awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-12 14:29:34 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-02-08 04:27:17 +04:00
parent ba42ea736b
commit a67badf660
55 changed files with 872 additions and 428 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts
+1 -3
View File
@@ -8,7 +8,6 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
import { TAppConnection, TAppConnectionInput } from "@app/services/app-connection/app-connection-types";
import { AzureResources } from "@app/services/app-connection/azure";
import { AuthMode } from "@app/services/auth/auth-type";
export const registerAppConnectionEndpoints = <T extends TAppConnection, I extends TAppConnectionInput>({
@@ -78,8 +77,7 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
.object({
app: z.literal(app),
name: z.string(),
id: z.string().uuid(),
azureResource: z.nativeEnum(AzureResources).optional()
id: z.string().uuid()
})
.array()
})
backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
+12 -3
View File
@@ -4,7 +4,14 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
import { AzureConnectionListItemSchema, SanitizedAzureConnectionSchema } from "@app/services/app-connection/azure";
import {
AzureAppConfigurationConnectionListItemSchema,
SanitizedAzureAppConfigurationConnectionSchema
} from "@app/services/app-connection/azure-app-configuration";
import {
AzureKeyVaultConnectionListItemSchema,
SanitizedAzureKeyVaultConnectionSchema
} from "@app/services/app-connection/azure-key-vault";
import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
import { AuthMode } from "@app/services/auth/auth-type";
@@ -14,14 +21,16 @@ const SanitizedAppConnectionSchema = z.union([
...SanitizedAwsConnectionSchema.options,
...SanitizedGitHubConnectionSchema.options,
...SanitizedGcpConnectionSchema.options,
...SanitizedAzureConnectionSchema.options
...SanitizedAzureKeyVaultConnectionSchema.options,
...SanitizedAzureAppConfigurationConnectionSchema.options
]);
const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
AwsConnectionListItemSchema,
GitHubConnectionListItemSchema,
GcpConnectionListItemSchema,
AzureConnectionListItemSchema
AzureKeyVaultConnectionListItemSchema,
AzureAppConfigurationConnectionListItemSchema
]);
export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {
backend/src/server/routes/v1/app-connection-routers/azure-app-configuration-connection-router.ts
+18
View File
@@ -0,0 +1,18 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureAppConfigurationConnectionSchema,
SanitizedAzureAppConfigurationConnectionSchema,
UpdateAzureAppConfigurationConnectionSchema
} from "@app/services/app-connection/azure-app-configuration";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureAppConfigurationConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.AzureAppConfiguration,
server,
sanitizedResponseSchema: SanitizedAzureAppConfigurationConnectionSchema,
createSchema: CreateAzureAppConfigurationConnectionSchema,
updateSchema: UpdateAzureAppConfigurationConnectionSchema
});
};
backend/src/server/routes/v1/app-connection-routers/azure-connection-router.ts
-18
View File
@@ -1,18 +0,0 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureConnectionSchema,
SanitizedAzureConnectionSchema,
UpdateAzureConnectionSchema
} from "@app/services/app-connection/azure";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.Azure,
server,
sanitizedResponseSchema: SanitizedAzureConnectionSchema,
createSchema: CreateAzureConnectionSchema,
updateSchema: UpdateAzureConnectionSchema
});
};
backend/src/server/routes/v1/app-connection-routers/azure-key-vault-connection-router.ts
+18
View File
@@ -0,0 +1,18 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureKeyVaultConnectionSchema,
SanitizedAzureKeyVaultConnectionSchema,
UpdateAzureKeyVaultConnectionSchema
} from "@app/services/app-connection/azure-key-vault";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureKeyVaultConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.AzureKeyVault,
server,
sanitizedResponseSchema: SanitizedAzureKeyVaultConnectionSchema,
createSchema: CreateAzureKeyVaultConnectionSchema,
updateSchema: UpdateAzureKeyVaultConnectionSchema
});
};
backend/src/server/routes/v1/app-connection-routers/index.ts
+4 -2
View File
@@ -1,7 +1,8 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { registerAwsConnectionRouter } from "./aws-connection-router";
import { registerAzureConnectionRouter } from "./azure-connection-router";
import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
import { registerGcpConnectionRouter } from "./gcp-connection-router";
import { registerGitHubConnectionRouter } from "./github-connection-router";
@@ -12,5 +13,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
[AppConnection.AWS]: registerAwsConnectionRouter,
[AppConnection.GitHub]: registerGitHubConnectionRouter,
[AppConnection.GCP]: registerGcpConnectionRouter,
[AppConnection.Azure]: registerAzureConnectionRouter
[AppConnection.AzureKeyVault]: registerAzureKeyVaultConnectionRouter,
[AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter
};
backend/src/services/app-connection/app-connection-enums.ts
+2 -1
View File
@@ -2,7 +2,8 @@ export enum AppConnection {
GitHub = "github",
AWS = "aws",
GCP = "gcp",
Azure = "azure"
AzureKeyVault = "azure-key-vault",
AzureAppConfiguration = "azure-app-configuration"
}
export enum AWSRegion {
backend/src/services/app-connection/app-connection-fns.ts
+18 -5
View File
@@ -20,14 +20,24 @@ import {
} from "@app/services/app-connection/github";
import { KmsDataKey } from "@app/services/kms/kms-types";
import { AzureConnectionMethod, getAzureConnectionListItem, validateAzureConnectionCredentials } from "./azure";
import {
AzureAppConfigurationConnectionMethod,
getAzureAppConfigurationConnectionListItem,
validateAzureAppConfigurationConnectionCredentials
} from "./azure-app-configuration";
import {
AzureKeyVaultConnectionMethod,
getAzureKeyVaultConnectionListItem,
validateAzureKeyVaultConnectionCredentials
} from "./azure-key-vault";
export const listAppConnectionOptions = () => {
return [
getAwsAppConnectionListItem(),
getGitHubConnectionListItem(),
getGcpAppConnectionListItem(),
getAzureConnectionListItem()
getAzureKeyVaultConnectionListItem(),
getAzureAppConfigurationConnectionListItem()
].sort((a, b) => a.name.localeCompare(b.name));
};
@@ -84,8 +94,10 @@ export const validateAppConnectionCredentials = async (
return validateGitHubConnectionCredentials(appConnection);
case AppConnection.GCP:
return validateGcpConnectionCredentials(appConnection);
case AppConnection.Azure:
return validateAzureConnectionCredentials(appConnection);
case AppConnection.AzureKeyVault:
return validateAzureKeyVaultConnectionCredentials(appConnection);
case AppConnection.AzureAppConfiguration:
return validateAzureAppConfigurationConnectionCredentials(appConnection);
default:
// eslint-disable-next-line @typescript-eslint/restrict-template-expressions
throw new Error(`Unhandled App Connection ${app}`);
@@ -96,7 +108,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
switch (method) {
case GitHubConnectionMethod.App:
return "GitHub App";
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
case AzureAppConfigurationConnectionMethod.OAuth:
case GitHubConnectionMethod.OAuth:
return "OAuth";
case AwsConnectionMethod.AccessKey:
backend/src/services/app-connection/app-connection-maps.ts
+2 -1
View File
@@ -4,5 +4,6 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
[AppConnection.AWS]: "AWS",
[AppConnection.GitHub]: "GitHub",
[AppConnection.GCP]: "GCP",
[AppConnection.Azure]: "Azure"
[AppConnection.AzureKeyVault]: "Azure Key Vault",
[AppConnection.AzureAppConfiguration]: "Azure App Configuration"
};
backend/src/services/app-connection/app-connection-service.ts
+4 -24
View File
@@ -27,9 +27,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "@app/services/app-con
import { githubConnectionService } from "@app/services/app-connection/github/github-connection-service";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { KmsDataKey } from "../kms/kms-types";
import { TAppConnectionDALFactory } from "./app-connection-dal";
import { AzureResources } from "./azure";
import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
import { gcpConnectionService } from "./gcp/gcp-connection-service";
@@ -45,7 +44,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
[AppConnection.AWS]: ValidateAwsConnectionCredentialsSchema,
[AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
[AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
[AppConnection.Azure]: ValidateGcpConnectionCredentialsSchema
[AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
[AppConnection.AzureAppConfiguration]: ValidateAzureKeyVaultConnectionCredentialsSchema
};
export const appConnectionServiceFactory = ({
@@ -350,27 +350,7 @@ export const appConnectionServiceFactory = ({
)
);
const { decryptor } = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.Organization,
orgId: actor.orgId
});
const decryptedConnections = availableConnections.map((connection) => {
const decryptedPlainTextBlob = decryptor({
cipherTextBlob: connection.encryptedCredentials
});
const credentials = JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
return {
...connection,
...(app === AppConnection.Azure && {
azureResource: (credentials as { resource: AzureResources }).resource
})
};
});
return decryptedConnections as Omit<TAppConnection, "credentials">[];
return availableConnections as Omit<TAppConnection, "credentials">[];
};
return {
backend/src/services/app-connection/app-connection-types.ts
+24 -9
View File
@@ -12,20 +12,33 @@ import {
} from "@app/services/app-connection/github";
import {
TAzureConnection,
TAzureConnectionConfig,
TAzureConnectionInput,
TValidateAzureConnectionCredentials
} from "./azure";
TAzureAppConfigurationConnection,
TAzureAppConfigurationConnectionConfig,
TAzureAppConfigurationConnectionInput,
TValidateAzureAppConfigurationConnectionCredentials
} from "./azure-app-configuration";
import {
TAzureKeyVaultConnection,
TAzureKeyVaultConnectionConfig,
TAzureKeyVaultConnectionInput,
TValidateAzureKeyVaultConnectionCredentials
} from "./azure-key-vault";
import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection);
export type TAppConnection = { id: string } & (
| TAwsConnection
| TGitHubConnection
| TGcpConnection
| TAzureKeyVaultConnection
| TAzureAppConfigurationConnection
);
export type TAppConnectionInput = { id: string } & (
| TAwsConnectionInput
| TGitHubConnectionInput
| TGcpConnectionInput
| TAzureConnectionInput
| TAzureKeyVaultConnectionInput
| TAzureAppConfigurationConnectionInput
);
export type TCreateAppConnectionDTO = Pick<
@@ -41,10 +54,12 @@ export type TAppConnectionConfig =
| TAwsConnectionConfig
| TGitHubConnectionConfig
| TGcpConnectionConfig
| TAzureConnectionConfig;
| TAzureKeyVaultConnectionConfig
| TAzureAppConfigurationConnectionConfig;
export type TValidateAppConnectionCredentials =
| TValidateAwsConnectionCredentials
| TValidateGitHubConnectionCredentials
| TValidateGcpConnectionCredentials
| TValidateAzureConnectionCredentials;
| TValidateAzureKeyVaultConnectionCredentials
| TValidateAzureAppConfigurationConnectionCredentials;
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-enums.ts
+3
View File
@@ -0,0 +1,3 @@
export enum AzureAppConfigurationConnectionMethod {
OAuth = "oauth"
}
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-fns.ts
+98
View File
@@ -0,0 +1,98 @@
import { AxiosError, AxiosResponse } from "axios";
import { getConfig } from "@app/lib/config/env";
import { request } from "@app/lib/config/request";
import { BadRequestError, InternalServerError } from "@app/lib/errors";
import { getAppConnectionMethodName } from "@app/services/app-connection/app-connection-fns";
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
import { AppConnection } from "../app-connection-enums";
import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
import {
ExchangeCodeAzureResponse,
TAzureAppConfigurationConnectionConfig
} from "./azure-app-configuration-connection-types";
export const getAzureAppConfigurationConnectionListItem = () => {
const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
return {
name: "Azure App Configuration" as const,
app: AppConnection.AzureAppConfiguration as const,
methods: Object.values(AzureAppConfigurationConnectionMethod) as [AzureAppConfigurationConnectionMethod.OAuth],
oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
};
};
export const validateAzureAppConfigurationConnectionCredentials = async (
config: TAzureAppConfigurationConnectionConfig
) => {
const { credentials: inputCredentials, method } = config;
const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
throw new InternalServerError({
message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
});
}
let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
let tokenError: AxiosError | null = null;
try {
tokenResp = await request.post<ExchangeCodeAzureResponse>(
IntegrationUrls.AZURE_TOKEN_URL.replace("common", inputCredentials.tenantId || "common"),
new URLSearchParams({
grant_type: "authorization_code",
code: inputCredentials.code,
scope: `openid offline_access https://azconfig.io/.default`,
client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
})
);
} catch (e: unknown) {
if (e instanceof AxiosError) {
tokenError = e;
} else {
throw new BadRequestError({
message: `Unable to validate connection - verify credentials`
});
}
}
if (tokenError) {
if (tokenError instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to get access token: ${
(tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
}`
});
} else {
throw new InternalServerError({
message: "Failed to get access token"
});
}
}
if (!tokenResp) {
throw new InternalServerError({
message: `Failed to get access token: Token was empty with no error`
});
}
switch (method) {
case AzureAppConfigurationConnectionMethod.OAuth:
return {
tenantId: inputCredentials.tenantId,
accessToken: tokenResp.data.access_token,
refreshToken: tokenResp.data.refresh_token,
expiresAt: Date.now() + tokenResp.data.expires_in * 1000
};
default:
throw new InternalServerError({
message: `Unhandled Azure connection method: ${method as AzureAppConfigurationConnectionMethod}`
});
}
};
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-schemas.ts
+77
View File
@@ -0,0 +1,77 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
export const AzureAppConfigurationConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional()
});
export const AzureAppConfigurationConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number()
});
export const ValidateAzureAppConfigurationConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(AzureAppConfigurationConnectionMethod.OAuth)
.describe(AppConnections.CREATE(AppConnection.AzureAppConfiguration).method),
credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.AzureAppConfiguration).credentials
)
})
]);
export const CreateAzureAppConfigurationConnectionSchema = ValidateAzureAppConfigurationConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration)
);
export const UpdateAzureAppConfigurationConnectionSchema = z
.object({
credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.AzureAppConfiguration).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration));
const BaseAzureAppConfigurationConnectionSchema = BaseAppConnectionSchema.extend({
app: z.literal(AppConnection.AzureAppConfiguration)
});
export const AzureAppConfigurationConnectionSchema = z.intersection(
BaseAzureAppConfigurationConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureAppConfigurationConnectionSchema = z.discriminatedUnion("method", [
BaseAzureAppConfigurationConnectionSchema.extend({
method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema.pick({
resource: true,
tenantId: true
})
})
]);
export const AzureAppConfigurationConnectionListItemSchema = z.object({
name: z.literal("Azure App Configuration"),
app: z.literal(AppConnection.AzureAppConfiguration),
methods: z.nativeEnum(AzureAppConfigurationConnectionMethod).array(),
oauthClientId: z.string().optional()
});
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-types.ts
+41
View File
@@ -0,0 +1,41 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureAppConfigurationConnectionOAuthOutputCredentialsSchema,
AzureAppConfigurationConnectionSchema,
CreateAzureAppConfigurationConnectionSchema,
ValidateAzureAppConfigurationConnectionCredentialsSchema
} from "./azure-app-configuration-connection-schemas";
export type TAzureAppConfigurationConnection = z.infer<typeof AzureAppConfigurationConnectionSchema>;
export type TAzureAppConfigurationConnectionInput = z.infer<typeof CreateAzureAppConfigurationConnectionSchema> & {
app: AppConnection.AzureAppConfiguration;
};
export type TValidateAzureAppConfigurationConnectionCredentials =
typeof ValidateAzureAppConfigurationConnectionCredentialsSchema;
export type TAzureAppConfigurationConnectionConfig = DiscriminativePick<
TAzureAppConfigurationConnectionInput,
"method" | "app" | "credentials"
> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureAppConfigurationConnectionCredentials = z.infer<
typeof AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
>;
backend/src/services/app-connection/azure-app-configuration/index.ts
+4
View File
@@ -0,0 +1,4 @@
export * from "./azure-app-configuration-connection-enums";
export * from "./azure-app-configuration-connection-fns";
export * from "./azure-app-configuration-connection-schemas";
export * from "./azure-app-configuration-connection-types";
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-enums.ts
+3
View File
@@ -0,0 +1,3 @@
export enum AzureKeyVaultConnectionMethod {
OAuth = "oauth"
}
backend/src/services/app-connection/azure/azure-connection-fns.ts → backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts
+24 -24
View File
@@ -13,17 +13,12 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TAppConnectionDALFactory } from "../app-connection-dal";
import { AppConnection } from "../app-connection-enums";
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
import {
ExchangeCodeAzureResponse,
TAzureConnectionConfig,
TAzureConnectionCredentials
} from "./azure-connection-types";
const resourceScopes: Record<AzureResources, string> = {
[AzureResources.AppConfiguration]: "https://azconfig.io/.default",
[AzureResources.KeyVault]: "https://vault.azure.net/.default"
};
TAzureKeyVaultConnectionConfig,
TAzureKeyVaultConnectionCredentials
} from "./azure-key-vault-connection-types";
export const getAzureConnectionAccessToken = async (
connectionId: string,
@@ -31,6 +26,11 @@ export const getAzureConnectionAccessToken = async (
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
) => {
const appCfg = getConfig();
if (!appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID || !appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
throw new BadRequestError({
message: `Azure environment variables have not been configured`
});
}
const appConnection = await appConnectionDAL.findById(connectionId);
@@ -38,23 +38,23 @@ export const getAzureConnectionAccessToken = async (
throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
}
if (appConnection.app !== AppConnection.Azure) {
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure connection` });
if (appConnection.app !== AppConnection.AzureKeyVault && appConnection.app !== AppConnection.AzureAppConfiguration) {
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` });
}
const credentials = (await decryptAppConnectionCredentials({
orgId: appConnection.orgId,
kmsService,
encryptedCredentials: appConnection.encryptedCredentials
})) as TAzureConnectionCredentials;
})) as TAzureKeyVaultConnectionCredentials;
const { data } = await request.post<ExchangeCodeAzureResponse>(
IntegrationUrls.AZURE_TOKEN_URL.replace("common", credentials.tenantId || "common"),
new URLSearchParams({
grant_type: "refresh_token",
scope: `openid offline_access`,
client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID!,
client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET!,
client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
refresh_token: credentials.refreshToken
})
);
@@ -87,18 +87,18 @@ export const getAzureConnectionAccessToken = async (
};
};
export const getAzureConnectionListItem = () => {
export const getAzureKeyVaultConnectionListItem = () => {
const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
return {
name: "Azure" as const,
app: AppConnection.Azure as const,
methods: Object.values(AzureConnectionMethod) as [AzureConnectionMethod.OAuth],
name: "Azure Key Vault" as const,
app: AppConnection.AzureKeyVault as const,
methods: Object.values(AzureKeyVaultConnectionMethod) as [AzureKeyVaultConnectionMethod.OAuth],
oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
};
};
export const validateAzureConnectionCredentials = async (config: TAzureConnectionConfig) => {
export const validateAzureKeyVaultConnectionCredentials = async (config: TAzureKeyVaultConnectionConfig) => {
const { credentials: inputCredentials, method } = config;
const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
@@ -118,7 +118,7 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
new URLSearchParams({
grant_type: "authorization_code",
code: inputCredentials.code,
scope: `openid offline_access ${resourceScopes[inputCredentials.resource]}`,
scope: `openid offline_access https://vault.azure.net/.default`,
client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
@@ -155,16 +155,16 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
}
switch (method) {
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
return {
tenantId: inputCredentials.tenantId,
accessToken: tokenResp.data.access_token,
refreshToken: tokenResp.data.refresh_token,
expiresAt: Date.now() + tokenResp.data.expires_in * 1000,
resource: inputCredentials.resource
expiresAt: Date.now() + tokenResp.data.expires_in * 1000
};
default:
throw new InternalServerError({
message: `Unhandled Azure connection method: ${method as AzureConnectionMethod}`
message: `Unhandled Azure connection method: ${method as AzureKeyVaultConnectionMethod}`
});
}
};
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-schemas.ts
+77
View File
@@ -0,0 +1,77 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
export const AzureKeyVaultConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional()
});
export const AzureKeyVaultConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number()
});
export const ValidateAzureKeyVaultConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(AzureKeyVaultConnectionMethod.OAuth)
.describe(AppConnections.CREATE(AppConnection.AzureKeyVault).method),
credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.AzureKeyVault).credentials
)
})
]);
export const CreateAzureKeyVaultConnectionSchema = ValidateAzureKeyVaultConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.AzureKeyVault)
);
export const UpdateAzureKeyVaultConnectionSchema = z
.object({
credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.AzureKeyVault).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureKeyVault));
const BaseAzureKeyVaultConnectionSchema = BaseAppConnectionSchema.extend({
app: z.literal(AppConnection.AzureKeyVault)
});
export const AzureKeyVaultConnectionSchema = z.intersection(
BaseAzureKeyVaultConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureKeyVaultConnectionSchema = z.discriminatedUnion("method", [
BaseAzureKeyVaultConnectionSchema.extend({
method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema.pick({
resource: true,
tenantId: true
})
})
]);
export const AzureKeyVaultConnectionListItemSchema = z.object({
name: z.literal("Azure Key Vault"),
app: z.literal(AppConnection.AzureKeyVault),
methods: z.nativeEnum(AzureKeyVaultConnectionMethod).array(),
oauthClientId: z.string().optional()
});
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-types.ts
+38
View File
@@ -0,0 +1,38 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureKeyVaultConnectionOAuthOutputCredentialsSchema,
AzureKeyVaultConnectionSchema,
CreateAzureKeyVaultConnectionSchema,
ValidateAzureKeyVaultConnectionCredentialsSchema
} from "./azure-key-vault-connection-schemas";
export type TAzureKeyVaultConnection = z.infer<typeof AzureKeyVaultConnectionSchema>;
export type TAzureKeyVaultConnectionInput = z.infer<typeof CreateAzureKeyVaultConnectionSchema> & {
app: AppConnection.AzureKeyVault;
};
export type TValidateAzureKeyVaultConnectionCredentials = typeof ValidateAzureKeyVaultConnectionCredentialsSchema;
export type TAzureKeyVaultConnectionConfig = DiscriminativePick<
TAzureKeyVaultConnectionInput,
"method" | "app" | "credentials"
> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureKeyVaultConnectionCredentials = z.infer<typeof AzureKeyVaultConnectionOAuthOutputCredentialsSchema>;
backend/src/services/app-connection/azure-key-vault/index.ts
+4
View File
@@ -0,0 +1,4 @@
export * from "./azure-key-vault-connection-enums";
export * from "./azure-key-vault-connection-fns";
export * from "./azure-key-vault-connection-schemas";
export * from "./azure-key-vault-connection-types";
backend/src/services/app-connection/azure/azure-connection-enums.ts
-8
View File
@@ -1,8 +0,0 @@
export enum AzureConnectionMethod {
OAuth = "oauth"
}
export enum AzureResources {
KeyVault = "key-vault",
AppConfiguration = "app-configuration"
}
backend/src/services/app-connection/azure/azure-connection-schemas.ts
-74
View File
@@ -1,74 +0,0 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
export const AzureConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional(),
resource: z.nativeEnum(AzureResources)
});
export const AzureConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number(), // unix timestamp,
resource: z.nativeEnum(AzureResources)
});
export const ValidateAzureConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.Azure).method),
credentials: AzureConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.Azure).credentials
)
})
]);
export const CreateAzureConnectionSchema = ValidateAzureConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.Azure)
);
export const UpdateAzureConnectionSchema = z
.object({
credentials: AzureConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.Azure).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Azure));
const BaseAzureConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Azure) });
export const AzureConnectionSchema = z.intersection(
BaseAzureConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureConnectionMethod.OAuth),
credentials: AzureConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureConnectionSchema = z.discriminatedUnion("method", [
BaseAzureConnectionSchema.extend({
method: z.literal(AzureConnectionMethod.OAuth),
credentials: AzureConnectionOAuthOutputCredentialsSchema.pick({
resource: true
})
})
]);
export const AzureConnectionListItemSchema = z.object({
name: z.literal("Azure"),
app: z.literal(AppConnection.Azure),
methods: z.nativeEnum(AzureConnectionMethod).array(),
oauthClientId: z.string().optional()
});
backend/src/services/app-connection/azure/azure-connection-types.ts
-35
View File
@@ -1,35 +0,0 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureConnectionOAuthOutputCredentialsSchema,
AzureConnectionSchema,
CreateAzureConnectionSchema,
ValidateAzureConnectionCredentialsSchema
} from "./azure-connection-schemas";
export type TAzureConnection = z.infer<typeof AzureConnectionSchema>;
export type TAzureConnectionInput = z.infer<typeof CreateAzureConnectionSchema> & {
app: AppConnection.Azure;
};
export type TValidateAzureConnectionCredentials = typeof ValidateAzureConnectionCredentialsSchema;
export type TAzureConnectionConfig = DiscriminativePick<TAzureConnectionInput, "method" | "app" | "credentials"> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureConnectionCredentials = z.infer<typeof AzureConnectionOAuthOutputCredentialsSchema>;
backend/src/services/app-connection/azure/index.ts
-4
View File
@@ -1,4 +0,0 @@
export * from "./azure-connection-enums";
export * from "./azure-connection-fns";
export * from "./azure-connection-schemas";
export * from "./azure-connection-types";
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-constants.ts
+2 -2
View File
@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
export const AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Azure App Configuration",
destination: SecretSync.AzureAppConfiguration,
connection: AppConnection.Azure,
canImportSecrets: false
connection: AppConnection.AzureAppConfiguration,
canImportSecrets: true
};
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-fns.ts
+1 -1
View File
@@ -4,7 +4,7 @@ import https from "https";
import { request } from "@app/lib/config/request";
import { BadRequestError } from "@app/lib/errors";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
import { isAzureKeyVaultReference } from "@app/services/integration-auth/integration-sync-secret-fns";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-schemas.ts
+2 -2
View File
@@ -40,7 +40,7 @@ export const UpdateAzureAppConfigurationSyncSchema = GenericUpdateSecretSyncFiel
export const AzureAppConfigurationSyncListItemSchema = z.object({
name: z.literal("Azure App Configuration"),
connection: z.literal(AppConnection.Azure),
connection: z.literal(AppConnection.AzureAppConfiguration),
destination: z.literal(SecretSync.AzureAppConfiguration),
canImportSecrets: z.literal(false)
canImportSecrets: z.literal(true)
});
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-types.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { z } from "zod";
import { TAzureConnection } from "@app/services/app-connection/azure";
import { TAzureAppConfigurationConnection } from "@app/services/app-connection/azure-app-configuration";
import {
AzureAppConfigurationSyncListItemSchema,
@@ -15,5 +15,5 @@ export type TAzureAppConfigurationSyncInput = z.infer<typeof CreateAzureAppConfi
export type TAzureAppConfigurationSyncListItem = z.infer<typeof AzureAppConfigurationSyncListItemSchema>;
export type TAzureAppConfigurationSyncWithCredentials = TAzureAppConfigurationSync & {
connection: TAzureConnection;
connection: TAzureAppConfigurationConnection;
};
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-constants.ts
+2 -2
View File
@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
export const AZURE_KEY_VAULT_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Azure Key Vault",
destination: SecretSync.AzureKeyVault,
connection: AppConnection.Azure,
canImportSecrets: false
connection: AppConnection.AzureKeyVault,
canImportSecrets: true
};
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts
+5 -1
View File
@@ -3,7 +3,7 @@ import { AxiosError } from "axios";
import { request } from "@app/lib/config/request";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
@@ -172,6 +172,10 @@ export const azureKeyVaultSecretSyncFactory = ({
}
}
}
if (!isSecretSet) {
throw new Error(`Failed to set secret ${key}`);
}
};
for await (const setSecret of setSecrets) {
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-schemas.ts
+3 -3
View File
@@ -10,7 +10,7 @@ import {
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
const AzureKeyVaultSyncDestinationConfigSchema = z.object({
vaultBaseUrl: z.string().min(1, "Vault base URL required")
vaultBaseUrl: z.string().url("Invalid vault base URL format").min(1, "Vault base URL required")
});
const AzureKeyVaultSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
@@ -39,7 +39,7 @@ export const UpdateAzureKeyVaultSyncSchema = GenericUpdateSecretSyncFieldsSchema
export const AzureKeyVaultSyncListItemSchema = z.object({
name: z.literal("Azure Key Vault"),
connection: z.literal(AppConnection.Azure),
connection: z.literal(AppConnection.AzureKeyVault),
destination: z.literal(SecretSync.AzureKeyVault),
canImportSecrets: z.literal(false)
canImportSecrets: z.literal(true)
});
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-types.ts
+2 -2
View File
@@ -1,6 +1,6 @@
import { z } from "zod";
import { TAzureConnection } from "@app/services/app-connection/azure";
import { TAzureKeyVaultConnection } from "@app/services/app-connection/azure-key-vault";
import {
AzureKeyVaultSyncListItemSchema,
@@ -15,7 +15,7 @@ export type TAzureKeyVaultSyncInput = z.infer<typeof CreateAzureKeyVaultSyncSche
export type TAzureKeyVaultSyncListItem = z.infer<typeof AzureKeyVaultSyncListItemSchema>;
export type TAzureKeyVaultSyncWithCredentials = TAzureKeyVaultSync & {
connection: TAzureConnection;
connection: TAzureKeyVaultConnection;
};
export interface GetAzureKeyVaultSecret {
backend/src/services/secret-sync/secret-sync-fns.ts
+24 -36
View File
@@ -93,16 +93,6 @@ export const SecretSyncFns = {
): Promise<void> => {
// const affixedSecretMap = addAffixes(secretSync, secretMap);
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
return AwsParameterStoreSyncFns.syncSecrets(secretSync, secretMap);
@@ -113,9 +103,15 @@ export const SecretSyncFns = {
case SecretSync.GCPSecretManager:
return GcpSyncFns.syncSecrets(secretSync, secretMap);
case SecretSync.AzureKeyVault:
return azureKeyVaultSecretSync.syncSecrets(secretSync, secretMap);
return azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).syncSecrets(secretSync, secretMap);
case SecretSync.AzureAppConfiguration:
return azureAppConfigurationSecretSync.syncSecrets(secretSync, secretMap);
return azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).syncSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -126,16 +122,6 @@ export const SecretSyncFns = {
secretSync: TSecretSyncWithCredentials,
{ kmsService, appConnectionDAL }: TSyncSecretDeps
): Promise<TSecretMap> => {
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
let secretMap: TSecretMap;
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
@@ -151,10 +137,16 @@ export const SecretSyncFns = {
secretMap = await GcpSyncFns.getSecrets(secretSync);
break;
case SecretSync.AzureKeyVault:
secretMap = await azureKeyVaultSecretSync.getSecrets(secretSync);
secretMap = await azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).getSecrets(secretSync);
break;
case SecretSync.AzureAppConfiguration:
secretMap = await azureAppConfigurationSecretSync.getSecrets(secretSync);
secretMap = await azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).getSecrets(secretSync);
break;
default:
throw new Error(
@@ -172,16 +164,6 @@ export const SecretSyncFns = {
): Promise<void> => {
// const affixedSecretMap = addAffixes(secretSync, secretMap);
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
return AwsParameterStoreSyncFns.removeSecrets(secretSync, secretMap);
@@ -192,9 +174,15 @@ export const SecretSyncFns = {
case SecretSync.GCPSecretManager:
return GcpSyncFns.removeSecrets(secretSync, secretMap);
case SecretSync.AzureKeyVault:
return azureKeyVaultSecretSync.removeSecrets(secretSync, secretMap);
return azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).removeSecrets(secretSync, secretMap);
case SecretSync.AzureAppConfiguration:
return azureAppConfigurationSecretSync.removeSecrets(secretSync, secretMap);
return azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).removeSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
backend/src/services/secret-sync/secret-sync-maps.ts
+2 -2
View File
@@ -15,6 +15,6 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.AWSSecretsManager]: AppConnection.AWS,
[SecretSync.GitHub]: AppConnection.GitHub,
[SecretSync.GCPSecretManager]: AppConnection.GCP,
[SecretSync.AzureKeyVault]: AppConnection.Azure,
[SecretSync.AzureAppConfiguration]: AppConnection.Azure
[SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
[SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration
};