Merge pull request #2220 from Infisical/feat/added-secret-folder-rbac

feat: added secret folder permissions

frontend/src/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils.ts

@@ -36,6 +36,7 @@ export const formSchema = z.object({
   permissions: z
     .object({
       secrets: z.record(multiEnvPermissionSchema).optional(),
+      "secret-folders": generalPermissionSchema.optional(),
       member: generalPermissionSchema,
       groups: generalPermissionSchema,
       identity: generalPermissionSchema,
@@ -158,7 +159,7 @@ export const formRolePermission2API = (formVal: TFormSchema["permissions"]) => {
   Object.entries(formVal || {}).forEach(([rule, actions]) => {
     if (rule === "secrets") {
       multiEnvForm2Api(permissions, JSON.parse(JSON.stringify(actions || {})), rule);
-    } else {
+    } else if (actions) {
       Object.entries(actions).forEach(([action, isAllowed]) => {
         if (isAllowed) {
           permissions.push({ subject: rule, action });

frontend/src/views/Project/RolePage/components/RolePermissionsSection/RolePermissionSecretFoldersRow.tsx

@@ -0,0 +1,71 @@
+import { Control, UseFormSetValue, useWatch } from "react-hook-form";
+
+import { Select, SelectItem, Td, Tr } from "@app/components/v2";
+import { ProjectPermissionSub } from "@app/context";
+import { TFormSchema } from "@app/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils";
+
+type Props = {
+  isEditable: boolean;
+  setValue: UseFormSetValue<TFormSchema>;
+  control: Control<TFormSchema>;
+};
+
+enum Permission {
+  SameAsSecrets = "same-as-secrets",
+  ReadOnly = "read-only"
+}
+
+export const RowPermissionSecretFoldersRow = ({ isEditable, setValue, control }: Props) => {
+  const formName = ProjectPermissionSub.SecretFolders;
+  const rule = useWatch({
+    control,
+    name: `permissions.${formName}`
+  });
+
+  const selectedPermissionCategory =
+    rule !== undefined ? Permission.ReadOnly : Permission.SameAsSecrets;
+
+  const handlePermissionChange = (val: Permission) => {
+    if (!val) return;
+    switch (val) {
+      case Permission.SameAsSecrets: {
+        setValue(`permissions.${formName}`, undefined, { shouldDirty: true });
+        break;
+      }
+      // Read-only
+      default:
+        setValue(
+          `permissions.${formName}`,
+          {
+            read: true,
+            edit: false,
+            create: false,
+            delete: false
+          },
+          {
+            shouldDirty: true
+          }
+        );
+        break;
+    }
+  };
+
+  return (
+    <Tr>
+      <Td />
+      <Td>Secret Folders</Td>
+      <Td>
+        <Select
+          value={selectedPermissionCategory}
+          className="w-40 bg-mineshaft-600"
+          dropdownContainerClassName="border border-mineshaft-600 bg-mineshaft-800"
+          onValueChange={handlePermissionChange}
+          isDisabled={!isEditable}
+        >
+          <SelectItem value={Permission.SameAsSecrets}>Same as Secrets</SelectItem>
+          <SelectItem value={Permission.ReadOnly}>Read Only</SelectItem>
+        </Select>
+      </Td>
+    </Tr>
+  );
+};

frontend/src/views/Project/RolePage/components/RolePermissionsSection/RolePermissionsSection.tsx

@@ -13,6 +13,7 @@ import {
 } from "@app/views/Project/RolePage/components/RolePermissionsSection/ProjectRoleModifySection.utils";
 
 import { RolePermissionRow } from "./RolePermissionRow";
+import { RowPermissionSecretFoldersRow } from "./RolePermissionSecretFoldersRow";
 import { RowPermissionSecretsRow } from "./RolePermissionSecretsRow";
 
 const SINGLE_PERMISSION_LIST = [
@@ -177,6 +178,11 @@ export const RolePermissionsSection = ({ roleSlug }: Props) => {
                 getValue={getValues}
                 control={control}
               />
+              <RowPermissionSecretFoldersRow
+                isEditable={isCustomRole}
+                setValue={setValue}
+                control={control}
+              />
               {SINGLE_PERMISSION_LIST.map((permission) => {
                 return (
                   <RolePermissionRow