From 8cfcbaa12c1c353cfb283b4d5f18e9d12ca48989 Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Mon, 11 Nov 2024 13:17:25 -0800
Subject: [PATCH 1/4] fix: correct secret reference validation check to permit
 referencing the same secret multiple times and improve error message

---
 .../src/services/secret-v2-bridge/secret-v2-bridge-service.ts | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index 75b7fcca9..6b9740ffd 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -150,9 +150,9 @@ export const secretV2BridgeServiceFactory = ({
       }
     });
 
-    if (referredSecrets.length !== references.length)
+    if (new Set(referredSecrets.map((sec) => sec.key)).size !== new Set(references.map((sec) => sec.secretKey)).size)
       throw new BadRequestError({
-        message: `Referenced secret not found. Found only ${diff(
+        message: `Referenced secret(s) not found: ${diff(
           references.map((el) => el.secretKey),
           referredSecrets.map((el) => el.key)
         ).join(",")}`

From 14810de0542577ff4350827d82ca45db4483a972 Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Mon, 11 Nov 2024 13:46:39 -0800
Subject: [PATCH 2/4] fix: correct secret reference value replacement to
 support special characters

---
 .../src/services/secret-v2-bridge/secret-v2-bridge-fns.ts   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
index f1042d20c..22fc04db3 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
@@ -444,6 +444,7 @@ export const expandSecretReferencesFactory = ({
       // eslint-disable-next-line no-continue
       if (depth > MAX_SECRET_REFERENCE_DEPTH) continue;
       const refs = value?.match(INTERPOLATION_SYNTAX_REG);
+      console.log("refs", refs);
 
       if (refs) {
         for (const interpolationSyntax of refs) {
@@ -518,7 +519,10 @@ export const expandSecretReferencesFactory = ({
           }
 
           if (referencedSecretValue) {
-            expandedValue = expandedValue.replaceAll(interpolationSyntax, referencedSecretValue);
+            expandedValue = expandedValue.replaceAll(
+              interpolationSyntax,
+              () => referencedSecretValue // prevents special characters from triggering replacement patterns
+            );
           }
         }
       }

From 4a3143e68996a58727ecb82cd534d777808a87ec Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Mon, 11 Nov 2024 14:04:36 -0800
Subject: [PATCH 3/4] fix: correct unique secret check to account for env and
 path

---
 .../services/secret-v2-bridge/secret-v2-bridge-service.ts   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
index 6b9740ffd..d49a183ae 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts
@@ -150,7 +150,11 @@ export const secretV2BridgeServiceFactory = ({
       }
     });
 
-    if (new Set(referredSecrets.map((sec) => sec.key)).size !== new Set(references.map((sec) => sec.secretKey)).size)
+    if (
+      referredSecrets.length !==
+      new Set(references.map(({ secretKey, secretPath, environment }) => `${secretKey}.${secretPath}.${environment}`))
+        .size // only count unique references
+    )
       throw new BadRequestError({
         message: `Referenced secret(s) not found: ${diff(
           references.map((el) => el.secretKey),

From 334a728259230ce4df58d769bbf46b6e3df7ed48 Mon Sep 17 00:00:00 2001
From: Scott Wilson <scottraywilson@gmail.com>
Date: Mon, 11 Nov 2024 14:06:12 -0800
Subject: [PATCH 4/4] chore: remove console log

---
 backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts | 1 -
 1 file changed, 1 deletion(-)

diff --git a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
index 22fc04db3..95d2cdbf4 100644
--- a/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
+++ b/backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts
@@ -444,7 +444,6 @@ export const expandSecretReferencesFactory = ({
       // eslint-disable-next-line no-continue
       if (depth > MAX_SECRET_REFERENCE_DEPTH) continue;
       const refs = value?.match(INTERPOLATION_SYNTAX_REG);
-      console.log("refs", refs);
 
       if (refs) {
         for (const interpolationSyntax of refs) {