Skip to content

feat: Using global private environment to save secrets[INS-4715]#8233

Merged
cwangsmv merged 46 commits into
developfrom
feat/vault-environment
Feb 17, 2025
Merged

feat: Using global private environment to save secrets[INS-4715]#8233
cwangsmv merged 46 commits into
developfrom
feat/vault-environment

Conversation

@cwangsmv

@cwangsmv cwangsmv commented Dec 5, 2024

Copy link
Copy Markdown
Contributor

Changes
Leverage global private environment to add built-in support secret management capabilities.
Add a new secret type environment key-value pair to store secret variables with the following features:

  • Secret environment variables will add a vault prefix automatically to distinguish with normal environment variables. If you define a secret environment called foo, you need to input {{ vault.foo }} to use as environment variable
  • Secret environment values are encrypted in the database
  • Secret environment values are masked unless in environment editor/variable editor modal/using in request
  • When the private environment is exported, a default placeholder string will replace its real value
  • When user has rest the encryption key (aka: vault key) in other devices, all local secret environment variables will be removed
Screenshot 2024-12-05 at 14 44 33

We also introduce a new term Vault Key.
Vault key is used to encrypt/decrypt secret environment variables, it is not synced to the cloud, so users need to save the key themselves.
User could reset the vault key, but this will remove local secret environments in all devices.
Add a new UI in Preferences page for management:
Screenshot 2025-01-07 at 15 54 55

Vault secrets can be used in scripts if user set Enable vault in scripts in settings. (Only allow to get vault secret value, set/unset/clear methods are not allowd)
The pattern is

insomnia.vault.get(<vault_name>)

Tasks

  • Add new UI for secret environment variables
  • Secret environment variables processing logic
    • Mask value unless in editor and request
    • Encryption/Decryption logic
  • Vault key UI
    • New vault key management UI in Preferences modal
    • API integration and SSE event handling
    • Vault key/hash CRUD operations
  • Pre-requset & After-response support
  • Add smoke test

@cwangsmv
cwangsmv marked this pull request as draft December 5, 2024 07:08
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch from a546711 to f8cb14d Compare December 9, 2024 08:45
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch 2 times, most recently from b453cd8 to bfb3d55 Compare January 6, 2025 09:10
@cwangsmv
cwangsmv marked this pull request as ready for review January 8, 2025 07:22
@cwangsmv
cwangsmv requested review from a team and ihexxa January 8, 2025 07:22
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch from 9b384d8 to 3f66590 Compare January 8, 2025 07:28
Comment thread packages/insomnia/package.json Outdated
Comment thread packages/insomnia-sdk/src/objects/environments.ts
Comment thread packages/insomnia/src/models/environment.ts Outdated
Comment thread packages/insomnia/src/models/environment.ts Outdated
Comment thread packages/insomnia/src/main/ipc/secretStorage.ts
Comment thread packages/insomnia/src/models/environment.ts Outdated
Comment thread packages/insomnia/src/ui/components/upgrade-notice.tsx Outdated
Comment thread packages/insomnia/src/ui/components/upgrade-notices.tsx Outdated
Comment thread packages/insomnia/src/models/environment.ts Outdated
Comment thread packages/insomnia/src/models/environment.ts Outdated
Comment thread packages/insomnia/src/ui/routes/auth.vaultKey.ts Outdated
Comment thread packages/insomnia/src/common/settings.ts Outdated
name: vault env
data:
__insomnia_vault:
secret: eyJpdiI6ImY2NTAzYmVjMDIyYTE2YzNlNTNkMWY5MiIsInQiOiI3YzgwMGVkZGVhZGZmN2MxMjVmNmVmNzlkODY2NGM0YyIsImFkIjoiIiwiZCI6IjU2YzdlODU0NDA3MjdmOTQifQ==

Check failure

Code scanning / Semgrep OSS

Semgrep Finding: generic.secrets.security.detected-generic-secret.detected-generic-secret

Generic Secret detected
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch 3 times, most recently from 5ed3dbd to 241dbc4 Compare February 17, 2025 08:46
ihexxa
ihexxa previously approved these changes Feb 17, 2025

@ihexxa ihexxa left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some minor comments and tend to move forward as there're several rounds review before, but ideally we might still have more tests in the next as it is a relatively huge change.

Comment thread packages/insomnia/src/ui/components/editors/environment-utils.tsx
return false;
}, [selectedEnvironment]);
// Do not allowed to switch to json environment if contains secret item
const allowSwitchEnvironment = !selectedEnvironment?.kvPairData?.some(d => d.type === EnvironmentKvPairDataType.SECRET);

@ihexxa ihexxa Feb 17, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Probably need to to auto switch to kv mode for one user has been in the json mode?

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I will add in a separate PR and add a test to cover this

Comment thread packages/insomnia/src/ui/components/upgrade-notices.tsx Outdated
@cwangsmv
cwangsmv enabled auto-merge (squash) February 17, 2025 10:00
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch from b4430ab to c240e19 Compare February 17, 2025 10:00
@cwangsmv
cwangsmv disabled auto-merge February 17, 2025 10:13
2.secret key-value pair ui
2.Add basic integration with AWS
3.Add vault secret cache and config UI
2.add a hook to get user plan
2.AWS secret nunjuckt tag config UI
…lobal environment

2.mask all secret items value when export
@cwangsmv
cwangsmv force-pushed the feat/vault-environment branch from c240e19 to c05a95d Compare February 17, 2025 10:14
@cwangsmv
cwangsmv merged commit 3abe124 into develop Feb 17, 2025
@cwangsmv
cwangsmv deleted the feat/vault-environment branch February 17, 2025 10:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants