starred/coolify
1
0
Fork 0
mirror of https://github.com/coollabsio/coolify.git synced 2026-11-12 15:53:46 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(infisical): expand secret references when fetching secrets

Browse Source 
Older Infisical versions default expandSecretReferences to false, so
values like prefix-${OTHER_KEY} reached containers unexpanded. Request
expanded values explicitly on the v4 endpoint and the v3 fallback.

Fixes #12128
This commit is contained in:
Andras Bacsai
2026-10-09 08:30:00 +02:00
parent 065d4825d3
commit 34366a47b5
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Services/InfisicalService.php
+4
View File
@@ -39,11 +39,14 @@ class InfisicalService
{
$client = $this->client()->withToken($this->login());
$secretPath = $secretPath ?: '/';
// Older Infisical versions do not expand ${KEY} references unless asked to.
$valueOptions = ['expandSecretReferences' => 'true', 'viewSecretValue' => 'true'];
$response = $client->get($this->baseUrl.'/api/v4/secrets', [
'projectId' => $projectId,
'environment' => $environment,
'secretPath' => $secretPath,
...$valueOptions,
]);
// Older self-hosted instances only expose the v3 endpoint.
@@ -52,6 +55,7 @@ class InfisicalService
'workspaceId' => $projectId,
'environment' => $environment,
'secretPath' => $secretPath,
...$valueOptions,
]);
}
tests/Feature/SecretManagers/SecretManagerServicesTest.php
+5 -2
View File
@@ -99,7 +99,9 @@ describe('InfisicalService', function () {
Http::assertSent(fn ($request) => str_contains($request->url(), '/api/v4/secrets')
&& $request->hasHeader('Authorization', 'Bearer short-lived-token')
&& str_contains($request->url(), 'projectId=project-1'));
&& str_contains($request->url(), 'projectId=project-1')
&& $request['expandSecretReferences'] === 'true'
&& $request['viewSecretValue'] === 'true');
});
test('falls back to the v3 raw endpoint on older self-hosted instances', function () {
@@ -119,7 +121,8 @@ describe('InfisicalService', function () {
expect($service->fetchSecrets('project-1', 'prod'))->toBe(['LEGACY_KEY' => 'legacy-value']);
Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1'));
Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1')
&& $request['expandSecretReferences'] === 'true');
});
test('throws when the login fails', function () {