improvement: make query timeout const

.github/workflows/check-api-for-breaking-changes.yml

@@ -35,20 +35,7 @@ jobs:
           echo "SECRET_SCANNING_GIT_APP_ID=793712" >> .env
           echo "SECRET_SCANNING_PRIVATE_KEY=some-random" >> .env
           echo "SECRET_SCANNING_WEBHOOK_SECRET=some-random" >> .env
-
-          echo "Examining built image:"
-          docker image inspect infisical-api | grep -A 5 "Entrypoint"
-          
-          docker run --name infisical-api -d -p 4000:4000 \
-            -e DB_CONNECTION_URI=$DB_CONNECTION_URI \
-            -e REDIS_URL=$REDIS_URL \
-            -e JWT_AUTH_SECRET=$JWT_AUTH_SECRET \
-            -e ENCRYPTION_KEY=$ENCRYPTION_KEY \
-            --env-file .env \
-            infisical-api
-          
-          echo "Container status right after creation:"
-          docker ps -a | grep infisical-api
+          docker run --name infisical-api -d -p 4000:4000 -e DB_CONNECTION_URI=$DB_CONNECTION_URI -e REDIS_URL=$REDIS_URL -e JWT_AUTH_SECRET=$JWT_AUTH_SECRET -e ENCRYPTION_KEY=$ENCRYPTION_KEY --env-file .env --entrypoint '/bin/sh' infisical-api
         env:
           REDIS_URL: redis://172.17.0.1:6379
           DB_CONNECTION_URI: postgres://infisical:infisical@172.17.0.1:5432/infisical?sslmode=disable
@@ -62,42 +49,29 @@ jobs:
           SECONDS=0
           HEALTHY=0
           while [ $SECONDS -lt 60 ]; do
-            # Check if container is running
-            if docker ps | grep infisical-api; then
-              # Try to access the API endpoint
-              if curl -s -f http://localhost:4000/api/docs/json > /dev/null 2>&1; then
-                echo "API endpoint is responding. Container seems healthy."
-                HEALTHY=1
-                break
-              fi
-            else
-              echo "Container is not running!"
-              docker ps -a | grep infisical-api
+            if docker ps | grep infisical-api | grep -q healthy; then
+              echo "Container is healthy."
+              HEALTHY=1
               break
             fi
-            
             echo "Waiting for container to be healthy... ($SECONDS seconds elapsed)"
-            sleep 5
-            SECONDS=$((SECONDS+5))
+
+            docker logs infisical-api
+
+            sleep 2
+            SECONDS=$((SECONDS+2))
           done
-          
+
           if [ $HEALTHY -ne 1 ]; then
             echo "Container did not become healthy in time"
-            echo "Container status:"
-            docker ps -a | grep infisical-api
-            echo "Container logs (if any):"
-            docker logs infisical-api || echo "No logs available"
-            echo "Container inspection:"
-            docker inspect infisical-api | grep -A 5 "State"
             exit 1
           fi
       - name: Install openapi-diff
-        run: go install github.com/oasdiff/oasdiff@latest
+        run: go install github.com/tufin/oasdiff@latest
       - name: Running OpenAPI Spec diff action
         run: oasdiff breaking https://app.infisical.com/api/docs/json http://localhost:4000/api/docs/json --fail-on ERR
       - name: cleanup
-        if: always()
         run: |
           docker compose -f "docker-compose.dev.yml" down
-          docker stop infisical-api || true
-          docker rm infisical-api || true
+          docker stop infisical-api
+          docker remove infisical-api

.github/workflows/run-backend-tests.yml

@@ -34,10 +34,7 @@ jobs:
         working-directory: backend
       - name: Start postgres and redis
         run: touch .env && docker compose -f docker-compose.dev.yml up -d db redis
-      - name: Run unit test
-        run: npm run test:unit
-        working-directory: backend
-      - name: Run integration test
+      - name: Start integration test
         run: npm run test:e2e
         working-directory: backend
         env:
@@ -47,5 +44,4 @@ jobs:
           ENCRYPTION_KEY: 4bnfe4e407b8921c104518903515b218
       - name: cleanup
         run: |
-          docker compose -f "docker-compose.dev.yml" down
-
+          docker compose -f "docker-compose.dev.yml" down

backend/e2e-test/vitest-environment-knex.ts

@@ -120,3 +120,4 @@ export default {
     };
   }
 };
+

backend/package.json

@@ -40,7 +40,6 @@
     "type:check": "tsc --noEmit",
     "lint:fix": "eslint --fix --ext js,ts ./src",
     "lint": "eslint 'src/**/*.ts'",
-    "test:unit": "vitest run -c vitest.unit.config.ts",
     "test:e2e": "vitest run -c vitest.e2e.config.ts --bail=1",
     "test:e2e-watch": "vitest -c vitest.e2e.config.ts --bail=1",
     "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.ts",
@@ -71,7 +70,6 @@
     "migrate:org": "tsx ./scripts/migrate-organization.ts",
     "seed:new": "tsx ./scripts/create-seed-file.ts",
     "seed": "knex --knexfile ./dist/db/knexfile.ts --client pg seed:run",
-    "seed-dev": "knex --knexfile ./src/db/knexfile.ts --client pg seed:run",
     "db:reset": "npm run migration:rollback -- --all && npm run migration:latest"
   },
   "keywords": [],

backend/src/db/migrations/20250305131152_add-actor-id-to-secret-versions-v2.ts

@@ -1,45 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "@app/db/schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretVersionV2)) {
-    const hasSecretVersionV2UserActorId = await knex.schema.hasColumn(TableName.SecretVersionV2, "userActorId");
-    const hasSecretVersionV2IdentityActorId = await knex.schema.hasColumn(TableName.SecretVersionV2, "identityActorId");
-    const hasSecretVersionV2ActorType = await knex.schema.hasColumn(TableName.SecretVersionV2, "actorType");
-
-    await knex.schema.alterTable(TableName.SecretVersionV2, (t) => {
-      if (!hasSecretVersionV2UserActorId) {
-        t.uuid("userActorId");
-        t.foreign("userActorId").references("id").inTable(TableName.Users);
-      }
-      if (!hasSecretVersionV2IdentityActorId) {
-        t.uuid("identityActorId");
-        t.foreign("identityActorId").references("id").inTable(TableName.Identity);
-      }
-      if (!hasSecretVersionV2ActorType) {
-        t.string("actorType");
-      }
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.SecretVersionV2)) {
-    const hasSecretVersionV2UserActorId = await knex.schema.hasColumn(TableName.SecretVersionV2, "userActorId");
-    const hasSecretVersionV2IdentityActorId = await knex.schema.hasColumn(TableName.SecretVersionV2, "identityActorId");
-    const hasSecretVersionV2ActorType = await knex.schema.hasColumn(TableName.SecretVersionV2, "actorType");
-
-    await knex.schema.alterTable(TableName.SecretVersionV2, (t) => {
-      if (hasSecretVersionV2UserActorId) {
-        t.dropColumn("userActorId");
-      }
-      if (hasSecretVersionV2IdentityActorId) {
-        t.dropColumn("identityActorId");
-      }
-      if (hasSecretVersionV2ActorType) {
-        t.dropColumn("actorType");
-      }
-    });
-  }
-}

backend/src/db/schemas/secret-versions-v2.ts

@@ -25,10 +25,7 @@ export const SecretVersionsV2Schema = z.object({
   folderId: z.string().uuid(),
   userId: z.string().uuid().nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  userActorId: z.string().uuid().nullable().optional(),
-  identityActorId: z.string().uuid().nullable().optional(),
-  actorType: z.string().nullable().optional()
+  updatedAt: z.date()
 });
 
 export type TSecretVersionsV2 = z.infer<typeof SecretVersionsV2Schema>;

backend/src/ee/routes/v1/secret-approval-request-router.ts

@@ -1,11 +1,16 @@
 import { z } from "zod";
 
-import { SecretApprovalRequestsReviewersSchema, SecretApprovalRequestsSchema, UsersSchema } from "@app/db/schemas";
+import {
+  SecretApprovalRequestsReviewersSchema,
+  SecretApprovalRequestsSchema,
+  SecretTagsSchema,
+  UsersSchema
+} from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApprovalStatus, RequestState } from "@app/ee/services/secret-approval-request/secret-approval-request-types";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedTagSchema, secretRawSchema } from "@app/server/routes/sanitizedSchemas";
+import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { ResourceMetadataSchema } from "@app/services/resource-metadata/resource-metadata-schema";
 
@@ -245,6 +250,14 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
     }
   });
 
+  const tagSchema = SecretTagsSchema.pick({
+    id: true,
+    slug: true,
+    color: true
+  })
+    .array()
+    .optional();
+
   server.route({
     method: "GET",
     url: "/:id",
@@ -278,7 +291,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                 .omit({ _id: true, environment: true, workspace: true, type: true, version: true })
                 .extend({
                   op: z.string(),
-                  tags: SanitizedTagSchema.array().optional(),
+                  tags: tagSchema,
                   secretMetadata: ResourceMetadataSchema.nullish(),
                   secret: z
                     .object({
@@ -297,7 +310,7 @@ export const registerSecretApprovalRequestRouter = async (server: FastifyZodProv
                       secretKey: z.string(),
                       secretValue: z.string().optional(),
                       secretComment: z.string().optional(),
-                      tags: SanitizedTagSchema.array().optional(),
+                      tags: tagSchema,
                       secretMetadata: ResourceMetadataSchema.nullish()
                     })
                     .optional()

backend/src/ee/routes/v1/secret-router.ts

@@ -1,6 +1,6 @@
 import z from "zod";
 
-import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions } from "@app/ee/services/permission/project-permission";
 import { RAW_SECRETS } from "@app/lib/api-docs";
 import { removeTrailingSlash } from "@app/lib/fn";
 import { readLimit } from "@app/server/config/rateLimiter";
@@ -9,7 +9,7 @@ import { AuthMode } from "@app/services/auth/auth-type";
 
 const AccessListEntrySchema = z
   .object({
-    allowedActions: z.nativeEnum(ProjectPermissionSecretActions).array(),
+    allowedActions: z.nativeEnum(ProjectPermissionActions).array(),
     id: z.string(),
     membershipId: z.string(),
     name: z.string()

backend/src/ee/routes/v1/secret-version-router.ts

@@ -22,11 +22,7 @@ export const registerSecretVersionRouter = async (server: FastifyZodProvider) =>
       }),
       response: {
         200: z.object({
-          secretVersions: secretRawSchema
-            .extend({
-              secretValueHidden: z.boolean()
-            })
-            .array()
+          secretVersions: secretRawSchema.array()
         })
       }
     },
@@ -41,7 +37,6 @@ export const registerSecretVersionRouter = async (server: FastifyZodProvider) =>
         offset: req.query.offset,
         secretId: req.params.secretId
       });
-
       return { secretVersions };
     }
   });

backend/src/ee/routes/v1/snapshot-router.ts

@@ -1,10 +1,10 @@
 import { z } from "zod";
 
-import { SecretSnapshotsSchema } from "@app/db/schemas";
+import { SecretSnapshotsSchema, SecretTagsSchema } from "@app/db/schemas";
 import { PROJECTS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedTagSchema, secretRawSchema } from "@app/server/routes/sanitizedSchemas";
+import { secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerSnapshotRouter = async (server: FastifyZodProvider) => {
@@ -31,9 +31,12 @@ export const registerSnapshotRouter = async (server: FastifyZodProvider) => {
             secretVersions: secretRawSchema
               .omit({ _id: true, environment: true, workspace: true, type: true })
               .extend({
-                secretValueHidden: z.boolean(),
                 secretId: z.string(),
-                tags: SanitizedTagSchema.array()
+                tags: SecretTagsSchema.pick({
+                  id: true,
+                  slug: true,
+                  color: true
+                }).array()
               })
               .array(),
             folderVersion: z.object({ id: z.string(), name: z.string() }).array(),
@@ -52,7 +55,6 @@ export const registerSnapshotRouter = async (server: FastifyZodProvider) => {
         actorOrgId: req.permission.orgId,
         id: req.params.secretSnapshotId
       });
-
       return { secretSnapshot };
     }
   });

backend/src/ee/routes/v1/user-additional-privilege-router.ts

@@ -2,7 +2,6 @@ import slugify from "@sindresorhus/slugify";
 import ms from "ms";
 import { z } from "zod";
 
-import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
 import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-types";
 import { PROJECT_USER_ADDITIONAL_PRIVILEGE } from "@app/lib/api-docs";
@@ -24,9 +23,7 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
       body: z.object({
         projectMembershipId: z.string().min(1).describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.projectMembershipId),
         slug: slugSchema({ min: 1, max: 60 }).optional().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.slug),
-        permissions: ProjectPermissionV2Schema.array()
-          .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions)
-          .refine(checkForInvalidPermissionCombination),
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.CREATE.permissions),
         type: z.discriminatedUnion("isTemporary", [
           z.object({
             isTemporary: z.literal(false)
@@ -84,8 +81,7 @@ export const registerUserAdditionalPrivilegeRouter = async (server: FastifyZodPr
           slug: slugSchema({ min: 1, max: 60 }).describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.slug),
           permissions: ProjectPermissionV2Schema.array()
             .optional()
-            .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions)
-            .refine(checkForInvalidPermissionCombination),
+            .describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.permissions),
           type: z.discriminatedUnion("isTemporary", [
             z.object({ isTemporary: z.literal(false).describe(PROJECT_USER_ADDITIONAL_PRIVILEGE.UPDATE.isTemporary) }),
             z.object({

backend/src/ee/routes/v2/identity-project-additional-privilege-router.ts

@@ -3,7 +3,6 @@ import ms from "ms";
 import { z } from "zod";
 
 import { IdentityProjectAdditionalPrivilegeTemporaryMode } from "@app/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-types";
-import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
 import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
 import { IDENTITY_ADDITIONAL_PRIVILEGE_V2 } from "@app/lib/api-docs";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
@@ -31,9 +30,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         identityId: z.string().min(1).describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.identityId),
         projectId: z.string().min(1).describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.projectId),
         slug: slugSchema({ min: 1, max: 60 }).optional().describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.slug),
-        permissions: ProjectPermissionV2Schema.array()
-          .describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.permission)
-          .refine(checkForInvalidPermissionCombination),
+        permissions: ProjectPermissionV2Schema.array().describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.CREATE.permission),
         type: z.discriminatedUnion("isTemporary", [
           z.object({
             isTemporary: z.literal(false)
@@ -97,8 +94,7 @@ export const registerIdentityProjectAdditionalPrivilegeRouter = async (server: F
         slug: slugSchema({ min: 1, max: 60 }).describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.slug),
         permissions: ProjectPermissionV2Schema.array()
           .optional()
-          .describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.privilegePermission)
-          .refine(checkForInvalidPermissionCombination),
+          .describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.privilegePermission),
         type: z.discriminatedUnion("isTemporary", [
           z.object({ isTemporary: z.literal(false).describe(IDENTITY_ADDITIONAL_PRIVILEGE_V2.UPDATE.isTemporary) }),
           z.object({

backend/src/ee/routes/v2/project-role-router.ts

@@ -2,7 +2,6 @@ import { packRules } from "@casl/ability/extra";
 import { z } from "zod";
 
 import { ProjectMembershipRole, ProjectRolesSchema } from "@app/db/schemas";
-import { checkForInvalidPermissionCombination } from "@app/ee/services/permission/permission-fns";
 import { ProjectPermissionV2Schema } from "@app/ee/services/permission/project-permission";
 import { PROJECT_ROLE } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -38,9 +37,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
           .describe(PROJECT_ROLE.CREATE.slug),
         name: z.string().min(1).trim().describe(PROJECT_ROLE.CREATE.name),
         description: z.string().trim().nullish().describe(PROJECT_ROLE.CREATE.description),
-        permissions: ProjectPermissionV2Schema.array()
-          .describe(PROJECT_ROLE.CREATE.permissions)
-          .refine(checkForInvalidPermissionCombination)
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.CREATE.permissions)
       }),
       response: {
         200: z.object({
@@ -95,10 +92,7 @@ export const registerProjectRoleRouter = async (server: FastifyZodProvider) => {
           .describe(PROJECT_ROLE.UPDATE.slug),
         name: z.string().trim().optional().describe(PROJECT_ROLE.UPDATE.name),
         description: z.string().trim().nullish().describe(PROJECT_ROLE.UPDATE.description),
-        permissions: ProjectPermissionV2Schema.array()
-          .describe(PROJECT_ROLE.UPDATE.permissions)
-          .optional()
-          .superRefine(checkForInvalidPermissionCombination)
+        permissions: ProjectPermissionV2Schema.array().describe(PROJECT_ROLE.UPDATE.permissions).optional()
       }),
       response: {
         200: z.object({

backend/src/ee/services/dynamic-secret/providers/models.ts

@@ -1,16 +1,5 @@
 import { z } from "zod";
 
-export type PasswordRequirements = {
-  length: number;
-  required: {
-    lowercase: number;
-    uppercase: number;
-    digits: number;
-    symbols: number;
-  };
-  allowedSymbols?: string;
-};
-
 export enum SqlProviders {
   Postgres = "postgres",
   MySQL = "mysql2",
@@ -111,28 +100,6 @@ export const DynamicSecretSqlDBSchema = z.object({
   database: z.string().trim(),
   username: z.string().trim(),
   password: z.string().trim(),
-  passwordRequirements: z
-    .object({
-      length: z.number().min(1).max(250),
-      required: z
-        .object({
-          lowercase: z.number().min(0),
-          uppercase: z.number().min(0),
-          digits: z.number().min(0),
-          symbols: z.number().min(0)
-        })
-        .refine((data) => {
-          const total = Object.values(data).reduce((sum, count) => sum + count, 0);
-          return total <= 250;
-        }, "Sum of required characters cannot exceed 250"),
-      allowedSymbols: z.string().optional()
-    })
-    .refine((data) => {
-      const total = Object.values(data.required).reduce((sum, count) => sum + count, 0);
-      return total <= data.length;
-    }, "Sum of required characters cannot exceed the total length")
-    .optional()
-    .describe("Password generation requirements"),
   creationStatement: z.string().trim(),
   revocationStatement: z.string().trim(),
   renewStatement: z.string().trim().optional(),

backend/src/ee/services/dynamic-secret/providers/sql-database.ts

@@ -1,6 +1,6 @@
-import { randomInt } from "crypto";
 import handlebars from "handlebars";
 import knex from "knex";
+import { customAlphabet } from "nanoid";
 import { z } from "zod";
 
 import { withGatewayProxy } from "@app/lib/gateway";
@@ -8,99 +8,16 @@ import { alphaNumericNanoId } from "@app/lib/nanoid";
 
 import { TGatewayServiceFactory } from "../../gateway/gateway-service";
 import { verifyHostInputValidity } from "../dynamic-secret-fns";
-import { DynamicSecretSqlDBSchema, PasswordRequirements, SqlProviders, TDynamicProviderFns } from "./models";
+import { DynamicSecretSqlDBSchema, SqlProviders, TDynamicProviderFns } from "./models";
 
 const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
 
-const DEFAULT_PASSWORD_REQUIREMENTS = {
-  length: 48,
-  required: {
-    lowercase: 1,
-    uppercase: 1,
-    digits: 1,
-    symbols: 0
-  },
-  allowedSymbols: "-_.~!*"
-};
+const generatePassword = (provider: SqlProviders) => {
+  // oracle has limit of 48 password length
+  const size = provider === SqlProviders.Oracle ? 30 : 48;
 
-const ORACLE_PASSWORD_REQUIREMENTS = {
-  ...DEFAULT_PASSWORD_REQUIREMENTS,
-  length: 30
-};
-
-const generatePassword = (provider: SqlProviders, requirements?: PasswordRequirements) => {
-  const defaultReqs = provider === SqlProviders.Oracle ? ORACLE_PASSWORD_REQUIREMENTS : DEFAULT_PASSWORD_REQUIREMENTS;
-  const finalReqs = requirements || defaultReqs;
-
-  try {
-    const { length, required, allowedSymbols } = finalReqs;
-
-    const chars = {
-      lowercase: "abcdefghijklmnopqrstuvwxyz",
-      uppercase: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
-      digits: "0123456789",
-      symbols: allowedSymbols || "-_.~!*"
-    };
-
-    const parts: string[] = [];
-
-    if (required.lowercase > 0) {
-      parts.push(
-        ...Array(required.lowercase)
-          .fill(0)
-          .map(() => chars.lowercase[randomInt(chars.lowercase.length)])
-      );
-    }
-
-    if (required.uppercase > 0) {
-      parts.push(
-        ...Array(required.uppercase)
-          .fill(0)
-          .map(() => chars.uppercase[randomInt(chars.uppercase.length)])
-      );
-    }
-
-    if (required.digits > 0) {
-      parts.push(
-        ...Array(required.digits)
-          .fill(0)
-          .map(() => chars.digits[randomInt(chars.digits.length)])
-      );
-    }
-
-    if (required.symbols > 0) {
-      parts.push(
-        ...Array(required.symbols)
-          .fill(0)
-          .map(() => chars.symbols[randomInt(chars.symbols.length)])
-      );
-    }
-
-    const requiredTotal = Object.values(required).reduce<number>((a, b) => a + b, 0);
-    const remainingLength = Math.max(length - requiredTotal, 0);
-
-    const allowedChars = Object.entries(chars)
-      .filter(([key]) => required[key as keyof typeof required] > 0)
-      .map(([, value]) => value)
-      .join("");
-
-    parts.push(
-      ...Array(remainingLength)
-        .fill(0)
-        .map(() => allowedChars[randomInt(allowedChars.length)])
-    );
-
-    // shuffle the array to mix up the characters
-    for (let i = parts.length - 1; i > 0; i -= 1) {
-      const j = randomInt(i + 1);
-      [parts[i], parts[j]] = [parts[j], parts[i]];
-    }
-
-    return parts.join("");
-  } catch (error: unknown) {
-    const message = error instanceof Error ? error.message : "Unknown error";
-    throw new Error(`Failed to generate password: ${message}`);
-  }
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_.~!*";
+  return customAlphabet(charset, 48)(size);
 };
 
 const generateUsername = (provider: SqlProviders) => {
@@ -198,7 +115,7 @@ export const SqlDatabaseProvider = ({ gatewayService }: TSqlDatabaseProviderDTO)
   const create = async (inputs: unknown, expireAt: number) => {
     const providerInputs = await validateProviderInputs(inputs);
     const username = generateUsername(providerInputs.client);
-    const password = generatePassword(providerInputs.client, providerInputs.passwordRequirements);
+    const password = generatePassword(providerInputs.client);
     const gatewayCallback = async (host = providerInputs.host, port = providerInputs.port) => {
       const db = await $getClient({ ...providerInputs, port, host });
       try {

backend/src/ee/services/group/group-service.ts

@@ -3,7 +3,7 @@ import slugify from "@sindresorhus/slugify";
 
 import { OrgMembershipRole, TOrgRoles } from "@app/db/schemas";
 import { TOidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { TGroupProjectDALFactory } from "@app/services/group-project/group-project-dal";
@@ -87,14 +87,9 @@ export const groupServiceFactory = ({
       actorOrgId
     );
     const isCustomRole = Boolean(customRole);
-
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to create a more privileged group",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to create a more privileged group" });
 
     const group = await groupDAL.transaction(async (tx) => {
       const existingGroup = await groupDAL.findOne({ orgId: actorOrgId, name }, tx);
@@ -161,13 +156,9 @@ export const groupServiceFactory = ({
       );
 
       const isCustomRole = Boolean(customOrgRole);
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to update a more privileged group",
-          details: { missingPermissions: permissionBoundary.missingPermissions }
-        });
+      const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission);
+      if (!hasRequiredNewRolePermission)
+        throw new ForbiddenRequestError({ message: "Failed to create a more privileged group" });
       if (isCustomRole) customRole = customOrgRole;
     }
 
@@ -338,13 +329,9 @@ export const groupServiceFactory = ({
     const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, actorOrgId);
 
     // check if user has broader or equal to privileges than group
-    const permissionBoundary = validatePermissionBoundary(permission, groupRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to add user to more privileged group",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPrivileges = isAtLeastAsPrivileged(permission, groupRolePermission);
+    if (!hasRequiredPrivileges)
+      throw new ForbiddenRequestError({ message: "Failed to add user to more privileged group" });
 
     const user = await userDAL.findOne({ username });
     if (!user) throw new NotFoundError({ message: `Failed to find user with username ${username}` });
@@ -409,13 +396,9 @@ export const groupServiceFactory = ({
     const { permission: groupRolePermission } = await permissionService.getOrgPermissionByRole(group.role, actorOrgId);
 
     // check if user has broader or equal to privileges than group
-    const permissionBoundary = validatePermissionBoundary(permission, groupRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to delete user from more privileged group",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPrivileges = isAtLeastAsPrivileged(permission, groupRolePermission);
+    if (!hasRequiredPrivileges)
+      throw new ForbiddenRequestError({ message: "Failed to delete user from more privileged group" });
 
     const user = await userDAL.findOne({ username });
     if (!user) throw new NotFoundError({ message: `Failed to find user with username ${username}` });

backend/src/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service.ts

@@ -3,7 +3,7 @@ import { packRules } from "@casl/ability/extra";
 import ms from "ms";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { unpackPermissions } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -79,13 +79,9 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
-    const permissionBoundary = validatePermissionBoundary(permission, targetIdentityPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetIdentityPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     const existingSlug = await identityProjectAdditionalPrivilegeDAL.findOne({
       slug,
@@ -165,13 +161,9 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
-    const permissionBoundary = validatePermissionBoundary(permission, targetIdentityPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetIdentityPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     if (data?.slug) {
       const existingSlug = await identityProjectAdditionalPrivilegeDAL.findOne({
@@ -247,13 +239,9 @@ export const identityProjectAdditionalPrivilegeV2ServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.Any
     });
-    const permissionBoundary = validatePermissionBoundary(permission, identityRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     const deletedPrivilege = await identityProjectAdditionalPrivilegeDAL.deleteById(identityPrivilege.id);
     return {

backend/src/ee/services/identity-project-additional-privilege/identity-project-additional-privilege-service.ts

@@ -3,7 +3,7 @@ import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -88,13 +88,9 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(customPermission));
-    const permissionBoundary = validatePermissionBoundary(permission, targetIdentityPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetIdentityPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     const existingSlug = await identityProjectAdditionalPrivilegeDAL.findOne({
       slug,
@@ -176,13 +172,9 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetIdentityPermission.update(targetIdentityPermission.rules.concat(data.permissions || []));
-    const permissionBoundary = validatePermissionBoundary(permission, targetIdentityPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetIdentityPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     const identityPrivilege = await identityProjectAdditionalPrivilegeDAL.findOne({
       slug,
@@ -276,13 +268,9 @@ export const identityProjectAdditionalPrivilegeServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.Any
     });
-    const permissionBoundary = validatePermissionBoundary(permission, identityRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to edit more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to edit more privileged identity" });
 
     const identityPrivilege = await identityProjectAdditionalPrivilegeDAL.findOne({
       slug,

backend/src/ee/services/permission/permission-fns.ts

@@ -1,109 +1,7 @@
-/* eslint-disable no-nested-ternary */
-import { ForbiddenError, MongoAbility, PureAbility, subject } from "@casl/ability";
-import { z } from "zod";
-
 import { TOrganizations } from "@app/db/schemas";
-import { BadRequestError, ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
+import { ForbiddenRequestError, UnauthorizedError } from "@app/lib/errors";
 import { ActorAuthMethod, AuthMethod } from "@app/services/auth/auth-type";
 
-import {
-  ProjectPermissionSecretActions,
-  ProjectPermissionSet,
-  ProjectPermissionSub,
-  ProjectPermissionV2Schema,
-  SecretSubjectFields
-} from "./project-permission";
-
-export function throwIfMissingSecretReadValueOrDescribePermission(
-  permission: MongoAbility<ProjectPermissionSet> | PureAbility,
-  action: Extract<
-    ProjectPermissionSecretActions,
-    ProjectPermissionSecretActions.ReadValue | ProjectPermissionSecretActions.DescribeSecret
-  >,
-  subjectFields?: SecretSubjectFields
-) {
-  try {
-    if (subjectFields) {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretActions.DescribeAndReadValue,
-        subject(ProjectPermissionSub.Secrets, subjectFields)
-      );
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretActions.DescribeAndReadValue,
-        ProjectPermissionSub.Secrets
-      );
-    }
-  } catch {
-    if (subjectFields) {
-      ForbiddenError.from(permission).throwUnlessCan(action, subject(ProjectPermissionSub.Secrets, subjectFields));
-    } else {
-      ForbiddenError.from(permission).throwUnlessCan(action, ProjectPermissionSub.Secrets);
-    }
-  }
-}
-
-export function hasSecretReadValueOrDescribePermission(
-  permission: MongoAbility<ProjectPermissionSet>,
-  action: Extract<
-    ProjectPermissionSecretActions,
-    ProjectPermissionSecretActions.DescribeSecret | ProjectPermissionSecretActions.ReadValue
-  >,
-  subjectFields?: SecretSubjectFields
-) {
-  let canNewPermission = false;
-  let canOldPermission = false;
-
-  if (subjectFields) {
-    canNewPermission = permission.can(action, subject(ProjectPermissionSub.Secrets, subjectFields));
-    canOldPermission = permission.can(
-      ProjectPermissionSecretActions.DescribeAndReadValue,
-      subject(ProjectPermissionSub.Secrets, subjectFields)
-    );
-  } else {
-    canNewPermission = permission.can(action, ProjectPermissionSub.Secrets);
-    canOldPermission = permission.can(
-      ProjectPermissionSecretActions.DescribeAndReadValue,
-      ProjectPermissionSub.Secrets
-    );
-  }
-
-  return canNewPermission || canOldPermission;
-}
-
-const OptionalArrayPermissionSchema = ProjectPermissionV2Schema.array().optional();
-export function checkForInvalidPermissionCombination(permissions: z.infer<typeof OptionalArrayPermissionSchema>) {
-  if (!permissions) return;
-
-  for (const permission of permissions) {
-    if (permission.subject === ProjectPermissionSub.Secrets) {
-      if (permission.action.includes(ProjectPermissionSecretActions.DescribeAndReadValue)) {
-        const hasReadValue = permission.action.includes(ProjectPermissionSecretActions.ReadValue);
-        const hasDescribeSecret = permission.action.includes(ProjectPermissionSecretActions.DescribeSecret);
-
-        // eslint-disable-next-line no-continue
-        if (!hasReadValue && !hasDescribeSecret) continue;
-
-        const hasBothDescribeAndReadValue = hasReadValue && hasDescribeSecret;
-
-        throw new BadRequestError({
-          message: `You have selected Read, and ${
-            hasBothDescribeAndReadValue
-              ? "both Read Value and Describe Secret"
-              : hasReadValue
-                ? "Read Value"
-                : hasDescribeSecret
-                  ? "Describe Secret"
-                  : ""
-          }. You cannot select Read Value or Describe Secret if you have selected Read. The Read permission is a legacy action which has been replaced by Describe Secret and Read Value.`
-        });
-      }
-    }
-  }
-
-  return true;
-}
-
 function isAuthMethodSaml(actorAuthMethod: ActorAuthMethod) {
   if (!actorAuthMethod) return false;
 

backend/src/ee/services/permission/permission-types.ts

@@ -5,6 +5,22 @@ import { PermissionConditionOperators } from "@app/lib/casl";
 
 export const PermissionConditionSchema = {
   [PermissionConditionOperators.$IN]: z.string().trim().min(1).array(),
+  [PermissionConditionOperators.$ALL]: z.string().trim().min(1).array(),
+  [PermissionConditionOperators.$REGEX]: z
+    .string()
+    .min(1)
+    .refine(
+      (el) => {
+        try {
+          // eslint-disable-next-line no-new
+          new RegExp(el);
+          return true;
+        } catch {
+          return false;
+        }
+      },
+      { message: "Invalid regex pattern" }
+    ),
   [PermissionConditionOperators.$EQ]: z.string().min(1),
   [PermissionConditionOperators.$NEQ]: z.string().min(1),
   [PermissionConditionOperators.$GLOB]: z

backend/src/ee/services/permission/project-permission.ts

@@ -17,15 +17,6 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
-export enum ProjectPermissionSecretActions {
-  DescribeAndReadValue = "read",
-  DescribeSecret = "describeSecret",
-  ReadValue = "readValue",
-  Create = "create",
-  Edit = "edit",
-  Delete = "delete"
-}
-
 export enum ProjectPermissionCmekActions {
   Read = "read",
   Create = "create",
@@ -124,7 +115,7 @@ export type IdentityManagementSubjectFields = {
 
 export type ProjectPermissionSet =
   | [
-      ProjectPermissionSecretActions,
+      ProjectPermissionActions,
       ProjectPermissionSub.Secrets | (ForcedSubject<ProjectPermissionSub.Secrets> & SecretSubjectFields)
     ]
   | [
@@ -438,7 +429,6 @@ const GeneralPermissionSchema = [
   })
 ];
 
-// Do not update this schema anymore, as it's kept purely for backwards compatability. Update V2 schema only.
 export const ProjectPermissionV1Schema = z.discriminatedUnion("subject", [
   z.object({
     subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
@@ -470,7 +460,7 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
   z.object({
     subject: z.literal(ProjectPermissionSub.Secrets).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionSecretActions).describe(
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionActions).describe(
       "Describe what action an entity can take."
     ),
     conditions: SecretConditionV2Schema.describe(
@@ -527,6 +517,7 @@ const buildAdminPermissionRules = () => {
 
   // Admins get full access to everything
   [
+    ProjectPermissionSub.Secrets,
     ProjectPermissionSub.SecretFolders,
     ProjectPermissionSub.SecretImports,
     ProjectPermissionSub.SecretApproval,
@@ -559,22 +550,10 @@ const buildAdminPermissionRules = () => {
         ProjectPermissionActions.Create,
         ProjectPermissionActions.Delete
       ],
-      el
+      el as ProjectPermissionSub
     );
   });
 
-  can(
-    [
-      ProjectPermissionSecretActions.DescribeAndReadValue,
-      ProjectPermissionSecretActions.DescribeSecret,
-      ProjectPermissionSecretActions.ReadValue,
-      ProjectPermissionSecretActions.Create,
-      ProjectPermissionSecretActions.Edit,
-      ProjectPermissionSecretActions.Delete
-    ],
-    ProjectPermissionSub.Secrets
-  );
-
   can(
     [
       ProjectPermissionDynamicSecretActions.ReadRootCredential,
@@ -634,12 +613,10 @@ const buildMemberPermissionRules = () => {
 
   can(
     [
-      ProjectPermissionSecretActions.DescribeAndReadValue,
-      ProjectPermissionSecretActions.DescribeSecret,
-      ProjectPermissionSecretActions.ReadValue,
-      ProjectPermissionSecretActions.Edit,
-      ProjectPermissionSecretActions.Create,
-      ProjectPermissionSecretActions.Delete
+      ProjectPermissionActions.Read,
+      ProjectPermissionActions.Edit,
+      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete
     ],
     ProjectPermissionSub.Secrets
   );
@@ -811,9 +788,7 @@ export const projectMemberPermissions = buildMemberPermissionRules();
 const buildViewerPermissionRules = () => {
   const { can, rules } = new AbilityBuilder<MongoAbility<ProjectPermissionSet>>(createMongoAbility);
 
-  can(ProjectPermissionSecretActions.DescribeAndReadValue, ProjectPermissionSub.Secrets);
-  can(ProjectPermissionSecretActions.DescribeSecret, ProjectPermissionSub.Secrets);
-  can(ProjectPermissionSecretActions.ReadValue, ProjectPermissionSub.Secrets);
+  can(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretFolders);
   can(ProjectPermissionDynamicSecretActions.ReadRootCredential, ProjectPermissionSub.DynamicSecrets);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SecretImports);
@@ -862,6 +837,7 @@ export const buildServiceTokenProjectPermission = (
       (subject) => {
         if (canWrite) {
           can(ProjectPermissionActions.Edit, subject, {
+            // TODO: @Akhi
             // @ts-expect-error type
             secretPath: { $glob: secretPath },
             environment
@@ -940,17 +916,7 @@ export const backfillPermissionV1SchemaToV2Schema = (
     subject: ProjectPermissionSub.SecretImports as const
   }));
 
-  const secretPolicies = secretSubjects.map(({ subject, ...el }) => ({
-    subject: ProjectPermissionSub.Secrets as const,
-    ...el,
-    action:
-      el.action.includes(ProjectPermissionActions.Read) && !el.action.includes(ProjectPermissionSecretActions.ReadValue)
-        ? el.action.concat(ProjectPermissionSecretActions.ReadValue)
-        : el.action
-  }));
-
   const secretFolderPolicies = secretSubjects
-
     .map(({ subject, ...el }) => ({
       ...el,
       // read permission is not needed anymore
@@ -992,7 +958,6 @@ export const backfillPermissionV1SchemaToV2Schema = (
     // eslint-disable-next-line @typescript-eslint/ban-ts-comment
     // @ts-ignore-error this is valid ts
     secretImportPolicies,
-    secretPolicies,
     dynamicSecretPolicies,
     hasReadOnlyFolder.length ? [] : secretFolderPolicies
   );

backend/src/ee/services/project-user-additional-privilege/project-user-additional-privilege-service.ts

@@ -3,7 +3,7 @@ import { PackRule, packRules, unpackRules } from "@casl/ability/extra";
 import ms from "ms";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { UnpackedPermissionSchema } from "@app/server/routes/sanitizedSchema/permission";
 import { ActorType } from "@app/services/auth/auth-type";
@@ -76,13 +76,9 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetUserPermission.update(targetUserPermission.rules.concat(customPermission));
-    const permissionBoundary = validatePermissionBoundary(permission, targetUserPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged user",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetUserPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     const existingSlug = await projectUserAdditionalPrivilegeDAL.findOne({
       slug,
@@ -167,13 +163,9 @@ export const projectUserAdditionalPrivilegeServiceFactory = ({
     // we need to validate that the privilege given is not higher than the assigning users permission
     // @ts-expect-error this is expected error because of one being really accurate rule definition other being a bit more broader. Both are valid casl rules
     targetUserPermission.update(targetUserPermission.rules.concat(dto.permissions || []));
-    const permissionBoundary = validatePermissionBoundary(permission, targetUserPermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, targetUserPermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to update more privileged identity" });
 
     if (dto?.slug) {
       const existingSlug = await projectUserAdditionalPrivilegeDAL.findOne({

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -57,9 +57,8 @@ import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
-import { throwIfMissingSecretReadValueOrDescribePermission } from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionSecretActions, ProjectPermissionSub } from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TSecretApprovalPolicyDALFactory } from "../secret-approval-policy/secret-approval-policy-dal";
 import { TSecretSnapshotServiceFactory } from "../secret-snapshot/secret-snapshot-service";
 import { TSecretApprovalRequestDALFactory } from "./secret-approval-request-dal";
@@ -89,12 +88,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
   secretDAL: TSecretDALFactory;
   secretTagDAL: Pick<
     TSecretTagDALFactory,
-    | "findManyTagsById"
-    | "saveTagsToSecret"
-    | "deleteTagsManySecret"
-    | "saveTagsToSecretV2"
-    | "deleteTagsToSecretV2"
-    | "find"
+    "findManyTagsById" | "saveTagsToSecret" | "deleteTagsManySecret" | "saveTagsToSecretV2" | "deleteTagsToSecretV2"
   >;
   secretBlindIndexDAL: Pick<TSecretBlindIndexDALFactory, "findOne">;
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
@@ -112,7 +106,7 @@ type TSecretApprovalRequestServiceFactoryDep = {
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey" | "encryptWithInputKey" | "decryptWithInputKey">;
   secretV2BridgeDAL: Pick<
     TSecretV2BridgeDALFactory,
-    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" | "find"
+    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany"
   >;
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
@@ -509,7 +503,7 @@ export const secretApprovalRequestServiceFactory = ({
     if (!hasMinApproval && !isSoftEnforcement)
       throw new BadRequestError({ message: "Doesn't have minimum approvals needed" });
 
-    const { botKey, shouldUseSecretV2Bridge, project } = await projectBotService.getBotKey(projectId);
+    const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
     let mergeStatus;
     if (shouldUseSecretV2Bridge) {
       // this cycle if for bridged secrets
@@ -867,6 +861,7 @@ export const secretApprovalRequestServiceFactory = ({
 
     if (isSoftEnforcement) {
       const cfg = getConfig();
+      const project = await projectDAL.findProjectById(projectId);
       const env = await projectEnvDAL.findOne({ id: policy.envId });
       const requestedByUser = await userDAL.findOne({ id: actorId });
       const approverUsers = await userDAL.find({
@@ -918,11 +913,10 @@ export const secretApprovalRequestServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-      environment,
-      secretPath
-    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath })
+    );
 
     await projectDAL.checkProjectUpgradeStatus(projectId);
 
@@ -1007,7 +1001,6 @@ export const secretApprovalRequestServiceFactory = ({
               : keyName2BlindIndex[secretName];
           // add tags
           if (tagIds?.length) commitTagIds[keyName2BlindIndex[secretName]] = tagIds;
-
           return {
             ...latestSecretVersions[secretId],
             ...el,
@@ -1163,8 +1156,7 @@ export const secretApprovalRequestServiceFactory = ({
           environment: env.name,
           secretPath,
           projectId,
-          requestId: secretApprovalRequest.id,
-          secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretName) ?? []))]
+          requestId: secretApprovalRequest.id
         }
       }
     });
@@ -1371,9 +1363,9 @@ export const secretApprovalRequestServiceFactory = ({
     const tagsGroupById = groupBy(tags, (i) => i.id);
 
     commits.forEach((commit) => {
-      let action = ProjectPermissionSecretActions.Create;
-      if (commit.op === SecretOperations.Update) action = ProjectPermissionSecretActions.Edit;
-      if (commit.op === SecretOperations.Delete) action = ProjectPermissionSecretActions.Delete;
+      let action = ProjectPermissionActions.Create;
+      if (commit.op === SecretOperations.Update) action = ProjectPermissionActions.Edit;
+      if (commit.op === SecretOperations.Delete) action = ProjectPermissionActions.Delete;
 
       ForbiddenError.from(permission).throwUnlessCan(
         action,
@@ -1464,8 +1456,7 @@ export const secretApprovalRequestServiceFactory = ({
           environment: env.name,
           secretPath,
           projectId,
-          requestId: secretApprovalRequest.id,
-          secretKeys: [...new Set(Object.values(data).flatMap((arr) => arr?.map((item) => item.secretKey) ?? []))]
+          requestId: secretApprovalRequest.id
         }
       }
     });

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -265,7 +265,6 @@ export const secretReplicationServiceFactory = ({
         folderDAL,
         secretImportDAL,
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
-        viewSecretValue: true,
         hasSecretAccess: () => true
       });
       // secrets that gets replicated across imports

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -13,7 +13,6 @@ import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
-import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -333,7 +332,6 @@ export const secretRotationQueueFactory = ({
           await secretVersionV2BridgeDAL.insertMany(
             updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
               ...el,
-              actorType: ActorType.PLATFORM,
               secretId: id
             })),
             tx

backend/src/ee/services/secret-rotation/secret-rotation-service.ts

@@ -15,11 +15,7 @@ import { TSecretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret
 
 import { TLicenseServiceFactory } from "../license/license-service";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TSecretRotationDALFactory } from "./secret-rotation-dal";
 import { TSecretRotationQueueFactory } from "./secret-rotation-queue";
 import { TSecretRotationEncData } from "./secret-rotation-queue/secret-rotation-queue-types";
@@ -110,7 +106,7 @@ export const secretRotationServiceFactory = ({
       });
     }
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -1,18 +1,16 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment,@typescript-eslint/no-unsafe-member-access,@typescript-eslint/no-unsafe-argument */
 // akhilmhdh: I did this, quite strange bug with eslint. Everything do have a type stil has this error
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, TableName, TSecretTagJunctionInsert, TSecretV2TagJunctionInsert } from "@app/db/schemas";
 import { decryptSymmetric128BitHexKeyUTF8 } from "@app/lib/crypto";
 import { InternalServerError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
-import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
 import { TSecretDALFactory } from "@app/services/secret/secret-dal";
-import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "@app/services/secret/secret-fns";
 import { TSecretVersionDALFactory } from "@app/services/secret/secret-version-dal";
 import { TSecretVersionTagDALFactory } from "@app/services/secret/secret-version-tag-dal";
 import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
@@ -23,16 +21,8 @@ import { TSecretVersionV2DALFactory } from "@app/services/secret-v2-bridge/secre
 import { TSecretVersionV2TagDALFactory } from "@app/services/secret-v2-bridge/secret-version-tag-dal";
 
 import { TLicenseServiceFactory } from "../license/license-service";
-import {
-  hasSecretReadValueOrDescribePermission,
-  throwIfMissingSecretReadValueOrDescribePermission
-} from "../permission/permission-fns";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "../permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import {
   TGetSnapshotDataDTO,
   TProjectSnapshotCountDTO,
@@ -106,10 +96,10 @@ export const secretSnapshotServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
 
     // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret, {
-      environment,
-      secretPath: path
-    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+    );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder) {
@@ -143,10 +133,10 @@ export const secretSnapshotServiceFactory = ({
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
 
     // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret, {
-      environment,
-      secretPath: path
-    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+    );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
@@ -171,7 +161,6 @@ export const secretSnapshotServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
-
     const shouldUseBridge = snapshot.projectVersion === 3;
     let snapshotDetails;
     if (shouldUseBridge) {
@@ -180,112 +169,68 @@ export const secretSnapshotServiceFactory = ({
         projectId: snapshot.projectId
       });
       const encryptedSnapshotDetails = await snapshotDAL.findSecretSnapshotV2DataById(id);
-
-      const fullFolderPath = await getFullFolderPath({
-        folderDAL,
-        folderId: encryptedSnapshotDetails.folderId,
-        envId: encryptedSnapshotDetails.environment.id
-      });
-
       snapshotDetails = {
         ...encryptedSnapshotDetails,
-        secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => {
-          const canReadValue = hasSecretReadValueOrDescribePermission(
-            permission,
-            ProjectPermissionSecretActions.ReadValue,
-            {
-              environment: encryptedSnapshotDetails.environment.slug,
-              secretPath: fullFolderPath,
-              secretName: el.key,
-              secretTags: el.tags.length ? el.tags.map((tag) => tag.slug) : undefined
-            }
-          );
-
-          let secretValue = "";
-          if (canReadValue) {
-            secretValue = el.encryptedValue
-              ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString()
-              : "";
-          } else {
-            secretValue = INFISICAL_SECRET_VALUE_HIDDEN_MASK;
-          }
-
-          return {
-            ...el,
-            secretKey: el.key,
-            secretValueHidden: !canReadValue,
-            secretValue,
-            secretComment: el.encryptedComment
-              ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString()
-              : ""
-          };
-        })
+        secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => ({
+          ...el,
+          secretKey: el.key,
+          secretValue: el.encryptedValue
+            ? secretManagerDecryptor({ cipherTextBlob: el.encryptedValue }).toString()
+            : "",
+          secretComment: el.encryptedComment
+            ? secretManagerDecryptor({ cipherTextBlob: el.encryptedComment }).toString()
+            : ""
+        }))
       };
     } else {
       const encryptedSnapshotDetails = await snapshotDAL.findSecretSnapshotDataById(id);
-
-      const fullFolderPath = await getFullFolderPath({
-        folderDAL,
-        folderId: encryptedSnapshotDetails.folderId,
-        envId: encryptedSnapshotDetails.environment.id
-      });
-
       const { botKey } = await projectBotService.getBotKey(snapshot.projectId);
       if (!botKey)
         throw new NotFoundError({ message: `Project bot key not found for project with ID '${snapshot.projectId}'` });
       snapshotDetails = {
         ...encryptedSnapshotDetails,
-        secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => {
-          const secretKey = decryptSymmetric128BitHexKeyUTF8({
+        secretVersions: encryptedSnapshotDetails.secretVersions.map((el) => ({
+          ...el,
+          secretKey: decryptSymmetric128BitHexKeyUTF8({
             ciphertext: el.secretKeyCiphertext,
             iv: el.secretKeyIV,
             tag: el.secretKeyTag,
             key: botKey
-          });
-
-          const canReadValue = hasSecretReadValueOrDescribePermission(
-            permission,
-            ProjectPermissionSecretActions.ReadValue,
-            {
-              environment: encryptedSnapshotDetails.environment.slug,
-              secretPath: fullFolderPath,
-              secretName: secretKey,
-              secretTags: el.tags.length ? el.tags.map((tag) => tag.slug) : undefined
-            }
-          );
-
-          let secretValue = "";
-
-          if (canReadValue) {
-            secretValue = decryptSymmetric128BitHexKeyUTF8({
-              ciphertext: el.secretValueCiphertext,
-              iv: el.secretValueIV,
-              tag: el.secretValueTag,
-              key: botKey
-            });
-          } else {
-            secretValue = INFISICAL_SECRET_VALUE_HIDDEN_MASK;
-          }
-
-          return {
-            ...el,
-            secretKey,
-            secretValueHidden: !canReadValue,
-            secretValue,
-            secretComment:
-              el.secretCommentTag && el.secretCommentIV && el.secretCommentCiphertext
-                ? decryptSymmetric128BitHexKeyUTF8({
-                    ciphertext: el.secretCommentCiphertext,
-                    iv: el.secretCommentIV,
-                    tag: el.secretCommentTag,
-                    key: botKey
-                  })
-                : ""
-          };
-        })
+          }),
+          secretValue: decryptSymmetric128BitHexKeyUTF8({
+            ciphertext: el.secretValueCiphertext,
+            iv: el.secretValueIV,
+            tag: el.secretValueTag,
+            key: botKey
+          }),
+          secretComment:
+            el.secretCommentTag && el.secretCommentIV && el.secretCommentCiphertext
+              ? decryptSymmetric128BitHexKeyUTF8({
+                  ciphertext: el.secretCommentCiphertext,
+                  iv: el.secretCommentIV,
+                  tag: el.secretCommentTag,
+                  key: botKey
+                })
+              : ""
+        }))
       };
     }
 
+    const fullFolderPath = await getFullFolderPath({
+      folderDAL,
+      folderId: snapshotDetails.folderId,
+      envId: snapshotDetails.environment.id
+    });
+
+    // We need to check if the user has access to the secrets in the folder. If we don't do this, a user could theoretically access snapshot secret values even if they don't have read access to the secrets in the folder.
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: snapshotDetails.environment.slug,
+        secretPath: fullFolderPath
+      })
+    );
+
     return snapshotDetails;
   };
 
@@ -425,21 +370,7 @@ export const secretSnapshotServiceFactory = ({
         const secrets = await secretV2BridgeDAL.insertMany(
           rollbackSnaps.flatMap(({ secretVersions, folderId }) =>
             secretVersions.map(
-              ({
-                latestSecretVersion,
-                version,
-                updatedAt,
-                createdAt,
-                secretId,
-                envId,
-                id,
-                tags,
-                // exclude the bottom fields from the secret - they are for versioning only.
-                userActorId,
-                identityActorId,
-                actorType,
-                ...el
-              }) => ({
+              ({ latestSecretVersion, version, updatedAt, createdAt, secretId, envId, id, tags, ...el }) => ({
                 ...el,
                 id: secretId,
                 version: deletedTopLevelSecsGroupById[secretId] ? latestSecretVersion + 1 : latestSecretVersion,
@@ -470,18 +401,8 @@ export const secretSnapshotServiceFactory = ({
           })),
           tx
         );
-        const userActorId = actor === ActorType.USER ? actorId : undefined;
-        const identityActorId = actor !== ActorType.USER ? actorId : undefined;
-        const actorType = actor || ActorType.PLATFORM;
-
         const secretVersions = await secretVersionV2BridgeDAL.insertMany(
-          secrets.map(({ id, updatedAt, createdAt, ...el }) => ({
-            ...el,
-            secretId: id,
-            userActorId,
-            identityActorId,
-            actorType
-          })),
+          secrets.map(({ id, updatedAt, createdAt, ...el }) => ({ ...el, secretId: id })),
           tx
         );
         await secretVersionV2TagBridgeDAL.insertMany(

backend/src/lib/api-docs/constants.ts

@@ -459,8 +459,7 @@ export const PROJECTS = {
     workspaceId: "The ID of the project to update.",
     name: "The new name of the project.",
     projectDescription: "An optional description label for the project.",
-    autoCapitalization: "Disable or enable auto-capitalization for the project.",
-    slug: "An optional slug for the project. (must be unique within the organization)"
+    autoCapitalization: "Disable or enable auto-capitalization for the project."
   },
   GET_KEY: {
     workspaceId: "The ID of the project to get the key from."
@@ -667,7 +666,6 @@ export const SECRETS = {
     secretPath: "The path of the secret to attach tags to.",
     type: "The type of the secret to attach tags to. (shared/personal)",
     environment: "The slug of the environment where the secret is located",
-    viewSecretValue: "Whether or not to retrieve the secret value.",
     projectSlug: "The slug of the project where the secret is located.",
     tagSlugs: "An array of existing tag slugs to attach to the secret."
   },
@@ -691,7 +689,6 @@ export const RAW_SECRETS = {
       "The slug of the project to list secrets from. This parameter is only applicable by machine identities.",
     environment: "The slug of the environment to list secrets from.",
     secretPath: "The secret path to list secrets from.",
-    viewSecretValue: "Whether or not to retrieve the secret value.",
     includeImports: "Weather to include imported secrets or not.",
     tagSlugs: "The comma separated tag slugs to filter secrets.",
     metadataFilter:
@@ -720,7 +717,6 @@ export const RAW_SECRETS = {
     secretPath: "The path of the secret to get.",
     version: "The version of the secret to get.",
     type: "The type of the secret to get.",
-    viewSecretValue: "Whether or not to retrieve the secret value.",
     includeImports: "Weather to include imported secrets or not."
   },
   UPDATE: {

backend/src/lib/casl/boundary.test.ts

@@ -1,669 +0,0 @@
-import { createMongoAbility } from "@casl/ability";
-
-import { PermissionConditionOperators } from ".";
-import { validatePermissionBoundary } from "./boundary";
-
-describe("Validate Permission Boundary Function", () => {
-  test.each([
-    {
-      title: "child with equal privilege",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets"
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets"
-        }
-      ]),
-      expectValid: true,
-      missingPermissions: []
-    },
-    {
-      title: "child with less privilege",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets"
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: ["create", "edit"],
-          subject: "secrets"
-        }
-      ]),
-      expectValid: true,
-      missingPermissions: []
-    },
-    {
-      title: "child with more privilege",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets"
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: ["create", "edit"],
-          subject: "secrets"
-        }
-      ]),
-      expectValid: false,
-      missingPermissions: [{ action: "edit", subject: "secrets" }]
-    },
-    {
-      title: "parent with multiple and child with multiple",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets"
-        },
-        {
-          action: ["create", "edit"],
-          subject: "members"
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "members"
-        },
-        {
-          action: ["create"],
-          subject: "secrets"
-        }
-      ]),
-      expectValid: true,
-      missingPermissions: []
-    },
-    {
-      title: "Child with no access",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets"
-        },
-        {
-          action: ["create", "edit"],
-          subject: "members"
-        }
-      ]),
-      childPermission: createMongoAbility([]),
-      expectValid: true,
-      missingPermissions: []
-    },
-    {
-      title: "Parent and child disjoint set",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        }
-      ]),
-      expectValid: false,
-      missingPermissions: ["create", "edit", "delete", "read"].map((el) => ({
-        action: el,
-        subject: "secrets",
-        conditions: {
-          secretPath: { [PermissionConditionOperators.$EQ]: "dev" }
-        }
-      }))
-    },
-    {
-      title: "Parent with inverted rules",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        },
-        {
-          action: "read",
-          subject: "secrets",
-          inverted: true,
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" },
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/hello/**" }
-          }
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: "read",
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" },
-            secretPath: { [PermissionConditionOperators.$EQ]: "/" }
-          }
-        }
-      ]),
-      expectValid: true,
-      missingPermissions: []
-    },
-    {
-      title: "Parent with inverted rules - child accessing invalid one",
-      parentPermission: createMongoAbility([
-        {
-          action: ["create", "edit", "delete", "read"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        },
-        {
-          action: "read",
-          subject: "secrets",
-          inverted: true,
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" },
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/hello/**" }
-          }
-        }
-      ]),
-      childPermission: createMongoAbility([
-        {
-          action: "read",
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" },
-            secretPath: { [PermissionConditionOperators.$EQ]: "/hello/world" }
-          }
-        }
-      ]),
-      expectValid: false,
-      missingPermissions: [
-        {
-          action: "read",
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" },
-            secretPath: { [PermissionConditionOperators.$EQ]: "/hello/world" }
-          }
-        }
-      ]
-    }
-  ])("Check permission: $title", ({ parentPermission, childPermission, expectValid, missingPermissions }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    if (expectValid) {
-      expect(permissionBoundary.isValid).toBeTruthy();
-    } else {
-      expect(permissionBoundary.isValid).toBeFalsy();
-      expect(permissionBoundary.missingPermissions).toEqual(expect.arrayContaining(missingPermissions));
-    }
-  });
-});
-
-describe("Validate Permission Boundary: Checking Parent $eq operator", () => {
-  const parentPermission = createMongoAbility([
-    {
-      action: ["create", "read"],
-      subject: "secrets",
-      conditions: {
-        environment: { [PermissionConditionOperators.$EQ]: "dev" }
-      }
-    }
-  ]);
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$IN]: ["dev"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$GLOB]: "dev" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator truthy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeTruthy();
-  });
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "prod" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$IN]: ["dev", "prod"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$GLOB]: "dev**" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$NEQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$GLOB]: "staging" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator falsy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeFalsy();
-  });
-});
-
-describe("Validate Permission Boundary: Checking Parent $neq operator", () => {
-  const parentPermission = createMongoAbility([
-    {
-      action: ["create", "read"],
-      subject: "secrets",
-      conditions: {
-        secretPath: { [PermissionConditionOperators.$NEQ]: "/hello" }
-      }
-    }
-  ]);
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$EQ]: "/" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$NEQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$NEQ]: "/hello" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$IN]: ["/", "/staging"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/dev**" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator truthy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeTruthy();
-  });
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$EQ]: "/hello" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$NEQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$NEQ]: "/" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$IN]: ["/", "/hello"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/hello**" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator falsy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeFalsy();
-  });
-});
-
-describe("Validate Permission Boundary: Checking Parent $IN operator", () => {
-  const parentPermission = createMongoAbility([
-    {
-      action: ["edit"],
-      subject: "secrets",
-      conditions: {
-        environment: { [PermissionConditionOperators.$IN]: ["dev", "staging"] }
-      }
-    }
-  ]);
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "dev" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$IN]: ["dev"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: `${PermissionConditionOperators.$IN} - 2`,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$IN]: ["dev", "staging"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$GLOB]: "dev" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator truthy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeTruthy();
-  });
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$EQ]: "prod" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$NEQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$NEQ]: "dev" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$IN]: ["dev", "prod"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["edit"],
-          subject: "secrets",
-          conditions: {
-            environment: { [PermissionConditionOperators.$GLOB]: "dev**" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator falsy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeFalsy();
-  });
-});
-
-describe("Validate Permission Boundary: Checking Parent $GLOB operator", () => {
-  const parentPermission = createMongoAbility([
-    {
-      action: ["create", "read"],
-      subject: "secrets",
-      conditions: {
-        secretPath: { [PermissionConditionOperators.$GLOB]: "/hello/**" }
-      }
-    }
-  ]);
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$EQ]: "/hello/world" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$IN]: ["/hello/world", "/hello/world2"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/hello/**/world" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator truthy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeTruthy();
-  });
-
-  test.each([
-    {
-      operator: PermissionConditionOperators.$EQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$EQ]: "/print" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$NEQ,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$NEQ]: "/hello/world" }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$IN,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$IN]: ["/", "/hello"] }
-          }
-        }
-      ])
-    },
-    {
-      operator: PermissionConditionOperators.$GLOB,
-      childPermission: createMongoAbility([
-        {
-          action: ["create"],
-          subject: "secrets",
-          conditions: {
-            secretPath: { [PermissionConditionOperators.$GLOB]: "/hello**" }
-          }
-        }
-      ])
-    }
-  ])("Child $operator falsy cases", ({ childPermission }) => {
-    const permissionBoundary = validatePermissionBoundary(parentPermission, childPermission);
-    expect(permissionBoundary.isValid).toBeFalsy();
-  });
-});

backend/src/lib/casl/boundary.ts

@@ -1,249 +0,0 @@
-import { MongoAbility } from "@casl/ability";
-import { MongoQuery } from "@ucast/mongo2js";
-import picomatch from "picomatch";
-
-import { PermissionConditionOperators } from "./index";
-
-type TMissingPermission = {
-  action: string;
-  subject: string;
-  conditions?: MongoQuery;
-};
-
-type TPermissionConditionShape = {
-  [PermissionConditionOperators.$EQ]: string;
-  [PermissionConditionOperators.$NEQ]: string;
-  [PermissionConditionOperators.$GLOB]: string;
-  [PermissionConditionOperators.$IN]: string[];
-};
-
-const getPermissionSetID = (action: string, subject: string) => `${action}:${subject}`;
-const invertTheOperation = (shouldInvert: boolean, operation: boolean) => (shouldInvert ? !operation : operation);
-const formatConditionOperator = (condition: TPermissionConditionShape | string) => {
-  return (
-    typeof condition === "string" ? { [PermissionConditionOperators.$EQ]: condition } : condition
-  ) as TPermissionConditionShape;
-};
-
-const isOperatorsASubset = (parentSet: TPermissionConditionShape, subset: TPermissionConditionShape) => {
-  // we compute each operator against each other in left hand side and right hand side
-  if (subset[PermissionConditionOperators.$EQ] || subset[PermissionConditionOperators.$NEQ]) {
-    const subsetOperatorValue = subset[PermissionConditionOperators.$EQ] || subset[PermissionConditionOperators.$NEQ];
-    const isInverted = !subset[PermissionConditionOperators.$EQ];
-    if (
-      parentSet[PermissionConditionOperators.$EQ] &&
-      invertTheOperation(isInverted, parentSet[PermissionConditionOperators.$EQ] !== subsetOperatorValue)
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$NEQ] &&
-      invertTheOperation(isInverted, parentSet[PermissionConditionOperators.$NEQ] === subsetOperatorValue)
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$IN] &&
-      invertTheOperation(isInverted, !parentSet[PermissionConditionOperators.$IN].includes(subsetOperatorValue))
-    ) {
-      return false;
-    }
-    // ne and glob cannot match each other
-    if (parentSet[PermissionConditionOperators.$GLOB] && isInverted) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$GLOB] &&
-      !picomatch.isMatch(subsetOperatorValue, parentSet[PermissionConditionOperators.$GLOB], { strictSlashes: false })
-    ) {
-      return false;
-    }
-  }
-  if (subset[PermissionConditionOperators.$IN]) {
-    const subsetOperatorValue = subset[PermissionConditionOperators.$IN];
-    if (
-      parentSet[PermissionConditionOperators.$EQ] &&
-      (subsetOperatorValue.length !== 1 || subsetOperatorValue[0] !== parentSet[PermissionConditionOperators.$EQ])
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$NEQ] &&
-      subsetOperatorValue.includes(parentSet[PermissionConditionOperators.$NEQ])
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$IN] &&
-      !subsetOperatorValue.every((el) => parentSet[PermissionConditionOperators.$IN].includes(el))
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$GLOB] &&
-      !subsetOperatorValue.every((el) =>
-        picomatch.isMatch(el, parentSet[PermissionConditionOperators.$GLOB], {
-          strictSlashes: false
-        })
-      )
-    ) {
-      return false;
-    }
-  }
-  if (subset[PermissionConditionOperators.$GLOB]) {
-    const subsetOperatorValue = subset[PermissionConditionOperators.$GLOB];
-    const { isGlob } = picomatch.scan(subsetOperatorValue);
-    // if it's glob, all other fixed operators would make this superset because glob is powerful. like eq
-    // example: $in [dev, prod] => glob: dev** could mean anything starting with dev: thus is bigger
-    if (
-      isGlob &&
-      Object.keys(parentSet).some(
-        (el) => el !== PermissionConditionOperators.$GLOB && el !== PermissionConditionOperators.$NEQ
-      )
-    ) {
-      return false;
-    }
-
-    if (
-      parentSet[PermissionConditionOperators.$EQ] &&
-      parentSet[PermissionConditionOperators.$EQ] !== subsetOperatorValue
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$NEQ] &&
-      picomatch.isMatch(parentSet[PermissionConditionOperators.$NEQ], subsetOperatorValue, {
-        strictSlashes: false
-      })
-    ) {
-      return false;
-    }
-    // if parent set is IN, glob cannot be used for children - It's a bigger scope
-    if (
-      parentSet[PermissionConditionOperators.$IN] &&
-      !parentSet[PermissionConditionOperators.$IN].includes(subsetOperatorValue)
-    ) {
-      return false;
-    }
-    if (
-      parentSet[PermissionConditionOperators.$GLOB] &&
-      !picomatch.isMatch(subsetOperatorValue, parentSet[PermissionConditionOperators.$GLOB], {
-        strictSlashes: false
-      })
-    ) {
-      return false;
-    }
-  }
-  return true;
-};
-
-const isSubsetForSamePermissionSubjectAction = (
-  parentSetRules: ReturnType<MongoAbility["possibleRulesFor"]>,
-  subsetRules: ReturnType<MongoAbility["possibleRulesFor"]>,
-  appendToMissingPermission: (condition?: MongoQuery) => void
-) => {
-  const isMissingConditionInParent = parentSetRules.every((el) => !el.conditions);
-  if (isMissingConditionInParent) return true;
-
-  // all subset rules must pass in comparison to parent rul
-  return subsetRules.every((subsetRule) => {
-    const subsetRuleConditions = subsetRule.conditions as Record<string, TPermissionConditionShape | string>;
-    // compare subset rule with all parent rules
-    const isSubsetOfNonInvertedParentSet = parentSetRules
-      .filter((el) => !el.inverted)
-      .some((parentSetRule) => {
-        // get conditions and iterate
-        const parentSetRuleConditions = parentSetRule?.conditions as Record<string, TPermissionConditionShape | string>;
-        if (!parentSetRuleConditions) return true;
-        return Object.keys(parentSetRuleConditions).every((parentConditionField) => {
-          // if parent condition is missing then it's never a subset
-          if (!subsetRuleConditions?.[parentConditionField]) return false;
-
-          // standardize the conditions plain string operator => $eq function
-          const parentRuleConditionOperators = formatConditionOperator(parentSetRuleConditions[parentConditionField]);
-          const selectedSubsetRuleCondition = subsetRuleConditions?.[parentConditionField];
-          const subsetRuleConditionOperators = formatConditionOperator(selectedSubsetRuleCondition);
-          return isOperatorsASubset(parentRuleConditionOperators, subsetRuleConditionOperators);
-        });
-      });
-
-    const invertedParentSetRules = parentSetRules.filter((el) => el.inverted);
-    const isNotSubsetOfInvertedParentSet = invertedParentSetRules.length
-      ? !invertedParentSetRules.some((parentSetRule) => {
-          // get conditions and iterate
-          const parentSetRuleConditions = parentSetRule?.conditions as Record<
-            string,
-            TPermissionConditionShape | string
-          >;
-          if (!parentSetRuleConditions) return true;
-          return Object.keys(parentSetRuleConditions).every((parentConditionField) => {
-            // if parent condition is missing then it's never a subset
-            if (!subsetRuleConditions?.[parentConditionField]) return false;
-
-            // standardize the conditions plain string operator => $eq function
-            const parentRuleConditionOperators = formatConditionOperator(parentSetRuleConditions[parentConditionField]);
-            const selectedSubsetRuleCondition = subsetRuleConditions?.[parentConditionField];
-            const subsetRuleConditionOperators = formatConditionOperator(selectedSubsetRuleCondition);
-            return isOperatorsASubset(parentRuleConditionOperators, subsetRuleConditionOperators);
-          });
-        })
-      : true;
-    const isSubset = isSubsetOfNonInvertedParentSet && isNotSubsetOfInvertedParentSet;
-    if (!isSubset) {
-      appendToMissingPermission(subsetRule.conditions);
-    }
-    return isSubset;
-  });
-};
-
-export const validatePermissionBoundary = (parentSetPermissions: MongoAbility, subsetPermissions: MongoAbility) => {
-  const checkedPermissionRules = new Set<string>();
-  const missingPermissions: TMissingPermission[] = [];
-
-  subsetPermissions.rules.forEach((subsetPermissionRules) => {
-    const subsetPermissionSubject = subsetPermissionRules.subject.toString();
-    let subsetPermissionActions: string[] = [];
-
-    // actions can be string or string[]
-    if (typeof subsetPermissionRules.action === "string") {
-      subsetPermissionActions.push(subsetPermissionRules.action);
-    } else {
-      subsetPermissionRules.action.forEach((subsetPermissionAction) => {
-        subsetPermissionActions.push(subsetPermissionAction);
-      });
-    }
-
-    // if action is already processed ignore
-    subsetPermissionActions = subsetPermissionActions.filter(
-      (el) => !checkedPermissionRules.has(getPermissionSetID(el, subsetPermissionSubject))
-    );
-
-    if (!subsetPermissionActions.length) return;
-    subsetPermissionActions.forEach((subsetPermissionAction) => {
-      const parentSetRulesOfSubset = parentSetPermissions.possibleRulesFor(
-        subsetPermissionAction,
-        subsetPermissionSubject
-      );
-      const nonInveretedOnes = parentSetRulesOfSubset.filter((el) => !el.inverted);
-      if (!nonInveretedOnes.length) {
-        missingPermissions.push({ action: subsetPermissionAction, subject: subsetPermissionSubject });
-        return;
-      }
-
-      const subsetRules = subsetPermissions.possibleRulesFor(subsetPermissionAction, subsetPermissionSubject);
-      isSubsetForSamePermissionSubjectAction(parentSetRulesOfSubset, subsetRules, (conditions) => {
-        missingPermissions.push({ action: subsetPermissionAction, subject: subsetPermissionSubject, conditions });
-      });
-    });
-
-    subsetPermissionActions.forEach((el) =>
-      checkedPermissionRules.add(getPermissionSetID(el, subsetPermissionSubject))
-    );
-  });
-
-  if (missingPermissions.length) {
-    return { isValid: false as const, missingPermissions };
-  }
-
-  return { isValid: true };
-};

backend/src/lib/casl/index.ts

@@ -1,5 +1,5 @@
 /* eslint-disable @typescript-eslint/no-unsafe-assignment */
-import { buildMongoQueryMatcher } from "@casl/ability";
+import { buildMongoQueryMatcher, MongoAbility } from "@casl/ability";
 import { FieldCondition, FieldInstruction, JsInterpreter } from "@ucast/mongo2js";
 import picomatch from "picomatch";
 
@@ -20,8 +20,45 @@ const glob: JsInterpreter<FieldCondition<string>> = (node, object, context) => {
 
 export const conditionsMatcher = buildMongoQueryMatcher({ $glob }, { glob });
 
+/**
+ * Extracts and formats permissions from a CASL Ability object or a raw permission set.
+ */
+const extractPermissions = (ability: MongoAbility) => {
+  const permissions: string[] = [];
+  ability.rules.forEach((permission) => {
+    if (typeof permission.action === "string") {
+      permissions.push(`${permission.action}_${permission.subject as string}`);
+    } else {
+      permission.action.forEach((permissionAction) => {
+        permissions.push(`${permissionAction}_${permission.subject as string}`);
+      });
+    }
+  });
+  return permissions;
+};
+
+/**
+ * Compares two sets of permissions to determine if the first set is at least as privileged as the second set.
+ * The function checks if all permissions in the second set are contained within the first set and if the first set has equal or more permissions.
+ *
+ */
+export const isAtLeastAsPrivileged = (permissions1: MongoAbility, permissions2: MongoAbility) => {
+  const set1 = new Set(extractPermissions(permissions1));
+  const set2 = new Set(extractPermissions(permissions2));
+
+  for (const perm of set2) {
+    if (!set1.has(perm)) {
+      return false;
+    }
+  }
+
+  return set1.size >= set2.size;
+};
+
 export enum PermissionConditionOperators {
   $IN = "$in",
+  $ALL = "$all",
+  $REGEX = "$regex",
   $EQ = "$eq",
   $NEQ = "$ne",
   $GLOB = "$glob"

backend/src/lib/errors/index.ts

@@ -1,5 +1,4 @@
 /* eslint-disable max-classes-per-file */
-
 export class DatabaseError extends Error {
   name: string;
 
@@ -53,18 +52,10 @@ export class ForbiddenRequestError extends Error {
 
   error: unknown;
 
-  details?: unknown;
-
-  constructor({
-    name,
-    error,
-    message,
-    details
-  }: { message?: string; name?: string; error?: unknown; details?: unknown } = {}) {
+  constructor({ name, error, message }: { message?: string; name?: string; error?: unknown } = {}) {
     super(message ?? "You are not allowed to access this resource");
     this.name = name || "ForbiddenError";
     this.error = error;
-    this.details = details;
   }
 }
 

backend/src/lib/gateway/index.ts

@@ -2,7 +2,7 @@
 import crypto from "node:crypto";
 import net from "node:net";
 
-import quicDefault, * as quicModule from "@infisical/quic";
+import * as quic from "@infisical/quic";
 
 import { BadRequestError } from "../errors";
 import { logger } from "../logger";
@@ -10,8 +10,6 @@ import { logger } from "../logger";
 const DEFAULT_MAX_RETRIES = 3;
 const DEFAULT_RETRY_DELAY = 1000; // 1 second
 
-const quic = quicDefault || quicModule;
-
 const parseSubjectDetails = (data: string) => {
   const values: Record<string, string> = {};
   data.split("\n").forEach((el) => {
@@ -96,7 +94,6 @@ export const pingGatewayAndVerify = async ({
       error: err as Error
     });
   });
-
   for (let attempt = 1; attempt <= maxRetries; attempt += 1) {
     try {
       const stream = quicClient.connection.newStream("bidi");
@@ -109,13 +106,17 @@ export const pingGatewayAndVerify = async ({
       const { value, done } = await reader.read();
 
       if (done) {
-        throw new Error("Gateway closed before receiving PONG");
+        throw new BadRequestError({
+          message: "Gateway closed before receiving PONG"
+        });
       }
 
       const response = Buffer.from(value).toString();
 
       if (response !== "PONG\n" && response !== "PONG") {
-        throw new Error(`Failed to Ping. Unexpected response: ${response}`);
+        throw new BadRequestError({
+          message: `Failed to Ping. Unexpected response: ${response}`
+        });
       }
 
       reader.releaseLock();
@@ -143,7 +144,6 @@ interface TProxyServer {
   server: net.Server;
   port: number;
   cleanup: () => Promise<void>;
-  getProxyError: () => string;
 }
 
 const setupProxyServer = async ({
@@ -168,7 +168,6 @@ const setupProxyServer = async ({
       error: err as Error
     });
   });
-  const proxyErrorMsg = [""];
 
   return new Promise((resolve, reject) => {
     const server = net.createServer();
@@ -184,33 +183,31 @@ const setupProxyServer = async ({
         const forwardWriter = stream.writable.getWriter();
         await forwardWriter.write(Buffer.from(`FORWARD-TCP ${targetHost}:${targetPort}\n`));
         forwardWriter.releaseLock();
-
+        /* eslint-disable @typescript-eslint/no-misused-promises */
         // Set up bidirectional copy
-        const setupCopy = () => {
+        const setupCopy = async () => {
           // Client to QUIC
           // eslint-disable-next-line
           (async () => {
-            const writer = stream.writable.getWriter();
+            try {
+              const writer = stream.writable.getWriter();
 
-            // Create a handler for client data
-            clientConn.on("data", (chunk) => {
-              writer.write(chunk).catch((err) => {
-                proxyErrorMsg.push((err as Error)?.message);
+              // Create a handler for client data
+              clientConn.on("data", async (chunk) => {
+                await writer.write(chunk);
               });
-            });
 
-            // Handle client connection close
-            clientConn.on("end", () => {
-              writer.close().catch((err) => {
-                logger.error(err);
+              // Handle client connection close
+              clientConn.on("end", async () => {
+                await writer.close();
               });
-            });
 
-            clientConn.on("error", (clientConnErr) => {
-              writer.abort(clientConnErr?.message).catch((err) => {
-                proxyErrorMsg.push((err as Error)?.message);
+              clientConn.on("error", async (err) => {
+                await writer.abort(err);
               });
-            });
+            } catch (err) {
+              clientConn.destroy();
+            }
           })();
 
           // QUIC to Client
@@ -239,18 +236,15 @@ const setupProxyServer = async ({
                 }
               }
             } catch (err) {
-              proxyErrorMsg.push((err as Error)?.message);
               clientConn.destroy();
             }
           })();
         };
-
-        setupCopy();
+        await setupCopy();
+        //
         // Handle connection closure
-        clientConn.on("close", () => {
-          stream.destroy().catch((err) => {
-            proxyErrorMsg.push((err as Error)?.message);
-          });
+        clientConn.on("close", async () => {
+          await stream.destroy();
         });
 
         const cleanup = async () => {
@@ -258,18 +252,13 @@ const setupProxyServer = async ({
           await stream.destroy();
         };
 
-        clientConn.on("error", (clientConnErr) => {
-          logger.error(clientConnErr, "Client socket error");
-          cleanup().catch((err) => {
-            logger.error(err, "Client conn cleanup");
-          });
+        clientConn.on("error", (err) => {
+          logger.error(err, "Client socket error");
+          void cleanup();
+          reject(err);
         });
 
-        clientConn.on("end", () => {
-          cleanup().catch((err) => {
-            logger.error(err, "Client conn end");
-          });
-        });
+        clientConn.on("end", cleanup);
       } catch (err) {
         logger.error(err, "Failed to establish target connection:");
         clientConn.end();
@@ -281,12 +270,12 @@ const setupProxyServer = async ({
       reject(err);
     });
 
-    server.on("close", () => {
-      quicClient?.destroy().catch((err) => {
-        logger.error(err, "Failed to destroy quic client");
-      });
+    server.on("close", async () => {
+      await quicClient?.destroy();
     });
 
+    /* eslint-enable */
+
     server.listen(0, () => {
       const address = server.address();
       if (!address || typeof address === "string") {
@@ -302,8 +291,7 @@ const setupProxyServer = async ({
         cleanup: async () => {
           server.close();
           await quicClient?.destroy();
-        },
-        getProxyError: () => proxyErrorMsg.join(",")
+        }
       });
     });
   });
@@ -326,7 +314,7 @@ export const withGatewayProxy = async (
   const { relayHost, relayPort, targetHost, targetPort, tlsOptions, identityId, orgId } = options;
 
   // Setup the proxy server
-  const { port, cleanup, getProxyError } = await setupProxyServer({
+  const { port, cleanup } = await setupProxyServer({
     targetHost,
     targetPort,
     relayPort,
@@ -340,12 +328,8 @@ export const withGatewayProxy = async (
     // Execute the callback with the allocated port
     await callback(port);
   } catch (err) {
-    const proxyErrorMessage = getProxyError();
-    if (proxyErrorMessage) {
-      logger.error(new Error(proxyErrorMessage), "Failed to proxy");
-    }
-    logger.error(err, "Failed to do gateway");
-    throw new BadRequestError({ message: proxyErrorMessage || (err as Error)?.message });
+    logger.error(err, "Failed to proxy");
+    throw new BadRequestError({ message: (err as Error)?.message });
   } finally {
     // Ensure cleanup happens regardless of success or failure
     await cleanup();

backend/src/lib/turn/credentials.ts

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 
-const TURN_TOKEN_TTL = 24 * 60 * 60 * 1000; // 24 hours in milliseconds
+const TURN_TOKEN_TTL = 60 * 60 * 1000; // 24 hours in milliseconds
 export const getTurnCredentials = (id: string, authSecret: string, ttl = TURN_TOKEN_TTL) => {
   const timestamp = Math.floor((Date.now() + ttl) / 1000);
   const username = `${timestamp}:${id}`;

backend/src/main.ts

@@ -83,14 +83,6 @@ const run = async () => {
     process.exit(0);
   });
 
-  process.on("uncaughtException", (error) => {
-    logger.error(error, "CRITICAL ERROR: Uncaught Exception");
-  });
-
-  process.on("unhandledRejection", (error) => {
-    logger.error(error, "CRITICAL ERROR: Unhandled Promise Rejection");
-  });
-
   await server.listen({
     port: envConfig.PORT,
     host: envConfig.HOST,

backend/src/queue/queue-service.ts

@@ -21,7 +21,6 @@ import {
   TQueueSecretSyncSyncSecretsByIdDTO,
   TQueueSendSecretSyncActionFailedNotificationsDTO
 } from "@app/services/secret-sync/secret-sync-types";
-import { TWebhookPayloads } from "@app/services/webhook/webhook-types";
 
 export enum QueueName {
   SecretRotation = "secret-rotation",
@@ -108,7 +107,7 @@ export type TQueueJobTypes = {
   };
   [QueueName.SecretWebhook]: {
     name: QueueJobs.SecWebhook;
-    payload: TWebhookPayloads;
+    payload: { projectId: string; environment: string; secretPath: string; depth?: number };
   };
 
   [QueueName.AccessTokenStatusUpdate]:

backend/src/server/lib/utils.ts

@@ -0,0 +1,8 @@
+export const QUERY_TIMEOUT = 121000; // 2 mins (query timeout) with padding
+
+export const extendTimeout =
+  (timeoutMs: number) =>
+  (request: { raw: { socket: { setTimeout: (ms: number) => void } } }, reply: unknown, done: () => void) => {
+    request.raw.socket.setTimeout(timeoutMs);
+    done();
+  };

backend/src/server/plugins/error-handler.ts

@@ -122,8 +122,7 @@ export const fastifyErrHandler = fastifyPlugin(async (server: FastifyZodProvider
         reqId: req.id,
         statusCode: HttpStatusCodes.Forbidden,
         message: error.message,
-        error: error.name,
-        details: error?.details
+        error: error.name
       });
     } else if (error instanceof RateLimitError) {
       void res.status(HttpStatusCodes.TooManyRequests).send({

backend/src/server/routes/sanitizedSchemas.ts

@@ -7,7 +7,6 @@ import {
   ProjectRolesSchema,
   ProjectsSchema,
   SecretApprovalPoliciesSchema,
-  SecretTagsSchema,
   UsersSchema
 } from "@app/db/schemas";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
@@ -112,16 +111,7 @@ export const secretRawSchema = z.object({
   secretReminderRepeatDays: z.number().nullable().optional(),
   skipMultilineEncoding: z.boolean().default(false).nullable().optional(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  actor: z
-    .object({
-      actorId: z.string().nullable().optional(),
-      actorType: z.string().nullable().optional(),
-      name: z.string().nullable().optional(),
-      membershipId: z.string().nullable().optional()
-    })
-    .optional()
-    .nullable()
+  updatedAt: z.date()
 });
 
 export const ProjectPermissionSchema = z.object({
@@ -242,11 +232,3 @@ export const SanitizedProjectSchema = ProjectsSchema.pick({
   kmsCertificateKeyId: true,
   auditLogsRetentionDays: true
 });
-
-export const SanitizedTagSchema = SecretTagsSchema.pick({
-  id: true,
-  slug: true,
-  color: true
-}).extend({
-  name: z.string()
-});

backend/src/server/routes/v1/admin-router.ts

@@ -118,12 +118,7 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
       querystring: z.object({
         searchTerm: z.string().default(""),
         offset: z.coerce.number().default(0),
-        limit: z.coerce.number().max(100).default(20),
-        // TODO: remove this once z.coerce.boolean() is supported
-        adminsOnly: z
-          .string()
-          .transform((val) => val === "true")
-          .default("false")
+        limit: z.coerce.number().max(100).default(20)
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/dashboard-router.ts

@@ -1,11 +1,10 @@
 import { ForbiddenError, subject } from "@casl/ability";
 import { z } from "zod";
 
-import { ActionProjectType, SecretFoldersSchema, SecretImportsSchema } from "@app/db/schemas";
+import { ActionProjectType, SecretFoldersSchema, SecretImportsSchema, SecretTagsSchema } from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
 import {
   ProjectPermissionDynamicSecretActions,
-  ProjectPermissionSecretActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
 import { DASHBOARD } from "@app/lib/api-docs";
@@ -16,7 +15,7 @@ import { secretsLimit } from "@app/server/config/rateLimiter";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { getUserAgentType } from "@app/server/plugins/audit-log";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { SanitizedDynamicSecretSchema, SanitizedTagSchema, secretRawSchema } from "@app/server/routes/sanitizedSchemas";
+import { SanitizedDynamicSecretSchema, secretRawSchema } from "@app/server/routes/sanitizedSchemas";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { ResourceMetadataSchema } from "@app/services/resource-metadata/resource-metadata-schema";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
@@ -117,10 +116,16 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           dynamicSecrets: SanitizedDynamicSecretSchema.extend({ environment: z.string() }).array().optional(),
           secrets: secretRawSchema
             .extend({
-              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
-              tags: SanitizedTagSchema.array().optional()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+                .optional()
             })
             .array()
             .optional(),
@@ -289,7 +294,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
 
         if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
           secrets = await server.services.secret.getSecretsRawMultiEnv({
-            viewSecretValue: true,
             actorId: req.permission.id,
             actor: req.permission.type,
             actorOrgId: req.permission.orgId,
@@ -389,7 +393,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           .optional(),
         search: z.string().trim().describe(DASHBOARD.SECRET_DETAILS_LIST.search).optional(),
         tags: z.string().trim().transform(decodeURIComponent).describe(DASHBOARD.SECRET_DETAILS_LIST.tags).optional(),
-        viewSecretValue: booleanSchema.default(true),
         includeSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeSecrets),
         includeFolders: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeFolders),
         includeDynamicSecrets: booleanSchema.describe(DASHBOARD.SECRET_DETAILS_LIST.includeDynamicSecrets),
@@ -407,10 +410,16 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           dynamicSecrets: SanitizedDynamicSecretSchema.array().optional(),
           secrets: secretRawSchema
             .extend({
-              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
-              tags: SanitizedTagSchema.array().optional()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+                .optional()
             })
             .array()
             .optional(),
@@ -592,25 +601,23 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
           });
 
           if (remainingLimit > 0 && totalSecretCount > adjustedOffset) {
-            secrets = (
-              await server.services.secret.getSecretsRaw({
-                actorId: req.permission.id,
-                actor: req.permission.type,
-                viewSecretValue: req.query.viewSecretValue,
-                throwOnMissingReadValuePermission: false,
-                actorOrgId: req.permission.orgId,
-                environment,
-                actorAuthMethod: req.permission.authMethod,
-                projectId,
-                path: secretPath,
-                orderBy,
-                orderDirection,
-                search,
-                limit: remainingLimit,
-                offset: adjustedOffset,
-                tagSlugs: tags
-              })
-            ).secrets;
+            const secretsRaw = await server.services.secret.getSecretsRaw({
+              actorId: req.permission.id,
+              actor: req.permission.type,
+              actorOrgId: req.permission.orgId,
+              environment,
+              actorAuthMethod: req.permission.authMethod,
+              projectId,
+              path: secretPath,
+              orderBy,
+              orderDirection,
+              search,
+              limit: remainingLimit,
+              offset: adjustedOffset,
+              tagSlugs: tags
+            });
+
+            secrets = secretsRaw.secrets;
 
             await server.services.auditLog.createAuditLog({
               projectId,
@@ -689,10 +696,16 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
             .optional(),
           secrets: secretRawSchema
             .extend({
-              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
-              tags: SanitizedTagSchema.array().optional()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+                .optional()
             })
             .array()
             .optional()
@@ -736,7 +749,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
 
       const secrets = await server.services.secret.getSecretsRawByFolderMappings(
         {
-          filterByAction: ProjectPermissionSecretActions.DescribeSecret,
           projectId,
           folderMappings,
           filters: {
@@ -834,52 +846,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/accessible-secrets",
-    config: {
-      rateLimit: secretsLimit
-    },
-    schema: {
-      querystring: z.object({
-        projectId: z.string().trim(),
-        environment: z.string().trim(),
-        secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        filterByAction: z
-          .enum([ProjectPermissionSecretActions.DescribeSecret, ProjectPermissionSecretActions.ReadValue])
-          .default(ProjectPermissionSecretActions.ReadValue)
-      }),
-      response: {
-        200: z.object({
-          secrets: secretRawSchema
-            .extend({
-              secretPath: z.string().optional(),
-              secretValueHidden: z.boolean()
-            })
-            .array()
-            .optional()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { projectId, environment, secretPath, filterByAction } = req.query;
-
-      const { secrets } = await server.services.secret.getAccessibleSecrets({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        environment,
-        secretPath,
-        projectId,
-        filterByAction
-      });
-
-      return { secrets };
-    }
-  });
-
   server.route({
     method: "GET",
     url: "/secrets-by-keys",
@@ -896,17 +862,22 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         projectId: z.string().trim(),
         environment: z.string().trim(),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        keys: z.string().trim().transform(decodeURIComponent),
-        viewSecretValue: booleanSchema.default(false)
+        keys: z.string().trim().transform(decodeURIComponent)
       }),
       response: {
         200: z.object({
           secrets: secretRawSchema
             .extend({
-              secretValueHidden: z.boolean(),
               secretPath: z.string().optional(),
               secretMetadata: ResourceMetadataSchema.optional(),
-              tags: SanitizedTagSchema.array().optional()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+                .optional()
             })
             .array()
             .optional()
@@ -915,7 +886,7 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
     },
     onRequest: verifyAuth([AuthMode.JWT]),
     handler: async (req) => {
-      const { secretPath, projectId, environment, viewSecretValue } = req.query;
+      const { secretPath, projectId, environment } = req.query;
 
       const keys = req.query.keys?.split(",").filter((key) => Boolean(key.trim())) ?? [];
       if (!keys.length) throw new BadRequestError({ message: "One or more keys required" });
@@ -924,7 +895,6 @@ export const registerDashboardRouter = async (server: FastifyZodProvider) => {
         actorId: req.permission.id,
         actor: req.permission.type,
         actorOrgId: req.permission.orgId,
-        viewSecretValue,
         environment,
         actorAuthMethod: req.permission.authMethod,
         projectId,

backend/src/server/routes/v1/organization-router.ts

@@ -14,6 +14,7 @@ import { AUDIT_LOGS, ORGANIZATIONS } from "@app/lib/api-docs";
 import { getLastMidnightDateISO, removeTrailingSlash } from "@app/lib/fn";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
+import { extendTimeout, QUERY_TIMEOUT } from "@app/server/lib/utils";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { ActorType, AuthMode, MfaMethod } from "@app/services/auth/auth-type";
 import { sanitizedOrganizationSchema } from "@app/services/org/org-schema";
@@ -108,6 +109,7 @@ export const registerOrgRouter = async (server: FastifyZodProvider) => {
     config: {
       rateLimit: readLimit
     },
+    preHandler: extendTimeout(QUERY_TIMEOUT),
     schema: {
       description: "Get all audit logs for an organization",
       querystring: z.object({

backend/src/server/routes/v1/password-router.ts

@@ -6,7 +6,6 @@ import { authRateLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { validateSignUpAuthorization } from "@app/services/auth/auth-fns";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { UserEncryption } from "@app/services/user/user-types";
 
 export const registerPasswordRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -114,16 +113,20 @@ export const registerPasswordRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
+          message: z.string(),
           user: UsersSchema,
-          token: z.string(),
-          userEncryptionVersion: z.nativeEnum(UserEncryption)
+          token: z.string()
         })
       }
     },
     handler: async (req) => {
-      const passwordReset = await server.services.password.verifyPasswordResetEmail(req.body.email, req.body.code);
+      const { token, user } = await server.services.password.verifyPasswordResetEmail(req.body.email, req.body.code);
 
-      return passwordReset;
+      return {
+        message: "Successfully verified email",
+        user,
+        token
+      };
     }
   });
 

backend/src/server/routes/v1/project-router.ts

@@ -2,12 +2,10 @@ import { z } from "zod";
 
 import {
   IntegrationsSchema,
-  ProjectEnvironmentsSchema,
   ProjectMembershipsSchema,
   ProjectRolesSchema,
   ProjectSlackConfigsSchema,
   ProjectType,
-  SecretFoldersSchema,
   UserEncryptionKeysSchema,
   UsersSchema
 } from "@app/db/schemas";
@@ -309,17 +307,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
           .max(256, { message: "Description must be 256 or fewer characters" })
           .optional()
           .describe(PROJECTS.UPDATE.projectDescription),
-        autoCapitalization: z.boolean().optional().describe(PROJECTS.UPDATE.autoCapitalization),
-        slug: z
-          .string()
-          .trim()
-          .regex(
-            /^[a-z0-9]+(?:[_-][a-z0-9]+)*$/,
-            "Project slug can only contain lowercase letters and numbers, with optional single hyphens (-) or underscores (_) between words. Cannot start or end with a hyphen or underscore."
-          )
-          .max(64, { message: "Slug must be 64 characters or fewer" })
-          .optional()
-          .describe(PROJECTS.UPDATE.slug)
+        autoCapitalization: z.boolean().optional().describe(PROJECTS.UPDATE.autoCapitalization)
       }),
       response: {
         200: z.object({
@@ -337,8 +325,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
         update: {
           name: req.body.name,
           description: req.body.description,
-          autoCapitalization: req.body.autoCapitalization,
-          slug: req.body.slug
+          autoCapitalization: req.body.autoCapitalization
         },
         actorAuthMethod: req.permission.authMethod,
         actorId: req.permission.id,
@@ -677,31 +664,4 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       return slackConfig;
     }
   });
-
-  server.route({
-    method: "GET",
-    url: "/:workspaceId/environment-folder-tree",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        workspaceId: z.string().trim()
-      }),
-      response: {
-        200: z.record(
-          ProjectEnvironmentsSchema.extend({ folders: SecretFoldersSchema.extend({ path: z.string() }).array() })
-        )
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const environmentsFolders = await server.services.folder.getProjectEnvironmentsFolders(
-        req.params.workspaceId,
-        req.permission
-      );
-
-      return environmentsFolders;
-    }
-  });
 };

backend/src/server/routes/v2/index.ts

@@ -3,7 +3,6 @@ import { registerIdentityOrgRouter } from "./identity-org-router";
 import { registerIdentityProjectRouter } from "./identity-project-router";
 import { registerMfaRouter } from "./mfa-router";
 import { registerOrgRouter } from "./organization-router";
-import { registerPasswordRouter } from "./password-router";
 import { registerProjectMembershipRouter } from "./project-membership-router";
 import { registerProjectRouter } from "./project-router";
 import { registerServiceTokenRouter } from "./service-token-router";
@@ -13,7 +12,6 @@ export const registerV2Routes = async (server: FastifyZodProvider) => {
   await server.register(registerMfaRouter, { prefix: "/auth" });
   await server.register(registerUserRouter, { prefix: "/users" });
   await server.register(registerServiceTokenRouter, { prefix: "/service-token" });
-  await server.register(registerPasswordRouter, { prefix: "/password" });
   await server.register(
     async (orgRouter) => {
       await orgRouter.register(registerOrgRouter);

backend/src/server/routes/v2/password-router.ts

@@ -1,53 +0,0 @@
-import { z } from "zod";
-
-import { authRateLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { validatePasswordResetAuthorization } from "@app/services/auth/auth-fns";
-import { ResetPasswordV2Type } from "@app/services/auth/auth-password-type";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-export const registerPasswordRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "POST",
-    url: "/password-reset",
-    config: {
-      rateLimit: authRateLimit
-    },
-    schema: {
-      body: z.object({
-        newPassword: z.string().trim()
-      })
-    },
-    handler: async (req) => {
-      const token = validatePasswordResetAuthorization(req.headers.authorization);
-      await server.services.password.resetPasswordV2({
-        type: ResetPasswordV2Type.Recovery,
-        newPassword: req.body.newPassword,
-        userId: token.userId
-      });
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/user/password-reset",
-    schema: {
-      body: z.object({
-        oldPassword: z.string().trim(),
-        newPassword: z.string().trim()
-      })
-    },
-    config: {
-      rateLimit: authRateLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT], { requireOrg: false }),
-    handler: async (req) => {
-      await server.services.password.resetPasswordV2({
-        type: ResetPasswordV2Type.LoggedInReset,
-        userId: req.permission.id,
-        newPassword: req.body.newPassword,
-        oldPassword: req.body.oldPassword
-      });
-    }
-  });
-};

backend/src/server/routes/v3/secret-router.ts

@@ -1,7 +1,13 @@
 import picomatch from "picomatch";
 import { z } from "zod";
 
-import { SecretApprovalRequestsSchema, SecretsSchema, SecretType, ServiceTokenScopes } from "@app/db/schemas";
+import {
+  SecretApprovalRequestsSchema,
+  SecretsSchema,
+  SecretTagsSchema,
+  SecretType,
+  ServiceTokenScopes
+} from "@app/db/schemas";
 import { EventType, UserAgentType } from "@app/ee/services/audit-log/audit-log-types";
 import { RAW_SECRETS, SECRETS } from "@app/lib/api-docs";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
@@ -17,7 +23,7 @@ import { SecretOperations, SecretProtectionType } from "@app/services/secret/sec
 import { SecretUpdateMode } from "@app/services/secret-v2-bridge/secret-v2-bridge-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
-import { SanitizedTagSchema, secretRawSchema } from "../sanitizedSchemas";
+import { secretRawSchema } from "../sanitizedSchemas";
 
 const SecretReferenceNode = z.object({
   key: z.string(),
@@ -25,14 +31,6 @@ const SecretReferenceNode = z.object({
   environment: z.string(),
   secretPath: z.string()
 });
-
-const convertStringBoolean = (defaultValue: boolean = false) => {
-  return z
-    .enum(["true", "false"])
-    .default(defaultValue ? "true" : "false")
-    .transform((value) => value === "true");
-};
-
 type TSecretReferenceNode = z.infer<typeof SecretReferenceNode> & { children: TSecretReferenceNode[] };
 
 const SecretReferenceNodeTree: z.ZodType<TSecretReferenceNode> = SecretReferenceNode.extend({
@@ -77,9 +75,17 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          secret: SecretsSchema.omit({ secretBlindIndex: true }).extend({
-            tags: SanitizedTagSchema.array()
-          })
+          secret: SecretsSchema.omit({ secretBlindIndex: true }).merge(
+            z.object({
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+            })
+          )
         })
       }
     },
@@ -133,7 +139,13 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.object({
           secret: SecretsSchema.omit({ secretBlindIndex: true }).extend({
-            tags: SanitizedTagSchema.array()
+            tags: SecretTagsSchema.pick({
+              id: true,
+              slug: true,
+              color: true
+            })
+              .extend({ name: z.string() })
+              .array()
           })
         })
       }
@@ -235,10 +247,21 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         workspaceSlug: z.string().trim().optional().describe(RAW_SECRETS.LIST.workspaceSlug),
         environment: z.string().trim().optional().describe(RAW_SECRETS.LIST.environment),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash).describe(RAW_SECRETS.LIST.secretPath),
-        viewSecretValue: convertStringBoolean(true).describe(RAW_SECRETS.LIST.viewSecretValue),
-        expandSecretReferences: convertStringBoolean().describe(RAW_SECRETS.LIST.expand),
-        recursive: convertStringBoolean().describe(RAW_SECRETS.LIST.recursive),
-        include_imports: convertStringBoolean().describe(RAW_SECRETS.LIST.includeImports),
+        expandSecretReferences: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(RAW_SECRETS.LIST.expand),
+        recursive: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(RAW_SECRETS.LIST.recursive),
+        include_imports: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(RAW_SECRETS.LIST.includeImports),
         tagSlugs: z
           .string()
           .describe(RAW_SECRETS.LIST.tagSlugs)
@@ -251,9 +274,15 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           secrets: secretRawSchema
             .extend({
               secretPath: z.string().optional(),
-              secretValueHidden: z.boolean(),
               secretMetadata: ResourceMetadataSchema.optional(),
-              tags: SanitizedTagSchema.array().optional()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
+                .optional()
             })
             .array(),
           imports: z
@@ -264,7 +293,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
               secrets: secretRawSchema
                 .omit({ createdAt: true, updatedAt: true })
                 .extend({
-                  secretValueHidden: z.boolean(),
                   secretMetadata: ResourceMetadataSchema.optional()
                 })
                 .array()
@@ -314,7 +342,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         expandSecretReferences: req.query.expandSecretReferences,
         actorAuthMethod: req.permission.authMethod,
         projectId: workspaceId,
-        viewSecretValue: req.query.viewSecretValue,
         path: secretPath,
         metadataFilter: req.query.metadataFilter,
         includeImports: req.query.include_imports,
@@ -349,46 +376,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           }
         });
       }
-
       return { secrets, imports };
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/raw/id/:secretId",
-    config: {
-      rateLimit: secretsLimit
-    },
-    schema: {
-      params: z.object({
-        secretId: z.string()
-      }),
-      response: {
-        200: z.object({
-          secret: secretRawSchema.extend({
-            secretPath: z.string(),
-            tags: SanitizedTagSchema.array().optional(),
-            secretMetadata: ResourceMetadataSchema.optional()
-          })
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { secretId } = req.params;
-      const secret = await server.services.secret.getSecretByIdRaw({
-        actorId: req.permission.id,
-        actor: req.permission.type,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        secretId
-      });
-
-      return { secret };
-    }
-  });
-
   server.route({
     method: "GET",
     url: "/raw/:secretName",
@@ -412,15 +403,28 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash).describe(RAW_SECRETS.GET.secretPath),
         version: z.coerce.number().optional().describe(RAW_SECRETS.GET.version),
         type: z.nativeEnum(SecretType).default(SecretType.Shared).describe(RAW_SECRETS.GET.type),
-        viewSecretValue: convertStringBoolean(true).describe(RAW_SECRETS.GET.viewSecretValue),
-        expandSecretReferences: convertStringBoolean().describe(RAW_SECRETS.GET.expand),
-        include_imports: convertStringBoolean().describe(RAW_SECRETS.GET.includeImports)
+        expandSecretReferences: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(RAW_SECRETS.GET.expand),
+        include_imports: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
+          .describe(RAW_SECRETS.GET.includeImports)
       }),
       response: {
         200: z.object({
           secret: secretRawSchema.extend({
-            secretValueHidden: z.boolean(),
-            tags: SanitizedTagSchema.array().optional(),
+            tags: SecretTagsSchema.pick({
+              id: true,
+              slug: true,
+              color: true
+            })
+              .extend({ name: z.string() })
+              .array()
+              .optional(),
             secretMetadata: ResourceMetadataSchema.optional()
           })
         })
@@ -452,7 +456,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         expandSecretReferences: req.query.expandSecretReferences,
         environment,
         projectId: workspaceId,
-        viewSecretValue: req.query.viewSecretValue,
         projectSlug: workspaceSlug,
         path: secretPath,
         secretName: req.params.secretName,
@@ -659,9 +662,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secret: secretRawSchema.extend({
-              secretValueHidden: z.boolean()
-            })
+            secret: secretRawSchema
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -757,9 +758,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secret: secretRawSchema.extend({
-              secretValueHidden: z.boolean()
-            })
+            secret: secretRawSchema
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -781,7 +780,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       if (secretOperation.type === SecretProtectionType.Approval) {
         return { approval: secretOperation.approval };
       }
-
       const { secret } = secretOperation;
 
       await server.services.auditLog.createAuditLog({
@@ -844,7 +842,13 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
               workspace: z.string(),
               environment: z.string(),
               secretPath: z.string().optional(),
-              tags: SanitizedTagSchema.array()
+              tags: SecretTagsSchema.pick({
+                id: true,
+                slug: true,
+                color: true
+              })
+                .extend({ name: z.string() })
+                .array()
             })
             .array(),
           imports: z
@@ -940,7 +944,10 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
         type: z.nativeEnum(SecretType).default(SecretType.Shared),
         version: z.coerce.number().optional(),
-        include_imports: convertStringBoolean()
+        include_imports: z
+          .enum(["true", "false"])
+          .default("false")
+          .transform((value) => value === "true")
       }),
       response: {
         200: z.object({
@@ -1211,7 +1218,6 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
           z.object({
             secret: SecretsSchema.omit({ secretBlindIndex: true }).merge(
               z.object({
-                secretValueHidden: z.boolean(),
                 _id: z.string(),
                 workspace: z.string(),
                 environment: z.string()
@@ -1381,12 +1387,13 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secret: SecretsSchema.omit({ secretBlindIndex: true }).extend({
-              _id: z.string(),
-              secretValueHidden: z.boolean(),
-              workspace: z.string(),
-              environment: z.string()
-            })
+            secret: SecretsSchema.omit({ secretBlindIndex: true }).merge(
+              z.object({
+                _id: z.string(),
+                workspace: z.string(),
+                environment: z.string()
+              })
+            )
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -1698,7 +1705,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: SecretsSchema.omit({ secretBlindIndex: true }).extend({ secretValueHidden: z.boolean() }).array()
+            secrets: SecretsSchema.omit({ secretBlindIndex: true }).array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -1813,11 +1820,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: SecretsSchema.omit({ secretBlindIndex: true })
-              .extend({
-                secretValueHidden: z.boolean()
-              })
-              .array()
+            secrets: SecretsSchema.omit({ secretBlindIndex: true }).array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -2079,7 +2082,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: secretRawSchema.extend({ secretValueHidden: z.boolean() }).array()
+            secrets: secretRawSchema.array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])
@@ -2201,11 +2204,7 @@ export const registerSecretRouter = async (server: FastifyZodProvider) => {
       response: {
         200: z.union([
           z.object({
-            secrets: secretRawSchema
-              .extend({
-                secretValueHidden: z.boolean()
-              })
-              .array()
+            secrets: secretRawSchema.array()
           }),
           z.object({ approval: SecretApprovalRequestsSchema }).describe("When secret protection policy is enabled")
         ])

backend/src/services/auth/auth-fns.ts

@@ -45,36 +45,6 @@ export const validateSignUpAuthorization = (token: string, userId: string, valid
   if (decodedToken.userId !== userId) throw new UnauthorizedError();
 };
 
-export const validatePasswordResetAuthorization = (token?: string) => {
-  if (!token) throw new UnauthorizedError();
-
-  const appCfg = getConfig();
-  const [AUTH_TOKEN_TYPE, AUTH_TOKEN_VALUE] = <[string, string]>token?.split(" ", 2) ?? [null, null];
-  if (AUTH_TOKEN_TYPE === null) {
-    throw new UnauthorizedError({ message: "Missing Authorization Header in the request header." });
-  }
-  if (AUTH_TOKEN_TYPE.toLowerCase() !== "bearer") {
-    throw new UnauthorizedError({
-      message: `The provided authentication type '${AUTH_TOKEN_TYPE}' is not supported.`
-    });
-  }
-  if (AUTH_TOKEN_VALUE === null) {
-    throw new UnauthorizedError({
-      message: "Missing Authorization Body in the request header"
-    });
-  }
-
-  const decodedToken = jwt.verify(AUTH_TOKEN_VALUE, appCfg.AUTH_SECRET) as AuthModeProviderSignUpTokenPayload;
-
-  if (decodedToken.authTokenType !== AuthTokenType.SIGNUP_TOKEN) {
-    throw new UnauthorizedError({
-      message: `The provided authentication token type is not supported.`
-    });
-  }
-
-  return decodedToken;
-};
-
 export const enforceUserLockStatus = (isLocked: boolean, temporaryLockDateEnd?: Date | null) => {
   if (isLocked) {
     throw new ForbiddenRequestError({

backend/src/services/auth/auth-password-service.ts

@@ -4,10 +4,7 @@ import jwt from "jsonwebtoken";
 import { SecretEncryptionAlgo, SecretKeyEncoding } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { generateSrpServerKey, srpCheckClientProof } from "@app/lib/crypto";
-import { infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
-import { generateUserSrpKeys } from "@app/lib/crypto/srp";
 import { BadRequestError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
 import { OrgServiceActor } from "@app/lib/types";
 
 import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
@@ -15,13 +12,10 @@ import { TokenType } from "../auth-token/auth-token-types";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TTotpConfigDALFactory } from "../totp/totp-config-dal";
 import { TUserDALFactory } from "../user/user-dal";
-import { UserEncryption } from "../user/user-types";
 import { TAuthDALFactory } from "./auth-dal";
 import {
-  ResetPasswordV2Type,
   TChangePasswordDTO,
   TCreateBackupPrivateKeyDTO,
-  TResetPasswordV2DTO,
   TResetPasswordViaBackupKeyDTO,
   TSetupPasswordViaBackupKeyDTO
 } from "./auth-password-type";
@@ -120,31 +114,26 @@ export const authPaswordServiceFactory = ({
    * Email password reset flow via email. Step 1 send email
    */
   const sendPasswordResetEmail = async (email: string) => {
-    const sendEmail = async () => {
-      const user = await userDAL.findUserByUsername(email);
+    const user = await userDAL.findUserByUsername(email);
+    // ignore as user is not found to avoid an outside entity to identify infisical registered accounts
+    if (!user || (user && !user.isAccepted)) return;
 
-      if (user && user.isAccepted) {
-        const cfg = getConfig();
-        const token = await tokenService.createTokenForUser({
-          type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
-          userId: user.id
-        });
+    const cfg = getConfig();
+    const token = await tokenService.createTokenForUser({
+      type: TokenType.TOKEN_EMAIL_PASSWORD_RESET,
+      userId: user.id
+    });
 
-        await smtpService.sendMail({
-          template: SmtpTemplates.ResetPassword,
-          recipients: [email],
-          subjectLine: "Infisical password reset",
-          substitutions: {
-            email,
-            token,
-            callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
-          }
-        });
+    await smtpService.sendMail({
+      template: SmtpTemplates.ResetPassword,
+      recipients: [email],
+      subjectLine: "Infisical password reset",
+      substitutions: {
+        email,
+        token,
+        callback_url: cfg.SITE_URL ? `${cfg.SITE_URL}/password-reset` : ""
       }
-    };
-
-    // note(daniel): run in background to prevent timing attacks
-    void sendEmail().catch((err) => logger.error(err, "Failed to send password reset email"));
+    });
   };
 
   /*
@@ -153,11 +142,6 @@ export const authPaswordServiceFactory = ({
   const verifyPasswordResetEmail = async (email: string, code: string) => {
     const cfg = getConfig();
     const user = await userDAL.findUserByUsername(email);
-
-    const userEnc = await userDAL.findUserEncKeyByUserId(user.id);
-
-    if (!userEnc) throw new BadRequestError({ message: "Failed to find user encryption data" });
-
     // ignore as user is not found to avoid an outside entity to identify infisical registered accounts
     if (!user || (user && !user.isAccepted)) {
       throw new Error("Failed email verification for pass reset");
@@ -178,91 +162,8 @@ export const authPaswordServiceFactory = ({
       { expiresIn: cfg.JWT_SIGNUP_LIFETIME }
     );
 
-    return { token, user, userEncryptionVersion: userEnc.encryptionVersion as UserEncryption };
+    return { token, user };
   };
-
-  const resetPasswordV2 = async ({ userId, newPassword, type, oldPassword }: TResetPasswordV2DTO) => {
-    const cfg = getConfig();
-
-    const user = await userDAL.findUserEncKeyByUserId(userId);
-    if (!user) {
-      throw new BadRequestError({ message: `User encryption key not found for user with ID '${userId}'` });
-    }
-
-    if (!user.hashedPassword) {
-      throw new BadRequestError({ message: "Unable to reset password, no password is set" });
-    }
-
-    if (!user.authMethods?.includes(AuthMethod.EMAIL)) {
-      throw new BadRequestError({ message: "Unable to reset password, no email authentication method is configured" });
-    }
-
-    // we check the old password if the user is resetting their password while logged in
-    if (type === ResetPasswordV2Type.LoggedInReset) {
-      if (!oldPassword) {
-        throw new BadRequestError({ message: "Current password is required." });
-      }
-
-      const isValid = await bcrypt.compare(oldPassword, user.hashedPassword);
-      if (!isValid) {
-        throw new BadRequestError({ message: "Incorrect current password." });
-      }
-    }
-
-    const newHashedPassword = await bcrypt.hash(newPassword, cfg.BCRYPT_SALT_ROUND);
-
-    // we need to get the original private key first for v2
-    let privateKey: string;
-    if (
-      user.serverEncryptedPrivateKey &&
-      user.serverEncryptedPrivateKeyTag &&
-      user.serverEncryptedPrivateKeyIV &&
-      user.serverEncryptedPrivateKeyEncoding &&
-      user.encryptionVersion === UserEncryption.V2
-    ) {
-      privateKey = infisicalSymmetricDecrypt({
-        iv: user.serverEncryptedPrivateKeyIV,
-        tag: user.serverEncryptedPrivateKeyTag,
-        ciphertext: user.serverEncryptedPrivateKey,
-        keyEncoding: user.serverEncryptedPrivateKeyEncoding as SecretKeyEncoding
-      });
-    } else {
-      throw new BadRequestError({
-        message: "Cannot reset password without current credentials or recovery method",
-        name: "Reset password"
-      });
-    }
-
-    const encKeys = await generateUserSrpKeys(user.username, newPassword, {
-      publicKey: user.publicKey,
-      privateKey
-    });
-
-    const { tag, iv, ciphertext, encoding } = infisicalSymmetricEncypt(privateKey);
-
-    await userDAL.updateUserEncryptionByUserId(userId, {
-      hashedPassword: newHashedPassword,
-
-      // srp params
-      salt: encKeys.salt,
-      verifier: encKeys.verifier,
-
-      protectedKey: encKeys.protectedKey,
-      protectedKeyIV: encKeys.protectedKeyIV,
-      protectedKeyTag: encKeys.protectedKeyTag,
-      encryptedPrivateKey: encKeys.encryptedPrivateKey,
-      iv: encKeys.encryptedPrivateKeyIV,
-      tag: encKeys.encryptedPrivateKeyTag,
-
-      serverEncryptedPrivateKey: ciphertext,
-      serverEncryptedPrivateKeyIV: iv,
-      serverEncryptedPrivateKeyTag: tag,
-      serverEncryptedPrivateKeyEncoding: encoding
-    });
-
-    await tokenService.revokeAllMySessions(userId);
-  };
-
   /*
    * Reset password of a user via backup key
    * */
@@ -490,7 +391,6 @@ export const authPaswordServiceFactory = ({
     createBackupPrivateKey,
     getBackupPrivateKeyOfUser,
     sendPasswordSetupEmail,
-    setupPassword,
-    resetPasswordV2
+    setupPassword
   };
 };

backend/src/services/auth/auth-password-type.ts

@@ -13,18 +13,6 @@ export type TChangePasswordDTO = {
   password: string;
 };
 
-export enum ResetPasswordV2Type {
-  Recovery = "recovery",
-  LoggedInReset = "logged-in-reset"
-}
-
-export type TResetPasswordV2DTO = {
-  type: ResetPasswordV2Type;
-  userId: string;
-  newPassword: string;
-  oldPassword?: string;
-};
-
 export type TResetPasswordViaBackupKeyDTO = {
   userId: string;
   protectedKey: string;

backend/src/services/external-migration/external-migration-fns.ts

@@ -31,9 +31,9 @@ export type TImportDataIntoInfisicalDTO = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findLastEnvPosition" | "create" | "findOne">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 
-  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "find">;
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create" | "find">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
 
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany">;
@@ -772,10 +772,6 @@ export const importDataIntoInfisicalFn = async ({
             secretVersionDAL,
             secretTagDAL,
             secretVersionTagDAL,
-            actor: {
-              type: actor,
-              actorId
-            },
             tx
           });
         }

backend/src/services/external-migration/external-migration-queue.ts

@@ -27,9 +27,9 @@ export type TExternalMigrationQueueFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "find" | "findLastEnvPosition" | "create" | "findOne">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 
-  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "find">;
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "findBySecretKeys">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "create">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create" | "find">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "create">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany" | "create">;
 
   folderDAL: Pick<TSecretFolderDALFactory, "create" | "findBySecretPath" | "findOne" | "findById">;

backend/src/services/group-project/group-project-service.ts

@@ -4,7 +4,7 @@ import ms from "ms";
 import { ActionProjectType, ProjectMembershipRole, SecretKeyEncoding, TGroups } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto";
 import { infisicalSymmetricDecrypt } from "@app/lib/crypto/encryption";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
@@ -102,13 +102,11 @@ export const groupProjectServiceFactory = ({
         project.id
       );
 
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to assign group to a more privileged role",
-          details: { missingPermissions: permissionBoundary.missingPermissions }
-        });
+      const hasRequiredPrivileges = isAtLeastAsPrivileged(permission, rolePermission);
+
+      if (!hasRequiredPrivileges) {
+        throw new ForbiddenRequestError({ message: "Failed to assign group to a more privileged role" });
+      }
     }
 
     // validate custom roles input
@@ -269,13 +267,12 @@ export const groupProjectServiceFactory = ({
         requestedRoleChange,
         project.id
       );
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to assign group to a more privileged role",
-          details: { missingPermissions: permissionBoundary.missingPermissions }
-        });
+
+      const hasRequiredPrivileges = isAtLeastAsPrivileged(permission, rolePermission);
+
+      if (!hasRequiredPrivileges) {
+        throw new ForbiddenRequestError({ message: "Failed to assign group to a more privileged role" });
+      }
     }
 
     // validate custom roles input

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -7,7 +7,7 @@ import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -339,12 +339,9 @@ export const identityAwsAuthServiceFactory = ({
       actorOrgId
     );
 
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke aws auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke aws auth of identity with more privileged role"
       });
 
     const revokedIdentityAwsAuth = await identityAwsAuthDAL.transaction(async (tx) => {

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -5,7 +5,7 @@ import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -312,12 +312,9 @@ export const identityAzureAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke azure auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke azure auth of identity with more privileged role"
       });
 
     const revokedIdentityAzureAuth = await identityAzureAuthDAL.transaction(async (tx) => {

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -5,7 +5,7 @@ import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -358,12 +358,9 @@ export const identityGcpAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke gcp auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke gcp auth of identity with more privileged role"
       });
 
     const revokedIdentityGcpAuth = await identityGcpAuthDAL.transaction(async (tx) => {

backend/src/services/identity-jwt-auth/identity-jwt-auth-service.ts

@@ -7,7 +7,7 @@ import { IdentityAuthMethod, TIdentityJwtAuthsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -78,22 +78,14 @@ export const identityJwtAuthServiceFactory = ({
     let tokenData: Record<string, string | boolean | number> = {};
 
     if (identityJwtAuth.configurationType === JwtConfigurationType.JWKS) {
-      let client: JwksClient;
-      if (identityJwtAuth.jwksUrl.includes("https:")) {
-        const decryptedJwksCaCert = orgDataKeyDecryptor({
-          cipherTextBlob: identityJwtAuth.encryptedJwksCaCert
-        }).toString();
-
-        const requestAgent = new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: !!decryptedJwksCaCert });
-        client = new JwksClient({
-          jwksUri: identityJwtAuth.jwksUrl,
-          requestAgent
-        });
-      } else {
-        client = new JwksClient({
-          jwksUri: identityJwtAuth.jwksUrl
-        });
-      }
+      const decryptedJwksCaCert = orgDataKeyDecryptor({
+        cipherTextBlob: identityJwtAuth.encryptedJwksCaCert
+      }).toString();
+      const requestAgent = new https.Agent({ ca: decryptedJwksCaCert, rejectUnauthorized: !!decryptedJwksCaCert });
+      const client = new JwksClient({
+        jwksUri: identityJwtAuth.jwksUrl,
+        requestAgent
+      });
 
       const { kid } = decodedToken.header;
       const jwtSigningKey = await client.getSigningKey(kid);
@@ -516,13 +508,11 @@ export const identityJwtAuthServiceFactory = ({
       actorOrgId
     );
 
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke jwt auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke JWT auth of identity with more privileged role"
       });
+    }
 
     const revokedIdentityJwtAuth = await identityJwtAuthDAL.transaction(async (tx) => {
       const deletedJwtAuth = await identityJwtAuthDAL.delete({ identityId }, tx);

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -7,7 +7,7 @@ import { IdentityAuthMethod, TIdentityKubernetesAuthsUpdate } from "@app/db/sche
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -487,12 +487,9 @@ export const identityKubernetesAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke kubernetes auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke kubernetes auth of identity with more privileged role"
       });
 
     const revokedIdentityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => {

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -8,7 +8,7 @@ import { IdentityAuthMethod, TIdentityOidcAuthsUpdate } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -428,13 +428,11 @@ export const identityOidcAuthServiceFactory = ({
       actorOrgId
     );
 
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke oidc auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke OIDC auth of identity with more privileged role"
       });
+    }
 
     const revokedIdentityOidcAuth = await identityOidcAuthDAL.transaction(async (tx) => {
       const deletedOidcAuth = await identityOidcAuthDAL.delete({ identityId }, tx);

backend/src/services/identity-project/identity-project-service.ts

@@ -4,7 +4,7 @@ import ms from "ms";
 import { ActionProjectType, ProjectMembershipRole } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 
@@ -91,13 +91,11 @@ export const identityProjectServiceFactory = ({
         projectId
       );
 
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to assign to a more privileged role",
-          details: { missingPermissions: permissionBoundary.missingPermissions }
-        });
+      const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
+
+      if (!hasRequiredPriviledges) {
+        throw new ForbiddenRequestError({ message: "Failed to change to a more privileged role" });
+      }
     }
 
     // validate custom roles input
@@ -187,13 +185,9 @@ export const identityProjectServiceFactory = ({
         projectId
       );
 
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to change to a more privileged role",
-          details: { missingPermissions: permissionBoundary.missingPermissions }
-        });
+      if (!isAtLeastAsPrivileged(permission, rolePermission)) {
+        throw new ForbiddenRequestError({ message: "Failed to change to a more privileged role" });
+      }
     }
 
     // validate custom roles input
@@ -283,13 +277,8 @@ export const identityProjectServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.Any
     });
-    const permissionBoundary = validatePermissionBoundary(permission, identityRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to remove more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    if (!isAtLeastAsPrivileged(permission, identityRolePermission))
+      throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
 
     const [deletedIdentity] = await identityProjectDAL.delete({ identityId, projectId });
     return deletedIdentity;

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -5,7 +5,7 @@ import { IdentityAuthMethod, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
@@ -245,13 +245,11 @@ export const identityTokenAuthServiceFactory = ({
       actorOrgId
     );
 
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission)) {
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke token auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke Token Auth of identity with more privileged role"
       });
+    }
 
     const revokedIdentityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => {
       const deletedTokenAuth = await identityTokenAuthDAL.delete({ identityId }, tx);
@@ -297,12 +295,10 @@ export const identityTokenAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasPriviledge)
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to create token for identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to create token for identity with more privileged role"
       });
 
     const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
@@ -419,12 +415,10 @@ export const identityTokenAuthServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasPriviledge)
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update token for identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to update token for identity with more privileged role"
       });
 
     const [token] = await identityAccessTokenDAL.update(

backend/src/services/identity-ua/identity-ua-service.ts

@@ -8,7 +8,7 @@ import { IdentityAuthMethod } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
@@ -367,12 +367,9 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke universal auth of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke universal auth of identity with more privileged role"
       });
 
     const revokedIdentityUniversalAuth = await identityUaDAL.transaction(async (tx) => {
@@ -417,12 +414,10 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasPriviledge)
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to create client secret for a more privileged identity.",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to add identity to project with more privileged role"
       });
 
     const appCfg = getConfig();
@@ -480,12 +475,9 @@ export const identityUaServiceFactory = ({
       actorOrgId
     );
 
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to get identity client secret with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to add identity to project with more privileged role"
       });
 
     const identityUniversalAuth = await identityUaDAL.findOne({
@@ -532,12 +524,9 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to read identity client secret of identity with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to read identity client secret of project with more privileged role"
       });
 
     const clientSecret = await identityUaClientSecretDAL.findById(clientSecretId);
@@ -577,12 +566,10 @@ export const identityUaServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
+
+    if (!isAtLeastAsPrivileged(permission, rolePermission))
       throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to revoke identity client secret with more privileged role",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
+        message: "Failed to revoke identity client secret with more privileged role"
       });
 
     const clientSecret = await identityUaClientSecretDAL.updateById(clientSecretId, {

backend/src/services/identity/identity-service.ts

@@ -4,7 +4,7 @@ import { OrgMembershipRole, TableName, TOrgRoles } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 
@@ -58,13 +58,9 @@ export const identityServiceFactory = ({
       orgId
     );
     const isCustomRole = Boolean(customRole);
-    const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to create a more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" });
 
     const plan = await licenseService.getPlan(orgId);
 
@@ -133,13 +129,9 @@ export const identityServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, identityRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to update a more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
 
     let customRole: TOrgRoles | undefined;
     if (role) {
@@ -149,13 +141,9 @@ export const identityServiceFactory = ({
       );
 
       const isCustomRole = Boolean(customOrgRole);
-      const appliedRolePermissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!appliedRolePermissionBoundary.isValid)
-        throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: "Failed to create a more privileged identity",
-          details: { missingPermissions: appliedRolePermissionBoundary.missingPermissions }
-        });
+      const hasRequiredNewRolePermission = isAtLeastAsPrivileged(permission, rolePermission);
+      if (!hasRequiredNewRolePermission)
+        throw new ForbiddenRequestError({ message: "Failed to create a more privileged identity" });
       if (isCustomRole) customRole = customOrgRole;
     }
 
@@ -228,13 +216,9 @@ export const identityServiceFactory = ({
       actorAuthMethod,
       actorOrgId
     );
-    const permissionBoundary = validatePermissionBoundary(permission, identityRolePermission);
-    if (!permissionBoundary.isValid)
-      throw new ForbiddenRequestError({
-        name: "PermissionBoundaryError",
-        message: "Failed to delete more privileged identity",
-        details: { missingPermissions: permissionBoundary.missingPermissions }
-      });
+    const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, identityRolePermission);
+    if (!hasRequiredPriviledges)
+      throw new ForbiddenRequestError({ message: "Failed to delete more privileged identity" });
 
     const deletedIdentity = await identityDAL.deleteById(id);
 

backend/src/services/integration-auth/integration-auth-service.ts

@@ -114,27 +114,20 @@ export const integrationAuthServiceFactory = ({
   const listOrgIntegrationAuth = async ({ actorId, actor, actorOrgId, actorAuthMethod }: TGenericPermission) => {
     const authorizations = await integrationAuthDAL.getByOrg(actorOrgId as string);
 
-    const filteredAuthorizations = await Promise.all(
-      authorizations.map(async (auth) => {
-        try {
-          const { permission } = await permissionService.getProjectPermission({
-            actor,
-            actorId,
-            projectId: auth.projectId,
-            actorAuthMethod,
-            actorOrgId,
-            actionProjectType: ActionProjectType.SecretManager
-          });
+    return Promise.all(
+      authorizations.filter(async (auth) => {
+        const { permission } = await permissionService.getProjectPermission({
+          actor,
+          actorId,
+          projectId: auth.projectId,
+          actorAuthMethod,
+          actorOrgId,
+          actionProjectType: ActionProjectType.SecretManager
+        });
 
-          return permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations) ? auth : null;
-        } catch (error) {
-          // user does not belong to the project that the integration auth belongs to
-          return null;
-        }
+        return permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.Integrations);
       })
     );
-
-    return filteredAuthorizations.filter((auth): auth is NonNullable<typeof auth> => auth !== null);
   };
 
   const getIntegrationAuth = async ({ actor, id, actorId, actorAuthMethod, actorOrgId }: TGetIntegrationAuthDTO) => {

backend/src/services/integration-auth/integration-delete-secret.ts

@@ -68,8 +68,7 @@ const getIntegrationSecretsV2 = async (
     secretDAL: secretV2BridgeDAL,
     secretImportDAL,
     secretImports,
-    hasSecretAccess: () => true,
-    viewSecretValue: true
+    hasSecretAccess: () => true
   });
 
   for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {

backend/src/services/integration/integration-service.ts

@@ -1,13 +1,8 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { throwIfMissingSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { NotFoundError } from "@app/lib/errors";
 import { TProjectPermission } from "@app/lib/types";
 
@@ -96,10 +91,13 @@ export const integrationServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Create, ProjectPermissionSub.Integrations);
 
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-      environment: sourceEnvironment,
-      secretPath
-    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath
+      })
+    );
 
     const folder = await folderDAL.findBySecretPath(integrationAuth.projectId, sourceEnvironment, secretPath);
     if (!folder) {
@@ -176,10 +174,13 @@ export const integrationServiceFactory = ({
     const newSecretPath = secretPath || integration.secretPath;
 
     if (environment || secretPath) {
-      throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-        environment: newEnvironment,
-        secretPath: newSecretPath
-      });
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: newEnvironment,
+          secretPath: newSecretPath
+        })
+      );
     }
 
     const folder = await folderDAL.findBySecretPath(integration.projectId, newEnvironment, newSecretPath);

backend/src/services/project-membership/project-membership-service.ts

@@ -7,7 +7,7 @@ import { TLicenseServiceFactory } from "@app/ee/services/license/license-service
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
-import { validatePermissionBoundary } from "@app/lib/casl/boundary";
+import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
@@ -274,13 +274,13 @@ export const projectMembershipServiceFactory = ({
         projectId
       );
 
-      const permissionBoundary = validatePermissionBoundary(permission, rolePermission);
-      if (!permissionBoundary.isValid)
+      const hasRequiredPriviledges = isAtLeastAsPrivileged(permission, rolePermission);
+
+      if (!hasRequiredPriviledges) {
         throw new ForbiddenRequestError({
-          name: "PermissionBoundaryError",
-          message: `Failed to change to a more privileged role ${requestedRoleChange}`,
-          details: { missingPermissions: permissionBoundary.missingPermissions }
+          message: `Failed to change to a more privileged role ${requestedRoleChange}`
         });
+      }
     }
 
     // validate custom roles input

backend/src/services/project/project-service.ts

@@ -10,13 +10,8 @@ import {
 } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { throwIfMissingSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { InfisicalProjectTemplate } from "@app/ee/services/project-template/project-template-types";
 import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
@@ -568,24 +563,11 @@ export const projectServiceFactory = ({
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Edit, ProjectPermissionSub.Settings);
 
-    if (update.slug) {
-      const existingProject = await projectDAL.findOne({
-        slug: update.slug,
-        orgId: actorOrgId
-      });
-      if (existingProject && existingProject.id !== project.id) {
-        throw new BadRequestError({
-          message: `Failed to update project slug. The project "${existingProject.name}" with the slug "${existingProject.slug}" already exists in your organization. Please choose a unique slug for your project.`
-        });
-      }
-    }
-
     const updatedProject = await projectDAL.updateById(project.id, {
       name: update.name,
       description: update.description,
       autoCapitalization: update.autoCapitalization,
-      enforceCapitalization: update.autoCapitalization,
-      slug: update.slug
+      enforceCapitalization: update.autoCapitalization
     });
 
     return updatedProject;
@@ -765,7 +747,7 @@ export const projectServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.Any
     });
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret);
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.Secrets);
 
     const project = await projectDAL.findProjectById(projectId);
 

backend/src/services/project/project-types.ts

@@ -82,7 +82,6 @@ export type TUpdateProjectDTO = {
     name?: string;
     description?: string;
     autoCapitalization?: boolean;
-    slug?: string;
   };
 } & Omit<TProjectPermission, "projectId">;
 

backend/src/services/secret-folder/secret-folder-fns.ts

@@ -1,17 +0,0 @@
-import { TSecretFolders } from "@app/db/schemas";
-import { InternalServerError } from "@app/lib/errors";
-
-export const buildFolderPath = (
-  folder: TSecretFolders,
-  foldersMap: Record<string, TSecretFolders>,
-  depth: number = 0
-): string => {
-  if (depth > 20) {
-    throw new InternalServerError({ message: "Maximum folder depth of 20 exceeded" });
-  }
-  if (!folder.parentId) {
-    return depth === 0 ? "/" : "";
-  }
-
-  return `${buildFolderPath(foldersMap[folder.parentId], foldersMap, depth + 1)}/${folder.name}`;
-};

backend/src/services/secret-folder/secret-folder-service.ts

@@ -8,7 +8,6 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services
 import { TSecretSnapshotServiceFactory } from "@app/ee/services/secret-snapshot/secret-snapshot-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrderByDirection, OrgServiceActor } from "@app/lib/types";
-import { buildFolderPath } from "@app/services/secret-folder/secret-folder-fns";
 
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
@@ -28,7 +27,7 @@ type TSecretFolderServiceFactoryDep = {
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   folderDAL: TSecretFolderDALFactory;
-  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs" | "find">;
+  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne" | "findBySlugs">;
   folderVersionDAL: TSecretFolderVersionDALFactory;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug">;
 };
@@ -581,44 +580,6 @@ export const secretFolderServiceFactory = ({
     return folders;
   };
 
-  const getProjectEnvironmentsFolders = async (projectId: string, actor: OrgServiceActor) => {
-    // folder list is allowed to be read by anyone
-    // permission is to check if user has access
-    await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorId: actor.id,
-      projectId,
-      actorAuthMethod: actor.authMethod,
-      actorOrgId: actor.orgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-
-    const environments = await projectEnvDAL.find({ projectId });
-
-    const folders = await folderDAL.find({
-      $in: {
-        envId: environments.map((env) => env.id)
-      },
-      isReserved: false
-    });
-
-    const environmentFolders = Object.fromEntries(
-      environments.map((env) => {
-        const relevantFolders = folders.filter((folder) => folder.envId === env.id);
-        const foldersMap = Object.fromEntries(relevantFolders.map((folder) => [folder.id, folder]));
-
-        const foldersWithPath = relevantFolders.map((folder) => ({
-          ...folder,
-          path: buildFolderPath(folder, foldersMap)
-        }));
-
-        return [env.slug, { ...env, folders: foldersWithPath }];
-      })
-    );
-
-    return environmentFolders;
-  };
-
   return {
     createFolder,
     updateFolder,
@@ -628,7 +589,6 @@ export const secretFolderServiceFactory = ({
     getFolderById,
     getProjectFolderCount,
     getFoldersMultiEnv,
-    getFoldersDeepByEnvs,
-    getProjectEnvironmentsFolders
+    getFoldersDeepByEnvs
   };
 };

backend/src/services/secret-import/secret-import-fns.ts

@@ -3,7 +3,6 @@ import { groupBy, unique } from "@app/lib/fn";
 
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
 import { TSecretDALFactory } from "../secret/secret-dal";
-import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretV2BridgeDALFactory } from "../secret-v2-bridge/secret-v2-bridge-dal";
 import { TSecretImportDALFactory } from "./secret-import-dal";
@@ -33,12 +32,6 @@ type TSecretImportSecretsV2 = {
   folderId: string | undefined;
   importFolderId: string;
   secrets: (TSecretsV2 & {
-    secretTags: {
-      slug: string;
-      name: string;
-      color?: string | null;
-      id: string;
-    }[];
     workspace: string;
     environment: string;
     _id: string;
@@ -46,7 +39,6 @@ type TSecretImportSecretsV2 = {
     // akhilmhdh: yes i know you can put ?.
     // But for somereason ts consider ? and undefined explicit as different just ts things
     secretValue: string;
-    secretValueHidden: boolean;
     secretComment: string;
     secretMetadata?: ResourceMetadataDTO;
   })[];
@@ -158,14 +150,12 @@ export const fnSecretsV2FromImports = async ({
   secretImportDAL,
   decryptor,
   expandSecretReferences,
-  hasSecretAccess,
-  viewSecretValue
+  hasSecretAccess
 }: {
   secretImports: (Omit<TSecretImports, "importEnv"> & {
     importEnv: { id: string; slug: string; name: string };
   })[];
   folderDAL: Pick<TSecretFolderDALFactory, "findByManySecretPath">;
-  viewSecretValue: boolean;
   secretDAL: Pick<TSecretV2BridgeDALFactory, "find">;
   secretImportDAL: Pick<TSecretImportDALFactory, "findByFolderIds">;
   decryptor: (value?: Buffer | null) => string;
@@ -178,14 +168,9 @@ export const fnSecretsV2FromImports = async ({
   hasSecretAccess: (environment: string, secretPath: string, secretName: string, secretTagSlugs: string[]) => boolean;
 }) => {
   const cyclicDetector = new Set();
-  const stack: {
-    secretImports: typeof rootSecretImports;
-    depth: number;
-    parentImportedSecrets: (TSecretsV2 & {
-      secretValueHidden: boolean;
-      secretTags: { slug: string; name: string; id: string; color?: string | null }[];
-    })[];
-  }[] = [{ secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }];
+  const stack: { secretImports: typeof rootSecretImports; depth: number; parentImportedSecrets: TSecretsV2[] }[] = [
+    { secretImports: rootSecretImports, depth: 0, parentImportedSecrets: [] }
+  ];
 
   const processedImports: TSecretImportSecretsV2[] = [];
 
@@ -244,9 +229,7 @@ export const fnSecretsV2FromImports = async ({
         .map((item) => ({
           ...item,
           secretKey: item.key,
-          secretValue: viewSecretValue ? decryptor(item.encryptedValue) : INFISICAL_SECRET_VALUE_HIDDEN_MASK,
-          secretValueHidden: !viewSecretValue,
-          secretTags: item.tags,
+          secretValue: decryptor(item.encryptedValue),
           secretComment: decryptor(item.encryptedComment),
           environment: importEnv.slug,
           workspace: "", // This field should not be used, it's only here to keep the older Python SDK versions backwards compatible with the new Postgres backend.
@@ -284,8 +267,6 @@ export const fnSecretsV2FromImports = async ({
         processedImport.secrets = unique(processedImport.secrets, (i) => i.key);
         return Promise.allSettled(
           processedImport.secrets.map(async (decryptedSecret, index) => {
-            if (decryptedSecret.secretValueHidden) return;
-
             const expandedSecretValue = await expandSecretReferences({
               value: decryptedSecret.secretValue,
               secretPath: processedImport.secretPath,

backend/src/services/secret-import/secret-import-service.ts

@@ -4,16 +4,8 @@ import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType, TableName } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import {
-  hasSecretReadValueOrDescribePermission,
-  throwIfMissingSecretReadValueOrDescribePermission
-} from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getReplicationFolderName } from "@app/ee/services/secret-replication/secret-replication-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -97,11 +89,13 @@ export const secretImportServiceFactory = ({
     );
 
     // check if user has permission to import from target path
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret, {
-      environment: data.environment,
-      secretPath: data.path
-    });
-
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: data.environment,
+        secretPath: data.path
+      })
+    );
     if (isReplication) {
       const plan = await licenseService.getPlan(actorOrgId);
       if (!plan.secretApproval) {
@@ -407,10 +401,13 @@ export const secretImportServiceFactory = ({
     if (!secretImportDoc.isReplication) throw new BadRequestError({ message: "Import is not in replication mode" });
 
     // check if user has permission to import from target path
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.DescribeSecret, {
-      environment: secretImportDoc.importEnv.slug,
-      secretPath: secretImportDoc.importPath
-    });
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: secretImportDoc.importEnv.slug,
+        secretPath: secretImportDoc.importPath
+      })
+    );
 
     await projectDAL.checkProjectUpgradeStatus(projectId);
 
@@ -598,12 +595,14 @@ export const secretImportServiceFactory = ({
     // so anything based on this order will also be in right position
     const secretImports = await secretImportDAL.find({ folderId: folder.id, isReplication: false });
     const allowedImports = secretImports.filter((el) =>
-      hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-        environment: el.importEnv.slug,
-        secretPath: el.importPath
-      })
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: el.importEnv.slug,
+          secretPath: el.importPath
+        })
+      )
     );
-
     return fnSecretsFromImports({ allowedImports, folderDAL, secretDAL, secretImportDAL });
   };
 
@@ -643,19 +642,20 @@ export const secretImportServiceFactory = ({
       const importedSecrets = await fnSecretsV2FromImports({
         secretImports,
         folderDAL,
-        viewSecretValue: true,
         secretDAL: secretV2BridgeDAL,
         secretImportDAL,
         decryptor: (value) => (value ? secretManagerDecryptor({ cipherTextBlob: value }).toString() : ""),
         hasSecretAccess: (expandEnvironment, expandSecretPath, expandSecretKey, expandSecretTags) =>
-          hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-            environment: expandEnvironment,
-            secretPath: expandSecretPath,
-            secretName: expandSecretKey,
-            secretTags: expandSecretTags
-          })
+          permission.can(
+            ProjectPermissionActions.Read,
+            subject(ProjectPermissionSub.Secrets, {
+              environment: expandEnvironment,
+              secretPath: expandSecretPath,
+              secretName: expandSecretKey,
+              secretTags: expandSecretTags
+            })
+          )
       });
-
       return importedSecrets;
     }
 
@@ -666,10 +666,13 @@ export const secretImportServiceFactory = ({
       });
 
     const allowedImports = secretImports.filter((el) =>
-      hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-        environment: el.importEnv.slug,
-        secretPath: el.importPath
-      })
+      permission.can(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: el.importEnv.slug,
+          secretPath: el.importPath
+        })
+      )
     );
     const importedSecrets = await fnSecretsFromImports({
       allowedImports,
@@ -680,10 +683,7 @@ export const secretImportServiceFactory = ({
     return importedSecrets.map((el) => ({
       ...el,
       secrets: el.secrets.map((encryptedSecret) =>
-        decryptSecretRaw(
-          { ...encryptedSecret, workspace: projectId, environment, secretPath, secretValueHidden: false },
-          botKey
-        )
+        decryptSecretRaw({ ...encryptedSecret, workspace: projectId, environment, secretPath }, botKey)
       )
     }));
   };

backend/src/services/secret-sync/secret-sync-queue.ts

@@ -249,8 +249,7 @@ export const secretSyncQueueFactory = ({
         expandSecretReferences,
         secretImportDAL,
         secretImports,
-        hasSecretAccess: () => true,
-        viewSecretValue: true
+        hasSecretAccess: () => true
       });
 
       for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {

backend/src/services/secret-sync/secret-sync-service.ts

@@ -1,10 +1,9 @@
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 
 import { ActionProjectType } from "@app/db/schemas";
-import { throwIfMissingSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
-  ProjectPermissionSecretActions,
+  ProjectPermissionActions,
   ProjectPermissionSecretSyncActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
@@ -179,10 +178,13 @@ export const secretSyncServiceFactory = ({
       ProjectPermissionSub.SecretSyncs
     );
 
-    throwIfMissingSecretReadValueOrDescribePermission(projectPermission, ProjectPermissionSecretActions.ReadValue, {
-      environment,
-      secretPath
-    });
+    ForbiddenError.from(projectPermission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, {
+        environment,
+        secretPath
+      })
+    );
 
     const folder = await folderDAL.findBySecretPath(projectId, environment, secretPath);
 
@@ -267,10 +269,13 @@ export const secretSyncServiceFactory = ({
       if (!updatedEnvironment || !updatedSecretPath)
         throw new BadRequestError({ message: "Must specify both source environment and secret path" });
 
-      throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-        environment: updatedEnvironment,
-        secretPath: updatedSecretPath
-      });
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, {
+          environment: updatedEnvironment,
+          secretPath: updatedSecretPath
+        })
+      );
 
       const newFolder = await folderDAL.findBySecretPath(secretSync.projectId, updatedEnvironment, updatedSecretPath);
 

backend/src/services/secret-tag/secret-tag-dal.ts

@@ -47,7 +47,6 @@ export const secretTagDALFactory = (db: TDbClient) => {
       throw new DatabaseError({ error, name: "Find all by ids" });
     }
   };
-
   return {
     ...secretTagOrm,
     saveTagsToSecret: secretJnTagOrm.insertMany,

backend/src/services/secret-v2-bridge/secret-v2-bridge-dal.ts

@@ -613,9 +613,6 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
           `${TableName.SecretTag}.id`
         )
-
-        .leftJoin(TableName.SecretFolder, `${TableName.SecretV2}.folderId`, `${TableName.SecretFolder}.id`)
-        .leftJoin(TableName.Environment, `${TableName.SecretFolder}.envId`, `${TableName.Environment}.id`)
         .leftJoin(TableName.ResourceMetadata, `${TableName.SecretV2}.id`, `${TableName.ResourceMetadata}.secretId`)
         .select(selectAllTableCols(TableName.SecretV2))
         .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
@@ -625,13 +622,12 @@ export const secretV2BridgeDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.ResourceMetadata).as("metadataId"),
           db.ref("key").withSchema(TableName.ResourceMetadata).as("metadataKey"),
           db.ref("value").withSchema(TableName.ResourceMetadata).as("metadataValue")
-        )
-        .select(db.ref("projectId").withSchema(TableName.Environment).as("projectId"));
+        );
 
       const docs = sqlNestRelationships({
         data: rawDocs,
         key: "id",
-        parentMapper: (el) => ({ _id: el.id, projectId: el.projectId, ...SecretsV2Schema.parse(el) }),
+        parentMapper: (el) => ({ _id: el.id, ...SecretsV2Schema.parse(el) }),
         childrenMapper: [
           {
             key: "tagId",

backend/src/services/secret-v2-bridge/secret-v2-bridge-fns.ts

@@ -5,10 +5,8 @@ import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 
-import { ActorType } from "../auth/auth-type";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { ResourceMetadataDTO } from "../resource-metadata/resource-metadata-schema";
-import { INFISICAL_SECRET_VALUE_HIDDEN_MASK } from "../secret/secret-fns";
 import { TSecretFolderDALFactory } from "../secret-folder/secret-folder-dal";
 import { TSecretV2BridgeDALFactory } from "./secret-v2-bridge-dal";
 import { TFnSecretBulkDelete, TFnSecretBulkInsert, TFnSecretBulkUpdate } from "./secret-v2-bridge-types";
@@ -64,7 +62,6 @@ export const fnSecretBulkInsert = async ({
   resourceMetadataDAL,
   secretTagDAL,
   secretVersionTagDAL,
-  actor,
   tx
 }: TFnSecretBulkInsert) => {
   const sanitizedInputSecrets = inputSecrets.map(
@@ -93,10 +90,6 @@ export const fnSecretBulkInsert = async ({
     })
   );
 
-  const userActorId = actor && actor.type === ActorType.USER ? actor.actorId : undefined;
-  const identityActorId = actor && actor.type !== ActorType.USER ? actor.actorId : undefined;
-  const actorType = actor?.type || ActorType.PLATFORM;
-
   const newSecrets = await secretDAL.insertMany(
     sanitizedInputSecrets.map((el) => ({ ...el, folderId })),
     tx
@@ -109,14 +102,10 @@ export const fnSecretBulkInsert = async ({
       [`${TableName.SecretV2}Id` as const]: newSecretGroupedByKeyName[key][0].id
     }))
   );
-
   const secretVersions = await secretVersionDAL.insertMany(
     sanitizedInputSecrets.map((el) => ({
       ...el,
       folderId,
-      userActorId,
-      identityActorId,
-      actorType,
       secretId: newSecretGroupedByKeyName[el.key][0].id
     })),
     tx
@@ -148,7 +137,6 @@ export const fnSecretBulkInsert = async ({
   if (newSecretTags.length) {
     const secTags = await secretTagDAL.saveTagsToSecretV2(newSecretTags, tx);
     const secVersionsGroupBySecId = groupBy(secretVersions, (i) => i.secretId);
-
     const newSecretVersionTags = secTags.flatMap(({ secrets_v2Id, secret_tagsId }) => ({
       [`${TableName.SecretVersionV2}Id` as const]: secVersionsGroupBySecId[secrets_v2Id][0].id,
       [`${TableName.SecretTag}Id` as const]: secret_tagsId
@@ -157,16 +145,7 @@ export const fnSecretBulkInsert = async ({
     await secretVersionTagDAL.insertMany(newSecretVersionTags, tx);
   }
 
-  const secretsWithTags = await secretDAL.find(
-    {
-      $in: {
-        [`${TableName.SecretV2}.id` as "id"]: newSecrets.map((s) => s.id)
-      }
-    },
-    { tx }
-  );
-
-  return secretsWithTags.map((secret) => ({ ...secret, _id: secret.id }));
+  return newSecrets.map((secret) => ({ ...secret, _id: secret.id }));
 };
 
 export const fnSecretBulkUpdate = async ({
@@ -178,13 +157,8 @@ export const fnSecretBulkUpdate = async ({
   secretVersionDAL,
   secretTagDAL,
   secretVersionTagDAL,
-  resourceMetadataDAL,
-  actor
+  resourceMetadataDAL
 }: TFnSecretBulkUpdate) => {
-  const userActorId = actor && actor?.type === ActorType.USER ? actor?.actorId : undefined;
-  const identityActorId = actor && actor?.type !== ActorType.USER ? actor?.actorId : undefined;
-  const actorType = actor?.type || ActorType.PLATFORM;
-
   const sanitizedInputSecrets = inputSecrets.map(
     ({
       filter,
@@ -242,10 +216,7 @@ export const fnSecretBulkUpdate = async ({
         encryptedValue,
         reminderRepeatDays,
         folderId,
-        secretId,
-        userActorId,
-        identityActorId,
-        actorType
+        secretId
       })
     ),
     tx
@@ -312,15 +283,7 @@ export const fnSecretBulkUpdate = async ({
     tx
   );
 
-  const secretsWithTags = await secretDAL.find(
-    {
-      $in: {
-        [`${TableName.SecretV2}.id` as "id"]: newSecrets.map((s) => s.id)
-      }
-    },
-    { tx }
-  );
-  return secretsWithTags.map((secret) => ({ ...secret, _id: secret.id }));
+  return newSecrets.map((secret) => ({ ...secret, _id: secret.id }));
 };
 
 export const fnSecretBulkDelete = async ({
@@ -553,7 +516,7 @@ export const expandSecretReferencesFactory = ({
             const referredValue = await fetchSecret(environment, secretPath, secretKey);
             if (!canExpandValue(environment, secretPath, secretKey, referredValue.tags))
               throw new ForbiddenRequestError({
-                message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to read value on.`
+                message: `You are attempting to reference secret named ${secretKey} from environment ${environment} in path ${secretPath} which you do not have access to.`
               });
 
             const cacheKey = getCacheUniqueKey(environment, secretPath);
@@ -572,7 +535,7 @@ export const expandSecretReferencesFactory = ({
             const referedValue = await fetchSecret(secretReferenceEnvironment, secretReferencePath, secretReferenceKey);
             if (!canExpandValue(secretReferenceEnvironment, secretReferencePath, secretReferenceKey, referedValue.tags))
               throw new ForbiddenRequestError({
-                message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to read value on.`
+                message: `You are attempting to reference secret named ${secretReferenceKey} from environment ${secretReferenceEnvironment} in path ${secretReferencePath} which you do not have access to.`
               });
 
             const cacheKey = getCacheUniqueKey(secretReferenceEnvironment, secretReferencePath);
@@ -653,12 +616,6 @@ export const reshapeBridgeSecret = (
   secret: Omit<TSecretsV2, "encryptedValue" | "encryptedComment"> & {
     value: string;
     comment: string;
-    userActorName?: string | null;
-    identityActorName?: string | null;
-    userActorId?: string | null;
-    identityActorId?: string | null;
-    membershipId?: string | null;
-    actorType?: string | null;
     tags?: {
       id: string;
       slug: string;
@@ -666,27 +623,19 @@ export const reshapeBridgeSecret = (
       name: string;
     }[];
     secretMetadata?: ResourceMetadataDTO;
-  },
-  secretValueHidden: boolean
+  }
 ) => ({
   secretKey: secret.key,
   secretPath,
   workspace: workspaceId,
   environment,
+  secretValue: secret.value || "",
   secretComment: secret.comment || "",
   version: secret.version,
   type: secret.type,
   _id: secret.id,
   id: secret.id,
   user: secret.userId,
-  actor: secret.actorType
-    ? {
-        actorType: secret.actorType,
-        actorId: secret.userActorId || secret.identityActorId,
-        name: secret.identityActorName || secret.userActorName,
-        membershipId: secret.membershipId
-      }
-    : undefined,
   tags: secret.tags,
   skipMultilineEncoding: secret.skipMultilineEncoding,
   secretReminderRepeatDays: secret.reminderRepeatDays,
@@ -694,15 +643,5 @@ export const reshapeBridgeSecret = (
   metadata: secret.metadata,
   secretMetadata: secret.secretMetadata,
   createdAt: secret.createdAt,
-  updatedAt: secret.updatedAt,
-
-  ...(secretValueHidden
-    ? {
-        secretValue: INFISICAL_SECRET_VALUE_HIDDEN_MASK,
-        secretValueHidden: true
-      }
-    : {
-        secretValue: secret.value || "",
-        secretValueHidden: false
-      })
+  updatedAt: secret.updatedAt
 });

backend/src/services/secret-v2-bridge/secret-v2-bridge-types.ts

@@ -1,7 +1,6 @@
 import { Knex } from "knex";
 
 import { SecretType, TSecretsV2, TSecretsV2Insert, TSecretsV2Update } from "@app/db/schemas";
-import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
 import { OrderByDirection, TProjectPermission } from "@app/lib/types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { SecretsOrderBy } from "@app/services/secret/secret-types";
@@ -37,8 +36,6 @@ export type TGetSecretsDTO = {
   includeImports?: boolean;
   recursive?: boolean;
   tagSlugs?: string[];
-  viewSecretValue: boolean;
-  throwOnMissingReadValuePermission?: boolean;
   metadataFilter?: {
     key?: string;
     value?: string;
@@ -51,11 +48,6 @@ export type TGetSecretsDTO = {
   keys?: string[];
 } & TProjectPermission;
 
-export type TGetSecretsMissingReadValuePermissionDTO = Omit<
-  TGetSecretsDTO,
-  "viewSecretValue" | "recursive" | "expandSecretReferences"
->;
-
 export type TGetASecretDTO = {
   secretName: string;
   path: string;
@@ -65,7 +57,6 @@ export type TGetASecretDTO = {
   includeImports?: boolean;
   version?: number;
   projectId: string;
-  viewSecretValue: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TCreateSecretDTO = TProjectPermission & {
@@ -173,14 +164,10 @@ export type TFnSecretBulkInsert = {
     }
   >;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany">;
-  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences" | "find">;
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "insertMany" | "upsertSecretReferences">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "find">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
-  actor?: {
-    type: string;
-    actorId: string;
-  };
 };
 
 type TRequireReferenceIfValue =
@@ -201,14 +188,10 @@ export type TFnSecretBulkUpdate = {
     data: TRequireReferenceIfValue & { tags?: string[]; secretMetadata?: ResourceMetadataDTO };
   }[];
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
-  secretDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "upsertSecretReferences" | "find">;
+  secretDAL: Pick<TSecretV2BridgeDALFactory, "bulkUpdate" | "upsertSecretReferences">;
   secretVersionDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
-  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
+  secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2">;
   secretVersionTagDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
-  actor?: {
-    type: string;
-    actorId: string;
-  };
   tx?: Knex;
 };
 
@@ -349,12 +332,4 @@ export type TGetSecretsRawByFolderMappingsDTO = {
   folderMappings: { folderId: string; path: string; environment: string }[];
   userId: string;
   filters: TFindSecretsByFolderIdsFilter;
-  filterByAction?: ProjectPermissionSecretActions.DescribeSecret | ProjectPermissionSecretActions.ReadValue;
 };
-
-export type TGetAccessibleSecretsDTO = {
-  environment: string;
-  projectId: string;
-  secretPath: string;
-  filterByAction: ProjectPermissionSecretActions.DescribeSecret | ProjectPermissionSecretActions.ReadValue;
-} & TProjectPermission;

backend/src/services/secret-v2-bridge/secret-version-dal.ts

@@ -1,10 +1,9 @@
-/* eslint-disable @typescript-eslint/no-unsafe-assignment */
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { SecretVersionsV2Schema, TableName, TSecretVersionsV2, TSecretVersionsV2Update } from "@app/db/schemas";
+import { TableName, TSecretVersionsV2, TSecretVersionsV2Update } from "@app/db/schemas";
 import { BadRequestError, DatabaseError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships, TFindOpt } from "@app/lib/knex";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
 
@@ -13,58 +12,6 @@ export type TSecretVersionV2DALFactory = ReturnType<typeof secretVersionV2Bridge
 export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
   const secretVersionV2Orm = ormify(db, TableName.SecretVersionV2);
 
-  const findBySecretId = async (secretId: string, { offset, limit, sort, tx }: TFindOpt<TSecretVersionsV2> = {}) => {
-    try {
-      const query = (tx || db.replicaNode())(TableName.SecretVersionV2)
-        .where(`${TableName.SecretVersionV2}.secretId`, secretId)
-        .leftJoin(TableName.SecretV2, `${TableName.SecretVersionV2}.secretId`, `${TableName.SecretV2}.id`)
-        .leftJoin(
-          TableName.SecretV2JnTag,
-          `${TableName.SecretV2}.id`,
-          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
-        )
-        .leftJoin(
-          TableName.SecretTag,
-          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
-          `${TableName.SecretTag}.id`
-        )
-        .select(selectAllTableCols(TableName.SecretVersionV2))
-        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
-        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
-
-      if (limit) void query.limit(limit);
-      if (offset) void query.offset(offset);
-      if (sort) {
-        void query.orderBy(sort.map(([column, order, nulls]) => ({ column: column as string, order, nulls })));
-      }
-
-      const docs = await query;
-
-      const data = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretVersionsV2Schema.parse(el) }),
-        childrenMapper: [
-          {
-            key: "tagId",
-            label: "tags" as const,
-            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
-              id,
-              color,
-              slug,
-              name: slug
-            })
-          }
-        ]
-      });
-
-      return data;
-    } catch (error) {
-      throw new DatabaseError({ error, name: `${TableName.SecretVersionV2}: FindBySecretId` });
-    }
-  };
-
   // This will fetch all latest secret versions from a folder
   const findLatestVersionByFolderId = async (folderId: string, tx?: Knex) => {
     try {
@@ -172,101 +119,11 @@ export const secretVersionV2BridgeDALFactory = (db: TDbClient) => {
     logger.info(`${QueueName.DailyResourceCleanUp}: pruning secret version v2 completed`);
   };
 
-  const findVersionsBySecretIdWithActors = async (
-    secretId: string,
-    projectId: string,
-    { offset, limit, sort = [["createdAt", "desc"]] }: TFindOpt<TSecretVersionsV2> = {},
-    tx?: Knex
-  ) => {
-    try {
-      const query = (tx || db)(TableName.SecretVersionV2)
-        .leftJoin(TableName.Users, `${TableName.Users}.id`, `${TableName.SecretVersionV2}.userActorId`)
-        .leftJoin(
-          TableName.ProjectMembership,
-          `${TableName.ProjectMembership}.userId`,
-          `${TableName.SecretVersionV2}.userActorId`
-        )
-        .leftJoin(TableName.Identity, `${TableName.Identity}.id`, `${TableName.SecretVersionV2}.identityActorId`)
-        .leftJoin(TableName.SecretV2, `${TableName.SecretVersionV2}.secretId`, `${TableName.SecretV2}.id`)
-        .leftJoin(
-          TableName.SecretV2JnTag,
-          `${TableName.SecretV2}.id`,
-          `${TableName.SecretV2JnTag}.${TableName.SecretV2}Id`
-        )
-        .leftJoin(
-          TableName.SecretTag,
-          `${TableName.SecretV2JnTag}.${TableName.SecretTag}Id`,
-          `${TableName.SecretTag}.id`
-        )
-        .where((qb) => {
-          void qb.where(`${TableName.SecretVersionV2}.secretId`, secretId);
-          void qb.where(`${TableName.ProjectMembership}.projectId`, projectId);
-        })
-        .orWhere((qb) => {
-          void qb.where(`${TableName.SecretVersionV2}.secretId`, secretId);
-          void qb.whereNull(`${TableName.ProjectMembership}.projectId`);
-        })
-        .select(
-          selectAllTableCols(TableName.SecretVersionV2),
-          db.ref("username").withSchema(TableName.Users).as("userActorName"),
-          db.ref("name").withSchema(TableName.Identity).as("identityActorName"),
-          db.ref("id").withSchema(TableName.ProjectMembership).as("membershipId"),
-          db.ref("id").withSchema(TableName.SecretTag).as("tagId"),
-          db.ref("color").withSchema(TableName.SecretTag).as("tagColor"),
-          db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug")
-        );
-
-      if (limit) void query.limit(limit);
-      if (offset) void query.offset(offset);
-      if (sort) {
-        void query.orderBy(
-          sort.map(([column, order, nulls]) => ({
-            column: `${TableName.SecretVersionV2}.${column as string}`,
-            order,
-            nulls
-          }))
-        );
-      }
-
-      const docs = await query;
-
-      const data = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (el) => ({
-          _id: el.id,
-          ...SecretVersionsV2Schema.parse(el),
-          userActorName: el.userActorName,
-          identityActorName: el.identityActorName,
-          membershipId: el.membershipId
-        }),
-        childrenMapper: [
-          {
-            key: "tagId",
-            label: "tags" as const,
-            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
-              id,
-              color,
-              slug,
-              name: slug
-            })
-          }
-        ]
-      });
-
-      return data;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindVersionsBySecretIdWithActors" });
-    }
-  };
-
   return {
     ...secretVersionV2Orm,
     pruneExcessVersions,
     findLatestVersionMany,
     bulkUpdate,
-    findLatestVersionByFolderId,
-    findVersionsBySecretIdWithActors,
-    findBySecretId
+    findLatestVersionByFolderId
   };
 };

backend/src/services/secret/secret-dal.ts

@@ -169,48 +169,6 @@ export const secretDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findManySecretsWithTags = async (
-    filter: {
-      secretIds: string[];
-      type: SecretType;
-    },
-    tx?: Knex
-  ) => {
-    try {
-      const secrets = await (tx || db.replicaNode())(TableName.Secret)
-        .whereIn(`${TableName.Secret}.id` as "id", filter.secretIds)
-        .where("type", filter.type)
-        .leftJoin(TableName.JnSecretTag, `${TableName.Secret}.id`, `${TableName.JnSecretTag}.${TableName.Secret}Id`)
-        .leftJoin(TableName.SecretTag, `${TableName.JnSecretTag}.${TableName.SecretTag}Id`, `${TableName.SecretTag}.id`)
-        .select(selectAllTableCols(TableName.Secret))
-        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
-        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
-
-      const data = sqlNestRelationships({
-        data: secrets,
-        key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretsSchema.parse(el) }),
-        childrenMapper: [
-          {
-            key: "tagId",
-            label: "tags" as const,
-            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
-              id,
-              color,
-              slug,
-              name: slug
-            })
-          }
-        ]
-      });
-
-      return data;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "get many secrets with tags" });
-    }
-  };
-
   const findByFolderIds = async (folderIds: string[], userId?: string, tx?: Knex) => {
     try {
       // check if not uui then userId id is null (corner case because service token's ID is not UUI in effort to keep backwards compatibility from mongo)
@@ -485,7 +443,6 @@ export const secretDALFactory = (db: TDbClient) => {
     upsertSecretReferences,
     findReferencedSecretReferences,
     findAllProjectSecretValues,
-    pruneSecretReminders,
-    findManySecretsWithTags
+    pruneSecretReminders
   };
 };

backend/src/services/secret/secret-fns.ts

@@ -1,4 +1,5 @@
 /* eslint-disable no-await-in-loop */
+import { subject } from "@casl/ability";
 import path from "path";
 
 import {
@@ -11,9 +12,8 @@ import {
   TSecretFolders,
   TSecrets
 } from "@app/db/schemas";
-import { hasSecretReadValueOrDescribePermission } from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import {
   buildSecretBlindIndexFromName,
@@ -51,8 +51,6 @@ import {
   TUpdateManySecretsRawFnFactory
 } from "./secret-types";
 
-export const INFISICAL_SECRET_VALUE_HIDDEN_MASK = "<hidden-by-infisical>";
-
 export const generateSecretBlindIndexBySalt = async (secretName: string, secretBlindIndexDoc: TSecretBlindIndexes) => {
   const appCfg = getConfig();
   const secretBlindIndex = await buildSecretBlindIndexFromName({
@@ -191,10 +189,13 @@ export const recursivelyGetSecretPaths = ({
     // Filter out paths that the user does not have permission to access, and paths that are not in the current path
     const allowedPaths = paths.filter(
       (folder) =>
-        hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-          environment,
-          secretPath: folder.path
-        }) && folder.path.startsWith(currentPath === "/" ? "" : currentPath)
+        permission.can(
+          ProjectPermissionActions.Read,
+          subject(ProjectPermissionSub.Secrets, {
+            environment,
+            secretPath: folder.path
+          })
+        ) && folder.path.startsWith(currentPath === "/" ? "" : currentPath)
     );
 
     return allowedPaths;
@@ -343,7 +344,6 @@ export const interpolateSecrets = ({ projectId, secretEncKey, secretDAL, folderD
 
 export const decryptSecretRaw = (
   secret: TSecrets & {
-    secretValueHidden: boolean;
     workspace: string;
     environment: string;
     secretPath: string;
@@ -362,14 +362,12 @@ export const decryptSecretRaw = (
     key
   });
 
-  const secretValue = !secret.secretValueHidden
-    ? decryptSymmetric128BitHexKeyUTF8({
-        ciphertext: secret.secretValueCiphertext,
-        iv: secret.secretValueIV,
-        tag: secret.secretValueTag,
-        key
-      })
-    : INFISICAL_SECRET_VALUE_HIDDEN_MASK;
+  const secretValue = decryptSymmetric128BitHexKeyUTF8({
+    ciphertext: secret.secretValueCiphertext,
+    iv: secret.secretValueIV,
+    tag: secret.secretValueTag,
+    key
+  });
 
   let secretComment = "";
 
@@ -387,7 +385,6 @@ export const decryptSecretRaw = (
     secretPath: secret.secretPath,
     workspace: secret.workspace,
     environment: secret.environment,
-    secretValueHidden: secret.secretValueHidden,
     secretValue,
     secretComment,
     version: secret.version,
@@ -582,7 +579,6 @@ export const fnSecretBulkInsert = async ({
       [`${TableName.Secret}Id` as const]: newSecretGroupByBlindIndex[secretBlindIndex as string][0].id
     }))
   );
-
   const secretVersions = await secretVersionDAL.insertMany(
     sanitizedInputSecrets.map((el) => ({
       ...el,
@@ -1201,23 +1197,3 @@ export const fnDeleteProjectSecretReminders = async (
     }
   }
 };
-
-export const conditionallyHideSecretValue = (
-  shouldHideValue: boolean,
-  {
-    secretValueCiphertext,
-    secretValueIV,
-    secretValueTag
-  }: {
-    secretValueCiphertext: string;
-    secretValueIV: string;
-    secretValueTag: string;
-  }
-) => {
-  return {
-    secretValueCiphertext: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueCiphertext,
-    secretValueIV: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueIV,
-    secretValueTag: shouldHideValue ? INFISICAL_SECRET_VALUE_HIDDEN_MASK : secretValueTag,
-    secretValueHidden: shouldHideValue
-  };
-};

backend/src/services/secret/secret-queue.ts

@@ -61,7 +61,6 @@ import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TWebhookDALFactory } from "../webhook/webhook-dal";
 import { fnTriggerWebhook } from "../webhook/webhook-fns";
-import { WebhookEvents } from "../webhook/webhook-types";
 import { TSecretDALFactory } from "./secret-dal";
 import { interpolateSecrets } from "./secret-fns";
 import {
@@ -403,8 +402,7 @@ export const secretQueueFactory = ({
       expandSecretReferences,
       secretImportDAL,
       secretImports,
-      hasSecretAccess: () => true,
-      viewSecretValue: true
+      hasSecretAccess: () => true
     });
 
     for (let i = importedSecrets.length - 1; i >= 0; i -= 1) {
@@ -625,14 +623,7 @@ export const secretQueueFactory = ({
     await queueService.queue(
       QueueName.SecretWebhook,
       QueueJobs.SecWebhook,
-      {
-        type: WebhookEvents.SecretModified,
-        payload: {
-          environment,
-          projectId,
-          secretPath
-        }
-      },
+      { environment, projectId, secretPath },
       {
         jobId: `secret-webhook-${environment}-${projectId}-${secretPath}`,
         removeOnFail: { count: 5 },
@@ -1064,8 +1055,6 @@ export const secretQueueFactory = ({
 
     const organization = await orgDAL.findOrgByProjectId(projectId);
     const project = await projectDAL.findById(projectId);
-    const secret = await secretV2BridgeDAL.findById(data.secretId);
-    const [folder] = await folderDAL.findSecretPathByFolderIds(project.id, [secret.folderId]);
 
     if (!organization) {
       logger.info(`secretReminderQueue.process: [secretDocument=${data.secretId}] no organization found`);
@@ -1094,19 +1083,6 @@ export const secretQueueFactory = ({
         organizationName: organization.name
       }
     });
-
-    await queueService.queue(QueueName.SecretWebhook, QueueJobs.SecWebhook, {
-      type: WebhookEvents.SecretReminderExpired,
-      payload: {
-        projectName: project.name,
-        projectId: project.id,
-        secretPath: folder?.path,
-        environment: folder?.environmentSlug || "",
-        reminderNote: data.note,
-        secretName: secret?.key,
-        secretId: data.secretId
-      }
-    });
   });
 
   const startSecretV2Migration = async (projectId: string) => {
@@ -1514,17 +1490,14 @@ export const secretQueueFactory = ({
   queueService.start(QueueName.SecretWebhook, async (job) => {
     const { decryptor: secretManagerDecryptor } = await kmsService.createCipherPairWithDataKey({
       type: KmsDataKey.SecretManager,
-      projectId: job.data.payload.projectId
+      projectId: job.data.projectId
     });
 
     await fnTriggerWebhook({
-      projectId: job.data.payload.projectId,
-      environment: job.data.payload.environment,
-      secretPath: job.data.payload.secretPath || "/",
+      ...job.data,
       projectEnvDAL,
-      projectDAL,
       webhookDAL,
-      event: job.data,
+      projectDAL,
       secretManagerDecryptor: (value) => secretManagerDecryptor({ cipherTextBlob: value }).toString()
     });
   });

backend/src/services/secret/secret-service.ts

@@ -6,23 +6,14 @@ import {
   ActionProjectType,
   ProjectMembershipRole,
   ProjectUpgradeStatus,
-  ProjectVersion,
   SecretEncryptionAlgo,
   SecretKeyEncoding,
   SecretsSchema,
   SecretType
 } from "@app/db/schemas";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import {
-  hasSecretReadValueOrDescribePermission,
-  throwIfMissingSecretReadValueOrDescribePermission
-} from "@app/ee/services/permission/permission-fns";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
 import { TSecretApprovalRequestDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-dal";
 import { TSecretApprovalRequestSecretDALFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-secret-dal";
@@ -57,7 +48,6 @@ import { TSecretV2BridgeServiceFactory } from "../secret-v2-bridge/secret-v2-bri
 import { TGetSecretReferencesTreeDTO } from "../secret-v2-bridge/secret-v2-bridge-types";
 import { TSecretDALFactory } from "./secret-dal";
 import {
-  conditionallyHideSecretValue,
   decryptSecretRaw,
   fnSecretBlindIndexCheck,
   fnSecretBulkDelete,
@@ -81,8 +71,6 @@ import {
   TDeleteManySecretRawDTO,
   TDeleteSecretDTO,
   TDeleteSecretRawDTO,
-  TGetAccessibleSecretsDTO,
-  TGetASecretByIdRawDTO,
   TGetASecretDTO,
   TGetASecretRawDTO,
   TGetSecretAccessListDTO,
@@ -107,7 +95,7 @@ type TSecretServiceFactoryDep = {
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   folderDAL: Pick<
     TSecretFolderDALFactory,
-    "findBySecretPath" | "updateById" | "findById" | "findByManySecretPath" | "find" | "findSecretPathByFolderIds"
+    "findBySecretPath" | "updateById" | "findById" | "findByManySecretPath" | "find"
   >;
   secretV2BridgeService: TSecretV2BridgeServiceFactory;
   secretBlindIndexDAL: TSecretBlindIndexDALFactory;
@@ -216,7 +204,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Create,
+      ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -334,7 +322,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -456,23 +444,7 @@ export const secretServiceFactory = ({
         environmentSlug: folder.environment.slug
       });
     }
-
-    const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-      permission,
-      ProjectPermissionSecretActions.ReadValue,
-      {
-        environment,
-        secretPath: path
-      }
-    );
-
-    return {
-      ...updatedSecret[0],
-      ...conditionallyHideSecretValue(secretValueHidden, updatedSecret[0]),
-      workspace: projectId,
-      environment,
-      secretPath: path
-    };
+    return { ...updatedSecret[0], workspace: projectId, environment, secretPath: path };
   };
 
   const deleteSecret = async ({
@@ -495,7 +467,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Delete,
+      ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -568,23 +540,7 @@ export const secretServiceFactory = ({
       });
     }
 
-    const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-      permission,
-      ProjectPermissionSecretActions.ReadValue,
-      {
-        environment,
-        secretPath: path
-      }
-    );
-
-    return {
-      ...deletedSecret[0],
-      ...conditionallyHideSecretValue(secretValueHidden, deletedSecret[0]),
-      _id: deletedSecret[0].id,
-      workspace: projectId,
-      environment,
-      secretPath: path
-    };
+    return { ...deletedSecret[0], _id: deletedSecret[0].id, workspace: projectId, environment, secretPath: path };
   };
 
   const getSecrets = async ({
@@ -632,10 +588,10 @@ export const secretServiceFactory = ({
 
       paths = deepPaths.map(({ folderId, path: p }) => ({ folderId, path: p }));
     } else {
-      throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-        environment,
-        secretPath: path
-      });
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionActions.Read,
+        subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+      );
 
       const folder = await folderDAL.findBySecretPath(projectId, environment, path);
       if (!folder) return { secrets: [], imports: [] };
@@ -657,10 +613,13 @@ export const secretServiceFactory = ({
         // if its service token allow full access over imported one
         actor === ActorType.SERVICE
           ? true
-          : hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-              environment: importEnv.slug,
-              secretPath: importPath
-            })
+          : permission.can(
+              ProjectPermissionActions.Read,
+              subject(ProjectPermissionSub.Secrets, {
+                environment: importEnv.slug,
+                secretPath: importPath
+              })
+            )
       );
       const importedSecrets = await fnSecretsFromImports({
         allowedImports,
@@ -711,11 +670,10 @@ export const secretServiceFactory = ({
       actorOrgId,
       actionProjectType: ActionProjectType.SecretManager
     });
-    throwIfMissingSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-      environment,
-      secretPath: path
-    });
-
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
+    );
     const folder = await folderDAL.findBySecretPath(projectId, environment, path);
     if (!folder)
       throw new NotFoundError({
@@ -762,12 +720,14 @@ export const secretServiceFactory = ({
         // if its service token allow full access over imported one
         actor === ActorType.SERVICE
           ? true
-          : hasSecretReadValueOrDescribePermission(permission, ProjectPermissionSecretActions.ReadValue, {
-              environment: importEnv.slug,
-              secretPath: importPath
-            })
+          : permission.can(
+              ProjectPermissionActions.Read,
+              subject(ProjectPermissionSub.Secrets, {
+                environment: importEnv.slug,
+                secretPath: importPath
+              })
+            )
       );
-
       const importedSecrets = await fnSecretsFromImports({
         allowedImports,
         secretDAL,
@@ -779,7 +739,6 @@ export const secretServiceFactory = ({
           if (secretBlindIndex === importedSecrets[i].secrets[j].secretBlindIndex) {
             return {
               ...importedSecrets[i].secrets[j],
-              secretValueHidden: false,
               workspace: projectId,
               environment: importedSecrets[i].environment,
               secretPath: importedSecrets[i].secretPath
@@ -790,13 +749,7 @@ export const secretServiceFactory = ({
     }
     if (!secret) throw new NotFoundError({ message: `Secret with name '${secretName}' not found` });
 
-    return {
-      ...secret,
-      secretValueHidden: false, // Always false because we check permission at the beginning of the function
-      workspace: projectId,
-      environment,
-      secretPath: path
-    };
+    return { ...secret, workspace: projectId, environment, secretPath: path };
   };
 
   const createManySecret = async ({
@@ -818,7 +771,7 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Create,
+      ProjectPermissionActions.Create,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -906,7 +859,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -948,8 +901,8 @@ export const secretServiceFactory = ({
     if (tagIds.length !== tags.length) throw new NotFoundError({ message: "One or more tags not found" });
 
     const references = await getSecretReference(projectId);
-    const secrets = await secretDAL.transaction(async (tx) => {
-      const updatedSecrets = await fnSecretBulkUpdate({
+    const secrets = await secretDAL.transaction(async (tx) =>
+      fnSecretBulkUpdate({
         folderId,
         projectId,
         tx,
@@ -979,22 +932,8 @@ export const secretServiceFactory = ({
         secretVersionDAL,
         secretTagDAL,
         secretVersionTagDAL
-      });
-
-      const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-        permission,
-        ProjectPermissionSecretActions.ReadValue,
-        {
-          environment,
-          secretPath: path
-        }
-      );
-
-      return updatedSecrets.map((secret) => ({
-        ...secret,
-        ...conditionallyHideSecretValue(secretValueHidden, secret)
-      }));
-    });
+      })
+    );
 
     await snapshotService.performSnapshot(folderId);
     await secretQueueService.syncSecrets({
@@ -1028,7 +967,7 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Delete,
+      ProjectPermissionActions.Delete,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath: path })
     );
 
@@ -1079,19 +1018,8 @@ export const secretServiceFactory = ({
           });
         }
       }
-      const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-        permission,
-        ProjectPermissionSecretActions.ReadValue,
-        {
-          environment,
-          secretPath: path
-        }
-      );
 
-      return secrets.map((secret) => ({
-        ...secret,
-        ...conditionallyHideSecretValue(secretValueHidden, secret)
-      }));
+      return secrets;
     });
 
     await snapshotService.performSnapshot(folderId);
@@ -1252,7 +1180,6 @@ export const secretServiceFactory = ({
       secretName,
       path: secretPath,
       environment,
-      viewSecretValue: false,
       type: "shared"
     });
 
@@ -1267,25 +1194,12 @@ export const secretServiceFactory = ({
         | (typeof groupPermissions)[number]
     ) => {
       const allowedActions = [
-        ProjectPermissionSecretActions.DescribeSecret,
-        ProjectPermissionSecretActions.ReadValue,
-        ProjectPermissionSecretActions.Delete,
-        ProjectPermissionSecretActions.Create,
-        ProjectPermissionSecretActions.Edit
-      ].filter((action) => {
-        if (
-          action === ProjectPermissionSecretActions.DescribeSecret ||
-          action === ProjectPermissionSecretActions.ReadValue
-        ) {
-          return hasSecretReadValueOrDescribePermission(entityPermission.permission, action, {
-            environment,
-            secretPath,
-            secretName,
-            secretTags: secret?.tags?.map((el) => el.slug)
-          });
-        }
-
-        return entityPermission.permission.can(
+        ProjectPermissionActions.Read,
+        ProjectPermissionActions.Delete,
+        ProjectPermissionActions.Create,
+        ProjectPermissionActions.Edit
+      ].filter((action) =>
+        entityPermission.permission.can(
           action,
           subject(ProjectPermissionSub.Secrets, {
             environment,
@@ -1293,8 +1207,8 @@ export const secretServiceFactory = ({
             secretName,
             secretTags: secret?.tags?.map((el) => el.slug)
           })
-        );
-      });
+        )
+      );
 
       return {
         ...entityPermission,
@@ -1313,39 +1227,6 @@ export const secretServiceFactory = ({
     return { users: usersWithAccess, identities: identitiesWithAccess, groups: groupsWithAccess };
   };
 
-  const getAccessibleSecrets = async ({
-    projectId,
-    secretPath,
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    environment,
-    filterByAction
-  }: TGetAccessibleSecretsDTO) => {
-    const { shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
-
-    if (!shouldUseSecretV2Bridge) {
-      throw new BadRequestError({
-        message: "Project version does not support this endpoint.",
-        name: "ProjectVersionNotSupported"
-      });
-    }
-
-    const secrets = await secretV2BridgeService.getAccessibleSecrets({
-      projectId,
-      secretPath,
-      environment,
-      filterByAction,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod
-    });
-
-    return secrets;
-  };
-
   const getSecretsRaw = async ({
     projectId,
     path,
@@ -1353,13 +1234,11 @@ export const secretServiceFactory = ({
     actorId,
     actorOrgId,
     actorAuthMethod,
-    viewSecretValue,
     environment,
     includeImports,
     expandSecretReferences,
     recursive,
     tagSlugs = [],
-    throwOnMissingReadValuePermission = true,
     ...paramsV2
   }: TGetSecretsRawDTO) => {
     const { botKey, shouldUseSecretV2Bridge } = await projectBotService.getBotKey(projectId);
@@ -1370,8 +1249,6 @@ export const secretServiceFactory = ({
         actorId,
         actor,
         actorOrgId,
-        viewSecretValue,
-        throwOnMissingReadValuePermission,
         environment,
         path,
         recursive,
@@ -1380,7 +1257,6 @@ export const secretServiceFactory = ({
         tagSlugs,
         ...paramsV2
       });
-
       return { secrets, imports };
     }
 
@@ -1409,20 +1285,14 @@ export const secretServiceFactory = ({
       recursive
     });
 
-    const decryptedSecrets = secrets.map((el) => decryptSecretRaw({ ...el, secretValueHidden: false }, botKey));
+    const decryptedSecrets = secrets.map((el) => decryptSecretRaw(el, botKey));
     const filteredSecrets = tagSlugs.length
       ? decryptedSecrets.filter((secret) => Boolean(secret.tags?.find((el) => tagSlugs.includes(el.slug))))
       : decryptedSecrets;
     const processedImports = (imports || [])?.map(({ secrets: importedSecrets, ...el }) => {
       const decryptedImportSecrets = importedSecrets.map((sec) =>
         decryptSecretRaw(
-          {
-            ...sec,
-            environment: el.environment,
-            workspace: projectId,
-            secretPath: el.secretPath,
-            secretValueHidden: false
-          },
+          { ...sec, environment: el.environment, workspace: projectId, secretPath: el.secretPath },
           botKey
         )
       );
@@ -1433,7 +1303,6 @@ export const secretServiceFactory = ({
       const importedEntries = decryptedImportSecrets.reduce(
         (
           accum: {
-            secretValueHidden: boolean;
             secretKey: string;
             secretPath: string;
             workspace: string;
@@ -1477,7 +1346,6 @@ export const secretServiceFactory = ({
         Object.keys(secretsGroupByPath).map((groupedPath) =>
           Promise.allSettled(
             secretsGroupByPath[groupedPath].map(async (decryptedSecret, index) => {
-              if (decryptedSecret.secretValueHidden) return;
               const expandedSecretValue = await expandSecret({
                 value: decryptedSecret.secretValue,
                 secretPath: groupedPath,
@@ -1494,7 +1362,6 @@ export const secretServiceFactory = ({
         processedImports.map((processedImport) =>
           Promise.allSettled(
             processedImport.secrets.map(async (decryptedSecret, index) => {
-              if (decryptedSecret.secretValueHidden) return;
               const expandedSecretValue = await expandSecret({
                 value: decryptedSecret.secretValue,
                 secretPath: path,
@@ -1515,24 +1382,11 @@ export const secretServiceFactory = ({
     };
   };
 
-  const getSecretByIdRaw = async ({ secretId, actorId, actor, actorOrgId, actorAuthMethod }: TGetASecretByIdRawDTO) => {
-    const secret = await secretV2BridgeService.getSecretById({
-      secretId,
-      actorId,
-      actor,
-      actorOrgId,
-      actorAuthMethod
-    });
-
-    return secret;
-  };
-
   const getSecretByNameRaw = async ({
     type,
     path,
     actor,
     environment,
-    viewSecretValue,
     projectId: workspaceId,
     expandSecretReferences,
     projectSlug,
@@ -1552,7 +1406,6 @@ export const secretServiceFactory = ({
         includeImports,
         actorAuthMethod,
         path,
-        viewSecretValue,
         actorOrgId,
         actor,
         actorId,
@@ -1583,7 +1436,6 @@ export const secretServiceFactory = ({
         message: `Project bot for project with ID '${projectId}' not found. Please upgrade your project.`,
         name: "bot_not_found_error"
       });
-
     const decryptedSecret = decryptSecretRaw(encryptedSecret, botKey);
 
     if (expandSecretReferences) {
@@ -1602,10 +1454,7 @@ export const secretServiceFactory = ({
       decryptedSecret.secretValue = expandedSecretValue || "";
     }
 
-    return {
-      secretMetadata: undefined,
-      ...decryptedSecret
-    };
+    return { secretMetadata: undefined, ...decryptedSecret };
   };
 
   const createSecretRaw = async ({
@@ -1756,16 +1605,7 @@ export const secretServiceFactory = ({
       tags: tagIds
     });
 
-    return {
-      type: SecretProtectionType.Direct as const,
-      secret: decryptSecretRaw(
-        {
-          ...secret,
-          secretValueHidden: false
-        },
-        botKey
-      )
-    };
+    return { type: SecretProtectionType.Direct as const, secret: decryptSecretRaw(secret, botKey) };
   };
 
   const updateSecretRaw = async ({
@@ -2161,7 +2001,7 @@ export const secretServiceFactory = ({
     return {
       type: SecretProtectionType.Direct as const,
       secrets: secrets.map((secret) =>
-        decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath, secretValueHidden: false }, botKey)
+        decryptSecretRaw({ ...secret, workspace: projectId, environment, secretPath }, botKey)
       )
     };
   };
@@ -2450,12 +2290,6 @@ export const secretServiceFactory = ({
     const folder = await folderDAL.findById(secret.folderId);
     if (!folder) throw new NotFoundError({ message: `Folder with ID '${secret.folderId}' not found` });
 
-    const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(folder.projectId, [folder.id]);
-
-    if (!folderWithPath) {
-      throw new NotFoundError({ message: `Folder with ID '${folder.id}' not found` });
-    }
-
     const { botKey } = await projectBotService.getBotKey(folder.projectId);
     if (!botKey)
       throw new NotFoundError({ message: `Project bot for project with ID '${folder.projectId}' not found` });
@@ -2469,43 +2303,18 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
     ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback);
-    const secretVersions = await secretVersionDAL.findBySecretId(secretId, {
-      offset,
-      limit,
-      sort: [["createdAt", "desc"]]
-    });
-    return secretVersions.map((el) => {
-      const secretKey = decryptSymmetric128BitHexKeyUTF8({
-        ciphertext: secret.secretKeyCiphertext,
-        iv: secret.secretKeyIV,
-        tag: secret.secretKeyTag,
-        key: botKey
-      });
-
-      const secretValueHidden = !hasSecretReadValueOrDescribePermission(
-        permission,
-        ProjectPermissionSecretActions.ReadValue,
+    const secretVersions = await secretVersionDAL.find({ secretId }, { offset, limit, sort: [["createdAt", "desc"]] });
+    return secretVersions.map((el) =>
+      decryptSecretRaw(
         {
-          environment: folder.environment.envSlug,
-          secretPath: folderWithPath.path,
-          secretName: secretKey,
-          ...(el.tags?.length && {
-            secretTags: el.tags.map((tag) => tag.slug)
-          })
-        }
-      );
-
-      return decryptSecretRaw(
-        {
-          secretValueHidden,
           ...el,
           workspace: folder.projectId,
           environment: folder.environment.envSlug,
-          secretPath: folderWithPath.path
+          secretPath: "/"
         },
         botKey
-      );
-    });
+      )
+    );
   };
 
   const attachTags = async ({
@@ -2531,7 +2340,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -2637,7 +2446,7 @@ export const secretServiceFactory = ({
     });
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionSecretActions.Edit,
+      ProjectPermissionActions.Edit,
       subject(ProjectPermissionSub.Secrets, { environment, secretPath })
     );
 
@@ -2803,7 +2612,7 @@ export const secretServiceFactory = ({
         message: `Project with slug '${projectSlug}' not found`
       });
     }
-    if (project.version === ProjectVersion.V3) {
+    if (project.version === 3) {
       return secretV2BridgeService.moveSecrets({
         sourceEnvironment,
         sourceSecretPath,
@@ -2828,6 +2637,30 @@ export const secretServiceFactory = ({
       actionProjectType: ActionProjectType.SecretManager
     });
 
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Delete,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: sourceEnvironment,
+        secretPath: sourceSecretPath
+      })
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Create,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Edit,
+      subject(ProjectPermissionSub.Secrets, {
+        environment: destinationEnvironment,
+        secretPath: destinationSecretPath
+      })
+    );
+
     const { botKey } = await projectBotService.getBotKey(project.id);
     if (!botKey) {
       throw new NotFoundError({
@@ -2855,9 +2688,11 @@ export const secretServiceFactory = ({
       });
     }
 
-    const sourceSecrets = await secretDAL.findManySecretsWithTags({
+    const sourceSecrets = await secretDAL.find({
       type: SecretType.Shared,
-      secretIds
+      $in: {
+        id: secretIds
+      }
     });
 
     if (sourceSecrets.length !== secretIds.length) {
@@ -2866,62 +2701,21 @@ export const secretServiceFactory = ({
       });
     }
 
-    const sourceActions = [
-      ProjectPermissionSecretActions.Delete,
-      ProjectPermissionSecretActions.DescribeSecret,
-      ProjectPermissionSecretActions.ReadValue
-    ] as const;
-    const destinationActions = [ProjectPermissionSecretActions.Create, ProjectPermissionSecretActions.Edit] as const;
-
-    const decryptedSourceSecrets = sourceSecrets.map((secret) => {
-      const secretKey = decryptSymmetric128BitHexKeyUTF8({
+    const decryptedSourceSecrets = sourceSecrets.map((secret) => ({
+      ...secret,
+      secretKey: decryptSymmetric128BitHexKeyUTF8({
         ciphertext: secret.secretKeyCiphertext,
         iv: secret.secretKeyIV,
         tag: secret.secretKeyTag,
         key: botKey
-      });
-
-      for (const destinationAction of destinationActions) {
-        ForbiddenError.from(permission).throwUnlessCan(
-          destinationAction,
-          subject(ProjectPermissionSub.Secrets, {
-            environment: destinationEnvironment,
-            secretPath: destinationSecretPath
-          })
-        );
-      }
-
-      for (const sourceAction of sourceActions) {
-        if (
-          sourceAction === ProjectPermissionSecretActions.ReadValue ||
-          sourceAction === ProjectPermissionSecretActions.DescribeSecret
-        ) {
-          throwIfMissingSecretReadValueOrDescribePermission(permission, sourceAction, {
-            environment: sourceEnvironment,
-            secretPath: sourceSecretPath
-          });
-        } else {
-          ForbiddenError.from(permission).throwUnlessCan(
-            sourceAction,
-            subject(ProjectPermissionSub.Secrets, {
-              environment: sourceEnvironment,
-              secretPath: sourceSecretPath
-            })
-          );
-        }
-      }
-
-      return {
-        ...secret,
-        secretKey,
-        secretValue: decryptSymmetric128BitHexKeyUTF8({
-          ciphertext: secret.secretValueCiphertext,
-          iv: secret.secretValueIV,
-          tag: secret.secretValueTag,
-          key: botKey
-        })
-      };
-    });
+      }),
+      secretValue: decryptSymmetric128BitHexKeyUTF8({
+        ciphertext: secret.secretValueCiphertext,
+        iv: secret.secretValueIV,
+        tag: secret.secretValueTag,
+        key: botKey
+      })
+    }));
 
     let isSourceUpdated = false;
     let isDestinationUpdated = false;
@@ -3294,8 +3088,6 @@ export const secretServiceFactory = ({
     getSecretsRawMultiEnv,
     getSecretReferenceTree,
     getSecretsRawByFolderMappings,
-    getSecretAccessList,
-    getSecretByIdRaw,
-    getAccessibleSecrets
+    getSecretAccessList
   };
 };

backend/src/services/secret/secret-types.ts

@@ -2,7 +2,6 @@ import { Knex } from "knex";
 import { z } from "zod";
 
 import { SecretType, TSecretBlindIndexes, TSecrets, TSecretsInsert, TSecretsUpdate } from "@app/db/schemas";
-import { ProjectPermissionSecretActions } from "@app/ee/services/permission/project-permission";
 import { OrderByDirection, TProjectPermission } from "@app/lib/types";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal";
@@ -122,10 +121,6 @@ export type TGetASecretDTO = {
   version?: number;
 } & TProjectPermission;
 
-export type TGetASecretByIdDTO = {
-  secretId: string;
-} & Omit<TProjectPermission, "projectId">;
-
 export type TCreateBulkSecretDTO = {
   path: string;
   environment: string;
@@ -181,18 +176,10 @@ export enum SecretsOrderBy {
   Name = "name" // "key" for secrets but using name for use across resources
 }
 
-export type TGetAccessibleSecretsDTO = {
-  secretPath: string;
-  environment: string;
-  filterByAction: ProjectPermissionSecretActions.DescribeSecret | ProjectPermissionSecretActions.ReadValue;
-} & TProjectPermission;
-
 export type TGetSecretsRawDTO = {
   expandSecretReferences?: boolean;
   path: string;
   environment: string;
-  viewSecretValue: boolean;
-  throwOnMissingReadValuePermission?: boolean;
   includeImports?: boolean;
   recursive?: boolean;
   tagSlugs?: string[];
@@ -218,7 +205,6 @@ export type TGetASecretRawDTO = {
   secretName: string;
   path: string;
   environment: string;
-  viewSecretValue: boolean;
   expandSecretReferences?: boolean;
   type: "shared" | "personal";
   includeImports?: boolean;
@@ -227,10 +213,6 @@ export type TGetASecretRawDTO = {
   projectId?: string;
 } & Omit<TProjectPermission, "projectId">;
 
-export type TGetASecretByIdRawDTO = {
-  secretId: string;
-} & Omit<TProjectPermission, "projectId">;
-
 export type TCreateSecretRawDTO = TProjectPermission & {
   secretName: string;
   secretPath: string;
@@ -427,7 +409,7 @@ export type TCreateManySecretsRawFnFactory = {
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   secretV2BridgeDAL: Pick<
     TSecretV2BridgeDALFactory,
-    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" | "find"
+    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany"
   >;
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
@@ -464,7 +446,7 @@ export type TUpdateManySecretsRawFnFactory = {
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   secretV2BridgeDAL: Pick<
     TSecretV2BridgeDALFactory,
-    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany" | "find"
+    "insertMany" | "upsertSecretReferences" | "findBySecretKeys" | "bulkUpdate" | "deleteMany"
   >;
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;

backend/src/services/secret/secret-version-dal.ts

@@ -1,9 +1,9 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { SecretVersionsSchema, TableName, TSecretVersions, TSecretVersionsUpdate } from "@app/db/schemas";
+import { TableName, TSecretVersions, TSecretVersionsUpdate } from "@app/db/schemas";
 import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
-import { ormify, selectAllTableCols, sqlNestRelationships, TFindOpt } from "@app/lib/knex";
+import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
 import { QueueName } from "@app/queue";
 
@@ -12,50 +12,6 @@ export type TSecretVersionDALFactory = ReturnType<typeof secretVersionDALFactory
 export const secretVersionDALFactory = (db: TDbClient) => {
   const secretVersionOrm = ormify(db, TableName.SecretVersion);
 
-  const findBySecretId = async (secretId: string, { offset, limit, sort, tx }: TFindOpt<TSecretVersions> = {}) => {
-    try {
-      const query = (tx || db.replicaNode())(TableName.SecretVersion)
-        .where(`${TableName.SecretVersion}.secretId`, secretId)
-        .leftJoin(TableName.Secret, `${TableName.SecretVersion}.secretId`, `${TableName.Secret}.id`)
-        .leftJoin(TableName.JnSecretTag, `${TableName.Secret}.id`, `${TableName.JnSecretTag}.${TableName.Secret}Id`)
-        .leftJoin(TableName.SecretTag, `${TableName.JnSecretTag}.${TableName.SecretTag}Id`, `${TableName.SecretTag}.id`)
-        .select(selectAllTableCols(TableName.SecretVersion))
-        .select(db.ref("id").withSchema(TableName.SecretTag).as("tagId"))
-        .select(db.ref("color").withSchema(TableName.SecretTag).as("tagColor"))
-        .select(db.ref("slug").withSchema(TableName.SecretTag).as("tagSlug"));
-
-      if (limit) void query.limit(limit);
-      if (offset) void query.offset(offset);
-      if (sort) {
-        void query.orderBy(sort.map(([column, order, nulls]) => ({ column: column as string, order, nulls })));
-      }
-
-      const docs = await query;
-
-      const data = sqlNestRelationships({
-        data: docs,
-        key: "id",
-        parentMapper: (el) => ({ _id: el.id, ...SecretVersionsSchema.parse(el) }),
-        childrenMapper: [
-          {
-            key: "tagId",
-            label: "tags" as const,
-            mapper: ({ tagId: id, tagColor: color, tagSlug: slug }) => ({
-              id,
-              color,
-              slug,
-              name: slug
-            })
-          }
-        ]
-      });
-
-      return data;
-    } catch (error) {
-      throw new DatabaseError({ error, name: `${TableName.SecretVersion}: FindBySecretId` });
-    }
-  };
-
   // This will fetch all latest secret versions from a folder
   const findLatestVersionByFolderId = async (folderId: string, tx?: Knex) => {
     try {
@@ -193,7 +149,6 @@ export const secretVersionDALFactory = (db: TDbClient) => {
     findLatestVersionMany,
     bulkUpdate,
     findLatestVersionByFolderId,
-    findBySecretId,
     bulkUpdateNoVersionIncrement
   };
 };

backend/src/services/service-token/service-token-service.ts

@@ -5,11 +5,7 @@ import bcrypt from "bcrypt";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionSecretActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { ForbiddenRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
 
@@ -71,7 +67,7 @@ export const serviceTokenServiceFactory = ({
 
     scopes.forEach(({ environment, secretPath }) => {
       ForbiddenError.from(permission).throwUnlessCan(
-        ProjectPermissionSecretActions.Create,
+        ProjectPermissionActions.Create,
         subject(ProjectPermissionSub.Secrets, { environment, secretPath })
       );
     });

backend/src/services/slack/slack-fns.ts

@@ -50,7 +50,6 @@ const buildSlackPayload = (notification: TSlackNotification) => {
       const messageBody = `A secret approval request has been opened by ${payload.userEmail}.
 *Environment*: ${payload.environment}
 *Secret path*: ${payload.secretPath || "/"}
-*Secret Key${payload.secretKeys.length > 1 ? "s" : ""}*: ${payload.secretKeys.join(", ")}
 
 View the complete details <${appCfg.SITE_URL}/secret-manager/${payload.projectId}/approval?requestId=${
         payload.requestId

backend/src/services/slack/slack-types.ts

@@ -62,7 +62,6 @@ export type TSlackNotification =
         secretPath: string;
         requestId: string;
         projectId: string;
-        secretKeys: string[];
       };
     }
   | {

backend/src/services/super-admin/super-admin-service.ts

@@ -271,17 +271,22 @@ export const superAdminServiceFactory = ({
     return { token, user: userInfo, organization };
   };
 
-  const getUsers = ({ offset, limit, searchTerm, adminsOnly }: TAdminGetUsersDTO) => {
+  const getUsers = ({ offset, limit, searchTerm }: TAdminGetUsersDTO) => {
     return userDAL.getUsersByFilter({
       limit,
       offset,
       searchTerm,
-      sortBy: "username",
-      adminsOnly
+      sortBy: "username"
     });
   };
 
   const deleteUser = async (userId: string) => {
+    if (!licenseService.onPremFeatures?.instanceUserManagement) {
+      throw new BadRequestError({
+        message: "Failed to delete user due to plan restriction. Upgrade to Infisical's Pro plan."
+      });
+    }
+
     const user = await userDAL.deleteById(userId);
     return user;
   };

backend/src/services/super-admin/super-admin-types.ts

@@ -20,7 +20,6 @@ export type TAdminGetUsersDTO = {
   offset: number;
   limit: number;
   searchTerm: string;
-  adminsOnly: boolean;
 };
 
 export enum LoginMethod {

backend/src/services/user/user-dal.ts

@@ -23,18 +23,15 @@ export const userDALFactory = (db: TDbClient) => {
     limit,
     offset,
     searchTerm,
-    sortBy,
-    adminsOnly
+    sortBy
   }: {
     limit: number;
     offset: number;
     searchTerm: string;
     sortBy?: keyof TUsers;
-    adminsOnly: boolean;
   }) => {
     try {
       let query = db.replicaNode()(TableName.Users).where("isGhost", "=", false);
-
       if (searchTerm) {
         query = query.where((qb) => {
           void qb
@@ -45,10 +42,6 @@ export const userDALFactory = (db: TDbClient) => {
         });
       }
 
-      if (adminsOnly) {
-        query = query.where("superAdmin", true);
-      }
-
       if (sortBy) {
         query = query.orderBy(sortBy);
       }

backend/src/services/webhook/webhook-fns.ts

@@ -11,7 +11,7 @@ import { logger } from "@app/lib/logger";
 import { TProjectDALFactory } from "../project/project-dal";
 import { TProjectEnvDALFactory } from "../project-env/project-env-dal";
 import { TWebhookDALFactory } from "./webhook-dal";
-import { TWebhookPayloads, WebhookEvents, WebhookType } from "./webhook-types";
+import { WebhookType } from "./webhook-types";
 
 const WEBHOOK_TRIGGER_TIMEOUT = 15 * 1000;
 
@@ -54,64 +54,29 @@ export const triggerWebhookRequest = async (
   return req;
 };
 
-export const getWebhookPayload = (event: TWebhookPayloads) => {
-  if (event.type === WebhookEvents.SecretModified) {
-    const { projectName, projectId, environment, secretPath, type } = event.payload;
-
-    switch (type) {
-      case WebhookType.SLACK:
-        return {
-          text: "A secret value has been added or modified.",
-          attachments: [
-            {
-              color: "#E7F256",
-              fields: [
-                {
-                  title: "Project",
-                  value: projectName,
-                  short: false
-                },
-                {
-                  title: "Environment",
-                  value: environment,
-                  short: false
-                },
-                {
-                  title: "Secret Path",
-                  value: secretPath,
-                  short: false
-                }
-              ]
-            }
-          ]
-        };
-      case WebhookType.GENERAL:
-      default:
-        return {
-          event: event.type,
-          project: {
-            workspaceId: projectId,
-            projectName,
-            environment,
-            secretPath
-          }
-        };
-    }
+export const getWebhookPayload = (
+  eventName: string,
+  details: {
+    workspaceName: string;
+    workspaceId: string;
+    environment: string;
+    secretPath?: string;
+    type?: string | null;
   }
-
-  const { projectName, projectId, environment, secretPath, type, reminderNote, secretName } = event.payload;
+) => {
+  const { workspaceName, workspaceId, environment, secretPath, type } = details;
 
   switch (type) {
     case WebhookType.SLACK:
       return {
-        text: "You have a secret reminder",
+        text: "A secret value has been added or modified.",
         attachments: [
           {
             color: "#E7F256",
             fields: [
               {
                 title: "Project",
-                value: projectName,
+                value: workspaceName,
                 short: false
               },
               {
@@ -123,16 +88,6 @@ export const getWebhookPayload = (event: TWebhookPayloads) => {
                 title: "Secret Path",
                 value: secretPath,
                 short: false
-              },
-              {
-                title: "Secret Name",
-                value: secretName,
-                short: false
-              },
-              {
-                title: "Reminder Note",
-                value: reminderNote,
-                short: false
               }
             ]
           }
@@ -141,14 +96,11 @@ export const getWebhookPayload = (event: TWebhookPayloads) => {
     case WebhookType.GENERAL:
     default:
       return {
-        event: event.type,
+        event: eventName,
         project: {
-          workspaceId: projectId,
-          projectName,
+          workspaceId,
           environment,
-          secretPath,
-          secretName,
-          reminderNote
+          secretPath
         }
       };
   }
@@ -158,7 +110,6 @@ export type TFnTriggerWebhookDTO = {
   projectId: string;
   secretPath: string;
   environment: string;
-  event: TWebhookPayloads;
   webhookDAL: Pick<TWebhookDALFactory, "findAllWebhooks" | "transaction" | "update" | "bulkUpdate">;
   projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
   projectDAL: Pick<TProjectDALFactory, "findById">;
@@ -173,9 +124,8 @@ export const fnTriggerWebhook = async ({
   projectId,
   webhookDAL,
   projectEnvDAL,
-  event,
-  secretManagerDecryptor,
-  projectDAL
+  projectDAL,
+  secretManagerDecryptor
 }: TFnTriggerWebhookDTO) => {
   const webhooks = await webhookDAL.findAllWebhooks(projectId, environment);
   const toBeTriggeredHooks = webhooks.filter(
@@ -184,20 +134,21 @@ export const fnTriggerWebhook = async ({
   );
   if (!toBeTriggeredHooks.length) return;
   logger.info({ environment, secretPath, projectId }, "Secret webhook job started");
-  let { projectName } = event.payload;
-  if (!projectName) {
-    const project = await projectDAL.findById(event.payload.projectId);
-    projectName = project.name;
-  }
-
+  const project = await projectDAL.findById(projectId);
   const webhooksTriggered = await Promise.allSettled(
-    toBeTriggeredHooks.map((hook) => {
-      const formattedEvent = {
-        type: event.type,
-        payload: { ...event.payload, type: hook.type, projectName }
-      } as TWebhookPayloads;
-      return triggerWebhookRequest(hook, secretManagerDecryptor, getWebhookPayload(formattedEvent));
-    })
+    toBeTriggeredHooks.map((hook) =>
+      triggerWebhookRequest(
+        hook,
+        secretManagerDecryptor,
+        getWebhookPayload("secrets.modified", {
+          workspaceName: project.name,
+          workspaceId: projectId,
+          environment,
+          secretPath,
+          type: hook.type
+        })
+      )
+    )
   );
 
   // filter hooks by status

backend/src/services/webhook/webhook-service.ts

@@ -16,8 +16,7 @@ import {
   TDeleteWebhookDTO,
   TListWebhookDTO,
   TTestWebhookDTO,
-  TUpdateWebhookDTO,
-  WebhookEvents
+  TUpdateWebhookDTO
 } from "./webhook-types";
 
 type TWebhookServiceFactoryDep = {
@@ -145,15 +144,12 @@ export const webhookServiceFactory = ({
       await triggerWebhookRequest(
         webhook,
         (value) => secretManagerDecryptor({ cipherTextBlob: value }).toString(),
-        getWebhookPayload({
-          type: "test" as WebhookEvents.SecretModified,
-          payload: {
-            projectName: project.name,
-            projectId: webhook.projectId,
-            environment: webhook.environment.slug,
-            secretPath: webhook.secretPath,
-            type: webhook.type
-          }
+        getWebhookPayload("test", {
+          workspaceName: project.name,
+          workspaceId: webhook.projectId,
+          environment: webhook.environment.slug,
+          secretPath: webhook.secretPath,
+          type: webhook.type
         })
       );
     } catch (err) {

backend/src/services/webhook/webhook-types.ts

@@ -30,36 +30,3 @@ export enum WebhookType {
   GENERAL = "general",
   SLACK = "slack"
 }
-
-export enum WebhookEvents {
-  SecretModified = "secrets.modified",
-  SecretReminderExpired = "secrets.reminder-expired",
-  TestEvent = "test"
-}
-
-type TWebhookSecretModifiedEventPayload = {
-  type: WebhookEvents.SecretModified;
-  payload: {
-    projectName?: string;
-    projectId: string;
-    environment: string;
-    secretPath?: string;
-    type?: string | null;
-  };
-};
-
-type TWebhookSecretReminderEventPayload = {
-  type: WebhookEvents.SecretReminderExpired;
-  payload: {
-    projectName?: string;
-    projectId: string;
-    environment: string;
-    secretPath?: string;
-    type?: string | null;
-    secretName: string;
-    secretId: string;
-    reminderNote?: string | null;
-  };
-};
-
-export type TWebhookPayloads = TWebhookSecretModifiedEventPayload | TWebhookSecretReminderEventPayload;

backend/vitest.unit.config.ts

@@ -1,17 +0,0 @@
-import path from "path";
-import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    globals: true,
-    env: {
-      NODE_ENV: "test"
-    },
-    include: ["./src/**/*.test.ts"]
-  },
-  resolve: {
-    alias: {
-      "@app": path.resolve(__dirname, "./src")
-    }
-  }
-});

cli/config/example-infisical-relay.yaml

@@ -1,8 +0,0 @@
-public_ip: 127.0.0.1
-auth_secret: example-auth-secret
-realm: infisical.org
-# set port 5349 for tls
-# port: 5349
-# tls_private_key_path: /full-path
-# tls_ca_path:  /full-path
-# tls_cert_path: /full-path

cli/go.mod

@@ -20,7 +20,6 @@ require (
 	github.com/muesli/reflow v0.3.0
 	github.com/muesli/roff v0.1.0
 	github.com/petar-dambovaliev/aho-corasick v0.0.0-20211021192214-5ab2d9280aa9
-	github.com/pion/dtls/v3 v3.0.4
 	github.com/pion/logging v0.2.3
 	github.com/pion/turn/v4 v4.0.0
 	github.com/posthog/posthog-go v0.0.0-20221221115252-24dfed35d71a
@@ -29,10 +28,9 @@ require (
 	github.com/rs/zerolog v1.26.1
 	github.com/spf13/cobra v1.6.1
 	github.com/spf13/viper v1.8.1
-	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.36.0
-	golang.org/x/sys v0.31.0
-	golang.org/x/term v0.30.0
+	github.com/stretchr/testify v1.9.0
+	golang.org/x/crypto v0.35.0
+	golang.org/x/term v0.29.0
 	gopkg.in/yaml.v2 v2.4.0
 )
 
@@ -91,6 +89,7 @@ require (
 	github.com/oklog/ulid v1.3.1 // indirect
 	github.com/onsi/ginkgo/v2 v2.22.2 // indirect
 	github.com/pelletier/go-toml v1.9.3 // indirect
+	github.com/pion/dtls/v3 v3.0.4 // indirect
 	github.com/pion/randutil v0.1.0 // indirect
 	github.com/pion/stun/v3 v3.0.0 // indirect
 	github.com/pion/transport/v3 v3.0.7 // indirect
@@ -115,8 +114,9 @@ require (
 	golang.org/x/mod v0.23.0 // indirect
 	golang.org/x/net v0.35.0 // indirect
 	golang.org/x/oauth2 v0.21.0 // indirect
-	golang.org/x/sync v0.12.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
+	golang.org/x/sync v0.11.0 // indirect
+	golang.org/x/sys v0.30.0 // indirect
+	golang.org/x/text v0.22.0 // indirect
 	golang.org/x/time v0.6.0 // indirect
 	golang.org/x/tools v0.30.0 // indirect
 	google.golang.org/api v0.188.0 // indirect
@@ -139,5 +139,3 @@ require (
 )
 
 replace github.com/zalando/go-keyring => github.com/Infisical/go-keyring v1.0.2
-
-replace github.com/pion/turn/v4 => github.com/Infisical/turn/v4 v4.0.1

cli/go.sum

@@ -49,8 +49,6 @@ github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Infisical/go-keyring v1.0.2 h1:dWOkI/pB/7RocfSJgGXbXxLDcVYsdslgjEPmVhb+nl8=
 github.com/Infisical/go-keyring v1.0.2/go.mod h1:LWOnn/sw9FxDW/0VY+jHFAfOFEe03xmwBVSfJnBowto=
-github.com/Infisical/turn/v4 v4.0.1 h1:omdelNsnFfzS5cu86W5OBR68by68a8sva4ogR0lQQnw=
-github.com/Infisical/turn/v4 v4.0.1/go.mod h1:pMMKP/ieNAG/fN5cZiN4SDuyKsXtNTr0ccN7IToA1zs=
 github.com/alessio/shellescape v1.4.1 h1:V7yhSDDn8LP4lc4jS8pFkt0zCnzVJlG5JXy9BVKJUX0=
 github.com/alessio/shellescape v1.4.1/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
@@ -367,6 +365,8 @@ github.com/pion/stun/v3 v3.0.0 h1:4h1gwhWLWuZWOJIJR9s2ferRO+W3zA/b6ijOI6mKzUw=
 github.com/pion/stun/v3 v3.0.0/go.mod h1:HvCN8txt8mwi4FBvS3EmDghW6aQJ24T+y+1TKjB5jyU=
 github.com/pion/transport/v3 v3.0.7 h1:iRbMH05BzSNwhILHoBoAPxoB9xQgOaJk+591KC9P1o0=
 github.com/pion/transport/v3 v3.0.7/go.mod h1:YleKiTZ4vqNxVwh77Z0zytYi7rXHl7j6uPLGhhz9rwo=
+github.com/pion/turn/v4 v4.0.0 h1:qxplo3Rxa9Yg1xXDxxH8xaqcyGUtbHYw4QSCvmFWvhM=
+github.com/pion/turn/v4 v4.0.0/go.mod h1:MuPDkm15nYSklKpN8vWJ9W2M0PlyQZqYt1McGuxG7mA=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@@ -425,8 +425,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
@@ -484,8 +484,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20211215165025-cf75a172585e/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
-golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/crypto v0.35.0 h1:b15kiHdrGCHrP6LvwaQ3c03kgNhhiMgvlhxHQhmg2Xs=
+golang.org/x/crypto v0.35.0/go.mod h1:dy7dXNW32cAb/6/PRuTNsix8T+vJAqvuIy5Bli/x0YQ=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -590,8 +590,8 @@ golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.12.0 h1:MHc5BpPuC30uJk597Ri8TV3CNZcTLu6B6z4lJy+g6Jw=
-golang.org/x/sync v0.12.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
+golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -640,11 +640,11 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220310020820-b874c991c1a5/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
-golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
+golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
-golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
+golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
+golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -654,8 +654,8 @@ golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
-golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
+golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -858,4 +858,4 @@ honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=