From f76d3e2a14ac4e8c6af09e2b57f43f2ffe831c66 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Wed, 18 Jun 2025 14:35:49 -0300 Subject: [PATCH 1/6] Add projectSlug parameter on secrets v3 endpoints --- backend/src/server/routes/v3/secret-router.ts | 83 ++++++++++++++++--- 1 file changed, 71 insertions(+), 12 deletions(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index c986e40b4..f860f05e8 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -518,7 +518,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretName: SecretNameSchema.describe(RAW_SECRETS.CREATE.secretName) }), body: z.object({ - workspaceId: z.string().trim().describe(RAW_SECRETS.CREATE.workspaceId), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.CREATE.workspaceId), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.CREATE.projectSlug), environment: z.string().trim().describe(RAW_SECRETS.CREATE.environment), secretPath: z .string() @@ -558,13 +559,32 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + let { workspaceId } = req.body; + if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { + const workspace = await server.services.project.getAProject({ + filter: { + type: ProjectFilterType.SLUG, + orgId: req.permission.orgId, + slug: req.body.projectSlug + }, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); + + if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); + + workspaceId = workspace.id; + } + const secretOperation = await server.services.secret.createSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorOrgId: req.permission.orgId, environment: req.body.environment, actorAuthMethod: req.permission.authMethod, - projectId: req.body.workspaceId, + projectId: workspaceId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type, @@ -582,7 +602,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: req.body.workspaceId, + projectId: workspaceId, ...req.auditLogInfo, event: { type: EventType.CREATE_SECRET, @@ -602,7 +622,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId: req.body.workspaceId, + workspaceId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), @@ -633,7 +653,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretName: BaseSecretNameSchema.describe(RAW_SECRETS.UPDATE.secretName) }), body: z.object({ - workspaceId: z.string().trim().describe(RAW_SECRETS.UPDATE.workspaceId), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.UPDATE.workspaceId), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.UPDATE.projectSlug), environment: z.string().trim().describe(RAW_SECRETS.UPDATE.environment), secretValue: z .string() @@ -679,13 +700,31 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + let { workspaceId } = req.body; + if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { + const workspace = await server.services.project.getAProject({ + filter: { + type: ProjectFilterType.SLUG, + orgId: req.permission.orgId, + slug: req.body.projectSlug + }, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); + + if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); + + workspaceId = workspace.id; + } const secretOperation = await server.services.secret.updateSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorOrgId: req.permission.orgId, actorAuthMethod: req.permission.authMethod, environment: req.body.environment, - projectId: req.body.workspaceId, + projectId: workspaceId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type, @@ -707,7 +746,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: req.body.workspaceId, + projectId: workspaceId, ...req.auditLogInfo, event: { type: EventType.UPDATE_SECRET, @@ -727,7 +766,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId: req.body.workspaceId, + workspaceId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), @@ -757,7 +796,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { secretName: z.string().min(1).describe(RAW_SECRETS.DELETE.secretName) }), body: z.object({ - workspaceId: z.string().trim().describe(RAW_SECRETS.DELETE.workspaceId), + workspaceId: z.string().trim().optional().describe(RAW_SECRETS.DELETE.workspaceId), + projectSlug: z.string().trim().optional().describe(RAW_SECRETS.DELETE.projectSlug), environment: z.string().trim().describe(RAW_SECRETS.DELETE.environment), secretPath: z .string() @@ -780,13 +820,32 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { + let { workspaceId } = req.body; + if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { + const workspace = await server.services.project.getAProject({ + filter: { + type: ProjectFilterType.SLUG, + orgId: req.permission.orgId, + slug: req.body.projectSlug + }, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); + + if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); + + workspaceId = workspace.id; + } + const secretOperation = await server.services.secret.deleteSecretRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId, environment: req.body.environment, - projectId: req.body.workspaceId, + projectId: workspaceId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type @@ -798,7 +857,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: req.body.workspaceId, + projectId: workspaceId, ...req.auditLogInfo, event: { type: EventType.DELETE_SECRET, @@ -817,7 +876,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId: req.body.workspaceId, + workspaceId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), From a8eb72a8c5028dedc04993e2720c461acdffff72 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Wed, 18 Jun 2025 14:48:29 -0300 Subject: [PATCH 2/6] Fix type issue --- backend/src/server/routes/v3/secret-router.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index f860f05e8..70b20f79d 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -577,6 +577,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { workspaceId = workspace.id; } + if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); const secretOperation = await server.services.secret.createSecretRaw({ actorId: req.permission.id, @@ -718,6 +719,8 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { workspaceId = workspace.id; } + if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); + const secretOperation = await server.services.secret.updateSecretRaw({ actorId: req.permission.id, actor: req.permission.type, @@ -838,6 +841,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { workspaceId = workspace.id; } + if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); const secretOperation = await server.services.secret.deleteSecretRaw({ actorId: req.permission.id, From 4800e9c36e0ff1ffffbaf1a7147171f50f7143f5 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Mon, 23 Jun 2025 17:45:21 -0300 Subject: [PATCH 3/6] Address PR comments --- backend/src/server/routes/v3/secret-router.ts | 78 ++++++------------- .../src/services/project/project-service.ts | 39 +++++++++- 2 files changed, 61 insertions(+), 56 deletions(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 70b20f79d..564ff262f 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -560,24 +560,14 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { let { workspaceId } = req.body; - if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { - const workspace = await server.services.project.getAProject({ - filter: { - type: ProjectFilterType.SLUG, - orgId: req.permission.orgId, - slug: req.body.projectSlug - }, - actorId: req.permission.id, - actorAuthMethod: req.permission.authMethod, - actor: req.permission.type, - actorOrgId: req.permission.orgId - }); - - if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); - - workspaceId = workspace.id; - } - if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); + workspaceId = await server.services.project.extractProjectIdFromSlug({ + projectSlug: req.body.projectSlug, + projectId: req.body.workspaceId, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); const secretOperation = await server.services.secret.createSecretRaw({ actorId: req.permission.id, @@ -702,24 +692,14 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { let { workspaceId } = req.body; - if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { - const workspace = await server.services.project.getAProject({ - filter: { - type: ProjectFilterType.SLUG, - orgId: req.permission.orgId, - slug: req.body.projectSlug - }, - actorId: req.permission.id, - actorAuthMethod: req.permission.authMethod, - actor: req.permission.type, - actorOrgId: req.permission.orgId - }); - - if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); - - workspaceId = workspace.id; - } - if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); + workspaceId = await server.services.project.extractProjectIdFromSlug({ + projectSlug: req.body.projectSlug, + projectId: req.body.workspaceId, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); const secretOperation = await server.services.secret.updateSecretRaw({ actorId: req.permission.id, @@ -824,24 +804,14 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { let { workspaceId } = req.body; - if (req.permission.type === ActorType.IDENTITY && req.body.projectSlug && !workspaceId) { - const workspace = await server.services.project.getAProject({ - filter: { - type: ProjectFilterType.SLUG, - orgId: req.permission.orgId, - slug: req.body.projectSlug - }, - actorId: req.permission.id, - actorAuthMethod: req.permission.authMethod, - actor: req.permission.type, - actorOrgId: req.permission.orgId - }); - - if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.body.projectSlug}` }); - - workspaceId = workspace.id; - } - if (!workspaceId) throw new BadRequestError({ message: "You must provide workspaceId or projectSlug" }); + workspaceId = await server.services.project.extractProjectIdFromSlug({ + projectSlug: req.body.projectSlug, + projectId: req.body.workspaceId, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); const secretOperation = await server.services.secret.deleteSecretRaw({ actorId: req.permission.id, diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 4650c474d..29774fcc8 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -42,7 +42,7 @@ import { TProjectPermission } from "@app/lib/types"; import { TQueueServiceFactory } from "@app/queue"; import { TPkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal"; -import { ActorType } from "../auth/auth-type"; +import { ActorAuthMethod, ActorType } from "../auth/auth-type"; import { TCertificateDALFactory } from "../certificate/certificate-dal"; import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal"; import { expandInternalCa } from "../certificate-authority/certificate-authority-fns"; @@ -82,6 +82,7 @@ import { assignWorkspaceKeysToMembers, bootstrapSshProject, createProjectKey } f import { TProjectQueueFactory } from "./project-queue"; import { TProjectSshConfigDALFactory } from "./project-ssh-config-dal"; import { + ProjectFilterType, TCreateProjectDTO, TDeleteProjectDTO, TDeleteProjectWorkflowIntegration, @@ -866,6 +867,39 @@ export const projectServiceFactory = ({ }); }; + const extractProjectIdFromSlug = async ({ + projectSlug, + projectId, + actorId, + actorAuthMethod, + actor, + actorOrgId + }: { + projectSlug?: string; + projectId?: string; + actorId: string; + actorAuthMethod: ActorAuthMethod; + actor: ActorType; + actorOrgId: string; + }) => { + if (projectId) return projectId; + if (!projectSlug) throw new BadRequestError({ message: "You must provide projectSlug or workspaceId" }); + const project = await getAProject({ + filter: { + type: ProjectFilterType.SLUG, + orgId: actorOrgId, + slug: projectSlug + }, + actorId, + actorAuthMethod, + actor, + actorOrgId + }); + + if (!project) throw new NotFoundError({ message: `No project found with slug ${projectSlug}` }); + return project.id; + }; + const getProjectUpgradeStatus = async ({ projectId, actor, @@ -2006,6 +2040,7 @@ export const projectServiceFactory = ({ getProjectSshConfig, updateProjectSshConfig, requestProjectAccess, - searchProjects + searchProjects, + extractProjectIdFromSlug }; }; From 39abeaaab584cba956ed049d15f4e0b1f753c28c Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Mon, 23 Jun 2025 23:05:12 -0300 Subject: [PATCH 4/6] Small fix on workspaceId variable definition on secret-router --- backend/src/server/routes/v3/secret-router.ts | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 564ff262f..1db8414e7 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -559,8 +559,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - let { workspaceId } = req.body; - workspaceId = await server.services.project.extractProjectIdFromSlug({ + const workspaceId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, @@ -691,8 +690,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - let { workspaceId } = req.body; - workspaceId = await server.services.project.extractProjectIdFromSlug({ + const workspaceId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, @@ -803,8 +801,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - let { workspaceId } = req.body; - workspaceId = await server.services.project.extractProjectIdFromSlug({ + const workspaceId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, From 42aaddccd518e159cbcb8516aa3daecb1eb01d09 Mon Sep 17 00:00:00 2001 From: carlosmonastyrski Date: Mon, 23 Jun 2025 23:13:29 -0300 Subject: [PATCH 5/6] Lint fix --- backend/src/server/routes/v3/secret-router.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 1db8414e7..4e00cfe09 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -559,7 +559,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const workspaceId = await server.services.project.extractProjectIdFromSlug({ + const workspaceId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, From 59cc857aeffd015c9b70cb5ee812309f1282c89e Mon Sep 17 00:00:00 2001 From: Daniel Hougaard Date: Tue, 24 Jun 2025 19:37:32 +0400 Subject: [PATCH 6/6] fix: further improve inconsistencies --- backend/src/server/routes/v3/secret-router.ts | 57 ++++++++++--------- backend/src/services/secret/secret-service.ts | 4 +- backend/src/services/secret/secret-types.ts | 3 +- 3 files changed, 33 insertions(+), 31 deletions(-) diff --git a/backend/src/server/routes/v3/secret-router.ts b/backend/src/server/routes/v3/secret-router.ts index 4e00cfe09..33878f1e7 100644 --- a/backend/src/server/routes/v3/secret-router.ts +++ b/backend/src/server/routes/v3/secret-router.ts @@ -4,7 +4,7 @@ import { z } from "zod"; import { SecretApprovalRequestsSchema, SecretsSchema, SecretType, ServiceTokenScopes } from "@app/db/schemas"; import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types"; import { ApiDocsTags, RAW_SECRETS, SECRETS } from "@app/lib/api-docs"; -import { BadRequestError, NotFoundError } from "@app/lib/errors"; +import { BadRequestError } from "@app/lib/errors"; import { removeTrailingSlash } from "@app/lib/fn"; import { secretsLimit, writeLimit } from "@app/server/config/rateLimiter"; import { BaseSecretNameSchema, SecretNameSchema } from "@app/server/lib/schemas"; @@ -12,7 +12,6 @@ import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; import { getUserAgentType } from "@app/server/plugins/audit-log"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { ActorType, AuthMode } from "@app/services/auth/auth-type"; -import { ProjectFilterType } from "@app/services/project/project-types"; import { ResourceMetadataSchema } from "@app/services/resource-metadata/resource-metadata-schema"; import { SecretOperations, SecretProtectionType } from "@app/services/secret/secret-types"; import { SecretUpdateMode } from "@app/services/secret-v2-bridge/secret-v2-bridge-types"; @@ -286,22 +285,17 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { environment = scope[0].environment; workspaceId = req.auth.serviceToken.projectId; } - } else if (req.permission.type === ActorType.IDENTITY && req.query.workspaceSlug && !workspaceId) { - const workspace = await server.services.project.getAProject({ - filter: { - type: ProjectFilterType.SLUG, - orgId: req.permission.orgId, - slug: req.query.workspaceSlug - }, + } else { + const projectId = await server.services.project.extractProjectIdFromSlug({ + projectSlug: req.query.workspaceSlug, + projectId: workspaceId, actorId: req.permission.id, actorAuthMethod: req.permission.authMethod, actor: req.permission.type, actorOrgId: req.permission.orgId }); - if (!workspace) throw new NotFoundError({ message: `No project found with slug ${req.query.workspaceSlug}` }); - - workspaceId = workspace.id; + workspaceId = projectId; } if (!workspaceId || !environment) throw new BadRequestError({ message: "Missing workspace id or environment" }); @@ -442,11 +436,23 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { environment = scope[0].environment; workspaceId = req.auth.serviceToken.projectId; } + } else { + const projectId = await server.services.project.extractProjectIdFromSlug({ + projectSlug: workspaceSlug, + projectId: workspaceId, + actorId: req.permission.id, + actorAuthMethod: req.permission.authMethod, + actor: req.permission.type, + actorOrgId: req.permission.orgId + }); + + workspaceId = projectId; } if (!environment) throw new BadRequestError({ message: "Missing environment" }); - if (!workspaceId && !workspaceSlug) + if (!workspaceId) { throw new BadRequestError({ message: "You must provide workspaceSlug or workspaceId" }); + } const secret = await server.services.secret.getSecretByNameRaw({ actorId: req.permission.id, @@ -457,7 +463,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { environment, projectId: workspaceId, viewSecretValue: req.query.viewSecretValue, - projectSlug: workspaceSlug, path: secretPath, secretName: req.params.secretName, type: req.query.type, @@ -559,7 +564,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const workspaceId = await server.services.project.extractProjectIdFromSlug({ + const projectId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, @@ -574,7 +579,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, environment: req.body.environment, actorAuthMethod: req.permission.authMethod, - projectId: workspaceId, + projectId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type, @@ -592,7 +597,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: workspaceId, + projectId, ...req.auditLogInfo, event: { type: EventType.CREATE_SECRET, @@ -612,7 +617,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId, + workspaceId: projectId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), @@ -690,7 +695,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const workspaceId = await server.services.project.extractProjectIdFromSlug({ + const projectId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, @@ -705,7 +710,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { actorOrgId: req.permission.orgId, actorAuthMethod: req.permission.authMethod, environment: req.body.environment, - projectId: workspaceId, + projectId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type, @@ -727,7 +732,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: workspaceId, + projectId, ...req.auditLogInfo, event: { type: EventType.UPDATE_SECRET, @@ -747,7 +752,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId, + workspaceId: projectId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), @@ -801,7 +806,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.API_KEY, AuthMode.SERVICE_TOKEN, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { - const workspaceId = await server.services.project.extractProjectIdFromSlug({ + const projectId = await server.services.project.extractProjectIdFromSlug({ projectSlug: req.body.projectSlug, projectId: req.body.workspaceId, actorId: req.permission.id, @@ -816,7 +821,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId, environment: req.body.environment, - projectId: workspaceId, + projectId, secretPath: req.body.secretPath, secretName: req.params.secretName, type: req.body.type @@ -828,7 +833,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { const { secret } = secretOperation; await server.services.auditLog.createAuditLog({ - projectId: workspaceId, + projectId, ...req.auditLogInfo, event: { type: EventType.DELETE_SECRET, @@ -847,7 +852,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => { distinctId: getTelemetryDistinctId(req), properties: { numberOfSecrets: 1, - workspaceId, + workspaceId: projectId, environment: req.body.environment, secretPath: req.body.secretPath, channel: getUserAgentType(req.headers["user-agent"]), diff --git a/backend/src/services/secret/secret-service.ts b/backend/src/services/secret/secret-service.ts index d5c836ff7..159bee8e3 100644 --- a/backend/src/services/secret/secret-service.ts +++ b/backend/src/services/secret/secret-service.ts @@ -1543,9 +1543,8 @@ export const secretServiceFactory = ({ actor, environment, viewSecretValue, - projectId: workspaceId, + projectId, expandSecretReferences, - projectSlug, actorId, actorOrgId, actorAuthMethod, @@ -1553,7 +1552,6 @@ export const secretServiceFactory = ({ includeImports, version }: TGetASecretRawDTO) => { - const projectId = workspaceId || (await projectDAL.findProjectBySlug(projectSlug as string, actorOrgId)).id; const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId); if (shouldUseSecretV2Bridge) { const secret = await secretV2BridgeService.getSecretByName({ diff --git a/backend/src/services/secret/secret-types.ts b/backend/src/services/secret/secret-types.ts index 91fc2eb6a..12b8e7175 100644 --- a/backend/src/services/secret/secret-types.ts +++ b/backend/src/services/secret/secret-types.ts @@ -229,8 +229,7 @@ export type TGetASecretRawDTO = { type: "shared" | "personal"; includeImports?: boolean; version?: number; - projectSlug?: string; - projectId?: string; + projectId: string; } & Omit; export type TGetASecretByIdRawDTO = {