string) => {
+export const getAllSecretReferences = (maybeSecretReference: string) => {
   const references = Array.from(maybeSecretReference.matchAll(INTERPOLATION_SYNTAX_REG), (m) => m[1]);
-  return references
+
+  const nestedReferences = references
     .filter((el) => el.includes("."))
     .map((el) => {
       const [environment, ...secretPathList] = el.split(".");
@@ -42,6 +43,8 @@ export const getAllNestedSecretReferences = (maybeSecretReference: string) => {
         secretKey: secretPathList[secretPathList.length - 1]
       };
     });
+  const localReferences = references.filter((el) => !el.includes("."));
+  return { nestedReferences, localReferences };
 };
 
 // these functions are special functions shared by a couple of resources
@@ -325,16 +328,13 @@ type TRecursivelyFetchSecretsFromFoldersArg = {
   projectId: string;
   environment: string;
   currentPath: string;
-  hasAccess: (environment: string, secretPath: string) => boolean;
 };
 
 export const recursivelyGetSecretPaths = async ({
   folderDAL,
   projectEnvDAL,
   projectId,
-  environment,
+  environment
-  currentPath,
-  hasAccess
 }: TRecursivelyFetchSecretsFromFoldersArg) => {
   const env = await projectEnvDAL.findOne({
     projectId,
@@ -362,12 +362,7 @@ export const recursivelyGetSecretPaths = async ({
     folderId: p.folderId
   }));
 
-  // Filter out paths that the user does not have permission to access, and paths that are not in the current path
+  return paths;
-  const allowedPaths = paths.filter(
-    (folder) => hasAccess(environment, folder.path) && folder.path.startsWith(currentPath === "/" ? "" : currentPath)
-  );
-
-  return allowedPaths;
 };
 // used to convert multi line ones to quotes ones with \n
 const formatMultiValueEnv = (val?: string) => {
@@ -381,7 +376,7 @@ type TInterpolateSecretArg = {
   decryptSecretValue: (encryptedValue?: Buffer | null) => string | undefined;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "findByFolderId">;
   folderDAL: Pick<TSecretFolderDALFactory, "findBySecretPath">;
-  canExpandValue: (environment: string, secretPath: string) => boolean;
+  canExpandValue: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 };
 
 const MAX_SECRET_REFERENCE_DEPTH = 10;
@@ -392,29 +387,29 @@ export const expandSecretReferencesFactory = ({
   folderDAL,
   canExpandValue
 }: TInterpolateSecretArg) => {
-  const secretCache: Record<string, Record<string, string>> = {};
+  const secretCache: Record<string, Record<string, { value: string; tags: string[] }>> = {};
   const getCacheUniqueKey = (environment: string, secretPath: string) => `${environment}-${secretPath}`;
 
   const fetchSecret = async (environment: string, secretPath: string, secretKey: string) => {
     const cacheKey = getCacheUniqueKey(environment, secretPath);
 
     if (secretCache?.[cacheKey]) {
-      return secretCache[cacheKey][secretKey] || "";
+      return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
     }
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
-    if (!folder) return "";
+    if (!folder) return { value: "", tags: [] };
     const secrets = await secretDAL.findByFolderId(folder.id);
 
-    const decryptedSecret = secrets.reduce<Record<string, string>>((prev, secret) => {
+    const decryptedSecret = secrets.reduce<Record<string, { value: string; tags: string[] }>>((prev, secret) => {
       // eslint-disable-next-line no-param-reassign
-      prev[secret.key] = decryptSecret(secret.encryptedValue) || "";
+      prev[secret.key] = { value: decryptSecret(secret.encryptedValue) || "", tags: secret.tags?.map((el) => el.slug) };
       return prev;
     }, {});
 
     secretCache[cacheKey] = decryptedSecret;
 
-    return secretCache[cacheKey][secretKey] || "";
+    return secretCache[cacheKey][secretKey] || { value: "", tags: [] };
   };
 
   const recursivelyExpandSecret = async (dto: { value?: string; secretPath: string; environment: string }) => {
@@ -440,43 +435,43 @@ export const expandSecretReferencesFactory = ({
           if (entities.length === 1) {
             const [secretKey] = entities;
 
-            if (!canExpandValue(environment, secretPath))
+            // eslint-disable-next-line no-continue,no-await-in-loop
+            const referredValue = await fetchSecret(environment, secretPath, secretKey);
+            if (!canExpandValue(environment, secretPath, secretKey, referredValue.tags))
               throw new ForbiddenRequestError({
                 message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to.`
               });
 
-            // eslint-disable-next-line no-continue,no-await-in-loop
-            const referedValue = await fetchSecret(environment, secretPath, secretKey);
             const cacheKey = getCacheUniqueKey(environment, secretPath);
-            secretCache[cacheKey][secretKey] = referedValue;
+            secretCache[cacheKey][secretKey] = referredValue;
-            if (INTERPOLATION_SYNTAX_REG.test(referedValue)) {
+            if (INTERPOLATION_SYNTAX_REG.test(referredValue.value)) {
               stack.push({
-                value: referedValue,
+                value: referredValue.value,
                 secretPath,
                 environment,
                 depth: depth + 1
               });
             }
-            if (referedValue) {
+            if (referredValue) {
-              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue);
+              expandedValue = expandedValue.replaceAll(interpolationSyntax, referredValue.value);
             }
           } else {
             const secretReferenceEnvironment = entities[0];
             const secretReferencePath = path.join("/", ...entities.slice(1, entities.length - 1));
             const secretReferenceKey = entities[entities.length - 1];
 
-            if (!canExpandValue(secretReferenceEnvironment, secretReferencePath))
+            // eslint-disable-next-line no-await-in-loop
+            const referedValue = await fetchSecret(secretReferenceEnvironment, secretReferencePath, secretReferenceKey);
+            if (!canExpandValue(secretReferenceEnvironment, secretReferencePath, secretReferenceKey, referedValue.tags))
               throw new ForbiddenRequestError({
                 message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to.`
               });
 
-            // eslint-disable-next-line no-await-in-loop
-            const referedValue = await fetchSecret(secretReferenceEnvironment, secretReferencePath, secretReferenceKey);
             const cacheKey = getCacheUniqueKey(secretReferenceEnvironment, secretReferencePath);
             secretCache[cacheKey][secretReferenceKey] = referedValue;
-            if (INTERPOLATION_SYNTAX_REG.test(referedValue)) {
+            if (INTERPOLATION_SYNTAX_REG.test(referedValue.value)) {
               stack.push({
-                value: referedValue,
+                value: referedValue.value,
                 secretPath: secretReferencePath,
                 environment: secretReferenceEnvironment,
                 depth: depth + 1
@@ -484,7 +479,7 @@ export const expandSecretReferencesFactory = ({
             }
 
             if (referedValue) {
-              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue);
+              expandedValue = expandedValue.replaceAll(interpolationSyntax, referedValue.value);
             }
           }
         }

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -15,6 +15,12 @@ type TPartialSecret = Pick<TSecretsV2, "id" | "reminderRepeatDays" | "reminderNo
 
 type TPartialInputSecret = Pick<TSecretsV2, "type" | "reminderNote" | "reminderRepeatDays" | "id">;
 
+export type TSecretReferenceDTO = {
+  environment: string;
+  secretPath: string;
+  secretKey: string;
+};
+
 export type TGetSecretsDTO = {
   expandSecretReferences?: boolean;
   path: string;

backend/src/services/secret/secret-fns.ts

@@ -25,7 +25,7 @@ import { logger } from "@app/lib/logger";
 import {
   fnSecretBulkInsert as fnSecretV2BridgeBulkInsert,
   fnSecretBulkUpdate as fnSecretV2BridgeBulkUpdate,
-  getAllNestedSecretReferences as getAllNestedSecretReferencesV2Bridge
+  getAllSecretReferences
 } from "@app/services/secret-v2-bridge/secret-v2-bridge-fns";
 
 import { ActorAuthMethod, ActorType } from "../auth/auth-type";
@@ -793,7 +793,7 @@ export const createManySecretsRawFnFactory = ({
             : null,
           skipMultilineEncoding: secret.skipMultilineEncoding,
           tags: secret.tags,
-          references: getAllNestedSecretReferencesV2Bridge(secret.secretValue)
+          references: getAllSecretReferences(secret.secretValue).nestedReferences
         };
       });
 
@@ -973,7 +973,7 @@ export const updateManySecretsRawFnFactory = ({
             : null,
           skipMultilineEncoding: secret.skipMultilineEncoding,
           tags: secret.tags,
-          references: getAllNestedSecretReferencesV2Bridge(secret.secretValue)
+          references: getAllSecretReferences(secret.secretValue).nestedReferences
         };
       });
 

backend/src/services/secret/secret-queue.ts

@@ -50,7 +50,7 @@ import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretImportDALFactory } from "../secret-import/secret-import-dal";
 import { fnSecretsV2FromImports } from "../secret-import/secret-import-fns";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
-import { expandSecretReferencesFactory, getAllNestedSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
+import { expandSecretReferencesFactory, getAllSecretReferences } from "../secret-v2-bridge/secret-v2-bridge-fns";
 import { TSecretVersionV2DALFactory } from "../secret-v2-bridge/secret-version-dal";
 import { TSecretVersionV2TagDALFactory } from "../secret-v2-bridge/secret-version-tag-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
@@ -342,7 +342,8 @@ export const secretQueueFactory = ({
       secretDAL: secretV2BridgeDAL,
       expandSecretReferences,
       secretImportDAL,
-      allowedImports: secretImports
+      secretImports,
+      hasSecretAccess: () => true
     });
 
     for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
@@ -1147,7 +1148,7 @@ export const secretQueueFactory = ({
                   : "";
               const encryptedValue = secretManagerEncryptor({ plainText: Buffer.from(value) }).cipherTextBlob;
               // create references
-              const references = getAllNestedSecretReferences(value);
+              const references = getAllSecretReferences(value).nestedReferences;
               secretReferences.push({ secretId: el.id, references });
 
               const encryptedComment = comment

backend/src/services/secret/secret-service.ts

@@ -2436,17 +2436,26 @@ export const secretServiceFactory = ({
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment: sourceEnvironment, secretPath: sourceSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath: sourceSecretPath
+      })
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Secrets, { environment: destinationEnvironment, secretPath: destinationSecretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
     );
 
     const { botKey } = await projectBotService.getBotKey(project.id);

frontend/src/components/permissions/GlobPermissionInfo.tsx

@@ -0,0 +1,33 @@
+import { useState } from "react";
+import picomatch from "picomatch";
+
+import { FormControl } from "../v2/FormControl";
+import { Input } from "../v2/Input";
+
+export const GlobPermissionInfo = () => {
+  const [pattern, setPattern] = useState("");
+  const [text, setText] = useState("");
+
+  return (
+    <div>
+      <div className="mt-2">A glob pattern uses wildcards to match resources or paths.</div>
+      <div>
+        <FormControl label="Glob pattern" helperText="Examples: /{a,b}, DB_**">
+          <Input value={pattern} onChange={(e) => setPattern(e.target.value)} />
+        </FormControl>
+      </div>
+      <div>
+        <FormControl
+          label="Test string"
+          helperText="Type a value to test glob match"
+          isError={
+            pattern && text ? !picomatch.isMatch(text, pattern, { strictSlashes: false }) : false
+          }
+          errorText="Invalid"
+        >
+          <Input value={text} onChange={(e) => setText(e.target.value)} />
+        </FormControl>
+      </div>
+    </div>
+  );
+};

frontend/src/components/permissions/ProjectPermissionCan.tsx

@@ -1,23 +1,25 @@
 import { FunctionComponent, ReactNode } from "react";
-import { BoundCanProps, Can } from "@casl/react";
+import { AbilityTuple, MongoAbility } from "@casl/ability";
+import { Can } from "@casl/react";
 
-import { TProjectPermission, useProjectPermission } from "@app/context/ProjectPermissionContext";
+import { ProjectPermissionSet, useProjectPermission } from "@app/context/ProjectPermissionContext";
 
-import { Tooltip } from "../v2";
+import { Tooltip } from "../v2/Tooltip";
 
-type Props = {
+type Props<T extends AbilityTuple> = {
   label?: ReactNode;
   // this prop is used when there exist already a tooltip as helper text for users
   // so when permission is allowed same tooltip will be reused  to show helpertext
   renderTooltip?: boolean;
   allowedLabel?: string;
-  // BUG(akhilmhdh): As a workaround for now i put any but this should be TProjectPermission
+  children: ReactNode | ((isAllowed: boolean, ability: T) => ReactNode);
-  // For some reason when i put TProjectPermission in a wrapper component it just wont work causes a weird  ts error
+  passThrough?: boolean;
-  // tried a lot combinations
+  I: T[0];
-  // REF: https://github.com/stalniy/casl/blob/ac081a34f56366a7eaaed05d21689d27041ef005/packages/casl-react/src/factory.ts#L15
+  a: T[1];
-} & BoundCanProps<any>;
+  ability?: MongoAbility<T>;
+};
 
-export const ProjectPermissionCan: FunctionComponent<Props> = ({
+export const ProjectPermissionCan: FunctionComponent<Props<ProjectPermissionSet>> = ({
   label = "Access restricted",
   children,
   passThrough = true,
@@ -31,9 +33,7 @@ export const ProjectPermissionCan: FunctionComponent<Props> = ({
       {(isAllowed, ability) => {
         // akhilmhdh: This is set as type due to error in casl react type.
         const finalChild =
-          typeof children === "function"
+          typeof children === "function" ? children(isAllowed, ability as any) : children;
-            ? children(isAllowed, ability as TProjectPermission)
-            : children;
 
         if (!isAllowed && passThrough) {
           return <Tooltip content={label}>{finalChild}</Tooltip>;

frontend/src/components/permissions/index.tsx

@@ -1,3 +1,4 @@
+export { GlobPermissionInfo } from "./GlobPermissionInfo";
 export { OrgPermissionCan } from "./OrgPermissionCan";
 export { PermissionDeniedBanner } from "./PermissionDeniedBanner";
 export { ProjectPermissionCan } from "./ProjectPermissionCan";

frontend/src/components/v2/Select/Select.tsx

@@ -12,6 +12,7 @@ type Props = {
   placeholder?: string;
   className?: string;
   dropdownContainerClassName?: string;
+  containerClassName?: string;
   isLoading?: boolean;
   position?: "item-aligned" | "popper";
   isDisabled?: boolean;
@@ -31,12 +32,13 @@ export const Select = forwardRef<HTMLButtonElement, SelectProps>(
       isDisabled,
       dropdownContainerClassName,
       position,
+      containerClassName,
       ...props
     },
     ref
   ): JSX.Element => {
     return (
-      <div className="flex items-center space-x-2">
+      <div className={twMerge("flex items-center space-x-2", containerClassName)}>
         <SelectPrimitive.Root
           {...props}
           onValueChange={(value) => {

frontend/src/context/ProjectPermissionContext/index.tsx

@@ -3,5 +3,6 @@ export type { ProjectPermissionSet, TProjectPermission } from "./types";
 export {
   ProjectPermissionActions,
   ProjectPermissionCmekActions,
+  ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub
 } from "./types";

frontend/src/context/ProjectPermissionContext/types.ts

@@ -7,6 +7,14 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
+export enum ProjectPermissionDynamicSecretActions {
+  ReadRootCredential = "read-root-credential",
+  CreateRootCredential = "create-root-credential",
+  EditRootCredential = "edit-root-credential",
+  DeleteRootCredential = "delete-root-credential",
+  Lease = "lease"
+}
+
 export enum ProjectPermissionCmekActions {
   Read = "read",
   Create = "create",
@@ -21,7 +29,7 @@ export enum PermissionConditionOperators {
   $ALL = "$all",
   $REGEX = "$regex",
   $EQ = "$eq",
-  $NEQ = "$neq",
+  $NEQ = "$ne",
   $GLOB = "$glob"
 }
 
@@ -37,7 +45,7 @@ export type TPermissionConditionOperators = {
 export type TPermissionCondition = Record<
   string,
   | string
-  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $neq: string; $glob: string }
+  | { $in: string[]; $all: string[]; $regex: string; $eq: string; $ne: string; $glob: string }
 >;
 
 export enum ProjectPermissionSub {
@@ -52,9 +60,11 @@ export enum ProjectPermissionSub {
   Tags = "tags",
   AuditLogs = "audit-logs",
   IpAllowList = "ip-allowlist",
-  Workspace = "workspace",
+  Project = "workspace",
   Secrets = "secrets",
   SecretFolders = "secret-folders",
+  SecretImports = "secret-imports",
+  DynamicSecrets = "dynamic-secrets",
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
@@ -68,7 +78,24 @@ export enum ProjectPermissionSub {
   Cmek = "cmek"
 }
 
-type SubjectFields = {
+export type SecretSubjectFields = {
+  environment: string;
+  secretPath: string;
+  secretName: string;
+  secretTags: string[];
+};
+
+export type SecretFolderSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
+export type DynamicSecretSubjectFields = {
+  environment: string;
+  secretPath: string;
+};
+
+export type SecretImportSubjectFields = {
   environment: string;
   secretPath: string;
 };
@@ -76,13 +103,30 @@ type SubjectFields = {
 export type ProjectPermissionSet =
   | [
       ProjectPermissionActions,
-      ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SubjectFields)
+      (
+        | ProjectPermissionSub.Secrets
+        | (ForcedSubject<ProjectPermissionSub.Secrets> & SecretSubjectFields)
+      )
     ]
   | [
       ProjectPermissionActions,
       (
         | ProjectPermissionSub.SecretFolders
-        | (ForcedSubject<ProjectPermissionSub.SecretFolders> & SubjectFields)
+        | (ForcedSubject<ProjectPermissionSub.SecretFolders> & SecretFolderSubjectFields)
+      )
+    ]
+  | [
+      ProjectPermissionDynamicSecretActions,
+      (
+        | ProjectPermissionSub.DynamicSecrets
+        | (ForcedSubject<ProjectPermissionSub.DynamicSecrets> & DynamicSecretSubjectFields)
+      )
+    ]
+  | [
+      ProjectPermissionActions,
+      (
+        | ProjectPermissionSub.SecretImports
+        | (ForcedSubject<ProjectPermissionSub.SecretImports> & SecretImportSubjectFields)
       )
     ]
   | [ProjectPermissionActions, ProjectPermissionSub.Role]
@@ -95,19 +139,19 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions, ProjectPermissionSub.Environments]
   | [ProjectPermissionActions, ProjectPermissionSub.IpAllowList]
   | [ProjectPermissionActions, ProjectPermissionSub.Settings]
-  | [ProjectPermissionActions, ProjectPermissionSub.Identity]
   | [ProjectPermissionActions, ProjectPermissionSub.ServiceTokens]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretApproval]
   | [ProjectPermissionActions, ProjectPermissionSub.SecretRotation]
+  | [ProjectPermissionActions, ProjectPermissionSub.Identity]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateAuthorities]
   | [ProjectPermissionActions, ProjectPermissionSub.Certificates]
   | [ProjectPermissionActions, ProjectPermissionSub.CertificateTemplates]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
-  | [ProjectPermissionActions.Delete, ProjectPermissionSub.Workspace]
+  | [ProjectPermissionActions.Delete, ProjectPermissionSub.Project]
-  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Workspace]
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
   | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionCmekActions, ProjectPermissionSub.Cmek];
+  | [ProjectPermissionCmekActions, ProjectPermissionSub.Cmek]
-
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms];
 export type TProjectPermission = MongoAbility<ProjectPermissionSet>;

frontend/src/context/index.tsx

@@ -11,6 +11,7 @@ export type { TProjectPermission } from "./ProjectPermissionContext";
 export {
   ProjectPermissionActions,
   ProjectPermissionCmekActions,
+  ProjectPermissionDynamicSecretActions,
   ProjectPermissionProvider,
   ProjectPermissionSub,
   useProjectPermission

frontend/src/hoc/withProjectPermission/withProjectPermission.tsx

@@ -1,31 +1,29 @@
 import { ComponentType } from "react";
-import { Abilities, AbilityTuple, Generics, SubjectType } from "@casl/ability";
+import { AbilityTuple } from "@casl/ability";
 import { faLock } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { twMerge } from "tailwind-merge";
 
-import { TProjectPermission, useProjectPermission } from "@app/context";
+import { useProjectPermission } from "@app/context";
+import { ProjectPermissionSet } from "@app/context/ProjectPermissionContext";
 
-type Props<T extends Abilities> = (T extends AbilityTuple
+type Props<T extends AbilityTuple> = {
-  ? {
+  className?: string;
-      action: T[0];
+  containerClassName?: string;
-      subject: Extract<T[1], SubjectType>;
+  action: T[0];
-    }
+  subject: T[1];
-  : {
+};
-      action: string;
-      subject: string;
-    }) & { className?: string; containerClassName?: string };
 
-export const withProjectPermission = <T extends {}, J extends TProjectPermission>(
+export const withProjectPermission = <T extends {}>(
-  Component: ComponentType<T>,
+  Component: ComponentType<Omit<Props<ProjectPermissionSet>, "action" | "subject"> & T>,
-  { action, subject, className, containerClassName }: Props<Generics<J>["abilities"]>
+  { action, subject, className, containerClassName }: Props<ProjectPermissionSet>
 ) => {
-  const HOC = (hocProps: T) => {
+  const HOC = (hocProps: Omit<Props<ProjectPermissionSet>, "action" | "subject"> & T) => {
     const { permission } = useProjectPermission();
 
     // akhilmhdh: Set as any due to casl/react ts type bug
     // REASON: casl due to its type checking can't seem to union even if union intersection is applied
-    if (permission.cannot(action as any, subject)) {
+    if (permission.cannot(action as any, subject as any)) {
       return (
         <div
           className={twMerge(

frontend/src/hooks/api/dashboard/queries.tsx

@@ -15,6 +15,7 @@ import {
 } from "@app/hooks/api/dashboard/types";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import { mergePersonalSecrets } from "@app/hooks/api/secrets/queries";
+import { unique } from "@app/lib/fn/array";
 
 export const dashboardKeys = {
   all: () => ["dashboard"] as const,
@@ -154,10 +155,20 @@ export const useGetProjectSecretsOverview = (
     },
     select: useCallback((data: Awaited<ReturnType<typeof fetchProjectSecretsOverview>>) => {
       const { secrets, ...select } = data;
+      const uniqueSecrets = secrets ? unique(secrets, (i) => i.secretKey) : [];
+
+      const uniqueFolders = select.folders ? unique(select.folders, (i) => i.name) : [];
+
+      const uniqueDynamicSecrets = select.dynamicSecrets
+        ? unique(select.dynamicSecrets, (i) => i.name)
+        : [];
 
       return {
         ...select,
-        secrets: secrets ? mergePersonalSecrets(secrets) : undefined
+        secrets: secrets ? mergePersonalSecrets(secrets) : undefined,
+        totalUniqueSecretsInPage: uniqueSecrets.length,
+        totalUniqueDynamicSecretsInPage: uniqueDynamicSecrets.length,
+        totalUniqueFoldersInPage: uniqueFolders.length
       };
     }, []),
     keepPreviousData: true

frontend/src/hooks/api/dashboard/types.ts

@@ -12,6 +12,9 @@ export type DashboardProjectSecretsOverviewResponse = {
   totalFolderCount?: number;
   totalDynamicSecretCount?: number;
   totalCount: number;
+  totalUniqueSecretsInPage: number;
+  totalUniqueDynamicSecretsInPage: number;
+  totalUniqueFoldersInPage: number;
 };
 
 export type DashboardProjectSecretsDetailsResponse = {

frontend/src/hooks/api/projectUserAdditionalPrivilege/mutation.tsx

@@ -1,4 +1,3 @@
-import { packRules } from "@casl/ability/extra";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 
 import { apiRequest } from "@app/config/request";
@@ -16,10 +15,7 @@ export const useCreateProjectUserAdditionalPrivilege = () => {
 
   return useMutation<{ privilege: TProjectUserPrivilege }, {}, TCreateProjectUserPrivilegeDTO>({
     mutationFn: async (dto) => {
-      const { data } = await apiRequest.post("/api/v1/additional-privilege/users/permanent", {
+      const { data } = await apiRequest.post("/api/v1/additional-privilege/users/permanent", dto);
-        ...dto,
-        permissions: packRules(dto.permissions)
-      });
       return data.privilege;
     },
     onSuccess: (_, { projectMembershipId }) => {
@@ -35,7 +31,7 @@ export const useUpdateProjectUserAdditionalPrivilege = () => {
     mutationFn: async (dto) => {
       const { data } = await apiRequest.patch(
         `/api/v1/additional-privilege/users/${dto.privilegeId}`,
-        { ...dto, permissions: dto.permissions ? packRules(dto.permissions) : undefined }
+        dto
       );
       return data.privilege;
     },

frontend/src/hooks/api/projectUserAdditionalPrivilege/queries.tsx

@@ -1,4 +1,3 @@
-import { PackRule, unpackRules } from "@casl/ability/extra";
 import { useQuery } from "@tanstack/react-query";
 
 import { apiRequest } from "@app/config/request";
@@ -18,10 +17,7 @@ const fetchProjectUserPrivilegeDetails = async (privilegeId: string) => {
   } = await apiRequest.get<{
     privilege: Omit<TProjectUserPrivilege, "permissions"> & { permissions: unknown };
   }>(`/api/v1/additional-privilege/users/${privilegeId}`);
-  return {
+  return privilege;
-    ...privilege,
-    permissions: unpackRules(privilege.permissions as PackRule<TProjectPermission>[])
-  };
 };
 
 export const useGetProjectUserPrivilegeDetails = (privilegeId: string) => {
@@ -44,7 +40,7 @@ export const useListProjectUserPrivileges = (projectMembershipId: string) => {
       }>("/api/v1/additional-privilege/users", { params: { projectMembershipId } });
       return privileges.map((el) => ({
         ...el,
-        permissions: unpackRules(el.permissions as PackRule<TProjectPermission>[])
+        permissions: el.permissions as TProjectPermission[]
       }));
     }
   });

frontend/src/hooks/api/projectUserAdditionalPrivilege/types.tsx

@@ -4,6 +4,15 @@ export enum ProjectUserAdditionalPrivilegeTemporaryMode {
   Relative = "relative"
 }
 
+export type TProjectSpecificPrivilegePermission = {
+  conditions: {
+    environment: string;
+    secretPath?: { $glob: string };
+  };
+  actions: string[];
+  subject: string;
+};
+
 export type TProjectUserPrivilege = {
   projectMembershipId: string;
   slug: string;
@@ -12,21 +21,21 @@ export type TProjectUserPrivilege = {
   updatedAt: Date;
   permissions?: TProjectPermission[];
 } & (
-    | {
+  | {
       isTemporary: true;
       temporaryMode: string;
       temporaryRange: string;
       temporaryAccessStartTime: string;
       temporaryAccessEndTime?: string;
     }
-    | {
+  | {
       isTemporary: false;
       temporaryMode?: null;
       temporaryRange?: null;
       temporaryAccessStartTime?: null;
       temporaryAccessEndTime?: null;
     }
-  );
+);
 
 export type TCreateProjectUserPrivilegeDTO = {
   projectMembershipId: string;
@@ -35,7 +44,7 @@ export type TCreateProjectUserPrivilegeDTO = {
   temporaryMode?: ProjectUserAdditionalPrivilegeTemporaryMode;
   temporaryRange?: string;
   temporaryAccessStartTime?: string;
-  permissions: TProjectPermission[];
+  permissions: TProjectSpecificPrivilegePermission;
 };
 
 export type TUpdateProjectUserPrivlegeDTO = {

frontend/src/hooks/api/roles/mutation.tsx

@@ -22,7 +22,7 @@ export const useCreateProjectRole = () => {
     mutationFn: async ({ projectSlug, ...dto }: TCreateProjectRoleDTO) => {
       const {
         data: { role }
-      } = await apiRequest.post(`/api/v1/workspace/${projectSlug}/roles`, dto);
+      } = await apiRequest.post(`/api/v2/workspace/${projectSlug}/roles`, dto);
       return role;
     },
     onSuccess: (_, { projectSlug }) => {
@@ -38,7 +38,7 @@ export const useUpdateProjectRole = () => {
     mutationFn: async ({ id, projectSlug, ...dto }: TUpdateProjectRoleDTO) => {
       const {
         data: { role }
-      } = await apiRequest.patch(`/api/v1/workspace/${projectSlug}/roles/${id}`, dto);
+      } = await apiRequest.patch(`/api/v2/workspace/${projectSlug}/roles/${id}`, dto);
       return role;
     },
     onSuccess: (_, { projectSlug }) => {
@@ -53,7 +53,7 @@ export const useDeleteProjectRole = () => {
     mutationFn: async ({ projectSlug, id }: TDeleteProjectRoleDTO) => {
       const {
         data: { role }
-      } = await apiRequest.delete(`/api/v1/workspace/${projectSlug}/roles/${id}`);
+      } = await apiRequest.delete(`/api/v2/workspace/${projectSlug}/roles/${id}`);
       return role;
     },
     onSuccess: (_, { projectSlug }) => {

frontend/src/hooks/api/roles/queries.tsx

@@ -7,6 +7,8 @@ import picomatch from "picomatch";
 import { apiRequest } from "@app/config/request";
 import { OrgPermissionSet } from "@app/context/OrgPermissionContext/types";
 import { ProjectPermissionSet } from "@app/context/ProjectPermissionContext/types";
+import { groupBy } from "@app/lib/fn/array";
+import { omit } from "@app/lib/fn/object";
 
 import { OrgUser, TProjectMembership } from "../users/types";
 import {
@@ -49,7 +51,7 @@ export const roleQueryKeys = {
 
 export const getProjectRoles = async (projectId: string) => {
   const { data } = await apiRequest.get<{ roles: Array<Omit<TProjectRole, "permissions">> }>(
-    `/api/v1/workspace/${projectId}/roles`
+    `/api/v2/workspace/${projectId}/roles`
   );
   return data.roles;
 };
@@ -66,7 +68,7 @@ export const useGetProjectRoleBySlug = (projectSlug: string, roleSlug: string) =
     queryKey: roleQueryKeys.getProjectRoleBySlug(projectSlug, roleSlug),
     queryFn: async () => {
       const { data } = await apiRequest.get<{ role: TProjectRole }>(
-        `/api/v1/workspace/${projectSlug}/roles/slug/${roleSlug}`
+        `/api/v2/workspace/${projectSlug}/roles/slug/${roleSlug}`
       );
       return data.role;
     },
@@ -134,7 +136,7 @@ const getUserProjectPermissions = async ({ workspaceId }: TGetUserProjectPermiss
       permissions: PackRule<RawRuleOf<MongoAbility<OrgPermissionSet>>>[];
       membership: Omit<TProjectMembership, "roles"> & { roles: { role: string }[] };
     };
-  }>(`/api/v1/workspace/${workspaceId}/permissions`, {});
+  }>(`/api/v2/workspace/${workspaceId}/permissions`, {});
 
   return data.data;
 };
@@ -146,8 +148,32 @@ export const useGetUserProjectPermissions = ({ workspaceId }: TGetUserProjectPer
     enabled: Boolean(workspaceId),
     select: (data) => {
       const rule = unpackRules<RawRuleOf<MongoAbility<ProjectPermissionSet>>>(data.permissions);
-      const ability = createMongoAbility<ProjectPermissionSet>(rule, { conditionsMatcher });
+      const negatedRules = groupBy(
+        rule.filter((i) => i.inverted && i.conditions),
+        (i) => `${i.subject}-${JSON.stringify(i.conditions)}`
+      );
+      const ability = createMongoAbility<ProjectPermissionSet>(rule, {
+        // this allows in frontend to skip some rules using *
+        conditionsMatcher: (rules) => {
+          return (entity) => {
+            // skip validation if its negated rules
+            const isNegatedRule =
+              // eslint-disable-next-line no-underscore-dangle
+              negatedRules?.[`${entity.__caslSubjectType__}-${JSON.stringify(rules)}`];
+            if (isNegatedRule) {
+              const baseMatcher = conditionsMatcher(rules);
+              return baseMatcher(entity);
+            }
 
+            const rulesStrippedOfWildcard = omit(
+              rules,
+              Object.keys(entity).filter((el) => entity[el]?.includes("*"))
+            );
+            const baseMatcher = conditionsMatcher(rulesStrippedOfWildcard);
+            return baseMatcher(entity);
+          };
+        }
+      });
       const membership = {
         ...data.membership,
         roles: data.membership.roles.map(({ role }) => role)

frontend/src/hooks/api/roles/types.ts

@@ -40,6 +40,7 @@ export type TPermission = {
 
 export type TProjectPermission = {
   conditions?: Record<string, any>;
+  inverted?: boolean;
   action: string | string[];
   subject: string | string[];
 };

frontend/src/lib/fn/array.ts

@@ -13,3 +13,22 @@ export const groupBy = <T, Key extends string | number | symbol>(
     acc[groupId].push(item);
     return acc;
   }, {} as Record<Key, T[]>);
+
+/**
+ * Given a list of items returns a new list with only
+ * unique items. Accepts an optional identity function
+ * to convert each item in the list to a comparable identity
+ * value
+ */
+export const unique = <T, K extends string | number | symbol>(
+  array: readonly T[],
+  toKey?: (item: T) => K
+): T[] => {
+  const valueMap = array.reduce((acc, item) => {
+    const key = toKey ? toKey(item) : (item as unknown as string | number | symbol);
+    if (acc[key]) return acc;
+    acc[key] = item;
+    return acc;
+  }, {} as Record<string | number | symbol, T>);
+  return Object.values(valueMap);
+};

frontend/src/lib/fn/object.ts

@@ -0,0 +1,20 @@
+/**
+ * Omit a list of properties from an object
+ * returning a new object with the properties
+ * that remain
+ */
+export const omit = <T, TKeys extends keyof T>(obj: T, keys: TKeys[]): Omit<T, TKeys> => {
+  if (!obj) return {} as Omit<T, TKeys>;
+  if (!keys || keys.length === 0) return obj as Omit<T, TKeys>;
+  return keys.reduce(
+    (acc, key) => {
+      // Gross, I know, it's mutating the object, but we
+      // are allowing it in this very limited scope due
+      // to the performance implications of an omit func.
+      // Not a pattern or practice to use elsewhere.
+      delete acc[key];
+      return acc;
+    },
+    { ...obj }
+  );
+};

frontend/src/views/Project/MembersPage/components/MembersTab/components/MemberRoleForm/SpecificPrivilegeSection.tsx

@@ -184,20 +184,20 @@ export const SpecificPrivilegeSecretForm = ({
         { action: ProjectPermissionActions.Delete, allowed: data.delete },
         { action: ProjectPermissionActions.Edit, allowed: data.edit }
       ];
-      const conditions: Record<string, any> = { environment: data.environmentSlug };
+      const conditions: { environment: string; secretPath?: { $glob: string } } = {
+        environment: data.environmentSlug
+      };
       if (data.secretPath) {
         conditions.secretPath = { $glob: removeTrailingSlash(data.secretPath) };
       }
       await updateUserPrivilege.mutateAsync({
         privilegeId: privilege.id,
         ...data.temporaryAccess,
-        permissions: actions
+        permissions: {
-          .filter(({ allowed }) => allowed)
+          subject: ProjectPermissionSub.Secrets,
-          .map(({ action }) => ({
+          conditions,
-            action,
+          actions: actions.filter((i) => i.allowed).map((i) => i.action)
-            subject: [ProjectPermissionSub.Secrets],
+        },
-            conditions
-          })),
         projectMembershipId: privilege.projectMembershipId
       });
       createNotification({
@@ -642,15 +642,13 @@ export const SpecificPrivilegeSection = ({ membershipId }: Props) => {
     if (createUserPrivilege.isLoading) return;
     try {
       await createUserPrivilege.mutateAsync({
-        permissions: [
+        permissions: {
-          {
+          actions: [ProjectPermissionActions.Read],
-            action: ProjectPermissionActions.Read,
+          subject: ProjectPermissionSub.Secrets,
-            subject: [ProjectPermissionSub.Secrets],
+          conditions: {
-            conditions: {
+            environment: currentWorkspace?.environments?.[0].slug || ""
-              environment: currentWorkspace?.environments?.[0].slug
-            }
           }
-        ],
+        },
         projectMembershipId: membershipId
       });
       createNotification({

frontend/src/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils.ts

@@ -7,6 +7,7 @@ import {
 } from "@app/context";
 import {
   PermissionConditionOperators,
+  ProjectPermissionDynamicSecretActions,
   TPermissionCondition,
   TPermissionConditionOperators
 } from "@app/context/ProjectPermissionContext/types";
@@ -28,8 +29,12 @@ const CmekPolicyActionSchema = z.object({
   decrypt: z.boolean().optional()
 });
 
-const SecretFolderPolicyActionSchema = z.object({
+const DynamicSecretPolicyActionSchema = z.object({
-  read: z.boolean().optional()
+  [ProjectPermissionDynamicSecretActions.ReadRootCredential]: z.boolean().optional(),
+  [ProjectPermissionDynamicSecretActions.EditRootCredential]: z.boolean().optional(),
+  [ProjectPermissionDynamicSecretActions.DeleteRootCredential]: z.boolean().optional(),
+  [ProjectPermissionDynamicSecretActions.CreateRootCredential]: z.boolean().optional(),
+  [ProjectPermissionDynamicSecretActions.Lease]: z.boolean().optional()
 });
 
 const SecretRollbackPolicyActionSchema = z.object({
@@ -42,11 +47,29 @@ const WorkspacePolicyActionSchema = z.object({
   delete: z.boolean().optional()
 });
 
-const ConditionSchema = z.object({
+const ConditionSchema = z
-  operator: z.string(),
+  .object({
-  lhs: z.string(),
+    operator: z.string(),
-  rhs: z.string().min(1)
+    lhs: z.string(),
-});
+    rhs: z.string().min(1)
+  })
+  .array()
+  .optional()
+  .default([])
+  .refine(
+    (el) => {
+      const lhsOperatorSet = new Set<string>();
+      for (let i = 0; i < el.length; i += 1) {
+        const { lhs, operator } = el[i];
+        if (lhsOperatorSet.has(`${lhs}-${operator}`)) {
+          return false;
+        }
+        lhsOperatorSet.add(`${lhs}-${operator}`);
+      }
+      return true;
+    },
+    { message: "Duplicate operator found for a condition" }
+  );
 
 export const formSchema = z.object({
   name: z.string().trim(),
@@ -59,27 +82,29 @@ export const formSchema = z.object({
   permissions: z
     .object({
       [ProjectPermissionSub.Secrets]: GeneralPolicyActionSchema.extend({
-        conditions: ConditionSchema.array()
+        inverted: z.boolean().optional(),
-          .optional()
+        conditions: ConditionSchema
-          .default([])
+      })
-          .refine(
+        .array()
-            (el) => {
+        .default([]),
-              const lhsOperatorSet = new Set<string>();
+      [ProjectPermissionSub.SecretFolders]: GeneralPolicyActionSchema.extend({
-              for (let i = 0; i < el.length; i += 1) {
+        inverted: z.boolean().optional(),
-                const { lhs, operator } = el[i];
+        conditions: ConditionSchema
-                if (lhsOperatorSet.has(`${lhs}-${operator}`)) {
+      })
-                  return false;
+        .array()
-                }
+        .default([]),
-                lhsOperatorSet.add(`${lhs}-${operator}`);
+      [ProjectPermissionSub.SecretImports]: GeneralPolicyActionSchema.extend({
-              }
+        inverted: z.boolean().optional(),
-              return true;
+        conditions: ConditionSchema
-            },
+      })
-            { message: "Duplicate operator found for a condition" }
+        .array()
-          )
+        .default([]),
+      [ProjectPermissionSub.DynamicSecrets]: DynamicSecretPolicyActionSchema.extend({
+        inverted: z.boolean().optional(),
+        conditions: ConditionSchema
       })
         .array()
         .default([]),
-      [ProjectPermissionSub.SecretFolders]: SecretFolderPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Member]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Groups]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Identity]: GeneralPolicyActionSchema.array().default([]),
@@ -98,7 +123,7 @@ export const formSchema = z.object({
       [ProjectPermissionSub.CertificateTemplates]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.SecretApproval]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.SecretRollback]: SecretRollbackPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.Workspace]: WorkspacePolicyActionSchema.array().default([]),
+      [ProjectPermissionSub.Project]: WorkspacePolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Tags]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.SecretRotation]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Kms]: GeneralPolicyActionSchema.array().default([]),
@@ -110,8 +135,22 @@ export const formSchema = z.object({
 
 export type TFormSchema = z.infer<typeof formSchema>;
 
+type TConditionalFields =
+  | ProjectPermissionSub.Secrets
+  | ProjectPermissionSub.SecretFolders
+  | ProjectPermissionSub.SecretImports
+  | ProjectPermissionSub.DynamicSecrets;
+
+export const isConditionalSubjects = (
+  subject: ProjectPermissionSub
+): subject is TConditionalFields =>
+  subject === (ProjectPermissionSub.Secrets as const) ||
+  subject === ProjectPermissionSub.DynamicSecrets ||
+  subject === ProjectPermissionSub.SecretImports ||
+  subject === ProjectPermissionSub.SecretFolders;
+
 const convertCaslConditionToFormOperator = (caslConditions: TPermissionCondition) => {
-  const formConditions: z.infer<typeof ConditionSchema>[] = [];
+  const formConditions: z.infer<typeof ConditionSchema> = [];
   Object.entries(caslConditions).forEach(([type, condition]) => {
     if (typeof condition === "string") {
       formConditions.push({
@@ -138,12 +177,15 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
   const formVal: Partial<TFormSchema["permissions"]> = {};
 
   permissions.forEach((permission) => {
-    const { subject: caslSub, action, conditions } = permission;
+    const { subject: caslSub, action, conditions, inverted } = permission;
     const subject = (typeof caslSub === "string" ? caslSub : caslSub[0]) as ProjectPermissionSub;
 
     if (
       [
         ProjectPermissionSub.Secrets,
+        ProjectPermissionSub.DynamicSecrets,
+        ProjectPermissionSub.SecretFolders,
+        ProjectPermissionSub.SecretImports,
         ProjectPermissionSub.Member,
         ProjectPermissionSub.Groups,
         ProjectPermissionSub.Identity,
@@ -166,37 +208,67 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
         ProjectPermissionSub.Kms
       ].includes(subject)
     ) {
-      const canRead = action.includes(ProjectPermissionActions.Read);
-      const canEdit = action.includes(ProjectPermissionActions.Edit);
-      const canDelete = action.includes(ProjectPermissionActions.Delete);
-      const canCreate = action.includes(ProjectPermissionActions.Create);
-
       // from above statement we are sure it won't be undefined
-      if (subject === ProjectPermissionSub.Secrets) {
+      if (isConditionalSubjects(subject)) {
         if (!formVal[subject]) formVal[subject] = [];
-        formVal[subject]!.push({
+
-          read: canRead,
+        if (subject === ProjectPermissionSub.DynamicSecrets) {
-          create: canCreate,
+          const canRead = action.includes(ProjectPermissionDynamicSecretActions.ReadRootCredential);
-          edit: canEdit,
+          const canEdit = action.includes(ProjectPermissionDynamicSecretActions.EditRootCredential);
-          delete: canDelete,
+          const canDelete = action.includes(
-          conditions: conditions ? convertCaslConditionToFormOperator(conditions) : []
+            ProjectPermissionDynamicSecretActions.DeleteRootCredential
-        });
+          );
+          const canCreate = action.includes(
+            ProjectPermissionDynamicSecretActions.CreateRootCredential
+          );
+          const canLease = action.includes(ProjectPermissionDynamicSecretActions.Lease);
+
+          // from above statement we are sure it won't be undefined
+          formVal[subject]!.push({
+            [ProjectPermissionDynamicSecretActions.ReadRootCredential]: canRead,
+            [ProjectPermissionDynamicSecretActions.CreateRootCredential]: canCreate,
+            [ProjectPermissionDynamicSecretActions.EditRootCredential]: canEdit,
+            [ProjectPermissionDynamicSecretActions.DeleteRootCredential]: canDelete,
+            conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
+            inverted,
+            [ProjectPermissionDynamicSecretActions.Lease]: canLease
+          });
+        } else {
+          // for other subjects
+          const canRead = action.includes(ProjectPermissionActions.Read);
+          const canEdit = action.includes(ProjectPermissionActions.Edit);
+          const canDelete = action.includes(ProjectPermissionActions.Delete);
+          const canCreate = action.includes(ProjectPermissionActions.Create);
+          formVal[subject]!.push({
+            read: canRead,
+            create: canCreate,
+            edit: canEdit,
+            delete: canDelete,
+            conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
+            inverted
+          });
+        }
       } else {
         // deduplicate multiple rules for other policies
         // because they don't have condition it doesn't make sense for multiple rules
+        const canRead = action.includes(ProjectPermissionActions.Read);
+        const canEdit = action.includes(ProjectPermissionActions.Edit);
+        const canDelete = action.includes(ProjectPermissionActions.Delete);
+        const canCreate = action.includes(ProjectPermissionActions.Create);
+
         if (!formVal[subject]) formVal[subject] = [{}];
         if (canRead) formVal[subject as ProjectPermissionSub.Member]![0].read = true;
         if (canEdit) formVal[subject as ProjectPermissionSub.Member]![0].edit = true;
         if (canCreate) formVal[subject as ProjectPermissionSub.Member]![0].create = true;
         if (canDelete) formVal[subject as ProjectPermissionSub.Member]![0].delete = true;
       }
-    } else if (subject === ProjectPermissionSub.Workspace) {
+    } else if (subject === ProjectPermissionSub.Project) {
       const canEdit = action.includes(ProjectPermissionActions.Edit);
       const canDelete = action.includes(ProjectPermissionActions.Delete);
       if (!formVal[subject]) formVal[subject] = [{}];
 
       // from above statement we are sure it won't be undefined
-      if (canEdit) formVal[subject as ProjectPermissionSub.Workspace]![0].edit = true;
+      if (canEdit) formVal[subject as ProjectPermissionSub.Project]![0].edit = true;
       if (canDelete) formVal[subject as ProjectPermissionSub.Member]![0].delete = true;
     } else if (subject === ProjectPermissionSub.SecretRollback) {
       const canRead = action.includes(ProjectPermissionActions.Read);
@@ -206,12 +278,6 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
       // from above statement we are sure it won't be undefined
       if (canRead) formVal[subject as ProjectPermissionSub.Member]![0].read = true;
       if (canCreate) formVal[subject as ProjectPermissionSub.Member]![0].create = true;
-    } else if (subject === ProjectPermissionSub.SecretFolders) {
-      const canRead = action.includes(ProjectPermissionActions.Read);
-      if (!formVal[subject]) formVal[subject] = [{}];
-
-      // from above statement we are sure it won't be undefined
-      if (canRead) formVal[subject as ProjectPermissionSub.Member]![0].read = true;
     } else if (subject === ProjectPermissionSub.Cmek) {
       const canRead = action.includes(ProjectPermissionCmekActions.Read);
       const canEdit = action.includes(ProjectPermissionCmekActions.Edit);
@@ -264,7 +330,7 @@ export const formRolePermission2API = (formVal: TFormSchema["permissions"]) => {
   Object.entries(formVal || {}).forEach(([subject, rules]) => {
     rules.forEach((actions) => {
       const caslActions = Object.keys(actions).filter(
-        (el) => actions?.[el as keyof typeof actions] && el !== "conditions"
+        (el) => actions?.[el as keyof typeof actions] && el !== "conditions" && el !== "inverted"
       );
       const caslConditions =
         "conditions" in actions
@@ -274,6 +340,7 @@ export const formRolePermission2API = (formVal: TFormSchema["permissions"]) => {
       permissions.push({
         action: caslActions,
         subject,
+        inverted: (actions as { inverted?: boolean })?.inverted,
         conditions: caslConditions
       });
     });
@@ -288,7 +355,7 @@ export type TProjectPermissionObject = {
       label: string;
       value: keyof Omit<
         NonNullable<NonNullable<TFormSchema["permissions"]>[K]>[number],
-        "conditions"
+        "conditions" | "inverted"
       >;
     }[];
   };
@@ -306,7 +373,42 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
   },
   [ProjectPermissionSub.SecretFolders]: {
     title: "Secret Folders",
-    actions: [{ label: "Read Only", value: "read" }]
+    actions: [
+      { label: "Create", value: "create" },
+      { label: "Modify", value: "edit" },
+      { label: "Remove", value: "delete" }
+    ]
+  },
+  [ProjectPermissionSub.SecretImports]: {
+    title: "Secret Imports",
+    actions: [
+      { label: "Read", value: "read" },
+      { label: "Create", value: "create" },
+      { label: "Modify", value: "edit" },
+      { label: "Remove", value: "delete" }
+    ]
+  },
+  [ProjectPermissionSub.DynamicSecrets]: {
+    title: "Dynamic Secrets",
+    actions: [
+      {
+        label: "Read root credentials",
+        value: ProjectPermissionDynamicSecretActions.ReadRootCredential
+      },
+      {
+        label: "Create root credentials",
+        value: ProjectPermissionDynamicSecretActions.CreateRootCredential
+      },
+      {
+        label: "Modify root credentials",
+        value: ProjectPermissionDynamicSecretActions.EditRootCredential
+      },
+      {
+        label: "Remove root credentials",
+        value: ProjectPermissionDynamicSecretActions.DeleteRootCredential
+      },
+      { label: "Manage Leases", value: ProjectPermissionDynamicSecretActions.Lease }
+    ]
   },
   [ProjectPermissionSub.Cmek]: {
     title: "KMS",
@@ -332,7 +434,7 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
       { label: "Remove", value: "delete" }
     ]
   },
-  [ProjectPermissionSub.Workspace]: {
+  [ProjectPermissionSub.Project]: {
     title: "Project",
     actions: [
       { label: "Update project details", value: "edit" },

frontend/src/views/Project/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx

@@ -10,13 +10,15 @@ import { ProjectPermissionSub, useWorkspace } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { useGetProjectRoleBySlug, useUpdateProjectRole } from "@app/hooks/api";
 
-import { GeneralPermissionOptions } from "./components/GeneralPermissionOptions";
+import { GeneralPermissionConditions } from "./components/GeneralPermissionConditions";
+import { GeneralPermissionPolicies } from "./components/GeneralPermissionPolicies";
 import { NewPermissionRule } from "./components/NewPermissionRule";
 import { SecretPermissionConditions } from "./components/SecretPermissionConditions";
 import { PermissionEmptyState } from "./PermissionEmptyState";
 import {
   formRolePermission2API,
   formSchema,
+  isConditionalSubjects,
   PROJECT_PERMISSION_OBJECT,
   rolePermission2Form,
   TFormSchema
@@ -27,6 +29,17 @@ type Props = {
   isDisabled?: boolean;
 };
 
+const renderConditionalComponents = (subject: ProjectPermissionSub, isDisabled?: boolean) => {
+  if (subject === ProjectPermissionSub.Secrets)
+    return <SecretPermissionConditions isDisabled={isDisabled} />;
+
+  if (isConditionalSubjects(subject)) {
+    return <GeneralPermissionConditions isDisabled={isDisabled} type={subject} />;
+  }
+
+  return undefined;
+};
+
 export const RolePermissionsSection = ({ roleSlug, isDisabled }: Props) => {
   const { currentWorkspace } = useWorkspace();
   const { popUp, handlePopUpToggle } = usePopUp(["createPolicy"] as const);
@@ -130,17 +143,15 @@ export const RolePermissionsSection = ({ roleSlug, isDisabled }: Props) => {
         <div className="py-4">
           {!isLoading && <PermissionEmptyState />}
           {(Object.keys(PROJECT_PERMISSION_OBJECT) as ProjectPermissionSub[]).map((subject) => (
-            <GeneralPermissionOptions
+            <GeneralPermissionPolicies
               subject={subject}
               actions={PROJECT_PERMISSION_OBJECT[subject].actions}
               title={PROJECT_PERMISSION_OBJECT[subject].title}
               key={`project-permission-${subject}`}
               isDisabled={isDisabled}
             >
-              {subject === ProjectPermissionSub.Secrets ? (
+              {renderConditionalComponents(subject, isDisabled)}
-                <SecretPermissionConditions isDisabled={isDisabled} />
+            </GeneralPermissionPolicies>
-              ) : undefined}
-            </GeneralPermissionOptions>
           ))}
         </div>
       </FormProvider>

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/GeneralPermissionConditions.tsx

@@ -0,0 +1,176 @@
+import { Controller, useFieldArray, useFormContext } from "react-hook-form";
+import { faInfoCircle, faPlus, faTrash, faWarning } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import {
+  Button,
+  FormControl,
+  IconButton,
+  Input,
+  Select,
+  SelectItem,
+  Tooltip
+} from "@app/components/v2";
+import {
+  PermissionConditionOperators,
+  ProjectPermissionSub
+} from "@app/context/ProjectPermissionContext/types";
+
+import { TFormSchema } from "../ProjectRoleModifySection.utils";
+import {
+  getConditionOperatorHelperInfo,
+  renderOperatorSelectItems
+} from "./PermissionConditionHelpers";
+
+type Props = {
+  position?: number;
+  isDisabled?: boolean;
+  type:
+    | ProjectPermissionSub.DynamicSecrets
+    | ProjectPermissionSub.SecretFolders
+    | ProjectPermissionSub.SecretImports;
+};
+
+export const GeneralPermissionConditions = ({ position = 0, isDisabled, type }: Props) => {
+  const {
+    control,
+    watch,
+    formState: { errors }
+  } = useFormContext<TFormSchema>();
+  const items = useFieldArray({
+    control,
+    name: `permissions.${type}.${position}.conditions`
+  });
+
+  return (
+    <div className="mt-6 border-t border-t-mineshaft-600 bg-mineshaft-800 pt-2">
+      <p className="mt-2 text-gray-300">Conditions</p>
+      <p className="mb-2 text-sm text-mineshaft-400">
+        When this policy should apply (always if no conditions are added).
+      </p>
+      <div className="mt-2 flex flex-col space-y-2">
+        {items.fields.map((el, index) => {
+          const condition =
+            (watch(`permissions.${type}.${position}.conditions.${index}`) as {
+              lhs: string;
+              rhs: string;
+              operator: string;
+            }) || {};
+          return (
+            <div
+              key={el.id}
+              className="flex gap-2 bg-mineshaft-800 first:rounded-t-md last:rounded-b-md"
+            >
+              <div className="w-1/4">
+                <Controller
+                  control={control}
+                  name={`permissions.${type}.${position}.conditions.${index}.lhs`}
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      isError={Boolean(error?.message)}
+                      errorText={error?.message}
+                      className="mb-0"
+                    >
+                      <Select
+                        defaultValue={field.value}
+                        {...field}
+                        onValueChange={(e) => field.onChange(e)}
+                        className="w-full"
+                      >
+                        <SelectItem value="environment">Environment Slug</SelectItem>
+                        <SelectItem value="secretPath">Secret Path</SelectItem>
+                      </Select>
+                    </FormControl>
+                  )}
+                />
+              </div>
+              <div className="flex w-36 items-center space-x-2">
+                <Controller
+                  control={control}
+                  name={`permissions.${type}.${position}.conditions.${index}.operator`}
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      isError={Boolean(error?.message)}
+                      errorText={error?.message}
+                      className="mb-0 flex-grow"
+                    >
+                      <Select
+                        defaultValue={field.value}
+                        {...field}
+                        onValueChange={(e) => field.onChange(e)}
+                        className="w-full"
+                      >
+                        {renderOperatorSelectItems(condition.lhs)}
+                      </Select>
+                    </FormControl>
+                  )}
+                />
+                <div>
+                  <Tooltip
+                    asChild
+                    content={getConditionOperatorHelperInfo(
+                      condition?.operator as PermissionConditionOperators
+                    )}
+                    className="max-w-xs"
+                  >
+                    <FontAwesomeIcon icon={faInfoCircle} size="xs" className="text-gray-400" />
+                  </Tooltip>
+                </div>
+              </div>
+              <div className="flex-grow">
+                <Controller
+                  control={control}
+                  name={`permissions.${type}.${position}.conditions.${index}.rhs`}
+                  render={({ field, fieldState: { error } }) => (
+                    <FormControl
+                      isError={Boolean(error?.message)}
+                      errorText={error?.message}
+                      className="mb-0 flex-grow"
+                    >
+                      <Input {...field} />
+                    </FormControl>
+                  )}
+                />
+              </div>
+              <div>
+                <IconButton
+                  ariaLabel="plus"
+                  variant="outline_bg"
+                  className="p-2.5"
+                  onClick={() => items.remove(index)}
+                >
+                  <FontAwesomeIcon icon={faTrash} />
+                </IconButton>
+              </div>
+            </div>
+          );
+        })}
+      </div>
+      {errors?.permissions?.[type]?.[position]?.conditions?.message && (
+        <div className="flex items-center space-x-2 py-2 text-sm text-gray-400">
+          <FontAwesomeIcon icon={faWarning} className="text-red" />
+          <span>{errors?.permissions?.[type]?.[position]?.conditions?.message}</span>
+        </div>
+      )}
+      <div>{}</div>
+      <div>
+        <Button
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          variant="star"
+          size="xs"
+          className="mt-3"
+          isDisabled={isDisabled}
+          onClick={() =>
+            items.append({
+              lhs: "environment",
+              operator: PermissionConditionOperators.$EQ,
+              rhs: ""
+            })
+          }
+        >
+          Add Condition
+        </Button>
+      </div>
+    </div>
+  );
+};

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/GeneralPermissionPolicies.tsx

@@ -1,14 +1,24 @@
 import { cloneElement } from "react";
 import { Controller, useFieldArray, useFormContext } from "react-hook-form";
-import { faChevronDown, faChevronRight, faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
+import {
+  faChevronDown,
+  faChevronRight,
+  faInfoCircle,
+  faPlus,
+  faTrash
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { twMerge } from "tailwind-merge";
 
-import { Button, Checkbox, Tag } from "@app/components/v2";
+import { Button, Checkbox, Select, SelectItem, Tag, Tooltip } from "@app/components/v2";
 import { ProjectPermissionSub } from "@app/context";
 import { useToggle } from "@app/hooks";
 
-import { TFormSchema, TProjectPermissionObject } from "../ProjectRoleModifySection.utils";
+import {
+  isConditionalSubjects,
+  TFormSchema,
+  TProjectPermissionObject
+} from "../ProjectRoleModifySection.utils";
 
 type Props<T extends ProjectPermissionSub> = {
   title: string;
@@ -18,7 +28,7 @@ type Props<T extends ProjectPermissionSub> = {
   isDisabled?: boolean;
 };
 
-export const GeneralPermissionOptions = <T extends keyof NonNullable<TFormSchema["permissions"]>>({
+export const GeneralPermissionPolicies = <T extends keyof NonNullable<TFormSchema["permissions"]>>({
   subject,
   actions,
   children,
@@ -63,6 +73,44 @@ export const GeneralPermissionOptions = <T extends keyof NonNullable<TFormSchema
         <div key={`select-${subject}-type`} className="flex flex-col space-y-4 bg-bunker-800 p-6">
           {items.fields.map((el, rootIndex) => (
             <div key={el.id} className="bg-mineshaft-800 p-5 first:rounded-t-md last:rounded-b-md">
+              {isConditionalSubjects(subject) && (
+                <div className="mt-4 mb-6 flex w-full items-center text-gray-300">
+                  <div className="w-1/4">Permission</div>
+                  <div className="mr-4 w-1/4">
+                    <Controller
+                      defaultValue={false as any}
+                      name={`permissions.${subject}.${rootIndex}.inverted`}
+                      render={({ field }) => (
+                        <Select
+                          value={String(field.value)}
+                          onValueChange={(val) => field.onChange(val === "true")}
+                          containerClassName="w-full"
+                          className="w-full"
+                        >
+                          <SelectItem value="false">Allow</SelectItem>
+                          <SelectItem value="true">Forbid</SelectItem>
+                        </Select>
+                      )}
+                    />
+                  </div>
+                  <div>
+                    <Tooltip
+                      asChild
+                      content={
+                        <>
+                          <p>
+                            Whether to allow or forbid the selected actions when the following
+                            conditions (if any) are met.
+                          </p>
+                          <p className="mt-2">Forbid rules must come after allow rules.</p>
+                        </>
+                      }
+                    >
+                      <FontAwesomeIcon icon={faInfoCircle} size="sm" className="text-gray-400" />
+                    </Tooltip>
+                  </div>
+                </div>
+              )}
               <div className="flex text-gray-300">
                 <div className="w-1/4">Actions</div>
                 <div className="flex flex-grow flex-wrap justify-start gap-8">
@@ -98,10 +146,10 @@ export const GeneralPermissionOptions = <T extends keyof NonNullable<TFormSchema
               <div
                 className={twMerge(
                   "mt-4 flex justify-start space-x-4",
-                  subject === ProjectPermissionSub.Secrets && "justify-end"
+                  isConditionalSubjects(subject) && "justify-end"
                 )}
               >
-                {!isDisabled && subject === ProjectPermissionSub.Secrets && (
+                {!isDisabled && isConditionalSubjects(subject) && (
                   <Button
                     leftIcon={<FontAwesomeIcon icon={faPlus} />}
                     variant="star"

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/NewPermissionRule.tsx

@@ -15,6 +15,7 @@ import { ProjectPermissionSub } from "@app/context";
 
 import {
   formSchema,
+  isConditionalSubjects,
   PROJECT_PERMISSION_OBJECT,
   TFormSchema
 } from "../ProjectRoleModifySection.utils";
@@ -89,7 +90,7 @@ export const NewPermissionRule = ({ onClose }: Props) => {
         <Button
           onClick={form.handleSubmit((el) => {
             const rootPolicyValue = rootForm.getValues("permissions")?.[el.type];
-            if (rootPolicyValue && selectedSubject === ProjectPermissionSub.Secrets) {
+            if (rootPolicyValue && isConditionalSubjects(selectedSubject)) {
               rootForm.setValue(
                 `permissions.${el.type}`,
                 // eslint-disable-next-line @typescript-eslint/ban-ts-comment

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/PermissionConditionHelpers.tsx

@@ -0,0 +1,32 @@
+import { GlobPermissionInfo } from "@app/components/permissions";
+import { SelectItem } from "@app/components/v2";
+import { PermissionConditionOperators } from "@app/context/ProjectPermissionContext/types";
+
+export const getConditionOperatorHelperInfo = (type: PermissionConditionOperators) => {
+  switch (type) {
+    case PermissionConditionOperators.$EQ:
+      return "Value should equal specified value.";
+    case PermissionConditionOperators.$NEQ:
+      return "Value should not equal specified value.";
+    case PermissionConditionOperators.$IN:
+      return "List of comma-separated values that match a given value.";
+    case PermissionConditionOperators.$GLOB:
+      return <GlobPermissionInfo />;
+    default:
+      return "";
+  }
+};
+
+export const renderOperatorSelectItems = (type: string) => {
+  if (type === "secretTags") {
+    return <SelectItem value={PermissionConditionOperators.$IN}>Contains</SelectItem>;
+  }
+  return (
+    <>
+      <SelectItem value={PermissionConditionOperators.$EQ}>Equal</SelectItem>
+      <SelectItem value={PermissionConditionOperators.$NEQ}>Not Equal</SelectItem>
+      <SelectItem value={PermissionConditionOperators.$GLOB}>Glob Match</SelectItem>
+      <SelectItem value={PermissionConditionOperators.$IN}>Contains</SelectItem>
+    </>
+  );
+};

frontend/src/views/Project/RolePage/components/RolePermissionsSection/components/SecretPermissionConditions.tsx

@@ -1,27 +1,34 @@
 import { Controller, useFieldArray, useFormContext } from "react-hook-form";
-import { faPlus, faTrash, faWarning } from "@fortawesome/free-solid-svg-icons";
+import { faInfoCircle, faPlus, faTrash, faWarning } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
-import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2";
+import {
+  Button,
+  FormControl,
+  IconButton,
+  Input,
+  Select,
+  SelectItem,
+  Tooltip
+} from "@app/components/v2";
 import { PermissionConditionOperators } from "@app/context/ProjectPermissionContext/types";
 
 import { TFormSchema } from "../ProjectRoleModifySection.utils";
+import {
+  getConditionOperatorHelperInfo,
+  renderOperatorSelectItems
+} from "./PermissionConditionHelpers";
 
 type Props = {
   position?: number;
   isDisabled?: boolean;
 };
 
-const getValueLabel = (type: string) => {
-  if (type === "environment") return "Environment slug";
-  if (type === "secretPath") return "Folder path";
-  return "";
-};
-
 export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props) => {
   const {
     control,
     watch,
+    setValue,
     formState: { errors }
   } = useFormContext<TFormSchema>();
   const items = useFieldArray({
@@ -30,10 +37,18 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
   });
 
   return (
-    <div className="mt-6 border-t  border-t-gray-800 bg-mineshaft-800  pt-2">
+    <div className="mt-6 border-t border-t-mineshaft-600 bg-mineshaft-800 pt-2">
+      <p className="mt-2 text-gray-300">Conditions</p>
+      <p className="mb-2 text-sm text-mineshaft-400">
+        When this policy should apply (always if no conditions are added).
+      </p>
       <div className="mt-2 flex flex-col space-y-2">
         {items.fields.map((el, index) => {
-          const lhs = watch(`permissions.secrets.${position}.conditions.${index}.lhs`);
+          const condition = watch(`permissions.secrets.${position}.conditions.${index}`) as {
+            lhs: string;
+            rhs: string;
+            operator: string;
+          };
           return (
             <div
               key={el.id}
@@ -52,17 +67,25 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                       <Select
                         defaultValue={field.value}
                         {...field}
-                        onValueChange={(e) => field.onChange(e)}
+                        onValueChange={(e) => {
+                          setValue(
+                            `permissions.secrets.${position}.conditions.${index}.operator`,
+                            PermissionConditionOperators.$IN as never
+                          );
+                          field.onChange(e);
+                        }}
                         className="w-full"
                       >
                         <SelectItem value="environment">Environment Slug</SelectItem>
                         <SelectItem value="secretPath">Secret Path</SelectItem>
+                        <SelectItem value="secretName">Secret Name</SelectItem>
+                        <SelectItem value="secretTags">Secret Tags</SelectItem>
                       </Select>
                     </FormControl>
                   )}
                 />
               </div>
-              <div className="w-36">
+              <div className="flex w-36 items-center space-x-2">
                 <Controller
                   control={control}
                   name={`permissions.secrets.${position}.conditions.${index}.operator`}
@@ -78,16 +101,22 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                         onValueChange={(e) => field.onChange(e)}
                         className="w-full"
                       >
-                        <SelectItem value={PermissionConditionOperators.$EQ}>Equal</SelectItem>
+                        {renderOperatorSelectItems(condition.lhs)}
-                        <SelectItem value={PermissionConditionOperators.$NEQ}>Not Equal</SelectItem>
-                        <SelectItem value={PermissionConditionOperators.$GLOB}>
-                          Glob Match
-                        </SelectItem>
-                        <SelectItem value={PermissionConditionOperators.$IN}>Contains</SelectItem>
                       </Select>
                     </FormControl>
                   )}
                 />
+                <div>
+                  <Tooltip
+                    asChild
+                    content={getConditionOperatorHelperInfo(
+                      condition?.operator as PermissionConditionOperators
+                    )}
+                    className="max-w-xs"
+                  >
+                    <FontAwesomeIcon icon={faInfoCircle} size="xs" className="text-gray-400" />
+                  </Tooltip>
+                </div>
               </div>
               <div className="flex-grow">
                 <Controller
@@ -99,7 +128,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
                       errorText={error?.message}
                       className="mb-0 flex-grow"
                     >
-                      <Input {...field} placeholder={getValueLabel(lhs)} />
+                      <Input {...field} />
                     </FormControl>
                   )}
                 />
@@ -124,7 +153,6 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
           <span>{errors?.permissions?.secrets?.[position]?.conditions?.message}</span>
         </div>
       )}
-      <div>{}</div>
       <div>
         <Button
           leftIcon={<FontAwesomeIcon icon={faPlus} />}
@@ -140,7 +168,7 @@ export const SecretPermissionConditions = ({ position = 0, isDisabled }: Props)
             })
           }
         >
-          New Condition
+          Add Condition
         </Button>
       </div>
     </div>

frontend/src/views/SecretMainPage/SecretMainPage.tsx

@@ -12,6 +12,7 @@ import { PermissionDeniedBanner } from "@app/components/permissions";
 import { Checkbox, ContentLoader, Pagination, Tooltip } from "@app/components/v2";
 import {
   ProjectPermissionActions,
+  ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub,
   useProjectPermission,
   useWorkspace
@@ -37,7 +38,7 @@ import { ActionBar } from "./components/ActionBar";
 import { CreateSecretForm } from "./components/CreateSecretForm";
 import { PitDrawer } from "./components/PitDrawer";
 import { SecretDropzone } from "./components/SecretDropzone";
-import { SecretListView } from "./components/SecretListView";
+import { SecretListView, SecretNoAccessListView } from "./components/SecretListView";
 import { SnapshotView } from "./components/SnapshotView";
 import {
   StoreProvider,
@@ -83,8 +84,24 @@ const SecretMainPageContent = () => {
   const secretPath = (router.query.secretPath as string) || "/";
   const canReadSecret = permission.can(
     ProjectPermissionActions.Read,
-    subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    subject(ProjectPermissionSub.Secrets, {
+      environment,
+      secretPath,
+      secretName: "*",
+      secretTags: ["*"]
+    })
   );
+
+  const canReadSecretImports = permission.can(
+    ProjectPermissionActions.Read,
+    subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
+  );
+
+  const canReadDynamicSecret = permission.can(
+    ProjectPermissionDynamicSecretActions.ReadRootCredential,
+    subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })
+  );
+
   const canDoReadRollback = permission.can(
     ProjectPermissionActions.Read,
     ProjectPermissionSub.SecretRollback
@@ -93,11 +110,12 @@ const SecretMainPageContent = () => {
   const defaultFilterState = {
     tags: {},
     searchFilter: (router.query.searchFilter as string) || "",
+    // these should always be on by default for the UI, they will be disabled for the query below based off permissions
     include: {
       [RowType.Folder]: true,
-      [RowType.Import]: canReadSecret,
+      [RowType.Import]: true,
-      [RowType.DynamicSecret]: canReadSecret,
+      [RowType.DynamicSecret]: true,
-      [RowType.Secret]: canReadSecret
+      [RowType.Secret]: true
     }
   };
 
@@ -105,19 +123,6 @@ const SecretMainPageContent = () => {
   const [debouncedSearchFilter, setDebouncedSearchFilter] = useDebounce(filter.searchFilter);
   const [filterHistory, setFilterHistory] = useState<Map<string, Filter>>(new Map());
 
-  // change filters if permissions change at different paths/env
-  useEffect(() => {
-    setFilter((prev) => ({
-      ...prev,
-      include: {
-        [RowType.Folder]: true,
-        [RowType.Import]: canReadSecret,
-        [RowType.DynamicSecret]: canReadSecret,
-        [RowType.Secret]: canReadSecret
-      }
-    }));
-  }, [canReadSecret]);
-
   useEffect(() => {
     if (
       !isWorkspaceLoading &&
@@ -145,9 +150,9 @@ const SecretMainPageContent = () => {
     orderBy,
     search: debouncedSearchFilter,
     orderDirection,
-    includeImports: canReadSecret && filter.include.import,
+    includeImports: canReadSecretImports && filter.include.import,
     includeFolders: filter.include.folder,
-    includeDynamicSecrets: canReadSecret && filter.include.dynamic,
+    includeDynamicSecrets: canReadDynamicSecret && filter.include.dynamic,
     includeSecrets: canReadSecret && filter.include.secret,
     tags: filter.tags
   });
@@ -210,8 +215,20 @@ const SecretMainPageContent = () => {
     isPaused: !canDoReadRollback
   });
 
+  const noAccessSecretCount = Math.max(
+    (page * perPage > totalCount ? totalCount % perPage : perPage) -
+      (imports?.length || 0) -
+      (folders?.length || 0) -
+      (secrets?.length || 0) -
+      (dynamicSecrets?.length || 0),
+    0
+  );
   const isNotEmpty = Boolean(
-    secrets?.length || folders?.length || imports?.length || dynamicSecrets?.length
+    secrets?.length ||
+      folders?.length ||
+      imports?.length ||
+      dynamicSecrets?.length ||
+      noAccessSecretCount
   );
 
   const handleSortToggle = () =>
@@ -330,7 +347,6 @@ const SecretMainPageContent = () => {
     setFilter(defaultFilterState);
     setDebouncedSearchFilter("");
   };
-
   return (
     <div className="container mx-auto flex flex-col px-6 text-mineshaft-50 dark:[color-scheme:dark]">
       <SecretV2MigrationSection />
@@ -411,49 +427,53 @@ const SecretMainPageContent = () => {
                   </div>
                   <div className="flex-grow px-4 py-2">Value</div>
                 </div>
-              )}
+                )}
-              {canReadSecret && imports?.length && (
+                {canReadSecretImports && Boolean(imports?.length) && (
-                <SecretImportListView
+                  <SecretImportListView
-                  searchTerm={debouncedSearchFilter}
+                    searchTerm={debouncedSearchFilter}
-                  secretImports={imports}
+                    secretImports={imports}
-                  isFetching={isDetailsFetching}
+                    isFetching={isDetailsFetching}
-                  environment={environment}
+                    environment={environment}
-                  workspaceId={workspaceId}
+                    workspaceId={workspaceId}
-                  secretPath={secretPath}
+                    secretPath={secretPath}
-                  importedSecrets={importedSecrets}
+                    importedSecrets={importedSecrets}
-                />
+                  />
-              )}
+                )}
-              {folders?.length && (
+                {Boolean(folders?.length) && (
-                <FolderListView
+                  <FolderListView
-                  folders={folders}
+                    folders={folders}
-                  environment={environment}
+                    environment={environment}
-                  workspaceId={workspaceId}
+                    workspaceId={workspaceId}
-                  secretPath={secretPath}
+                    secretPath={secretPath}
-                  onNavigateToFolder={handleResetFilter}
+                    onNavigateToFolder={handleResetFilter}
-                />
+                  />
-              )}
+                )}
-              {canReadSecret && dynamicSecrets?.length && (
+                {canReadDynamicSecret && Boolean(dynamicSecrets?.length) && (
-                <DynamicSecretListView
+                  <DynamicSecretListView
-                  environment={environment}
+                    environment={environment}
-                  projectSlug={projectSlug}
+                    projectSlug={projectSlug}
-                  secretPath={secretPath}
+                    secretPath={secretPath}
-                  dynamicSecrets={dynamicSecrets}
+                    dynamicSecrets={dynamicSecrets}
-                />
+                  />
-              )}
+                )}
-              {canReadSecret && secrets?.length && (
+                {canReadSecret && Boolean(secrets?.length) && (
-                <SecretListView
+                  <SecretListView
-                  secrets={secrets}
+                    secrets={secrets}
-                  tags={tags}
+                    tags={tags}
-                  isVisible={isVisible}
+                    isVisible={isVisible}
-                  environment={environment}
+                    environment={environment}
-                  workspaceId={workspaceId}
+                    workspaceId={workspaceId}
-                  secretPath={secretPath}
+                    secretPath={secretPath}
-                  isProtectedBranch={isProtectedBranch}
+                    isProtectedBranch={isProtectedBranch}
-                />
+                  />
-              )}
+                )}
-              {!canReadSecret && folders?.length === 0 && <PermissionDeniedBanner />}
+                {canReadSecret && <SecretNoAccessListView count={noAccessSecretCount} />}
+                {!canReadSecret &&
+                  !canReadDynamicSecret &&
+                  !canReadSecretImports &&
+                  folders?.length === 0 && <PermissionDeniedBanner />}
+              </div>
             </div>
-          </div>
           {!isDetailsLoading && totalCount > 0 && (
             <Pagination
               startAdornment={

frontend/src/views/SecretMainPage/components/ActionBar/ActionBar.tsx

@@ -47,8 +47,8 @@ import {
 } from "@app/components/v2";
 import {
   ProjectPermissionActions,
+  ProjectPermissionDynamicSecretActions,
   ProjectPermissionSub,
-  useProjectPermission,
   useSubscription
 } from "@app/context";
 import { usePopUp } from "@app/hooks";
@@ -123,12 +123,6 @@ export const ActionBar = ({
   const { reset: resetSelectedSecret } = useSelectedSecretActions();
   const isMultiSelectActive = Boolean(Object.keys(selectedSecrets).length);
 
-  const { permission } = useProjectPermission();
-
-  const shouldCheckFolderPermission = permission.rules.some((rule) =>
-    (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders)
-  );
-
   const handleFolderCreate = async (folderName: string) => {
     try {
       await createFolder({
@@ -436,7 +430,12 @@ export const ActionBar = ({
         <div className="flex items-center">
           <ProjectPermissionCan
             I={ProjectPermissionActions.Create}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath,
+              secretName: "*",
+              secretTags: ["*"]
+            })}
           >
             {(isAllowed) => (
               <Button
@@ -467,12 +466,7 @@ export const ActionBar = ({
               <div className="flex flex-col space-y-1 p-1.5">
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Create}
-                  a={subject(
+                  a={subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })}
-                    shouldCheckFolderPermission
-                      ? ProjectPermissionSub.SecretFolders
-                      : ProjectPermissionSub.Secrets,
-                    { environment, secretPath }
-                  )}
                 >
                   {(isAllowed) => (
                     <Button
@@ -491,8 +485,13 @@ export const ActionBar = ({
                   )}
                 </ProjectPermissionCan>
                 <ProjectPermissionCan
-                  I={ProjectPermissionActions.Create}
+                  I={ProjectPermissionDynamicSecretActions.CreateRootCredential}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.DynamicSecrets, {
+                    environment,
+                    secretPath,
+                    secretName: "*",
+                    secretTags: ["*"]
+                  })}
                 >
                   {(isAllowed) => (
                     <Button
@@ -516,7 +515,10 @@ export const ActionBar = ({
                 </ProjectPermissionCan>
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Create}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.SecretImports, {
+                    environment,
+                    secretPath
+                  })}
                 >
                   {(isAllowed) => (
                     <Button
@@ -556,7 +558,12 @@ export const ActionBar = ({
           </div>
           <ProjectPermissionCan
             I={ProjectPermissionActions.Delete}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath,
+              secretName: "*",
+              secretTags: ["*"]
+            })}
             renderTooltip
             allowedLabel="Move"
           >
@@ -575,7 +582,12 @@ export const ActionBar = ({
           </ProjectPermissionCan>
           <ProjectPermissionCan
             I={ProjectPermissionActions.Delete}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath,
+              secretName: "*",
+              secretTags: ["*"]
+            })}
             renderTooltip
             allowedLabel="Delete"
           >

frontend/src/views/SecretMainPage/components/DynamicSecretListView/DynamicSecretLease.tsx

@@ -26,7 +26,7 @@ import {
   Tooltip,
   Tr
 } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionDynamicSecretActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { useGetDynamicSecretLeases, useRevokeDynamicSecretLease } from "@app/hooks/api";
 import { DynamicSecretLeaseStatus } from "@app/hooks/api/dynamicSecretLease/types";
@@ -61,7 +61,6 @@ export const DynamicSecretLease = ({
     dynamicSecretName
   });
 
-
   const deleteDynamicSecretLease = useRevokeDynamicSecretLease();
 
   const handleDynamicSecretDeleteLease = async () => {
@@ -140,8 +139,8 @@ export const DynamicSecretLease = ({
                 <Td>
                   <div className="flex items-center space-x-4">
                     <ProjectPermissionCan
-                      I={ProjectPermissionActions.Edit}
+                      I={ProjectPermissionDynamicSecretActions.Lease}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })}
                       renderTooltip
                       allowedLabel="Renew"
                     >
@@ -159,8 +158,8 @@ export const DynamicSecretLease = ({
                       )}
                     </ProjectPermissionCan>
                     <ProjectPermissionCan
-                      I={ProjectPermissionActions.Delete}
+                      I={ProjectPermissionDynamicSecretActions.Lease}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })}
                       renderTooltip
                       allowedLabel="Delete"
                     >
@@ -179,8 +178,11 @@ export const DynamicSecretLease = ({
                     </ProjectPermissionCan>
                     {status === DynamicSecretLeaseStatus.FailedDeletion && (
                       <ProjectPermissionCan
-                        I={ProjectPermissionActions.Delete}
+                        I={ProjectPermissionDynamicSecretActions.Lease}
-                        a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                        a={subject(ProjectPermissionSub.DynamicSecrets, {
+                          environment,
+                          secretPath
+                        })}
                         renderTooltip
                         allowedLabel="Force Delete. This action will remove the secret from internal storage, but it will remain in external systems."
                       >
@@ -209,9 +211,19 @@ export const DynamicSecretLease = ({
       </TableContainer>
       {!isLeaseLoading && Boolean(leases?.length) && (
         <div className="mt-6 flex items-center space-x-4">
-          <Button onClick={onClickNewLease} size="xs">
+          <ProjectPermissionCan
-            New Lease
+            I={ProjectPermissionDynamicSecretActions.Lease}
-          </Button>
+            a={subject(ProjectPermissionSub.DynamicSecrets, {
+              environment,
+              secretPath
+            })}
+          >
+            {(isAllowed) => (
+              <Button onClick={onClickNewLease} size="xs" isDisabled={!isAllowed}>
+                New Lease
+              </Button>
+            )}
+          </ProjectPermissionCan>
           <Button onClick={onClose} variant="plain" colorSchema="secondary" size="xs">
             Close
           </Button>

frontend/src/views/SecretMainPage/components/DynamicSecretListView/DynamicSecretListView.tsx

@@ -18,7 +18,7 @@ import {
   Tag,
   Tooltip
 } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
+import { ProjectPermissionDynamicSecretActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { useDeleteDynamicSecret } from "@app/hooks/api";
 import {
@@ -132,17 +132,27 @@ export const DynamicSecretListView = ({
                 )}
               </div>
               <div className="flex items-center space-x-2 px-4 py-2">
-                <Button
+                <ProjectPermissionCan
-                  size="xs"
+                  I={ProjectPermissionDynamicSecretActions.Lease}
-                  className="m-0 py-0.5 px-2 opacity-0 group-hover:opacity-100"
+                  a={subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })}
-                  isDisabled={isRevoking}
+                  renderTooltip
-                  onClick={(evt) => {
+                  allowedLabel="Edit"
-                    evt.stopPropagation();
-                    handlePopUpOpen("createDynamicSecretLease", secret);
-                  }}
                 >
-                  Generate
+                  {(isAllowed) => (
-                </Button>
+                    <Button
+                      size="xs"
+                      className="m-0 py-0.5 px-2 opacity-0 group-hover:opacity-100"
+                      isDisabled={isRevoking || !isAllowed}
+                      onClick={(evt) => {
+                        evt.stopPropagation();
+                        handlePopUpOpen("createDynamicSecretLease", secret);
+                      }}
+                    >
+                      Generate
+                    </Button>
+                  )}
+                </ProjectPermissionCan>
+
                 {secret.status === DynamicSecretStatus.FailedDeletion && (
                   <Tooltip content="This action will remove the secret from internal storage, but it will remain in external systems. Use this option only after you've confirmed that your external leases are handled.">
                     <Button
@@ -165,8 +175,8 @@ export const DynamicSecretListView = ({
               </div>
               <div className="flex items-center space-x-4 border-l border-mineshaft-600 px-3 py-3">
                 <ProjectPermissionCan
-                  I={ProjectPermissionActions.Edit}
+                  I={ProjectPermissionDynamicSecretActions.EditRootCredential}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })}
                   renderTooltip
                   allowedLabel="Edit"
                 >
@@ -187,8 +197,8 @@ export const DynamicSecretListView = ({
                   )}
                 </ProjectPermissionCan>
                 <ProjectPermissionCan
-                  I={ProjectPermissionActions.Delete}
+                  I={ProjectPermissionDynamicSecretActions.DeleteRootCredential}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.DynamicSecrets, { environment, secretPath })}
                   renderTooltip
                   allowedLabel="Delete"
                 >

frontend/src/views/SecretMainPage/components/FolderListView/FolderListView.tsx

@@ -6,7 +6,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
 import { DeleteActionModal, IconButton, Modal, ModalContent } from "@app/components/v2";
-import { ProjectPermissionActions, ProjectPermissionSub, useProjectPermission } from "@app/context";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { usePopUp } from "@app/hooks";
 import { useDeleteFolder, useUpdateFolder } from "@app/hooks/api";
 import { TSecretFolder } from "@app/hooks/api/secretFolders/types";
@@ -33,11 +33,6 @@ export const FolderListView = ({
     "deleteFolder"
   ] as const);
   const router = useRouter();
-  const { permission } = useProjectPermission();
-
-  const shouldCheckFolderPermission = permission.rules.some((rule) =>
-    (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders)
-  );
 
   const { mutateAsync: updateFolder } = useUpdateFolder();
   const { mutateAsync: deleteFolder } = useDeleteFolder();
@@ -126,12 +121,7 @@ export const FolderListView = ({
           <div className="flex items-center space-x-4 border-l border-mineshaft-600 px-3 py-3">
             <ProjectPermissionCan
               I={ProjectPermissionActions.Edit}
-              a={subject(
+              a={subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })}
-                shouldCheckFolderPermission
-                  ? ProjectPermissionSub.SecretFolders
-                  : ProjectPermissionSub.Secrets,
-                { environment, secretPath }
-              )}
               renderTooltip
               allowedLabel="Edit"
             >
@@ -150,12 +140,7 @@ export const FolderListView = ({
             </ProjectPermissionCan>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Delete}
-              a={subject(
+              a={subject(ProjectPermissionSub.SecretFolders, { environment, secretPath })}
-                shouldCheckFolderPermission
-                  ? ProjectPermissionSub.SecretFolders
-                  : ProjectPermissionSub.Secrets,
-                { environment, secretPath }
-              )}
               renderTooltip
               allowedLabel="Delete"
             >

frontend/src/views/SecretMainPage/components/SecretDropzone/CopySecretsFromBoard.tsx

@@ -142,7 +142,12 @@ export const CopySecretsFromBoard = ({
         <div>
           <ProjectPermissionCan
             I={ProjectPermissionActions.Create}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.Secrets, {
+              environment,
+              secretPath,
+              secretName: "*",
+              secretTags: ["*"]
+            })}
           >
             {(isAllowed) => (
               <Button

frontend/src/views/SecretMainPage/components/SecretDropzone/SecretDropzone.tsx

@@ -250,7 +250,12 @@ export const SecretDropzone = ({
             </div>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Create}
-              a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+              a={subject(ProjectPermissionSub.Secrets, {
+                environment,
+                secretPath,
+                secretName: "*",
+                secretTags: ["*"]
+              })}
             >
               {(isAllowed) => (
                 <input
@@ -287,7 +292,12 @@ export const SecretDropzone = ({
               {!isSmaller && (
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Create}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.Secrets, {
+                    environment,
+                    secretPath,
+                    secretName: "*",
+                    secretTags: ["*"]
+                  })}
                 >
                   {(isAllowed) => (
                     <Button

frontend/src/views/SecretMainPage/components/SecretImportListView/SecretImportItem.tsx

@@ -67,7 +67,7 @@ export const SecretImportItem = ({
   isReplicationExpand,
   importedSecrets = [],
   searchTerm = "",
-  secretPath,
+  secretPath = "/",
   environment,
   secretImport,
   onExpandReplicateSecrets: onExpandReplicate
@@ -209,7 +209,7 @@ export const SecretImportItem = ({
           {isReplication && (
             <ProjectPermissionCan
               I={ProjectPermissionActions.Edit}
-              a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+              a={subject(ProjectPermissionSub.SecretImports, { environment, secretPath })}
               renderTooltip
               allowedLabel="Resync replicated secrets"
             >
@@ -235,7 +235,10 @@ export const SecretImportItem = ({
         <div className="flex items-center space-x-4 border-l border-mineshaft-600 px-4 py-2">
           <ProjectPermissionCan
             I={ProjectPermissionActions.Edit}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.SecretImports, {
+              environment,
+              secretPath: secretPath || "/"
+            })}
             renderTooltip
             allowedLabel="Change order"
           >
@@ -256,7 +259,7 @@ export const SecretImportItem = ({
           </ProjectPermissionCan>
           <ProjectPermissionCan
             I={ProjectPermissionActions.Delete}
-            a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+            a={subject(ProjectPermissionSub.SecretImports, { environment, secretPath })}
             renderTooltip
             allowedLabel="Delete"
           >

frontend/src/views/SecretMainPage/components/SecretListView/SecretDetaiSidebar.tsx

@@ -84,26 +84,41 @@ export const SecretDetailSidebar = ({
     resolver: zodResolver(formSchema),
     values: secret
   });
+
   const { permission } = useProjectPermission();
-  const cannotEditSecret = permission.cannot(
-    ProjectPermissionActions.Edit,
-    subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-  );
-  const isReadOnly =
-    permission.can(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-    ) && cannotEditSecret;
 
   const { fields, append, remove } = useFieldArray({
     control,
     name: "tags"
   });
+
+  const secretKey = secret?.key || "";
   const selectedTags = watch("tags", []) || [];
   const selectedTagsGroupById = selectedTags.reduce<Record<string, boolean>>(
     (prev, curr) => ({ ...prev, [curr.id]: true }),
     {}
   );
+  const selectTagSlugs = selectedTags.map((i) => i.slug);
+
+  const cannotEditSecret = permission.cannot(
+    ProjectPermissionActions.Edit,
+    subject(ProjectPermissionSub.Secrets, {
+      environment,
+      secretPath,
+      secretName: secretKey,
+      secretTags: selectTagSlugs
+    })
+  );
+  const isReadOnly =
+    permission.can(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath,
+        secretName: secretKey,
+        secretTags: selectTagSlugs
+      })
+    ) && cannotEditSecret;
 
   const overrideAction = watch("overrideAction");
   const isOverridden =
@@ -194,7 +209,12 @@ export const SecretDetailSidebar = ({
               </FormControl>
               <ProjectPermissionCan
                 I={ProjectPermissionActions.Edit}
-                a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                a={subject(ProjectPermissionSub.Secrets, {
+                  environment,
+                  secretPath,
+                  secretName: secretKey,
+                  secretTags: selectTagSlugs
+                })}
               >
                 {(isAllowed) => (
                   <Controller
@@ -221,7 +241,12 @@ export const SecretDetailSidebar = ({
               <div className="mb-2 border-b border-mineshaft-600 pb-4">
                 <ProjectPermissionCan
                   I={ProjectPermissionActions.Edit}
-                  a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                  a={subject(ProjectPermissionSub.Secrets, {
+                    environment,
+                    secretPath,
+                    secretName: secretKey,
+                    secretTags: selectTagSlugs
+                  })}
                 >
                   {(isAllowed) => (
                     <Switch
@@ -277,7 +302,12 @@ export const SecretDetailSidebar = ({
                   <DropdownMenu>
                     <ProjectPermissionCan
                       I={ProjectPermissionActions.Edit}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.Secrets, {
+                        environment,
+                        secretPath,
+                        secretName: secretKey,
+                        secretTags: selectTagSlugs
+                      })}
                     >
                       {(isAllowed) => (
                         <DropdownMenuTrigger asChild>
@@ -367,6 +397,7 @@ export const SecretDetailSidebar = ({
                       variant="outline_bg"
                       leftIcon={<FontAwesomeIcon icon={faClock} />}
                       onClick={() => setCreateReminderFormOpen.on()}
+                      isDisabled={cannotEditSecret}
                     >
                       Create Reminder
                     </Button>
@@ -388,7 +419,12 @@ export const SecretDetailSidebar = ({
                   render={({ field: { value, onChange, onBlur } }) => (
                     <ProjectPermissionCan
                       I={ProjectPermissionActions.Edit}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.Secrets, {
+                        environment,
+                        secretPath,
+                        secretName: secretKey,
+                        secretTags: selectTagSlugs
+                      })}
                     >
                       {(isAllowed) => (
                         <Switch
@@ -450,7 +486,12 @@ export const SecretDetailSidebar = ({
                 <div className="flex items-center space-x-4">
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
-                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                    a={subject(ProjectPermissionSub.Secrets, {
+                      environment,
+                      secretPath,
+                      secretName: secretKey,
+                      secretTags: selectTagSlugs
+                    })}
                   >
                     {(isAllowed) => (
                       <Button
@@ -465,7 +506,12 @@ export const SecretDetailSidebar = ({
                   </ProjectPermissionCan>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Delete}
-                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                    a={subject(ProjectPermissionSub.Secrets, {
+                      environment,
+                      secretPath,
+                      secretName: secretKey,
+                      secretTags: selectTagSlugs
+                    })}
                   >
                     {(isAllowed) => (
                       <Button colorSchema="danger" isDisabled={!isAllowed} onClick={onDeleteSecret}>

frontend/src/views/SecretMainPage/components/SecretListView/SecretItem.tsx

@@ -81,15 +81,6 @@ export const SecretItem = memo(
   }: Props) => {
     const { currentWorkspace } = useWorkspace();
     const { permission } = useProjectPermission();
-    const isReadOnly =
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      ) &&
-      permission.cannot(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
 
     const {
       handleSubmit,
@@ -107,6 +98,8 @@ export const SecretItem = memo(
       resolver: zodResolver(formSchema)
     });
 
+    const secretName = watch("key");
+
     const secretReminderRepeatDays = watch("reminderRepeatDays");
     const secretReminderNote = watch("reminderNote");
 
@@ -118,11 +111,33 @@ export const SecretItem = memo(
       (prev, curr) => ({ ...prev, [curr.id]: true }),
       {}
     );
+    const selectedTagSlugs = selectedTags.map((i) => i.slug);
+
     const { fields, append, remove } = useFieldArray({
       control,
       name: "tags"
     });
 
+    const isReadOnly =
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName,
+          secretTags: selectedTagSlugs
+        })
+      ) &&
+      permission.cannot(
+        ProjectPermissionActions.Edit,
+        subject(ProjectPermissionSub.Secrets, {
+          environment,
+          secretPath,
+          secretName,
+          secretTags: selectedTagSlugs
+        })
+      );
+
     const [isSecValueCopied, setIsSecValueCopied] = useToggle(false);
     const [createReminderFormOpen, setCreateReminderFormOpen] = useToggle(false);
     useEffect(() => {
@@ -309,7 +324,12 @@ export const SecretItem = memo(
                   <DropdownMenu>
                     <ProjectPermissionCan
                       I={ProjectPermissionActions.Edit}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.Secrets, {
+                        environment,
+                        secretPath,
+                        secretName,
+                        secretTags: selectedTagSlugs
+                      })}
                     >
                       {(isAllowed) => (
                         <DropdownMenuTrigger asChild disabled={!isAllowed}>
@@ -384,7 +404,12 @@ export const SecretItem = memo(
                   </DropdownMenu>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
-                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                    a={subject(ProjectPermissionSub.Secrets, {
+                      environment,
+                      secretPath,
+                      secretName,
+                      secretTags: selectedTagSlugs
+                    })}
                     renderTooltip
                     allowedLabel="Override"
                   >
@@ -440,7 +465,12 @@ export const SecretItem = memo(
                   <Popover>
                     <ProjectPermissionCan
                       I={ProjectPermissionActions.Edit}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.Secrets, {
+                        environment,
+                        secretPath,
+                        secretName,
+                        secretTags: selectedTagSlugs
+                      })}
                     >
                       {(isAllowed) => (
                         <PopoverTrigger asChild disabled={!isAllowed}>
@@ -519,7 +549,12 @@ export const SecretItem = memo(
                     </Tooltip>
                     <ProjectPermissionCan
                       I={ProjectPermissionActions.Delete}
-                      a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+                      a={subject(ProjectPermissionSub.Secrets, {
+                        environment,
+                        secretPath,
+                        secretName,
+                        secretTags: selectedTagSlugs
+                      })}
                       renderTooltip
                       allowedLabel="Delete"
                     >

frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.tsx

@@ -16,7 +16,6 @@ import { WsTag } from "@app/hooks/api/types";
 import { AddShareSecretModal } from "@app/views/ShareSecretPage/components/AddShareSecretModal";
 
 import { useSelectedSecretActions, useSelectedSecrets } from "../../SecretMainPage.store";
-import { Filter } from "../../SecretMainPage.types";
 import { SecretDetailSidebar } from "./SecretDetaiSidebar";
 import { SecretItem } from "./SecretItem";
 import { FontAwesomeSpriteSymbols } from "./SecretListView.utils";
@@ -31,16 +30,6 @@ type Props = {
   isProtectedBranch?: boolean;
 };
 
-export const filterSecrets = (secrets: SecretV3RawSanitized[], filter: Filter) =>
-  secrets.filter(({ key, value, tags }) => {
-    const isTagFilterActive = Boolean(Object.keys(filter.tags).length);
-    const searchTerm = filter.searchFilter.toLowerCase();
-    return (
-      (!isTagFilterActive || tags?.some(({ id }) => filter.tags?.[id])) &&
-      (key.toLowerCase().includes(searchTerm) || value?.toLowerCase().includes(searchTerm))
-    );
-  });
-
 export const SecretListView = ({
   secrets = [],
   environment,

frontend/src/views/SecretMainPage/components/SecretListView/SecretListView.utils.ts

@@ -10,6 +10,7 @@ import {
   faCopy,
   faEllipsis,
   faKey,
+  faLock,
   faShare,
   faTags
 } from "@fortawesome/free-solid-svg-icons";
@@ -71,7 +72,8 @@ export enum FontAwesomeSpriteName {
   Close = "close",
   CheckedCircle = "check-circle",
   ReplicatedSecretKey = "secret-replicated",
-  ShareSecret = "share-secret"
+  ShareSecret = "share-secret",
+  KeyLock = "key-lock"
 }
 
 // this is an optimization technique
@@ -88,5 +90,6 @@ export const FontAwesomeSpriteSymbols = [
   { icon: faClose, symbol: FontAwesomeSpriteName.Close },
   { icon: faCheckCircle, symbol: FontAwesomeSpriteName.CheckedCircle },
   { icon: faClone, symbol: FontAwesomeSpriteName.ReplicatedSecretKey },
-  { icon: faShare, symbol: FontAwesomeSpriteName.ShareSecret }
+  { icon: faShare, symbol: FontAwesomeSpriteName.ShareSecret },
+  { icon: faLock, symbol: FontAwesomeSpriteName.KeyLock }
 ];

frontend/src/views/SecretMainPage/components/SecretListView/SecretNoAccessListView.tsx

@@ -0,0 +1,49 @@
+import { FontAwesomeSymbol, Input, Tooltip } from "@app/components/v2";
+
+import { FontAwesomeSpriteName } from "./SecretListView.utils";
+
+type Props = {
+  count: number;
+};
+
+export const SecretNoAccessListView = ({ count }: Props) => {
+  return (
+    <>
+      {Array.from(Array(count)).map((_, i) => (
+        <Tooltip
+          className="max-w-sm"
+          asChild
+          content="You do not have permission to view this secret"
+          key={`no-access-secret-${i + 1}`}
+        >
+          <div className="flex border-b border-mineshaft-600 bg-mineshaft-800 shadow-none hover:bg-mineshaft-700">
+            <div className="flex h-11 w-11 items-center justify-center px-4 py-3">
+              <FontAwesomeSymbol
+                className="ml-3 block h-3.5 w-3.5"
+                symbolName={FontAwesomeSpriteName.KeyLock}
+              />
+            </div>
+
+            <div className="flex h-11 w-80 flex-shrink-0 items-center px-4 py-2">
+              <Input
+                autoComplete="off"
+                isReadOnly
+                variant="plain"
+                value="NO ACCESS"
+                isDisabled
+                className="w-full px-0 blur-sm placeholder:text-red-500 focus:text-bunker-100 focus:ring-transparent"
+              />
+            </div>
+            <div
+              className="flex w-80 flex-grow items-center border-x border-mineshaft-600 py-1 pl-4 pr-2"
+              tabIndex={0}
+              role="button"
+            >
+              <span className="blur">********</span>
+            </div>
+          </div>
+        </Tooltip>
+      ))}
+    </>
+  );
+};

frontend/src/views/SecretMainPage/components/SecretListView/index.tsx

@@ -1 +1,2 @@
 export { SecretListView } from "./SecretListView";
+export { SecretNoAccessListView } from "./SecretNoAccessListView";

frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx

@@ -72,7 +72,10 @@ import { SecretType, SecretV3RawSanitized, TSecretFolder } from "@app/hooks/api/
 import { ProjectVersion } from "@app/hooks/api/workspace/types";
 import { useDynamicSecretOverview, useFolderOverview, useSecretOverview } from "@app/hooks/utils";
 import { SecretOverviewDynamicSecretRow } from "@app/views/SecretOverviewPage/components/SecretOverviewDynamicSecretRow";
-import { SecretOverviewTableRow } from "@app/views/SecretOverviewPage/components/SecretOverviewTableRow";
+import {
+  SecretNoAccessOverviewTableRow,
+  SecretOverviewTableRow
+} from "@app/views/SecretOverviewPage/components/SecretOverviewTableRow";
 import { SecretTableResourceCount } from "@app/views/SecretOverviewPage/components/SecretTableResourceCount";
 
 import { FolderForm } from "../SecretMainPage/components/ActionBar/FolderForm";
@@ -210,7 +213,10 @@ export const SecretOverviewPage = () => {
     totalFolderCount,
     totalSecretCount,
     totalDynamicSecretCount,
-    totalCount = 0
+    totalCount = 0,
+    totalUniqueFoldersInPage,
+    totalUniqueSecretsInPage,
+    totalUniqueDynamicSecretsInPage
   } = overview ?? {};
 
   useResetPageHelper({
@@ -275,7 +281,7 @@ export const SecretOverviewPage = () => {
       if (
         permission.can(
           ProjectPermissionActions.Edit,
-          subject(ProjectPermissionSub.Secrets, { environment: env.slug, secretPath })
+          subject(ProjectPermissionSub.SecretFolders, { environment: env.slug, secretPath })
         )
       ) {
         const folder = getFolderByNameAndEnv(oldFolderName, env.slug);
@@ -478,20 +484,13 @@ export const SecretOverviewPage = () => {
       const pathSegment = secretPath.split("/").filter(Boolean);
       const parentPath = `/${pathSegment.slice(0, -1).join("/")}`;
       const folderName = pathSegment.at(-1);
-      const canCreateFolder = permission.rules.some((rule) =>
+      const canCreateFolder = permission.can(
-        (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders)
+        ProjectPermissionActions.Create,
-      )
+        subject(ProjectPermissionSub.SecretFolders, {
-        ? permission.can(
+          environment: slug,
-            ProjectPermissionActions.Create,
+          secretPath: parentPath
-            subject(ProjectPermissionSub.SecretFolders, {
+        })
-              environment: slug,
+      );
-              secretPath: parentPath
-            })
-          )
-        : permission.can(
-            ProjectPermissionActions.Create,
-            subject(ProjectPermissionSub.Secrets, { environment: slug, secretPath: parentPath })
-          );
       if (folderName && parentPath && canCreateFolder) {
         await createFolder({
           projectId: workspaceId,
@@ -822,7 +821,7 @@ export const SecretOverviewPage = () => {
                       <div className="flex flex-col space-y-1 p-1.5">
                         <ProjectPermissionCan
                           I={ProjectPermissionActions.Create}
-                          a={subject(ProjectPermissionSub.Secrets, { secretPath })}
+                          a={ProjectPermissionSub.SecretFolders}
                         >
                           {(isAllowed) => (
                             <Button
@@ -1047,6 +1046,16 @@ export const SecretOverviewPage = () => {
                         scrollOffset={debouncedScrollOffset}
                       />
                     ))}
+                    <SecretNoAccessOverviewTableRow
+                      environments={visibleEnvs}
+                      count={Math.max(
+                        (page * perPage > totalCount ? totalCount % perPage : perPage) -
+                          (totalUniqueFoldersInPage || 0) -
+                          (totalUniqueDynamicSecretsInPage || 0) -
+                          (totalUniqueSecretsInPage || 0),
+                        0
+                      )}
+                    />
                   </>
                 )}
               </TBody>

frontend/src/views/SecretOverviewPage/components/CreateSecretForm/CreateSecretForm.tsx

@@ -93,23 +93,14 @@ export const CreateSecretForm = ({
         const pathSegment = secretPath.split("/").filter(Boolean);
         const parentPath = `/${pathSegment.slice(0, -1).join("/")}`;
         const folderName = pathSegment.at(-1);
-        const canCreateFolder = permission.rules.some((rule) =>
+        const canCreateFolder = permission.can(
-          (rule.subject as ProjectPermissionSub[]).includes(ProjectPermissionSub.SecretFolders)
+          ProjectPermissionActions.Create,
-        )
+          subject(ProjectPermissionSub.SecretFolders, {
-          ? permission.can(
+            environment: env.slug,
-              ProjectPermissionActions.Create,
+            secretPath: parentPath
-              subject(ProjectPermissionSub.SecretFolders, {
+          })
-                environment: env.slug,
+        );
-                secretPath: parentPath
+
-              })
-            )
-          : permission.can(
-              ProjectPermissionActions.Create,
-              subject(ProjectPermissionSub.Secrets, {
-                environment: env.slug,
-                secretPath: parentPath
-              })
-            );
         if (folderName && parentPath && canCreateFolder) {
           await createFolder({
             projectId: workspaceId,
@@ -250,7 +241,9 @@ export const CreateSecretForm = ({
                   ProjectPermissionActions.Create,
                   subject(ProjectPermissionSub.Secrets, {
                     environment: environmentSlug.slug,
-                    secretPath
+                    secretPath,
+                    secretName: "*",
+                    secretTags: ["*"]
                   })
                 )
               )

frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretEditRow.tsx

@@ -1,4 +1,4 @@
-import { useCallback,useState } from "react";
+import { useCallback, useState } from "react";
 import { Controller, useForm } from "react-hook-form";
 import { subject } from "@casl/ability";
 import { faCheck, faCopy, faTrash, faXmark } from "@fortawesome/free-solid-svg-icons";
@@ -7,7 +7,7 @@ import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { ProjectPermissionCan } from "@app/components/permissions";
-import { DeleteActionModal,IconButton, Tooltip } from "@app/components/v2";
+import { DeleteActionModal, IconButton, Tooltip } from "@app/components/v2";
 import { InfisicalSecretInput } from "@app/components/v2/InfisicalSecretInput";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context";
 import { useToggle } from "@app/hooks";
@@ -63,8 +63,8 @@ export const SecretEditRow = ({
   const [isModalOpen, setIsModalOpen] = useState<boolean>(false);
 
   const toggleModal = useCallback(() => {
-    setIsModalOpen((prev) => !prev)
+    setIsModalOpen((prev) => !prev);
-  }, [])
+  }, []);
 
   const handleFormReset = () => {
     reset();
@@ -114,7 +114,6 @@ export const SecretEditRow = ({
 
   return (
     <div className="group flex w-full cursor-text items-center space-x-2">
-
       <DeleteActionModal
         isOpen={isModalOpen}
         onClose={toggleModal}
@@ -151,8 +150,13 @@ export const SecretEditRow = ({
         {isDirty ? (
           <>
             <ProjectPermissionCan
-              I={ProjectPermissionActions.Create}
+              I={isCreatable ? ProjectPermissionActions.Create : ProjectPermissionActions.Edit}
-              a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
+              a={subject(ProjectPermissionSub.Secrets, {
+                environment,
+                secretPath,
+                secretName,
+                secretTags: ["*"]
+              })}
             >
               {(isAllowed) => (
                 <div>
@@ -201,7 +205,12 @@ export const SecretEditRow = ({
             </div>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Delete}
-              a={ProjectPermissionSub.Secrets}
+              a={subject(ProjectPermissionSub.Secrets, {
+                environment,
+                secretPath,
+                secretName,
+                secretTags: ["*"]
+              })}
             >
               {(isAllowed) => (
                 <div className="opacity-0 group-hover:opacity-100">

frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretNoAccessOverviewTableRow.tsx

@@ -0,0 +1,51 @@
+import { faCircle } from "@fortawesome/free-regular-svg-icons";
+import { faLock } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { Td, Tooltip, Tr } from "@app/components/v2";
+
+type Props = {
+  environments: { name: string; slug: string }[];
+  count: number;
+};
+
+export const SecretNoAccessOverviewTableRow = ({ environments = [], count }: Props) => {
+  return (
+    <>
+      {Array.from(Array(count)).map((_, j) => (
+        <Tr key={`no-access-secret-overview-${j + 1}`} isHoverable isSelectable className="group">
+          <Td className="sticky left-0 z-10 bg-mineshaft-800 bg-clip-padding py-0 px-0 group-hover:bg-mineshaft-700">
+            <div className="h-full w-full border-r border-mineshaft-600 py-2.5 px-5">
+              <Tooltip
+                asChild
+                content="You do not have permission to view this secret"
+                className="max-w-sm"
+              >
+                <div className="flex items-center space-x-5">
+                  <div className="text-bunker-300">
+                    <FontAwesomeIcon className="block" icon={faLock} />
+                  </div>
+                  <div className="blur-sm">NO ACCESS</div>
+                </div>
+              </Tooltip>
+            </div>
+          </Td>
+          {environments.map(({ slug }, i) => {
+            return (
+              <Td
+                key={`sec-overview-${slug}-${i + 1}-value`}
+                className="py-0 px-0 group-hover:bg-mineshaft-700"
+              >
+                <div className="h-full w-full border-r border-mineshaft-600 py-[0.85rem] px-5">
+                  <div className="flex justify-center">
+                    <FontAwesomeIcon icon={faCircle} />
+                  </div>
+                </div>
+              </Td>
+            );
+          })}
+        </Tr>
+      ))}
+    </>
+  );
+};

frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx

@@ -18,7 +18,7 @@ import {
 } from "@app/context";
 import { useToggle } from "@app/hooks";
 import { useUpdateSecretV3 } from "@app/hooks/api";
-import { SecretType,SecretV3RawSanitized } from "@app/hooks/api/types";
+import { SecretType, SecretV3RawSanitized } from "@app/hooks/api/types";
 import { SecretActionType } from "@app/views/SecretMainPage/components/SecretListView/SecretListView.utils";
 
 type Props = {
@@ -42,15 +42,16 @@ function SecretRenameRow({ environments, getSecretByKey, secretKey, secretPath }
 
   const isReadOnly = environments.some((env) => {
     const environment = env.slug;
+    const secretDetails = getSecretByKey(environment, secretKey);
+    const secretPermissionSubject = subject(ProjectPermissionSub.Secrets, {
+      environment,
+      secretPath,
+      secretName: secretKey,
+      secretTags: (secretDetails?.tags || []).map((i) => i.slug)
+    });
     const isSecretInEnvReadOnly =
-      permission.can(
+      permission.can(ProjectPermissionActions.Read, secretPermissionSubject) &&
-        ProjectPermissionActions.Read,
+      permission.cannot(ProjectPermissionActions.Edit, secretPermissionSubject);
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      ) &&
-      permission.cannot(
-        ProjectPermissionActions.Edit,
-        subject(ProjectPermissionSub.Secrets, { environment, secretPath })
-      );
     if (isSecretInEnvReadOnly) {
       return true;
     }

frontend/src/views/SecretOverviewPage/components/SecretOverviewTableRow/index.tsx

@@ -1 +1,2 @@
+export { SecretNoAccessOverviewTableRow } from "./SecretNoAccessOverviewTableRow";
 export { SecretOverviewTableRow } from "./SecretOverviewTableRow";

frontend/src/views/SecretOverviewPage/components/SelectionPanel/SelectionPanel.tsx

@@ -57,7 +57,12 @@ export const SelectionPanel = ({ secretPath, resetSelectedEntries, selectedEntri
   const shouldShowDelete = userAvailableEnvs.some((env) =>
     permission.can(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Secrets, { environment: env.slug, secretPath })
+      subject(ProjectPermissionSub.Secrets, {
+        environment: env.slug,
+        secretPath,
+        secretName: "*",
+        secretTags: ["*"]
+      })
     )
   );
 
@@ -76,34 +81,43 @@ export const SelectionPanel = ({ secretPath, resetSelectedEntries, selectedEntri
 
     const promises = userAvailableEnvs.map(async (env) => {
       // additional check: ensure that bulk delete is only executed on envs that user has access to
+
       if (
-        permission.cannot(
+        permission.can(
           ProjectPermissionActions.Delete,
-          subject(ProjectPermissionSub.Secrets, { environment: env.slug, secretPath })
+          subject(ProjectPermissionSub.SecretFolders, { environment: env.slug, secretPath })
         )
       ) {
-        return;
+        await Promise.all(
+          Object.keys(selectedEntries.folder).map(async (folderRecord) => {
+            const folder = folderRecord[env.slug];
+            if (folder) {
+              processedEntries += 1;
+              await deleteFolder({
+                folderId: folder?.id,
+                path: secretPath,
+                environment: env.slug,
+                projectId: workspaceId
+              });
+            }
+          })
+        );
       }
 
-      await Promise.all(
+      const secretsToDelete = Object.keys(selectedEntries.secret).reduce(
-        Object.values(selectedEntries.folder).map(async (folderRecord) => {
-          const folder = folderRecord[env.slug];
-          if (folder) {
-            processedEntries += 1;
-            await deleteFolder({
-              folderId: folder?.id,
-              path: secretPath,
-              environment: env.slug,
-              projectId: workspaceId
-            });
-          }
-        })
-      );
-
-      const secretsToDelete = Object.values(selectedEntries.secret).reduce(
         (accum: TDeleteSecretBatchDTO["secrets"], secretRecord) => {
           const entry = secretRecord[env.slug];
-          if (entry) {
+          const canDeleteSecret = permission.can(
+            ProjectPermissionActions.Delete,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: env.slug,
+              secretPath,
+              secretName: entry.key,
+              secretTags: (entry?.tags || []).map((i) => i.slug)
+            })
+          );
+
+          if (entry && canDeleteSecret) {
             return [
               ...accum,
               {

frontend/src/views/Settings/ProjectSettingsPage/components/DeleteProjectSection/DeleteProjectSection.tsx

@@ -136,10 +136,7 @@ export const DeleteProjectSection = () => {
     <div className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
       <p className="mb-4 text-xl font-semibold text-mineshaft-100">Danger Zone</p>
       <div className="space-x-4">
-        <ProjectPermissionCan
+        <ProjectPermissionCan I={ProjectPermissionActions.Delete} a={ProjectPermissionSub.Project}>
-          I={ProjectPermissionActions.Delete}
-          a={ProjectPermissionSub.Workspace}
-        >
           {(isAllowed) => (
             <Button
               isLoading={isDeleting}

frontend/src/views/Settings/ProjectSettingsPage/components/EncryptionTab/EncryptionTab.tsx

@@ -318,10 +318,7 @@ export const EncryptionTab = () => {
               />
             )}
           </ProjectPermissionCan>
-          <ProjectPermissionCan
+          <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Project}>
-            I={ProjectPermissionActions.Edit}
-            a={ProjectPermissionSub.Workspace}
-          >
             {(isAllowed) => (
               <Button
                 colorSchema="secondary"

frontend/src/views/Settings/ProjectSettingsPage/components/ProjectNameChangeSection/ProjectNameChangeSection.tsx

@@ -22,7 +22,6 @@ const formSchema = yup.object({
 type FormData = yup.InferType<typeof formSchema>;
 
 export const ProjectNameChangeSection = () => {
-  
   const { currentWorkspace } = useWorkspace();
   const { mutateAsync, isLoading } = useRenameWorkspace();
 
@@ -83,7 +82,7 @@ export const ProjectNameChangeSection = () => {
         </div>
       </div>
       <div className="max-w-md">
-        <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Workspace}>
+        <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Project}>
           {(isAllowed) => (
             <Controller
               defaultValue=""
@@ -103,7 +102,7 @@ export const ProjectNameChangeSection = () => {
           )}
         </ProjectPermissionCan>
       </div>
-      <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Workspace}>
+      <ProjectPermissionCan I={ProjectPermissionActions.Edit} a={ProjectPermissionSub.Project}>
         {(isAllowed) => (
           <Button
             colorSchema="secondary"