fix: permission error instead of not found error on single secret import

backend/src/services/secret-import/secret-import-fns.ts

@@ -3,10 +3,10 @@ import { groupBy, unique } from "@app/lib/fn";
 
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { TSecretDALFactory } from "../secret/secret-dal";
+import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretImportDALFactory } from "./secret-import-dal";
-import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 
 type TSecretImportSecrets = {
   secretPath: string;
@@ -33,6 +33,12 @@ type TSecretImportSecretsV2 = {
   folderId: string | undefined;
   importFolderId: string;
   secrets: (TSecretsV2 & {
+    secretTags: {
+      slug: string;
+      name: string;
+      color?: string | null;
+      id: string;
+    }[];
     workspace: string;
     environment: string;
     _id: string;
@@ -175,7 +181,10 @@ export const fnSecretsV2FromImports = async ({
   const stack: {
     secretImports: typeof rootSecretImports;
     depth: number;
-    parentImportedSecrets: (TSecretsV2 & { secretValueHidden: boolean })[];
+    parentImportedSecrets: (TSecretsV2 & {
+      secretValueHidden: boolean;
+      secretTags: { slug: string; name: string; id: string; color: string }[];
+    })[];
   }[] = [{ secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }];
 
   const processedImports: TSecretImportSecretsV2[] = [];
@@ -237,6 +246,7 @@ export const fnSecretsV2FromImports = async ({
           secretKey: item.key,
           secretValue: viewSecretValue ? decryptor(item.encryptedValue) : INFISICAL_SECRET_VALUE_HIDDEN_MASK,
           secretValueHidden: !viewSecretValue,
+          secretTags: item.tags,
           secretComment: decryptor(item.encryptedComment),
           environment: importEnv.slug,
           workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.

backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts

@@ -1234,7 +1234,7 @@ export const secretV2BridgeServiceFactory = ({
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         expandSecretReferences: shouldExpandSecretReferences ? expandSecretReferences : undefined,
         hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) => {
-          const canDescribe = permission.can(
+          return permission.can(
             ProjectPermissionSecretActions.DescribeSecret,
             subject(ProjectPermissionSub.Secrets, {
               environment: expandEnvironment,
@@ -1243,17 +1243,6 @@ export const secretV2BridgeServiceFactory = ({
               secretTags: expandSecretTags
             })
           );
-          const canReadValue = permission.can(
-            ProjectPermissionSecretActions.ReadValue,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: expandEnvironment,
-              secretPath: expandSecretPath,
-              secretName: expandSecretKey,
-              secretTags: expandSecretTags
-            })
-          );
-
-          return viewSecretValue ? canDescribe && canReadValue : canDescribe;
         }
       });
 
@@ -1261,6 +1250,30 @@ export const secretV2BridgeServiceFactory = ({
         for (let j = 0; j < importedSecrets[i].secrets.length; j += 1) {
           const importedSecret = importedSecrets[i].secrets[j];
           if (secretName === importedSecret.key) {
+            let secretValueHidden = true;
+
+            if (viewSecretValue) {
+              if (
+                !permission.can(
+                  ProjectPermissionSecretActions.ReadValue,
+                  subject(ProjectPermissionSub.Secrets, {
+                    environment: importedSecret.environment,
+                    secretPath: importedSecrets[i].secretPath,
+                    secretName: importedSecret.key,
+                    secretTags: (importedSecret.secretTags || []).map((el) => el.slug)
+                  })
+                ) &&
+                secretType !== SecretType.Personal
+              ) {
+                throw new ForbiddenRequestError({
+                  message: `You do not have permission to view secret import value on secret with name '${secretName}'`,
+                  name: "ForbiddenReadSecretError"
+                });
+              }
+
+              secretValueHidden = false;
+            }
+
             return reshapeBridgeSecret(
               projectId,
               importedSecrets[i].environment,
@@ -1270,7 +1283,7 @@ export const secretV2BridgeServiceFactory = ({
                 value: importedSecret.secretValue || "",
                 comment: importedSecret.secretComment || ""
               },
-              importedSecret.secretValueHidden
+              secretValueHidden
             );
           }
         }