From eef29cd2d42b76ebd6ea816220d98e182a482b99 Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 7 Feb 2024 12:08:30 -0500 Subject: [PATCH 1/2] patch get secret by name --- backend/src/services/secret/secret-service.ts | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 71086446f..c4779d9c7 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -537,18 +537,27 @@ export const secretServiceFactory = ({ const secretBlindIndex = await interalGenSecBlindIndexByName(projectId, secretName); - const secret = await (typeof version !== undefined + // Case: The old python SDK uses incorrect logic https://github.com/Infisical/infisical-python/blob/main/infisical/client/infisicalclient.py#L89. + // Fetch secrets using service tokens cannot fetch personal secrets, only shared. + // The mongo backend used to correct this mistake, this line also adds it to current backend + // Mongo backend check: https://github.com/Infisical/infisical-mongo/blob/main/backend/src/helpers/secrets.ts#L658 + let secretType = type; + if (actor === ActorType.SERVICE) { + secretType = SecretType.Shared; + } + + const secret = await (typeof version === undefined ? secretDAL.findOne({ folderId, - type, - userId: type === SecretType.Personal ? actorId : null, + type: secretType, + userId: secretType === SecretType.Personal ? actorId : null, secretBlindIndex }) : secretVersionDAL .findOne({ folderId, - type, - userId: type === SecretType.Personal ? actorId : null, + type: secretType, + userId: secretType === SecretType.Personal ? actorId : null, secretBlindIndex }) .then((el) => SecretsSchema.parse({ ...el, id: el.secretId }))); From 8bc952388c7e5c9c4b52c6f6dee13a42a2fc546b Mon Sep 17 00:00:00 2001 From: Maidul Islam Date: Wed, 7 Feb 2024 12:23:48 -0500 Subject: [PATCH 2/2] add log --- backend/src/services/secret/secret-service.ts | 3 +++ 1 file changed, 3 insertions(+) diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index c4779d9c7..aa9ce309a 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -543,6 +543,9 @@ export const secretServiceFactory = ({ // Mongo backend check: https://github.com/Infisical/infisical-mongo/blob/main/backend/src/helpers/secrets.ts#L658 let secretType = type; if (actor === ActorType.SERVICE) { + logger.info( + `secretServiceFactory: overriding secret type for service token [projectId=${projectId}] [factoryFunctionName=getSecretByName]` + ); secretType = SecretType.Shared; }