Fix: Add secret referencing (Fixes Issue #18)

ragnarbull commented 8 months ago

Currently the Node SDK doesn't support secret referencing. This PR fixes Issue #18

NESTED_SECRET_1 = ${NESTED_SECRET_2}
NESTED_SECRET_2 = ${NESTED_SECRET_3}
NESTED_SECRET_3 = DEEPLY_NESTED_SECRET

Each of these secrets should resolve to: "DEEPLY_NESTED_SECRET".

PROTOCOL= "https"
HOSTNAME= "www.infisical.com"
FULL_HOST= ${PROTOCOL}://${HOSTNAME}

The FULL_HOST secret should resolve to: "https://www.infisical.com" (ie. a URL).

In a "db-secrets" folder in the "dev" directory:

USERNAME= "admin2023"
PASSWORD= "Supersecret123"
PORT= "4000"
DB_NAME = "dev"

Then in the "dev" directory: MONGO_URL = mongodb://${dev.db-secrets.USERNAME}:${dev.db-secrets.PASSWORD}@${HOSTNAME}:${dev.db-secrets.PORT}/${dev.db-secrets.DB_NAME}

The MONGO_URL secret should resolve to: "mongodb://admin2023:Supersecret123@www.infisical.com:4000/dev" (ie. a Mongo DB connection URI).

A development file (dev.js) is included to assist with creating & fetching secret references. Unit tests have been updated & fix applied for one.

TODO:

Fix getSecret for secret references (WIP) - issue with caching or expandSecrets setup
Fix secret references from other folders & environments (DONE - for getAllSecrets):
Fix support for creating secrets in new folders to allow for seamless unit tests (out-of-scope - another PR)

gitguardian[bot] commented 8 months ago

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

| GitGuardian id | Secret | Commit | Filename | | | -------------- | ------------------------- | ---------------- | --------------- | -------------------- | | [-](https://dashboard.gitguardian.com/incidents/secrets) | MongoDB Credentials | e02898c0f29c80de994f1ce378ab9a4963b8d73c | tests/client/InfisicalClient.test.ts | [View secret](https://github.com/Infisical/infisical-node/commit/e02898c0f29c80de994f1ce378ab9a4963b8d73c#diff-61ca2c64bdc1f9b376c0bc16f40e9387L201) | | [-](https://dashboard.gitguardian.com/incidents/secrets) | MongoDB Credentials | b3e0bdd9aa52e0988357475e82360ca49580fed5 | dev.js | [View secret](https://github.com/Infisical/infisical-node/commit/b3e0bdd9aa52e0988357475e82360ca49580fed5#diff-fef45a639edd03b578f5eaeb0364b587L95) | | [-](https://dashboard.gitguardian.com/incidents/secrets) | MongoDB Credentials | b3e0bdd9aa52e0988357475e82360ca49580fed5 | dev.js | [View secret](https://github.com/Infisical/infisical-node/commit/b3e0bdd9aa52e0988357475e82360ca49580fed5#diff-fef45a639edd03b578f5eaeb0364b587L141) | | [-](https://dashboard.gitguardian.com/incidents/secrets) | MongoDB Credentials | b3e0bdd9aa52e0988357475e82360ca49580fed5 | dev.js | [View secret](https://github.com/Infisical/infisical-node/commit/b3e0bdd9aa52e0988357475e82360ca49580fed5#diff-fef45a639edd03b578f5eaeb0364b587L114) |

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code. 2. Replace and store your secrets safely. [Learn here](https://blog.gitguardian.com/secrets-api-management?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) the best practices. 3. Revoke and [rotate these secrets](https://docs.gitguardian.com/secrets-detection/detectors/specifics/mongo_uri#revoke-the-secret?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). 4. If possible, [rewrite git history](https://blog.gitguardian.com/rewriting-git-history-cheatsheet?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment). Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data. To avoid such incidents in the future consider - following these [best practices](https://blog.gitguardian.com/secrets-api-management/?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) for managing and storing secrets including API keys and other credentials - install [secret detection on pre-commit](https://docs.gitguardian.com/ggshield-docs/integrations/git-hooks/pre-commit?utm_source=product&utm_medium=GitHub_checks&utm_campaign=check_run_comment) to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

Our GitHub checks need improvements? Share your feedbacks!}

devilmark84 commented 8 months ago

Any news about this PR? I would be so nice to have the secret referencing in the node SDK.

ragnarbull commented 8 months ago

Any news about this PR? I would be so nice to have the secret referencing in the node SDK.

hi @devilmark84 the code I've submitted works well for pulling multiple secrets with nested references (like the examples) - feel free to refactor it if you want to fetch a single secret and edit this PR. but I won't be submitting new code to infisical...

ragnarbull commented 8 months ago

@dangtony98 can you fix this PR up so it can be merged pls.

devilmark84 commented 8 months ago

Any news about this PR? I would be so nice to have the secret referencing in the node SDK.

hi @devilmark84 the code I've submitted works well for pulling multiple secrets with nested references (like the examples) - feel free to refactor it if you want to fetch a single secret and edit this PR. but I won't be submitting new code to infisical...

Thank you very much for your work on the code! I'd like to understand what's behind this sentence: "I won't be submitting new code to infisical..."

dangtony98 commented 8 months ago

Will shoot to review/merge this sometime in the next week folks.

devilmark84 commented 8 months ago

Will shoot to review/merge this sometime in the next week folks.

Any news?

dangtony98 commented 8 months ago

@devilmark84 Probably sometime end of week; there's a lot of ongoing development at the moment across the codebase.

devilmark84 commented 7 months ago

@devilmark84 Probably sometime end of week; there's a lot of ongoing development at the moment across the codebase.

Any news? This feature is so important...

Infisical / infisical-node

Fix: Add secret referencing (Fixes Issue #18) #21

⚠️ GitGuardian has uncovered 4 secrets following the scan of your pull request.