feat(vault): add Phase.dev secrets provider - #5123
Open
barrynorman wants to merge 1 commit into
Open
Conversation
Enable deploy-time ${{vault.*}} resolution from Phase via the REST API
(Service Account token + SSE-enabled apps), matching existing Infisical/Doppler providers.
Fixes Dokploy#5122
Co-authored-by: Cursor <cursoragent@cursor.com>
dosubot
Bot
added
the
size:L
3 tasks
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Comment on lines
+37
to
+42
| const url = new URL(`${baseUrl(config)}${path}`); | ||
| if (params) { | ||
| for (const [key, value] of Object.entries(params)) { | ||
| url.searchParams.set(key, value); | ||
| } | ||
| } |
Contributor
There was a problem hiding this comment.
When a custom role has vaultProvider.create but not update access, it can test an existing Phase provider with the masked token and a replacement apiUrl; the route restores the stored token and this request sends it to that URL, disclosing the Service Account credential. How this was verified: The create-authorized test route merges the stored masked token into submitted config, and the Phase client sends it in the Authorization header to the submitted apiUrl.
Knowledge Base Used: DNS and Vault Providers
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
${{vault.*}}resolution via the Phase REST API (Service Account token).Caveats
Test plan
0186_phase_vault_provider.sql/ run drizzle migrate${{vault.KEY}}(or equivalent) and confirm secret resolves at deploy timeapps/dokploy/__test__/env/vault.test.tsDocs
Docs update for Phase in Dokploy/website secrets-providers will follow (or a linked docs PR/issue).
Made with Cursor
Greptile Summary
The PR adds Phase.dev as a deploy-time vault provider, including persistence, migration metadata, dashboard configuration, provider dispatch, REST secret retrieval, credential masking, and tests.
Confidence Score: 3/5
This PR should not merge until a create-only caller is prevented from redirecting an existing Phase provider's stored Service Account token to an arbitrary endpoint.
The new client sends stored Phase credentials to a configurable URL, and the existing create-authorized connection-test flow can merge an existing masked credential into an edited config before issuing that request.
Files Needing Attention: packages/server/src/utils/vault/phase.ts, packages/server/src/db/schema/vault-provider.ts, and apps/dokploy/server/api/routers/vault-provider.ts
Security Review
The Phase connection-test path can disclose an existing provider's Service Account token: a create-only caller can submit an attacker-controlled API URL with the masked credential sentinel, causing the stored token to be merged and forwarded to that URL. How this was verified: The create-authorized test route merges the stored masked token into submitted config, and the Phase client sends it in the Authorization header to the submitted
apiUrl.Reviews (1): Last reviewed commit: "feat(vault): add Phase.dev secrets provi..." | Re-trigger Greptile
Context used: