Skip to content

Commit 908dfcf

Browse files
fiftinfiftin
authored
Secret from env (#3396)
* docs(be): add description for db field * feat(be): read secret from environment variable * feat(secrets): read secret from envrionment variable * feat(secrets): getting env var name for secret storage * feat(ui): readonly secret storage support * feat(secrets): respect readonly storages * test: fix tests * test: remove exta tests * test: fix api docs
1 parent ed18a33 commit 908dfcf

File tree

14 files changed

+364
-279
lines changed

14 files changed

+364
-279
lines changed

‎api-docs.yml‎

Lines changed: 64 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -1753,70 +1753,70 @@ paths:
17531753
description: User updated
17541754

17551755
# Invite management
1756-
/project/{project_id}/invites:
1757-
parameters:
1758-
- $ref: "#/parameters/project_id"
1759-
get:
1760-
tags:
1761-
- project
1762-
summary: Get invitations for project
1763-
parameters:
1764-
- name: sort
1765-
in: query
1766-
required: false
1767-
type: string
1768-
enum: [created, status, role]
1769-
description: sorting field
1770-
x-example: created
1771-
- name: order
1772-
in: query
1773-
required: false
1774-
type: string
1775-
enum: [asc, desc]
1776-
description: ordering manner
1777-
x-example: desc
1778-
responses:
1779-
200:
1780-
description: Project invitations
1781-
schema:
1782-
type: array
1783-
items:
1784-
$ref: "#/definitions/ProjectInvite"
1785-
post:
1786-
tags:
1787-
- project
1788-
summary: Create project invitation
1789-
parameters:
1790-
- name: Invite
1791-
in: body
1792-
required: true
1793-
schema:
1794-
$ref: "#/definitions/ProjectInviteRequest"
1795-
responses:
1796-
201:
1797-
description: Invitation created
1798-
schema:
1799-
$ref: "#/definitions/ProjectInvite"
1800-
400:
1801-
description: Bad request (invalid role, missing user_id/email, or both provided)
1802-
409:
1803-
description: User already a member or invitation already exists
1804-
1805-
/project/{project_id}/invites/{invite_id}:
1806-
parameters:
1807-
- $ref: "#/parameters/project_id"
1808-
- $ref: "#/parameters/invite_id"
1809-
get:
1810-
tags:
1811-
- project
1812-
summary: Get specific project invitation
1813-
responses:
1814-
200:
1815-
description: Project invitation
1816-
schema:
1817-
$ref: "#/definitions/ProjectInvite"
1818-
404:
1819-
description: Invitation not found
1756+
# /project/{project_id}/invites:
1757+
# parameters:
1758+
# - $ref: "#/parameters/project_id"
1759+
# get:
1760+
# tags:
1761+
# - project
1762+
# summary: Get invitations for project
1763+
# parameters:
1764+
# - name: sort
1765+
# in: query
1766+
# required: false
1767+
# type: string
1768+
# enum: [created, status, role]
1769+
# description: sorting field
1770+
# x-example: created
1771+
# - name: order
1772+
# in: query
1773+
# required: false
1774+
# type: string
1775+
# enum: [asc, desc]
1776+
# description: ordering manner
1777+
# x-example: desc
1778+
# responses:
1779+
# 200:
1780+
# description: Project invitations
1781+
# schema:
1782+
# type: array
1783+
# items:
1784+
# $ref: "#/definitions/ProjectInvite"
1785+
# post:
1786+
# tags:
1787+
# - project
1788+
# summary: Create project invitation
1789+
# parameters:
1790+
# - name: Invite
1791+
# in: body
1792+
# required: true
1793+
# schema:
1794+
# $ref: "#/definitions/ProjectInviteRequest"
1795+
# responses:
1796+
# 201:
1797+
# description: Invitation created
1798+
# schema:
1799+
# $ref: "#/definitions/ProjectInvite"
1800+
# 400:
1801+
# description: Bad request (invalid role, missing user_id/email, or both provided)
1802+
# 409:
1803+
# description: User already a member or invitation already exists
1804+
#
1805+
# /project/{project_id}/invites/{invite_id}:
1806+
# parameters:
1807+
# - $ref: "#/parameters/project_id"
1808+
# - $ref: "#/parameters/invite_id"
1809+
# get:
1810+
# tags:
1811+
# - project
1812+
# summary: Get specific project invitation
1813+
# responses:
1814+
# 200:
1815+
# description: Project invitation
1816+
# schema:
1817+
# $ref: "#/definitions/ProjectInvite"
1818+
# 404:
1819+
# description: Invitation not found
18201820
# put:
18211821
# tags:
18221822
# - project

‎api/projects/keys.go‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ package projects
33
import (
44
"errors"
55
"fmt"
6-
"github.com/semaphoreui/semaphore/services/server"
76
"net/http"
87

8+
"github.com/semaphoreui/semaphore/services/server"
9+
910
"github.com/semaphoreui/semaphore/api/helpers"
1011
"github.com/semaphoreui/semaphore/db"
1112
)
@@ -91,12 +92,12 @@ func (c *KeyController) AddKey(w http.ResponseWriter, r *http.Request) {
9192
return
9293
}
9394

94-
if err := key.Validate(true); err != nil {
95-
helpers.WriteJSON(w, http.StatusBadRequest, map[string]string{
96-
"error": err.Error(),
97-
})
98-
return
99-
}
95+
//if err := key.Validate(true); err != nil {
96+
// helpers.WriteJSON(w, http.StatusBadRequest, map[string]string{
97+
// "error": err.Error(),
98+
// })
99+
// return
100+
//}
100101

101102
newKey, err := c.accessKeyService.Create(key)
102103

‎api/projects/secret_storages.go‎

Lines changed: 24 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,11 @@ package projects
22

33
import (
44
"fmt"
5+
"net/http"
6+
57
"github.com/semaphoreui/semaphore/api/helpers"
68
"github.com/semaphoreui/semaphore/db"
79
"github.com/semaphoreui/semaphore/services/server"
8-
"net/http"
910
)
1011

1112
type SecretStorageController struct {
@@ -21,14 +22,33 @@ func SecretStorageMiddleware(next http.Handler) http.Handler {
2122
return
2223
}
2324

24-
key, err := helpers.Store(r).GetSecretStorage(project.ID, storageID)
25+
storage, err := helpers.Store(r).GetSecretStorage(project.ID, storageID)
26+
27+
if err != nil {
28+
helpers.WriteError(w, err)
29+
return
30+
}
31+
32+
keys, err := helpers.Store(r).GetAccessKeys(project.ID, db.GetAccessKeyOptions{
33+
Owner: db.AccessKeySecretStorage,
34+
StorageID: &storage.ID,
35+
}, db.RetrieveQueryParams{})
2536

2637
if err != nil {
2738
helpers.WriteError(w, err)
2839
return
2940
}
3041

31-
r = helpers.SetContextValue(r, "secretStorage", key)
42+
if len(keys) == 0 {
43+
helpers.WriteErrorStatus(w, "Access key not found", http.StatusNotFound)
44+
return
45+
}
46+
47+
if keys[0].SourceStorageKey != nil {
48+
storage.SecretEnvironmentVariable = *keys[0].SourceStorageKey
49+
}
50+
51+
r = helpers.SetContextValue(r, "secretStorage", storage)
3252
next.ServeHTTP(w, r)
3353
})
3454
}
@@ -157,5 +177,5 @@ func (c *SecretStorageController) Remove(w http.ResponseWriter, r *http.Request)
157177
return
158178
}
159179

160-
helpers.WriteJSON(w, http.StatusNoContent, nil)
180+
w.WriteHeader(http.StatusNoContent)
161181
}

‎db/AccessKey.go‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@ package db
22

33
import (
44
"fmt"
5-
//"github.com/semaphoreui/semaphore/pkg/ssh"
6-
//"github.com/semaphoreui/semaphore/pkg/random"
7-
//"github.com/semaphoreui/semaphore/pkg/ssh"
8-
//"path"
95
)
106

117
type AccessKeyType string
@@ -18,10 +14,10 @@ const (
1814
AccessKeyString AccessKeyType = "string"
1915
)
2016
const (
21-
AccessKeyEnvironment AccessKeyOwner = "environment"
22-
AccessKeyVariable AccessKeyOwner = "variable"
23-
AccessKeyVault AccessKeyOwner = "vault"
24-
AccessKeyShared AccessKeyOwner = ""
17+
AccessKeyEnvironment AccessKeyOwner = "environment"
18+
AccessKeyVariable AccessKeyOwner = "variable"
19+
AccessKeySecretStorage AccessKeyOwner = "vault"
20+
AccessKeyShared AccessKeyOwner = ""
2521
)
2622

2723
// AccessKey represents a key used to access a machine with ansible from semaphore
@@ -55,7 +51,12 @@ type AccessKey struct {
5551

5652
Owner AccessKeyOwner `db:"owner" json:"owner,omitempty"`
5753

58-
SourceStorageID *int `db:"source_storage_id" json:"source_storage_id,omitempty" backup:"-"`
54+
// SourceStorageID represents the ID of the source storage associated with the access key, used for reference purposes.
55+
SourceStorageID *int `db:"source_storage_id" json:"source_storage_id,omitempty" backup:"-"`
56+
57+
// SourceStorageKey is an optional reference to a specific storage key associated with the source storage.
58+
// For example for Hashicorp vault this is the path to the secret.
59+
// If SourceStorageID is nil, this field is references to an environment variable.
5960
SourceStorageKey *string `db:"source_storage_key" json:"source_storage_key,omitempty"`
6061
}
6162

@@ -101,3 +102,7 @@ func (key *AccessKey) Validate(validateSecretFields bool) error {
101102

102103
return nil
103104
}
105+
106+
func (key *AccessKey) IsEnvironmentVariable() bool {
107+
return key.SourceStorageID == nil && key.SourceStorageKey != nil
108+
}

‎db/SecretStorage.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,5 +16,6 @@ type SecretStorage struct {
1616
Params MapStringAnyField `db:"params" json:"params"`
1717
ReadOnly bool `db:"readonly" json:"readonly"`
1818

19-
Secret string `db:"-" json:"secret,omitempty" backup:"-"`
19+
Secret string `db:"-" json:"secret,omitempty" backup:"-"`
20+
SecretEnvironmentVariable string `db:"-" json:"secret_environment_variable,omitempty" backup:"-"`
2021
}

‎db/sql/access_key.go‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package sql
22

33
import (
44
"database/sql"
5+
56
"github.com/Masterminds/squirrel"
67
"github.com/semaphoreui/semaphore/db"
78
)
@@ -30,7 +31,7 @@ func (d *SqlDb) GetAccessKeys(projectID int, options db.GetAccessKeyOptions, par
3031
switch options.Owner {
3132
case db.AccessKeyVariable, db.AccessKeyEnvironment:
3233
q = q.Where(squirrel.Eq{"pe.environment_id": *options.EnvironmentID})
33-
case db.AccessKeyVault:
34+
case db.AccessKeySecretStorage:
3435
q = q.Where(squirrel.Eq{"pe.storage_id": options.StorageID})
3536
}
3637
}
@@ -59,12 +60,6 @@ func (d *SqlDb) UpdateAccessKey(key db.AccessKey) error {
5960
return err
6061
}
6162

62-
//err = key.SerializeSecret()
63-
//
64-
//if err != nil {
65-
// return err
66-
//}
67-
6863
var res sql.Result
6964

7065
var args []any

0 commit comments

Comments
 (0)