awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'ENG-3506' into ENG-3506-LDAP

Browse Source
This commit is contained in:
x032205
2025-08-29 15:27:07 -04:00
parent cbc1d951ac 0f76003f77
commit d83f0d4214
139 changed files with 7030 additions and 3272 deletions
Download Patch File Download Diff File Expand all files Collapse all files

290
backend/package-lock.json generated
View File

@@ -63,6 +63,7 @@
"argon2": "^0.31.2",
"aws-sdk": "^2.1553.0",
"axios": "^1.11.0",
"axios-ntlm": "^1.4.4",
"axios-retry": "^4.0.0",
"bcrypt": "^5.1.1",
"botbuilder": "^4.23.2",
@@ -12956,216 +12957,6 @@
"dev": true,
"license": "MIT"
},
"node_modules/@swc/core": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core/-/core-1.3.107.tgz",
"integrity": "sha512-zKhqDyFcTsyLIYK1iEmavljZnf4CCor5pF52UzLAz4B6Nu/4GLU+2LQVAf+oRHjusG39PTPjd2AlRT3f3QWfsQ==",
"dev": true,
"hasInstallScript": true,
"optional": true,
"peer": true,
"dependencies": {
"@swc/counter": "^0.1.1",
"@swc/types": "^0.1.5"
},
"engines": {
"node": ">=10"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/swc"
},
"optionalDependencies": {
"@swc/core-darwin-arm64": "1.3.107",
"@swc/core-darwin-x64": "1.3.107",
"@swc/core-linux-arm-gnueabihf": "1.3.107",
"@swc/core-linux-arm64-gnu": "1.3.107",
"@swc/core-linux-arm64-musl": "1.3.107",
"@swc/core-linux-x64-gnu": "1.3.107",
"@swc/core-linux-x64-musl": "1.3.107",
"@swc/core-win32-arm64-msvc": "1.3.107",
"@swc/core-win32-ia32-msvc": "1.3.107",
"@swc/core-win32-x64-msvc": "1.3.107"
},
"peerDependencies": {
"@swc/helpers": "^0.5.0"
},
"peerDependenciesMeta": {
"@swc/helpers": {
"optional": true
}
}
},
"node_modules/@swc/core-darwin-arm64": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.3.107.tgz",
"integrity": "sha512-47tD/5vSXWxPd0j/ZllyQUg4bqalbQTsmqSw0J4dDdS82MWqCAwUErUrAZPRjBkjNQ6Kmrf5rpCWaGTtPw+ngw==",
"cpu": [
"arm64"
],
"dev": true,
"optional": true,
"os": [
"darwin"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-darwin-x64": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-darwin-x64/-/core-darwin-x64-1.3.107.tgz",
"integrity": "sha512-hwiLJ2ulNkBGAh1m1eTfeY1417OAYbRGcb/iGsJ+LuVLvKAhU/itzsl535CvcwAlt2LayeCFfcI8gdeOLeZa9A==",
"cpu": [
"x64"
],
"dev": true,
"optional": true,
"os": [
"darwin"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-linux-arm-gnueabihf": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-linux-arm-gnueabihf/-/core-linux-arm-gnueabihf-1.3.107.tgz",
"integrity": "sha512-I2wzcC0KXqh0OwymCmYwNRgZ9nxX7DWnOOStJXV3pS0uB83TXAkmqd7wvMBuIl9qu4Hfomi9aDM7IlEEn9tumQ==",
"cpu": [
"arm"
],
"dev": true,
"optional": true,
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-linux-arm64-gnu": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-gnu/-/core-linux-arm64-gnu-1.3.107.tgz",
"integrity": "sha512-HWgnn7JORYlOYnGsdunpSF8A+BCZKPLzLtEUA27/M/ZuANcMZabKL9Zurt7XQXq888uJFAt98Gy+59PU90aHKg==",
"cpu": [
"arm64"
],
"dev": true,
"optional": true,
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-linux-arm64-musl": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-linux-arm64-musl/-/core-linux-arm64-musl-1.3.107.tgz",
"integrity": "sha512-vfPF74cWfAm8hyhS8yvYI94ucMHIo8xIYU+oFOW9uvDlGQRgnUf/6DEVbLyt/3yfX5723Ln57U8uiMALbX5Pyw==",
"cpu": [
"arm64"
],
"dev": true,
"optional": true,
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-linux-x64-gnu": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-linux-x64-gnu/-/core-linux-x64-gnu-1.3.107.tgz",
"integrity": "sha512-uBVNhIg0ip8rH9OnOsCARUFZ3Mq3tbPHxtmWk9uAa5u8jQwGWeBx5+nTHpDOVd3YxKb6+5xDEI/edeeLpha/9g==",
"cpu": [
"x64"
],
"dev": true,
"optional": true,
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-linux-x64-musl": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-linux-x64-musl/-/core-linux-x64-musl-1.3.107.tgz",
"integrity": "sha512-mvACkUvzSIB12q1H5JtabWATbk3AG+pQgXEN95AmEX2ZA5gbP9+B+mijsg7Sd/3tboHr7ZHLz/q3SHTvdFJrEw==",
"cpu": [
"x64"
],
"dev": true,
"optional": true,
"os": [
"linux"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-win32-arm64-msvc": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-win32-arm64-msvc/-/core-win32-arm64-msvc-1.3.107.tgz",
"integrity": "sha512-J3P14Ngy/1qtapzbguEH41kY109t6DFxfbK4Ntz9dOWNuVY3o9/RTB841ctnJk0ZHEG+BjfCJjsD2n8H5HcaOA==",
"cpu": [
"arm64"
],
"dev": true,
"optional": true,
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-win32-ia32-msvc": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-win32-ia32-msvc/-/core-win32-ia32-msvc-1.3.107.tgz",
"integrity": "sha512-ZBUtgyjTHlz8TPJh7kfwwwFma+ktr6OccB1oXC8fMSopD0AxVnQasgun3l3099wIsAB9eEsJDQ/3lDkOLs1gBA==",
"cpu": [
"ia32"
],
"dev": true,
"optional": true,
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/core-win32-x64-msvc": {
"version": "1.3.107",
"resolved": "https://registry.npmjs.org/@swc/core-win32-x64-msvc/-/core-win32-x64-msvc-1.3.107.tgz",
"integrity": "sha512-Eyzo2XRqWOxqhE1gk9h7LWmUf4Bp4Xn2Ttb0ayAXFp6YSTxQIThXcT9kipXZqcpxcmDwoq8iWbbf2P8XL743EA==",
"cpu": [
"x64"
],
"dev": true,
"optional": true,
"os": [
"win32"
],
"peer": true,
"engines": {
"node": ">=10"
}
},
"node_modules/@swc/counter": {
"version": "0.1.3",
"resolved": "https://registry.npmjs.org/@swc/counter/-/counter-0.1.3.tgz",
@@ -13183,14 +12974,6 @@
"tslib": "^2.8.0"
}
},
"node_modules/@swc/types": {
"version": "0.1.5",
"resolved": "https://registry.npmjs.org/@swc/types/-/types-0.1.5.tgz",
"integrity": "sha512-myfUej5naTBWnqOCc/MdVOLVjXUXtIA+NpDrDBKJtLLg2shUjBu3cZmB/85RyitKc55+lUUyl7oRfLOvkr2hsw==",
"dev": true,
"optional": true,
"peer": true
},
"node_modules/@techteamer/ocsp": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/@techteamer/ocsp/-/ocsp-1.0.1.tgz",
@@ -15195,6 +14978,18 @@
"proxy-from-env": "^1.1.0"
}
},
"node_modules/axios-ntlm": {
"version": "1.4.4",
"resolved": "https://registry.npmjs.org/axios-ntlm/-/axios-ntlm-1.4.4.tgz",
"integrity": "sha512-kpCRdzMfL8gi0Z0o96P3QPAK4XuC8iciGgxGXe+PeQ4oyjI2LZN8WSOKbu0Y9Jo3T/A7pB81n6jYVPIpglEuRA==",
"license": "MIT",
"dependencies": {
"axios": "^1.8.4",
"des.js": "^1.1.0",
"dev-null": "^0.1.1",
"js-md4": "^0.3.2"
}
},
"node_modules/axios-retry": {
"version": "4.0.0",
"resolved": "https://registry.npmjs.org/axios-retry/-/axios-retry-4.0.0.tgz",
@@ -16954,6 +16749,16 @@
"resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
"integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ=="
},
"node_modules/des.js": {
"version": "1.1.0",
"resolved": "https://registry.npmjs.org/des.js/-/des.js-1.1.0.tgz",
"integrity": "sha512-r17GxjhUCjSRy8aiJpr8/UadFIzMzJGexI3Nmz4ADi9LYSFx4gTBp80+NaX/YsXWWLhpZ7v/v/ubEc/bCNfKwg==",
"license": "MIT",
"dependencies": {
"inherits": "^2.0.1",
"minimalistic-assert": "^1.0.0"
}
},
"node_modules/destroy": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
@@ -16981,6 +16786,12 @@
"node": ">=8"
}
},
"node_modules/dev-null": {
"version": "0.1.1",
"resolved": "https://registry.npmjs.org/dev-null/-/dev-null-0.1.1.tgz",
"integrity": "sha512-nMNZG0zfMgmdv8S5O0TM5cpwNbGKRGPCxVsr0SmA3NZZy9CYBbuNLL0PD3Acx9e5LIUgwONXtM9kM6RlawPxEQ==",
"license": "MIT"
},
"node_modules/diff": {
"version": "4.0.2",
"resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
@@ -19029,49 +18840,6 @@
"resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
"integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w=="
},
"node_modules/gcp-metadata": {
"version": "5.3.0",
"resolved": "https://registry.npmjs.org/gcp-metadata/-/gcp-metadata-5.3.0.tgz",
"integrity": "sha512-FNTkdNEnBdlqF2oatizolQqNANMrcqJt6AAYt99B3y1aLLC8Hc5IOBb+ZnnzllodEEf6xMBp6wRcBbc16fa65w==",
"optional": true,
"peer": true,
"dependencies": {
"gaxios": "^5.0.0",
"json-bigint": "^1.0.0"
},
"engines": {
"node": ">=12"
}
},
"node_modules/gcp-metadata/node_modules/gaxios": {
"version": "5.1.3",
"resolved": "https://registry.npmjs.org/gaxios/-/gaxios-5.1.3.tgz",
"integrity": "sha512-95hVgBRgEIRQQQHIbnxBXeHbW4TqFk4ZDJW7wmVtvYar72FdhRIo1UGOLS2eRAKCPEdPBWu+M7+A33D9CdX9rA==",
"optional": true,
"peer": true,
"dependencies": {
"extend": "^3.0.2",
"https-proxy-agent": "^5.0.0",
"is-stream": "^2.0.0",
"node-fetch": "^2.6.9"
},
"engines": {
"node": ">=12"
}
},
"node_modules/gcp-metadata/node_modules/is-stream": {
"version": "2.0.1",
"resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
"integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
"optional": true,
"peer": true,
"engines": {
"node": ">=8"
},
"funding": {
"url": "https://github.com/sponsors/sindresorhus"
}
},
"node_modules/generate-function": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/generate-function/-/generate-function-2.3.1.tgz",

1
backend/package.json
View File

@@ -183,6 +183,7 @@
"argon2": "^0.31.2",
"aws-sdk": "^2.1553.0",
"axios": "^1.11.0",
"axios-ntlm": "^1.4.4",
"axios-retry": "^4.0.0",
"bcrypt": "^5.1.1",
"botbuilder": "^4.23.2",

19
backend/src/db/migrations/20250824173438_add-approval-secret-read-compat.ts Normal file
View File

@@ -0,0 +1,19 @@
import { Knex } from "knex";
import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
if (!(await knex.schema.hasColumn(TableName.SecretApprovalPolicy, "shouldCheckSecretPermission"))) {
await knex.schema.alterTable(TableName.SecretApprovalPolicy, (t) => {
t.boolean("shouldCheckSecretPermission").nullable();
});
}
}
export async function down(knex: Knex): Promise<void> {
if (await knex.schema.hasColumn(TableName.SecretApprovalPolicy, "shouldCheckSecretPermission")) {
await knex.schema.alterTable(TableName.SecretApprovalPolicy, (t) => {
t.dropColumn("shouldCheckSecretPermission");
});
}
}

29
backend/src/db/migrations/20250824192801_backfill-secret-read-compat-flag.ts Normal file
View File

@@ -0,0 +1,29 @@
import { Knex } from "knex";
import { selectAllTableCols } from "@app/lib/knex";
import { TableName } from "../schemas";
const BATCH_SIZE = 100;
export async function up(knex: Knex): Promise<void> {
if (await knex.schema.hasColumn(TableName.SecretApprovalPolicy, "shouldCheckSecretPermission")) {
// find all existing SecretApprovalPolicy rows to backfill shouldCheckSecretPermission flag
const rows = await knex(TableName.SecretApprovalPolicy).select(selectAllTableCols(TableName.SecretApprovalPolicy));
if (rows.length > 0) {
for (let i = 0; i < rows.length; i += BATCH_SIZE) {
const batch = rows.slice(i, i + BATCH_SIZE);
// eslint-disable-next-line no-await-in-loop
await knex(TableName.SecretApprovalPolicy)
.whereIn(
"id",
batch.map((row) => row.id)
)
.update({ shouldCheckSecretPermission: true });
}
}
}
}
export async function down(): Promise<void> {}

23
backend/src/db/migrations/20250826190000_add-properties-to-pki-subscriber.ts Normal file
View File

@@ -0,0 +1,23 @@
import { Knex } from "knex";
import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
const hasPropertiesCol = await knex.schema.hasColumn(TableName.PkiSubscriber, "properties");
if (!hasPropertiesCol) {
await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
t.jsonb("properties").nullable();
});
}
}
export async function down(knex: Knex): Promise<void> {
const hasPropertiesCol = await knex.schema.hasColumn(TableName.PkiSubscriber, "properties");
if (hasPropertiesCol) {
await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
t.dropColumn("properties");
});
}
}

3
backend/src/db/schemas/pki-subscribers.ts
View File

@@ -25,7 +25,8 @@ export const PkiSubscribersSchema = z.object({
lastAutoRenewAt: z.date().nullable().optional(),
lastOperationStatus: z.string().nullable().optional(),
lastOperationMessage: z.string().nullable().optional(),
lastOperationAt: z.date().nullable().optional()
lastOperationAt: z.date().nullable().optional(),
properties: z.unknown().nullable().optional()
});
export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

3
backend/src/db/schemas/secret-approval-policies.ts
View File

@@ -17,7 +17,8 @@ export const SecretApprovalPoliciesSchema = z.object({
updatedAt: z.date(),
enforcementLevel: z.string().default("hard"),
deletedAt: z.date().nullable().optional(),
allowedSelfApprovals: z.boolean().default(true)
allowedSelfApprovals: z.boolean().default(true),
shouldCheckSecretPermission: z.boolean().nullable().optional()
});
export type TSecretApprovalPolicies = z.infer<typeof SecretApprovalPoliciesSchema>;

3
backend/src/ee/routes/v1/secret-approval-request-router.ts
View File

@@ -305,7 +305,8 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
secretPath: z.string().optional().nullable(),
enforcementLevel: z.string(),
deletedAt: z.date().nullish(),
allowedSelfApprovals: z.boolean()
allowedSelfApprovals: z.boolean(),
shouldCheckSecretPermission: z.boolean().nullable().optional()
}),
environment: z.string(),
statusChangedByUser: approvalRequestUser.optional(),

10
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -283,6 +283,7 @@ export enum EventType {
UPDATE_SSH_CERTIFICATE_TEMPLATE = "update-ssh-certificate-template",
DELETE_SSH_CERTIFICATE_TEMPLATE = "delete-ssh-certificate-template",
GET_SSH_CERTIFICATE_TEMPLATE = "get-ssh-certificate-template",
GET_AZURE_AD_TEMPLATES = "get-azure-ad-templates",
GET_SSH_HOST = "get-ssh-host",
CREATE_SSH_HOST = "create-ssh-host",
UPDATE_SSH_HOST = "update-ssh-host",
@@ -2529,6 +2530,14 @@ interface CreateCertificateTemplateEstConfig {
};
}
interface GetAzureAdCsTemplatesEvent {
type: EventType.GET_AZURE_AD_TEMPLATES;
metadata: {
caId: string;
amount: number;
};
}
interface UpdateCertificateTemplateEstConfig {
type: EventType.UPDATE_CERTIFICATE_TEMPLATE_EST_CONFIG;
metadata: {
@@ -3670,6 +3679,7 @@ export type Event =
| CreateCertificateTemplateEstConfig
| UpdateCertificateTemplateEstConfig
| GetCertificateTemplateEstConfig
| GetAzureAdCsTemplatesEvent
| AttemptCreateSlackIntegration
| AttemptReinstallSlackIntegration
| UpdateSlackIntegration

23
backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts
View File

@@ -180,7 +180,11 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
tx.ref("enforcementLevel").withSchema(TableName.SecretApprovalPolicy).as("policyEnforcementLevel"),
tx.ref("allowedSelfApprovals").withSchema(TableName.SecretApprovalPolicy).as("policyAllowedSelfApprovals"),
tx.ref("approvals").withSchema(TableName.SecretApprovalPolicy).as("policyApprovals"),
tx.ref("deletedAt").withSchema(TableName.SecretApprovalPolicy).as("policyDeletedAt")
tx.ref("deletedAt").withSchema(TableName.SecretApprovalPolicy).as("policyDeletedAt"),
tx
.ref("shouldCheckSecretPermission")
.withSchema(TableName.SecretApprovalPolicy)
.as("policySecretReadAccessCompat")
);
const findById = async (id: string, tx?: Knex) => {
@@ -220,7 +224,8 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
enforcementLevel: el.policyEnforcementLevel,
envId: el.policyEnvId,
deletedAt: el.policyDeletedAt,
allowedSelfApprovals: el.policyAllowedSelfApprovals
allowedSelfApprovals: el.policyAllowedSelfApprovals,
shouldCheckSecretPermission: el.policySecretReadAccessCompat
}
}),
childrenMapper: [
@@ -692,14 +697,15 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
db.ref("firstName").withSchema("committerUser").as("committerUserFirstName"),
db.ref("lastName").withSchema("committerUser").as("committerUserLastName")
)
.distinctOn(`${TableName.SecretApprovalRequest}.id`)
.as("inner");
const query = (tx || db)
.select("*")
const countQuery = (await (tx || db)
.select(db.raw("count(*) OVER() as total_count"))
.from(innerQuery)
.orderBy("createdAt", "desc") as typeof innerQuery;
.from(innerQuery.clone().distinctOn(`${TableName.SecretApprovalRequest}.id`))) as Array<{
total_count: number;
}>;
const query = (tx || db).select("*").from(innerQuery).orderBy("createdAt", "desc") as typeof innerQuery;
if (search) {
void query.where((qb) => {
@@ -725,8 +731,7 @@ export const secretApprovalRequestDALFactory = (db: TDbClient) => {
.where("w.rank", ">=", rankOffset)
.andWhere("w.rank", "<", rankOffset + limit);
// @ts-expect-error knex does not infer
const totalCount = Number(docs[0]?.total_count || 0);
const totalCount = Number(countQuery[0]?.total_count || 0);
const formattedDoc = sqlNestRelationships({
data: docs,

60
backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
View File

@@ -281,13 +281,22 @@ export const secretApprovalRequestServiceFactory = ({
) {
throw new ForbiddenRequestError({ message: "User has insufficient privileges" });
}
const getHasSecretReadAccess = (environment: string, tags: { slug: string }[], secretPath?: string) => {
const canRead = hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
environment,
secretPath: secretPath || "/",
secretTags: tags.map((i) => i.slug)
});
return canRead;
const getHasSecretReadAccess = (
shouldCheckSecretPermission: boolean | null | undefined,
environment: string,
tags: { slug: string }[],
secretPath?: string
) => {
if (shouldCheckSecretPermission) {
const canRead = hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
environment,
secretPath: secretPath || "/",
secretTags: tags.map((i) => i.slug)
});
return canRead;
}
return true;
};
let secrets;
@@ -309,8 +318,18 @@ export const secretApprovalRequestServiceFactory = ({
version: el.version,
secretMetadata: el.secretMetadata as ResourceMetadataDTO,
isRotatedSecret: el.secret?.isRotatedSecret ?? false,
secretValueHidden: !getHasSecretReadAccess(secretApprovalRequest.environment, el.tags, secretPath?.[0]?.path),
secretValue: !getHasSecretReadAccess(secretApprovalRequest.environment, el.tags, secretPath?.[0]?.path)
secretValueHidden: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
),
secretValue: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
)
? INFISICAL_SECRET_VALUE_HIDDEN_MASK
: el.secret && el.secret.isRotatedSecret
? undefined
@@ -326,11 +345,17 @@ export const secretApprovalRequestServiceFactory = ({
id: el.secret.id,
version: el.secret.version,
secretValueHidden: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
),
secretValue: !getHasSecretReadAccess(secretApprovalRequest.environment, el.tags, secretPath?.[0]?.path)
secretValue: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
)
? INFISICAL_SECRET_VALUE_HIDDEN_MASK
: el.secret.encryptedValue
? secretManagerDecryptor({ cipherTextBlob: el.secret.encryptedValue }).toString()
@@ -346,11 +371,17 @@ export const secretApprovalRequestServiceFactory = ({
id: el.secretVersion.id,
version: el.secretVersion.version,
secretValueHidden: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
),
secretValue: !getHasSecretReadAccess(secretApprovalRequest.environment, el.tags, secretPath?.[0]?.path)
secretValue: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
)
? INFISICAL_SECRET_VALUE_HIDDEN_MASK
: el.secretVersion.encryptedValue
? secretManagerDecryptor({ cipherTextBlob: el.secretVersion.encryptedValue }).toString()
@@ -368,7 +399,12 @@ export const secretApprovalRequestServiceFactory = ({
const encryptedSecrets = await secretApprovalRequestSecretDAL.findByRequestId(secretApprovalRequest.id);
secrets = encryptedSecrets.map((el) => ({
...el,
secretValueHidden: !getHasSecretReadAccess(secretApprovalRequest.environment, el.tags, secretPath?.[0]?.path),
secretValueHidden: !getHasSecretReadAccess(
secretApprovalRequest.policy.shouldCheckSecretPermission,
secretApprovalRequest.environment,
el.tags,
secretPath?.[0]?.path
),
...decryptSecretWithBot(el, botKey),
secret: el.secret
? {

9
backend/src/lib/api-docs/constants.ts
View File

@@ -2338,6 +2338,15 @@ export const AppConnections = {
OKTA: {
instanceUrl: "The URL used to access your Okta organization.",
apiToken: "The API token used to authenticate with Okta."
},
AZURE_ADCS: {
adcsUrl:
"The HTTPS URL of the Azure ADCS instance to connect with (e.g., 'https://adcs.yourdomain.com/certsrv').",
username: "The username used to access Azure ADCS (format: 'DOMAIN\\username' or 'username@domain.com').",
password: "The password used to access Azure ADCS.",
sslRejectUnauthorized:
"Whether or not to reject unauthorized SSL certificates (true/false). Set to false only in test environments with self-signed certificates.",
sslCertificate: "The SSL certificate (PEM format) to use for secure connection."
}
}
};

10
backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
View File

@@ -15,6 +15,10 @@ import {
} from "@app/services/app-connection/1password";
import { Auth0ConnectionListItemSchema, SanitizedAuth0ConnectionSchema } from "@app/services/app-connection/auth0";
import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
import {
AzureADCSConnectionListItemSchema,
SanitizedAzureADCSConnectionSchema
} from "@app/services/app-connection/azure-adcs/azure-adcs-connection-schemas";
import {
AzureAppConfigurationConnectionListItemSchema,
SanitizedAzureAppConfigurationConnectionSchema
@@ -150,7 +154,8 @@ const SanitizedAppConnectionSchema = z.union([
...SanitizedSupabaseConnectionSchema.options,
...SanitizedDigitalOceanConnectionSchema.options,
...SanitizedNetlifyConnectionSchema.options,
...SanitizedOktaConnectionSchema.options
...SanitizedOktaConnectionSchema.options,
...SanitizedAzureADCSConnectionSchema.options
]);
const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -190,7 +195,8 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
SupabaseConnectionListItemSchema,
DigitalOceanConnectionListItemSchema,
NetlifyConnectionListItemSchema,
OktaConnectionListItemSchema
OktaConnectionListItemSchema,
AzureADCSConnectionListItemSchema
]);
export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

18
backend/src/server/routes/v1/app-connection-routers/azure-adcs-connection-router.ts Normal file
View File

@@ -0,0 +1,18 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureADCSConnectionSchema,
SanitizedAzureADCSConnectionSchema,
UpdateAzureADCSConnectionSchema
} from "@app/services/app-connection/azure-adcs";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureADCSConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.AzureADCS,
server,
sanitizedResponseSchema: SanitizedAzureADCSConnectionSchema,
createSchema: CreateAzureADCSConnectionSchema,
updateSchema: UpdateAzureADCSConnectionSchema
});
};

32
backend/src/server/routes/v1/app-connection-routers/checkly-connection-router.ts
View File

@@ -53,4 +53,36 @@ export const registerChecklyConnectionRouter = async (server: FastifyZodProvider
return { accounts };
}
});
server.route({
method: "GET",
url: `/:connectionId/accounts/:accountId/groups`,
config: {
rateLimit: readLimit
},
schema: {
params: z.object({
connectionId: z.string().uuid(),
accountId: z.string()
}),
response: {
200: z.object({
groups: z
.object({
name: z.string(),
id: z.string()
})
.array()
})
}
},
onRequest: verifyAuth([AuthMode.JWT]),
handler: async (req) => {
const { connectionId, accountId } = req.params;
const groups = await server.services.appConnection.checkly.listGroups(connectionId, accountId, req.permission);
return { groups };
}
});
};

2
backend/src/server/routes/v1/app-connection-routers/index.ts
View File

@@ -5,6 +5,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
import { registerOnePassConnectionRouter } from "./1password-connection-router";
import { registerAuth0ConnectionRouter } from "./auth0-connection-router";
import { registerAwsConnectionRouter } from "./aws-connection-router";
import { registerAzureADCSConnectionRouter } from "./azure-adcs-connection-router";
import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
import { registerAzureClientSecretsConnectionRouter } from "./azure-client-secrets-connection-router";
import { registerAzureDevOpsConnectionRouter } from "./azure-devops-connection-router";
@@ -50,6 +51,7 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
[AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter,
[AppConnection.AzureClientSecrets]: registerAzureClientSecretsConnectionRouter,
[AppConnection.AzureDevOps]: registerAzureDevOpsConnectionRouter,
[AppConnection.AzureADCS]: registerAzureADCSConnectionRouter,
[AppConnection.Databricks]: registerDatabricksConnectionRouter,
[AppConnection.Humanitec]: registerHumanitecConnectionRouter,
[AppConnection.TerraformCloud]: registerTerraformCloudConnectionRouter,

78
backend/src/server/routes/v1/certificate-authority-routers/azure-ad-cs-certificate-authority-router.ts Normal file
View File

@@ -0,0 +1,78 @@
import { z } from "zod";
import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import {
AzureAdCsCertificateAuthoritySchema,
CreateAzureAdCsCertificateAuthoritySchema,
UpdateAzureAdCsCertificateAuthoritySchema
} from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
export const registerAzureAdCsCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
registerCertificateAuthorityEndpoints({
caType: CaType.AZURE_AD_CS,
server,
responseSchema: AzureAdCsCertificateAuthoritySchema,
createSchema: CreateAzureAdCsCertificateAuthoritySchema,
updateSchema: UpdateAzureAdCsCertificateAuthoritySchema
});
server.route({
method: "GET",
url: "/:caId/templates",
config: {
rateLimit: readLimit
},
schema: {
hide: false,
description: "Get available certificate templates from Azure AD CS CA",
params: z.object({
caId: z.string().describe("Azure AD CS CA ID")
}),
querystring: z.object({
projectId: z.string().describe("Project ID")
}),
response: {
200: z.object({
templates: z.array(
z.object({
id: z.string().describe("Template identifier"),
name: z.string().describe("Template display name"),
description: z.string().optional().describe("Template description")
})
)
})
}
},
onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
handler: async (req) => {
const templates = await server.services.certificateAuthority.getAzureAdcsTemplates({
caId: req.params.caId,
projectId: req.query.projectId,
actor: req.permission.type,
actorId: req.permission.id,
actorAuthMethod: req.permission.authMethod,
actorOrgId: req.permission.orgId
});
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.query.projectId,
event: {
type: EventType.GET_AZURE_AD_TEMPLATES,
metadata: {
caId: req.params.caId,
amount: templates.length
}
}
});
return { templates };
}
});
};

4
backend/src/server/routes/v1/certificate-authority-routers/index.ts
View File

@@ -1,6 +1,7 @@
import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
import { registerAcmeCertificateAuthorityRouter } from "./acme-certificate-authority-router";
import { registerAzureAdCsCertificateAuthorityRouter } from "./azure-ad-cs-certificate-authority-router";
import { registerInternalCertificateAuthorityRouter } from "./internal-certificate-authority-router";
export * from "./internal-certificate-authority-router";
@@ -8,5 +9,6 @@ export * from "./internal-certificate-authority-router";
export const CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP: Record<CaType, (server: FastifyZodProvider) => Promise<void>> =
{
[CaType.INTERNAL]: registerInternalCertificateAuthorityRouter,
[CaType.ACME]: registerAcmeCertificateAuthorityRouter
[CaType.ACME]: registerAcmeCertificateAuthorityRouter,
[CaType.AZURE_AD_CS]: registerAzureAdCsCertificateAuthorityRouter
};

167
backend/src/server/routes/v1/pki-subscriber-router.ts
View File

@@ -1,3 +1,4 @@
import RE2 from "re2";
import { z } from "zod";
import { CertificatesSchema } from "@app/db/schemas";
@@ -112,7 +113,88 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
.transform((arr) => Array.from(new Set(arr)))
.describe(PKI_SUBSCRIBERS.CREATE.extendedKeyUsages),
enableAutoRenewal: z.boolean().optional().describe(PKI_SUBSCRIBERS.CREATE.enableAutoRenewal),
autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.CREATE.autoRenewalPeriodInDays)
autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.CREATE.autoRenewalPeriodInDays),
properties: z
.object({
azureTemplateType: z.string().optional().describe("Azure ADCS Certificate Template Type"),
organization: z
.string()
.trim()
.min(1)
.max(64, "Organization cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Organization contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organization cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Organization (O) - Maximum 64 characters, no special DN characters"),
organizationalUnit: z
.string()
.trim()
.min(1)
.max(64, "Organizational Unit cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Organizational Unit (OU) - Maximum 64 characters, no special DN characters"),
country: z
.string()
.trim()
.length(2, "Country must be exactly 2 characters")
.regex(new RE2("^[A-Z]{2}$"), "Country must be exactly 2 uppercase letters")
.optional()
.describe("Country (C) - Two uppercase letter country code (e.g., US, CA, GB)"),
state: z
.string()
.trim()
.min(1)
.max(64, "State cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"State cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("State/Province (ST) - Maximum 64 characters, no special DN characters"),
locality: z
.string()
.trim()
.min(1)
.max(64, "Locality cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Locality cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Locality (L) - Maximum 64 characters, no special DN characters"),
emailAddress: z
.string()
.trim()
.email("Email Address must be a valid email format")
.min(6, "Email Address must be at least 6 characters")
.max(64, "Email Address cannot exceed 64 characters")
.optional()
.describe("Email Address - Valid email format between 6 and 64 characters")
})
.optional()
.describe("Additional subscriber properties and subject fields")
}),
response: {
200: sanitizedPkiSubscriber
@@ -199,7 +281,88 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
.optional()
.describe(PKI_SUBSCRIBERS.UPDATE.extendedKeyUsages),
enableAutoRenewal: z.boolean().optional().describe(PKI_SUBSCRIBERS.UPDATE.enableAutoRenewal),
autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.UPDATE.autoRenewalPeriodInDays)
autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.UPDATE.autoRenewalPeriodInDays),
properties: z
.object({
azureTemplateType: z.string().optional().describe("Azure ADCS Certificate Template Type"),
organization: z
.string()
.trim()
.min(1)
.max(64, "Organization cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Organization contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organization cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Organization (O) - Maximum 64 characters, no special DN characters"),
organizationalUnit: z
.string()
.trim()
.min(1)
.max(64, "Organizational Unit cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Organizational Unit contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Organizational Unit cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Organizational Unit (OU) - Maximum 64 characters, no special DN characters"),
country: z
.string()
.trim()
.length(2, "Country must be exactly 2 characters")
.regex(new RE2("^[A-Z]{2}$"), "Country must be exactly 2 uppercase letters")
.optional()
.describe("Country (C) - Two uppercase letter country code (e.g., US, CA, GB)"),
state: z
.string()
.trim()
.min(1)
.max(64, "State cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'State contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"State cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("State/Province (ST) - Maximum 64 characters, no special DN characters"),
locality: z
.string()
.trim()
.min(1)
.max(64, "Locality cannot exceed 64 characters")
.regex(
new RE2('^[^,=+<>#;\\\\"/\\r\\n\\t]*$'),
'Locality contains invalid characters: , = + < > # ; \\ " / \\r \\n \\t'
)
.regex(
new RE2("^[^\\\\s\\\\-_.]+.*[^\\\\s\\\\-_.]+$|^[^\\\\s\\\\-_.]{1}$"),
"Locality cannot start or end with spaces, hyphens, underscores, or periods"
)
.optional()
.describe("Locality (L) - Maximum 64 characters, no special DN characters"),
emailAddress: z
.string()
.trim()
.email("Email Address must be a valid email format")
.min(6, "Email Address must be at least 6 characters")
.max(64, "Email Address cannot exceed 64 characters")
.optional()
.describe("Email Address - Valid email format between 6 and 64 characters")
})
.optional()
.describe("Additional subscriber properties and subject fields")
}),
response: {
200: sanitizedPkiSubscriber

20
backend/src/server/routes/v2/certificate-authority-router.ts
View File

@@ -6,12 +6,14 @@ import { readLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AuthMode } from "@app/services/auth/auth-type";
import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
import { AzureAdCsCertificateAuthoritySchema } from "@app/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas";
import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
import { InternalCertificateAuthoritySchema } from "@app/services/certificate-authority/internal/internal-certificate-authority-schemas";
const CertificateAuthoritySchema = z.discriminatedUnion("type", [
InternalCertificateAuthoritySchema,
AcmeCertificateAuthoritySchema
AcmeCertificateAuthoritySchema,
AzureAdCsCertificateAuthoritySchema
]);
export const registerCaRouter = async (server: FastifyZodProvider) => {
@@ -52,19 +54,31 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
req.permission
);
const azureAdCsCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
{
projectId: req.query.projectId,
type: CaType.AZURE_AD_CS
},
req.permission
);
await server.services.auditLog.createAuditLog({
...req.auditLogInfo,
projectId: req.query.projectId,
event: {
type: EventType.GET_CAS,
metadata: {
caIds: [...(internalCas ?? []).map((ca) => ca.id), ...(acmeCas ?? []).map((ca) => ca.id)]
caIds: [
...(internalCas ?? []).map((ca) => ca.id),
...(acmeCas ?? []).map((ca) => ca.id),
...(azureAdCsCas ?? []).map((ca) => ca.id)
]
}
}
});
return {
certificateAuthorities: [...(internalCas ?? []), ...(acmeCas ?? [])]
certificateAuthorities: [...(internalCas ?? []), ...(acmeCas ?? []), ...(azureAdCsCas ?? [])]
};
}
});

1
backend/src/services/app-connection/app-connection-enums.ts
View File

@@ -8,6 +8,7 @@ export enum AppConnection {
AzureAppConfiguration = "azure-app-configuration",
AzureClientSecrets = "azure-client-secrets",
AzureDevOps = "azure-devops",
AzureADCS = "azure-adcs",
Humanitec = "humanitec",
TerraformCloud = "terraform-cloud",
Vercel = "vercel",

9
backend/src/services/app-connection/app-connection-fns.ts
View File

@@ -31,6 +31,11 @@ import {
} from "./app-connection-types";
import { Auth0ConnectionMethod, getAuth0ConnectionListItem, validateAuth0ConnectionCredentials } from "./auth0";
import { AwsConnectionMethod, getAwsConnectionListItem, validateAwsConnectionCredentials } from "./aws";
import { AzureADCSConnectionMethod } from "./azure-adcs";
import {
getAzureADCSConnectionListItem,
validateAzureADCSConnectionCredentials
} from "./azure-adcs/azure-adcs-connection-fns";
import {
AzureAppConfigurationConnectionMethod,
getAzureAppConfigurationConnectionListItem,
@@ -136,6 +141,7 @@ export const listAppConnectionOptions = () => {
getAzureKeyVaultConnectionListItem(),
getAzureAppConfigurationConnectionListItem(),
getAzureDevopsConnectionListItem(),
getAzureADCSConnectionListItem(),
getDatabricksConnectionListItem(),
getHumanitecConnectionListItem(),
getTerraformCloudConnectionListItem(),
@@ -227,6 +233,7 @@ export const validateAppConnectionCredentials = async (
[AppConnection.AzureClientSecrets]:
validateAzureClientSecretsConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.AzureDevOps]: validateAzureDevOpsConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.AzureADCS]: validateAzureADCSConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Humanitec]: validateHumanitecConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.Postgres]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
[AppConnection.MsSql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
@@ -300,6 +307,7 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
case MsSqlConnectionMethod.UsernameAndPassword:
case MySqlConnectionMethod.UsernameAndPassword:
case OracleDBConnectionMethod.UsernameAndPassword:
case AzureADCSConnectionMethod.UsernamePassword:
return "Username & Password";
case WindmillConnectionMethod.AccessToken:
case HCVaultConnectionMethod.AccessToken:
@@ -357,6 +365,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
[AppConnection.AzureKeyVault]: platformManagedCredentialsNotSupported,
[AppConnection.AzureAppConfiguration]: platformManagedCredentialsNotSupported,
[AppConnection.AzureDevOps]: platformManagedCredentialsNotSupported,
[AppConnection.AzureADCS]: platformManagedCredentialsNotSupported,
[AppConnection.Humanitec]: platformManagedCredentialsNotSupported,
[AppConnection.Postgres]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,
[AppConnection.MsSql]: transferSqlConnectionCredentialsToPlatform as TAppConnectionTransitionCredentialsToPlatform,

2
backend/src/services/app-connection/app-connection-maps.ts
View File

@@ -9,6 +9,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
[AppConnection.AzureAppConfiguration]: "Azure App Configuration",
[AppConnection.AzureClientSecrets]: "Azure Client Secrets",
[AppConnection.AzureDevOps]: "Azure DevOps",
[AppConnection.AzureADCS]: "Azure ADCS",
[AppConnection.Databricks]: "Databricks",
[AppConnection.Humanitec]: "Humanitec",
[AppConnection.TerraformCloud]: "Terraform Cloud",
@@ -49,6 +50,7 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
[AppConnection.AzureAppConfiguration]: AppConnectionPlanType.Regular,
[AppConnection.AzureClientSecrets]: AppConnectionPlanType.Regular,
[AppConnection.AzureDevOps]: AppConnectionPlanType.Regular,
[AppConnection.AzureADCS]: AppConnectionPlanType.Regular,
[AppConnection.Databricks]: AppConnectionPlanType.Regular,
[AppConnection.Humanitec]: AppConnectionPlanType.Regular,
[AppConnection.TerraformCloud]: AppConnectionPlanType.Regular,

2
backend/src/services/app-connection/app-connection-service.ts
View File

@@ -45,6 +45,7 @@ import {
import { ValidateAuth0ConnectionCredentialsSchema } from "./auth0";
import { ValidateAwsConnectionCredentialsSchema } from "./aws";
import { awsConnectionService } from "./aws/aws-connection-service";
import { ValidateAzureADCSConnectionCredentialsSchema } from "./azure-adcs/azure-adcs-connection-schemas";
import { ValidateAzureAppConfigurationConnectionCredentialsSchema } from "./azure-app-configuration";
import { ValidateAzureClientSecretsConnectionCredentialsSchema } from "./azure-client-secrets";
import { azureClientSecretsConnectionService } from "./azure-client-secrets/azure-client-secrets-service";
@@ -122,6 +123,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
[AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
[AppConnection.AzureAppConfiguration]: ValidateAzureAppConfigurationConnectionCredentialsSchema,
[AppConnection.AzureDevOps]: ValidateAzureDevOpsConnectionCredentialsSchema,
[AppConnection.AzureADCS]: ValidateAzureADCSConnectionCredentialsSchema,
[AppConnection.Databricks]: ValidateDatabricksConnectionCredentialsSchema,
[AppConnection.Humanitec]: ValidateHumanitecConnectionCredentialsSchema,
[AppConnection.TerraformCloud]: ValidateTerraformCloudConnectionCredentialsSchema,

10
backend/src/services/app-connection/app-connection-types.ts
View File

@@ -33,6 +33,12 @@ import {
TAwsConnectionInput,
TValidateAwsConnectionCredentialsSchema
} from "./aws";
import {
TAzureADCSConnection,
TAzureADCSConnectionConfig,
TAzureADCSConnectionInput,
TValidateAzureADCSConnectionCredentialsSchema
} from "./azure-adcs/azure-adcs-connection-types";
import {
TAzureAppConfigurationConnection,
TAzureAppConfigurationConnectionConfig,
@@ -223,6 +229,7 @@ export type TAppConnection = { id: string } & (
| TAzureKeyVaultConnection
| TAzureAppConfigurationConnection
| TAzureDevOpsConnection
| TAzureADCSConnection
| TDatabricksConnection
| THumanitecConnection
| TTerraformCloudConnection
@@ -267,6 +274,7 @@ export type TAppConnectionInput = { id: string } & (
| TAzureKeyVaultConnectionInput
| TAzureAppConfigurationConnectionInput
| TAzureDevOpsConnectionInput
| TAzureADCSConnectionInput
| TDatabricksConnectionInput
| THumanitecConnectionInput
| TTerraformCloudConnectionInput
@@ -322,6 +330,7 @@ export type TAppConnectionConfig =
| TAzureKeyVaultConnectionConfig
| TAzureAppConfigurationConnectionConfig
| TAzureDevOpsConnectionConfig
| TAzureADCSConnectionConfig
| TAzureClientSecretsConnectionConfig
| TDatabricksConnectionConfig
| THumanitecConnectionConfig
@@ -359,6 +368,7 @@ export type TValidateAppConnectionCredentialsSchema =
| TValidateAzureAppConfigurationConnectionCredentialsSchema
| TValidateAzureClientSecretsConnectionCredentialsSchema
| TValidateAzureDevOpsConnectionCredentialsSchema
| TValidateAzureADCSConnectionCredentialsSchema
| TValidateDatabricksConnectionCredentialsSchema
| TValidateHumanitecConnectionCredentialsSchema
| TValidatePostgresConnectionCredentialsSchema

3
backend/src/services/app-connection/azure-adcs/azure-adcs-connection-enums.ts Normal file
View File

@@ -0,0 +1,3 @@
export enum AzureADCSConnectionMethod {
UsernamePassword = "username-password"
}

455
backend/src/services/app-connection/azure-adcs/azure-adcs-connection-fns.ts Normal file
View File

@@ -0,0 +1,455 @@
/* eslint-disable no-case-declarations, @typescript-eslint/no-unsafe-assignment, @typescript-eslint/no-unsafe-call, @typescript-eslint/no-unsafe-member-access, @typescript-eslint/no-var-requires, no-await-in-loop, no-continue */
import { NtlmClient } from "axios-ntlm";
import https from "https";
import { BadRequestError, NotFoundError } from "@app/lib/errors";
import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator/validate-url";
import { decryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TAppConnectionDALFactory } from "../app-connection-dal";
import { AppConnection } from "../app-connection-enums";
import { AzureADCSConnectionMethod } from "./azure-adcs-connection-enums";
import { TAzureADCSConnectionConfig } from "./azure-adcs-connection-types";
// Type definitions for axios-ntlm
interface AxiosNtlmConfig {
ntlm: {
domain: string;
username: string;
password: string;
};
httpsAgent?: https.Agent;
url: string;
method?: string;
data?: string;
headers?: Record<string, string>;
}
interface AxiosNtlmResponse {
status: number;
data: string;
headers: unknown;
}
// Types for credential parsing
interface ParsedCredentials {
domain: string;
username: string;
fullUsername: string; // domain\username format
}
// Helper function to parse and normalize credentials for Windows authentication
const parseCredentials = (inputUsername: string): ParsedCredentials => {
// Ensure inputUsername is a string
if (typeof inputUsername !== "string" || !inputUsername.trim()) {
throw new BadRequestError({
message: "Username must be a non-empty string"
});
}
let domain = "";
let username = "";
let fullUsername = "";
if (inputUsername.includes("\\")) {
// Already in domain\username format
const parts = inputUsername.split("\\");
if (parts.length === 2) {
[domain, username] = parts;
fullUsername = inputUsername;
} else {
throw new BadRequestError({
message: "Invalid domain\\username format. Expected format: DOMAIN\\username"
});
}
} else if (inputUsername.includes("@")) {
// UPN format: user@domain.com
const [user, domainPart] = inputUsername.split("@");
if (!user || !domainPart) {
throw new BadRequestError({
message: "Invalid UPN format. Expected format: user@domain.com"
});
}
username = user;
// Extract NetBIOS name from FQDN
domain = domainPart.split(".")[0].toUpperCase();
fullUsername = `${domain}\\${username}`;
} else {
// Plain username - assume local account or current domain
username = inputUsername;
domain = "";
fullUsername = inputUsername;
}
return { domain, username, fullUsername };
};
// Helper to normalize URL
const normalizeAdcsUrl = (url: string): string => {
let normalizedUrl = url.trim();
// Remove trailing slash
normalizedUrl = normalizedUrl.replace(/\/$/, "");
// Ensure HTTPS protocol
if (normalizedUrl.startsWith("http://")) {
normalizedUrl = normalizedUrl.replace("http://", "https://");
} else if (!normalizedUrl.startsWith("https://")) {
normalizedUrl = `https://${normalizedUrl}`;
}
return normalizedUrl;
};
// NTLM request wrapper
const createHttpsAgent = (sslRejectUnauthorized: boolean, sslCertificate?: string): https.Agent => {
const agentOptions: https.AgentOptions = {
rejectUnauthorized: sslRejectUnauthorized,
keepAlive: true, // axios-ntlm needs keepAlive for NTLM handshake
ca: sslCertificate ? [sslCertificate.trim()] : undefined,
// Disable hostname verification as Microsoft servers by default use local IPs for certificates
// which may not match the hostname used to connect
checkServerIdentity: () => undefined
};
return new https.Agent(agentOptions);
};
const axiosNtlmRequest = async (config: AxiosNtlmConfig): Promise<AxiosNtlmResponse> => {
const method = config.method || "GET";
const credentials = {
username: config.ntlm.username,
password: config.ntlm.password,
domain: config.ntlm.domain || "",
workstation: ""
};
const axiosConfig = {
httpsAgent: config.httpsAgent,
timeout: 30000
};
const client = NtlmClient(credentials, axiosConfig);
const requestOptions: { url: string; method: string; data?: string; headers?: Record<string, string> } = {
url: config.url,
method
};
if (config.data) {
requestOptions.data = config.data;
}
if (config.headers) {
requestOptions.headers = config.headers;
}
const response = await client(requestOptions);
return {
status: response.status,
data: response.data,
headers: response.headers
};
};
// Test ADCS connectivity and authentication using NTLM
const testAdcsConnection = async (
credentials: ParsedCredentials,
password: string,
baseUrl: string,
sslRejectUnauthorized: boolean = true,
sslCertificate?: string
): Promise<boolean> => {
// Test endpoints in order of preference
const testEndpoints = [
"/certsrv/certrqus.asp", // Certificate request status (most reliable)
"/certsrv/certfnsh.asp", // Certificate finalization
"/certsrv/default.asp", // Main ADCS page
"/certsrv/" // Root certsrv
];
for (const endpoint of testEndpoints) {
try {
const testUrl = `${baseUrl}${endpoint}`;
const shouldRejectUnauthorized = sslRejectUnauthorized;
const httpsAgent = createHttpsAgent(shouldRejectUnauthorized, sslCertificate);
const response = await axiosNtlmRequest({
url: testUrl,
method: "GET",
httpsAgent,
ntlm: {
domain: credentials.domain,
username: credentials.username,
password
}
});
// Check if we got a successful response
if (response.status === 200) {
const responseText = response.data;
// Verify this is actually an ADCS server by checking content
const adcsIndicators = [
"Microsoft Active Directory Certificate Services",
"Certificate Services",
"Request a certificate",
"certsrv",
"Certificate Template",
"Web Enrollment"
];
const isAdcsServer = adcsIndicators.some((indicator) =>
responseText.toLowerCase().includes(indicator.toLowerCase())
);
if (isAdcsServer) {
// Successfully authenticated and confirmed ADCS
return true;
}
}
if (response.status === 401) {
throw new BadRequestError({
message: "Authentication failed. Please verify your credentials are correct."
});
}
if (response.status === 403) {
throw new BadRequestError({
message: "Access denied. Your account may not have permission to access ADCS web enrollment."
});
}
} catch (error) {
if (error instanceof BadRequestError) {
throw error;
}
// Handle network and connection errors
if (error instanceof Error) {
if (error.message.includes("ENOTFOUND")) {
throw new BadRequestError({
message: "Cannot resolve ADCS server hostname. Please verify the URL is correct."
});
}
if (error.message.includes("ECONNREFUSED")) {
throw new BadRequestError({
message: "Connection refused by ADCS server. Please verify the server is running and accessible."
});
}
if (error.message.includes("ETIMEDOUT") || error.message.includes("timeout")) {
throw new BadRequestError({
message: "Connection timeout. Please verify the server is accessible and not blocked by firewall."
});
}
if (error.message.includes("certificate") || error.message.includes("SSL") || error.message.includes("TLS")) {
throw new BadRequestError({
message: `SSL/TLS certificate error: ${error.message}. This may indicate a certificate verification failure.`
});
}
if (error.message.includes("DEPTH_ZERO_SELF_SIGNED_CERT")) {
throw new BadRequestError({
message:
"Self-signed certificate detected. Either provide the server's certificate or set 'sslRejectUnauthorized' to false."
});
}
if (error.message.includes("UNABLE_TO_VERIFY_LEAF_SIGNATURE")) {
throw new BadRequestError({
message: "Unable to verify certificate signature. Please provide the correct CA certificate."
});
}
}
// Continue to next endpoint for other errors
continue;
}
}
// If we get here, no endpoint worked
throw new BadRequestError({
message: "Could not connect to ADCS server. Please verify the server URL and that Web Enrollment is enabled."
});
};
// Create authenticated NTLM client for ADCS operations
const createNtlmClient = (
username: string,
password: string,
baseUrl: string,
sslRejectUnauthorized: boolean = true,
sslCertificate?: string
) => {
const parsedCredentials = parseCredentials(username);
const normalizedUrl = normalizeAdcsUrl(baseUrl);
return {
get: async (endpoint: string, additionalHeaders: Record<string, string> = {}) => {
const shouldRejectUnauthorized = sslRejectUnauthorized;
const httpsAgent = createHttpsAgent(shouldRejectUnauthorized, sslCertificate);
return axiosNtlmRequest({
url: `${normalizedUrl}${endpoint}`,
method: "GET",
httpsAgent,
headers: additionalHeaders,
ntlm: {
domain: parsedCredentials.domain,
username: parsedCredentials.username,
password
}
});
},
post: async (endpoint: string, body: string, additionalHeaders: Record<string, string> = {}) => {
const shouldRejectUnauthorized = sslRejectUnauthorized;
const httpsAgent = createHttpsAgent(shouldRejectUnauthorized, sslCertificate);
return axiosNtlmRequest({
url: `${normalizedUrl}${endpoint}`,
method: "POST",
httpsAgent,
data: body,
headers: {
"Content-Type": "application/x-www-form-urlencoded",
...additionalHeaders
},
ntlm: {
domain: parsedCredentials.domain,
username: parsedCredentials.username,
password
}
});
},
baseUrl: normalizedUrl,
credentials: parsedCredentials
};
};
export const getAzureADCSConnectionCredentials = async (
connectionId: string,
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">,
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
) => {
const appConnection = await appConnectionDAL.findById(connectionId);
if (!appConnection) {
throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
}
if (appConnection.app !== AppConnection.AzureADCS) {
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure ADCS connection` });
}
switch (appConnection.method) {
case AzureADCSConnectionMethod.UsernamePassword:
const credentials = (await decryptAppConnectionCredentials({
orgId: appConnection.orgId,
kmsService,
encryptedCredentials: appConnection.encryptedCredentials
})) as {
username: string;
password: string;
adcsUrl: string;
sslRejectUnauthorized?: boolean;
sslCertificate?: string;
};
return {
username: credentials.username,
password: credentials.password,
adcsUrl: credentials.adcsUrl,
sslRejectUnauthorized: credentials.sslRejectUnauthorized ?? true,
sslCertificate: credentials.sslCertificate
};
default:
throw new BadRequestError({
message: `Unsupported Azure ADCS connection method: ${appConnection.method}`
});
}
};
export const validateAzureADCSConnectionCredentials = async (appConnection: TAzureADCSConnectionConfig) => {
const { credentials } = appConnection;
try {
// Parse and validate credentials
const parsedCredentials = parseCredentials(credentials.username);
const normalizedUrl = normalizeAdcsUrl(credentials.adcsUrl);
// Validate URL to prevent DNS manipulation attacks and SSRF
await blockLocalAndPrivateIpAddresses(normalizedUrl);
// Test the connection using NTLM
await testAdcsConnection(
parsedCredentials,
credentials.password,
normalizedUrl,
credentials.sslRejectUnauthorized ?? true,
credentials.sslCertificate
);
// If we get here, authentication was successful
return {
username: credentials.username,
password: credentials.password,
adcsUrl: credentials.adcsUrl,
sslRejectUnauthorized: credentials.sslRejectUnauthorized ?? true,
sslCertificate: credentials.sslCertificate
};
} catch (error) {
if (error instanceof BadRequestError) {
throw error;
}
// Handle unexpected errors
let errorMessage = "Unable to validate ADCS connection.";
if (error instanceof Error) {
if (error.message.includes("401") || error.message.includes("Unauthorized")) {
errorMessage = "NTLM authentication failed. Please verify your username, password, and domain are correct.";
} else if (error.message.includes("ENOTFOUND") || error.message.includes("ECONNREFUSED")) {
errorMessage = "Cannot connect to the ADCS server. Please verify the server URL is correct and accessible.";
} else if (error.message.includes("timeout")) {
errorMessage = "Connection to ADCS server timed out. Please verify the server is accessible.";
} else if (
error.message.includes("certificate") ||
error.message.includes("SSL") ||
error.message.includes("TLS") ||
error.message.includes("DEPTH_ZERO_SELF_SIGNED_CERT") ||
error.message.includes("UNABLE_TO_VERIFY_LEAF_SIGNATURE")
) {
errorMessage = `SSL/TLS certificate error: ${error.message}. The server certificate may be self-signed or the CA certificate may be incorrect.`;
}
}
throw new BadRequestError({
message: `Failed to validate Azure ADCS connection: ${errorMessage} Details: ${
error instanceof Error ? error.message : "Unknown error"
}`
});
}
};
export const getAzureADCSConnectionListItem = () => ({
name: "Azure ADCS" as const,
app: AppConnection.AzureADCS as const,
methods: [AzureADCSConnectionMethod.UsernamePassword] as [AzureADCSConnectionMethod.UsernamePassword]
});
// Export helper functions for use in certificate ordering
export const createAdcsHttpClient = (
username: string,
password: string,
baseUrl: string,
sslRejectUnauthorized: boolean = true,
sslCertificate?: string
) => {
return createNtlmClient(username, password, baseUrl, sslRejectUnauthorized, sslCertificate);
};

88
backend/src/services/app-connection/azure-adcs/azure-adcs-connection-schemas.ts Normal file
View File

@@ -0,0 +1,88 @@
import z from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureADCSConnectionMethod } from "./azure-adcs-connection-enums";
export const AzureADCSUsernamePasswordCredentialsSchema = z.object({
adcsUrl: z
.string()
.trim()
.min(1, "ADCS URL required")
.max(255)
.refine((value) => value.startsWith("https://"), "ADCS URL must use HTTPS")
.describe(AppConnections.CREDENTIALS.AZURE_ADCS.adcsUrl),
username: z
.string()
.trim()
.min(1, "Username required")
.max(255)
.describe(AppConnections.CREDENTIALS.AZURE_ADCS.username),
password: z
.string()
.trim()
.min(1, "Password required")
.max(255)
.describe(AppConnections.CREDENTIALS.AZURE_ADCS.password),
sslRejectUnauthorized: z.boolean().optional().describe(AppConnections.CREDENTIALS.AZURE_ADCS.sslRejectUnauthorized),
sslCertificate: z
.string()
.trim()
.transform((value) => value || undefined)
.optional()
.describe(AppConnections.CREDENTIALS.AZURE_ADCS.sslCertificate)
});
const BaseAzureADCSConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.AzureADCS) });
export const AzureADCSConnectionSchema = BaseAzureADCSConnectionSchema.extend({
method: z.literal(AzureADCSConnectionMethod.UsernamePassword),
credentials: AzureADCSUsernamePasswordCredentialsSchema
});
export const SanitizedAzureADCSConnectionSchema = z.discriminatedUnion("method", [
BaseAzureADCSConnectionSchema.extend({
method: z.literal(AzureADCSConnectionMethod.UsernamePassword),
credentials: AzureADCSUsernamePasswordCredentialsSchema.pick({
username: true,
adcsUrl: true,
sslRejectUnauthorized: true,
sslCertificate: true
})
})
]);
export const ValidateAzureADCSConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(AzureADCSConnectionMethod.UsernamePassword)
.describe(AppConnections.CREATE(AppConnection.AzureADCS).method),
credentials: AzureADCSUsernamePasswordCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.AzureADCS).credentials
)
})
]);
export const CreateAzureADCSConnectionSchema = ValidateAzureADCSConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.AzureADCS)
);
export const UpdateAzureADCSConnectionSchema = z
.object({
credentials: AzureADCSUsernamePasswordCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.AzureADCS).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureADCS));
export const AzureADCSConnectionListItemSchema = z.object({
name: z.literal("Azure ADCS"),
app: z.literal(AppConnection.AzureADCS),
methods: z.nativeEnum(AzureADCSConnectionMethod).array()
});

23
backend/src/services/app-connection/azure-adcs/azure-adcs-connection-types.ts Normal file
View File

@@ -0,0 +1,23 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureADCSConnectionSchema,
CreateAzureADCSConnectionSchema,
ValidateAzureADCSConnectionCredentialsSchema
} from "./azure-adcs-connection-schemas";
export type TAzureADCSConnection = z.infer<typeof AzureADCSConnectionSchema>;
export type TAzureADCSConnectionInput = z.infer<typeof CreateAzureADCSConnectionSchema> & {
app: AppConnection.AzureADCS;
};
export type TValidateAzureADCSConnectionCredentialsSchema = typeof ValidateAzureADCSConnectionCredentialsSchema;
export type TAzureADCSConnectionConfig = DiscriminativePick<
TAzureADCSConnectionInput,
"method" | "app" | "credentials"
>;

4
backend/src/services/app-connection/azure-adcs/index.ts Normal file
View File

@@ -0,0 +1,4 @@
export * from "./azure-adcs-connection-enums";
export * from "./azure-adcs-connection-fns";
export * from "./azure-adcs-connection-schemas";
export * from "./azure-adcs-connection-types";

117
backend/src/services/app-connection/checkly/checkly-connection-public-client.ts
View File

@@ -4,6 +4,7 @@ import { AxiosInstance, AxiosRequestConfig, AxiosResponse, HttpStatusCode, isAxi
import { createRequestClient } from "@app/lib/config/request";
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
import { SecretSyncError } from "@app/services/secret-sync/secret-sync-errors";
import { ChecklyConnectionMethod } from "./checkly-connection-constants";
import { TChecklyAccount, TChecklyConnectionConfig, TChecklyVariable } from "./checkly-connection-types";
@@ -181,6 +182,122 @@ class ChecklyPublicClient {
return res;
}
async getCheckGroups(connection: TChecklyConnectionConfig, accountId: string, limit = 50, page = 1) {
const res = await this.send<{ id: number; name: string }[]>(connection, {
accountId,
method: "GET",
url: `/v1/check-groups`,
params: { limit, page }
});
return res?.map((group) => ({
id: group.id.toString(),
name: group.name
}));
}
async getCheckGroup(connection: TChecklyConnectionConfig, accountId: string, groupId: string) {
try {
type ChecklyGroupResponse = {
id: number;
name: string;
environmentVariables: Array<{
key: string;
value: string;
locked: boolean;
}>;
};
const res = await this.send<ChecklyGroupResponse>(connection, {
accountId,
method: "GET",
url: `/v1/check-groups/${groupId}`
});
if (!res) return null;
return {
id: res.id.toString(),
name: res.name,
environmentVariables: res.environmentVariables
};
} catch (error) {
if (isAxiosError(error) && error.response?.status === HttpStatusCode.NotFound) {
return null;
}
throw error;
}
}
async updateCheckGroupEnvironmentVariables(
connection: TChecklyConnectionConfig,
accountId: string,
groupId: string,
environmentVariables: Array<{ key: string; value: string; locked?: boolean }>
) {
if (environmentVariables.length > 50) {
throw new SecretSyncError({
message: "Checkly does not support syncing more than 50 variables to Check Group",
shouldRetry: false
});
}
const apiVariables = environmentVariables.map((v) => ({
key: v.key,
value: v.value,
locked: v.locked ?? false,
secret: true
}));
const group = await this.getCheckGroup(connection, accountId, groupId);
await this.send(connection, {
accountId,
method: "PUT",
url: `/v2/check-groups/${groupId}`,
data: { name: group?.name, environmentVariables: apiVariables }
});
return this.getCheckGroup(connection, accountId, groupId);
}
async getCheckGroupEnvironmentVariables(connection: TChecklyConnectionConfig, accountId: string, groupId: string) {
const group = await this.getCheckGroup(connection, accountId, groupId);
return group?.environmentVariables || [];
}
async upsertCheckGroupEnvironmentVariables(
connection: TChecklyConnectionConfig,
accountId: string,
groupId: string,
variables: Array<{ key: string; value: string; locked?: boolean }>
) {
const existingVars = await this.getCheckGroupEnvironmentVariables(connection, accountId, groupId);
const varMap = new Map(existingVars.map((v) => [v.key, v]));
for (const newVar of variables) {
varMap.set(newVar.key, {
key: newVar.key,
value: newVar.value,
locked: newVar.locked ?? false
});
}
return this.updateCheckGroupEnvironmentVariables(connection, accountId, groupId, Array.from(varMap.values()));
}
async deleteCheckGroupEnvironmentVariable(
connection: TChecklyConnectionConfig,
accountId: string,
groupId: string,
variableKey: string
) {
const existingVars = await this.getCheckGroupEnvironmentVariables(connection, accountId, groupId);
const filteredVars = existingVars.filter((v) => v.key !== variableKey);
return this.updateCheckGroupEnvironmentVariables(connection, accountId, groupId, filteredVars);
}
}
export const ChecklyPublicAPI = new ChecklyPublicClient();

14
backend/src/services/app-connection/checkly/checkly-connection-service.ts
View File

@@ -24,7 +24,19 @@ export const checklyConnectionService = (getAppConnection: TGetAppConnectionFunc
}
};
const listGroups = async (connectionId: string, accountId: string, actor: OrgServiceActor) => {
const appConnection = await getAppConnection(AppConnection.Checkly, connectionId, actor);
try {
const groups = await ChecklyPublicAPI.getCheckGroups(appConnection, accountId);
return groups!;
} catch (error) {
logger.error(error, "Failed to list accounts on Checkly");
return [];
}
};
return {
listAccounts
listAccounts,
listGroups
};
};

12
backend/src/services/app-connection/checkly/checkly-connection-types.ts
View File

@@ -33,3 +33,15 @@ export type TChecklyAccount = {
name: string;
runtimeId: string;
};
export type TChecklyGroupEnvironmentVariable = {
key: string;
value: string;
locked: boolean;
};
export type TChecklyGroup = {
id: string;
name: string;
environmentVariables?: TChecklyGroupEnvironmentVariable[];
};

1172
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-fns.ts Normal file
View File

File diff suppressed because it is too large Load Diff

29
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-schemas.ts Normal file
View File

@@ -0,0 +1,29 @@
import { z } from "zod";
import { CaType } from "../certificate-authority-enums";
import {
BaseCertificateAuthoritySchema,
GenericCreateCertificateAuthorityFieldsSchema,
GenericUpdateCertificateAuthorityFieldsSchema
} from "../certificate-authority-schemas";
export const AzureAdCsCertificateAuthorityConfigurationSchema = z.object({
azureAdcsConnectionId: z.string().uuid().trim().describe("Azure ADCS Connection ID")
});
export const AzureAdCsCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
type: z.literal(CaType.AZURE_AD_CS),
configuration: AzureAdCsCertificateAuthorityConfigurationSchema
});
export const CreateAzureAdCsCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
CaType.AZURE_AD_CS
).extend({
configuration: AzureAdCsCertificateAuthorityConfigurationSchema
});
export const UpdateAzureAdCsCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
CaType.AZURE_AD_CS
).extend({
configuration: AzureAdCsCertificateAuthorityConfigurationSchema.optional()
});

13
backend/src/services/certificate-authority/azure-ad-cs/azure-ad-cs-certificate-authority-types.ts Normal file
View File

@@ -0,0 +1,13 @@
import { z } from "zod";
import {
AzureAdCsCertificateAuthoritySchema,
CreateAzureAdCsCertificateAuthoritySchema,
UpdateAzureAdCsCertificateAuthoritySchema
} from "./azure-ad-cs-certificate-authority-schemas";
export type TAzureAdCsCertificateAuthority = z.infer<typeof AzureAdCsCertificateAuthoritySchema>;
export type TCreateAzureAdCsCertificateAuthorityDTO = z.infer<typeof CreateAzureAdCsCertificateAuthoritySchema>;
export type TUpdateAzureAdCsCertificateAuthorityDTO = z.infer<typeof UpdateAzureAdCsCertificateAuthoritySchema>;

9
backend/src/services/certificate-authority/certificate-authority-enums.ts
View File

@@ -1,6 +1,7 @@
export enum CaType {
INTERNAL = "internal",
ACME = "acme"
ACME = "acme",
AZURE_AD_CS = "azure-ad-cs"
}
export enum InternalCaType {
@@ -17,3 +18,9 @@ export enum CaStatus {
export enum CaRenewalType {
EXISTING = "existing"
}
export enum CaCapability {
ISSUE_CERTIFICATES = "issue-certificates",
REVOKE_CERTIFICATES = "revoke-certificates",
RENEW_CERTIFICATES = "renew-certificates"
}

27
backend/src/services/certificate-authority/certificate-authority-maps.ts
View File

@@ -1,6 +1,29 @@
import { CaType } from "./certificate-authority-enums";
import { CaCapability, CaType } from "./certificate-authority-enums";
export const CERTIFICATE_AUTHORITIES_TYPE_MAP: Record<CaType, string> = {
[CaType.INTERNAL]: "Internal",
[CaType.ACME]: "ACME"
[CaType.ACME]: "ACME",
[CaType.AZURE_AD_CS]: "Azure AD Certificate Service"
};
export const CERTIFICATE_AUTHORITIES_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
[CaType.INTERNAL]: [
CaCapability.ISSUE_CERTIFICATES,
CaCapability.REVOKE_CERTIFICATES,
CaCapability.RENEW_CERTIFICATES
],
[CaType.ACME]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.REVOKE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES],
[CaType.AZURE_AD_CS]: [
CaCapability.ISSUE_CERTIFICATES,
CaCapability.RENEW_CERTIFICATES
// Note: REVOKE_CERTIFICATES intentionally omitted - not supported by ADCS connector
]
};
/**
* Check if a certificate authority type supports a specific capability
*/
export const caSupportsCapability = (caType: CaType, capability: CaCapability): boolean => {
const capabilities = CERTIFICATE_AUTHORITIES_CAPABILITIES_MAP[caType] || [];
return capabilities.includes(capability);
};

23
backend/src/services/certificate-authority/certificate-authority-queue.ts
View File

@@ -21,6 +21,7 @@ import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-
import { TPkiSubscriberDALFactory } from "../pki-subscriber/pki-subscriber-dal";
import { SubscriberOperationStatus } from "../pki-subscriber/pki-subscriber-types";
import { AcmeCertificateAuthorityFns } from "./acme/acme-certificate-authority-fns";
import { AzureAdCsCertificateAuthorityFns } from "./azure-ad-cs/azure-ad-cs-certificate-authority-fns";
import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
import { CaType } from "./certificate-authority-enums";
import { keyAlgorithmToAlgCfg } from "./certificate-authority-fns";
@@ -33,7 +34,7 @@ import {
type TCertificateAuthorityQueueFactoryDep = {
certificateAuthorityDAL: TCertificateAuthorityDALFactory;
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem">;
@@ -82,6 +83,19 @@ export const certificateAuthorityQueueFactory = ({
projectDAL
});
const azureAdCsFns = AzureAdCsCertificateAuthorityFns({
appConnectionDAL,
appConnectionService,
certificateAuthorityDAL,
externalCertificateAuthorityDAL,
certificateDAL,
certificateBodyDAL,
certificateSecretDAL,
kmsService,
pkiSubscriberDAL,
projectDAL
});
// TODO 1: auto-periodic rotation
// TODO 2: manual rotation
@@ -158,6 +172,13 @@ export const certificateAuthorityQueueFactory = ({
lastOperationMessage: "Certificate ordered successfully",
lastOperationAt: new Date()
});
} else if (caType === CaType.AZURE_AD_CS) {
await azureAdCsFns.orderSubscriberCertificate(subscriberId);
await pkiSubscriberDAL.updateById(subscriberId, {
lastOperationStatus: SubscriberOperationStatus.SUCCESS,
lastOperationMessage: "Certificate ordered successfully",
lastOperationAt: new Date()
});
}
} catch (e: unknown) {
if (e instanceof Error) {

95
backend/src/services/certificate-authority/certificate-authority-service.ts
View File

@@ -22,6 +22,14 @@ import {
TCreateAcmeCertificateAuthorityDTO,
TUpdateAcmeCertificateAuthorityDTO
} from "./acme/acme-certificate-authority-types";
import {
AzureAdCsCertificateAuthorityFns,
castDbEntryToAzureAdCsCertificateAuthority
} from "./azure-ad-cs/azure-ad-cs-certificate-authority-fns";
import {
TCreateAzureAdCsCertificateAuthorityDTO,
TUpdateAzureAdCsCertificateAuthorityDTO
} from "./azure-ad-cs/azure-ad-cs-certificate-authority-types";
import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
import { CaType } from "./certificate-authority-enums";
import {
@@ -34,7 +42,7 @@ import { TInternalCertificateAuthorityServiceFactory } from "./internal/internal
import { TCreateInternalCertificateAuthorityDTO } from "./internal/internal-certificate-authority-types";
type TCertificateAuthorityServiceFactoryDep = {
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
certificateAuthorityDAL: Pick<
TCertificateAuthorityDALFactory,
@@ -91,6 +99,19 @@ export const certificateAuthorityServiceFactory = ({
projectDAL
});
const azureAdCsFns = AzureAdCsCertificateAuthorityFns({
appConnectionDAL,
appConnectionService,
certificateAuthorityDAL,
externalCertificateAuthorityDAL,
certificateDAL,
certificateBodyDAL,
certificateSecretDAL,
kmsService,
pkiSubscriberDAL,
projectDAL
});
const createCertificateAuthority = async (
{ type, projectId, name, enableDirectIssuance, configuration, status }: TCreateCertificateAuthorityDTO,
actor: OrgServiceActor
@@ -146,6 +167,17 @@ export const certificateAuthorityServiceFactory = ({
});
}
if (type === CaType.AZURE_AD_CS) {
return azureAdCsFns.createCertificateAuthority({
name,
projectId,
configuration: configuration as TCreateAzureAdCsCertificateAuthorityDTO["configuration"],
enableDirectIssuance,
status,
actor
});
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
@@ -205,6 +237,10 @@ export const certificateAuthorityServiceFactory = ({
return castDbEntryToAcmeCertificateAuthority(certificateAuthority);
}
if (type === CaType.AZURE_AD_CS) {
return castDbEntryToAzureAdCsCertificateAuthority(certificateAuthority);
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
@@ -249,6 +285,10 @@ export const certificateAuthorityServiceFactory = ({
return acmeFns.listCertificateAuthorities({ projectId });
}
if (type === CaType.AZURE_AD_CS) {
return azureAdCsFns.listCertificateAuthorities({ projectId });
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
@@ -323,6 +363,17 @@ export const certificateAuthorityServiceFactory = ({
});
}
if (type === CaType.AZURE_AD_CS) {
return azureAdCsFns.updateCertificateAuthority({
id: certificateAuthority.id,
configuration: configuration as TUpdateAzureAdCsCertificateAuthorityDTO["configuration"],
enableDirectIssuance,
actor,
status,
name
});
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
@@ -384,14 +435,54 @@ export const certificateAuthorityServiceFactory = ({
return castDbEntryToAcmeCertificateAuthority(certificateAuthority);
}
if (type === CaType.AZURE_AD_CS) {
return castDbEntryToAzureAdCsCertificateAuthority(certificateAuthority);
}
throw new BadRequestError({ message: "Invalid certificate authority type" });
};
const getAzureAdcsTemplates = async ({
caId,
projectId,
actor,
actorId,
actorAuthMethod,
actorOrgId
}: {
caId: string;
projectId: string;
actor: OrgServiceActor["type"];
actorId: string;
actorAuthMethod: OrgServiceActor["authMethod"];
actorOrgId?: string;
}) => {
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionActions.Read,
ProjectPermissionSub.CertificateAuthorities
);
return azureAdCsFns.getTemplates({
caId,
projectId
});
};
return {
createCertificateAuthority,
findCertificateAuthorityByNameAndProjectId,
listCertificateAuthoritiesByProjectId,
updateCertificateAuthority,
deleteCertificateAuthority
deleteCertificateAuthority,
getAzureAdcsTemplates
};
};

14
backend/src/services/certificate-authority/certificate-authority-types.ts
View File

@@ -1,13 +1,23 @@
import { TAcmeCertificateAuthority, TAcmeCertificateAuthorityInput } from "./acme/acme-certificate-authority-types";
import {
TAzureAdCsCertificateAuthority,
TCreateAzureAdCsCertificateAuthorityDTO
} from "./azure-ad-cs/azure-ad-cs-certificate-authority-types";
import { CaType } from "./certificate-authority-enums";
import {
TInternalCertificateAuthority,
TInternalCertificateAuthorityInput
} from "./internal/internal-certificate-authority-types";
export type TCertificateAuthority = TInternalCertificateAuthority | TAcmeCertificateAuthority;
export type TCertificateAuthority =
| TInternalCertificateAuthority
| TAcmeCertificateAuthority
| TAzureAdCsCertificateAuthority;
export type TCertificateAuthorityInput = TInternalCertificateAuthorityInput | TAcmeCertificateAuthorityInput;
export type TCertificateAuthorityInput =
| TInternalCertificateAuthorityInput
| TAcmeCertificateAuthorityInput
| TCreateAzureAdCsCertificateAuthorityDTO;
export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id">;

10
backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts
View File

@@ -36,12 +36,18 @@ import { validateAndMapAltNameType } from "../certificate-authority-validators";
import { TIssueCertWithTemplateDTO } from "./internal-certificate-authority-types";
type TInternalCertificateAuthorityFnsDeps = {
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa" | "findById">;
certificateAuthorityDAL: Pick<
TCertificateAuthorityDALFactory,
"findByIdWithAssociatedCa" | "findById" | "create" | "transaction" | "updateById" | "findWithAssociatedCa"
>;
certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "findOne">;
projectDAL: Pick<TProjectDALFactory, "findById" | "transaction" | "findOne" | "updateById">;
kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "encryptWithKmsKey" | "generateKmsKey">;
kmsService: Pick<
TKmsServiceFactory,
"decryptWithKmsKey" | "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey"
>;
certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;

49
backend/src/services/certificate/certificate-service.ts
View File

@@ -14,6 +14,8 @@ import { TCertificateBodyDALFactory } from "@app/services/certificate/certificat
import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
import { CaCapability, CaType } from "@app/services/certificate-authority/certificate-authority-enums";
import { caSupportsCapability } from "@app/services/certificate-authority/certificate-authority-maps";
import { TCertificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TPkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
@@ -184,9 +186,11 @@ export const certificateServiceFactory = ({
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(cert.caId);
if (ca.externalCa?.id) {
// Check if the CA type supports revocation
const caType = (ca.externalCa?.type as CaType) ?? CaType.INTERNAL;
if (!caSupportsCapability(caType, CaCapability.REVOKE_CERTIFICATES)) {
throw new BadRequestError({
message: "Cannot revoke external certificates"
message: "Certificate revocation is not supported by this certificate authority type"
});
}
@@ -218,18 +222,37 @@ export const certificateServiceFactory = ({
}
);
// rebuild CRL (TODO: move to interval-based cron job)
await rebuildCaCrl({
caId: ca.id,
certificateAuthorityDAL,
certificateAuthorityCrlDAL,
certificateAuthoritySecretDAL,
projectDAL,
certificateDAL,
kmsService
});
// Note: External CA revocation handling would go here for supported CA types
// Currently, only internal CAs and ACME CAs support revocation
return { revokedAt, cert, ca: expandInternalCa(ca) };
// rebuild CRL (TODO: move to interval-based cron job)
// Only rebuild CRL for internal CAs - external CAs manage their own CRLs
if (!ca.externalCa?.id) {
await rebuildCaCrl({
caId: ca.id,
certificateAuthorityDAL,
certificateAuthorityCrlDAL,
certificateAuthoritySecretDAL,
projectDAL,
certificateDAL,
kmsService
});
}
// Return appropriate CA format based on CA type
const caResult = ca.externalCa?.id
? {
id: ca.id,
name: ca.name,
projectId: ca.projectId,
status: ca.status,
enableDirectIssuance: ca.enableDirectIssuance,
type: ca.externalCa.type,
externalCa: ca.externalCa
}
: expandInternalCa(ca);
return { revokedAt, cert, ca: caResult };
};
/**

10
backend/src/services/org-membership/org-membership-dal.ts
View File

@@ -124,12 +124,12 @@ export const orgMembershipDALFactory = (db: TDbClient) => {
void qb
.whereNull(`${TableName.OrgMembership}.lastInvitedAt`)
.whereBetween(`${TableName.OrgMembership}.createdAt`, [twelveMonthsAgo, oneWeekAgo]);
})
.orWhere((qb) => {
// lastInvitedAt is older than 1 week ago AND createdAt is younger than 1 month ago
void qb
.where(`${TableName.OrgMembership}.lastInvitedAt`, "<", oneWeekAgo)
.where(`${TableName.OrgMembership}.createdAt`, ">", oneMonthAgo);
void qb.orWhere((qbInner) => {
void qbInner
.where(`${TableName.OrgMembership}.lastInvitedAt`, "<", oneWeekAgo)
.where(`${TableName.OrgMembership}.createdAt`, ">", oneMonthAgo);
});
});
return memberships;

3
backend/src/services/pki-subscriber/pki-subscriber-schema.ts
View File

@@ -18,7 +18,8 @@ export const sanitizedPkiSubscriber = PkiSubscribersSchema.pick({
lastOperationAt: true,
enableAutoRenewal: true,
autoRenewalPeriodInDays: true,
lastAutoRenewAt: true
lastAutoRenewAt: true,
properties: true
}).extend({
supportsImmediateCertIssuance: z.boolean().optional()
});

10
backend/src/services/pki-subscriber/pki-subscriber-service.ts
View File

@@ -109,6 +109,7 @@ export const pkiSubscriberServiceFactory = ({
extendedKeyUsages,
enableAutoRenewal,
autoRenewalPeriodInDays,
properties,
projectId,
actorId,
actorAuthMethod,
@@ -157,7 +158,8 @@ export const pkiSubscriberServiceFactory = ({
keyUsages,
extendedKeyUsages,
enableAutoRenewal,
autoRenewalPeriodInDays
autoRenewalPeriodInDays,
properties
});
return newSubscriber;
@@ -221,6 +223,7 @@ export const pkiSubscriberServiceFactory = ({
extendedKeyUsages,
enableAutoRenewal,
autoRenewalPeriodInDays,
properties,
actorId,
actorAuthMethod,
actor,
@@ -275,7 +278,8 @@ export const pkiSubscriberServiceFactory = ({
keyUsages,
extendedKeyUsages,
enableAutoRenewal,
autoRenewalPeriodInDays
autoRenewalPeriodInDays,
properties
});
return updatedSubscriber;
@@ -360,7 +364,7 @@ export const pkiSubscriberServiceFactory = ({
throw new BadRequestError({ message: "CA is disabled" });
}
if (ca.externalCa?.id && ca.externalCa.type === CaType.ACME) {
if (ca.externalCa?.id && (ca.externalCa.type === CaType.ACME || ca.externalCa.type === CaType.AZURE_AD_CS)) {
await certificateAuthorityQueue.orderCertificateForSubscriber({
subscriberId: subscriber.id,
caType: ca.externalCa.type

12
backend/src/services/pki-subscriber/pki-subscriber-types.ts
View File

@@ -18,6 +18,7 @@ export type TCreatePkiSubscriberDTO = {
extendedKeyUsages: CertExtendedKeyUsage[];
enableAutoRenewal?: boolean;
autoRenewalPeriodInDays?: number;
properties?: TPkiSubscriberProperties;
} & TProjectPermission;
export type TGetPkiSubscriberDTO = {
@@ -36,6 +37,7 @@ export type TUpdatePkiSubscriberDTO = {
extendedKeyUsages?: CertExtendedKeyUsage[];
enableAutoRenewal?: boolean;
autoRenewalPeriodInDays?: number;
properties?: TPkiSubscriberProperties;
} & TProjectPermission;
export type TDeletePkiSubscriberDTO = {
@@ -69,3 +71,13 @@ export enum SubscriberOperationStatus {
SUCCESS = "success",
FAILED = "failed"
}
export type TPkiSubscriberProperties = {
azureTemplateType?: string;
organization?: string;
organizationalUnit?: string;
country?: string;
state?: string;
locality?: string;
emailAddress?: string;
};

167
backend/src/services/secret-sync/checkly/checkly-sync-fns.ts
View File

@@ -23,56 +23,120 @@ export const ChecklySyncFns = {
const config = secretSync.destinationConfig;
const variables = await ChecklyPublicAPI.getVariables(secretSync.connection, config.accountId);
if (config.groupId) {
// Handle group environment variables
const groupVars = await ChecklyPublicAPI.getCheckGroupEnvironmentVariables(
secretSync.connection,
config.accountId,
config.groupId
);
const checklySecrets = Object.fromEntries(variables!.map((variable) => [variable.key, variable]));
const checklyGroupSecrets = Object.fromEntries(groupVars.map((variable) => [variable.key, variable]));
for await (const key of Object.keys(secretMap)) {
try {
// Prepare all variables to update at once
const updatedVariables = { ...checklyGroupSecrets };
for (const key of Object.keys(secretMap)) {
const entry = secretMap[key];
// If value is empty, we skip the upsert - checkly does not allow empty values
// If value is empty, we skip adding it - checkly does not allow empty values
if (entry.value.trim() === "") {
// Delete the secret from Checkly if its empty
// Delete the secret from the group if it's empty
if (!disableSecretDeletion) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key
});
delete updatedVariables[key];
}
continue; // Skip empty values
}
await ChecklyPublicAPI.upsertVariable(secretSync.connection, config.accountId, {
// Add or update the variable
updatedVariables[key] = {
key,
value: entry.value,
secret: true,
locked: true
});
};
}
// Remove secrets that are not in the secretMap if deletion is enabled
if (!disableSecretDeletion) {
for (const key of Object.keys(checklyGroupSecrets)) {
// eslint-disable-next-line no-continue
if (!matchesSchema(key, environment?.slug || "", keySchema)) continue;
if (!secretMap[key]) {
delete updatedVariables[key];
}
}
}
// Update all group environment variables at once
try {
await ChecklyPublicAPI.updateCheckGroupEnvironmentVariables(
secretSync.connection,
config.accountId,
config.groupId,
Object.values(updatedVariables)
);
} catch (error) {
if (error instanceof SecretSyncError) throw error;
throw new SecretSyncError({
error,
secretKey: key
secretKey: "group_update"
});
}
}
} else {
// Handle global variables (existing logic)
const variables = await ChecklyPublicAPI.getVariables(secretSync.connection, config.accountId);
if (disableSecretDeletion) return;
const checklySecrets = Object.fromEntries(variables!.map((variable) => [variable.key, variable]));
for await (const key of Object.keys(checklySecrets)) {
try {
// eslint-disable-next-line no-continue
if (!matchesSchema(key, environment?.slug || "", keySchema)) continue;
for await (const key of Object.keys(secretMap)) {
try {
const entry = secretMap[key];
if (!secretMap[key]) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key
// If value is empty, we skip the upsert - checkly does not allow empty values
if (entry.value.trim() === "") {
// Delete the secret from Checkly if its empty
if (!disableSecretDeletion) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key
});
}
continue; // Skip empty values
}
await ChecklyPublicAPI.upsertVariable(secretSync.connection, config.accountId, {
key,
value: entry.value,
secret: true,
locked: true
});
} catch (error) {
throw new SecretSyncError({
error,
secretKey: key
});
}
}
if (disableSecretDeletion) return;
for await (const key of Object.keys(checklySecrets)) {
try {
// eslint-disable-next-line no-continue
if (!matchesSchema(key, environment?.slug || "", keySchema)) continue;
if (!secretMap[key]) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key
});
}
} catch (error) {
throw new SecretSyncError({
error,
secretKey: key
});
}
} catch (error) {
throw new SecretSyncError({
error,
secretKey: key
});
}
}
},
@@ -80,23 +144,54 @@ export const ChecklySyncFns = {
async removeSecrets(secretSync: TChecklySyncWithCredentials, secretMap: TSecretMap) {
const config = secretSync.destinationConfig;
const variables = await ChecklyPublicAPI.getVariables(secretSync.connection, config.accountId);
if (config.groupId) {
// Handle group environment variables
const groupVars = await ChecklyPublicAPI.getCheckGroupEnvironmentVariables(
secretSync.connection,
config.accountId,
config.groupId
);
const checklySecrets = Object.fromEntries(variables!.map((variable) => [variable.key, variable]));
const checklyGroupSecrets = Object.fromEntries(groupVars.map((variable) => [variable.key, variable]));
// Filter out the secrets to remove
const remainingVariables = Object.keys(checklyGroupSecrets)
.filter((key) => !(key in secretMap))
.map((key) => checklyGroupSecrets[key]);
for await (const secret of Object.keys(checklySecrets)) {
try {
if (secret in secretMap) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key: secret
});
}
await ChecklyPublicAPI.updateCheckGroupEnvironmentVariables(
secretSync.connection,
config.accountId,
config.groupId,
remainingVariables
);
} catch (error) {
throw new SecretSyncError({
error,
secretKey: secret
secretKey: "group_remove"
});
}
} else {
// Handle global variables (existing logic)
const variables = await ChecklyPublicAPI.getVariables(secretSync.connection, config.accountId);
const checklySecrets = Object.fromEntries(variables!.map((variable) => [variable.key, variable]));
for await (const secret of Object.keys(checklySecrets)) {
try {
if (secret in secretMap) {
await ChecklyPublicAPI.deleteVariable(secretSync.connection, config.accountId, {
key: secret
});
}
} catch (error) {
throw new SecretSyncError({
error,
secretKey: secret
});
}
}
}
}
};

12
backend/src/services/secret-sync/checkly/checkly-sync-schemas.ts
View File

@@ -11,7 +11,17 @@ import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types"
const ChecklySyncDestinationConfigSchema = z.object({
accountId: z.string().min(1, "Account ID is required").max(255, "Account ID must be less than 255 characters"),
accountName: z.string().min(1, "Account Name is required").max(255, "Account ID must be less than 255 characters")
accountName: z
.string()
.min(1, "Account Name is required")
.max(255, "Account ID must be less than 255 characters")
.optional(),
groupId: z.string().min(1, "Group ID is required").max(255, "Group ID must be less than 255 characters").optional(),
groupName: z
.string()
.min(1, "Group Name is required")
.max(255, "Group Name must be less than 255 characters")
.optional()
});
const ChecklySyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };

4
docs/api-reference/endpoints/app-connections/azure-adcs/available.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Available"
openapi: "GET /api/v1/app-connections/azure-adcs/available"
---

10
docs/api-reference/endpoints/app-connections/azure-adcs/create.mdx Normal file
View File

@@ -0,0 +1,10 @@
---
title: "Create"
openapi: "POST /api/v1/app-connections/azure-adcs"
---
<Note>
Azure ADCS Connections must be created through the Infisical UI.
Check out the configuration docs for [Azure ADCS Connections](/integrations/app-connections/azure-adcs) for a step-by-step
guide.
</Note>

4
docs/api-reference/endpoints/app-connections/azure-adcs/delete.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Delete"
openapi: "DELETE /api/v1/app-connections/azure-adcs/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/azure-adcs/get-by-id.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by ID"
openapi: "GET /api/v1/app-connections/azure-adcs/{connectionId}"
---

4
docs/api-reference/endpoints/app-connections/azure-adcs/get-by-name.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "Get by Name"
openapi: "GET /api/v1/app-connections/azure-adcs/connection-name/{connectionName}"
---

4
docs/api-reference/endpoints/app-connections/azure-adcs/list.mdx Normal file
View File

@@ -0,0 +1,4 @@
---
title: "List"
openapi: "GET /api/v1/app-connections/azure-adcs"
---

10
docs/api-reference/endpoints/app-connections/azure-adcs/update.mdx Normal file
View File

@@ -0,0 +1,10 @@
---
title: "Update"
openapi: "PATCH /api/v1/app-connections/azure-adcs/{connectionId}"
---
<Note>
Azure ADCS Connections must be updated through the Infisical UI.
Check out the configuration docs for [Azure ADCS Connections](/integrations/app-connections/azure-adcs) for a step-by-step
guide.
</Note>

57
docs/docs.json
View File

@@ -106,6 +106,7 @@
"integrations/app-connections/auth0",
"integrations/app-connections/aws",
"integrations/app-connections/azure-app-configuration",
"integrations/app-connections/azure-adcs",
"integrations/app-connections/azure-client-secrets",
"integrations/app-connections/azure-devops",
"integrations/app-connections/azure-key-vault",
@@ -342,10 +343,7 @@
},
{
"group": "Architecture",
"pages": [
"internals/architecture/components",
"internals/architecture/cloud"
]
"pages": ["internals/architecture/components", "internals/architecture/cloud"]
},
"internals/security",
"internals/service-tokens"
@@ -564,10 +562,7 @@
"integrations/cloud/gcp-secret-manager",
{
"group": "Cloudflare",
"pages": [
"integrations/cloud/cloudflare-pages",
"integrations/cloud/cloudflare-workers"
]
"pages": ["integrations/cloud/cloudflare-pages", "integrations/cloud/cloudflare-workers"]
},
"integrations/cloud/terraform-cloud",
"integrations/cloud/databricks",
@@ -661,9 +656,7 @@
"documentation/platform/secret-scanning/overview",
{
"group": "Concepts",
"pages": [
"documentation/platform/secret-scanning/concepts/secret-scanning"
]
"pages": ["documentation/platform/secret-scanning/concepts/secret-scanning"]
}
]
},
@@ -690,6 +683,7 @@
"documentation/platform/pki/subscribers",
"documentation/platform/pki/certificates",
"documentation/platform/pki/acme-ca",
"documentation/platform/pki/azure-adcs",
"documentation/platform/pki/est",
"documentation/platform/pki/alerting",
{
@@ -712,18 +706,13 @@
"documentation/platform/ssh/overview",
{
"group": "Concepts",
"pages": [
"documentation/platform/ssh/concepts/ssh-certificates"
]
"pages": ["documentation/platform/ssh/concepts/ssh-certificates"]
}
]
},
{
"group": "Platform Reference",
"pages": [
"documentation/platform/ssh/usage",
"documentation/platform/ssh/host-groups"
]
"pages": ["documentation/platform/ssh/usage", "documentation/platform/ssh/host-groups"]
}
]
},
@@ -770,11 +759,7 @@
"cli/commands/reset",
{
"group": "infisical scan",
"pages": [
"cli/commands/scan",
"cli/commands/scan-git-changes",
"cli/commands/scan-install"
]
"pages": ["cli/commands/scan", "cli/commands/scan-git-changes", "cli/commands/scan-install"]
}
]
},
@@ -1108,9 +1093,7 @@
"pages": [
{
"group": "Kubernetes",
"pages": [
"api-reference/endpoints/dynamic-secrets/kubernetes/create-lease"
]
"pages": ["api-reference/endpoints/dynamic-secrets/kubernetes/create-lease"]
},
"api-reference/endpoints/dynamic-secrets/create",
"api-reference/endpoints/dynamic-secrets/update",
@@ -1396,6 +1379,18 @@
"api-reference/endpoints/app-connections/aws/delete"
]
},
{
"group": "Azure ADCS",
"pages": [
"api-reference/endpoints/app-connections/azure-adcs/list",
"api-reference/endpoints/app-connections/azure-adcs/available",
"api-reference/endpoints/app-connections/azure-adcs/get-by-id",
"api-reference/endpoints/app-connections/azure-adcs/get-by-name",
"api-reference/endpoints/app-connections/azure-adcs/create",
"api-reference/endpoints/app-connections/azure-adcs/update",
"api-reference/endpoints/app-connections/azure-adcs/delete"
]
},
{
"group": "Azure App Configuration",
"pages": [
@@ -2453,7 +2448,7 @@
"sdks/languages/node",
"sdks/languages/python",
"sdks/languages/java",
"sdks/languages/csharp",
"sdks/languages/dotnet",
"sdks/languages/cpp",
"sdks/languages/rust",
"sdks/languages/go",
@@ -2681,5 +2676,11 @@
"koala": {
"publicApiKey": "pk_b50d7184e0e39ddd5cdb43cf6abeadd9b97d"
}
}
},
"redirects": [
{
"source": "/sdks/languages/csharp",
"destination": "/sdks/languages/dotnet"
}
]
}

5
docs/documentation/platform/access-controls/access-requests.mdx
View File

@@ -25,6 +25,11 @@ This functionality works in the following way:
{/* ![Access Request Review](/images/platform/access-controls/review-access-request.png) */}
![Access Request Bypass](/images/platform/access-controls/access-request-bypass.png)
<Note>
Optionally, approvers can edit the duration of an access request to reduce how long access will be granted by clicking the **Edit** icon next to the duration.
![Edit Access Request](/images/platform/access-controls/edit-access-request.png)
</Note>
<Info>
If the access request matches with a policy that allows break-glass approval
bypasses, the requester may bypass the policy and get access to the resource

206
docs/documentation/platform/pki/azure-adcs.mdx Normal file
View File

@@ -0,0 +1,206 @@
---
title: "Certificates with Azure ADCS"
description: "Learn how to issue and manage certificates using Microsoft Active Directory Certificate Services (ADCS) with Infisical."
---
Issue and manage certificates using Microsoft Active Directory Certificate Services (ADCS) for enterprise-grade certificate management integrated with your existing Windows infrastructure.
## Prerequisites
Before setting up ADCS integration, ensure you have:
- Microsoft Active Directory Certificate Services (ADCS) server running and accessible
- Domain administrator account with certificate management permissions
- ADCS web enrollment enabled on your server
- Network connectivity from Infisical to the ADCS server
- **IP whitelisting**: Your ADCS server must allow connections from Infisical's IP addresses
- For Infisical Cloud instances, see [Networking Configuration](/documentation/setup/networking) for the list of IPs to whitelist
- For self-hosted instances, whitelist your Infisical server's IP address
- Azure ADCS app connection configured (see [Azure ADCS Connection](/integrations/app-connections/azure-adcs))
## Complete Workflow: From Setup to Certificate Issuance
This section walks you through the complete end-to-end process of setting up Azure ADCS integration and issuing your first certificate.
<Steps>
<Step title="Navigate to External Certificate Authorities">
In your Infisical project, go to your **Certificate Project** → **Certificate Authority** to access the external CAs page.
![External CA Page](/images/platform/pki/azure-adcs/azure-adcs-external-ca-page.png)
</Step>
<Step title="Create New Azure ADCS Certificate Service CA">
Click **Create CA** and configure:
- **Type**: Choose **Azure AD Certificate Service**
- **Name**: Friendly name for this CA (e.g., "Production ADCS CA")
- **App Connection**: Choose your ADCS connection from the dropdown
![External CA Form](/images/platform/pki/azure-adcs/azure-adcs-external-ca-form.png)
</Step>
<Step title="Certificate Authority Created">
Once created, your Azure ADCS Certificate Authority will appear in the list and be ready for use.
![External CA Created](/images/platform/pki/azure-adcs/azure-adcs-external-ca-created.png)
</Step>
<Step title="Navigate to Subscribers">
Go to **Subscribers** to access the subscribers page.
![Subscribers Page](/images/platform/pki/azure-adcs/azure-adcs-subscribers-page.png)
</Step>
<Step title="Create New Subscriber">
Click **Add Subscriber** and configure:
- **Name**: Unique subscriber name (e.g., "web-server-certs")
- **Certificate Authority**: Select your ADCS CA
- **Common Name**: Certificate CN (e.g., "api.example.com")
- **Certificate Template**: Select from dynamically loaded ADCS templates
- **Subject Alternative Names**: DNS names, IP addresses, or email addresses
- **TTL**: Certificate validity period (e.g., "1y" for 1 year)
- **Additional Subject Fields**: Organization, OU, locality, state, country, email (if required by template)
![Subscribers Form](/images/platform/pki/azure-adcs/azure-adcs-subscribers-form.png)
</Step>
<Step title="Subscriber Created">
Your subscriber is now created and ready to issue certificates.
![Subscriber Created](/images/platform/pki/azure-adcs/azure-adcs-subscribers-created.png)
</Step>
<Step title="Issue New Certificate">
Click into your subscriber and click **Order Certificate** to generate a new certificate using your ADCS template.
![Issue New Certificate](/images/platform/pki/azure-adcs/azure-adcs-subscriber-issue-new-certificate.png)
</Step>
<Step title="Certificate Created">
Your certificate has been successfully issued by the ADCS server and is ready for use.
![Certificate Created](/images/platform/pki/azure-adcs/azure-adcs-certificate-created.png)
</Step>
<Step title="View Certificate Details">
Navigate to **Certificates** to view detailed information about all issued certificates, including expiration dates, serial numbers, and certificate chains.
![Certificates Page](/images/platform/pki/azure-adcs/azure-adcs-certificates-page.png)
</Step>
</Steps>
## Certificate Templates
Infisical automatically retrieves available certificate templates from your ADCS server, ensuring you can only select templates that are properly configured and accessible. The system dynamically discovers templates during the certificate authority setup and certificate issuance process.
### Common Template Types
ADCS templates you might see include:
- **Web Server**: For SSL/TLS certificates with server authentication
- **Computer**: For machine authentication certificates
- **User**: For client authentication certificates
- **Basic EFS**: For Encrypting File System certificates
- **EFS Recovery Agent**: For EFS data recovery
- **Administrator**: For administrative certificates
- **Subordinate Certification Authority**: For issuing CA certificates
### Template Requirements
Ensure your ADCS templates are configured with:
- **Enroll permissions** for your connection account
- **Auto-enroll permissions** if using automated workflows
- **Subject name requirements** matching your certificate requests
- **Key usage extensions** appropriate for your use case
<Info>
**Dynamic Template Discovery**: Infisical queries your ADCS server in real-time to populate available templates. Only templates you have permission to use will be displayed during certificate issuance.
</Info>
## Certificate Issuance Limitations
### Immediate Issuance Only
<Warning>
**Manual Approval Not Supported**: Infisical currently supports only **immediate certificate issuance**. Certificates that require manual approval or are held by ADCS policies cannot be issued through Infisical yet.
</Warning>
For successful certificate issuance, ensure your ADCS templates and policies are configured to:
- **Auto-approve** certificate requests without manual intervention
- **Not require** administrator approval for the templates you plan to use
- **Allow** the connection account to request and receive certificates immediately
### What Happens with Manual Approval
If a certificate request requires manual approval:
1. The request will be submitted to ADCS successfully
2. Infisical will attempt to retrieve the certificate with exponential backoff (up to 5 retries over ~1 minute)
3. If the certificate is not approved within this timeframe, the request will **fail**
4. **No background polling**: Currently, Infisical does not check for certificates that might be approved hours or days later
<Info>
**Future Enhancement**: Background polling for delayed certificate approvals is planned for future releases.
</Info>
### Certificate Revocation
<Warning>
Certificate revocation is **not supported** by the Azure ADCS connector due to security and complexity considerations.
</Warning>
## Advanced Configuration
### Custom Validity Periods
Enable custom certificate validity periods on your ADCS server:
```cmd
# Run on ADCS server as Administrator
certutil -setreg policy\EditFlags +EDITF_ATTRIBUTEENDDATE
net stop certsvc
net start certsvc
```
This allows Infisical to control certificate expiration dates directly.
## Troubleshooting
### Common Issues
**Certificate Request Denied**
- Verify ADCS template permissions for your connection account
- Check template subject name requirements
- Ensure template allows the requested key algorithm and size
**Revocation Service Unavailable**
- Verify IIS is running and the revocation endpoint is accessible
- Check IIS application pool permissions
- Test endpoint connectivity from Infisical
**Template Not Found**
- Verify template exists on ADCS server and is published
- Check that your connection account has enrollment permissions for the template
- Ensure the template is properly configured and available in the ADCS web enrollment interface
- Templates are dynamically loaded - refresh the PKI Subscriber form if templates don't appear
**Certificate Request Pending/Timeout**
- Check if your ADCS template requires manual approval - Infisical only supports immediate issuance
- Verify the certificate template is configured for auto-approval
- Ensure your connection account has sufficient permissions to request certificates without approval
- Review ADCS server policies that might be holding the certificate request
**Network Connectivity Issues**
- Verify your ADCS server's firewall allows connections from Infisical
- For Infisical Cloud: Ensure Infisical's IP addresses are whitelisted (see [Networking Configuration](/documentation/setup/networking))
- For self-hosted: Whitelist your Infisical server's IP address on the ADCS server
- Test HTTPS connectivity to the ADCS web enrollment endpoint
- Check for any network security appliances blocking the connection
**Authentication Failures**
- Verify ADCS connection credentials
- Check domain account permissions
- Ensure network connectivity to ADCS server
**SSL/TLS Certificate Errors**
- For ADCS servers with self-signed or private certificates: disable "Reject Unauthorized" in the SSL tab of your Azure ADCS app connection, or provide the certificate in PEM format
- Common SSL errors: `UNABLE_TO_VERIFY_LEAF_SIGNATURE`, `SELF_SIGNED_CERT_IN_CHAIN`, `CERT_HAS_EXPIRED`
- The SSL configuration applies to all HTTPS communications between Infisical and your ADCS server
- Only HTTPS URLs are supported - HTTP connections are not allowed for security reasons

BIN
docs/images/app-connections/azure-adcs/azure-adcs-app-connection-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 600 KiB

BIN
docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form-ssl.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 448 KiB

BIN
docs/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 449 KiB

BIN
docs/images/app-connections/azure-adcs/azure-adcs-select-connection.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 477 KiB

BIN
docs/images/platform/access-controls/edit-access-request.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 638 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-certificate-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 796 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-certificates-page.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 765 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-external-ca-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 803 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-external-ca-form.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 501 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-external-ca-page.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 801 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-subscriber-issue-new-certificate.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 778 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-subscribers-created.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 740 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-subscribers-form.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 497 KiB

BIN
docs/images/platform/pki/azure-adcs/azure-adcs-subscribers-page.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 735 KiB

BIN
docs/images/secret-syncs/checkly/checkly-sync-destination.png
View File

Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 618 KiB

After

Width:  |  Height:  |  Size: 592 KiB

70
docs/integrations/app-connections/azure-adcs.mdx Normal file
View File

@@ -0,0 +1,70 @@
---
title: "Azure ADCS Connection"
description: "Learn how to configure an Azure ADCS Connection for Infisical certificate management."
---
Connect Infisical to Microsoft Active Directory Certificate Services (ADCS) for automated certificate issuance and management.
## Prerequisites
- Microsoft Active Directory Certificate Services (ADCS) server running and accessible
- Domain administrator account with certificate management permissions
- Network connectivity from Infisical to the ADCS server
- ADCS web enrollment enabled on your server
## Connection Setup
<Steps>
<Step title="Navigate to App Connections">
Navigate to the **App Connections** tab on the **Organization Settings** page.
![App Connections Tab](/images/app-connections/general/add-connection.png)
</Step>
<Step title="Add Connection">
Select the **Azure ADCS Connection** option from the connection options modal.
![Select Azure ADCS Connection](/images/app-connections/azure-adcs/azure-adcs-select-connection.png)
</Step>
<Step title="Configure Connection Details">
**Configuration Tab:**
- **Name**: Friendly name for this ADCS connection (e.g., "Production ADCS")
- **ADCS URL**: Your ADCS HTTPS URL (e.g., `https://adcs.yourdomain.com/certsrv`) - only HTTPS is supported
- **Username**: Domain administrator username (format: `DOMAIN\username` or `username@domain.com`)
- **Password**: Password for the domain administrator account
**SSL Tab:**
- **SSL Certificate**: Optional PEM certificate for custom CA certificates or self-signed certificates
- **Reject Unauthorized**: Whether to reject connections with invalid SSL certificates (it's recommended to keep it enabled)
<Note>
**Getting the SSL Certificate**: If your ADCS server uses a self-signed certificate or a certificate from a custom CA, you can obtain the certificate using OpenSSL or PowerShell:
**Using OpenSSL:**
```bash
openssl s_client -connect your-adcs-server:443 -showcerts
```
**Using PowerShell (from inside your ADCS Server):**
```powershell
Import-Module WebAdministration -ErrorAction SilentlyContinue
$binding = Get-WebBinding -Protocol https -Port 443
if ($binding -and $binding.certificateHash) {
$cert = Get-ChildItem -Path "Cert:\LocalMachine\My\$($binding.certificateHash)"
if ($cert) {
$certBase64 = [System.Convert]::ToBase64String($cert.RawData)
$certPem = "-----BEGIN CERTIFICATE-----`n" + ($certBase64 -replace '(.{64})', '$1`n') + "`n-----END CERTIFICATE-----"
Write-Output $certPem
}
}
```
Copy the certificate content (including `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines) and paste it into the SSL Certificate field.
</Note>
And click **Connect to ADCS** to establish the connection.
![Connect to ADCS](/images/app-connections/azure-adcs/azure-adcs-app-connection-form.png)
![Connect to ADCS - SSL](/images/app-connections/azure-adcs/azure-adcs-app-connection-form-ssl.png)
</Step>
<Step title="Connection Created">
Your **Azure ADCS Connection** is now available for use in your Infisical projects. ![Azure ADCS Connection Created](/images/app-connections/azure-adcs/azure-adcs-app-connection-created.png)
</Step>
</Steps>

48
docs/integrations/platforms/ansible.mdx
View File

@@ -34,8 +34,54 @@ $ pip install infisicalsdk
You can either call modules by their Fully Qualified Collection Name (FQCN), such as `infisical.vault.read_secrets`, or you can call modules by their short name if you list the `infisical.vault` collection in the playbook's collections keyword:
### Authentication
```bash
The Infisical Ansible Collection supports [Universal Auth](/documentation/platform/identities/universal-auth) and [OIDC](/documentation/platform/identities/oidc-auth/general) for authenticating against Infisical.
<AccordionGroup>
<Accordion title="Universal Auth">
Using Universal Auth for authentication is the most straight-forward way to get started with using the Ansible collection.
To use Universal Auth, you need to provide the Client ID and Client Secret of your Infisical Machine Identity.
```yaml
lookup('infisical.vault.read_secrets', auth_method="universal-auth", universal_auth_client_id='<client-id>', universal_auth_client_secret='<client-secret>' ...rest)
```
You can also provide the `auth_method`, `universal_auth_client_id`, and `universal_auth_client_secret` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| ------------------------------ | ---------------------------------------- |
| `auth_method` | `INFISICAL_AUTH_METHOD` |
| `universal_auth_client_id` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` |
| `universal_auth_client_secret` | `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` |
</Accordion>
<Accordion title="OIDC Auth">
To use OIDC Auth, you'll need to provide the ID of your machine identity, and the OIDC JWT to be used for authentication.
<Note>
Please note that in order to use OIDC Auth, you must have `1.0.10` or newer of the `infisicalsdk` package installed.
</Note>
```yaml
lookup('infisical.vault.read_secrets', auth_method="oidc-auth", identity_id='<identity-id>', jwt='<oidc-jwt>' ...rest)
```
You can also provide the `auth_method`, `identity_id`, and `jwt` parameters through environment variables:
| Parameter Name | Environment Variable Name |
| --------------- | ------------------------- |
| auth_method | `INFISICAL_AUTH_METHOD` |
| identity_id | `INFISICAL_IDENTITY_ID` |
| jwt | `INFISICAL_JWT` |
</Accordion>
</AccordionGroup>
### Examples
```yaml
---
vars:
read_all_secrets_within_scope: "{{ lookup('infisical.vault.read_secrets', universal_auth_client_id='<>', universal_auth_client_secret='<>', project_id='<>', path='/', env_slug='dev', url='https://spotify.infisical.com') }}"

26
docs/integrations/platforms/docker.mdx
View File

@@ -6,32 +6,10 @@ description: "Learn how to use Infisical to inject environment variables into a
This approach allows you to inject secrets from Infisical directly into your application.
This is achieved by installing the Infisical CLI into your docker image and modifying your start command to execute with Infisical.
## Add the Infisical CLI to your Dockerfile
## Install the Infisical CLI to your Dockerfile
<Tabs>
<Tab title="Alpine">
```dockerfile
RUN apk add --no-cache bash curl && curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.alpine.sh' | bash \
&& apk add infisical
```
To install the CLI, follow the instructions for your chosen distribution [here](/cli/overview).
</Tab>
<Tab title="RedHat/CentOs/Amazon-linux">
```dockerfile
RUN curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.rpm.sh' | sh \
&& yum install -y infisical
```
</Tab>
<Tab title="Debian/Ubuntu">
```dockerfile
RUN apt-get update && apt-get install -y bash curl && curl -1sLf \
'https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh' | bash \
&& apt-get update && apt-get install -y infisical
```
</Tab>
</Tabs>
####
<Tip>
We recommend you to set the version of the CLI to a specific version. This will help keep your CLI version consistent across reinstalls. [View versions](https://cloudsmith.io/~infisical/repos/infisical-cli/packages/)

1
docs/integrations/secret-syncs/checkly.mdx
View File

@@ -37,6 +37,7 @@ description: "Learn how to configure a Checkly Sync for Infisical."
- **Checkly Connection**: The Checkly Connection to authenticate with.
- **Account**: The Checkly account to sync secrets to.
- **Group**: The Checkly check group to sync secrets to (Optional).
</Step>
<Step title="Configure Sync Options">
Configure the **Sync Options** to specify how secrets should be synced, then click **Next**.

313
docs/sdks/languages/cpp.mdx
View File

@@ -1,6 +1,315 @@
---
title: "Infisical C++ SDK"
sidebarTitle: "C++"
url: "https://github.com/Infisical/infisical-cpp-sdk/?tab=readme-ov-file#infisical-c-sdk"
icon: "/images/sdks/languages/cpp.svg"
---
---
If you're working with C++, the official Infisical C++ SDK package is the easiest way to fetch and work with secrets for your application.
## Compatible with C++ 17 and later
The Infisical C++ SDK is compatible with C++ 17 capable compilers. This implies GCC 8 or newer, and clang 3.8 or newer. Earlier versions of C++ are unsupported.
## Dependencies
- `cURL`: Used internally for crafting HTTP requests.
## CMake Installation
```bash
cmake_minimum_required(VERSION 3.14)
project(InfisicalTest)
set(CMAKE_CXX_STANDARD 17)
set(CMAKE_CXX_STANDARD_REQUIRED ON)
set(CMAKE_PREFIX_PATH ${CMAKE_BINARY_DIR})
find_package(OpenSSL REQUIRED)
include(FetchContent)
FetchContent_Declare(
infisical
GIT_REPOSITORY https://github.com/Infisical/infisical-cpp-sdk.git
GIT_TAG 1.0.0 # Replace with the desired version
)
FetchContent_MakeAvailable(infisical)
FetchContent_GetProperties(infisical)
# Example usage. This will differ based on your project structure.
add_executable(my_app src/main.cpp)
target_link_libraries(my_app PRIVATE infisical OpenSSL::SSL OpenSSL::Crypto)
target_include_directories(my_app PRIVATE ${infisical_SOURCE_DIR}/include)
```
## Manual Installation
If you're unable to use the recommended CMake installation approach, you can choose to manually build the library and use it in your project.
```bash
mkdir build
cd build
cmake ..
make
```
## Quick-Start Example
Below you'll find an example that uses the Infisical SDK to fetch a secret with the key `API_KEY` using [Machine Identity Universal Auth](https://infisical.com/docs/documentation/platform/identities/universal-auth)
More examples can be found in the [/examples](https://github.com/Infisical/infisical-cpp-sdk/tree/main/examples) folder.
```cpp
#include <iostream>
#include <libinfisical/InfisicalClient.h>
int main() {
try {
Infisical::InfisicalClient client(
Infisical::ConfigBuilder()
.withHostUrl("https://app.infisical.com") // Optionally change this to your custom Infisical instance URL.
.withAuthentication(
Infisical::AuthenticationBuilder()
.withUniversalAuth("<machine-identity-universal-auth-client-id>", "<machine-identity-universal-auth-client-secret>")
.build())
.build());
const auto getSecretOptions = Infisical::Input::GetSecretOptionsBuilder()
.withEnvironment("<env-slug>") // dev, staging, prod, etc
.withProjectId("<your-project-id>")
.withSecretKey("API_KEY")
.build();
const auto apiKeySecret = client.secrets().getSecret(getSecretOptions);
printf("Secret retrieved, [key=%s] [value=%s]\n", apiKeySecret.getSecretKey().c_str(), apiKeySecret.getSecretValue().c_str());
} catch (const Infisical::InfisicalError &e) {
std::cerr << "Error: " << e.what() << std::endl;
return 1;
}
return 0;
}
```
## JSON Serialization
The SDK uses [nlohmann/json](https://github.com/nlohmann/json) internally to serialize/deserialize JSON data. This SDK makes no assumptions about which JSON library you use in your project, and you aren't constrained to `nlohmann/json` in any way. Data returned by the SDK is returned as a class, which exposes Getter methods for getting fields such as the secret value or secret key.
## Documentation
The Infisical C++ SDK follows a builder pattern for all types of input. Below is a detailed documentation of our currently support methods.
Everything related to the Infisical SDK lives inside the `Infisical` namespace.
### InfisicalClient Class
`InfisicalClient(Config &config)`
```cpp
Infisical::InfisicalClient client(
Infisical::ConfigBuilder()
.withHostUrl("https://app.infisical.com")
.withAuthentication(
Infisical::AuthenticationBuilder()
.withUniversalAuth(clientId, clientSecret)
.build())
.build());
```
Config is created through the `ConfigBuilder` class. See below for more details
### Config Class
`Config` defines the configuration of the Infisical Client itself, such as authentication.
```cpp
Infisical::Config config = Infisical::ConfigBuilder()
.withHostUrl("https://app.infisical.com")
.withAuthentication(
Infisical::AuthenticationBuilder()
.withUniversalAuth(clientId, clientSecret)
.build())
.build();
Infisical::InfisicalClient client(config);
```
- `withHostUrl(string)` _(optional)_: Specify a custom Infisical host URL, pointing to your Infisical instance. Defaults to `https://app.infisical.com`
- `withAuthentication(Infisical::Authentication)`: Configure the authentication that will be used by the SDK. See [Authentication Class](#authentication-class) for more details.
- `build()`: Returns the `Config` object with the options you configured.
### Authentication Class
```cpp
Infisical::Authentication auth = Infisical::AuthenticationBuilder()
.withUniversalAuth(clientId, clientSecret)
.build();
Infisical::Config config = Infisical::ConfigBuilder()
.withAuthentication(std::move(auth)) // Or use inline declaration
.build();
```
- `withUniversalAuth(string, string)`: Specify the Universal Auth Client ID and Client Secret that will be used for authentication.
- `build()`: Returns the `Authentication` object with the options you specified.
### TSecret Class
The `TSecret` class is the class that's returned by all secret methods (get/list/delete/update/create). It can come in the form of a `std::vector` or a single instance.
**Available getter methods:**
- `getId(): std::string`: Returns the ID of the secret.
- `getWorkspace(): std::string`: Returns the project ID of the secret.
- `getEnvironment(): std::string`: Returns the environment slug of the secret.
- `getVersion(): unsigned int`: Gets the version of the secret. By default this will always be the latest version unless specified otherwise with `withVersion()`
- `getType(): std::string`: Returns the type of the secret. Can only be `shared` or `personal`. Shared secrets are available to everyone with access to the secret. Personal secrets are personal overwrites of the secret, mainly intended for local development purposes.
- `getSecretKey(): std::string`: Returns the secret key.
- `getSecretValue(): std::string` Returns the secret value.
- `getRotationId(): std::string`: If the secret is a rotation secret, this will return the rotation ID of the secret. If it's a regular secret, this will return an empty string.
- `getSecretPath(): std::string`: Returns the secret path of the secret.
- `getSkipMultilineEncoding(): bool`: Returns whether or not skip multiline encoding is enabled for the secret or not.
`getIsRotatedSecret(): bool`: Returns wether or not the secret is a rotated secret. If `true`, then `getRotationId()` returns the ID of the rotation.
### Secrets
#### Create Secret
```cpp
const auto createSecretOptions = Infisical::Input::CreateSecretOptionsBuilder()
.withEnvironment("<env-slug>")
.withProjectId("<project-id>")
.withSecretKey("SECRET_KEY_TO_CREATE")
.withSecretValue("VALUE_TO_CREATE")
.withSecretComment("Secret comment to attach") // Optional
.withSecretPath("/path/where/to/create/secret") // Optional, defaults to /
.withTagIds({"tag-id-1", "tag-id-2"}) // Optional
.build();
const auto secret = client.secrets().createSecret(createSecretOptions);
```
**Parameters**:
- `withEnvironment(string)`: Specify the slug of the environment to create the secret in.
- `withProjectId(string)`: Specify the ID of the project to create the secret in.
- `withSecretPath(string)`: Specify the secret path to create the secret in. Defaults to `/`
- `withSecretKey(string)`: The secret key to be created.
- `withSecretValue(string)`: The value of the secret to create.
- `withSecretComment(string)` _(optional)_: Optionally add a comment to the secret.
- `withTagIds(std::vector<std::string>>)` _(optional)_: A list of ID's of tags to attach to the secret.
- `build()`: Returns the `CreateSecretOptions` class that can be passed into the `createSecret()` method.
**Returns**:
- Returns the created secret as a `TSecret` class. Read more in the [TSecret Class](#tsecret-class) documentation.
#### Update Secret
```cpp
const auto updateSecretOptions = Infisical::Input::UpdateSecretOptionsBuilder()
.withEnvironment("<env-slug>")
.withProjectId("<project-id>")
.withSecretKey("<secret-key>")
.withNewSecretKey("<new-secret-key>") // Optional
.withSecretValue("<new-secret-value>") // Optional
.withSecretComment("Updated comment") // Optional
.withSecretReminderNote("Updated reminder note") // Optional
.withSecretReminderRepeatDays(1) // Optional
.withType("shared") // Optional
.withTagIds({"tag-id-3", "tag-id-4"}) // Optional
.build();
const auto updatedSecret = client.secrets().updateSecret(updateSecretOptions);
```
**Parameters**:
- `withEnvironment(string)`: Specify the slug of the environment where the secret lives in.
- `withProjectId(string)`: Specify the ID of the project where the secret to update lives in.
- `withSecretPath(string)`: Specify the secret path of the secret to update. Defaults to `/`.
- `withType("shared" | "personal")`: _(optional)_: The type of secret to update. Defaults to `shared`.
- `withSecretKey(string)`: The key of the secret you wish to update.
- `withNewSecretKey(string)` _(optional)_: The new key of the secret you wish to update.
- `withSecretValue(string)` _(optional)_: The new value of the secret.
- `withSecretReminderNote(string)` _(optional)_: Update the secret reminder note attached to the secret.
- `withSecretReminderRepeatDays(unsigned int)` _(optional)_: Update the secret reminder repeat days attached to the secret.
- `withTagIds(std::vector<std::string>>)` _(optional)_: A list of ID's of tags to attach to the secret.
- `build()`: Returns the `UpdateSecretOptions` class that can be passed into the `updateSecret()` method.
**Returns**:
- Returns the updated secret as a `TSecret` class. Read more in the [TSecret Class](#tsecret-class) documentation.
#### Get Secret
```cpp
const auto getSecretOptions = Infisical::Input::GetSecretOptionsBuilder()
.withEnvironment("<env-slug>")
.withProjectId("<project-id>")
.withSecretKey("<secret-key>")
.withType("shared")
.withVersion(2)
.withExpandSecretReferences(true)
.build();
const auto secret = client.secrets().getSecret(getSecretOptions);
```
**Parameters**:
- `withEnvironment(string)`: Specify the slug of the environment where the secret lives in.
- `withProjectId(string)`: Specify the ID of the project where the secret lives in.
- `withSecretPath(string)`: Specify the secret path of the secret to get. Defaults to `/`
- `withType("shared" | "personal")`: _(optional)_: The type of secret to get. Defaults to `shared`.
- `withSecretKey(string)`: The key of the secret to get.
- `withExpandSecretReferences(bool)` _(optional)_: Whether or not to expand secret references automatically. Defaults to `true`.
- `withVersion(unsigned int)` _(optional)_: Optionally fetch a specific version of the secret. If not defined, the latest version of the secret is returned.
- `build()`: Returns the `GetSecretOptions` class that can be passed into the `getSecret()` method.
**Returns**:
- Returns the secret as a `TSecret` class. Read more in the [TSecret Class](#tsecret-class) documentation.
#### Delete Secret
```cpp
const auto deleteSecretOptions = Infisical::Input::DeleteSecretOptionsBuilder()
.withEnvironment("<env-slug>")
.withProjectId("<project-id>")
.withSecretKey("<secret-key>")
.withType("shared")
.withSecretPath("<secret-path>")
.build();
const auto deletedSecret = client.secrets().deleteSecret(deleteSecretOptions);
```
**Parameters**:
- `withEnvironment(string)`: Specify the slug of the environment where the secret to delete lives in.
- `withProjectId(string)`: Specify the ID of the project where the secret to delete lives in.
- `withSecretPath(string)`: Specify the secret path of the secret to delete. Defaults to `/`
- `withType("shared" | "personal")`: _(optional)_: The type of secret to delete. Defaults to `shared`.
- `withSecretKey(string)`: The key of the secret to delete.
- `build()` Returns the `DeleteSecretOptions` class that can be passed into the `deleteSecret()` method.
**Returns**:
- Returns the deleted secret as a `TSecret` class. Read more in the [TSecret Class](#tsecret-class) documentation.
#### List Secrets
```cpp
const auto listSecretsOptions = Infisical::Input::ListSecretOptionsBuilder()
.withProjectId(projectId)
.withEnvironment(environment)
.withSecretPath("/")
.withRecursive(false)
.withAddSecretsToEnvironmentVariables(false)
.build();
const auto secrets = client.secrets().listSecrets(listSecretsOptions);
```
**Parameters**:
- `withEnvironment(string)`: Specify the slug of the environment to list secrets from.
- `withProjectId(string)`: Specify the ID of the project to fetch secrets from.
- `withSecretPath(string)`: Specify the secret path to fetch secrets from. Defaults to `/`
- `withExpandSecretReferences(bool)` _(optional)_: Whether or not to expand secret references automatically. Defaults to `true`.
- `withRecursive(bool)` _(optional)_: Wether or not to recursively fetch secrets from sub-folders. If set to true, all secrets from the secret path specified with `withSecretPath()` and downwards will be fetched.
- `withAddSecretsToEnvironmentVariables(bool)` _(optional)_: If set to true, the fetched secrets will be automatically set as environment variables, making them accessible with `std::getenv` or equivalent by secret key.
- `build()`: Returns the `ListSecretsOptions` class that can be passed into the `listSecrets()` method.
**Returns**:
- Returns the listed secrets as `std::vector<TSecret>`. Read more in the [TSecret Class](#tsecret-class) documentation.

594
docs/sdks/languages/csharp.mdx
View File

@@ -1,594 +0,0 @@
---
title: "Infisical .NET SDK"
sidebarTitle: ".NET"
url: "https://github.com/Infisical/infisical-dotnet-sdk?tab=readme-ov-file#infisical-net-sdk"
icon: "/images/sdks/languages/dotnet.svg"
---
{/*
If you're working with C#, the official [Infisical C# SDK](https://github.com/Infisical/sdk/tree/main/languages/csharp) package is the easiest way to fetch and work with secrets for your application.
- [Nuget Package](https://www.nuget.org/packages/Infisical.Sdk)
- [Github Repository](https://github.com/Infisical/sdk/tree/main/languages/csharp)
<Warning>
**Deprecation Notice**
All versions prior to **2.3.9** should be considered deprecated and are no longer supported by Infisical. Please update to version **2.3.9** or newer. All changes are fully backwards compatible with older versions.
</Warning>
## Basic Usage
```cs
using Infisical.Sdk;
namespace Example
{
class Program
{
static void Main(string[] args)
{
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
UniversalAuth = new UniversalAuthMethod
{
ClientId = "your-client-id",
ClientSecret = "your-client-secret"
}
}
};
var infisicalClient = new InfisicalClient(settings);
var getSecretOptions = new GetSecretOptions
{
SecretName = "TEST",
ProjectId = "PROJECT_ID",
Environment = "dev",
};
var secret = infisicalClient.GetSecret(getSecretOptions);
Console.WriteLine($"The value of secret '{secret.SecretKey}', is: {secret.SecretValue}");
}
}
}
```
This example demonstrates how to use the Infisical C# SDK in a C# application. The application retrieves a secret named `TEST` from the `dev` environment of the `PROJECT_ID` project.
<Warning>
We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
</Warning>
# Installation
```console
$ dotnet add package Infisical.Sdk
```
# Configuration
Import the SDK and create a client instance with your [Machine Identity](/platform/identities/universal-auth).
```cs
using Infisical.Sdk;
namespace Example
{
class Program
{
static void Main(string[] args)
{
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
UniversalAuth = new UniversalAuthMethod
{
ClientId = "your-client-id",
ClientSecret = "your-client-secret"
}
}
};
var infisicalClient = new InfisicalClient(settings); // <-- Your SDK client is now ready to use
}
}
}
```
### ClientSettings methods
<ParamField query="options" type="object">
<Expandable title="properties">
<ParamField query="ClientId" deprecated type="string" optional>
Your machine identity client ID.
</ParamField>
<ParamField query="ClientSecret" deprecated type="string" optional>
Your machine identity client secret.
</ParamField>
<ParamField query="AccessToken" deprecated type="string" optional>
An access token obtained from the machine identity login endpoint.
</ParamField>
<ParamField query="CacheTtl" type="number" default="300" optional>
Time-to-live (in seconds) for refreshing cached secrets.
If manually set to 0, caching will be disabled, this is not recommended.
</ParamField>
<ParamField query="SiteUrl" type="string" default="https://app.infisical.com" optional>
Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
</ParamField>
<ParamField query="SslCertificatePath" optional>
Optionally provide a path to a custom SSL certificate file. This can be substituted by setting the `INFISICAL_SSL_CERTIFICATE` environment variable to the contents of the certificate.
</ParamField>
<ParamField query="Auth" type="AuthenticationOptions">
The authentication object to use for the client. This is required unless you're using environment variables.
</ParamField>
</Expandable>
</ParamField>
### Authentication
The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
#### Universal Auth
**Using environment variables**
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
UniversalAuth = new UniversalAuthMethod
{
ClientId = "your-client-id",
ClientSecret = "your-client-secret"
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
#### GCP ID Token Auth
<Info>
Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
GcpIdToken = new GcpIdTokenAuthMethod
{
IdentityId = "your-machine-identity-id",
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
#### GCP IAM Auth
**Using environment variables**
- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
GcpIam = new GcpIamAuthMethod
{
IdentityId = "your-machine-identity-id",
ServiceAccountKeyFilePath = "./path/to/your/service-account-key.json"
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
#### AWS IAM Auth
<Info>
Please note that this authentication method will only work if you're running your application on AWS.
Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
AwsIam = new AwsIamAuthMethod
{
IdentityId = "your-machine-identity-id",
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
#### Azure Auth
<Info>
Please note that this authentication method will only work if you're running your application on Azure.
Please [read more](/documentation/platform/identities/azure-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AZURE_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
Azure = new AzureAuthMethod
{
IdentityId = "YOUR_IDENTITY_ID",
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
#### Kubernetes Auth
<Info>
Please note that this authentication method will only work if you're running your application on Kubernetes.
Please [read more](/documentation/platform/identities/kubernetes-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_KUBERNETES_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
**Using the SDK directly**
```csharp
ClientSettings settings = new ClientSettings
{
Auth = new AuthenticationOptions
{
Kubernetes = new KubernetesAuthMethod
{
ServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token", // Optional
IdentityId = "YOUR_IDENTITY_ID",
}
}
};
var infisicalClient = new InfisicalClient(settings);
```
### Caching
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cacheTTL" option when creating the client.
## Working with Secrets
### client.ListSecrets(options)
```cs
var options = new ListSecretsOptions
{
ProjectId = "PROJECT_ID",
Environment = "dev",
Path = "/foo/bar",
AttachToProcessEnv = false,
};
var secrets = infisical.ListSecrets(options);
```
Retrieve all secrets within the Infisical project and environment that client is connected to
#### Parameters
<ParamField query="Parameters" type="object">
<Expandable title="properties">
<ParamField query="Environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="ProjectId" type="string">
The project ID where the secret lives in.
</ParamField>
<ParamField query="Path" type="string" optional>
The path from where secrets should be fetched from.
</ParamField>
<ParamField query="AttachToProcessEnv" type="boolean" default="false" optional>
Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so `System.getenv("SECRET_NAME")`.
</ParamField>
<ParamField query="IncludeImports" type="boolean" default="false" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="Recursive" type="boolean" default="false" optional>
Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
</ParamField>
<ParamField query="ExpandSecretReferences" type="boolean" default="true" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.GetSecret(options)
```cs
var options = new GetSecretOptions
{
SecretName = "AAAA",
ProjectId = "659c781eb2d4fe3e307b77bd",
Environment = "dev",
};
var secret = infisical.GetSecret(options);
```
Retrieve a secret from Infisical.
By default, `GetSecret()` fetches and returns a shared secret.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="SecretName" type="string" required>
The key of the secret to retrieve.
</ParamField>
<ParamField query="ProjectId" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="Environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="Path" type="string" optional>
The path from where secret should be fetched from.
</ParamField>
<ParamField query="Type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
<ParamField query="IncludeImports" type="boolean" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="ExpandSecretReferences" type="boolean" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.CreateSecret(options)
```cs
var options = new CreateSecretOptions {
Environment = "dev",
ProjectId = "PROJECT_ID",
SecretName = "NEW_SECRET",
SecretValue = "NEW_SECRET_VALUE",
SecretComment = "This is a new secret",
};
var newSecret = infisical.CreateSecret(options);
```
Create a new secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="SecretName" type="string" required>
The key of the secret to create.
</ParamField>
<ParamField query="SecretValue" type="string" required>
The value of the secret.
</ParamField>
<ParamField query="ProjectId" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="Environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="Path" type="string" optional>
The path from where secret should be created.
</ParamField>
<ParamField query="Type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
### client.UpdateSecret(options)
```cs
var options = new UpdateSecretOptions {
Environment = "dev",
ProjectId = "PROJECT_ID",
SecretName = "SECRET_TO_UPDATE",
SecretValue = "NEW VALUE"
};
var updatedSecret = infisical.UpdateSecret(options);
```
Update an existing secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="SecretName" type="string" required>
The key of the secret to update.
</ParamField>
<ParamField query="SecretValue" type="string" required>
The new value of the secret.
</ParamField>
<ParamField query="ProjectId" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="Environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="Path" type="string" optional>
The path from where secret should be updated.
</ParamField>
<ParamField query="Type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
### client.DeleteSecret(options)
```cs
var options = new DeleteSecretOptions
{
Environment = "dev",
ProjectId = "PROJECT_ID",
SecretName = "NEW_SECRET",
};
var deletedSecret = infisical.DeleteSecret(options);
```
Delete a secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="SecretName" type="string">
The key of the secret to update.
</ParamField>
<ParamField query="ProjectId" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="Environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="Path" type="string" optional>
The path from where secret should be deleted.
</ParamField>
<ParamField query="Type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
## Cryptography
### Create a symmetric key
Create a base64-encoded, 256-bit symmetric key to be used for encryption/decryption.
```cs
var key = infisical.CreateSymmetricKey();
```
#### Returns (string)
`key` (string): A base64-encoded, 256-bit symmetric key, that can be used for encryption/decryption purposes.
### Encrypt symmetric
```cs
var options = new EncryptSymmetricOptions
{
Plaintext = "Infisical is awesome!",
Key = key,
};
var encryptedData = infisical.EncryptSymmetric(options);
```
#### Parameters
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="Plaintext" type="string">
The plaintext you want to encrypt.
</ParamField>
<ParamField query="Key" type="string" required>
The symmetric key to use for encryption.
</ParamField>
</Expandable>
</ParamField>
#### Returns (object)
`Tag` (string): A base64-encoded, 128-bit authentication tag.
`Iv` (string): A base64-encoded, 96-bit initialization vector.
`CipherText` (string): A base64-encoded, encrypted ciphertext.
### Decrypt symmetric
```cs
var decryptOptions = new DecryptSymmetricOptions
{
Key = key,
Ciphertext = encryptedData.Ciphertext,
Iv = encryptedData.Iv,
Tag = encryptedData.Tag,
};
var decryptedPlaintext = infisical.DecryptSymmetric(decryptOptions);
```
#### Parameters
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="Ciphertext" type="string">
The ciphertext you want to decrypt.
</ParamField>
<ParamField query="Key" type="string" required>
The symmetric key to use for encryption.
</ParamField>
<ParamField query="Iv" type="string" required>
The initialization vector to use for decryption.
</ParamField>
<ParamField query="Tag" type="string" required>
The authentication tag to use for decryption.
</ParamField>
</Expandable>
</ParamField>
#### Returns (string)
`Plaintext` (string): The decrypted plaintext.
*/}

358
docs/sdks/languages/dotnet.mdx Normal file
View File

@@ -0,0 +1,358 @@
---
title: "Infisical .NET SDK"
sidebarTitle: ".NET"
icon: "/images/sdks/languages/dotnet.svg"
---
If you're working with .NET, the official Infisical .NET SDK package is the easiest way to fetch and work with secrets for your application.
## Installation
```bash
dotnet add package Infisical.Sdk
```
## Getting Started (.NET)
```csharp
namespace Example;
using Infisical.Sdk;
using Infisical.Sdk.Model;
public class Program {
public static void Main(string[] args) {
var settings = new InfisicalSdkSettingsBuilder()
.WithHostUri("http://localhost:8080") // Optional. Will default to https://app.infisical.com
.Build();
var infisicalClient = new InfisicalClient(settings);
var _ = infisicalClient.Auth().UniversalAuth().LoginAsync("<machine-identity-universal-auth-client-id>", "<machine-identity-universal-auth-client-secret>").Result;
var options = new ListSecretsOptions
{
SetSecretsAsEnvironmentVariables = true,
EnvironmentSlug = "<your-env-slug>",
SecretPath = "/",
ProjectId = "<your-project-id>",
};
var secrets = infisicalClient.Secrets().ListAsync(options).Result;
if (secrets == null)
{
throw new Exception("Failed to fetch secrets, returned null response");
}
foreach (var secret in secrets)
{
Console.WriteLine($"{secret.SecretKey}: {secret.SecretValue}");
}
}
}
```
## Getting Started (Visual Basic)
```vb
Imports Infisical.Sdk
Imports Infisical.Sdk.Model
Module Program
Sub Main(args As String())
Dim settings = New InfisicalSdkSettingsBuilder() _
.WithHostUri("https://app.infisical.com") _
.Build()
Dim infisicalClient As New InfisicalClient(settings)
Dim authResult = infisicalClient.Auth().UniversalAuth() _
.LoginAsync("<machine-identity-universal-auth-client-id>", "machine-identity-universal-auth-client-secret").Result
Dim options As New ListSecretsOptions With {
.SetSecretsAsEnvironmentVariables = True,
.EnvironmentSlug = "<your-env-slug>",
.SecretPath = "/",
.ProjectId = "<your-project-id>"
}
Dim secrets = infisicalClient.Secrets().ListAsync(options).Result
For Each secret In secrets
Console.WriteLine(secret.SecretKey)
if Environment.GetEnvironmentVariable(secret.SecretKey) IsNot Nothing Then
Console.WriteLine("{0} found on environment variables", secret.SecretKey)
End If
Next
End Sub
End Module
```
## Core Methods
The SDK methods are organized into the following high-level categories:
1. `Auth()`: Handles authentication methods.
2. `Secrets()`: Manages CRUD operations for secrets.
3. `Pki()`: Programmatically interact with the Infisical PKI.
* `Subscribers()`: Manage PKI Subscribers.
### `Auth()`
The `Auth()` component provides methods for authentication:
### Universal Auth
#### Authenticating
```cs
var _ = await sdk.Auth().UniversalAuth().LoginAsync(
"CLIENT_ID",
"CLIENT_SECRET"
);
```
**Parameters:**
- `clientId` (string): The client ID of your Machine Identity.
- `clientSecret` (string): The client secret of your Machine Identity.
### `Secrets()`
The `Secrets()` sub-class handles operations related to the Infisical secrets management product.
#### List Secrets
```cs
Task<Secret[]> ListAsync(ListSecretsOptions options);
throws InfisicalException
```
```csharp
var options = new ListSecretsOptions
{
SetSecretsAsEnvironmentVariables = true,
EnvironmentSlug = "dev",
SecretPath = "/test",
Recursive = true,
ExpandSecretReferences = true,
ProjectId = projectId,
ViewSecretValue = true,
};
Secret[] secrets = await sdk.Secrets().ListAsync(options);
```
**ListSecretsOptions:**
- `ProjectId` (string): The ID of your project.
- `EnvironmentSlug` (string): The environment in which to list secrets (e.g., "dev").
- `SecretPath` (string): The path to the secrets.
- `ExpandSecretReferences` (boolean): Whether to expand secret references.
- `Recursive` (boolean): Whether to list secrets recursively.
- `SetSecretsAsEnvironmentVariables` (boolean): Set the retrieved secrets as environment variables.
**Returns:**
- `Task<Secret[]>`: The response containing the list of secrets.
#### Create Secret
```cs
public Task<Secret> CreateAsync(CreateSecretOptions options);
throws InfisicalException
```
```cs
var options = new CreateSecretOptions
{
SecretName = "SECRET_NAME",
SecretValue = "SECRET_VALUE",
EnvironmentSlug = "<environment-slug>",
SecretPath = "/",
ProjectId = "<your-project-id>",
Metadata = new SecretMetadata[] {
new SecretMetadata {
Key = "metadata-key",
Value = "metadata-value"
}
}
};
Task<Secret> newSecret = await sdk.Secrets().CreateAsync(options);
```
**Parameters:**
- `SecretName` (string): The name of the secret to create
- `SecretValue` (string): The value of the secret.
- `ProjectId` (string): The ID of your project.
- `EnvironmentSlug` (string): The environment in which to create the secret.
- `SecretPath` (string, optional): The path to the secret.
- `Metadata` (object, optional): Attach metadata to the secret.
- `SecretComment` (string, optional): Attach a secret comment to the secret.
- `SecretReminderNote` (string, optional): Attach a secret reminder note to the secret.
- `SecretReminderRepeatDays` (int, optional): Set the reminder repeat days on the secret.
- `SkipMultilineEncoding` (bool, optional): Whether or not to skip multiline encoding for the secret's value. Defaults to `false`.
**Returns:**
- `Task<Secret>`: The created secret.
#### Update Secret
```cs
public Task<Secret> UpdateAsync(UpdateSecretOptions options);
throws InfisicalException
```
```cs
var updateSecretOptions = new UpdateSecretOptions
{
SecretName = "EXISTING_SECRET_NAME",
EnvironmentSlug = "<environment-slug>",
SecretPath = "/",
NewSecretName = "NEW_SECRET_NAME",
NewSecretValue = "new-secret-value",
ProjectId = "<project-id>",
};
Task<Secret> updatedSecret = await sdk.Secrets().UpdateAsync(updateSecretOptions);
```
**Parameters:**
- `SecretName` (string): The name of the secret to update.`
- `ProjectId` (string): The ID of your project.
- `EnvironmentSlug` (string): The environment in which to update the secret.
- `SecretPath` (string): The path to the secret.
- `NewSecretValue` (string, optional): The new value of the secret.
- `NewSecretName` (string, optional): A new name for the secret.
- `NewMetadata` (object, optional): New metadata to attach to the secret.
**Returns:**
- `Task<Secret>`: The updated secret.
#### Get Secret by Name
```cs
public Task<Secret> GetAsync(GetSecretOptions options);
throws InfisicalException
```
```cs
var getSecretOptions = new GetSecretOptions
{
SecretName = "SECRET_NAME",
EnvironmentSlug = "<environment-slug>",
SecretPath = "/",
ProjectId = "<project-id>",
};
Secret secret = await sdk.Secrets().GetAsync(getSecretOptions);
```
**Parameters:**
- `SecretName` (string): The name of the secret to get`
- `ProjectId` (string): The ID of your project.
- `EnvironmentSlug` (string): The environment in which to retrieve the secret.
- `SecretPath` (string): The path to the secret.
- `ExpandSecretReferences` (boolean, optional): Whether to expand secret references.
- `Type` (SecretType, optional): The type of secret to fetch. Defaults to `Shared`.
**Returns:**
- `Task<Secret>`: The fetched secret.
#### Delete Secret by Name
```cs
public Secret DeleteAsync(DeleteSecretOptions options);
throws InfisicalException
```
```cs
var options = new DeleteSecretOptions
{
SecretName = "SECRET_TO_DELETE",
EnvironmentSlug = "<environment-slug>",
SecretPath = "/",
ProjectId = "<project-id>",
};
Secret deletedSecret = await sdk.Secrets().DeleteAsync(options);
```
**Parameters:**
- `SecretName` (string): The name of the secret to delete.
- `ProjectId` (string): The ID of your project.
- `EnvironmentSlug` (string): The environment in which to delete the secret.
- `SecretPath` (string, optional): The path to the secret.
**Returns:**
- `Task<Secret>`: The deleted secret.
### `Pki().Subscribers()`
The `Pki().Subscribers()` sub-class is used to programmatically interact with the Infisical PKI product line. Currently only issuing new certificates and retrieving the latest certificate bundle from a subscriber is supported. More widespread support for the PKI product is coming to the .NET SDK in the near future.
#### Issue a new certificate
```cs
public async Task<SubscriberIssuedCertificate> IssueCertificateAsync(IssueCertificateOptions options);
throws InfisicalException
```
```cs
var options = new IssueCertificateOptions
{
SubscriberName = "<subscriber-name>",
ProjectId = "<your-project-id>",
};
SubscriberIssuedCertificate newCertificate = await sdk.Pki().Subscribers().IssueCertificateAsync(options);
```
**Parameters:**
- `SubscriberName` (string): The name of the subscriber to create a certificate for.
- `ProjectId` (string): The ID of PKI project.
**Returns:**
- `Task<SubscriberIssuedCertificate>`: The newly issued certificate along with it's credentials for the specified subscriber.
#### Retrieve latest certificate bundle
```cs
public async Task<CertificateBundle> RetrieveLatestCertificateBundleAsync(RetrieveLatestCertificateBundleOptions options)
throws InfisicalException
```
```cs
var options = new RetrieveLatestCertificateBundleOptions
{
SubscriberName = "<subscriber-name>",
ProjectId = "<your-project-id>",
};
CertificateBundle latestCertificate = await sdk.Pki().Subscribers().RetrieveLatestCertificateBundleAsync(options);
```
**Parameters:**
- `SubscriberName` (string): The name of the subscriber to retrieve the latest certificate bundle for
- `ProjectId` (string): The ID of PKI project.
**Returns:**
- `Task<CertificateBundle>`: The latest certificate bundle for the specified subscriber.

2
docs/sdks/languages/go.mdx
View File

@@ -4,7 +4,7 @@ sidebarTitle: "Go"
icon: "/images/sdks/languages/go.svg"
---
If you're working with Go Lang, the official [Infisical Go SDK](https://github.com/infisical/go-sdk) package is the easiest way to fetch and work with secrets for your application.
If you're working with Go, the official Infisical Go SDK package is the easiest way to fetch and work with secrets for your application.
- [Package](https://pkg.go.dev/github.com/infisical/go-sdk)
- [Github Repository](https://github.com/infisical/go-sdk)

918
docs/sdks/languages/java.mdx
View File

@@ -1,575 +1,487 @@
---
title: "Infisical Java SDK"
sidebarTitle: "Java"
url: "https://github.com/Infisical/java-sdk?tab=readme-ov-file#infisical-java-sdk"
icon: "/images/sdks/languages/java.svg"
---
{
/*
If you're working with Java, the official [Infisical Java SDK](https://github.com/Infisical/sdk/tree/main/languages/java) package is the easiest way to fetch and work with secrets for your application.
If you're working with Java, the official Infisical Java SDK package is the easiest way to fetch and work with secrets for your application.
- [Maven Package](https://github.com/Infisical/sdk/packages/2019741)
- [Github Repository](https://github.com/Infisical/sdk/tree/main/languages/java)
## Installation
## Basic Usage
Replace `{version}` with the version of the SDK you wish to use. This documentation covers version >=3.0.0.
### Maven
```xml
<dependency>
<groupId>com.infisical</groupId>
<artifactId>sdk</artifactId>
<version>{version}</version>
</dependency>
```
### Gradle
```gradle
implementation group: 'com.infisical', name: 'sdk', version: '{version}'
```
### Others
For other build tools, please check our [package snippets](https://central.sonatype.com/artifact/com.infisical/sdk), and select the build tool you're using for your project.
## Getting Started
```java
package com.example.app;
package com.example.example;
import com.infisical.sdk.InfisicalClient;
import com.infisical.sdk.schema.*;
import com.infisical.sdk.InfisicalSdk;
import com.infisical.sdk.SdkConfig;
public class Example {
public static void main(String[] args) {
// Create the authentication settings for the client
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
UniversalAuthMethod authMethod = new UniversalAuthMethod();
authMethod.setClientID("YOUR_IDENTITY_ID");
authMethod.setClientSecret("YOUR_CLIENT_SECRET");
public static void main(String[] args) {
var sdk = new InfisicalSdk(
new SdkConfig.Builder()
// Optional, will default to https://app.infisical.com
.withSiteUrl("https://your-infisical-instance.com")
.build()
);
authOptions.setUniversalAuth(authMethod);
settings.setAuth(authOptions);
sdk.Auth().UniversalAuthLogin(
"CLIENT_ID",
"CLIENT_SECRET"
);
// Create a new Infisical Client
InfisicalClient client = new InfisicalClient(settings);
var secret = sdk.Secrets().GetSecret(
"<secret-name>",
"<project-id>",
"<env-slug>",
"<secret-path>",
null, // Expand Secret References (boolean, optional)
null, // Include Imports (boolean, optional)
null // Secret Type (shared/personal, defaults to shared, optional)
);
// Create the options for fetching the secret
GetSecretOptions options = new GetSecretOptions();
options.setSecretName("TEST");
options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
// Fetch the sercret with the provided options
GetSecretResponseSecret secret = client.getSecret(options);
// Print the value
System.out.println(secret.getSecretValue());
// Important to avoid memory leaks!
// If you intend to use the client throughout your entire application, you can omit this line.
client.close();
}
System.out.println(secret);
}
}
```
This example demonstrates how to use the Infisical Java SDK in a Java application. The application retrieves a secret named `TEST` from the `dev` environment of the `PROJECT_ID` project.
## Core Methods
<Warning>
We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
</Warning>
The SDK methods are organized into the following high-level categories:
# Installation
1. `Auth()`: Handles authentication methods.
2. `Secrets()`: Manages CRUD operations for secrets.
The Infisical Java SDK is hosted on the GitHub Packages Apache Maven registry. Because of this you need to configure your environment properly so it's able to pull dependencies from the GitHub registry. Please check [this guide from GitHub](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-apache-maven-registry) on how to achieve this.
### `Auth`
Our package is [located here](https://github.com/Infisical/sdk/packages/2019741). Please follow the installation guide on the page.
The `Auth` component provides methods for authentication:
# Configuration
### Universal Auth
Import the SDK and create a client instance with your [Machine Identity](/platform/identities/universal-auth).
#### Authenticating
```java
import com.infisical.sdk.InfisicalClient;
import com.infisical.sdk.schema.*;
public class App {
public static void main(String[] args) {
// Create the authentication settings for the client
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
UniversalAuthMethod authMethod = new UniversalAuthMethod();
authMethod.setClientID("YOUR_IDENTITY_ID");
authMethod.setClientSecret("YOUR_CLIENT_SECRET");
authOptions.setUniversalAuth(authMethod);
settings.setAuth(authOptions);
// Create a new Infisical Client
InfisicalClient client = new InfisicalClient(settings); // Your client!
}
}
public void UniversalAuthLogin(
String clientId,
String clientSecret
)
throws InfisicalException
```
### ClientSettings methods
<ParamField query="options" type="object">
<Expandable title="properties">
<ParamField query="setClientID()" type="string" deprecated optional>
Your machine identity client ID.
**This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
</ParamField>
<ParamField query="setClientSecret()" deprecated type="string" optional>
Your machine identity client secret.
**This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
</ParamField>
<ParamField query="setAccessToken()" deprecatedtype="string" optional>
An access token obtained from the machine identity login endpoint.
**This field is deprecated and will be removed in future versions.** Please use the `setAuth()` method on the client settings instead.
</ParamField>
<ParamField query="setCacheTTL()" type="number" default="300" optional>
Time-to-live (in seconds) for refreshing cached secrets.
If manually set to 0, caching will be disabled, this is not recommended.
</ParamField>
<ParamField query="setSiteURL()" type="string" default="https://app.infisical.com" optional>
Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
</ParamField>
<ParamField query="setSSLCertificatePath()">
Optionally provide a path to a custom SSL certificate file. This can be substituted by setting the `INFISICAL_SSL_CERTIFICATE` environment variable to the contents of the certificate.
</ParamField>
<ParamField query="setAuth()" type="AuthenticationOptions">
The authentication object to use for the client. This is required unless you're using environment variables.
</ParamField>
</Expandable>
</ParamField>
### Authentication
The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
#### Universal Auth
**Using environment variables**
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
UniversalAuthMethod authMethod = new UniversalAuthMethod();
authMethod.setClientID("YOUR_IDENTITY_ID");
authMethod.setClientSecret("YOUR_CLIENT_SECRET");
authOptions.setUniversalAuth(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
```
#### GCP ID Token Auth
<Info>
Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
GCPIDTokenAuthMethod authMethod = new GCPIDTokenAuthMethod();
authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
authOptions.setGcpIDToken(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
```
#### GCP IAM Auth
**Using environment variables**
- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
GCPIamAuthMethod authMethod = new GCPIamAuthMethod();
authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
authMethod.setServiceAccountKeyFilePath("./path/to/your/service-account-key.json");
authOptions.setGcpIam(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
```
#### AWS IAM Auth
<Info>
Please note that this authentication method will only work if you're running your application on AWS.
Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
AWSIamAuthMethod authMethod = new AWSIamAuthMethod();
authMethod.setIdentityID("YOUR_MACHINE_IDENTITY_ID");
authOptions.setAwsIam(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
```
#### Azure Auth
<Info>
Please note that this authentication method will only work if you're running your application on Azure.
Please [read more](/documentation/platform/identities/azure-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AZURE_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
AzureAuthMethod authMethod = new AzureAuthMethod();
authMethod.setIdentityID("YOUR_IDENTITY_ID");
authOptions.setAzure(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
```
#### Kubernetes Auth
<Info>
Please note that this authentication method will only work if you're running your application on Kubernetes.
Please [read more](/documentation/platform/identities/kubernetes-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_KUBERNETES_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
**Using the SDK directly**
```java
ClientSettings settings = new ClientSettings();
AuthenticationOptions authOptions = new AuthenticationOptions();
KubernetesAuthMethod authMethod = new KubernetesAuthMethod();
authMethod.setIdentityID("YOUR_IDENTITY_ID");
authMethod.setServiceAccountTokenPath("/var/run/secrets/kubernetes.io/serviceaccount/token"); // Optional
authOptions.setKubernetes(authMethod);
settings.setAuth(authOptions);
InfisicalClient client = new InfisicalClient(settings);
sdk.Auth().UniversalAuthLogin(
"CLIENT_ID",
"CLIENT_SECRET"
);
```
### Caching
**Parameters:**
- `clientId` (string): The client ID of your Machine Identity.
- `clientSecret` (string): The client secret of your Machine Identity.
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cacheTTL" option when creating the client.
## Working with Secrets
### client.listSecrets(options)
### LDAP Auth
```java
ListSecretsOptions options = new ListSecretsOptions();
options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
options.setPath("/foo/bar");
options.setIncludeImports(false);
options.setRecursive(false);
options.setExpandSecretReferences(true);
SecretElement[] secrets = client.listSecrets(options);
public void LdapAuthLogin(
LdapAuthLoginInput input
)
throws InfisicalException
```
Retrieve all secrets within the Infisical project and environment that client is connected to
#### Methods
<ParamField query="Parameters" type="object">
<Expandable title="properties">
<ParamField query="setEnvironment()" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="setProjectID()" type="string">
The project ID where the secret lives in.
</ParamField>
<ParamField query="setPath()" type="string" optional>
The path from where secrets should be fetched from.
</ParamField>
<ParamField query="setAttachToProcessEnv()" type="boolean" default="false" optional>
Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so `System.getenv("SECRET_NAME")`.
</ParamField>
<ParamField query="setIncludeImports()" type="boolean" default="false" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="setRecursive()" type="boolean" default="false" optional>
Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
</ParamField>
<ParamField query="setExpandSecretReferences()" type="boolean" default="true" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.getSecret(options)
```java
GetSecretOptions options = new GetSecretOptions();
options.setSecretName("TEST");
options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
var input = LdapAuthLoginInput
.builder()
.identityId("<machine-identity-id>")
.username("<ldap-username>")
.password("<ldap-password>")
.build();
GetSecretResponseSecret secret = client.getSecret(options);
String secretValue = secret.getSecretValue();
sdk.Auth().LdapAuthLogin(input);
```
Retrieve a secret from Infisical.
**Parameters:**
- `input` (LdapAuthLoginInput): The input for authenticating with LDAP.
- `identityId` (String): The ID of the machine identity to authenticate with.
- `username` (String): The LDAP username.
- `password` (String): The LDAP password.
By default, `getSecret()` fetches and returns a shared secret.
### Access Token Auth
#### Methods
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="setSecretName()" type="string" required>
The key of the secret to retrieve.
</ParamField>
<ParamField query="setProjectID()" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="setEnvironment()" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="setPath()" type="string" optional>
The path from where secret should be fetched from.
</ParamField>
<ParamField query="setType()" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
<ParamField query="setIncludeImports()" type="boolean" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="setExpandSecretReferences()" type="boolean" default="true" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.createSecret(options)
#### Authenticating
```java
CreateSecretOptions createOptions = new CreateSecretOptions();
createOptions.setSecretName("NEW_SECRET");
createOptions.setEnvironment("dev");
createOptions.setProjectID("PROJECT_ID");
createOptions.setSecretValue("SOME SECRET VALUE");
createOptions.setPath("/"); // Default
createOptions.setType("shared"); // Default
CreateSecretResponseSecret newSecret = client.createSecret(createOptions);
public void SetAccessToken(
String accessToken
)
throws InfisicalException
```
Create a new secret in Infisical.
#### Methods
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="setSecretName()" type="string" required>
The key of the secret to create.
</ParamField>
<ParamField query="setSecretValue()" type="string" required>
The value of the secret.
</ParamField>
<ParamField query="setProjectID()" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="setEnvironment()" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="setPath()" type="string" optional>
The path from where secret should be created.
</ParamField>
<ParamField query="setType()" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
### client.updateSecret(options)
```java
UpdateSecretOptions options = new UpdateSecretOptions();
options.setSecretName("SECRET_TO_UPDATE");
options.setSecretValue("NEW SECRET VALUE");
options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
options.setPath("/"); // Default
options.setType("shared"); // Default
UpdateSecretResponseSecret updatedSecret = client.updateSecret(options);
sdk.Auth().SetAccessToken("ACCESS_TOKEN");
```
Update an existing secret in Infisical.
**Parameters:**
- `accessToken` (string): The access token you want to use for authentication.
#### Methods
### `Secrets`
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="setSecretName()" type="string" required>
The key of the secret to update.
</ParamField>
<ParamField query="setSecretValue()" type="string" required>
The new value of the secret.
</ParamField>
<ParamField query="setProjectID()" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="setEnvironment()" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="setPath()" type="string" optional>
The path from where secret should be updated.
</ParamField>
<ParamField query="setType()" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
This sub-class handles operations related to secrets:
### client.deleteSecret(options)
#### List Secrets
```java
DeleteSecretOptions options = new DeleteSecretOptions();
public List<Secret> ListSecrets(
String projectId,
String environmentSlug,
String secretPath,
Boolean expandSecretReferences,
Boolean recursive,
Boolean includeImports,
Boolean setSecretsOnSystemProperties
)
options.setSecretName("SECRET_TO_DELETE");
options.setEnvironment("dev");
options.setProjectID("PROJECT_ID");
options.setPath("/"); // Default
options.setType("shared"); // Default
DeleteSecretResponseSecret deletedSecret = client.deleteSecret(options);
throws InfisicalException
```
Delete a secret in Infisical.
#### Methods
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="setSecretName()" type="string">
The key of the secret to update.
</ParamField>
<ParamField query="setProjectID()" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="setEnvironment()" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="setPath()" type="string" optional>
The path from where secret should be deleted.
</ParamField>
<ParamField query="setType()" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
## Cryptography
### Create a symmetric key
Create a base64-encoded, 256-bit symmetric key to be used for encryption/decryption.
```java
String key = client.createSymmetricKey();
List<Secret> secrets = sdk.Secrets().ListSecrets(
"<project-id>",
"<env-slug>", // dev, prod, staging, etc.
"/secret/path", // `/` is the root folder
false, // Should expand secret references
false, // Should get secrets recursively from sub folders
false, // Should include imports
false // Should set the fetched secrets as key/value pairs on the system properties. Makes the secrets accessible as System.getProperty("<secret-key>")
);
```
#### Returns (string)
`key` (string): A base64-encoded, 256-bit symmetric key, that can be used for encryption/decryption purposes.
**Parameters:**
- `projectId` (string): The ID of your project.
- `environmentSlug` (string): The environment in which to list secrets (e.g., "dev").
- `secretPath` (string): The path to the secrets.
- `expandSecretReferences` (boolean): Whether to expand secret references.
- `recursive` (boolean): Whether to list secrets recursively.
- `includeImports` (boolean): Whether to include imported secrets.
- `setSecretsOnSystemProperties` (boolean): Set the retrieved secrets as key/value pairs on the system properties, making them accessible through `System.getProperty("<secret-key>")`
**Returns:**
- `List<Secret>`: The response containing the list of secrets.
#### Create Secret
### Encrypt symmetric
```java
EncryptSymmetricOptions options = new EncryptSymmetricOptions();
options.setKey(key);
options.setPlaintext("Infisical is awesome!");
EncryptSymmetricResponse encryptedData = client.encryptSymmetric(options);
public Secret CreateSecret(
String secretName,
String secretValue,
String projectId,
String environmentSlug,
String secretPath
)
throws InfisicalException
```
#### Methods
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="setPlaintext()" type="string">
The plaintext you want to encrypt.
</ParamField>
<ParamField query="setKey()" type="string" required>
The symmetric key to use for encryption.
</ParamField>
</Expandable>
</ParamField>
#### Returns (object)
`tag (getTag())` (string): A base64-encoded, 128-bit authentication tag.
`iv (getIv())` (string): A base64-encoded, 96-bit initialization vector.
`ciphertext (getCipherText())` (string): A base64-encoded, encrypted ciphertext.
### Decrypt symmetric
```java
DecryptSymmetricOptions decryptOptions = new DecryptSymmetricOptions();
decryptOptions.setKey(key);
decryptOptions.setCiphertext(encryptedData.getCiphertext());
decryptOptions.setIv(encryptedData.getIv());
decryptOptions.setTag(encryptedData.getTag());
String decryptedString = client.decryptSymmetric(decryptOptions);
Secret newSecret = sdk.Secrets().CreateSecret(
"NEW_SECRET_NAME",
"secret-value",
"<project-id>",
"<env-slug>", // dev, prod, staging, etc.
"/secret/path", // `/` is the root folder
);
```
#### Methods
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="setCiphertext()" type="string">
The ciphertext you want to decrypt.
</ParamField>
<ParamField query="setKey()" type="string" required>
The symmetric key to use for encryption.
</ParamField>
<ParamField query="setIv()" type="string" required>
The initialization vector to use for decryption.
</ParamField>
<ParamField query="setTag()" type="string" required>
The authentication tag to use for decryption.
</ParamField>
</Expandable>
</ParamField>
**Parameters:**
- `secretName` (string): The name of the secret to create
- `secretValue` (string): The value of the secret.
- `projectId` (string): The ID of your project.
- `environmentSlug` (string): The environment in which to create the secret.
- `secretPath` (string, optional): The path to the secret.
#### Returns (string)
`Plaintext` (string): The decrypted plaintext.
*/}
**Returns:**
- `Secret`: The created secret.
#### Update Secret
```java
public Secret UpdateSecret(
String secretName,
String projectId,
String environmentSlug,
String secretPath,
String newSecretValue,
String newSecretName
)
throws InfisicalException
```
```java
Secret updatedSecret = sdk.Secrets().UpdateSecret(
"SECRET_NAME",
"<project-id>",
"<env-slug>", // dev, prod, staging, etc.
"/secret/path", // `/` is the root folder
"NEW_SECRET_VALUE", // nullable
"NEW_SECRET_NAME" // nullable
);
```
**Parameters:**
- `secretName` (string): The name of the secret to update.
- `projectId` (string): The ID of your project.
- `environmentSlug` (string): The environment in which to update the secret.
- `secretPath` (string): The path to the secret.
- `newSecretValue` (string, nullable): The new value of the secret.
- `newSecretName` (string, nullable): A new name for the secret.
**Returns:**
- `Secret`: The updated secret.
#### Get Secret by Name
```java
public Secret GetSecret(
String secretName,
String projectId,
String environmentSlug,
String secretPath,
Boolean expandSecretReferences,
Boolean includeImports,
String secretType
)
throws InfisicalException
```
```java
Secret secret = sdk.Secrets().GetSecret(
"SECRET_NAME",
"<project-id>",
"<env-slug>", // dev, prod, staging, etc.
"/secret/path", // `/` is the root folder
false, // Should expand secret references
false, // Should get secrets recursively from sub folders
false, // Should include imports
"shared" // Optional Secret Type (defaults to "shared")
);
```
**Parameters:**
- `secretName` (string): The name of the secret to get`
- `projectId` (string): The ID of your project.
- `environmentSlug` (string): The environment in which to retrieve the secret.
- `secretPath` (string): The path to the secret.
- `expandSecretReferences` (boolean, optional): Whether to expand secret references.
- `includeImports` (boolean, optional): Whether to include imported secrets.
- `secretType` (personal | shared, optional): The type of secret to fetch.
**Returns:**
- `Secret`: The fetched secret.
#### Delete Secret by Name
```java
public Secret DeleteSecret(
String secretName,
String projectId,
String environmentSlug,
String secretPath
)
throws InfisicalException
```
```java
Secret deletedSecret = sdk.Secrets().DeleteSecret(
"SECRET_NAME",
"<project-id>",
"<env-slug>", // dev, prod, staging, etc.
"/secret/path", // `/` is the root folder
);
```
**Parameters:**
- `secretName` (string): The name of the secret to delete.
- `projectId` (string): The ID of your project.
- `environmentSlug` (string): The environment in which to delete the secret.
- `secretPath` (string, optional): The path to the secret.
**Returns:**
- `Secret`: The deleted secret.
### `Folders`
#### Get Folder By Name
```java
public Folder Get(
String folderId
);
throws InfisicalException
```
```java
Folder folder = sdk.Folders().Get("<folder-id>");
```
**Parameters:**
- `folderId` (String): The ID of the folder to retrieve.
**Returns:**
- `Folder`: The retrieved folder.
#### List Folders
```java
public List<Folder> List(
ListFoldersInput input
)
throws InfisicalException
```
```java
ListFoldersInput input = ListFoldersInput
.builder()
.projectId("<your-project-id>")
.environmentSlug("<env-slug>")
.folderPath("/")
.recursive(false)
.build();
List<Folder> folders = sdk.Folders().List(input);
```
**Parameters:**
- `input` (ListFoldersInput): The input for listing folders.
- `projectId` (String): The ID of the project to list folders from.
- `environmentSlug` (String): The slug of the environment to list folders from.
- `folderPath` (String): The path to list folders from. Defaults to `/`.
- `recursive` (Boolean): Whether or not to list sub-folders recursively from the specified folder path and downwards. Defaults to `false`.
**Returns:**
- `List<Folder>`: The retrieved folders.
#### Create Folder
```java
public Folder Create(
CreateFolderInput input
)
throws InfisicalException
```
```java
var input = CreateFolderInput
.builder()
.projectId("<your-project-id>")
.environmentSlug("<env-slug>")
.folderName("<folder-name>")
.folderPath("/")
.description("Optional folder description")
.build();
Folder createdFolder = sdk.Folders().Create(input);
```
**Parameters:**
- `input` (CreateFolderInput): The input for creating a folder.
- `projectId` (String): The ID of the project to create the folder in.
- `environmentSlug` (String): The slug of the environment to create the folder in.
- `folderPath` (String): The path to create the folder in. Defaults to `/`.
- `folderName` (String): The name of the folder to create.
- `description` (String): The description of the folder to create. This is optional.
**Returns:**
- `Folder`: The created folder.
#### Update Folder
```java
public Folder Update(
UpdateFolderInput input
)
throws InfisicalException
```
```java
var input = UpdateFolderInput
.builder()
.projectId("<your-project-id>")
.environmentSlug("<env-slug>")
.folderId("<id-of-folder-to-update>")
.newFolderName("<the-new-folder-name>")
.folderPath("/")
.build();
Folder updatedFolder = sdk.Folders().Update(input);
```
**Parameters:**
- `input` (UpdateFolderInput): The input for updating a folder.
- `projectId` (String): The ID of the project where the folder exists.
- `environmentSlug` (String): The slug of the environment where the folder exists.
- `folderPath` (String): The path of the folder to update.
- `folderId` (String): The ID of the folder to update.
- `newFolderName` (String): The new folder name.
**Returns:**
- `Folder`: The updated folder.
#### Delete Folder
```java
public Folder Delete(
DeleteFolderInput input
)
throws InfisicalException
```
```java
var input = DeleteFolderInput
.builder()
.folderId("<the-folder-id>")
.environmentSlug("<env-slug>")
.projectId("<your-project-id>")
.build();
Folder deletedFolder = sdk.Folders().Delete(input);
```
**Parameters:**
- `input` (DeleteFolderInput): The input for deleting a folder.
- `projectId` (String): The ID of the project where the folder exists.
- `environmentSlug` (String): The slug of the environment where the folder exists.
- `folderId` (String): The ID of the folder to delete.
**Returns:**
- `Folder`: The deleted folder.

1017
docs/sdks/languages/node.mdx
View File

File diff suppressed because it is too large Load Diff

833
docs/sdks/languages/python.mdx
View File

@@ -1,533 +1,418 @@
---
title: "Infisical Python SDK"
sidebarTitle: "Python"
url: "https://github.com/Infisical/python-sdk-official?tab=readme-ov-file#infisical-python-sdk"
icon: "/images/sdks/languages/python.svg"
---
{/* If you're working with Python, the official [infisical-python](https://github.com/Infisical/sdk/edit/main/crates/infisical-py) package is the easiest way to fetch and work with secrets for your application.
If you're working with Python, the official Infisical Python SDK package is the easiest way to fetch and work with secrets for your application.
- [PyPi Package](https://pypi.org/project/infisical-python/)
- [Github Repository](https://github.com/Infisical/sdk/edit/main/crates/infisical-py)
### Migrating to version 1.0.3 or above
## Basic Usage
We have recently rolled out our first stable version of the SDK, version `1.0.3` and above.
```py
from flask import Flask
from infisical_client import ClientSettings, InfisicalClient, GetSecretOptions, AuthenticationOptions, UniversalAuthMethod
The 1.0.3 version comes with a few key changes that may change how you're using the SDK.
1. **Removal of `rest`**: The SDK no longer exposes the entire Infisical API. This was nessecary as we have moved away from using an OpenAPI generator approach. We aim to add support for more API resources in the near future. If you have any specific requests, please [open an issue](https://github.com/Infisical/python-sdk-official/issues).
app = Flask(__name__)
2. **New response types**: The 1.0.3 release uses return types that differ from the older versions. The new return types such as `BaseSecret`, are all exported from the Infisical SDK.
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
universal_auth=UniversalAuthMethod(
client_id="CLIENT_ID",
client_secret="CLIENT_SECRET",
)
)
))
3. **Property renaming**: Some properties on the responses have been slightly renamed. An example of this would be that the `secret_key` property on the `get_secret_by_name()` method, that has been renamed to `secretKey`.
@app.route("/")
def hello_world():
# access value
With this in mind, you're ready to upgrade your SDK version to `1.0.3` or above.
name = client.getSecret(options=GetSecretOptions(
environment="dev",
project_id="PROJECT_ID",
secret_name="NAME"
))
You can refer to our [legacy documentation](https://github.com/Infisical/python-sdk-official/tree/9b0403938ee5ae599d42c5f1fdf9158671a15606?tab=readme-ov-file#infisical-python-sdk) if need be.
return f"Hello! My name is: {name.secret_value}"
```
## Requirements
This example demonstrates how to use the Infisical Python SDK with a Flask application. The application retrieves a secret named "NAME" and responds to requests with a greeting that includes the secret value.
<Warning>
We do not recommend hardcoding your [Machine Identity Tokens](/platform/identities/overview). Setting it as an environment variable would be best.
</Warning>
Python 3.7+
## Installation
Run `pip` to add `infisical-python` to your project
```console
$ pip install infisical-python
```bash
pip install infisicalsdk
```
Note: You need Python 3.7+.
## Getting Started
## Configuration
```python
from infisical_sdk import InfisicalSDKClient
Import the SDK and create a client instance with your [Machine Identity](/api-reference/overview/authentication).
# Initialize the client
client = InfisicalSDKClient(host="https://app.infisical.com")
```py
from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, UniversalAuthMethod
# Authenticate (example using Universal Auth)
client.auth.universal_auth.login(
client_id="<machine-identity-client-id>",
client_secret="<machine-identity-client-secret>"
)
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
universal_auth=UniversalAuthMethod(
client_id="CLIENT_ID",
client_secret="CLIENT_SECRET",
)
)
))
# Use the SDK to interact with Infisical
secrets = client.secrets.list_secrets(project_id="<project-id>", environment_slug="dev", secret_path="/")
```
#### Parameters
## InfisicalSDKClient Parameters
<ParamField query="options" type="object">
<Expandable title="properties">
<ParamField query="client_id" type="string" deprecated optional>
Your Infisical Client ID.
The `InfisicalSDKClient` takes the following parameters, which are used as a global configuration for the lifetime of the SDK instance.
**This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
</ParamField>
<ParamField query="client_secret" type="string" deprecated optional>
Your Infisical Client Secret.
- **host** (`str`, _Optional_): The host URL for your Infisical instance. Defaults to `https://app.infisical.com`.
- **token** (`str`, _Optional_): Specify an authentication token to use for all requests. If provided, you will not need to call any of the `auth` methods. Defaults to `None`
- **cache_ttl** (`int`, _Optional_): The SDK has built-in client-side caching for secrets, greatly improving response times. By default, secrets are cached for 1 minute (60 seconds). You can disable caching by setting `cache_ttl` to `None`, or adjust the duration in seconds as needed.
**This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
</ParamField>
<ParamField query="access_token" type="string" deprecated optional>
If you want to directly pass an access token obtained from the authentication endpoints, you can do so.
```python
client = InfisicalSDKClient(
host="https://app.infisical.com", # Defaults to https://app.infisical.com
token="<optional-auth-token>", # If not set, use the client.auth() methods.
cache_ttl = 300 # `None` to disable caching
)
```
**This field is deprecated and will be removed in future versions.** Please use the `auth` field instead.
</ParamField>
## Core Methods
<ParamField query="cache_ttl" type="number" default="300" optional>
Time-to-live (in seconds) for refreshing cached secrets.
If manually set to 0, caching will be disabled, this is not recommended.
</ParamField>
The SDK methods are organized into the following high-level categories:
<ParamField query="site_url" type="string" default="https://app.infisical.com" optional>
Your self-hosted absolute site URL including the protocol (e.g. `https://app.infisical.com`)
</ParamField>
1. `auth`: Handles authentication methods.
2. `secrets`: Manages CRUD operations for secrets.
3. `kms`: Perform cryptographic operations with Infisical KMS.
<ParamField query="ssl_certificate_path" optional>
Optionally provide a path to a custom SSL certificate file. This can be substituted by setting the `INFISICAL_SSL_CERTIFICATE` environment variable to the contents of the certificate.
</ParamField>
### `auth`
<ParamField query="auth" type="AuthenticationOptions">
The authentication object to use for the client. This is required unless you're using environment variables.
</ParamField>
</Expandable>
</ParamField>
### Authentication
The SDK supports a variety of authentication methods. The most common authentication method is Universal Auth, which uses a client ID and client secret to authenticate.
The `Auth` component provides methods for authentication:
#### Universal Auth
**Using environment variables**
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_ID` - Your machine identity client ID.
- `INFISICAL_UNIVERSAL_AUTH_CLIENT_SECRET` - Your machine identity client secret.
**Using the SDK directly**
```python3
from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, UniversalAuthMethod
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
universal_auth=UniversalAuthMethod(
client_id="CLIENT_ID",
client_secret="CLIENT_SECRET",
)
)
))
```
#### GCP ID Token Auth
<Info>
Please note that this authentication method will only work if you're running your application on Google Cloud Platform.
Please [read more](/documentation/platform/identities/gcp-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_GCP_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```py
from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, GCPIDTokenAuthMethod
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
gcp_id_token=GCPIDTokenAuthMethod(
identity_id="MACHINE_IDENTITY_ID",
)
)
))
```
#### GCP IAM Auth
**Using environment variables**
- `INFISICAL_GCP_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_GCP_IAM_SERVICE_ACCOUNT_KEY_FILE_PATH` - The path to your GCP service account key file.
**Using the SDK directly**
```py
from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, GCPIamAuthMethod
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
gcp_iam=GCPIamAuthMethod(
identity_id="MACHINE_IDENTITY_ID",
service_account_key_file_path="./path/to/service_account_key.json"
)
)
))
```
#### AWS IAM Auth
<Info>
Please note that this authentication method will only work if you're running your application on AWS.
Please [read more](/documentation/platform/identities/aws-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AWS_IAM_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```py
from infisical_client import ClientSettings, InfisicalClient, AuthenticationOptions, AWSIamAuthMethod
client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
aws_iam=AWSIamAuthMethod(identity_id="MACHINE_IDENTITY_ID")
)
))
```
#### Azure Auth
<Info>
Please note that this authentication method will only work if you're running your application on Azure.
Please [read more](/documentation/platform/identities/azure-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_AZURE_AUTH_IDENTITY_ID` - Your Infisical Machine Identity ID.
**Using the SDK directly**
```python
from infisical_client import InfisicalClient, ClientSettings, AuthenticationOptions, AzureAuthMethod
kubernetes_client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
azure=AzureAuthMethod(
identity_id="YOUR_IDENTITY_ID",
)
)
))
response = client.auth.universal_auth.login(
client_id="<machine-identity-client-id>",
client_secret="<machine-identity-client-secret>"
)
```
#### AWS Auth
#### Kubernetes Auth
<Info>
Please note that this authentication method will only work if you're running your application on Kubernetes.
Please [read more](/documentation/platform/identities/kubernetes-auth) about this authentication method.
</Info>
**Using environment variables**
- `INFISICAL_KUBERNETES_IDENTITY_ID` - Your Infisical Machine Identity ID.
- `INFISICAL_KUBERNETES_SERVICE_ACCOUNT_TOKEN_PATH_ENV_NAME` - The environment variable name that contains the path to the service account token. This is optional and will default to `/var/run/secrets/kubernetes.io/serviceaccount/token`.
**Using the SDK directly**
```python
from infisical_client import InfisicalClient, ClientSettings, AuthenticationOptions, KubernetesAuthMethod
kubernetes_client = InfisicalClient(ClientSettings(
auth=AuthenticationOptions(
kubernetes=KubernetesAuthMethod(
identity_id="YOUR_IDENTITY_ID",
service_account_token_path="/var/run/secrets/kubernetes.io/serviceaccount/token" # Optional
)
)
))
response = client.auth.aws_auth.login(identity_id="<machine-identity-id>")
```
### Caching
#### OIDC Auth
To reduce the number of API requests, the SDK temporarily stores secrets it retrieves. By default, a secret remains cached for 5 minutes after it's first fetched. Each time it's fetched again, this 5-minute timer resets. You can adjust this caching duration by setting the "cache_ttl" option when creating the client.
## Working with Secrets
### client.listSecrets(options)
```py
client.listSecrets(options=ListSecretsOptions(
environment="dev",
project_id="PROJECT_ID"
))
```
Retrieve all secrets within the Infisical project and environment that client is connected to
#### Parameters
<ParamField query="Parameters" type="object">
<Expandable title="properties">
<ParamField query="environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="project_id" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="path" type="string" optional>
The path from where secrets should be fetched from.
</ParamField>
<ParamField query="attach_to_process_env" type="boolean" default="false" optional>
Whether or not to set the fetched secrets to the process environment. If true, you can access the secrets like so `process.env["SECRET_NAME"]`.
</ParamField>
<ParamField query="recursive" type="boolean" default="false" optional>
Whether or not to fetch secrets recursively from the specified path. Please note that there's a 20-depth limit for recursive fetching.
</ParamField>
<ParamField query="expand_secret_references" type="boolean" default="true" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="include_imports" type="boolean" default="false" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.getSecret(options)
```py
secret = client.getSecret(options=GetSecretOptions(
environment="dev",
project_id="PROJECT_ID",
secret_name="API_KEY"
))
value = secret.secret_value # get its value
```
By default, `getSecret()` fetches and returns a shared secret. If not found, it returns a personal secret.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="secret_name" type="string" required>
The key of the secret to retrieve
</ParamField>
<ParamField query="include_imports" type="boolean">
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="project_id" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="path" type="string" optional>
The path from where secret should be fetched from.
</ParamField>
<ParamField query="type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "personal".
</ParamField>
<ParamField query="include_imports" type="boolean" default="false" optional>
Whether or not to include imported secrets from the current path. Read about [secret import](/documentation/platform/secret-reference)
</ParamField>
<ParamField query="expand_secret_references" type="boolean" default="true" optional>
Whether or not to expand secret references in the fetched secrets. Read about [secret reference](/documentation/platform/secret-reference)
</ParamField>
</Expandable>
</ParamField>
### client.createSecret(options)
```py
api_key = client.createSecret(options=CreateSecretOptions(
secret_name="API_KEY",
secret_value="Some API Key",
environment="dev",
project_id="PROJECT_ID"
))
```
Create a new secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="secret_name" type="string" required>
The key of the secret to create.
</ParamField>
<ParamField query="secret_value" type="string" required>
The value of the secret.
</ParamField>
<ParamField query="project_id" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="path" type="string" optional>
The path from where secret should be created.
</ParamField>
<ParamField query="type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
### client.updateSecret(options)
```py
client.updateSecret(options=UpdateSecretOptions(
secret_name="API_KEY",
secret_value="NEW_VALUE",
environment="dev",
project_id="PROJECT_ID"
))
```
Update an existing secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="secret_name" type="string" required>
The key of the secret to update.
</ParamField>
<ParamField query="secret_value" type="string" required>
The new value of the secret.
</ParamField>
<ParamField query="project_id" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="path" type="string" optional>
The path from where secret should be updated.
</ParamField>
<ParamField query="type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
### client.deleteSecret(options)
```py
client.deleteSecret(options=DeleteSecretOptions(
environment="dev",
project_id="PROJECT_ID",
secret_name="API_KEY"
))
```
Delete a secret in Infisical.
#### Parameters
<ParamField query="Parameters" type="object" optional>
<Expandable title="properties">
<ParamField query="secret_name" type="string">
The key of the secret to update.
</ParamField>
<ParamField query="project_id" type="string" required>
The project ID where the secret lives in.
</ParamField>
<ParamField query="environment" type="string" required>
The slug name (dev, prod, etc) of the environment from where secrets should be fetched from.
</ParamField>
<ParamField query="path" type="string" optional>
The path from where secret should be deleted.
</ParamField>
<ParamField query="type" type="string" optional>
The type of the secret. Valid options are "shared" or "personal". If not specified, the default value is "shared".
</ParamField>
</Expandable>
</ParamField>
## Cryptography
### Create a symmetric key
Create a base64-encoded, 256-bit symmetric key to be used for encryption/decryption.
```py
key = client.createSymmetricKey()
```
#### Returns (string)
`key` (string): A base64-encoded, 256-bit symmetric key, that can be used for encryption/decryption purposes.
### Encrypt symmetric
```py
encryptOptions = EncryptSymmetricOptions(
key=key,
plaintext="Infisical is awesome!"
```python
response = client.auth.oidc_auth.login(
identity_id="<oidc-identity-id>",
jwt="<your-oidc-jwt-token>"
)
encryptedData = client.encryptSymmetric(encryptOptions)
```
#### Parameters
**Parameters:**
- `identity_id` (str): The ID of the OIDC identity configuration in Infisical.
- `jwt` (str): The OIDC JWT token obtained from your identity provider.
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="plaintext" type="string">
The plaintext you want to encrypt.
</ParamField>
<ParamField query="key" type="string" required>
The symmetric key to use for encryption.
</ParamField>
</Expandable>
</ParamField>
This authentication method is useful when integrating with OIDC-compliant identity providers like Okta, Auth0, or any service that issues OIDC tokens.
#### Returns (object)
### `secrets`
`tag` (string): A base64-encoded, 128-bit authentication tag. `iv` (string): A base64-encoded, 96-bit initialization vector. `ciphertext` (string): A base64-encoded, encrypted ciphertext.
This sub-class handles operations related to secrets:
### Decrypt symmetric
#### List Secrets
```py
decryptOptions = DecryptSymmetricOptions(
ciphertext=encryptedData.ciphertext,
iv=encryptedData.iv,
tag=encryptedData.tag,
key=key
```python
secrets = client.secrets.list_secrets(
project_id="<project-id>",
environment_slug="dev",
secret_path="/",
expand_secret_references=True, # Optional
view_secret_value=True, # Optional
recursive=False, # Optional
include_imports=True, # Optional
tag_filters=[] # Optional
)
decryptedString = client.decryptSymmetric(decryptOptions)
```
#### Parameters
**Parameters:**
- `project_id` (str): The ID of your project.
- `project_slug` (str): The slug of your project.
- `environment_slug` (str): The environment in which to list secrets (e.g., "dev").
- `secret_path` (str): The path to the secrets.
- `expand_secret_references` (bool): Whether to expand secret references.
- `view_secret_value` (bool): Whether or not to include the secret value in the response. If set to false, the `secretValue` will be masked with `<hidden-by-infisical>`. Defaults to true.
- `recursive` (bool): Whether to list secrets recursively.
- `include_imports` (bool): Whether to include imported secrets.
- `tag_filters` (List[str]): Tags to filter secrets.
<ParamField query="Parameters" type="object" required>
<Expandable title="properties">
<ParamField query="ciphertext" type="string">
The ciphertext you want to decrypt.
</ParamField>
<ParamField query="key" type="string" required>
The symmetric key to use for encryption.
</ParamField>
<ParamField query="iv" type="string" required>
The initialization vector to use for decryption.
</ParamField>
<ParamField query="tag" type="string" required>
The authentication tag to use for decryption.
</ParamField>
</Expandable>
</ParamField>
**Note:** Exactly one of `project_id` or `project_slug` is required. If both are provided, `project_id` takes precedence.
#### Returns (string)
**Returns:**
- `ListSecretsResponse`: The response containing the list of secrets.
`plaintext` (string): The decrypted plaintext. */}
#### Create Secret
```python
new_secret = client.secrets.create_secret_by_name(
secret_name="NEW_SECRET",
project_id="<project-id>",
secret_path="/",
environment_slug="dev",
secret_value="secret_value",
secret_comment="Optional comment",
skip_multiline_encoding=False,
secret_reminder_repeat_days=30, # Optional
secret_reminder_note="Remember to update this secret", # Optional
secret_metadata=[{"key": "metadata_key", "value": "metadata_value"}], # Optional
tags_ids=["tag_id_1", "tag_id_2"] # Optional
)
```
**Parameters:**
- `secret_name` (str): The name of the secret.
- `project_id` (str): The ID of your project.
- `project_slug` (str): The slug of your project.
- `secret_path` (str): The path to the secret.
- `environment_slug` (str): The environment in which to create the secret.
- `secret_value` (str): The value of the secret.
- `secret_comment` (str, optional): A comment associated with the secret.
- `skip_multiline_encoding` (bool, optional): Whether to skip encoding for multiline secrets.
- `secret_reminder_repeat_days` (Union[float, int], optional): Number of days after which to repeat secret reminders.
- `secret_reminder_note` (str, optional): A note for the secret reminder.
- `secret_metadata` (List[Dict[str, Any]], optional): Metadata associated with the secret.
- `tags_ids` (List[str], optional): IDs of tags to associate with the secret.
**Note:** Exactly one of `project_id` or `project_slug` is required. If both are provided, `project_id` takes precedence.
**Returns:**
- `BaseSecret`: The response after creating the secret.
#### Update Secret
```python
updated_secret = client.secrets.update_secret_by_name(
current_secret_name="EXISTING_SECRET",
project_id="<project-id>",
project_slug="<project-slug>",
secret_path="/",
environment_slug="dev",
secret_value="new_secret_value",
secret_comment="Updated comment", # Optional
skip_multiline_encoding=False,
secret_reminder_repeat_days=30, # Optional
secret_reminder_note="Updated reminder note", # Optional
new_secret_name="NEW_NAME", # Optional
secret_metadata=[{"key": "metadata_key", "value": "metadata_value"}], # Optional
tags_ids=["tag_id_1", "tag_id_2"] # Optional
)
```
**Parameters:**
- `current_secret_name` (str): The current name of the secret.
- `project_id` (str): The ID of your project.
- `project_slug` (str): The slug of your project.
- `secret_path` (str): The path to the secret.
- `environment_slug` (str): The environment in which to update the secret.
- `secret_value` (str, optional): The new value of the secret.
- `secret_comment` (str, optional): An updated comment associated with the secret.
- `skip_multiline_encoding` (bool, optional): Whether to skip encoding for multiline secrets.
- `secret_reminder_repeat_days` (Union[float, int], optional): Updated number of days after which to repeat secret reminders.
- `secret_reminder_note` (str, optional): An updated note for the secret reminder.
- `new_secret_name` (str, optional): A new name for the secret.
- `secret_metadata` (List[Dict[str, Any]], optional): Metadata associated with the secret.
- `tags_ids` (List[str], optional): IDs of tags to associate with the secret.
**Note:** Exactly one of `project_id` or `project_slug` is required. If both are provided, `project_id` takes precedence.
**Returns:**
- `BaseSecret`: The response after updating the secret.
#### Get Secret by Name
```python
secret = client.secrets.get_secret_by_name(
secret_name="EXISTING_SECRET",
project_id="<project-id>",
environment_slug="dev",
secret_path="/",
expand_secret_references=True, # Optional
view_secret_value=True, # Optional
include_imports=True, # Optional
version=None # Optional
)
```
**Parameters:**
- `secret_name` (str): The name of the secret.
- `project_id` (str): The ID of your project.
- `project_slug` (str): The slug of your project.
- `environment_slug` (str): The environment in which to retrieve the secret.
- `secret_path` (str): The path to the secret.
- `expand_secret_references` (bool): Whether to expand secret references.
- `view_secret_value` (bool): Whether or not to include the secret value in the response. If set to false, the `secretValue` will be masked with `<hidden-by-infisical>`. Defaults to true.
- `include_imports` (bool): Whether to include imported secrets.
- `version` (str, optional): The version of the secret to retrieve. Fetches the latest by default.
**Note:** Exactly one of `project_id` or `project_slug` is required. If both are provided, `project_id` takes precedence.
**Returns:**
- `BaseSecret`: The response containing the secret.
#### Delete Secret by Name
```python
deleted_secret = client.secrets.delete_secret_by_name(
secret_name="EXISTING_SECRET",
project_id="<project-id>",
environment_slug="dev",
secret_path="/"
)
```
**Parameters:**
- `secret_name` (str): The name of the secret to delete.
- `project_id` (str): The ID of your project.
- `project_slug` (str): The slug of your project.
- `environment_slug` (str): The environment in which to delete the secret.
- `secret_path` (str): The path to the secret.
**Note:** Exactly one of `project_id` or `project_slug` is required. If both are provided, `project_id` takes precedence.
**Returns:**
- `BaseSecret`: The response after deleting the secret.
### `kms`
This sub-class handles KMS related operations:
#### List KMS Keys
```python
kms_keys = client.kms.list_keys(
project_id="<project-id>",
offset=0, # Optional
limit=100, # Optional
order_by=KmsKeysOrderBy.NAME, # Optional
order_direction=OrderDirection.ASC, # Optional
search=None # Optional
)
```
**Parameters:**
- `project_id` (str): The ID of your project.
- `offset` (int, optional): The offset to paginate from.
- `limit` (int, optional): The page size for paginating.
- `order_by` (KmsKeysOrderBy, optional): The key property to order the list response by.
- `order_direction` (OrderDirection, optional): The direction to order the list response in.
- `search` (str, optional): The text value to filter key names by.
**Returns:**
- `ListKmsKeysResponse`: The response containing the list of KMS keys.
#### Get KMS Key by ID
```python
kms_key = client.kms.get_key_by_id(
key_id="<key-id>"
)
```
**Parameters:**
- `key_id` (str): The ID of the key to retrieve.
**Returns:**
- `KmsKey`: The specified key.
#### Get KMS Key by Name
```python
kms_key = client.kms.get_key_by_name(
key_name="my-key",
project_id="<project-id>"
)
```
**Parameters:**
- `key_name` (str): The name of the key to retrieve.
- `project_id` (str): The ID of your project.
**Returns:**
- `KmsKey`: The specified key.
#### Create KMS Key
```python
kms_key = client.kms.create_key(
name="my-key",
project_id="<project-id>",
encryption_algorithm=SymmetricEncryption.AES_GCM_256,
description=None # Optional
)
```
**Parameters:**
- `name` (str): The name of the key (must be slug-friendly).
- `project_id` (str): The ID of your project.
- `encryption_algorithm` (SymmetricEncryption): The encryption algorithm this key should use.
- `description` (str, optional): A description of your key.
**Returns:**
- `KmsKey`: The newly created key.
#### Update KMS Key
```python
updated_key = client.kms.update_key(
key_id="<key-id>",
name="my-updated-key", # Optional
description="Updated description", # Optional
is_disabled=True # Optional
)
```
**Parameters:**
- `key_id` (str): The ID of the key to be updated.
- `name` (str, optional): The updated name of the key (must be slug-friendly).
- `description` (str): The updated description of the key.
- `is_disabled` (str): The flag to disable operations with this key.
**Returns:**
- `KmsKey`: The updated key.
#### Delete KMS Key
```python
deleted_key = client.kms.delete_key(
key_id="<key-id>"
)
```
**Parameters:**
- `key_id` (str): The ID of the key to be deleted.
**Returns:**
- `KmsKey`: The deleted key.
#### Encrypt Data with KMS Key
```python
encrypted_data = client.kms.encrypt_data(
key_id="<key-id>",
base64EncodedPlaintext="TXkgc2VjcmV0IG1lc3NhZ2U=" # must be base64 encoded
)
```
**Parameters:**
- `key_id` (str): The ID of the key to encrypt the data with.
- `base64EncodedPlaintext` (str): The plaintext data to encrypt (must be base64 encoded).
**Returns:**
- `str`: The encrypted ciphertext.
#### Decrypt Data with KMS Key
```python
decrypted_data = client.kms.decrypt_data(
key_id="<key-id>",
ciphertext="Aq96Ry7sMH3k/ogaIB5MiSfH+LblQRBu69lcJe0GfIvI48ZvbWY+9JulyoQYdjAx"
)
```
**Parameters:**
- `key_id` (str): The ID of the key to decrypt the data with.
- `ciphertext` (str): The ciphertext returned from the encrypt operation.
**Returns:**
- `str`: The base64 encoded plaintext.

4
docs/sdks/languages/ruby.mdx
View File

@@ -4,9 +4,7 @@ sidebarTitle: "Ruby"
icon: "/images/sdks/languages/ruby.svg"
---
If you're working with Ruby, the official [Infisical Ruby SDK](https://github.com/infisical/sdk) package is the easiest way to fetch and work with secrets for your application.
If you're working with Ruby, the official Infisical Ruby SDK package is the easiest way to fetch and work with secrets for your application.
- [Ruby Package](https://rubygems.org/gems/infisical-sdk)
- [Github Repository](https://github.com/infisical/sdk)

493
docs/sdks/languages/rust.mdx
View File

@@ -2,5 +2,494 @@
title: "Infisical Rust SDK"
sidebarTitle: "Rust"
icon: "/images/sdks/languages/rust.svg"
url: "https://github.com/Infisical/rust-sdk?tab=readme-ov-file#infisical--the-official-infisical-rust-sdk"
---
---
If you're working with Rust, the official Infisical Rust SDK package is the easiest way to fetch and work with secrets for your application.
### Installation
```bash
cargo add infisical
```
### Getting Started
The easiest way to get started is to use the builder pattern for both the client and your requests.
```rust
use infisical::{AuthMethod, Client, InfisicalError, encode_base64, decode_base64};
use infisical::secrets::GetSecretRequest;
async fn fetch_secret() -> Result<(), InfisicalError> {
// 1. Build the client. You can chain methods to configure it.
let mut client = Client::builder()
.base_url("https://app.infisical.com") // Optional: defaults to https://app.infisical.com
.build()
.await?;
// 2. Set up your authentication method and log in.
let auth_method = AuthMethod::new_universal_auth("<your-client-id>", "<your-client-secret>");
client.login(auth_method).await?;
// 3. Build a request to get a secret.
// Required parameters (name, project_id, environment) are passed to `builder()`.
let request = GetSecretRequest::builder("API_KEY", "<your-project-id>", "dev")
.path("/") // Optional parameters are set with builder methods.
.build();
// 4. Make the API call.
let secret = client.secrets().get(request).await?;
println!("Fetched secret key: {}", secret.secret_key);
// For security, avoid printing the secret value in production code!
// println!("Secret value: {}", secret.secret_value);
Ok(())
}
```
### Client Configuration
The `Client::builder()` provides several configuration options:
```rust
let mut client = Client::builder()
.base_url("https://app.infisical.com") // Optional: set custom Infisical instance URL
.build()
.await?;
```
**Parameters**
- `.base_url(url)`: Optional method to set the Infisical instance URL. Defaults to `https://app.infisical.com` for Infisical Cloud. Use `https://eu.infisical.com` for EU and `http://localhost:8080` for local development.
### Core Methods
The SDK methods are organized into the following high-level categories:
- `Client::builder()`: The main entry point for creating a client.
- `client.login()`: Allows client to make authenticated requests to the API.
- `client.secrets()`: Provides access to all CRUD operations for secrets.
- `client.kms()`: Provides access to all KMS (Key Management Service) operations.
### Helper Functions
The SDK provides utility functions for common operations:
```rust
use infisical::{encode_base64, decode_base64};
// Base64 encode a string
let encoded = encode_base64("sensitive data");
println!("Encoded: {}", encoded);
// Base64 decode a string
let decoded = decode_base64(&encoded)?;
println!("Decoded: {}", decoded);
```
**Available Functions**
- `encode_base64(data: &str) -> String`: Encodes a string as base64
- `decode_base64(data: &str) -> Result<String, InfisicalError>`: Decodes a base64 string
### `secrets`
All secret operations are accessed via `client.secrets()`. Each operation has a dedicated request builder.
#### Create Secret
Create a new secret in your project.
**Example**
```rust
use infisical::secrets::CreateSecretRequest;
let request = CreateSecretRequest::builder(
"API_KEY",
"your-secret-value",
"<your-project-id>",
"dev"
)
.path("/")
.secret_comment("A comment for the new secret")
.build();
let created_secret = client.secrets().create(request).await?;
```
**Parameters**
- `secret_name`, `secret_value`, `project_id`, `environment`: Required parameters passed to the `builder()` function.
- `.path(path)`: Optional method to set the secret's path (defaults to `/`).
- `.secret_comment(comment)`: Optional method to add a comment.
- `.skip_multiline_encoding(bool)`: Optional method to control multiline encoding (defaults to `false`).
- `.r#type(type)`: Optional method to set the secret type (`shared` or `personal`), defaults to `shared`.
#### Get Secret
Retrieve a specific secret by name.
**Example**
```rust
use infisical::secrets::GetSecretRequest;
let request = GetSecretRequest::builder("API_KEY", "<your-project-id>", "dev")
.path("/")
.build();
let secret = client.secrets().get(request).await?;
```
**Parameters**
- `secret_name`, `project_id`, `environment`: Required parameters passed to the `builder()` function.
- `.path(path)`: Optional method to set the secret's path (defaults to `/`).
- `.expand_secret_references(bool)`: Optional method to control secret reference expansion (defaults to `true`).
- `.r#type(type)`: Optional method to set the secret type (`shared` or `personal`), defaults to `shared`.
#### List Secrets
List all secrets in a project and environment.
**Example**
```rust
use infisical::secrets::ListSecretsRequest;
let request = ListSecretsRequest::builder("<your-project-id>", "dev")
.path("/")
.recursive(true)
.build();
let secrets = client.secrets().list(request).await?;
```
**Parameters**
- `project_id`, `environment`: Required parameters passed to the `builder()` function.
- `.path(path)`: Optional method to set the path from which to list secrets (defaults to `/`).
- `.expand_secret_references(bool)`: Optional method to control secret reference expansion (defaults to `true`).
- `.recursive(bool)`: Optional method to recursively list secrets from sub-folders (defaults to `false`).
- `.attach_to_process_env(bool)`: Optional method to attach fetched secrets to the current process's environment variables (defaults to `false`).
#### Update Secret
Update an existing secret.
**Example**
```rust
use infisical::secrets::UpdateSecretRequest;
let request = UpdateSecretRequest::builder("API_KEY", "<your-project-id>", "dev")
.secret_value("new-secret-value") // Set the new value
.build();
let updated_secret = client.secrets().update(request).await?;
```
**Parameters**
- `secret_name`, `project_id`, `environment`: Required parameters passed to the `builder()` function.
- `.new_secret_name(name)`: Optional method to rename the secret.
- `.secret_value(value)`: Optional method to set a new value for the secret.
- `.path(path)`: Optional method to set the secret's path.
- `.secret_comment(comment)`: Optional method to add or change the comment.
- `.skip_multiline_encoding(bool)`: Optional method to control multiline encoding.
- `.r#type(type)`: Optional method to set the secret type (`shared` or `personal`).
#### Delete Secret
Delete a secret from your project.
**Example**
```rust
use infisical::secrets::DeleteSecretRequest;
let request = DeleteSecretRequest::builder("API_KEY", "<your-project-id>", "dev")
.path("/")
.build();
let deleted_secret = client.secrets().delete(request).await?;
```
**Parameters**
- `secret_name`, `project_id`, `environment`: Required parameters passed to the `builder()` function.
- `.path(path)`: Optional method to set the secret's path (defaults to `/`).
- `.r#type(type)`: Optional method to set the secret type (`shared` or `personal`), defaults to `shared`.
### `kms`
All KMS (Key Management Service) operations are accessed via `client.kms()`. Each operation has a dedicated request builder.
#### List KMS Keys
List all KMS keys in a project.
**Example**
```rust
use infisical::kms::ListKmsKeysRequest;
let request = ListKmsKeysRequest::builder("<your-project-id>").build();
let keys = client.kms().list(request).await?;
```
**Parameters**
- `project_id`: Required parameter passed to the `builder()` function.
#### Get KMS Key
Retrieve a specific KMS key by ID.
**Example**
```rust
use infisical::kms::GetKmsKeyRequest;
let request = GetKmsKeyRequest::builder("<key-id>").build();
let key = client.kms().get(request).await?;
```
**Parameters**
- `key_id`: Required parameter passed to the `builder()` function.
#### Get KMS Key by Name
Retrieve a specific KMS key by name.
**Example**
```rust
use infisical::kms::GetKmsKeyByNameRequest;
let request = GetKmsKeyByNameRequest::builder("<key-name>").build();
let key = client.kms().get_by_name(request).await?;
```
**Parameters**
- `key_name`: Required parameter passed to the `builder()` function.
#### Create KMS Key
Create a new KMS key in your project.
**Example**
```rust
use infisical::kms::{CreateKmsKeyRequest, EncryptionAlgorithm, KeyUsage};
let request = CreateKmsKeyRequest::builder("<your-project-id>", "my-key")
.description("A key for encryption operations")
.key_usage(KeyUsage::EncryptDecrypt)
.encryption_algorithm(EncryptionAlgorithm::Aes256Gcm)
.build();
let created_key = client.kms().create(request).await?;
```
**Parameters**
- `project_id`, `name`: Required parameters passed to the `builder()` function.
- `.description(description)`: Optional method to set the key description.
- `.key_usage(usage)`: Optional method to set the key usage using the `KeyUsage` enum (defaults to `KeyUsage::EncryptDecrypt`).
- `.encryption_algorithm(algorithm)`: Optional method to set the encryption algorithm using the `EncryptionAlgorithm` enum (defaults to `EncryptionAlgorithm::Aes256Gcm`).
#### Update KMS Key
Update an existing KMS key.
**Example**
```rust
use infisical::kms::UpdateKmsKeyRequest;
let request = UpdateKmsKeyRequest::builder("<key-id>")
.name("updated-key-name")
.description("Updated description")
.is_disabled(false)
.build();
let updated_key = client.kms().update(request).await?;
```
**Parameters**
- `key_id`: Required parameter passed to the `builder()` function.
- `.name(name)`: Optional method to rename the key.
- `.description(description)`: Optional method to update the key description.
- `.is_disabled(disabled)`: Optional method to enable or disable the key.
#### Delete KMS Key
Delete a KMS key from your project.
**Example**
```rust
use infisical::kms::DeleteKmsKeyRequest;
let request = DeleteKmsKeyRequest::builder("<key-id>").build();
let deleted_key = client.kms().delete(request).await?;
```
**Parameters**
- `key_id`: Required parameter passed to the `builder()` function.
#### Encrypt Data
Encrypt data using a KMS key.
**Example**
```rust
use infisical::kms::EncryptRequest;
let request = EncryptRequest::builder("<key-id>", "sensitive data").build();
let ciphertext = client.kms().encrypt(request).await?;
```
**Parameters**
- `key_id`, `plaintext`: Required parameters passed to the `builder()` function.
#### Decrypt Data
Decrypt data using a KMS key.
**Example**
```rust
use infisical::kms::DecryptRequest;
let request = DecryptRequest::builder("<key-id>", "encrypted-data").build();
let plaintext = client.kms().decrypt(request).await?;
```
**Parameters**
- `key_id`, `ciphertext`: Required parameters passed to the `builder()` function.
#### Sign Data
Sign data using a KMS key.
**Example**
```rust
use infisical::kms::{SigningAlgorithm, SignRequest};
let request = SignRequest::builder("<key-id>", "data to sign")
.signing_algorithm(SigningAlgorithm::RsassaPkcs1V15Sha256)
.is_digest(false)
.build();
let signature = client.kms().sign(request).await?;
```
**Parameters**
- `key_id`, `data`: Required parameters passed to the `builder()` function.
- `.signing_algorithm(algorithm)`: Optional method to set the signing algorithm using the `SigningAlgorithm` enum (defaults to `SigningAlgorithm::RsassaPkcs1V15Sha256`).
- `.is_digest(is_digest)`: Optional method to indicate if the data is a digest (defaults to `false`).
#### Verify Signature
Verify a signature using a KMS key.
**Example**
```rust
use infisical::kms::{SigningAlgorithm, VerifyRequest};
let request = VerifyRequest::builder("<key-id>", "data to sign", "signature")
.signing_algorithm(SigningAlgorithm::RsassaPkcs1V15Sha256)
.is_digest(false)
.build();
let verification = client.kms().verify(request).await?;
```
**Parameters**
- `key_id`, `data`, `signature`: Required parameters passed to the `builder()` function.
- `.signing_algorithm(algorithm)`: Optional method to set the signing algorithm using the `SigningAlgorithm` enum (defaults to `SigningAlgorithm::RsassaPkcs1V15Sha256`).
- `.is_digest(is_digest)`: Optional method to indicate if the data is a digest (defaults to `false`).
#### Get Public Key
Get the public key for a KMS key.
**Example**
```rust
let public_key = client.kms().get_public_key("<key-id>").await?;
```
**Parameters**
- `key_id`: The ID of the key to get the public key for.
#### Get Signing Algorithms
Get the available signing algorithms for a KMS key.
**Example**
```rust
let algorithms = client.kms().get_signing_algorithms("<key-id>").await?;
```
**Parameters**
- `key_id`: The ID of the key to get signing algorithms for.
## Development and Testing
### Environment Setup
For development and testing, you'll need to set up environment variables. Create a `.env` file in your project root:
```env
INFISICAL_CLIENT_ID=your_client_id_here
INFISICAL_CLIENT_SECRET=your_client_secret_here
INFISICAL_BASE_URL=http://localhost:8080 # Optional: for local development
# Project IDs for different resources
INFISICAL_SECRETS_PROJECT_ID=your_project_id_here
INFISICAL_KMS_PROJECT_ID=your_project_id_here
```
### Getting Credentials
To obtain the required credentials:
1. **Client ID and Secret**: Create a Universal Auth machine identity in your Infisical project settings
2. **Project ID**: Found in your project settings or URL when viewing a project in the Infisical dashboard
### Running Tests
Tests that require authentication are marked with `#[ignore]` and need valid credentials:
```bash
# Run ignored tests (requires .env file with valid credentials)
cargo test -- --ignored --nocapture
# Run a specific test
cargo test test_kms_resource -- --ignored --nocapture
```
**Note**: Integration tests require a running Infisical instance and valid authentication credentials.

12
docs/sdks/overview.mdx
View File

@@ -12,22 +12,22 @@ From local development to production, Infisical SDKs provide the easiest way for
- Fetch secrets on demand
<CardGroup cols={2}>
<Card title="Node.js" href="https://github.com/Infisical/node-sdk-v2?tab=readme-ov-file#infisical-nodejs-sdk" icon="/images/sdks/languages/node.svg">
<Card title="Node.js" href="/sdks/languages/node" icon="/images/sdks/languages/node.svg">
Manage secrets for your Node application on demand
</Card>
<Card href="https://github.com/Infisical/python-sdk-official?tab=readme-ov-file#infisical-python-sdk" title="Python" icon="/images/sdks/languages/python.svg">
<Card href="/sdks/languages/python" title="Python" icon="/images/sdks/languages/python.svg">
Manage secrets for your Python application on demand
</Card>
<Card href="https://github.com/Infisical/java-sdk?tab=readme-ov-file#infisical-java-sdk" title="Java" icon="/images/sdks/languages/java.svg">
<Card href="/sdks/languages/java" title="Java" icon="/images/sdks/languages/java.svg">
Manage secrets for your Java application on demand
</Card>
<Card href="https://github.com/Infisical/infisical-dotnet-sdk?tab=readme-ov-file#infisical-net-sdk" title=".NET" icon="/images/sdks/languages/dotnet.svg">
<Card href="/sdks/languages/dotnet" title=".NET" icon="/images/sdks/languages/dotnet.svg">
Manage secrets for your .NET application on demand
</Card>
<Card href="https://github.com/Infisical/infisical-cpp-sdk/?tab=readme-ov-file#infisical-c-sdk" title="C++" icon="/images/sdks/languages/cpp.svg">
<Card href="/sdks/languages/cpp" title="C++" icon="/images/sdks/languages/cpp.svg">
Manage secrets for your C++ application on demand
</Card>
<Card href="https://github.com/Infisical/rust-sdk?tab=readme-ov-file#infisical--the-official-infisical-rust-sdk" title="Rust" icon="/images/sdks/languages/rust.svg">
<Card href="/sdks/languages/rust" title="Rust" icon="/images/sdks/languages/rust.svg">
Manage secrets for your Rust application on demand
</Card>
<Card href="/sdks/languages/go" title="Go" icon="/images/sdks/languages/go.svg">

48
frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/ChecklySyncFields.tsx
View File

@@ -5,14 +5,15 @@ import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/Se
import { FilterableSelect, FormControl } from "@app/components/v2";
import {
TChecklyAccount,
useChecklyConnectionListAccounts
useChecklyConnectionListAccounts,
useChecklyConnectionListGroups
} from "@app/hooks/api/appConnections/checkly";
import { SecretSync } from "@app/hooks/api/secretSyncs";
import { TSecretSyncForm } from "../schemas";
export const ChecklySyncFields = () => {
const { control, setValue } = useFormContext<
const { control, setValue, watch } = useFormContext<
TSecretSyncForm & { destination: SecretSync.Checkly }
>();
@@ -25,12 +26,24 @@ export const ChecklySyncFields = () => {
}
);
const accountId = watch("destinationConfig.accountId");
const { data: groups = [], isPending: isGroupsLoading } = useChecklyConnectionListGroups(
connectionId,
accountId,
{
enabled: Boolean(connectionId && accountId)
}
);
return (
<>
<SecretSyncConnectionField
onChange={() => {
setValue("destinationConfig.accountId", "");
setValue("destinationConfig.accountName", "");
setValue("destinationConfig.groupId", undefined);
setValue("destinationConfig.groupName", undefined);
}}
/>
<Controller
@@ -60,6 +73,37 @@ export const ChecklySyncFields = () => {
</FormControl>
)}
/>
<Controller
name="destinationConfig.groupId"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
isError={Boolean(error)}
errorText={error?.message}
label="Select a group"
isOptional
helperText="If provided, secrets will be scoped to a check group instead"
tooltipClassName="max-w-md"
>
<FilterableSelect
isLoading={isGroupsLoading && Boolean(connectionId)}
isDisabled={!connectionId}
isClearable
value={groups.find((p) => p.id === value) ?? null}
onChange={(option) => {
const v = option as SingleValue<TChecklyAccount>;
onChange(v?.id ?? null);
setValue("destinationConfig.groupName", v?.name ?? undefined);
}}
options={groups}
placeholder="Select a group..."
getOptionLabel={(option) => option.name}
getOptionValue={(option) => option.id}
/>
</FormControl>
)}
/>
</>
);
};

13
frontend/src/components/secret-syncs/forms/SecretSyncReviewFields/ChecklySyncReviewFields.tsx
View File

@@ -6,7 +6,16 @@ import { SecretSync } from "@app/hooks/api/secretSyncs";
export const ChecklySyncReviewFields = () => {
const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Checkly }>();
const accountName = watch("destinationConfig.accountName");
const config = watch("destinationConfig");
return <GenericFieldLabel label="Account">{accountName}</GenericFieldLabel>;
return (
<>
<GenericFieldLabel label="Account">
{config.accountName ?? config.accountId}
</GenericFieldLabel>
{config.groupId && (
<GenericFieldLabel label="Group">{config.groupName ?? config.groupId}</GenericFieldLabel>
)}
</>
);
};

10
frontend/src/components/secret-syncs/forms/schemas/checkly-sync-destination-schema.ts
View File

@@ -8,7 +8,15 @@ export const ChecklySyncDestinationSchema = BaseSecretSyncSchema().merge(
destination: z.literal(SecretSync.Checkly),
destinationConfig: z.object({
accountId: z.string(),
accountName: z.string()
accountName: z.string(),
groupId: z
.string()
.nullish()
.transform((val) => val || undefined),
groupName: z
.string()
.nullish()
.transform((val) => val || undefined)
})
})
);

5
frontend/src/components/v2/DatePicker/DatePicker.tsx
View File

@@ -98,7 +98,7 @@ export const DatePicker = ({
>
{value
? formatDateTime({ timestamp: value, timezone, dateFormat })
: "Pick a date and time"}
: `Select Date${hideTime ? "" : " and Time"}`}
</Button>
</PopoverTrigger>
<PopoverContent
@@ -122,7 +122,8 @@ export const DatePicker = ({
root: `text-mineshaft-300 ${defaultClassNames}`,
[UI.DayButton]: "p-3 rounded hover:text-mineshaft-100",
[UI.Weekday]: "px-3 pt-3",
[UI.Chevron]: "fill-mineshaft-300"
[UI.Chevron]: "fill-mineshaft-300/70 hover:fill-mineshaft-300",
disabled: "text-mineshaft-400 pointer-events-none"
}}
/>
</div>

3
frontend/src/helpers/appConnections.ts
View File

@@ -13,6 +13,7 @@ import { AppConnection } from "@app/hooks/api/appConnections/enums";
import {
Auth0ConnectionMethod,
AwsConnectionMethod,
AzureADCSConnectionMethod,
AzureAppConfigurationConnectionMethod,
AzureClientSecretsConnectionMethod,
AzureDevOpsConnectionMethod,
@@ -76,6 +77,7 @@ export const APP_CONNECTION_MAP: Record<
image: "Microsoft Azure.png"
},
[AppConnection.AzureDevOps]: { name: "Azure DevOps", image: "Microsoft Azure.png" },
[AppConnection.AzureADCS]: { name: "Azure ADCS", image: "Microsoft Azure.png" },
[AppConnection.Databricks]: { name: "Databricks", image: "Databricks.png" },
[AppConnection.Humanitec]: { name: "Humanitec", image: "Humanitec.png" },
[AppConnection.TerraformCloud]: { name: "Terraform Cloud", image: "Terraform Cloud.png" },
@@ -151,6 +153,7 @@ export const getAppConnectionMethodDetails = (method: TAppConnection["method"])
case MsSqlConnectionMethod.UsernameAndPassword:
case MySqlConnectionMethod.UsernameAndPassword:
case OracleDBConnectionMethod.UsernameAndPassword:
case AzureADCSConnectionMethod.UsernamePassword:
return { name: "Username & Password", icon: faLock };
case HCVaultConnectionMethod.AccessToken:
case TeamCityConnectionMethod.AccessToken:

30
frontend/src/hooks/api/appConnections/checkly/queries.tsx
View File

@@ -8,7 +8,9 @@ import { TChecklyAccount } from "./types";
const checklyConnectionKeys = {
all: [...appConnectionKeys.all, "checkly"] as const,
listAccounts: (connectionId: string) =>
[...checklyConnectionKeys.all, "workspace-scopes", connectionId] as const
[...checklyConnectionKeys.all, "workspace-scopes", connectionId] as const,
listGroups: (connectionId: string, accountId: string) =>
[...checklyConnectionKeys.all, "groups", connectionId, accountId] as const
};
export const useChecklyConnectionListAccounts = (
@@ -35,3 +37,29 @@ export const useChecklyConnectionListAccounts = (
...options
});
};
export const useChecklyConnectionListGroups = (
connectionId: string,
accountId: string,
options?: Omit<
UseQueryOptions<
TChecklyAccount[],
unknown,
TChecklyAccount[],
ReturnType<typeof checklyConnectionKeys.listGroups>
>,
"queryKey" | "queryFn"
>
) => {
return useQuery({
queryKey: checklyConnectionKeys.listGroups(connectionId, accountId),
queryFn: async () => {
const { data } = await apiRequest.get<{ groups: TChecklyAccount[] }>(
`/api/v1/app-connections/checkly/${connectionId}/accounts/${accountId}/groups`
);
return data.groups;
},
...options
});
};

1
frontend/src/hooks/api/appConnections/enums.ts
View File

@@ -7,6 +7,7 @@ export enum AppConnection {
AzureAppConfiguration = "azure-app-configuration",
AzureClientSecrets = "azure-client-secrets",
AzureDevOps = "azure-devops",
AzureADCS = "azure-adcs",
Databricks = "databricks",
Humanitec = "humanitec",
TerraformCloud = "terraform-cloud",

12
frontend/src/hooks/api/appConnections/queries.tsx
View File

@@ -54,13 +54,13 @@ export const useAppConnectionOptions = (
export const useGetAppConnectionOption = <T extends AppConnection>(app: T) => {
const { data: options = [], isPending } = useAppConnectionOptions();
return useMemo(
() => ({
option: (options.find((opt) => opt.app === app) as TAppConnectionOptionMap[T]) ?? {},
return useMemo(() => {
const foundOption = options.find((opt) => opt.app === app);
return {
option: (foundOption as TAppConnectionOptionMap[T]) ?? {},
isLoading: isPending
}),
[options, app, isPending]
);
};
}, [options, app, isPending]);
};
export const useListAppConnections = (

13
frontend/src/hooks/api/appConnections/types/app-options.ts
View File

@@ -32,7 +32,7 @@ export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
};
export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.AzureKeyVault;
app: AppConnection.AzureAppConfiguration;
oauthClientId?: string;
};
@@ -164,9 +164,14 @@ export type TOktaConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.Okta;
};
export type TAzureAdCsConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.AzureADCS;
};
export type TAppConnectionOption =
| TAwsConnectionOption
| TGitHubConnectionOption
| TGitHubRadarConnectionOption
| TGcpConnectionOption
| TAzureAppConfigurationConnectionOption
| TAzureKeyVaultConnectionOption
@@ -184,6 +189,7 @@ export type TAppConnectionOption =
| TWindmillConnectionOption
| TAuth0ConnectionOption
| THCVaultConnectionOption
| TLdapConnectionOption
| TTeamCityConnectionOption
| TOCIConnectionOption
| TOnePassConnectionOption
@@ -196,9 +202,11 @@ export type TAppConnectionOption =
| TZabbixConnectionOption
| TRailwayConnectionOption
| TChecklyConnectionOption
| TSupabaseConnectionOption
| TDigitalOceanConnectionOption
| TNetlifyConnectionOption
| TOktaConnectionOption;
| TOktaConnectionOption
| TAzureAdCsConnectionOption;
export type TAppConnectionOptionMap = {
[AppConnection.AWS]: TAwsConnectionOption;
@@ -238,4 +246,5 @@ export type TAppConnectionOptionMap = {
[AppConnection.DigitalOcean]: TDigitalOceanConnectionOption;
[AppConnection.Netlify]: TNetlifyConnectionOption;
[AppConnection.Okta]: TOktaConnectionOption;
[AppConnection.AzureADCS]: TAzureAdCsConnectionOption;
};

21
frontend/src/hooks/api/appConnections/types/azure-adcs-connection.ts Normal file
View File

@@ -0,0 +1,21 @@
import { z } from "zod";
import { AppConnection } from "../enums";
import { TRootAppConnection } from "./root-connection";
export enum AzureADCSConnectionMethod {
UsernamePassword = "username-password"
}
export const CreateAzureADCSConnectionSchema = z.object({
adcsUrl: z.string().url().min(1, "ADCS URL is required"),
username: z.string().min(1, "Username is required"),
password: z.string().min(1, "Password is required")
});
export type TCreateAzureADCSConnection = z.infer<typeof CreateAzureADCSConnectionSchema>;
export type TAzureADCSConnection = TRootAppConnection & { app: AppConnection.AzureADCS } & {
method: AzureADCSConnectionMethod.UsernamePassword;
credentials: TCreateAzureADCSConnection;
};

4
frontend/src/hooks/api/appConnections/types/index.ts
View File

@@ -3,6 +3,7 @@ import { TOnePassConnection } from "./1password-connection";
import { TAppConnectionOption } from "./app-options";
import { TAuth0Connection } from "./auth0-connection";
import { TAwsConnection } from "./aws-connection";
import { TAzureADCSConnection } from "./azure-adcs-connection";
import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
import { TAzureDevOpsConnection } from "./azure-devops-connection";
@@ -41,6 +42,7 @@ import { TZabbixConnection } from "./zabbix-connection";
export * from "./1password-connection";
export * from "./auth0-connection";
export * from "./aws-connection";
export * from "./azure-adcs-connection";
export * from "./azure-app-configuration-connection";
export * from "./azure-client-secrets-connection";
export * from "./azure-devops-connection";
@@ -83,6 +85,7 @@ export type TAppConnection =
| TAzureAppConfigurationConnection
| TAzureClientSecretsConnection
| TAzureDevOpsConnection
| TAzureADCSConnection
| TDatabricksConnection
| THumanitecConnection
| TTerraformCloudConnection
@@ -156,6 +159,7 @@ export type TAppConnectionMap = {
[AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
[AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
[AppConnection.AzureDevOps]: TAzureDevOpsConnection;
[AppConnection.AzureADCS]: TAzureADCSConnection;
[AppConnection.Databricks]: TDatabricksConnection;
[AppConnection.Humanitec]: THumanitecConnection;
[AppConnection.TerraformCloud]: TTerraformCloudConnection;

24
frontend/src/hooks/api/ca/constants.tsx
View File

@@ -1,7 +1,7 @@
import { AppConnection } from "../appConnections/enums";
import { SshCaStatus } from "../sshCa";
import { SshCertTemplateStatus } from "../sshCertificateTemplates";
import { AcmeDnsProvider, CaStatus, InternalCaType } from "./enums";
import { AcmeDnsProvider, CaCapability, CaStatus, CaType, InternalCaType } from "./enums";
export const caTypeToNameMap: { [K in InternalCaType]: string } = {
[InternalCaType.ROOT]: "Root",
@@ -24,6 +24,28 @@ export const ACME_DNS_PROVIDER_APP_CONNECTION_MAP: Record<AcmeDnsProvider, AppCo
[AcmeDnsProvider.Cloudflare]: AppConnection.Cloudflare
};
export const CA_TYPE_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
[CaType.INTERNAL]: [
CaCapability.ISSUE_CERTIFICATES,
CaCapability.REVOKE_CERTIFICATES,
CaCapability.RENEW_CERTIFICATES
],
[CaType.ACME]: [
CaCapability.ISSUE_CERTIFICATES,
CaCapability.REVOKE_CERTIFICATES,
CaCapability.RENEW_CERTIFICATES
],
[CaType.AZURE_AD_CS]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES]
};
/**
* Check if a certificate authority type supports a specific capability
*/
export const caSupportsCapability = (caType: CaType, capability: CaCapability): boolean => {
const capabilities = CA_TYPE_CAPABILITIES_MAP[caType] || [];
return capabilities.includes(capability);
};
export const getCaStatusBadgeVariant = (status: CaStatus | SshCaStatus | SshCertTemplateStatus) => {
switch (status) {
case CaStatus.ACTIVE:

Some files were not shown because too many files have changed in this diff Show More