From e24f70b891499a33bb2e1d7952dfed1d6e3babef Mon Sep 17 00:00:00 2001
From: Tuan Dang <tony@infisical.com>
Date: Thu, 23 Feb 2023 16:47:21 +0700
Subject: [PATCH] Patch Vercel case where secrets can be of type plain and
 sensitive

---
 backend/src/integrations/sync.ts     | 47 +++++++++++++++++-----------
 backend/src/routes/v2/workspace.ts   |  1 -
 backend/src/services/EventService.ts |  2 --
 docs/integrations/cloud/vercel.mdx   | 17 ++++++++++
 4 files changed, 46 insertions(+), 21 deletions(-)

diff --git a/backend/src/integrations/sync.ts b/backend/src/integrations/sync.ts
index 3309e5813..cdf454e58 100644
--- a/backend/src/integrations/sync.ts
+++ b/backend/src/integrations/sync.ts
@@ -545,7 +545,7 @@ const syncSecretsVercel = async ({
     value: string;
     target: string[];
   }
-
+  
   try {
     // Get all (decrypted) secrets back from Vercel in
     // decrypted format
@@ -574,7 +574,10 @@ const syncSecretsVercel = async ({
       .data
       .envs
       .filter((secret: VercelSecret) => secret.target.includes(integration.targetEnvironment))
-      .map(async (secret: VercelSecret) => (await axios.get(
+      .map(async (secret: VercelSecret) => {
+        if (secret.type === 'encrypted') {
+          // case: secret is encrypted -> need to decrypt
+          return (await axios.get(
               `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
               {
                 params,
@@ -583,8 +586,11 @@ const syncSecretsVercel = async ({
                     'Accept-Encoding': 'application/json'
                 }
               }
-          )).data)
-      )).reduce((obj: any, secret: any) => ({
+          )).data;
+        }
+
+        return secret;
+      }))).reduce((obj: any, secret: any) => ({
           ...obj,
           [secret.key]: secret
       }), {});
@@ -615,8 +621,10 @@ const syncSecretsVercel = async ({
             id: res[key].id,
             key: key,
             value: secrets[key],
-            type: "encrypted",
-            target: [integration.targetEnvironment],
+            type: res[key].type,
+            target: res[key].target.includes(integration.targetEnvironment) 
+            ? [...res[key].target] 
+            : [...res[key].target, integration.targetEnvironment]
           });
         }
       } else {
@@ -625,7 +633,7 @@ const syncSecretsVercel = async ({
           id: res[key].id,
           key: key,
           value: res[key].value,
-          type: "encrypted",
+          type: "encrypted", // value doesn't matter
           target: [integration.targetEnvironment],
         });
       }
@@ -650,17 +658,20 @@ const syncSecretsVercel = async ({
     if (updateSecrets.length > 0) {
       updateSecrets.forEach(async (secret: VercelSecret) => {
         const { id, ...updatedSecret } = secret;
-        await axios.patch(
-          `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
-          updatedSecret,
-          {
-            params,
-            headers: {
-              Authorization: `Bearer ${accessToken}`,
-              'Accept-Encoding': 'application/json'
-            },
-          }
-        );
+        
+        if (secret.type !== 'sensitive') {
+          await axios.patch(
+            `${INTEGRATION_VERCEL_API_URL}/v9/projects/${integration.app}/env/${secret.id}`,
+            updatedSecret,
+            {
+              params,
+              headers: {
+                Authorization: `Bearer ${accessToken}`,
+                'Accept-Encoding': 'application/json'
+              },
+            }
+          );
+        }
       });
     }
 
diff --git a/backend/src/routes/v2/workspace.ts b/backend/src/routes/v2/workspace.ts
index 9a753badd..6183c9e66 100644
--- a/backend/src/routes/v2/workspace.ts
+++ b/backend/src/routes/v2/workspace.ts
@@ -118,7 +118,6 @@ router.delete( // TODO - rewire dashboard to this route
 	workspaceController.deleteWorkspaceMembership
 );
 
-
 router.patch(
 	'/:workspaceId/auto-capitalization',
 	requireAuth({
diff --git a/backend/src/services/EventService.ts b/backend/src/services/EventService.ts
index fcbac9ad0..9f982bf75 100644
--- a/backend/src/services/EventService.ts
+++ b/backend/src/services/EventService.ts
@@ -1,5 +1,3 @@
-import { Bot, IBot } from '../models';
-import * as Sentry from '@sentry/node';
 import { handleEventHelper } from '../helpers/event';
 
 interface Event {
diff --git a/docs/integrations/cloud/vercel.mdx b/docs/integrations/cloud/vercel.mdx
index 65526ac22..af20c60cf 100644
--- a/docs/integrations/cloud/vercel.mdx
+++ b/docs/integrations/cloud/vercel.mdx
@@ -30,3 +30,20 @@ Select which Infisical environment secrets you want to sync to which Vercel app
 
 ![integrations vercel](../../images/integrations-vercel-create.png)
 ![integrations vercel](../../images/integrations-vercel.png)
+
+<Info>
+  Infisical syncs every envar to Vercel with type `encrypted` unless an existing
+  envar with the same name in Vercel exists with a different type. Note that
+  Infisical will not be able to update Vercel envars with type `sensitive` since
+  they can only be decrypted and modified by Vercel's deployment systems.
+</Info>
+
+<Warning>
+  The following environment variable names are reserved by Vercel and cannot be
+  synced: `AWS_SECRET_KEY`, `AWS_EXECUTION_ENV`, `AWS_LAMBDA_LOG_GROUP_NAME`,
+  `AWS_LAMBDA_LOG_STREAM_NAME`, `AWS_LAMBDA_FUNCTION_NAME`,
+  `AWS_LAMBDA_FUNCTION_MEMORY_SIZE`, `AWS_LAMBDA_FUNCTION_VERSION`,
+  `NOW_REGION`, `TZ`, `LAMBDA_TASK_ROOT`, `LAMBDA_RUNTIME_DIR`,
+  `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`,
+  `AWS_REGION`, and `AWS_DEFAULT_REGION`.
+</Warning>