feat: get secret by ID #3181
feat: get secret by ID #3181
Conversation
WalkthroughA new GET endpoint has been added to the secret router for retrieving a secret by its ID, which includes authentication verification, rate limiting, and schema validation for both request parameters and response structure. The backend services have been updated to support this new endpoint, with modifications to the data access layer (DAL) that introduce new join operations to retrieve additional contextual data related to folders and environments. A new service function has been implemented to retrieve a secret by its ID, incorporating permission checks and decryption of sensitive information before returning a structured result. Relevant type definitions have been introduced and updated to facilitate the new functionality in secret retrieval. Additionally, the frontend has been modified to include a new icon button for copying the secret ID and to reorganize the layout for secret deletion controls. Possibly related PRs
Suggested reviewers
Warning There were issues while running some tools. Please review the errors and either fix the tool’s configuration or disable the tool if it’s a critical failure. 🔧 ESLint
backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.tsOops! Something went wrong! :( ESLint: 8.57.1 ESLint couldn't find the plugin "@typescript-eslint/eslint-plugin". (The package "@typescript-eslint/eslint-plugin" was not found when loaded as a Node module from the directory "/backend".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: The plugin "@typescript-eslint/eslint-plugin" was referenced from the config file in "backend/.eslintrc.js". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team. backend/src/server/routes/v3/secret-router.tsOops! Something went wrong! :( ESLint: 8.57.1 ESLint couldn't find the plugin "@typescript-eslint/eslint-plugin". (The package "@typescript-eslint/eslint-plugin" was not found when loaded as a Node module from the directory "/backend".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: The plugin "@typescript-eslint/eslint-plugin" was referenced from the config file in "backend/.eslintrc.js". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team. backend/src/services/secret-v2-bridge/secret-v2-bridge-service.tsOops! Something went wrong! :( ESLint: 8.57.1 ESLint couldn't find the plugin "@typescript-eslint/eslint-plugin". (The package "@typescript-eslint/eslint-plugin" was not found when loaded as a Node module from the directory "/backend".) It's likely that the plugin isn't installed correctly. Try reinstalling by running the following: The plugin "@typescript-eslint/eslint-plugin" was referenced from the config file in "backend/.eslintrc.js". If you still can't figure out the problem, please stop by https://eslint.org/chat/help to chat with the team.
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (3)
🧰 Additional context used🧠 Learnings (1)backend/src/server/routes/v3/secret-router.ts (1)⏰ Context from checks skipped due to timeout of 90000ms (4)
🔇 Additional comments (6)
✨ Finishing Touches
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Caution No docstrings were generated. |
DanielHougaard
force-pushed
the
daniel/id-get-secret
branch
from
c00ea0f to
f640a48
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
backend/src/server/routes/v3/secret-router.ts (1)
383-423: Consider adding audit logging and telemetry tracking for consistency.The new endpoint for retrieving secrets by ID is well implemented with proper schema validation and authentication. However, unlike similar GET endpoints in this file (such as
/raw/:secretName), it's missing audit logging and telemetry tracking.Consider adding audit logging and telemetry tracking for security and consistency:
server.route({ method: "GET", url: "/raw/id/:secretId", config: { rateLimit: secretsLimit }, schema: { params: z.object({ secretId: z.string() }), response: { secret: secretRawSchema.extend({ secretPath: z.string(), tags: SecretTagsSchema.pick({ id: true, slug: true, color: true }) .extend({ name: z.string() }) .array() .optional(), secretMetadata: ResourceMetadataSchema.optional() }) }) } }, onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), handler: async (req) => { const { secretId } = req.params; const secret = await server.services.secret.getSecretByIdRaw({ actorId: req.permission.id, actor: req.permission.type, actorAuthMethod: req.permission.authMethod, actorOrgId: req.permission.orgId, secretId }); + await server.services.auditLog.createAuditLog({ + projectId: secret.workspace, + ...req.auditLogInfo, + event: { + type: EventType.GET_SECRET, + metadata: { + environment: secret.environment, + secretPath: secret.secretPath, + secretId: secret.id, + secretKey: secret.secretKey, + secretVersion: secret.version + } + } + }); + + if (getUserAgentType(req.headers["user-agent"]) !== UserAgentType.K8_OPERATOR) { + await server.services.telemetry.sendPostHogEvents({ + event: PostHogEventTypes.SecretPulled, + distinctId: getTelemetryDistinctId(req), + properties: { + numberOfSecrets: 1, + workspaceId: secret.workspace, + environment: secret.environment, + secretPath: secret.secretPath, + channel: getUserAgentType(req.headers["user-agent"]), + ...req.auditLogInfo + } + }); + } return { secret }; } });frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx (1)
909-951: Great addition of the secret ID copy functionality.The implementation of the copy button with proper user feedback through tooltips and notifications is well done and enhances usability.
Consider extracting the clipboard functionality into a reusable utility function, as there are multiple places in this file where copy-to-clipboard functionality is implemented (here and in the version history section around line 654).
// Example utility function that could be defined in a separate file or at component level const copyToClipboard = async (text: string, successMessage: string) => { await navigator.clipboard.writeText(text); createNotification({ title: "Copied", text: successMessage, type: "success" }); }; // Usage in component onClick={() => copyToClipboard(secret.id, "The secret ID has been copied to your clipboard.")}
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (6)
backend/src/server/routes/v3/secret-router.ts(1 hunks)backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts(2 hunks)backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts(4 hunks)backend/src/services/secret/secret-service.ts(4 hunks)backend/src/services/secret/secret-types.ts(2 hunks)frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx(4 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- backend/src/services/secret/secret-types.ts
- backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts
- backend/src/services/secret/secret-service.ts
🧰 Additional context used
🧠 Learnings (1)
backend/src/server/routes/v3/secret-router.ts (1)
Learnt from: DanielHougaard
PR: Infisical/infisical#3153
File: backend/src/server/routes/v1/secret-requests-router.ts:14-55
Timestamp: 2025-03-03T17:46:52.142Z
Learning: The GET /:id endpoint in backend/src/server/routes/v1/secret-requests-router.ts is intentionally public (doesn't use verifyAuth) to allow accessing secret requests without authentication.
⏰ Context from checks skipped due to timeout of 90000ms (4)
- GitHub Check: Run integration test
- GitHub Check: Check API Changes
- GitHub Check: Check TS and Lint
- GitHub Check: Check Frontend Type and Lint check
🔇 Additional comments (6)
frontend/src/pages/secret-manager/SecretDashboardPage/components/SecretListView/SecretDetailSidebar.tsx (2)
8-8: LGTM! Good addition of the copy icon.
196-205: LGTM! Improved function readability.The refactoring of
handleReminderSubmitenhances code readability while maintaining the same functionality.backend/src/services/secret-v2-bridge/secret-v2-bridge-service.ts (4)
31-31: New import to support the getSecretById function.The import for
TGetASecretByIdDTOis needed for the new feature that fetches secrets by their ID.
77-83: Updated the folderDAL factory type to include the findSecretPathByFolderIds method.The
TSecretV2BridgeServiceFactoryDeptype has been properly updated to include the newfindSecretPathByFolderIdsmethod needed for the getSecretById functionality.
957-1022: Implementation of getSecretById with proper security checks.The
getSecretByIdfunction follows the secure pattern established in the codebase:
- Checks for secret existence
- Retrieves the folder path
- Verifies user permissions
- Checks if the user can access personal secrets
- Decrypts sensitive data
- Returns the properly reshaped secret
The implementation includes all necessary security checks and handles errors appropriately.
2281-2282: Exported the new getSecretById method as part of the service interface.The new method is correctly exposed in the factory return statement.
DanielHougaard
force-pushed
the
daniel/id-get-secret
branch
from
77d9128 to
07b93c5
Compare
Description 📣
This PR allows for fetching secrets by ID. This endpoint is intended for internal usage, specifically for terraform import support for the infisical_secret resource.
This PR serves as prerequisite for Infisical/terraform-provider-infisical#102
Type ✨
Summary by CodeRabbit