feat(secret-sync): Add gitlab secret sync

2026-10-14 08:29:55 +00:00 · 2025-06-20 21:13:14 -03:00
parent e5352e7aa8
commit e201d77a8f
99 changed files with 2912 additions and 56 deletions
@@ -0,0 +1,278 @@
+import { Controller, useFormContext, useWatch } from "react-hook-form";
+import { SingleValue } from "react-select";
+import { faCircleInfo } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+
+import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
+import {
+  FilterableSelect,
+  FormControl,
+  Input,
+  Select,
+  SelectItem,
+  Switch,
+  Tooltip
+} from "@app/components/v2";
+import {
+  TGitLabGroup,
+  TGitLabProject,
+  useGitlabConnectionListGroups,
+  useGitlabConnectionListProjects
+} from "@app/hooks/api/appConnections/gitlab";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { GitlabSyncScope } from "@app/hooks/api/secretSyncs/types/gitlab-sync";
+
+import { TSecretSyncForm } from "../schemas";
+
+const SecretProtectionOption = ({
+  title,
+  isEnabled,
+  onChange,
+  id,
+  isDisabled = false,
+  tooltip
+}: {
+  title: string;
+  isEnabled: boolean;
+  onChange: (checked: boolean) => void;
+  id: string;
+  isDisabled?: boolean;
+  tooltip?: string;
+}) => {
+  return (
+    <div className="flex items-start justify-between rounded-lg border border-mineshaft-600 bg-mineshaft-800/50 p-4 transition-all duration-200 hover:border-mineshaft-500">
+      <div className="flex flex-1 items-start space-x-3">
+        <div className="min-w-0 flex-1">
+          <div className="mb-1 flex items-center gap-2">
+            <h4 className="text-sm font-medium text-bunker-100">{title}</h4>
+            {tooltip && (
+              <Tooltip className="max-w-sm" content={tooltip}>
+                <FontAwesomeIcon
+                  icon={faCircleInfo}
+                  className="cursor-help text-xs text-mineshaft-400 hover:text-mineshaft-300"
+                />
+              </Tooltip>
+            )}
+          </div>
+        </div>
+      </div>
+      <div className="ml-4 flex-shrink-0">
+        <Switch id={id} onCheckedChange={onChange} isChecked={isEnabled} isDisabled={isDisabled} />
+      </div>
+    </div>
+  );
+};
+
+export const GitLabSyncFields = () => {
+  const { control, setValue } = useFormContext<
+    TSecretSyncForm & { destination: SecretSync.Gitlab }
+  >();
+
+  const connectionId = useWatch({ name: "connection.id", control });
+  const scope = useWatch({ name: "destinationConfig.scope", control });
+  const selectedGroup = useWatch({ name: "destinationConfig.groupId", control });
+  const shouldMaskSecrets = useWatch({ name: "destinationConfig.shouldMaskSecrets", control });
+
+  const { data: groups, isLoading: isGroupsLoading } = useGitlabConnectionListGroups(connectionId, {
+    enabled: Boolean(connectionId) && scope === GitlabSyncScope.Group
+  });
+
+  const { data: projects, isLoading: isProjectsLoading } = useGitlabConnectionListProjects(
+    connectionId,
+    selectedGroup,
+    {
+      enabled: Boolean(connectionId)
+    }
+  );
+
+  return (
+    <div className="h-[calc(100vh-20rem)] overflow-auto">
+      <SecretSyncConnectionField
+        onChange={() => {
+          setValue("destinationConfig.projectId", "");
+          setValue("destinationConfig.projectName", "");
+          setValue("destinationConfig.groupId", "");
+          setValue("destinationConfig.scope", GitlabSyncScope.Individual);
+        }}
+      />
+
+      <Controller
+        name="destinationConfig.scope"
+        control={control}
+        defaultValue={GitlabSyncScope.Individual}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl errorText={error?.message} isError={Boolean(error?.message)} label="Scope">
+            <Select
+              value={value}
+              onValueChange={(val) => {
+                onChange(val);
+                setValue("destinationConfig.projectId", "");
+                setValue("destinationConfig.projectName", "");
+                setValue("destinationConfig.groupId", "");
+              }}
+              className="w-full border border-mineshaft-500 capitalize"
+              position="popper"
+              placeholder="Select a scope..."
+              dropdownContainerClassName="max-w-none"
+            >
+              {Object.values(GitlabSyncScope).map((projectScope) => (
+                <SelectItem className="capitalize" value={projectScope} key={projectScope}>
+                  {projectScope.replace("-", " ")}
+                </SelectItem>
+              ))}
+            </Select>
+          </FormControl>
+        )}
+      />
+
+      {scope === GitlabSyncScope.Group && (
+        <Controller
+          name="destinationConfig.groupId"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              isError={Boolean(error)}
+              errorText={error?.message}
+              label="Group"
+              helperText={
+                <Tooltip
+                  className="max-w-md"
+                  content="Ensure the group exists in the connection's GitLab instance URL."
+                >
+                  <div>
+                    <span>Don&#39;t see the group you&#39;re looking for?</span>{" "}
+                    <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                  </div>
+                </Tooltip>
+              }
+            >
+              <FilterableSelect
+                menuPlacement="top"
+                isLoading={isGroupsLoading && Boolean(connectionId)}
+                isDisabled={!connectionId}
+                value={groups?.find((group) => group.id === value) ?? null}
+                onChange={(option) => {
+                  onChange((option as SingleValue<TGitLabGroup>)?.id ?? "");
+                }}
+                options={groups}
+                placeholder="Select a group..."
+                getOptionLabel={(option) => option.name}
+                getOptionValue={(option) => option.id}
+              />
+            </FormControl>
+          )}
+        />
+      )}
+
+      <Controller
+        name="destinationConfig.projectId"
+        control={control}
+        render={({ field: { value, onChange }, fieldState: { error } }) => (
+          <FormControl
+            isError={Boolean(error)}
+            errorText={error?.message}
+            label="GitLab Project"
+            helperText={
+              <Tooltip
+                className="max-w-md"
+                content="Ensure the project exists in the connection's GitLab instance URL."
+              >
+                <div>
+                  <span>Don&#39;t see the project you&#39;re looking for?</span>{" "}
+                  <FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
+                </div>
+              </Tooltip>
+            }
+          >
+            <FilterableSelect
+              menuPlacement="top"
+              isLoading={isProjectsLoading && Boolean(connectionId)}
+              isDisabled={!connectionId || (scope === GitlabSyncScope.Group && !selectedGroup)}
+              value={projects?.find((project) => project.id === value) ?? null}
+              onChange={(option) => {
+                onChange((option as SingleValue<TGitLabProject>)?.id ?? "");
+                setValue(
+                  "destinationConfig.projectName",
+                  (option as SingleValue<TGitLabProject>)?.name ?? ""
+                );
+              }}
+              options={projects}
+              placeholder="Select a project..."
+              getOptionLabel={(option) => option.name}
+              getOptionValue={(option) => option.id}
+            />
+          </FormControl>
+        )}
+      />
+
+      <Controller
+        control={control}
+        defaultValue=""
+        name="destinationConfig.targetEnvironment"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="GitLab Environment Scope (Optional)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="*" />
+          </FormControl>
+        )}
+      />
+
+      {/* Secret Protection Settings Section */}
+      <div className="mt-6">
+        <div className="space-y-4">
+          <Controller
+            control={control}
+            name="destinationConfig.shouldProtectSecrets"
+            render={({ field: { onChange, value } }) => (
+              <SecretProtectionOption
+                id="should-protect-secrets"
+                title="Mark Infisical secrets in GitLab as 'Protected' secrets"
+                isEnabled={value || false}
+                onChange={onChange}
+              />
+            )}
+          />
+
+          <Controller
+            control={control}
+            name="destinationConfig.shouldMaskSecrets"
+            render={({ field: { onChange, value } }) => (
+              <SecretProtectionOption
+                id="should-mask-secrets"
+                title="Mark Infisical secrets in GitLab as 'Masked' secrets"
+                tooltip="GitLab has limitations for masked variables: secrets must be at least 8 characters long and not match existing CI/CD variable names. Secrets not meeting these criteria won't be masked."
+                isEnabled={value || false}
+                onChange={(checked) => {
+                  onChange(checked);
+                  if (!checked) {
+                    setValue("destinationConfig.shouldHideSecrets", false);
+                  }
+                }}
+              />
+            )}
+          />
+
+          <Controller
+            control={control}
+            name="destinationConfig.shouldHideSecrets"
+            render={({ field: { onChange, value } }) => (
+              <div className='"max-h-32 opacity-100" transition-all duration-300'>
+                <SecretProtectionOption
+                  id="should-hide-secrets"
+                  title="Mark Infisical secrets in GitLab as 'Protected' secrets"
+                  tooltip="Secrets can only be marked as hidden if they are also masked."
+                  isEnabled={value || false}
+                  onChange={onChange}
+                  isDisabled={!shouldMaskSecrets}
+                />
+              </div>
+            )}
+          />
+        </div>
+      </div>
+    </div>
+  );
+};
@@ -14,6 +14,7 @@ import { DatabricksSyncFields } from "./DatabricksSyncFields";
 import { FlyioSyncFields } from "./FlyioSyncFields";
 import { GcpSyncFields } from "./GcpSyncFields";
 import { GitHubSyncFields } from "./GitHubSyncFields";
+import { GitLabSyncFields } from "./GitLabSyncFields";
 import { HCVaultSyncFields } from "./HCVaultSyncFields";
 import { HerokuSyncFields } from "./HerokuSyncFields";
 import { HumanitecSyncFields } from "./HumanitecSyncFields";
@@ -70,6 +71,8 @@ export const SecretSyncDestinationFields = () => {
      return <RenderSyncFields />;
    case SecretSync.Flyio:
      return <FlyioSyncFields />;
+    case SecretSync.Gitlab:
+      return <GitLabSyncFields />;
    default:
      throw new Error(`Unhandled Destination Config Field: ${destination}`);
  }
@@ -55,6 +55,7 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
    case SecretSync.Heroku:
    case SecretSync.Render:
    case SecretSync.Flyio:
+    case SecretSync.Gitlab:
      AdditionalSyncOptionsFieldsComponent = null;
      break;
    default:
@@ -0,0 +1,32 @@
+import { useFormContext } from "react-hook-form";
+
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TSecretSyncForm } from "@app/components/secret-syncs/forms/schemas";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+
+export const GitLabSyncReviewFields = () => {
+  const { watch } = useFormContext<TSecretSyncForm & { destination: SecretSync.Gitlab }>();
+  const projectId = watch("destinationConfig.projectId");
+  const targetEnvironment = watch("destinationConfig.targetEnvironment");
+  const groupId = watch("destinationConfig.groupId");
+  const scope = watch("destinationConfig.scope");
+  const shouldProtectSecrets = watch("destinationConfig.shouldProtectSecrets");
+  const shouldMaskSecrets = watch("destinationConfig.shouldMaskSecrets");
+  const shouldHideSecrets = watch("destinationConfig.shouldHideSecrets");
+
+  return (
+    <>
+      <GenericFieldLabel label="Scope">{scope}</GenericFieldLabel>
+      <GenericFieldLabel label="Project ID">{projectId}</GenericFieldLabel>
+      {groupId && <GenericFieldLabel label="Group ID">{groupId}</GenericFieldLabel>}
+      {targetEnvironment && (
+        <GenericFieldLabel label="Environment">{targetEnvironment}</GenericFieldLabel>
+      )}
+      <GenericFieldLabel label="Protect Secrets">
+        {shouldProtectSecrets ? "Yes" : "No"}
+      </GenericFieldLabel>
+      <GenericFieldLabel label="Mask Secrets">{shouldMaskSecrets ? "Yes" : "No"}</GenericFieldLabel>
+      <GenericFieldLabel label="Hide Secrets">{shouldHideSecrets ? "Yes" : "No"}</GenericFieldLabel>
+    </>
+  );
+};
@@ -23,6 +23,7 @@ import { DatabricksSyncReviewFields } from "./DatabricksSyncReviewFields";
 import { FlyioSyncReviewFields } from "./FlyioSyncReviewFields";
 import { GcpSyncReviewFields } from "./GcpSyncReviewFields";
 import { GitHubSyncReviewFields } from "./GitHubSyncReviewFields";
+import { GitLabSyncReviewFields } from "./GitLabSyncReviewFields";
 import { HCVaultSyncReviewFields } from "./HCVaultSyncReviewFields";
 import { HerokuSyncReviewFields } from "./HerokuSyncReviewFields";
 import { HumanitecSyncReviewFields } from "./HumanitecSyncReviewFields";
@@ -116,6 +117,9 @@ export const SecretSyncReviewFields = () => {
    case SecretSync.Flyio:
      DestinationFieldsComponent = <FlyioSyncReviewFields />;
      break;
+    case SecretSync.Gitlab:
+      DestinationFieldsComponent = <GitLabSyncReviewFields />;
+      break;
    default:
      throw new Error(`Unhandled Destination Review Fields: ${destination}`);
  }
@@ -0,0 +1,32 @@
+import { z } from "zod";
+
+import { BaseSecretSyncSchema } from "@app/components/secret-syncs/forms/schemas/base-secret-sync-schema";
+import { SecretSync } from "@app/hooks/api/secretSyncs";
+import { GitlabSyncScope } from "@app/hooks/api/secretSyncs/types/gitlab-sync";
+
+export const GitlabSyncDestinationSchema = BaseSecretSyncSchema().merge(
+  z.object({
+    destination: z.literal(SecretSync.Gitlab),
+    destinationConfig: z.discriminatedUnion("scope", [
+      z.object({
+        scope: z.literal(GitlabSyncScope.Individual),
+        projectId: z.string().trim().min(1, "Project ID required"),
+        projectName: z.string().trim().min(1, "Project name required"),
+        targetEnvironment: z.string().optional(),
+        shouldProtectSecrets: z.boolean().optional().default(false),
+        shouldMaskSecrets: z.boolean().optional().default(false),
+        shouldHideSecrets: z.boolean().optional().default(false)
+      }),
+      z.object({
+        scope: z.literal(GitlabSyncScope.Group),
+        projectId: z.string().trim().min(1, "Project ID required"),
+        projectName: z.string().trim().min(1, "Project name required"),
+        targetEnvironment: z.string().optional(),
+        groupId: z.string().trim().min(1, "Group ID required"),
+        shouldProtectSecrets: z.boolean().optional().default(false),
+        shouldMaskSecrets: z.boolean().optional().default(false),
+        shouldHideSecrets: z.boolean().optional().default(false)
+      })
+    ])
+  })
+);
@@ -11,6 +11,7 @@ import { DatabricksSyncDestinationSchema } from "./databricks-sync-destination-s
 import { FlyioSyncDestinationSchema } from "./flyio-sync-destination-schema";
 import { GcpSyncDestinationSchema } from "./gcp-sync-destination-schema";
 import { GitHubSyncDestinationSchema } from "./github-sync-destination-schema";
+import { GitlabSyncDestinationSchema } from "./gitlab-sync-destination-schema";
 import { HCVaultSyncDestinationSchema } from "./hc-vault-sync-destination-schema";
 import { HerokuSyncDestinationSchema } from "./heroku-sync-destination-schema";
 import { HumanitecSyncDestinationSchema } from "./humanitec-sync-destination-schema";
@@ -41,7 +42,8 @@ const SecretSyncUnionSchema = z.discriminatedUnion("destination", [
  OnePassSyncDestinationSchema,
  HerokuSyncDestinationSchema,
  RenderSyncDestinationSchema,
-  FlyioSyncDestinationSchema
+  FlyioSyncDestinationSchema,
+  GitlabSyncDestinationSchema
 ]);

 export const SecretSyncFormSchema = SecretSyncUnionSchema;