feat(secret-sync): Add gitlab secret sync

2026-10-15 01:52:22 +00:00 · 2025-06-20 21:13:14 -03:00
parent e5352e7aa8
commit e201d77a8f
99 changed files with 2912 additions and 56 deletions
@@ -22,6 +22,7 @@ import { FlyioConnectionForm } from "./FlyioConnectionForm";
 import { GcpConnectionForm } from "./GcpConnectionForm";
 import { GitHubConnectionForm } from "./GitHubConnectionForm";
 import { GitHubRadarConnectionForm } from "./GitHubRadarConnectionForm";
+import { GitLabConnectionForm } from "./GitLabConnectionForm";
 import { HCVaultConnectionForm } from "./HCVaultConnectionForm";
 import { HerokuConnectionForm } from "./HerokuAppConnectionForm";
 import { HumanitecConnectionForm } from "./HumanitecConnectionForm";
@@ -128,6 +129,8 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
      return <RenderConnectionForm onSubmit={onSubmit} />;
    case AppConnection.Flyio:
      return <FlyioConnectionForm onSubmit={onSubmit} />;
+    case AppConnection.Gitlab:
+      return <GitLabConnectionForm onSubmit={onSubmit} />;
    default:
      throw new Error(`Unhandled App ${app}`);
  }
@@ -218,6 +221,8 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
      return <RenderConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    case AppConnection.Flyio:
      return <FlyioConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
+    case AppConnection.Gitlab:
+      return <GitLabConnectionForm onSubmit={onSubmit} appConnection={appConnection} />;
    default:
      throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
  }
@@ -0,0 +1,297 @@
+/* eslint-disable no-case-declarations */
+/* eslint-disable no-nested-ternary */
+import crypto from "crypto";
+
+import { useState } from "react";
+import { Controller, FormProvider, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import {
+  Button,
+  FormControl,
+  Input,
+  ModalClose,
+  SecretInput,
+  Select,
+  SelectItem
+} from "@app/components/v2";
+import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
+import { isInfisicalCloud } from "@app/helpers/platform";
+import { useGetAppConnectionOption } from "@app/hooks/api/appConnections";
+import { AppConnection } from "@app/hooks/api/appConnections/enums";
+import {
+  GitlabConnectionMethod,
+  TGitlabConnection
+} from "@app/hooks/api/appConnections/types/gitlab-connection";
+
+import {
+  genericAppConnectionFieldsSchema,
+  GenericAppConnectionsFields
+} from "./GenericAppConnectionFields";
+
+type Props = {
+  appConnection?: TGitlabConnection;
+  onSubmit: (formData: FormData) => Promise<void>;
+};
+
+const formSchema = z.discriminatedUnion("method", [
+  genericAppConnectionFieldsSchema.extend({
+    app: z.literal(AppConnection.Gitlab),
+    method: z.literal(GitlabConnectionMethod.AccessToken),
+    credentials: z.object({
+      accessToken: z.string().min(1, "Access token is required"),
+      instanceUrl: z
+        .string()
+        .trim()
+        .transform((value) => value || undefined)
+        .refine((value) => (!value ? true : z.string().url().safeParse(value).success), {
+          message: "Invalid instance URL"
+        })
+        .optional()
+    })
+  }),
+  genericAppConnectionFieldsSchema.extend({
+    app: z.literal(AppConnection.Gitlab),
+    method: z.literal(GitlabConnectionMethod.OAuth),
+    credentials: z.object({
+      code: z.string().min(1, "Code is required"),
+      instanceUrl: z
+        .string()
+        .trim()
+        .transform((value) => value || undefined)
+        .refine((value) => (!value ? true : z.string().url().safeParse(value).success), {
+          message: "Invalid instance URL"
+        })
+        .optional()
+    })
+  })
+]);
+
+type FormData = z.infer<typeof formSchema>;
+
+export const GitLabConnectionForm = ({ appConnection, onSubmit: formSubmit }: Props) => {
+  const isUpdate = Boolean(appConnection);
+  const [isRedirecting, setIsRedirecting] = useState(false);
+
+  const {
+    option: { oauthClientId },
+    isLoading
+  } = useGetAppConnectionOption(AppConnection.Gitlab);
+
+  const form = useForm<FormData>({
+    resolver: zodResolver(formSchema),
+    defaultValues:
+      appConnection?.method === GitlabConnectionMethod.OAuth
+        ? { ...appConnection, credentials: { code: "custom" } }
+        : (appConnection ??
+          ({
+            app: AppConnection.Gitlab,
+            method: GitlabConnectionMethod.AccessToken,
+            credentials: {
+              accessToken: "",
+              instanceUrl: ""
+            }
+          } as FormData))
+  });
+
+  const {
+    handleSubmit,
+    control,
+    watch,
+    setValue,
+    formState: { isSubmitting, isDirty }
+  } = form;
+
+  const selectedMethod = watch("method");
+  const gitLabURL = watch("credentials.instanceUrl");
+
+  const onSubmit = async (formData: FormData) => {
+    try {
+      switch (formData.method) {
+        case GitlabConnectionMethod.AccessToken:
+          await formSubmit(formData);
+          break;
+
+        case GitlabConnectionMethod.OAuth:
+          if (!oauthClientId) {
+            return;
+          }
+          setIsRedirecting(true);
+
+          // Generate CSRF token
+          const state = crypto.randomBytes(16).toString("hex");
+
+          // Store state and form data for callback
+          localStorage.setItem("latestCSRFToken", state);
+          localStorage.setItem(
+            "gitlabConnectionFormData",
+            JSON.stringify({
+              ...formData,
+              connectionId: appConnection?.id,
+              isUpdate
+            })
+          );
+
+          // Redirect to Gitlab OAuth
+          const baseURL =
+            gitLabURL && (gitLabURL as string)?.trim() !== ""
+              ? (gitLabURL as string)?.trim()
+              : "https://gitlab.com";
+          const oauthUrl = new URL(`${baseURL}/oauth/authorize`);
+          oauthUrl.searchParams.set("client_id", oauthClientId);
+          oauthUrl.searchParams.set(
+            "redirect_uri",
+            `${window.location.origin}/integrations/gitlab/oauth2/callback`
+          );
+          oauthUrl.searchParams.set("response_type", "code");
+          oauthUrl.searchParams.set("state", state);
+
+          window.location.assign(oauthUrl.toString());
+          break;
+
+        default:
+          throw new Error("Unhandled Gitlab Connection method");
+      }
+    } catch (error) {
+      console.error("Error handling form submission:", error);
+      setIsRedirecting(false);
+    }
+  };
+
+  let isMissingConfig: boolean;
+
+  switch (selectedMethod) {
+    case GitlabConnectionMethod.OAuth:
+      isMissingConfig = !oauthClientId;
+      break;
+    case GitlabConnectionMethod.AccessToken:
+      isMissingConfig = false;
+      break;
+    default:
+      throw new Error(`Unhandled Gitlab Connection method: ${selectedMethod}`);
+  }
+
+  const methodDetails = getAppConnectionMethodDetails(selectedMethod);
+
+  return (
+    <FormProvider {...form}>
+      <form onSubmit={handleSubmit(onSubmit)}>
+        {!isUpdate && <GenericAppConnectionsFields />}
+
+        <Controller
+          name="credentials.instanceUrl"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              label="Self-hosted URL (optional)"
+              errorText={error?.message}
+              isError={Boolean(error?.message)}
+              tooltipText="Will default to GitLab Cloud if not specified."
+            >
+              <Input
+                value={value}
+                onChange={(e) => onChange(e.target.value)}
+                placeholder="https://gitlab.com"
+              />
+            </FormControl>
+          )}
+        />
+
+        <Controller
+          name="method"
+          control={control}
+          render={({ field: { value, onChange }, fieldState: { error } }) => (
+            <FormControl
+              tooltipText={`The method you would like to use to connect with ${
+                APP_CONNECTION_MAP[AppConnection.Gitlab].name
+              }. This field cannot be changed after creation.`}
+              errorText={
+                !isLoading && isMissingConfig && selectedMethod === GitlabConnectionMethod.OAuth
+                  ? `Environment variables have not been configured. ${
+                      isInfisicalCloud()
+                        ? "Please contact Infisical."
+                        : `See Docs to configure Gitlab ${methodDetails.name} Connections.`
+                    }`
+                  : error?.message
+              }
+              isError={Boolean(error?.message) || isMissingConfig}
+              label="Method"
+            >
+              <Select
+                isDisabled={isUpdate}
+                value={value}
+                onValueChange={(val) => {
+                  onChange(val);
+                  if (val === GitlabConnectionMethod.OAuth) {
+                    setValue("credentials.code", "custom");
+                  }
+                }}
+                className="w-full border border-mineshaft-500"
+                position="popper"
+                dropdownContainerClassName="max-w-none"
+              >
+                {Object.values(GitlabConnectionMethod).map((method) => {
+                  return (
+                    <SelectItem value={method} key={method}>
+                      {getAppConnectionMethodDetails(method).name}{" "}
+                      {method === GitlabConnectionMethod.AccessToken ? " (Recommended)" : ""}
+                    </SelectItem>
+                  );
+                })}
+              </Select>
+            </FormControl>
+          )}
+        />
+
+        {selectedMethod === GitlabConnectionMethod.AccessToken && (
+          <Controller
+            name="credentials.accessToken"
+            control={control}
+            render={({ field: { value, onChange }, fieldState: { error } }) => (
+              <FormControl
+                label="Access Token"
+                errorText={error?.message}
+                isError={Boolean(error?.message)}
+                tooltipText="Your Gitlab Access Token"
+              >
+                <SecretInput
+                  containerClassName="text-gray-400 group-focus-within:!border-primary-400/50 border border-mineshaft-500 bg-mineshaft-900 px-2.5 py-1.5"
+                  value={value}
+                  onChange={(e) => onChange(e.target.value)}
+                />
+              </FormControl>
+            )}
+          />
+        )}
+
+        <div className="mt-8 flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            colorSchema="secondary"
+            isLoading={isSubmitting || isRedirecting}
+            isDisabled={
+              isSubmitting ||
+              (!isUpdate && !isDirty) ||
+              (isMissingConfig && selectedMethod === GitlabConnectionMethod.OAuth) ||
+              isRedirecting
+            }
+          >
+            {isRedirecting && selectedMethod === GitlabConnectionMethod.OAuth
+              ? "Redirecting to Gitlab..."
+              : isUpdate
+                ? "Reconnect to Gitlab"
+                : "Connect to Gitlab"}
+          </Button>
+          <ModalClose asChild>
+            <Button colorSchema="secondary" variant="plain">
+              Cancel
+            </Button>
+          </ModalClose>
+        </div>
+      </form>
+    </FormProvider>
+  );
+};
@@ -0,0 +1,14 @@
+import { TGitlabSync } from "@app/hooks/api/secretSyncs/types/gitlab-sync";
+
+import { getSecretSyncDestinationColValues } from "../helpers";
+import { SecretSyncTableCell } from "../SecretSyncTableCell";
+
+type Props = {
+  secretSync: TGitlabSync;
+};
+
+export const GitLabSyncDestinationCol = ({ secretSync }: Props) => {
+  const { primaryText, secondaryText } = getSecretSyncDestinationColValues(secretSync);
+
+  return <SecretSyncTableCell primaryText={primaryText} secondaryText={secondaryText} />;
+};
@@ -11,6 +11,7 @@ import { DatabricksSyncDestinationCol } from "./DatabricksSyncDestinationCol";
 import { FlyioSyncDestinationCol } from "./FlyioSyncDestinationCol";
 import { GcpSyncDestinationCol } from "./GcpSyncDestinationCol";
 import { GitHubSyncDestinationCol } from "./GitHubSyncDestinationCol";
+import { GitLabSyncDestinationCol } from "./GitLabSyncDestinationCol";
 import { HCVaultSyncDestinationCol } from "./HCVaultSyncDestinationCol";
 import { HerokuSyncDestinationCol } from "./HerokuSyncDestinationCol";
 import { HumanitecSyncDestinationCol } from "./HumanitecSyncDestinationCol";
@@ -67,6 +68,8 @@ export const SecretSyncDestinationCol = ({ secretSync }: Props) => {
      return <RenderSyncDestinationCol secretSync={secretSync} />;
    case SecretSync.Flyio:
      return <FlyioSyncDestinationCol secretSync={secretSync} />;
+    case SecretSync.Gitlab:
+      return <GitLabSyncDestinationCol secretSync={secretSync} />;
    default:
      throw new Error(
        `Unhandled Secret Sync Destination Col: ${(secretSync as TSecretSync).destination}`
@@ -128,6 +128,10 @@ export const getSecretSyncDestinationColValues = (secretSync: TSecretSync) => {
      primaryText = destinationConfig.appId;
      secondaryText = "App ID";
      break;
+    case SecretSync.Gitlab:
+      primaryText = destinationConfig.projectName;
+      secondaryText = destinationConfig.projectId;
+      break;
    default:
      throw new Error(`Unhandled Destination Col Values ${destination}`);
  }
@@ -0,0 +1,34 @@
+import { GenericFieldLabel } from "@app/components/secret-syncs";
+import { TGitlabSync } from "@app/hooks/api/secretSyncs/types/gitlab-sync";
+
+type Props = {
+  secretSync: TGitlabSync;
+};
+
+export const GitLabSyncDestinationSection = ({ secretSync }: Props) => {
+  const {
+    destinationConfig: {
+      projectName,
+      projectId,
+      targetEnvironment,
+      shouldProtectSecrets,
+      shouldMaskSecrets,
+      shouldHideSecrets
+    }
+  } = secretSync;
+
+  return (
+    <>
+      <GenericFieldLabel label="Project Name">{projectName}</GenericFieldLabel>
+      <GenericFieldLabel label="Project ID">{projectId}</GenericFieldLabel>
+      {targetEnvironment && (
+        <GenericFieldLabel label="Environment">{targetEnvironment}</GenericFieldLabel>
+      )}
+      <GenericFieldLabel label="Protect Secrets">
+        {shouldProtectSecrets ? "Yes" : "No"}
+      </GenericFieldLabel>
+      <GenericFieldLabel label="Mask Secrets">{shouldMaskSecrets ? "Yes" : "No"}</GenericFieldLabel>
+      <GenericFieldLabel label="Hide Secrets">{shouldHideSecrets ? "Yes" : "No"}</GenericFieldLabel>
+    </>
+  );
+};
@@ -22,6 +22,7 @@ import { DatabricksSyncDestinationSection } from "./DatabricksSyncDestinationSec
 import { FlyioSyncDestinationSection } from "./FlyioSyncDestinationSection";
 import { GcpSyncDestinationSection } from "./GcpSyncDestinationSection";
 import { GitHubSyncDestinationSection } from "./GitHubSyncDestinationSection";
+import { GitLabSyncDestinationSection } from "./GitLabSyncDestinationSection";
 import { HCVaultSyncDestinationSection } from "./HCVaultSyncDestinationSection";
 import { HerokuSyncDestinationSection } from "./HerokuSyncDestinationSection";
 import { HumanitecSyncDestinationSection } from "./HumanitecSyncDestinationSection";
@@ -106,6 +107,9 @@ export const SecretSyncDestinationSection = ({ secretSync, onEditDestination }:
    case SecretSync.Flyio:
      DestinationComponents = <FlyioSyncDestinationSection secretSync={secretSync} />;
      break;
+    case SecretSync.Gitlab:
+      DestinationComponents = <GitLabSyncDestinationSection secretSync={secretSync} />;
+      break;
    default:
      throw new Error(`Unhandled Destination Section components: ${destination}`);
  }
@@ -58,6 +58,7 @@ export const SecretSyncOptionsSection = ({ secretSync, onEditOptions }: Props) =
    case SecretSync.Heroku:
    case SecretSync.Render:
    case SecretSync.Flyio:
+    case SecretSync.Gitlab:
      AdditionalSyncOptionsComponent = null;
      break;
    default:
@@ -3,11 +3,13 @@ import { useNavigate, useSearch } from "@tanstack/react-router";

 import { ROUTE_PATHS } from "@app/const/routes";
 import { useWorkspace } from "@app/context";
-import { useAuthorizeIntegration } from "@app/hooks/api";
+import { useCreateAppConnection, useUpdateAppConnection } from "@app/hooks/api/appConnections";
+import { GitlabConnectionMethod } from "@app/hooks/api/appConnections/types/gitlab-connection";

 export const GitLabOAuthCallbackPage = () => {
  const navigate = useNavigate();
-  const { mutateAsync } = useAuthorizeIntegration();
+  const { mutateAsync: createAppConnection } = useCreateAppConnection();
+  const { mutateAsync: updateAppConnection } = useUpdateAppConnection();

  const { code, state } = useSearch({
    from: ROUTE_PATHS.SecretManager.Integratons.GitlabOauthCallbackPage.id
@@ -17,37 +19,83 @@ export const GitLabOAuthCallbackPage = () => {
  useEffect(() => {
    (async () => {
      try {
-        // validate state
-        const [csrfToken, url] = (state as string).split("|", 2);
+        // Validate CSRF state token
+        const [csrfToken] = (state as string).split("|", 2);
+        const storedState = localStorage.getItem("latestCSRFToken");
+        if (csrfToken !== storedState) {
+          console.error("CSRF token mismatch");
+          navigate({
+            to: "/organization/app-connections",
+            search: { error: "invalid_state" }
+          });
+          return;
+        }

-        if (csrfToken !== localStorage.getItem("latestCSRFToken")) return;
        localStorage.removeItem("latestCSRFToken");

-        const integrationAuth = await mutateAsync({
-          workspaceId: currentWorkspace.id,
-          code: code as string,
-          integration: "gitlab",
-          ...(url === ""
-            ? {}
-            : {
-                url
-              })
-        });
+        // Retrieve stored form dataAdd commentMore actions
+        const storedFormData = localStorage.getItem("gitlabConnectionFormData");
+        if (!storedFormData) {
+          console.error("No stored form data found");
+          navigate({
+            to: "/organization/app-connections",
+            search: { error: "missing_form_data" }
+          });
+          return;
+        }
+
+        const formData = JSON.parse(storedFormData);
+        localStorage.removeItem("gitlabConnectionFormData");
+
+        // Prepare app connection data with OAuth credentials
+        const connectionData = {
+          ...formData,
+          method: GitlabConnectionMethod.OAuth,
+          credentials: {
+            code: code as string
+          }
+        };
+
+        let appConnection;
+
+        // Create or update app connection
+        if (formData.isUpdate && formData.connectionId) {
+          appConnection = await updateAppConnection({
+            connectionId: formData.connectionId,
+            ...connectionData
+          });
+        } else {
+          appConnection = await createAppConnection({
+            workspaceId: currentWorkspace.id,
+            ...connectionData
+          });
+        }
+
+        // Navigate to success page or app connections list

        navigate({
-          to: "/secret-manager/$projectId/integrations/gitlab/create",
-          params: {
-            projectId: currentWorkspace.id
-          },
+          to: "/organization/app-connections",
          search: {
-            integrationAuthId: integrationAuth.id
+            success: formData.isUpdate ? "connection_updated" : "connection_created",
+            connectionId: appConnection.id
          }
        });
      } catch (err) {
-        console.error(err);
+        console.error("Error handling GitLab OAuth callback:", err);
+        navigate({
+          to: "/organization/app-connections",
+          search: { error: "connection_failed" }
+        });
      }
    })();
-  }, []);
+  }, [code, state, navigate, createAppConnection, updateAppConnection, currentWorkspace.id]);

-  return <div />;
+  return (
+    <div className="flex h-screen items-center justify-center">
+      <div className="text-center">
+        <div className="mx-auto mb-4 h-8 w-8 animate-spin rounded-full border-b-2 border-primary" />
+        <p className="text-gray-600">Connecting to GitLab...</p>
+      </div>
+    </div>
+  );
 };