Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Using global private environment to save secrets[INS-4715] #8233

Merged
merged 46 commits into from
Feb 17, 2025

Conversation

cwangsmv
Copy link
Contributor

@cwangsmv cwangsmv commented Dec 5, 2024

Changes
Leverage global private environment to add built-in support secret management capabilities.
Add a new secret type environment key-value pair to store secret variables with the following features:

  • Secret environment variables will add a vault prefix automatically to distinguish with normal environment variables. If you define a secret environment called foo, you need to input {{ vault.foo }} to use as environment variable
  • Secret environment values are encrypted in the database
  • Secret environment values are masked unless in environment editor/variable editor modal/using in request
  • When the private environment is exported, a default placeholder string will replace its real value
  • When user has rest the encryption key (aka: vault key) in other devices, all local secret environment variables will be removed
Screenshot 2024-12-05 at 14 44 33

We also introduce a new term Vault Key.
Vault key is used to encrypt/decrypt secret environment variables, it is not synced to the cloud, so users need to save the key themselves.
User could reset the vault key, but this will remove local secret environments in all devices.
Add a new UI in Preferences page for management:
Screenshot 2025-01-07 at 15 54 55

Vault secrets can be used in scripts if user set Enable vault in scripts in settings. (Only allow to get vault secret value, set/unset/clear methods are not allowd)
The pattern is

insomnia.vault.get(<vault_name>)

Tasks

  • Add new UI for secret environment variables
  • Secret environment variables processing logic
    • Mask value unless in editor and request
    • Encryption/Decryption logic
  • Vault key UI
    • New vault key management UI in Preferences modal
    • API integration and SSE event handling
    • Vault key/hash CRUD operations
  • Pre-requset & After-response support
  • Add smoke test

@cwangsmv cwangsmv marked this pull request as draft December 5, 2024 07:08
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch from a546711 to f8cb14d Compare December 9, 2024 08:45
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch 2 times, most recently from b453cd8 to bfb3d55 Compare January 6, 2025 09:10
@cwangsmv cwangsmv marked this pull request as ready for review January 8, 2025 07:22
@cwangsmv cwangsmv requested review from ihexxa and a team January 8, 2025 07:22
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch from 9b384d8 to 3f66590 Compare January 8, 2025 07:28
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch 3 times, most recently from 5ed3dbd to 241dbc4 Compare February 17, 2025 08:46
ihexxa
ihexxa previously approved these changes Feb 17, 2025
Copy link
Contributor

@ihexxa ihexxa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added some minor comments and tend to move forward as there're several rounds review before, but ideally we might still have more tests in the next as it is a relatively huge change.

@@ -51,6 +51,8 @@ export const WorkspaceEnvironmentsEditModal = ({ onClose }: {
}
return false;
}, [selectedEnvironment]);
// Do not allowed to switch to json environment if contains secret item
const allowSwitchEnvironment = !selectedEnvironment?.kvPairData?.some(d => d.type === EnvironmentKvPairDataType.SECRET);
Copy link
Contributor

@ihexxa ihexxa Feb 17, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: Probably need to to auto switch to kv mode for one user has been in the json mode?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I will add in a separate PR and add a test to cover this

@cwangsmv cwangsmv enabled auto-merge (squash) February 17, 2025 10:00
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch from b4430ab to c240e19 Compare February 17, 2025 10:00
@cwangsmv cwangsmv disabled auto-merge February 17, 2025 10:13
2.secret key-value pair ui
2.Add basic integration with AWS
3.Add vault secret cache and config UI
2.add a hook to get user plan
2.AWS secret nunjuckt tag config UI
…lobal environment

2.mask all secret items value when export
@cwangsmv cwangsmv force-pushed the feat/vault-environment branch from c240e19 to c05a95d Compare February 17, 2025 10:14
@cwangsmv cwangsmv merged commit 3abe124 into develop Feb 17, 2025
9 checks passed
@cwangsmv cwangsmv deleted the feat/vault-environment branch February 17, 2025 10:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants