From a8fc0e540a92997b0948cead7ad07c4b6217cd0e Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Mon, 10 Mar 2025 17:50:43 +0400
Subject: [PATCH] fix: tests and missing tags permission check

---
 backend/package.json                          |  1 +
 .../ee/services/permission/permission-fns.ts  |  4 ++--
 .../secret-v2-bridge-service.ts               | 23 ++++++++++---------
 3 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/backend/package.json b/backend/package.json
index 5c2c805bc..25380f896 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -71,6 +71,7 @@
     "migrate:org": "tsx ./scripts/migrate-organization.ts",
     "seed:new": "tsx ./scripts/create-seed-file.ts",
     "seed": "knex --knexfile ./dist/db/knexfile.ts --client pg seed:run",
+    "seed-dev": "knex --knexfile ./src/db/knexfile.ts --client pg seed:run",
     "db:reset": "npm run migration:rollback -- --all && npm run migration:latest"
   },
   "keywords": [],
diff --git a/backend/src/ee/services/permission/permission-fns.ts b/backend/src/ee/services/permission/permission-fns.ts
index 97113a562..c9f3b826e 100644
--- a/backend/src/ee/services/permission/permission-fns.ts
+++ b/backend/src/ee/services/permission/permission-fns.ts
@@ -1,5 +1,5 @@
 /* eslint-disable no-nested-ternary */
-import { ForbiddenError, MongoAbility, subject } from "@casl/ability";
+import { ForbiddenError, MongoAbility, PureAbility, subject } from "@casl/ability";
 import { z } from "zod";
 
 import { TOrganizations } from "@app/db/schemas";
@@ -15,7 +15,7 @@ import {
 } from "./project-permission";
 
 export function CheckForbiddenErrorSecretsSubject(
-  permission: MongoAbility<ProjectPermissionSet>,
+  permission: MongoAbility<ProjectPermissionSet> | PureAbility,
   action: Extract<
     ProjectPermissionSecretActions,
     ProjectPermissionSecretActions.ReadValue | ProjectPermissionSecretActions.DescribeSecret
diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index ec2728966..3b3a147bd 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -1,4 +1,4 @@
-import { ForbiddenError, PureAbility, subject } from "@casl/ability";
+import { ForbiddenError, MongoAbility, subject } from "@casl/ability";
 import { Knex } from "knex";
 import { z } from "zod";
 
@@ -15,6 +15,7 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import {
   ProjectPermissionActions,
   ProjectPermissionSecretActions,
+  ProjectPermissionSet,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
@@ -123,7 +124,7 @@ export const secretV2BridgeServiceFactory = ({
 }: TSecretV2BridgeServiceFactoryDep) => {
   const $validateSecretReferences = async (
     projectId: string,
-    permission: PureAbility,
+    permission: MongoAbility<ProjectPermissionSet>,
     references: ReturnType<typeof getAllSecretReferences>["nestedReferences"],
     tx?: Knex
   ) => {
@@ -131,6 +132,7 @@ export const secretV2BridgeServiceFactory = ({
 
     const uniqueReferenceEnvironmentSlugs = Array.from(new Set(references.map((el) => el.environment)));
     const referencesEnvironments = await projectEnvDAL.findBySlugs(projectId, uniqueReferenceEnvironmentSlugs, tx);
+
     if (referencesEnvironments.length !== uniqueReferenceEnvironmentSlugs.length)
       throw new BadRequestError({
         message: `Referenced environment not found. Missing ${diff(
@@ -147,6 +149,7 @@ export const secretV2BridgeServiceFactory = ({
       })),
       tx
     );
+
     const referencesFolderGroupByPath = groupBy(referredFolders.filter(Boolean), (i) => `${i?.envId}-${i?.path}`);
     const referredSecrets = await secretDAL.find(
       {
@@ -194,15 +197,12 @@ export const secretV2BridgeServiceFactory = ({
 
     const referredSecretsGroupBySecretKey = groupBy(referredSecrets, (i) => i.key);
     references.forEach((el) => {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, {
-          environment: el.environment,
-          secretPath: el.secretPath,
-          secretName: el.secretKey,
-          tags: referredSecretsGroupBySecretKey[el.secretKey][0]?.tags?.map((i) => i.slug)
-        })
-      );
+      CheckForbiddenErrorSecretsSubject(permission, ProjectPermissionSecretActions.ReadValue, {
+        environment: el.environment,
+        secretPath: el.secretPath,
+        secretName: el.secretKey,
+        secretTags: referredSecretsGroupBySecretKey[el.secretKey][0]?.tags?.map((i) => i.slug)
+      });
     });
 
     return referredSecrets;
@@ -277,6 +277,7 @@ export const secretV2BridgeServiceFactory = ({
     const allSecretReferences = nestedReferences.concat(
       localReferences.map((el) => ({ secretKey: el, secretPath, environment }))
     );
+
     await $validateSecretReferences(projectId, permission, allSecretReferences);
 
     const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({