From 6cf248832666dc2bcfa8b7757f3ba4fa25420fb6 Mon Sep 17 00:00:00 2001 From: McPizza0 Date: Tue, 26 Nov 2024 23:22:07 +0100 Subject: [PATCH 1/4] Fix(Azure Key Vault): Ignore disabled secrets --- .../integration-sync-secret.ts | 32 ++++++++++++------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts index 3983bd8bc..3ed2887fa 100644 --- a/backend/src/services/integration-auth/integration-sync-secret.ts +++ b/backend/src/services/integration-auth/integration-sync-secret.ts @@ -516,12 +516,18 @@ const syncSecretsAzureKeyVault = async ({ if (!lastSlashIndex) { lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf("/"); } + if (!getAzureKeyVaultSecret.attributes.enabled) return null; - const azureKeyVaultSecret = await request.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, { - headers: { - Authorization: `Bearer ${accessToken}` - } - }); + let azureKeyVaultSecret; + try { + azureKeyVaultSecret = await request.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, { + headers: { + Authorization: `Bearer ${accessToken}` + } + }); + } catch (err) { + throw new Error(`Failed to fetch Azure Key Vault secret: ${(err as Error).message}`); + } return { ...azureKeyVaultSecret.data, @@ -529,13 +535,15 @@ const syncSecretsAzureKeyVault = async ({ }; }) ) - ).reduce( - (obj, secret) => ({ - ...obj, - [secret.key]: secret - }), - {} - ); + ) + .filter((secret) => secret !== null) + .reduce( + (obj, secret) => ({ + ...obj, + [secret.key]: secret + }), + {} + ); const setSecrets: { key: string; From 229706f57fcb40278728c32e3a4d7932053b46a3 Mon Sep 17 00:00:00 2001 From: McPizza0 Date: Tue, 26 Nov 2024 23:35:32 +0100 Subject: [PATCH 2/4] improve filtering --- .../integration-sync-secret.ts | 21 +++++++++---------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts index 3ed2887fa..10bdea855 100644 --- a/backend/src/services/integration-auth/integration-sync-secret.ts +++ b/backend/src/services/integration-auth/integration-sync-secret.ts @@ -507,7 +507,9 @@ const syncSecretsAzureKeyVault = async ({ return result; }; - const getAzureKeyVaultSecrets = await paginateAzureKeyVaultSecrets(`${integration.app}/secrets?api-version=7.3`); + const getAzureKeyVaultSecrets = ( + await paginateAzureKeyVaultSecrets(`${integration.app}/secrets?api-version=7.3`) + ).filter((secret) => secret.attributes.enabled); let lastSlashIndex: number; const res = ( @@ -516,7 +518,6 @@ const syncSecretsAzureKeyVault = async ({ if (!lastSlashIndex) { lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf("/"); } - if (!getAzureKeyVaultSecret.attributes.enabled) return null; let azureKeyVaultSecret; try { @@ -535,15 +536,13 @@ const syncSecretsAzureKeyVault = async ({ }; }) ) - ) - .filter((secret) => secret !== null) - .reduce( - (obj, secret) => ({ - ...obj, - [secret.key]: secret - }), - {} - ); + ).reduce( + (obj, secret) => ({ + ...obj, + [secret.key]: secret + }), + {} + ); const setSecrets: { key: string; From 728f0232637e5a12612284510225e9bf3346f841 Mon Sep 17 00:00:00 2001 From: McPizza0 Date: Tue, 26 Nov 2024 23:46:23 +0100 Subject: [PATCH 3/4] remove superfolous trycatch --- .../integration-auth/integration-sync-secret.ts | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts index 10bdea855..f69b3fefc 100644 --- a/backend/src/services/integration-auth/integration-sync-secret.ts +++ b/backend/src/services/integration-auth/integration-sync-secret.ts @@ -519,16 +519,11 @@ const syncSecretsAzureKeyVault = async ({ lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf("/"); } - let azureKeyVaultSecret; - try { - azureKeyVaultSecret = await request.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, { - headers: { - Authorization: `Bearer ${accessToken}` - } - }); - } catch (err) { - throw new Error(`Failed to fetch Azure Key Vault secret: ${(err as Error).message}`); - } + const azureKeyVaultSecret = await request.get(`${getAzureKeyVaultSecret.id}?api-version=7.3`, { + headers: { + Authorization: `Bearer ${accessToken}` + } + }); return { ...azureKeyVaultSecret.data, From 33411335edec161047e8a78c11260cce2dab2c3d Mon Sep 17 00:00:00 2001 From: McPizza0 Date: Wed, 27 Nov 2024 00:15:10 +0100 Subject: [PATCH 4/4] avoid syncing disabled azure keys --- .../integration-sync-secret.ts | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/backend/src/services/integration-auth/integration-sync-secret.ts b/backend/src/services/integration-auth/integration-sync-secret.ts index f69b3fefc..c147150f0 100644 --- a/backend/src/services/integration-auth/integration-sync-secret.ts +++ b/backend/src/services/integration-auth/integration-sync-secret.ts @@ -473,7 +473,7 @@ const syncSecretsAzureKeyVault = async ({ id: string; // secret URI value: string; attributes: { - enabled: true; + enabled: boolean; created: number; updated: number; recoveryLevel: string; @@ -507,14 +507,21 @@ const syncSecretsAzureKeyVault = async ({ return result; }; - const getAzureKeyVaultSecrets = ( - await paginateAzureKeyVaultSecrets(`${integration.app}/secrets?api-version=7.3`) - ).filter((secret) => secret.attributes.enabled); + const getAzureKeyVaultSecrets = await paginateAzureKeyVaultSecrets(`${integration.app}/secrets?api-version=7.3`); + + const enabledAzureKeyVaultSecrets = getAzureKeyVaultSecrets.filter((secret) => secret.attributes.enabled); + + // disabled keys to skip sending updates to + const disabledAzureKeyVaultSecretKeys = getAzureKeyVaultSecrets + .filter(({ attributes }) => !attributes.enabled) + .map((getAzureKeyVaultSecret) => { + return getAzureKeyVaultSecret.id.substring(getAzureKeyVaultSecret.id.lastIndexOf("/") + 1); + }); let lastSlashIndex: number; const res = ( await Promise.all( - getAzureKeyVaultSecrets.map(async (getAzureKeyVaultSecret) => { + enabledAzureKeyVaultSecrets.map(async (getAzureKeyVaultSecret) => { if (!lastSlashIndex) { lastSlashIndex = getAzureKeyVaultSecret.id.lastIndexOf("/"); } @@ -660,6 +667,7 @@ const syncSecretsAzureKeyVault = async ({ }) => { let isSecretSet = false; let maxTries = 6; + if (disabledAzureKeyVaultSecretKeys.includes(key)) return; while (!isSecretSet && maxTries > 0) { // try to set secret