Merge pull request #972 from akhilmhdh/feat/permission-patch

feat(rbac): grouped folder and imports permission into secret permission

backend/src/controllers/v1/secretImpsController.ts

@@ -1,6 +1,6 @@
 import { Request, Response } from "express";
 import { isValidScope } from "../../helpers";
-import { Folder, SecretImport, ServiceTokenData } from "../../models";
+import { Folder, IServiceTokenData, SecretImport, ServiceTokenData } from "../../models";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
 import { getFolderWithPathFromId } from "../../services/FolderService";
 import {
@@ -117,7 +117,15 @@ export const createSecretImp = async (req: Request, res: Response) => {
 
   if (req.authData.authPayload instanceof ServiceTokenData) {
     // root check
-    const isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    let isValidScopeAccess = isValidScope(req.authData.authPayload, environment, secretPath);
+    if (!isValidScopeAccess) {
+      throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
+    }
+    isValidScopeAccess = isValidScope(
+      req.authData.authPayload,
+      secretImport.environment,
+      secretImport.secretPath
+    );
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
@@ -125,7 +133,14 @@ export const createSecretImp = async (req: Request, res: Response) => {
     const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.SecretImports, { environment, secretPath })
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: secretImport.environment,
+        secretPath: secretImport.secretPath
+      })
     );
   }
 
@@ -325,7 +340,7 @@ export const updateSecretImport = async (req: Request, res: Response) => {
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.SecretImports, {
+      subject(ProjectPermissionSub.Secrets, {
         environment: importSecDoc.environment,
         secretPath
       })
@@ -454,7 +469,7 @@ export const deleteSecretImport = async (req: Request, res: Response) => {
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.SecretImports, {
+      subject(ProjectPermissionSub.Secrets, {
         environment: importSecDoc.environment,
         secretPath
       })
@@ -588,7 +603,7 @@ export const getSecretImports = async (req: Request, res: Response) => {
     );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.SecretImports, {
+      subject(ProjectPermissionSub.Secrets, {
         environment: importSecDoc.environment,
         secretPath
       })
@@ -630,6 +645,7 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     secretPath = folderPath;
   }
 
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
   if (req.authData.authPayload instanceof ServiceTokenData) {
     // check for service token validity
     const isValidScopeAccess = isValidScope(
@@ -640,18 +656,13 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     if (!isValidScopeAccess) {
       throw UnauthorizedRequestError({ message: "Folder Permission Denied" });
     }
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
   } else {
     const { permission } = await getUserProjectPermissions(
       req.user._id,
       importSecDoc.workspace.toString()
     );
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.SecretImports, {
-        environment: importSecDoc.environment,
-        secretPath
-      })
-    );
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, {
@@ -659,6 +670,14 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
         secretPath
       })
     );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
   }
 
   await EEAuditLogService.createAuditLog(
@@ -677,6 +696,11 @@ export const getAllSecretsFromImport = async (req: Request, res: Response) => {
     }
   );
 
-  const secrets = await getAllImportedSecrets(workspaceId, environment, folderId);
+  const secrets = await getAllImportedSecrets(
+    workspaceId,
+    environment,
+    folderId,
+    permissionCheckFn
+  );
   return res.status(200).json({ secrets });
 };

backend/src/controllers/v1/secretsFolderController.ts

@@ -129,7 +129,7 @@ export const createFolder = async (req: Request, res: Response) => {
         : "/";
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Create,
-      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
   }
 
@@ -357,7 +357,7 @@ export const updateFolderById = async (req: Request, res: Response) => {
     const secretPath = getFolderWithPathFromId(folders.nodes, parentFolder.id).folderPath;
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Edit,
-      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
   }
 
@@ -531,7 +531,7 @@ export const deleteFolder = async (req: Request, res: Response) => {
     const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Delete,
-      subject(ProjectPermissionSub.Folders, { environment, secretPath })
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
   }
 
@@ -682,18 +682,7 @@ export const getFolders = async (req: Request, res: Response) => {
 
   const folders = await Folder.findOne({ workspace: workspaceId, environment });
 
-  if (req.user) {
+  if (req.user) await getUserProjectPermissions(req.user._id, workspaceId);
-    const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
-    const secretPath =
-      folders && parentFolderId
-        ? getFolderWithPathFromId(folders.nodes, parentFolderId).folderPath
-        : parentFolderPath || "/";
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Read,
-      subject(ProjectPermissionSub.Folders, { environment, secretPath })
-    );
-  }
 
   if (!folders) {
     res.send({ folders: [], dir: [] });

backend/src/controllers/v2/secretsController.ts

@@ -979,7 +979,13 @@ export const getSecrets = async (req: Request, res: Response) => {
   // TODO(akhilmhdh) - secret-imp change this to org type
   let importedSecrets: any[] = [];
   if (include_imports) {
-    importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId as string);
+    // depreciated
+    importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId as string,
+      () => false
+    );
   }
 
   const channel = getUserAgentType(req.headers["user-agent"]);

backend/src/controllers/v3/secretsController.ts

@@ -3,7 +3,7 @@ import { Types } from "mongoose";
 import { EventService, SecretService } from "../../services";
 import { eventPushSecrets } from "../../events";
 import { BotService } from "../../services";
-import { containsGlobPatterns, repackageSecretToRaw } from "../../helpers/secrets";
+import { containsGlobPatterns, isValidScope, repackageSecretToRaw } from "../../helpers/secrets";
 import { encryptSymmetric128BitHexKeyUTF8 } from "../../utils/crypto";
 import { getAllImportedSecrets } from "../../services/SecretImportService";
 import { Folder, IServiceTokenData } from "../../models";
@@ -55,12 +55,21 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
     secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
   }
 
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
   if (req.user?._id) {
     const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
   } else {
     await validateServiceTokenDataClientForWorkspace({
       serviceTokenData: req.authData.authPayload as IServiceTokenData,
@@ -69,6 +78,8 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
       secretPath,
       requiredPermissions: [PERMISSION_READ_SECRETS]
     });
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
   }
 
   const secrets = await SecretService.getSecrets({
@@ -94,7 +105,12 @@ export const getSecretsRaw = async (req: Request, res: Response) => {
       }
       folderId = folder.id;
     }
-    const importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId);
+    const importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId,
+      permissionCheckFn
+    );
     return res.status(200).send({
       secrets: secrets.map((secret) =>
         repackageSecretToRaw({
@@ -394,12 +410,21 @@ export const getSecrets = async (req: Request, res: Response) => {
     secretPath = getFolderWithPathFromId(folder.nodes, folderId).folderPath;
   }
 
+  let permissionCheckFn: (env: string, secPath: string) => boolean; // used to pass as callback function to import secret
   if (req.user?._id) {
     const { permission } = await getUserProjectPermissions(req.user._id, workspaceId);
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionActions.Read,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
+    permissionCheckFn = (env: string, secPath: string) =>
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: env,
+          secretPath: secPath
+        })
+      );
   } else {
     await validateServiceTokenDataClientForWorkspace({
       serviceTokenData: req.authData.authPayload as IServiceTokenData,
@@ -408,6 +433,8 @@ export const getSecrets = async (req: Request, res: Response) => {
       secretPath,
       requiredPermissions: [PERMISSION_READ_SECRETS]
     });
+    permissionCheckFn = (env: string, secPath: string) =>
+      isValidScope(req.authData.authPayload as IServiceTokenData, env, secPath);
   }
 
   const secrets = await SecretService.getSecrets({
@@ -429,7 +456,12 @@ export const getSecrets = async (req: Request, res: Response) => {
       }
       folderId = folder.id;
     }
-    const importedSecrets = await getAllImportedSecrets(workspaceId, environment, folderId);
+    const importedSecrets = await getAllImportedSecrets(
+      workspaceId,
+      environment,
+      folderId,
+      permissionCheckFn
+    );
     return res.status(200).send({
       secrets,
       imports: importedSecrets

backend/src/ee/services/ProjectRoleService.ts

@@ -49,9 +49,7 @@ export enum ProjectPermissionSub {
   IpAllowList = "ip-allowlist",
   Workspace = "workspace",
   Secrets = "secrets",
-  SecretImports = "secret-imports",
+  SecretRollback = "secret-rollback"
-  SecretRollback = "secret-rollback",
-  Folders = "folders"
 }
 
 type SubjectFields = {
@@ -64,17 +62,6 @@ export type ProjectPermissionSet =
       ProjectPermissionActions,
       ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SubjectFields)
     ]
-  | [
-      ProjectPermissionActions,
-      ProjectPermissionSub.Folders | (ForcedSubject<ProjectPermissionSub.Folders> & SubjectFields)
-    ]
-  | [
-      ProjectPermissionActions,
-      (
-        | ProjectPermissionSub.SecretImports
-        | (ForcedSubject<ProjectPermissionSub.SecretImports> & SubjectFields)
-      )
-    ]
   | [ProjectPermissionActions, ProjectPermissionSub.Role]
   | [ProjectPermissionActions, ProjectPermissionSub.Tags]
   | [ProjectPermissionActions, ProjectPermissionSub.Member]
@@ -98,16 +85,6 @@ const buildAdminPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Secrets);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Secrets);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Folders);
-
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.SecretImports);
-
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback);
 
@@ -177,15 +154,6 @@ const buildMemberPermission = () => {
   can(ProjectPermissionActions.Edit, ProjectPermissionSub.Secrets);
   can(ProjectPermissionActions.Delete, ProjectPermissionSub.Secrets);
 
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.Folders);
-
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Edit, ProjectPermissionSub.SecretImports);
-  can(ProjectPermissionActions.Delete, ProjectPermissionSub.SecretImports);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback);
 
@@ -209,8 +177,6 @@ const buildViewerPermission = () => {
   const { can, build } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
 
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.Folders);
-  can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Member);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.Role);

backend/src/helpers/bot.ts

@@ -134,7 +134,8 @@ export const getSecretsBotHelper = async ({
   const importedSecrets = await getAllImportedSecrets(
     workspaceId.toString(),
     environment,
-    folderId
+    folderId,
+    () => true // integrations are setup to read all the ones
   );
 
   importedSecrets.forEach(({ secrets }) => {

backend/src/services/SecretImportService.ts

@@ -1,10 +1,5 @@
 import { Types } from "mongoose";
-import {
+import { Folder, ISecret, Secret, SecretImport } from "../models";
-  Folder,
-  ISecret,
-  Secret,
-  SecretImport
-} from "../models";
 import { getFolderByPath } from "./FolderService";
 
 type TSecretImportFid = { environment: string; folderId: string; secretPath: string };
@@ -12,7 +7,8 @@ type TSecretImportFid = { environment: string; folderId: string; secretPath: str
 export const getAllImportedSecrets = async (
   workspaceId: string,
   environment: string,
-  folderId = "root"
+  folderId = "root",
+  permissionCheckCB: (env: string, secPath: string) => boolean
 ) => {
   const secImports = await SecretImport.findOne({
     workspace: workspaceId,
@@ -23,7 +19,10 @@ export const getAllImportedSecrets = async (
   if (secImports.imports.length === 0) return [];
 
   const importedEnv: Record<string, boolean> = {}; // to get folders from all environment
-  secImports.imports.forEach((el) => (importedEnv[el.environment] = true));
+  const allowedSecretImports = secImports.imports.filter((el) =>
+    permissionCheckCB(el.environment, el.secretPath)
+  );
+  allowedSecretImports.forEach((el) => (importedEnv[el.environment] = true));
 
   const folders = await Folder.find({
     workspace: workspaceId,
@@ -31,7 +30,7 @@ export const getAllImportedSecrets = async (
   });
 
   const importedSecByFid: TSecretImportFid[] = [];
-  secImports.imports.forEach((el) => {
+  allowedSecretImports.forEach((el) => {
     const folder = folders.find((fl) => fl.environment === el.environment);
     if (folder) {
       const secPathFolder = getFolderByPath(folder.nodes, el.secretPath);

frontend/src/context/ProjectPermissionContext/types.ts

@@ -20,9 +20,7 @@ export enum ProjectPermissionSub {
   IpAllowList = "ip-allowlist",
   Workspace = "workspace",
   Secrets = "secrets",
-  SecretImports = "secret-imports",
+  SecretRollback = "secret-rollback"
-  SecretRollback = "secret-rollback",
-  Folders = "folders"
 }
 
 type SubjectFields = {
@@ -35,17 +33,6 @@ export type ProjectPermissionSet =
       ProjectPermissionActions,
       ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SubjectFields)
     ]
-  | [
-      ProjectPermissionActions,
-      ProjectPermissionSub.Folders | (ForcedSubject<ProjectPermissionSub.Folders> & SubjectFields)
-    ]
-  | [
-      ProjectPermissionActions,
-      (
-        | ProjectPermissionSub.SecretImports
-        | (ForcedSubject<ProjectPermissionSub.SecretImports> & SubjectFields)
-      )
-    ]
   | [ProjectPermissionActions, ProjectPermissionSub.Role]
   | [ProjectPermissionActions, ProjectPermissionSub.Tags]
   | [ProjectPermissionActions, ProjectPermissionSub.Member]

frontend/src/views/DashboardPage/DashboardPage.tsx

@@ -258,21 +258,7 @@ export const DashboardPage = () => {
     ?.map(({ name }) => name)
     .join("/")}`;
 
-  const userAvailableEnvs = currentWorkspace?.environments?.filter(
+  const userAvailableEnvs = currentWorkspace?.environments || [];
-    ({ slug }) =>
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Secrets, { environment: slug, secretPath })
-      ) ||
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.Folders, { environment: slug, secretPath })
-      ) ||
-      permission.can(
-        ProjectPermissionActions.Read,
-        subject(ProjectPermissionSub.SecretImports, { environment: slug, secretPath })
-      )
-  );
 
   // This is for dnd-kit. As react-query state mutation async
   // This will act as a placeholder to avoid a glitching animation on dropping items
@@ -943,7 +929,7 @@ export const DashboardPage = () => {
                       <div className="w-full pb-1">
                         <ProjectPermissionCan
                           I={ProjectPermissionActions.Create}
-                          a={ProjectPermissionSub.Folders}
+                          a={ProjectPermissionSub.Secrets}
                         >
                           {(isAllowed) => (
                             <Button
@@ -962,7 +948,7 @@ export const DashboardPage = () => {
                       <div className="w-full">
                         <ProjectPermissionCan
                           I={ProjectPermissionActions.Edit}
-                          a={subject(ProjectPermissionSub.SecretImports, {
+                          a={subject(ProjectPermissionSub.Secrets, {
                             environment,
                             secretPath
                           })}

frontend/src/views/DashboardPage/components/FolderSection/FolderSection.tsx

@@ -56,7 +56,7 @@ export const FolderSection = memo(
                 <div className="duration-0 flex h-10 w-16 items-center justify-end space-x-2.5 overflow-hidden border-l border-mineshaft-600 transition-all">
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Edit}
-                    a={subject(ProjectPermissionSub.Folders, { environment, secretPath })}
+                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
                   >
                     {(isAllowed) => (
                       <div className="opacity-0 group-hover:opacity-100">
@@ -77,7 +77,7 @@ export const FolderSection = memo(
                   </ProjectPermissionCan>
                   <ProjectPermissionCan
                     I={ProjectPermissionActions.Delete}
-                    a={subject(ProjectPermissionSub.Folders, { environment, secretPath })}
+                    a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
                   >
                     {(isAllowed) => (
                       <div className="opacity-0 group-hover:opacity-100">

frontend/src/views/DashboardPage/components/SecretImportSection/SecretImportItem.tsx

@@ -119,7 +119,7 @@ export const SecretImportItem = ({
             </div>
             <ProjectPermissionCan
               I={ProjectPermissionActions.Delete}
-              a={subject(ProjectPermissionSub.SecretImports, { environment, secretPath })}
+              a={subject(ProjectPermissionSub.Secrets, { environment, secretPath })}
             >
               {(isAllowed) => (
                 <div className="opacity-0 group-hover:opacity-100">

frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/MultiEnvProjectPermission.tsx

@@ -24,7 +24,7 @@ import { useWorkspace } from "@app/context";
 import { TFormSchema } from "./ProjectRoleModifySection.utils";
 
 type Props = {
-  formName: "secrets" | "folders" | "secret-imports";
+  formName: "secrets";
   isNonEditable?: boolean;
   setValue: UseFormSetValue<TFormSchema>;
   control: Control<TFormSchema>;

frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.tsx

@@ -6,9 +6,7 @@ import {
   faArrowLeft,
   faBook,
   faCog,
-  faFolder,
   faKey,
-  faLink,
   faLock,
   faMagnifyingGlass,
   faNetworkWired,
@@ -244,32 +242,10 @@ export const ProjectRoleModifySection = ({ role, onGoBack }: Props) => {
               setValue={setValue}
               icon={faLock}
               title="Secrets"
-              subtitle="Secret management control"
+              subtitle="Create, modify and remove secrets, folders and secret imports"
               formName="secrets"
             />
           </div>
-          <div>
-            <MultiEnvProjectPermission
-              isNonEditable={isNonEditable}
-              control={control}
-              setValue={setValue}
-              icon={faFolder}
-              title="Folders"
-              subtitle="Folder management control"
-              formName="folders"
-            />
-          </div>
-          <div>
-            <MultiEnvProjectPermission
-              isNonEditable={isNonEditable}
-              control={control}
-              setValue={setValue}
-              icon={faLink}
-              title="Secret Imports"
-              subtitle="Secret import management control"
-              formName="secret-imports"
-            />
-          </div>
           <div key="permission-ws">
             <WsProjectPermission
               control={control}

frontend/src/views/Project/MembersPage/components/ProjectRoleListTab/components/ProjectRoleModifySection/ProjectRoleModifySection.utils.ts

@@ -23,7 +23,6 @@ const multiEnvPermissionSchema = z
   .optional();
 
 const PERMISSION_ACTIONS = ["read", "create", "edit", "delete"] as const;
-const MULTI_ENV_KEY = ["secrets", "folders", "secret-imports"] as const;
 
 export const formSchema = z.object({
   name: z.string().trim(),
@@ -32,8 +31,6 @@ export const formSchema = z.object({
   permissions: z
     .object({
       secrets: z.record(multiEnvPermissionSchema).optional(),
-      folders: z.record(multiEnvPermissionSchema).optional(),
-      "secret-imports": z.record(multiEnvPermissionSchema).optional(),
       member: generalPermissionSchema,
       role: generalPermissionSchema,
       integrations: generalPermissionSchema,
@@ -92,7 +89,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
     const { subject, action } = permission;
     if (!formVal?.[subject]) formVal[subject] = {};
 
-    if (["secrets", "folders", "secret-imports"].includes(subject)) {
+    if (subject === "secrets") {
       multiEnvApi2Form(formVal[subject], permission);
     } else {
       // everything else follows same pattern
@@ -107,7 +104,7 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
 const multiEnvForm2Api = (
   permissions: TProjectPermission[],
   formVal: Record<string, { secretPath?: string } & { [key: string]: boolean }>,
-  subject: (typeof MULTI_ENV_KEY)[number]
+  subject: "secrets"
 ) => {
   if (!formVal) return;
 
@@ -147,12 +144,8 @@ export const formRolePermission2API = (formVal: TFormSchema["permissions"]) => {
   // other than workspace everything else follows same
   // if in future there is a different follow the above on how workspace is done
   Object.entries(formVal || {}).forEach(([rule, actions]) => {
-    if (MULTI_ENV_KEY.includes(rule as (typeof MULTI_ENV_KEY)[number])) {
+    if (rule === "secrets") {
-      multiEnvForm2Api(
+      multiEnvForm2Api(permissions, JSON.parse(JSON.stringify(actions || {})), rule);
-        permissions,
-        JSON.parse(JSON.stringify(actions || {})),
-        rule as (typeof MULTI_ENV_KEY)[number]
-      );
     } else {
       Object.entries(actions).forEach(([action, isAllowed]) => {
         if (isAllowed) {

frontend/src/views/SecretOverviewPage/SecretOverviewPage.tsx

@@ -2,7 +2,6 @@ import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import Link from "next/link";
 import { useRouter } from "next/router";
-import { subject } from "@casl/ability";
 import {
   faArrowDown,
   faArrowUp,
@@ -30,13 +29,7 @@ import {
   Tooltip,
   Tr
 } from "@app/components/v2";
-import {
+import { useOrganization, useWorkspace } from "@app/context";
-  ProjectPermissionActions,
-  ProjectPermissionSub,
-  useOrganization,
-  useProjectPermission,
-  useWorkspace
-} from "@app/context";
 import {
   useCreateSecretV3,
   useDeleteSecretV3,
@@ -82,7 +75,6 @@ export const SecretOverviewPage = () => {
   const { data: latestFileKey } = useGetUserWsKey(workspaceId);
   const [searchFilter, setSearchFilter] = useState("");
   const secretPath = (router.query?.secretPath as string) || "/";
-  const permission = useProjectPermission();
 
   useEffect(() => {
     if (!isWorkspaceLoading && !workspaceId && router.isReady) {
@@ -90,22 +82,7 @@ export const SecretOverviewPage = () => {
     }
   }, [isWorkspaceLoading, workspaceId, router.isReady]);
 
-  const userAvailableEnvs =
+  const userAvailableEnvs = currentWorkspace?.environments || [];
-    currentWorkspace?.environments?.filter(
-      ({ slug }) =>
-        permission.can(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.Secrets, { environment: slug, secretPath })
-        ) ||
-        permission.can(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.Folders, { environment: slug, secretPath })
-        ) ||
-        permission.can(
-          ProjectPermissionActions.Read,
-          subject(ProjectPermissionSub.SecretImports, { environment: slug, secretPath })
-        )
-    ) || [];
 
   const {
     data: secrets,