feat(secret-sync): Gitlab PR suggestions

2026-09-22 13:39:35 +00:00 · 2025-06-23 10:52:59 -03:00
parent 27cb686216
commit c305ddd463
18 changed files with 58 additions and 57 deletions
--- a/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts
+++ b/backend/src/services/app-connection/gitlab/gitlab-connection-fns.ts
@@ -4,7 +4,9 @@ import { AxiosError, AxiosResponse } from "axios";
 import { getConfig } from "@app/lib/config/env";
 import { request } from "@app/lib/config/request";
 import { BadRequestError, InternalServerError } from "@app/lib/errors";
+import { removeTrailingSlash } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { encryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
 import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
@@ -37,6 +39,14 @@ export const getGitLabConnectionListItem = () => {
  };
 };

+export const getGitLabInstanceUrl = async (instanceUrl?: string) => {
+  const gitLabInstanceUrl = instanceUrl ? removeTrailingSlash(instanceUrl) : IntegrationUrls.GITLAB_URL;
+
+  await blockLocalAndPrivateIpAddresses(gitLabInstanceUrl);
+
+  return gitLabInstanceUrl;
+};
+
 export const refreshGitLabToken = async (
  refreshToken: string,
  appId: string,
@@ -61,16 +71,13 @@ export const refreshGitLabToken = async (
  });

  try {
-    const { data } = await request.post<GitLabOAuthTokenResponse>(
-      `${instanceUrl ? `${instanceUrl}/oauth/token` : IntegrationUrls.GITLAB_TOKEN_URL}`,
-      payload.toString(),
-      {
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        }
+    const url = await getGitLabInstanceUrl(instanceUrl);
+    const { data } = await request.post<GitLabOAuthTokenResponse>(`${url}/oauth/token`, payload.toString(), {
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
      }
-    );
+    });

    const expiresAt = new Date(Date.now() + data.expires_in * 1000 - 60000);

@@ -118,17 +125,14 @@ export const exchangeGitLabOAuthCode = async (
      client_secret: CLIENT_SECRET_GITLAB_LOGIN,
      redirect_uri: `${SITE_URL}/integrations/gitlab/oauth2/callback`
    });
+    const url = await getGitLabInstanceUrl(instanceUrl);

-    const response = await request.post<GitLabOAuthTokenResponse>(
-      instanceUrl ? `${instanceUrl}/oauth/token` : IntegrationUrls.GITLAB_TOKEN_URL,
-      payload.toString(),
-      {
-        headers: {
-          "Content-Type": "application/x-www-form-urlencoded",
-          Accept: "application/json"
-        }
+    const response = await request.post<GitLabOAuthTokenResponse>(`${url}/oauth/token`, payload.toString(), {
+      headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
      }
-    );
+    });

    if (!response.data) {
      throw new InternalServerError({
@@ -169,15 +173,13 @@ export const validateGitLabConnectionCredentials = async (config: TGitLabConnect
  let response: AxiosResponse<TGitLabProject[]> | null = null;

  try {
-    response = await request.get<TGitLabProject[]>(
-      `${inputCredentials.instanceUrl ? `${inputCredentials.instanceUrl}/api` : IntegrationUrls.GITLAB_API_URL}/v4/groups`,
-      {
-        headers: {
-          Authorization: `Bearer ${accessToken}`,
-          Accept: "application/json"
-        }
+    const url = await getGitLabInstanceUrl(inputCredentials.instanceUrl);
+    response = await request.get<TGitLabProject[]>(`${url}/api/v4/groups`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        Accept: "application/json"
      }
-    );
+    });
  } catch (error: unknown) {
    if (error instanceof AxiosError) {
      throw new BadRequestError({
@@ -236,9 +238,8 @@ export const listGitLabProjects = async ({
    );
  }

-  const gitLabApiUrl = appConnection.credentials.instanceUrl
-    ? `${appConnection.credentials.instanceUrl}/api/v4`
-    : `${IntegrationUrls.GITLAB_API_URL}/v4`;
+  const url = await getGitLabInstanceUrl(appConnection.credentials.instanceUrl);
+  const gitLabApiUrl = `${url}/api/v4`;

  const projects: TGitLabProject[] = [];
  let page = 1;
@@ -433,9 +434,8 @@ export const listGitLabGroups = async ({
    );
  }

-  const gitLabApiUrl = appConnection.credentials.instanceUrl
-    ? `${appConnection.credentials.instanceUrl}/api/v4`
-    : `${IntegrationUrls.GITLAB_API_URL}/v4`;
+  const url = await getGitLabInstanceUrl(appConnection.credentials.instanceUrl);
+  const gitLabApiUrl = `${url}/api/v4`;

  const groups: TGitLabGroup[] = [];
  let page = 1;
--- a/backend/src/services/secret-sync/gitlab/gitlab-sync-fns.ts
+++ b/backend/src/services/secret-sync/gitlab/gitlab-sync-fns.ts
@@ -1,5 +1,6 @@
 /* eslint-disable no-await-in-loop */
 import { request } from "@app/lib/config/request";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { GitLabConnectionMethod, refreshGitLabToken, TGitLabConnection } from "@app/services/app-connection/gitlab";
 import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
@@ -55,8 +56,9 @@ const getValidAccessToken = async (
  return connection.credentials.accessToken;
 };

-const getGitLabApiUrl = (connection: TGitLabConnection): string => {
+const getGitLabApiUrl = async (connection: TGitLabConnection): Promise<string> => {
  const baseUrl = connection.credentials.instanceUrl || IntegrationUrls.GITLAB_API_URL;
+  await blockLocalAndPrivateIpAddresses(baseUrl);
  return baseUrl.includes("/api") ? baseUrl : `${baseUrl}/api`;
 };

@@ -76,7 +78,7 @@ const getGitLabVariables = async ({
  targetEnvironment?: string;
 }): Promise<TGitLabVariable[]> => {
  try {
-    const apiUrl = getGitLabApiUrl(connection);
+    const apiUrl = await getGitLabApiUrl(connection);
    const baseEndpoint = buildVariablesEndpoint(apiUrl, projectId);

    const headers = {
@@ -131,7 +133,7 @@ const createGitLabVariable = async ({
  variable: TGitLabVariableCreate;
 }): Promise<void> => {
  try {
-    const apiUrl = getGitLabApiUrl(connection);
+    const apiUrl = await getGitLabApiUrl(connection);
    const endpoint = buildVariablesEndpoint(apiUrl, projectId);

    const payload = {
@@ -177,7 +179,7 @@ const updateGitLabVariable = async ({
  targetEnvironment?: string;
 }): Promise<void> => {
  try {
-    const apiUrl = getGitLabApiUrl(connection);
+    const apiUrl = await getGitLabApiUrl(connection);
    const baseEndpoint = buildVariablesEndpoint(apiUrl, projectId);
    let url = `${baseEndpoint}/${encodeURIComponent(key)}`;

@@ -224,7 +226,7 @@ const deleteGitLabVariable = async ({
  targetEnvironment?: string;
 }): Promise<void> => {
  try {
-    const apiUrl = getGitLabApiUrl(connection);
+    const apiUrl = await getGitLabApiUrl(connection);
    const baseEndpoint = buildVariablesEndpoint(apiUrl, projectId);
    let url = `${baseEndpoint}/${encodeURIComponent(key)}`;

--- a/docs/integrations/secret-syncs/gitlab.mdx
+++ b/docs/integrations/secret-syncs/gitlab.mdx
@@ -5,8 +5,8 @@ description: "Learn how to configure a GitLab Sync for Infisical."

 **Prerequisites:**

-        - Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
-        - Create a [GitLab Connection](/integrations/app-connections/gitlab)
+    - Set up and add secrets to [Infisical Cloud](https://app.infisical.com)
+    - Create a [GitLab Connection](/integrations/app-connections/gitlab)

 <Tabs>
    <Tab title="Infisical UI">
--- a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/GitLabSyncFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/GitLabSyncFields.tsx
@@ -65,7 +65,7 @@ const SecretProtectionOption = ({

 export const GitLabSyncFields = () => {
  const { control, setValue } = useFormContext<
-    TSecretSyncForm & { destination: SecretSync.Gitlab }
+    TSecretSyncForm & { destination: SecretSync.GitLab }
  >();

  const connectionId = useWatch({ name: "connection.id", control });
@@ -259,10 +259,10 @@ export const GitLabSyncFields = () => {
            control={control}
            name="destinationConfig.shouldHideSecrets"
            render={({ field: { onChange, value } }) => (
-              <div className='"max-h-32 opacity-100" transition-all duration-300'>
+              <div className="max-h-32 opacity-100 transition-all duration-300">
                <SecretProtectionOption
                  id="should-hide-secrets"
-                  title="Mark Infisical secrets in GitLab as 'Protected' secrets"
+                  title="Mark Infisical secrets in GitLab as 'Hidden' secrets"
                  tooltip="Secrets can only be marked as hidden if they are also masked."
                  isEnabled={value || false}
                  onChange={onChange}
--- a/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/SecretSyncDestinationFields.tsx
@@ -71,7 +71,7 @@ export const SecretSyncDestinationFields = () => {
      return <RenderSyncFields />;
    case SecretSync.Flyio:
      return <FlyioSyncFields />;
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      return <GitLabSyncFields />;
    default:
      throw new Error(`Unhandled Destination Config Field: ${destination}`);
--- a/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx
@@ -55,7 +55,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
    case SecretSync.Heroku:
    case SecretSync.Render:
    case SecretSync.Flyio:
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      AdditionalSyncOptionsFieldsComponent = null;
      break;
    default:
--- a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/GitLabSyncReviewFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/GitLabSyncReviewFields.tsx
@@ -5,7 +5,7 @@ import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
 import { SecretSync } from "@app/hooks/api/secretSyncs";

 export const GitLabSyncReviewFields = () => {
-  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Gitlab }>();
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.GitLab }>();
  const projectId = watch("destinationConfig.projectId");
  const targetEnvironment = watch("destinationConfig.targetEnvironment");
  const groupId = watch("destinationConfig.groupId");
--- a/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
+++ b/frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/SecretSyncReviewFields.tsx
@@ -117,7 +117,7 @@ export const SecretSyncReviewFields = () => {
    case SecretSync.Flyio:
      DestinationFieldsComponent = <FlyioSyncReviewFields />;
      break;
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      DestinationFieldsComponent = <GitLabSyncReviewFields />;
      break;
    default:
--- a/frontend/src/components/secret-syncs/forms/schemas/gitlab-sync-destination-schema.ts
+++ b/frontend/src/components/secret-syncs/forms/schemas/gitlab-sync-destination-schema.ts
@@ -6,7 +6,7 @@ import { GitlabSyncScope } from "@app/hooks/api/secretSyncs/types/gitlab-sync";

 export const GitlabSyncDestinationSchema = BaseSecretSyncSchema().merge(
  z.object({
-    destination: z.literal(SecretSync.Gitlab),
+    destination: z.literal(SecretSync.GitLab),
    destinationConfig: z.discriminatedUnion("scope", [
      z.object({
        scope: z.literal(GitlabSyncScope.Individual),
--- a/frontend/src/helpers/appConnections.ts
+++ b/frontend/src/helpers/appConnections.ts
@@ -86,7 +86,7 @@ export const APP_CONNECTION_MAP: Record<
  [AppConnection.Heroku]: { name: "Heroku", image: "Heroku.png" },
  [AppConnection.Render]: { name: "Render", image: "Render.png" },
  [AppConnection.Flyio]: { name: "Fly.io", image: "Flyio.svg" },
-  [AppConnection.Gitlab]: { name: "Gitlab", image: "GitLab.png" }
+  [AppConnection.Gitlab]: { name: "GitLab", image: "GitLab.png" }
 };

 export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
--- a/frontend/src/helpers/secretSyncs.ts
+++ b/frontend/src/helpers/secretSyncs.ts
@@ -74,7 +74,7 @@ export const SECRET_SYNC_MAP: Record<SecretSync, { name: string; image: string }
    name: "Fly.io",
    image: "Flyio.svg"
  },
-  [SecretSync.Gitlab]: {
+  [SecretSync.GitLab]: {
    name: "Gitlab",
    image: "GitLab.png"
  }
@@ -101,7 +101,7 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
  [SecretSync.Heroku]: AppConnection.Heroku,
  [SecretSync.Render]: AppConnection.Render,
  [SecretSync.Flyio]: AppConnection.Flyio,
-  [SecretSync.Gitlab]: AppConnection.Gitlab
+  [SecretSync.GitLab]: AppConnection.Gitlab
 };

 export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<
--- a/frontend/src/hooks/api/secretSyncs/enums.ts
+++ b/frontend/src/hooks/api/secretSyncs/enums.ts
@@ -19,7 +19,7 @@ export enum SecretSync {
  Heroku = "heroku",
  Render = "render",
  Flyio = "flyio",
-  Gitlab = "gitlab"
+  GitLab = "gitlab"
 }

 export enum SecretSyncStatus {
--- a/frontend/src/hooks/api/secretSyncs/types/gitlab-sync.ts
+++ b/frontend/src/hooks/api/secretSyncs/types/gitlab-sync.ts
@@ -8,7 +8,7 @@ export enum GitlabSyncScope {
 }

 export type TGitlabSync = TRootSecretSync & {
-  destination: SecretSync.Gitlab;
+  destination: SecretSync.GitLab;
  destinationConfig:
    | {
        scope: GitlabSyncScope.Individual;
--- a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/SecretSyncDestinationCol/SecretSyncDestinationCol.tsx
@@ -68,7 +68,7 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
      return <RenderSyncDestinationCol secretSync={secretSync} />;
    case SecretSync.Flyio:
      return <FlyioSyncDestinationCol secretSync={secretSync} />;
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      return <GitLabSyncDestinationCol secretSync={secretSync} />;
    default:
      throw new Error(
--- a/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
+++ b/frontend/src/pages/secret-manager/IntegrationsListPage/components/SecretSyncsTab/SecretSyncTable/helpers/index.ts
@@ -128,7 +128,7 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
      primaryText = destinationConfig.appId;
      secondaryText = "App ID";
      break;
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      primaryText = destinationConfig.projectName;
      secondaryText = destinationConfig.projectId;
      break;
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/SecretSyncDestinatonSection.tsx
@@ -107,7 +107,7 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
    case SecretSync.Flyio:
      DestinationComponents = <FlyioSyncDestinationSection secretSync={secretSync} />;
      break;
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      DestinationComponents = <GitLabSyncDestinationSection secretSync={secretSync} />;
      break;
    default:
--- a/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
+++ b/frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncOptionsSection/SecretSyncOptionsSection.tsx
@@ -58,7 +58,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
    case SecretSync.Heroku:
    case SecretSync.Render:
    case SecretSync.Flyio:
-    case SecretSync.Gitlab:
+    case SecretSync.GitLab:
      AdditionalSyncOptionsComponent = null;
      break;
    default:
--- a/frontend/src/pages/secret-manager/integrations/GitlabOauthCallbackPage/GitlabOauthCallbackPage.tsx
+++ b/frontend/src/pages/secret-manager/integrations/GitlabOauthCallbackPage/GitlabOauthCallbackPage.tsx
@@ -33,7 +33,6 @@ export const GitLabOAuthCallbackPage = () => {

        localStorage.removeItem("latestCSRFToken");

-        // Retrieve stored form dataAdd commentMore actions
        const storedFormData = localStorage.getItem("gitlabConnectionFormData");
        if (!storedFormData) {
          console.error("No stored form data found");