fix(view-secret-value): backwards compatibility for read

frontend/src/pages/secret-manager/OverviewPage/components/SecretOverviewTableRow/SecretRenameRow.tsx

@@ -15,6 +15,7 @@ import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionCo
 import { useToggle } from "@app/hooks";
 import { useUpdateSecretV3 } from "@app/hooks/api";
 import { SecretType, SecretV3RawSanitized } from "@app/hooks/api/types";
+import { secretsPermissionCan } from "@app/lib/fn/permission";
 
 enum SecretActionType {
   Created = "created",
@@ -51,8 +52,11 @@ function SecretRenameRow({ environments, getSecretByKey, secretKey, secretPath }
       secretTags: (secretDetails?.tags || []).map((i) => i.slug)
     });
     const isSecretInEnvReadOnly =
-      permission.can(ProjectPermissionSecretActions.DescribeSecret, secretPermissionSubject) &&
-      permission.cannot(ProjectPermissionSecretActions.Edit, secretPermissionSubject);
+      secretsPermissionCan(
+        permission,
+        ProjectPermissionSecretActions.DescribeSecret,
+        secretPermissionSubject
+      ) && permission.cannot(ProjectPermissionSecretActions.Edit, secretPermissionSubject);
     if (isSecretInEnvReadOnly) {
       return true;
     }

frontend/src/pages/secret-manager/SecretDashboardPage/SecretDashboardPage.tsx

@@ -38,6 +38,7 @@ import { useGetProjectSecretsDetails } from "@app/hooks/api/dashboard";
 import { DashboardSecretsOrderBy } from "@app/hooks/api/dashboard/types";
 import { OrderByDirection } from "@app/hooks/api/generic/types";
 import { ProjectType } from "@app/hooks/api/workspace/types";
+import { secretsPermissionCan } from "@app/lib/fn/permission";
 
 import { SecretTableResourceCount } from "../OverviewPage/components/SecretTableResourceCount";
 import { SecretV2MigrationSection } from "../OverviewPage/components/SecretV2MigrationSection";
@@ -103,23 +104,27 @@ const Page = () => {
   const workspaceId = currentWorkspace?.id || "";
   const projectSlug = currentWorkspace?.slug || "";
   const secretPath = (routerQueryParams.secretPath as string) || "/";
-  const canReadSecret = permission.can(
+
+  const canReadSecret = secretsPermissionCan(
+    permission,
     ProjectPermissionSecretActions.DescribeSecret,
-    subject(ProjectPermissionSub.Secrets, {
+    {
       environment,
       secretPath,
       secretName: "*",
       secretTags: ["*"]
-    })
+    }
   );
-  const canReadSecretValue = permission.can(
+
+  const canReadSecretValue = secretsPermissionCan(
+    permission,
     ProjectPermissionSecretActions.ReadValue,
-    subject(ProjectPermissionSub.Secrets, {
+    {
       environment,
       secretPath,
       secretName: "*",
       secretTags: ["*"]
-    })
+    }
   );
 
   const canReadSecretImports = permission.can(

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx

@@ -57,6 +57,7 @@ import { ActorType } from "@app/hooks/api/auditLogs/enums";
 import { useGetSecretAccessList } from "@app/hooks/api/secrets/queries";
 import { SecretV3RawSanitized, WsTag } from "@app/hooks/api/types";
 import { ProjectType } from "@app/hooks/api/workspace/types";
+import { secretsPermissionCan } from "@app/lib/fn/permission";
 
 import { CreateReminderForm } from "./CreateReminderForm";
 import { formSchema, SecretActionType, TFormSchema } from "./SecretListView.utils";
@@ -140,26 +141,24 @@ export const SecretDetailSidebar = ({
     })
   );
 
-  const cannotReadSecretValue = permission.cannot(
+  const cannotReadSecretValue = !secretsPermissionCan(
+    permission,
     ProjectPermissionSecretActions.ReadValue,
-    subject(ProjectPermissionSub.Secrets, {
+    {
       environment,
       secretPath,
       secretName: secretKey,
       secretTags: selectTagSlugs
-    })
+    }
   );
 
   const isReadOnly =
-    permission.can(
-      ProjectPermissionSecretActions.DescribeSecret,
-      subject(ProjectPermissionSub.Secrets, {
-        environment,
-        secretPath,
-        secretName: secretKey,
-        secretTags: selectTagSlugs
-      })
-    ) &&
+    secretsPermissionCan(permission, ProjectPermissionSecretActions.DescribeSecret, {
+      environment,
+      secretPath,
+      secretName: secretKey,
+      secretTags: selectTagSlugs
+    }) &&
     cannotEditSecret &&
     cannotReadSecretValue;
 

frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretItem.tsx

@@ -47,6 +47,7 @@ import {
 
 import { ProjectPermissionSecretActions } from "@app/context/ProjectPermissionContext/types";
 import { Blur } from "@app/components/v2/Blur";
+import { secretsPermissionCan } from "@app/lib/fn/permission";
 import {
   FontAwesomeSpriteName,
   formSchema,
@@ -131,15 +132,12 @@ export const SecretItem = memo(
     });
 
     const isReadOnly =
-      permission.can(
-        ProjectPermissionSecretActions.DescribeSecret,
-        subject(ProjectPermissionSub.Secrets, {
-          environment,
-          secretPath,
-          secretName,
-          secretTags: selectedTagSlugs
-        })
-      ) &&
+      secretsPermissionCan(permission, ProjectPermissionSecretActions.DescribeSecret, {
+        environment,
+        secretPath,
+        secretName,
+        secretTags: selectedTagSlugs
+      }) &&
       permission.cannot(
         ProjectPermissionSecretActions.Edit,
         subject(ProjectPermissionSub.Secrets, {