Revert "feat(api/secrets): view secret value permission"

backend/src/services/secret-import/secret-import-fns.ts

@@ -3,7 +3,6 @@ import { groupBy, unique } from "@app/lib/fn";
 
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { TSecretDALFactory } from "../secret/secret-dal";
-import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretImportDALFactory } from "./secret-import-dal";
@@ -33,12 +32,6 @@ type TSecretImportSecretsV2 = {
   folderId: string | undefined;
   importFolderId: string;
   secrets: (TSecretsV2 & {
-    secretTags: {
-      slug: string;
-      name: string;
-      color?: string | null;
-      id: string;
-    }[];
     workspace: string;
     environment: string;
     _id: string;
@@ -46,7 +39,6 @@ type TSecretImportSecretsV2 = {
     // akhilmhdh: yes i know you can put ?.
     // But for somereason ts consider ? and undefined explicit as different just ts things
     secretValue: string;
-    secretValueHidden: boolean;
     secretComment: string;
     secretMetadata?: ResourceMetadataDTO;
   })[];
@@ -158,14 +150,12 @@ export const fnSecretsV2FromImports = async ({
   secretImportDAL,
   decryptor,
   expandSecretReferences,
-  hasSecretAccess,
-  viewSecretValue
+  hasSecretAccess
 }: {
   secretImports: (Omit<TSecretImports, "importEnv"> & {
     importEnv: { id: string; slug: string; name: string };
   })[];
   folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
-  viewSecretValue: boolean;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
   secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
   decryptor: (value?: Buffer | null) => string;
@@ -178,14 +168,9 @@ export const fnSecretsV2FromImports = async ({
   hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
   const cyclicDetector = new Set();
-  const stack: {
-    secretImports: typeof rootSecretImports;
-    depth: number;
-    parentImportedSecrets: (TSecretsV2 & {
-      secretValueHidden: boolean;
-      secretTags: { slug: string; name: string; id: string; color?: string | null }[];
-    })[];
-  }[] = [{ secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }];
+  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
+    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
+  ];
 
   const processedImports: TSecretImportSecretsV2[] = [];
 
@@ -244,9 +229,7 @@ export const fnSecretsV2FromImports = async ({
         .map((item) => ({
           ...item,
           secretKey: item.key,
-          secretValue: viewSecretValue ? decryptor(item.encryptedValue) : INFISICAL_SECRET_VALUE_HIDDEN_MASK,
-          secretValueHidden: !viewSecretValue,
-          secretTags: item.tags,
+          secretValue: decryptor(item.encryptedValue),
           secretComment: decryptor(item.encryptedComment),
           environment: importEnv.slug,
           workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
@@ -284,8 +267,6 @@ export const fnSecretsV2FromImports = async ({
         processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
         return Promise.allSettled(
           processedImport.secrets.map(async (decryptedSecret, index) => {
-            if (decryptedSecret.secretValueHidden) return;
-
             const expandedSecretValue = await expandSecretReferences({
               value: decryptedSecret.secretValue,
               secretPath: processedImport.secretPath,

backend/src/services/secret-import/secret-import-service.ts

@@ -5,11 +5,7 @@ import { ForbiddenError, subject } from "@casl/ability";
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getReplicationFolderName } from "@app/ee/services/secret-replication/secret-replication-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -94,7 +90,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: data.environment,
         secretPath: data.path
@@ -406,7 +402,7 @@ export const secretImportServiceFactory = ({
 
     // check if user has permission to import from target path
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.DescribeSecret,
+      ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
         environment: secretImportDoc.importEnv.slug,
         secretPath: secretImportDoc.importPath
@@ -600,7 +596,7 @@ export const secretImportServiceFactory = ({
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionSecretActions.ReadValue,
+        ProjectPermissionActions.Read,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -646,13 +642,12 @@ export const secretImportServiceFactory = ({
       const importedSecrets = await fnSecretsV2FromImports({
         secretImports,
         folderDAL,
-        viewSecretValue: true,
         secretDAL: secretV2BridgeDAL,
         secretImportDAL,
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
           permission.can(
-            ProjectPermissionSecretActions.ReadValue,
+            ProjectPermissionActions.Read,
             subject(ProjectPermissionSub.Secrets, {
               environment: expandEnvironment,
               secretPath: expandSecretPath,
@@ -672,7 +667,7 @@ export const secretImportServiceFactory = ({
 
     const allowedImports = secretImports.filter((el) =>
       permission.can(
-        ProjectPermissionSecretActions.ReadValue,
+        ProjectPermissionActions.Read,
         subject(ProjectPermissionSub.Secrets, {
           environment: el.importEnv.slug,
           secretPath: el.importPath
@@ -688,10 +683,7 @@ export const secretImportServiceFactory = ({
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>
-        decryptSecretRaw(
-          { ...encryptedSecret, workspace: projectId, environment, secretPath, secretValueHidden: false },
-          botKey
-        )
+        decryptSecretRaw({ ...encryptedSecret, workspace: projectId, environment, secretPath }, botKey)
       )
     }));
   };