misc: revisions to import secret flow

backend/src/server/routes/v3/external-migration-router.ts

@@ -7,6 +7,7 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import {
   ExternalMigrationProviders,
+  VaultImportStatus,
   VaultMappingType
 } from "@app/services/external-migration/external-migration-types";
 
@@ -277,19 +278,19 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
       }),
       response: {
         200: z.object({
-          message: z.string()
+          status: z.nativeEnum(VaultImportStatus)
         })
       }
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
-      await server.services.migration.importVaultSecrets({
+      const result = await server.services.migration.importVaultSecrets({
         actor: req.permission,
         auditLogInfo: req.auditLogInfo,
         ...req.body
       });
 
-      return { message: "Successfully imported vault secrets" };
+      return result;
     }
   });
 

backend/src/services/external-migration/external-migration-service.ts

@@ -43,7 +43,8 @@ import {
   TConfigureExternalMigrationDTO,
   THasCustomVaultMigrationDTO,
   TImportEnvKeyDataDTO,
-  TImportVaultDataDTO
+  TImportVaultDataDTO,
+  VaultImportStatus
 } from "./external-migration-types";
 
 type TExternalMigrationServiceFactoryDep = {
@@ -487,41 +488,49 @@ export const externalMigrationServiceFactory = ({
 
     const vaultSecrets = await getHCVaultSecretsForPath(vaultNamespace, vaultSecretPath, connection, gatewayService);
 
-    const secretOperation = await secretService.createManySecretsRaw({
-      actorId: actor.id,
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      secretPath,
-      environment,
-      projectId,
-      secrets: Object.entries(vaultSecrets).map(([secretKey, secretValue]) => ({
-        secretKey,
-        secretValue
-      }))
-    });
-
-    if (secretOperation.type === SecretProtectionType.Approval) {
-      await auditLogService.createAuditLog({
+    try {
+      const secretOperation = await secretService.createManySecretsRaw({
+        actorId: actor.id,
+        actor: actor.type,
+        actorAuthMethod: actor.authMethod,
+        actorOrgId: actor.orgId,
+        secretPath,
+        environment,
         projectId,
-        ...auditLogInfo,
-        event: {
-          type: EventType.SECRET_APPROVAL_REQUEST,
-          metadata: {
-            committedBy: secretOperation.approval.committerUserId,
-            secretApprovalRequestId: secretOperation.approval.id,
-            secretApprovalRequestSlug: secretOperation.approval.slug,
-            secretPath,
-            environment,
-            secrets: Object.entries(vaultSecrets).map(([secretKey]) => ({
-              secretKey
-            })),
-            eventType: SecretApprovalEvent.CreateMany
-          }
-        }
+        secrets: Object.entries(vaultSecrets).map(([secretKey, secretValue]) => ({
+          secretKey,
+          secretValue
+        }))
       });
 
-      return { approval: secretOperation.approval };
+      if (secretOperation.type === SecretProtectionType.Approval) {
+        await auditLogService.createAuditLog({
+          projectId,
+          ...auditLogInfo,
+          event: {
+            type: EventType.SECRET_APPROVAL_REQUEST,
+            metadata: {
+              committedBy: secretOperation.approval.committerUserId,
+              secretApprovalRequestId: secretOperation.approval.id,
+              secretApprovalRequestSlug: secretOperation.approval.slug,
+              secretPath,
+              environment,
+              secrets: Object.entries(vaultSecrets).map(([secretKey]) => ({
+                secretKey
+              })),
+              eventType: SecretApprovalEvent.CreateMany
+            }
+          }
+        });
+
+        return { status: VaultImportStatus.ApprovalRequired };
+      }
+
+      return { status: VaultImportStatus.Imported };
+    } catch (error) {
+      throw new BadRequestError({
+        message: `Failed to import Vault secrets. ${error instanceof Error ? error.message : "Unknown error"}`
+      });
     }
   };
 

backend/src/services/external-migration/external-migration-types.ts

@@ -122,6 +122,11 @@ export enum ExternalMigrationProviders {
   EnvKey = "env-key"
 }
 
+export enum VaultImportStatus {
+  Imported = "imported",
+  ApprovalRequired = "approval_required"
+}
+
 export type TConfigureExternalMigrationDTO = {
   platform: ExternalMigrationProviders;
   connectionId: string | null;