From ea9da6d2a84fa62a8f0810cbe8940c8e38770ff8 Mon Sep 17 00:00:00 2001
From: Daniel Hougaard <daniel@infisical.com>
Date: Wed, 5 Mar 2025 19:19:12 +0400
Subject: [PATCH] fix: view secret value (requested changes)

---
 .../src/server/routes/v1/dashboard-router.ts  |  3 +
 .../InfisicalSecretInput.tsx                  |  1 +
 frontend/src/hooks/api/secrets/queries.tsx    | 23 +++++--
 frontend/src/hooks/api/secrets/types.ts       |  1 +
 .../components/QuickSearchSecretItem.tsx      | 62 ++++++++++++-------
 5 files changed, 64 insertions(+), 26 deletions(-)

diff --git a/backend/src/server/routes/v1/dashboard-router.ts b/backend/src/server/routes/v1/dashboard-router.ts
index abe998c2e..27ba3f8a3 100644
--- a/backend/src/server/routes/v1/dashboard-router.ts
+++ b/backend/src/server/routes/v1/dashboard-router.ts
@@ -5,6 +5,7 @@ import { ActionProjectType, SecretFoldersSchema, SecretImportsSchema } from "@ap
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
 import {
   ProjectPermissionDynamicSecretActions,
+  ProjectPermissionSecretActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { DASHBOARD } from "@app/lib/api-docs";
@@ -688,6 +689,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             .optional(),
           secrets: secretRawSchema
             .extend({
+              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
               tags: SanitizedTagSchema.array().optional()
@@ -734,6 +736,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
 
       const secrets = await server.services.secret.getSecretsRawByFolderMappings(
         {
+          filterByAction: ProjectPermissionSecretActions.DescribeSecret,
           projectId,
           folderMappings,
           filters: {
diff --git a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
index 6fbe96238..dd6d3575e 100644
--- a/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
+++ b/frontend/src/components/v2/InfisicalSecretInput/InfisicalSecretInput.tsx
@@ -120,6 +120,7 @@ export const InfisicalSecretInput = forwardRef<HTMLTextAreaElement, Props>(
 
     const isPopupOpen = Boolean(suggestionSource.isOpen) && isFocused;
     const { data: secrets } = useGetProjectSecrets({
+      viewSecretValue: false,
       environment: suggestionSource.environment || "",
       secretPath: suggestionSource.secretPath || "",
       workspaceId,
diff --git a/frontend/src/hooks/api/secrets/queries.tsx b/frontend/src/hooks/api/secrets/queries.tsx
index 5549bdcec..3e82c3b90 100644
--- a/frontend/src/hooks/api/secrets/queries.tsx
+++ b/frontend/src/hooks/api/secrets/queries.tsx
@@ -26,8 +26,13 @@ import {
 
 export const secretKeys = {
   // this is also used in secretSnapshot part
-  getProjectSecret: ({ workspaceId, environment, secretPath }: TGetProjectSecretsKey) =>
-    [{ workspaceId, environment, secretPath }, "secrets"] as const,
+  getProjectSecret: ({
+    workspaceId,
+    environment,
+    secretPath,
+    viewSecretValue
+  }: TGetProjectSecretsKey) =>
+    [{ workspaceId, environment, secretPath, viewSecretValue }, "secrets"] as const,
   getSecretVersion: (secretId: string) => [{ secretId }, "secret-versions"] as const,
   getSecretAccessList: ({
     workspaceId,
@@ -44,13 +49,15 @@ export const fetchProjectSecrets = async ({
   environment,
   secretPath,
   includeImports,
-  expandSecretReferences
+  expandSecretReferences,
+  viewSecretValue
 }: TGetProjectSecretsKey) => {
   const { data } = await apiRequest.get<SecretV3RawResponse>("/api/v3/secrets/raw", {
     params: {
       environment,
       workspaceId,
       secretPath,
+      viewSecretValue,
       expandSecretReferences,
       include_imports: includeImports
     }
@@ -108,6 +115,7 @@ export const useGetProjectSecrets = ({
   workspaceId,
   environment,
   secretPath,
+  viewSecretValue,
   options
 }: TGetProjectSecretsDTO & {
   options?: Omit<
@@ -124,8 +132,13 @@ export const useGetProjectSecrets = ({
     ...options,
     // wait for all values to be available
     enabled: Boolean(workspaceId && environment) && (options?.enabled ?? true),
-    queryKey: secretKeys.getProjectSecret({ workspaceId, environment, secretPath }),
-    queryFn: () => fetchProjectSecrets({ workspaceId, environment, secretPath }),
+    queryKey: secretKeys.getProjectSecret({
+      workspaceId,
+      environment,
+      secretPath,
+      viewSecretValue
+    }),
+    queryFn: () => fetchProjectSecrets({ workspaceId, environment, secretPath, viewSecretValue }),
     select: useCallback(
       (data: Awaited<ReturnType<typeof fetchProjectSecrets>>) => mergePersonalSecrets(data.secrets),
       []
diff --git a/frontend/src/hooks/api/secrets/types.ts b/frontend/src/hooks/api/secrets/types.ts
index 9a419a037..d7b6cbcad 100644
--- a/frontend/src/hooks/api/secrets/types.ts
+++ b/frontend/src/hooks/api/secrets/types.ts
@@ -113,6 +113,7 @@ export type TGetProjectSecretsKey = {
   environment: string;
   secretPath?: string;
   includeImports?: boolean;
+  viewSecretValue?: boolean;
   expandSecretReferences?: boolean;
 };
 
diff --git a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
index e901a4ff7..9943de5b6 100644
--- a/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
+++ b/frontend/src/pages/secret-manager/OverviewPage/components/SecretSearchInput/components/QuickSearchSecretItem.tsx
@@ -110,21 +110,31 @@ export const QuickSearchSecretItem = ({
             </Badge>
           )}
           {isSingleEnv ? (
-            <IconButton
-              size="md"
-              variant="plain"
-              colorSchema="secondary"
-              ariaLabel="Copy secret value"
-              onClick={(e) => {
-                e.stopPropagation();
-                const el = envSlugMap.get(groupSecret.env)?.name;
-                if (el) {
-                  handleCopy(groupSecret.value!, el);
-                }
-              }}
+            <Tooltip
+              isDisabled={!groupSecret?.secretValueHidden}
+              content={
+                groupSecret?.secretValueHidden
+                  ? "You do not have permission to view this secret value"
+                  : ""
+              }
             >
-              <FontAwesomeIcon icon={isUrlCopied ? faCheck : faCopy} />
-            </IconButton>
+              <IconButton
+                size="md"
+                isDisabled={groupSecret?.secretValueHidden}
+                variant="plain"
+                colorSchema="secondary"
+                ariaLabel="Copy secret value"
+                onClick={(e) => {
+                  e.stopPropagation();
+                  const el = envSlugMap.get(groupSecret.env)?.name;
+                  if (el) {
+                    handleCopy(groupSecret.value!, el);
+                  }
+                }}
+              >
+                <FontAwesomeIcon icon={isUrlCopied ? faCheck : faCopy} />
+              </IconButton>
+            </Tooltip>
           ) : (
             <DropdownMenu>
               <DropdownMenuTrigger asChild>
@@ -158,14 +168,24 @@ export const QuickSearchSecretItem = ({
           )}
           <DropdownMenu>
             <DropdownMenuTrigger asChild>
-              <IconButton
-                size="md"
-                variant="plain"
-                colorSchema="secondary"
-                ariaLabel="View secret value"
+              <Tooltip
+                isDisabled={!groupSecret?.secretValueHidden}
+                content={
+                  groupSecret?.secretValueHidden
+                    ? "You do not have permission to view this secret value"
+                    : ""
+                }
               >
-                <FontAwesomeIcon icon={faEye} />
-              </IconButton>
+                <IconButton
+                  size="md"
+                  isDisabled={groupSecret?.secretValueHidden}
+                  variant="plain"
+                  colorSchema="secondary"
+                  ariaLabel="View secret value"
+                >
+                  <FontAwesomeIcon icon={faEye} />
+                </IconButton>
+              </Tooltip>
             </DropdownMenuTrigger>
             <DropdownMenuContent align="end">
               <DropdownMenuLabel>Hover to Reveal...</DropdownMenuLabel>