diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index 71086446f..c4779d9c7 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -537,18 +537,27 @@ export const secretServiceFactory = ({ const secretBlindIndex = await interalGenSecBlindIndexByName(projectId, secretName); - const secret = await (typeof version !== undefined + // Case: The old python SDK uses incorrect logic https://github.com/Infisical/infisical-python/blob/main/infisical/client/infisicalclient.py#L89. + // Fetch secrets using service tokens cannot fetch personal secrets, only shared. + // The mongo backend used to correct this mistake, this line also adds it to current backend + // Mongo backend check: https://github.com/Infisical/infisical-mongo/blob/main/backend/src/helpers/secrets.ts#L658 + let secretType = type; + if (actor === ActorType.SERVICE) { + secretType = SecretType.Shared; + } + + const secret = await (typeof version === undefined ? secretDAL.findOne({ folderId, - type, - userId: type === SecretType.Personal ? actorId : null, + type: secretType, + userId: secretType === SecretType.Personal ? actorId : null, secretBlindIndex }) : secretVersionDAL .findOne({ folderId, - type, - userId: type === SecretType.Personal ? actorId : null, + type: secretType, + userId: secretType === SecretType.Personal ? actorId : null, secretBlindIndex }) .then((el) => SecretsSchema.parse({ ...el, id: el.secretId })));