fix: refactor secrets overview endpoint to filter envs for secrets with read permissions

backend/src/server/routes/v3/dashboard-router.ts

@@ -1,8 +1,9 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 import { z } from "zod";
 
 import { SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { DASHBOARD } from "@app/lib/api-docs";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
@@ -174,114 +175,135 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         }
       }
 
-      try {
-        if (includeDynamicSecrets) {
-          // this is the unique count, ie duplicate secrets across envs only count as 1
-          totalDynamicSecretCount = await server.services.dynamicSecret.getCountMultiEnv({
+      if (!includeDynamicSecrets && !includeSecrets)
+        return {
+          folders,
+          totalFolderCount,
+          totalCount: totalFolderCount ?? 0
+        };
+
+      const { permission } = await server.services.permission.getProjectPermission(
+        req.permission.type,
+        req.permission.id,
+        projectId,
+        req.permission.authMethod,
+        req.permission.orgId
+      );
+
+      const permissiveEnvs = // filter envs user has access to
+        environments.filter((environment) =>
+          permission.can(
+            ProjectPermissionActions.Read,
+            subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+          )
+        );
+
+      if (includeDynamicSecrets) {
+        // this is the unique count, ie duplicate secrets across envs only count as 1
+        totalDynamicSecretCount = await server.services.dynamicSecret.getCountMultiEnv({
+          actor: req.permission.type,
+          actorId: req.permission.id,
+          actorAuthMethod: req.permission.authMethod,
+          actorOrgId: req.permission.orgId,
+          projectId,
+          search,
+          environmentSlugs: permissiveEnvs,
+          path: secretPath,
+          isInternal: true
+        });
+
+        if (remainingLimit > 0 && totalDynamicSecretCount > adjustedOffset) {
+          dynamicSecrets = await server.services.dynamicSecret.listDynamicSecretsByFolderIds({
             actor: req.permission.type,
             actorId: req.permission.id,
             actorAuthMethod: req.permission.authMethod,
             actorOrgId: req.permission.orgId,
             projectId,
             search,
-            environmentSlugs: environments,
-            path: secretPath
+            orderBy,
+            orderDirection,
+            environmentSlugs: permissiveEnvs,
+            path: secretPath,
+            limit: remainingLimit,
+            offset: adjustedOffset,
+            isInternal: true
           });
 
-          if (remainingLimit > 0 && totalDynamicSecretCount > adjustedOffset) {
-            dynamicSecrets = await server.services.dynamicSecret.listDynamicSecretsByFolderIds({
-              actor: req.permission.type,
-              actorId: req.permission.id,
-              actorAuthMethod: req.permission.authMethod,
-              actorOrgId: req.permission.orgId,
-              projectId,
-              search,
-              orderBy,
-              orderDirection,
-              environmentSlugs: environments,
-              path: secretPath,
-              limit: remainingLimit,
-              offset: adjustedOffset
-            });
+          // get the count of unique dynamic secret names to properly adjust remaining limit
+          const uniqueDynamicSecretsCount = new Set(dynamicSecrets.map((dynamicSecret) => dynamicSecret.name)).size;
 
-            // get the count of unique dynamic secret names to properly adjust remaining limit
-            const uniqueDynamicSecretsCount = new Set(dynamicSecrets.map((dynamicSecret) => dynamicSecret.name)).size;
-
-            remainingLimit -= uniqueDynamicSecretsCount;
-            adjustedOffset = 0;
-          } else {
-            adjustedOffset = Math.max(0, adjustedOffset - totalDynamicSecretCount);
-          }
+          remainingLimit -= uniqueDynamicSecretsCount;
+          adjustedOffset = 0;
+        } else {
+          adjustedOffset = Math.max(0, adjustedOffset - totalDynamicSecretCount);
         }
+      }
 
-        if (includeSecrets) {
-          // this is the unique count, ie duplicate secrets across envs only count as 1
-          totalSecretCount = await server.services.secret.getSecretsCountMultiEnv({
+      if (includeSecrets) {
+        // this is the unique count, ie duplicate secrets across envs only count as 1
+        totalSecretCount = await server.services.secret.getSecretsCountMultiEnv({
+          actorId: req.permission.id,
+          actor: req.permission.type,
+          actorOrgId: req.permission.orgId,
+          environments: permissiveEnvs,
+          actorAuthMethod: req.permission.authMethod,
+          projectId,
+          path: secretPath,
+          search,
+          isInternal: true
+        });
+
+        if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
+          secrets = await server.services.secret.getSecretsRawMultiEnv({
             actorId: req.permission.id,
             actor: req.permission.type,
             actorOrgId: req.permission.orgId,
-            environments,
+            environments: permissiveEnvs,
             actorAuthMethod: req.permission.authMethod,
             projectId,
             path: secretPath,
-            search
+            orderBy,
+            orderDirection,
+            search,
+            limit: remainingLimit,
+            offset: adjustedOffset,
+            isInternal: true
           });
 
-          if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
-            secrets = await server.services.secret.getSecretsRawMultiEnv({
-              actorId: req.permission.id,
-              actor: req.permission.type,
-              actorOrgId: req.permission.orgId,
-              environments,
-              actorAuthMethod: req.permission.authMethod,
-              projectId,
-              path: secretPath,
-              orderBy,
-              orderDirection,
-              search,
-              limit: remainingLimit,
-              offset: adjustedOffset
-            });
+          for await (const environment of permissiveEnvs) {
+            const secretCountFromEnv = secrets.filter((secret) => secret.environment === environment).length;
 
-            for await (const environment of environments) {
-              const secretCountFromEnv = secrets.filter((secret) => secret.environment === environment).length;
+            if (secretCountFromEnv) {
+              await server.services.auditLog.createAuditLog({
+                projectId,
+                ...req.auditLogInfo,
+                event: {
+                  type: EventType.GET_SECRETS,
+                  metadata: {
+                    environment,
+                    secretPath,
+                    numberOfSecrets: secretCountFromEnv
+                  }
+                }
+              });
 
-              if (secretCountFromEnv) {
-                await server.services.auditLog.createAuditLog({
-                  projectId,
-                  ...req.auditLogInfo,
-                  event: {
-                    type: EventType.GET_SECRETS,
-                    metadata: {
-                      environment,
-                      secretPath,
-                      numberOfSecrets: secretCountFromEnv
-                    }
+              if (getUserAgentType(req.headers["user-agent"]) !== UserAgentType.K8_OPERATOR) {
+                await server.services.telemetry.sendPostHogEvents({
+                  event: PostHogEventTypes.SecretPulled,
+                  distinctId: getTelemetryDistinctId(req),
+                  properties: {
+                    numberOfSecrets: secretCountFromEnv,
+                    workspaceId: projectId,
+                    environment,
+                    secretPath,
+                    channel: getUserAgentType(req.headers["user-agent"]),
+                    ...req.auditLogInfo
                   }
                 });
-
-                if (getUserAgentType(req.headers["user-agent"]) !== UserAgentType.K8_OPERATOR) {
-                  await server.services.telemetry.sendPostHogEvents({
-                    event: PostHogEventTypes.SecretPulled,
-                    distinctId: getTelemetryDistinctId(req),
-                    properties: {
-                      numberOfSecrets: secretCountFromEnv,
-                      workspaceId: projectId,
-                      environment,
-                      secretPath,
-                      channel: getUserAgentType(req.headers["user-agent"]),
-                      ...req.auditLogInfo
-                    }
-                  });
-                }
               }
             }
           }
         }
-      } catch (error) {
-        if (!(error instanceof ForbiddenError)) {
-          throw error;
-        }
       }
 
       return {