From 34366a47b5e9128730f2fe38eae3a5556c3fd433 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 9 Oct 2026 08:30:00 +0200
Subject: [PATCH] fix(infisical): expand secret references when fetching
 secrets

Older Infisical versions default expandSecretReferences to false, so
values like prefix-${OTHER_KEY} reached containers unexpanded. Request
expanded values explicitly on the v4 endpoint and the v3 fallback.

Fixes #12128
---
 app/Services/InfisicalService.php                          | 4 ++++
 tests/Feature/SecretManagers/SecretManagerServicesTest.php | 7 +++++--
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/app/Services/InfisicalService.php b/app/Services/InfisicalService.php
index 06f1e5d49f..1d3e87e48c 100644
--- a/app/Services/InfisicalService.php
+++ b/app/Services/InfisicalService.php
@@ -39,11 +39,14 @@ class InfisicalService
     {
         $client = $this->client()->withToken($this->login());
         $secretPath = $secretPath ?: '/';
+        // Older Infisical versions do not expand ${KEY} references unless asked to.
+        $valueOptions = ['expandSecretReferences' => 'true', 'viewSecretValue' => 'true'];
 
         $response = $client->get($this->baseUrl.'/api/v4/secrets', [
             'projectId' => $projectId,
             'environment' => $environment,
             'secretPath' => $secretPath,
+            ...$valueOptions,
         ]);
 
         // Older self-hosted instances only expose the v3 endpoint.
@@ -52,6 +55,7 @@ class InfisicalService
                 'workspaceId' => $projectId,
                 'environment' => $environment,
                 'secretPath' => $secretPath,
+                ...$valueOptions,
             ]);
         }
 
diff --git a/tests/Feature/SecretManagers/SecretManagerServicesTest.php b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
index c4e4df36b7..f6a2c34ac3 100644
--- a/tests/Feature/SecretManagers/SecretManagerServicesTest.php
+++ b/tests/Feature/SecretManagers/SecretManagerServicesTest.php
@@ -99,7 +99,9 @@ describe('InfisicalService', function () {
 
         Http::assertSent(fn ($request) => str_contains($request->url(), '/api/v4/secrets')
             && $request->hasHeader('Authorization', 'Bearer short-lived-token')
-            && str_contains($request->url(), 'projectId=project-1'));
+            && str_contains($request->url(), 'projectId=project-1')
+            && $request['expandSecretReferences'] === 'true'
+            && $request['viewSecretValue'] === 'true');
     });
 
     test('falls back to the v3 raw endpoint on older self-hosted instances', function () {
@@ -119,7 +121,8 @@ describe('InfisicalService', function () {
 
         expect($service->fetchSecrets('project-1', 'prod'))->toBe(['LEGACY_KEY' => 'legacy-value']);
 
-        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1'));
+        Http::assertSent(fn ($request) => str_contains($request->url(), 'workspaceId=project-1')
+            && $request['expandSecretReferences'] === 'true');
     });
 
     test('throws when the login fails', function () {