feat(permissions): folder rbac - #7762
Merged
Merged
Conversation
… that have folder rbac permissions
…w if an action is available
…ect admin verification for folder rbac on permissions
…ere is a RBAC permission on the folder
|
💬 Discussion in Slack: #pr-review-infisical-7762-feat-permissions-folder-rbac Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel. |
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 9387832 | Triggered | Generic Password | e1776a6 | backend/scripts/dev-folder-rbac.ts | View secret |
| 35864000 | Triggered | Generic High Entropy Secret | 86b3337 | backend/e2e-test/routes/v1/oauth-token-exchange.spec.ts | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secrets safely. Learn here the best practices.
- Revoke and rotate these secrets.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Contributor
|
| Filename | Overview |
|---|---|
| backend/src/ee/services/permission/permission-service.ts | Integrates folder-scoped grants into project permission construction and adds version-fingerprint caching for resolved folder privileges. |
| backend/src/ee/services/permission/permission-fns.ts | Builds exact-path deny-and-allow replacement rules and computes normalized folder privilege fingerprints. |
| backend/src/ee/services/permission/folder-roles.ts | Defines the folder access tiers and their explicit Secret Manager permission sets. |
| backend/src/services/folder-permission/folder-permission-service.ts | Implements validated folder grant CRUD with administrator eligibility and temporary full-access protections. |
| backend/src/services/folder-permission/folder-permission-dal.ts | Adds persistence and roster queries for user- and identity-scoped folder privileges. |
| backend/src/server/routes/v1/project-membership-router.ts | Exposes folder-access management and roster endpoints for project users. |
| backend/src/server/routes/v1/identity-project-membership-router.ts | Exposes equivalent folder-access management and roster endpoints for project identities. |
| backend/src/services/secret-folder/secret-folder-service.ts | Connects folder lifecycle operations to folder-permission cache invalidation. |
| backend/src/db/migrations/20260817120000_folder-scoped-additional-privileges.ts | Extends additional privileges with folder scope and role data needed by folder RBAC. |
| frontend/src/pages/secret-manager/OverviewPage/components/FolderAccessSheet/FolderAccessSheet.tsx | Adds the Secret Manager folder-access roster and management workflow. |
| frontend/src/pages/project/components/FolderAccessSection/FolderAccessSection.tsx | Adds folder-access visibility and editing to project member and identity details. |
| backend/e2e-test/routes/v2/secret-folder-rbac.spec.ts | Exercises folder-tier authorization across Secret Manager resources and folder operations. |
Reviews (2): Last reviewed commit: "fix lint" | Re-trigger Greptile
Contributor
PR overviewAll previously flagged issues have been addressed. No open security concerns remain on this pull request. Security reviewNo open security issues remain on this pull request. Fixed/addressed: 9 · PR risk: 0/10 |
Contributor
API changesThe breaking changes reported earlier are resolved as of |
…cal into feat/adilsitos/eng-5532
…l/infisical into feat/adilsitos/eng-5532
akhilmhdh
requested changes
Aug 26, 2026
Member
There was a problem hiding this comment.
One small confusion in folder permission. Let's catch up on that.
akhilmhdh
reviewed
Aug 27, 2026
akhilmhdh
approved these changes
Aug 27, 2026
varonix0
approved these changes
Aug 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Context
This introduces a new permission into the system, the RBAC for folders. More info on the design doc.
Screenshots
Steps to verify the change
There are several scenarios, so my recommendation is to create a folder with: secrets, dynamic secrets, rotations, imports and (if you want) honey tokens. Use an account which is project admin and another account that you can keep changing their permissions, so it is easier to validate how the permissions are being evaluated.
Scenario 1: The user has folder RBAC permission in two different folders
Scenario 2: Check the cache is working correctly
DEBUG=knex:queryon the .env)Scenario 3: Delete folders with RBAC as a member user
Scenario 4: Move folders with RBAC as a member user
Scenario 5: Project admins don't show on the rbac sheet
Scenario 6: Check all the defined permissions defined
Scenario 7: define a temporary full access.
Scenario 8: user has folder RBAC permission and become project admin
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).