Merge branch 'main' of https://github.com/Infisical/infisical into feat/chef-data-bag-app-connection-secret-sync

backend/src/services/secret-sync/northflank/index.ts

@@ -0,0 +1,4 @@
+export * from "./northflank-sync-constants";
+export * from "./northflank-sync-fns";
+export * from "./northflank-sync-schemas";
+export * from "./northflank-sync-types";

backend/src/services/secret-sync/northflank/northflank-sync-constants.ts

@@ -0,0 +1,10 @@
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types";
+
+export const NORTHFLANK_SYNC_LIST_OPTION: TSecretSyncListItem = {
+  name: "Northflank",
+  destination: SecretSync.Northflank,
+  connection: AppConnection.Northflank,
+  canImportSecrets: true
+};

backend/src/services/secret-sync/northflank/northflank-sync-fns.ts

@@ -0,0 +1,165 @@
+import { AxiosError } from "axios";
+
+import { request } from "@app/lib/config/request";
+import { matchesSchema } from "@app/services/secret-sync/secret-sync-fns";
+import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
+
+import { SecretSyncError } from "../secret-sync-errors";
+import { TNorthflankSyncWithCredentials } from "./northflank-sync-types";
+
+const NORTHFLANK_API_URL = "https://api.northflank.com";
+
+const buildNorthflankAPIErrorMessage = (error: unknown): string => {
+  let errorMessage = "Northflank API returned an error.";
+
+  if (error && typeof error === "object" && "response" in error) {
+    const axiosError = error as AxiosError;
+
+    if (axiosError.response?.data) {
+      // This is the shape of the error response from the Northflank API
+      const responseData = axiosError.response.data as {
+        error?: { message?: string; details?: Record<string, string[]> };
+        message?: string;
+      };
+      const errorParts = [];
+
+      if (responseData.error?.message) {
+        errorParts.push(responseData.error.message);
+      } else if (responseData.message) {
+        errorParts.push(responseData.message);
+      }
+
+      if (responseData.error?.details) {
+        const { details } = responseData.error;
+
+        // Flatten the details object into a string
+        Object.entries(details).forEach(([field, fieldErrors]) => {
+          if (Array.isArray(fieldErrors)) {
+            fieldErrors.forEach((fieldError) => errorParts.push(`${field}: ${fieldError}`));
+          } else {
+            errorParts.push(`${field}: ${String(fieldErrors)}`);
+          }
+        });
+      }
+
+      errorMessage += ` ${errorParts.join(". ")}`;
+    }
+  }
+
+  return errorMessage;
+};
+
+const getNorthflankSecrets = async (secretSync: TNorthflankSyncWithCredentials): Promise<Record<string, string>> => {
+  const {
+    destinationConfig: { projectId, secretGroupId },
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  try {
+    const {
+      data: {
+        data: {
+          secrets: { variables }
+        }
+      }
+    } = await request.get<{
+      data: {
+        secrets: {
+          variables: Record<string, string>;
+        };
+      };
+    }>(`${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}/details`, {
+      headers: {
+        Authorization: `Bearer ${apiToken}`,
+        Accept: "application/json"
+      }
+    });
+
+    return variables;
+  } catch (error: unknown) {
+    throw new SecretSyncError({
+      error,
+      message: `Failed to fetch Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
+    });
+  }
+};
+
+const updateNorthflankSecrets = async (
+  secretSync: TNorthflankSyncWithCredentials,
+  variables: Record<string, string>
+): Promise<void> => {
+  const {
+    destinationConfig: { projectId, secretGroupId },
+    connection: {
+      credentials: { apiToken }
+    }
+  } = secretSync;
+
+  try {
+    await request.patch(
+      `${NORTHFLANK_API_URL}/v1/projects/${projectId}/secrets/${secretGroupId}`,
+      {
+        secrets: {
+          variables
+        }
+      },
+      {
+        headers: {
+          Authorization: `Bearer ${apiToken}`,
+          Accept: "application/json"
+        }
+      }
+    );
+  } catch (error: unknown) {
+    throw new SecretSyncError({
+      error,
+      message: `Failed to update Northflank secrets. ${buildNorthflankAPIErrorMessage(error)}`
+    });
+  }
+};
+
+export const NorthflankSyncFns = {
+  syncSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+
+    const updatedVariables: Record<string, string> = {};
+
+    for (const [key, value] of Object.entries(northflankSecrets)) {
+      const shouldKeep =
+        !secretMap[key] && // this prevents duplicates from infisical secrets, because we add all of them to the updateVariables in the next loop
+        (secretSync.syncOptions.disableSecretDeletion ||
+          !matchesSchema(key, secretSync.environment?.slug || "", secretSync.syncOptions.keySchema));
+
+      if (shouldKeep) {
+        updatedVariables[key] = value;
+      }
+    }
+
+    for (const [key, { value }] of Object.entries(secretMap)) {
+      updatedVariables[key] = value;
+    }
+
+    await updateNorthflankSecrets(secretSync, updatedVariables);
+  },
+
+  getSecrets: async (secretSync: TNorthflankSyncWithCredentials): Promise<TSecretMap> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+    return Object.fromEntries(Object.entries(northflankSecrets).map(([key, value]) => [key, { value }]));
+  },
+
+  removeSecrets: async (secretSync: TNorthflankSyncWithCredentials, secretMap: TSecretMap): Promise<void> => {
+    const northflankSecrets = await getNorthflankSecrets(secretSync);
+
+    const updatedVariables: Record<string, string> = {};
+
+    for (const [key, value] of Object.entries(northflankSecrets)) {
+      if (!(key in secretMap)) {
+        updatedVariables[key] = value;
+      }
+    }
+
+    await updateNorthflankSecrets(secretSync, updatedVariables);
+  }
+};

backend/src/services/secret-sync/northflank/northflank-sync-schemas.ts

@@ -0,0 +1,54 @@
+import { z } from "zod";
+
+import { SecretSyncs } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import {
+  BaseSecretSyncSchema,
+  GenericCreateSecretSyncFieldsSchema,
+  GenericUpdateSecretSyncFieldsSchema
+} from "@app/services/secret-sync/secret-sync-schemas";
+import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
+
+const NorthflankSyncDestinationConfigSchema = z.object({
+  projectId: z
+    .string()
+    .trim()
+    .min(1, "Project ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectId),
+  projectName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.projectName),
+  secretGroupId: z
+    .string()
+    .trim()
+    .min(1, "Secret Group ID is required")
+    .describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupId),
+  secretGroupName: z.string().trim().optional().describe(SecretSyncs.DESTINATION_CONFIG.NORTHFLANK.secretGroupName)
+});
+
+const NorthflankSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
+
+export const NorthflankSyncSchema = BaseSecretSyncSchema(SecretSync.Northflank, NorthflankSyncOptionsConfig).extend({
+  destination: z.literal(SecretSync.Northflank),
+  destinationConfig: NorthflankSyncDestinationConfigSchema
+});
+
+export const CreateNorthflankSyncSchema = GenericCreateSecretSyncFieldsSchema(
+  SecretSync.Northflank,
+  NorthflankSyncOptionsConfig
+).extend({
+  destinationConfig: NorthflankSyncDestinationConfigSchema
+});
+
+export const UpdateNorthflankSyncSchema = GenericUpdateSecretSyncFieldsSchema(
+  SecretSync.Northflank,
+  NorthflankSyncOptionsConfig
+).extend({
+  destinationConfig: NorthflankSyncDestinationConfigSchema.optional()
+});
+
+export const NorthflankSyncListItemSchema = z.object({
+  name: z.literal("Northflank"),
+  connection: z.literal(AppConnection.Northflank),
+  destination: z.literal(SecretSync.Northflank),
+  canImportSecrets: z.literal(true)
+});

backend/src/services/secret-sync/northflank/northflank-sync-types.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+
+import { TNorthflankConnection } from "@app/services/app-connection/northflank";
+
+import {
+  CreateNorthflankSyncSchema,
+  NorthflankSyncListItemSchema,
+  NorthflankSyncSchema
+} from "./northflank-sync-schemas";
+
+export type TNorthflankSyncListItem = z.infer<typeof NorthflankSyncListItemSchema>;
+
+export type TNorthflankSync = z.infer<typeof NorthflankSyncSchema>;
+
+export type TNorthflankSyncInput = z.infer<typeof CreateNorthflankSyncSchema>;
+
+export type TNorthflankSyncWithCredentials = TNorthflankSync & {
+  connection: TNorthflankConnection;
+};

backend/src/services/secret-sync/secret-sync-enums.ts

@@ -28,6 +28,7 @@ export enum SecretSync {
   Checkly = "checkly",
   DigitalOceanAppPlatform = "digital-ocean-app-platform",
   Netlify = "netlify",
+  Northflank = "northflank",
   Bitbucket = "bitbucket",
   LaravelForge = "laravel-forge",
   Chef = "chef"

backend/src/services/secret-sync/secret-sync-fns.ts

@@ -52,6 +52,7 @@ import { HUMANITEC_SYNC_LIST_OPTION } from "./humanitec";
 import { HumanitecSyncFns } from "./humanitec/humanitec-sync-fns";
 import { LARAVEL_FORGE_SYNC_LIST_OPTION, LaravelForgeSyncFns } from "./laravel-forge";
 import { NETLIFY_SYNC_LIST_OPTION, NetlifySyncFns } from "./netlify";
+import { NORTHFLANK_SYNC_LIST_OPTION, NorthflankSyncFns } from "./northflank";
 import { RAILWAY_SYNC_LIST_OPTION } from "./railway/railway-sync-constants";
 import { RailwaySyncFns } from "./railway/railway-sync-fns";
 import { RENDER_SYNC_LIST_OPTION, RenderSyncFns } from "./render";
@@ -93,6 +94,7 @@ const SECRET_SYNC_LIST_OPTIONS: Record<SecretSync, TSecretSyncListItem> = {
   [SecretSync.Checkly]: CHECKLY_SYNC_LIST_OPTION,
   [SecretSync.DigitalOceanAppPlatform]: DIGITAL_OCEAN_APP_PLATFORM_SYNC_LIST_OPTION,
   [SecretSync.Netlify]: NETLIFY_SYNC_LIST_OPTION,
+  [SecretSync.Northflank]: NORTHFLANK_SYNC_LIST_OPTION,
   [SecretSync.Bitbucket]: BITBUCKET_SYNC_LIST_OPTION,
   [SecretSync.LaravelForge]: LARAVEL_FORGE_SYNC_LIST_OPTION,
   [SecretSync.Chef]: CHEF_SYNC_LIST_OPTION
@@ -279,6 +281,8 @@ export const SecretSyncFns = {
         return DigitalOceanAppPlatformSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.Netlify:
         return NetlifySyncFns.syncSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Northflank:
+        return NorthflankSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.Bitbucket:
         return BitbucketSyncFns.syncSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:
@@ -398,6 +402,9 @@ export const SecretSyncFns = {
       case SecretSync.Netlify:
         secretMap = await NetlifySyncFns.getSecrets(secretSync);
         break;
+      case SecretSync.Northflank:
+        secretMap = await NorthflankSyncFns.getSecrets(secretSync);
+        break;
       case SecretSync.Bitbucket:
         secretMap = await BitbucketSyncFns.getSecrets(secretSync);
         break;
@@ -498,6 +505,8 @@ export const SecretSyncFns = {
         return DigitalOceanAppPlatformSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.Netlify:
         return NetlifySyncFns.removeSecrets(secretSync, schemaSecretMap);
+      case SecretSync.Northflank:
+        return NorthflankSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.Bitbucket:
         return BitbucketSyncFns.removeSecrets(secretSync, schemaSecretMap);
       case SecretSync.LaravelForge:

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -32,6 +32,7 @@ export const SECRET_SYNC_NAME_MAP: Record<SecretSync, string> = {
   [SecretSync.Checkly]: "Checkly",
   [SecretSync.DigitalOceanAppPlatform]: "Digital Ocean App Platform",
   [SecretSync.Netlify]: "Netlify",
+  [SecretSync.Northflank]: "Northflank",
   [SecretSync.Bitbucket]: "Bitbucket",
   [SecretSync.LaravelForge]: "Laravel Forge",
   [SecretSync.Chef]: "Chef"
@@ -67,6 +68,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
   [SecretSync.Checkly]: AppConnection.Checkly,
   [SecretSync.DigitalOceanAppPlatform]: AppConnection.DigitalOcean,
   [SecretSync.Netlify]: AppConnection.Netlify,
+  [SecretSync.Northflank]: AppConnection.Northflank,
   [SecretSync.Bitbucket]: AppConnection.Bitbucket,
   [SecretSync.LaravelForge]: AppConnection.LaravelForge,
   [SecretSync.Chef]: AppConnection.Chef
@@ -102,6 +104,7 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
   [SecretSync.Checkly]: SecretSyncPlanType.Regular,
   [SecretSync.DigitalOceanAppPlatform]: SecretSyncPlanType.Regular,
   [SecretSync.Netlify]: SecretSyncPlanType.Regular,
+  [SecretSync.Northflank]: SecretSyncPlanType.Regular,
   [SecretSync.Bitbucket]: SecretSyncPlanType.Regular,
   [SecretSync.LaravelForge]: SecretSyncPlanType.Regular,
   [SecretSync.Chef]: SecretSyncPlanType.Regular
@@ -146,6 +149,7 @@ export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
   [SecretSync.Checkly]: ["groupName", "accountName"],
   [SecretSync.DigitalOceanAppPlatform]: ["appName"],
   [SecretSync.Netlify]: ["accountName", "siteName"],
+  [SecretSync.Northflank]: [],
   [SecretSync.Bitbucket]: [],
   [SecretSync.LaravelForge]: [],
   [SecretSync.Chef]: []
@@ -207,6 +211,7 @@ export const DESTINATION_DUPLICATE_CHECK_MAP: Record<SecretSync, DestinationDupl
   [SecretSync.Checkly]: defaultDuplicateCheck,
   [SecretSync.DigitalOceanAppPlatform]: defaultDuplicateCheck,
   [SecretSync.Netlify]: defaultDuplicateCheck,
+  [SecretSync.Northflank]: defaultDuplicateCheck,
   [SecretSync.Bitbucket]: defaultDuplicateCheck,
   [SecretSync.LaravelForge]: defaultDuplicateCheck,
   [SecretSync.Chef]: defaultDuplicateCheck

backend/src/services/secret-sync/secret-sync-types.ts

@@ -125,6 +125,12 @@ import {
   TLaravelForgeSyncWithCredentials
 } from "./laravel-forge";
 import { TNetlifySync, TNetlifySyncInput, TNetlifySyncListItem, TNetlifySyncWithCredentials } from "./netlify";
+import {
+  TNorthflankSync,
+  TNorthflankSyncInput,
+  TNorthflankSyncListItem,
+  TNorthflankSyncWithCredentials
+} from "./northflank";
 import {
   TRailwaySync,
   TRailwaySyncInput,
@@ -189,6 +195,7 @@ export type TSecretSync =
   | TChecklySync
   | TSupabaseSync
   | TNetlifySync
+  | TNorthflankSync
   | TBitbucketSync;
 
 export type TSecretSyncWithCredentials =
@@ -222,6 +229,7 @@ export type TSecretSyncWithCredentials =
   | TSupabaseSyncWithCredentials
   | TDigitalOceanAppPlatformSyncWithCredentials
   | TNetlifySyncWithCredentials
+  | TNorthflankSyncWithCredentials
   | TBitbucketSyncWithCredentials
   | TLaravelForgeSyncWithCredentials;
 
@@ -256,6 +264,7 @@ export type TSecretSyncInput =
   | TSupabaseSyncInput
   | TDigitalOceanAppPlatformSyncInput
   | TNetlifySyncInput
+  | TNorthflankSyncInput
   | TBitbucketSyncInput
   | TLaravelForgeSyncInput;
 
@@ -291,6 +300,7 @@ export type TSecretSyncListItem =
   | TSupabaseSyncListItem
   | TDigitalOceanAppPlatformSyncListItem
   | TNetlifySyncListItem
+  | TNorthflankSyncListItem
   | TBitbucketSyncListItem;
 
 export type TSyncOptionsConfig = {