Skip to content

feat(updater): allow to skip secrets sync for branching #2932

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
avallete wants to merge 4 commits into from
Closed

feat(updater): allow to skip secrets sync for branching #2932

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6a90beb
feat(updater): allow to skip secrets sync for branching
avallete Nov 29, 2024
a940423
Merge branch 'develop' into fix/skip-auth-secrets-syncing
avallete Nov 29, 2024
189f294
chore: apply pr comment
avallete Nov 29, 2024
c139ed3
Merge branch 'develop' into fix/skip-auth-secrets-syncing
avallete Dec 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
54 changes: 54 additions & 0 deletions pkg/config/auth.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,6 +217,60 @@ type (
}
)

func (a *auth) StripUpdateBodySecrets(body v1API.UpdateAuthConfigBody) v1API.UpdateAuthConfigBody {
body.SmtpPass = nil

@sweatybridge sweatybridge Dec 7, 2024

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately most of these secrets are required fields that we validate on api side when something like smtp is enabled. Setting them to nil would essentially block everyone from updating the whole config block.

An alternative is to let users opt out of those configs by turning the struct into pointers. Similar to #2954

@avallete avallete Dec 9, 2024

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Indeed I tested with a deployed project, and in such case the update went through but at the "first deploy" if no password is setup already then it'll fail.

// Only strip secrets for locally enabled providers because other envs won't be loaded
body.SmsTwilioAuthToken = nil
body.SmsTwilioVerifyAuthToken = nil
body.SmsMessagebirdAccessKey = nil
body.SmsTextlocalApiKey = nil
body.SmsVonageApiSecret = nil
body.HookMfaVerificationAttemptSecrets = nil
body.HookPasswordVerificationAttemptSecrets = nil
body.HookCustomAccessTokenSecrets = nil
body.HookSendSmsSecrets = nil
body.HookSendEmailSecrets = nil
body.ExternalAppleSecret = nil
body.ExternalAppleClientId = nil
body.ExternalAzureSecret = nil
body.ExternalAzureClientId = nil
body.ExternalBitbucketSecret = nil
body.ExternalBitbucketClientId = nil
body.ExternalDiscordSecret = nil
body.ExternalDiscordClientId = nil
body.ExternalFacebookSecret = nil
body.ExternalFacebookClientId = nil
body.ExternalFigmaSecret = nil
body.ExternalFigmaClientId = nil
body.ExternalGithubSecret = nil
body.ExternalGithubClientId = nil
body.ExternalGitlabSecret = nil
body.ExternalGitlabClientId = nil
body.ExternalGoogleSecret = nil
body.ExternalGoogleClientId = nil
body.ExternalKakaoSecret = nil
body.ExternalKakaoClientId = nil
body.ExternalKeycloakSecret = nil
body.ExternalKeycloakClientId = nil
body.ExternalLinkedinOidcSecret = nil
body.ExternalLinkedinOidcClientId = nil
body.ExternalNotionSecret = nil
body.ExternalNotionClientId = nil
body.ExternalSlackOidcSecret = nil
body.ExternalSlackOidcClientId = nil
body.ExternalSpotifySecret = nil
body.ExternalSpotifyClientId = nil
body.ExternalTwitchSecret = nil
body.ExternalTwitchClientId = nil
body.ExternalTwitterSecret = nil
body.ExternalTwitterClientId = nil
body.ExternalWorkosSecret = nil
body.ExternalWorkosClientId = nil
body.ExternalZoomSecret = nil
body.ExternalZoomClientId = nil
return body
}

func (a *auth) ToUpdateAuthConfigBody() v1API.UpdateAuthConfigBody {
body := v1API.UpdateAuthConfigBody{
SiteUrl: &a.SiteUrl,
Expand Down
11 changes: 8 additions & 3 deletions pkg/config/updater.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,11 +10,12 @@ import (
)

type ConfigUpdater struct {
client v1API.ClientWithResponses
client v1API.ClientWithResponses
skipSecrets bool
}

func NewConfigUpdater(client v1API.ClientWithResponses) ConfigUpdater {
return ConfigUpdater{client: client}
return ConfigUpdater{client: client, skipSecrets: false}
}

func (u *ConfigUpdater) UpdateRemoteConfig(ctx context.Context, remote baseConfig, filter ...func(string) bool) error {
Expand Down Expand Up @@ -123,7 +124,11 @@ func (u *ConfigUpdater) UpdateAuthConfig(ctx context.Context, projectRef string,
return nil
}
}
if resp, err := u.client.V1UpdateAuthServiceConfigWithResponse(ctx, projectRef, c.ToUpdateAuthConfigBody()); err != nil {
var updateBody = c.ToUpdateAuthConfigBody()
if u.skipSecrets {
updateBody = c.StripUpdateBodySecrets(updateBody)
}
if resp, err := u.client.V1UpdateAuthServiceConfigWithResponse(ctx, projectRef, updateBody); err != nil {
return errors.Errorf("failed to update Auth config: %w", err)
} else if status := resp.StatusCode(); status < 200 || status >= 300 {
return errors.Errorf("unexpected status %d: %s", status, string(resp.Body))
Expand Down