Remove Vault Secrets page from admin interface (#18795)
This commit is contained in:
Fernando Valverde
GitHub
parent
99f04b9119
commit
6b920acd2c
6 changed files with 0 additions and 142 deletions
|
|
@ -1,41 +0,0 @@
|
|||
module Admin
|
||||
class SecretsController < Admin::ApplicationController
|
||||
layout "admin"
|
||||
|
||||
before_action :validate_settable_secret, only: [:update]
|
||||
after_action only: [:update] do
|
||||
Audit::Logger.log(:internal, current_user, params.dup)
|
||||
end
|
||||
|
||||
def index
|
||||
@vault_enabled = AppSecrets.vault_enabled?
|
||||
@secrets = AppSecrets::SETTABLE_SECRETS.map do |key|
|
||||
secret_value = AppSecrets[key]
|
||||
secret_value = if secret_value.present?
|
||||
I18n.t("admin.secrets_controller.value",
|
||||
first8: secret_value.first(8))
|
||||
else
|
||||
I18n.t("admin.secrets_controller.not_in_vault")
|
||||
end
|
||||
[key, secret_value]
|
||||
end
|
||||
end
|
||||
|
||||
def update
|
||||
AppSecrets[params[:key_name]] = params[:key_value]
|
||||
|
||||
flash[:success] =
|
||||
I18n.t("admin.secrets_controller.updated", key: params[:key_name])
|
||||
redirect_to admin_secrets_path
|
||||
end
|
||||
|
||||
private
|
||||
|
||||
def validate_settable_secret
|
||||
update_param = params.permit(*AppSecrets::SETTABLE_SECRETS)
|
||||
params[:key_name], params[:key_value] = update_param.to_h.to_a.first
|
||||
|
||||
bad_request unless update_param.present? && params[:key_name].is_a?(String) && params[:key_value].is_a?(String)
|
||||
end
|
||||
end
|
||||
end
|
||||
|
|
@ -1,10 +1,4 @@
|
|||
class AppSecrets
|
||||
SETTABLE_SECRETS = %w[
|
||||
SLACK_CHANNEL
|
||||
SLACK_DEPLOY_CHANNEL
|
||||
SLACK_WEBHOOK_URL
|
||||
].freeze
|
||||
|
||||
def self.[](key)
|
||||
result = Vault.kv(namespace).read(key)&.data&.fetch(:value) if vault_enabled?
|
||||
result ||= ApplicationConfig[key]
|
||||
|
|
|
|||
|
|
@ -48,7 +48,6 @@ class AdminMenu
|
|||
item(name: "response templates"),
|
||||
item(name: "developer tools", controller: "tools", children: [
|
||||
item(name: "tools"),
|
||||
item(name: "vault secrets", controller: "secrets"),
|
||||
item(name: "data update scripts", visible: -> { FeatureFlag.enabled?(:data_update_scripts) }),
|
||||
item(name: "extensions", controller: "extensions"),
|
||||
]),
|
||||
|
|
|
|||
|
|
@ -1,28 +0,0 @@
|
|||
<% unless @vault_enabled %>
|
||||
<div class="crayons-notice crayons-notice--info mb-6" role="alert">
|
||||
<p>
|
||||
Vault is not currently setup for your application. This means your secrets are being stored as ENV variables and cannot be updated here. To update them you will need to update the appropriate files in your environment.
|
||||
</p>
|
||||
</div>
|
||||
<% end %>
|
||||
|
||||
<table class="crayons-table" width="100%">
|
||||
<thead>
|
||||
<tr>
|
||||
<th scope="col">Secret Name</th>
|
||||
<th scope="col">Secret Value</th>
|
||||
<th scope="col">Action</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody class="crayons-card">
|
||||
<% @secrets.each do |key, partial_value| %>
|
||||
<tr>
|
||||
<%= form_with(url: admin_secrets_path, method: "PUT", local: true) do %>
|
||||
<td><%= label_tag key, key %></td>
|
||||
<td><%= text_field_tag key, partial_value %></td>
|
||||
<td><%= submit_tag("Update", data: { confirm: "My username is @#{current_user.username} and I want to update this Vault Secret." }, disabled: !@vault_enabled) %></td>
|
||||
<% end %>
|
||||
</tr>
|
||||
<% end %>
|
||||
</tbody>
|
||||
</table>
|
||||
|
|
@ -127,8 +127,6 @@ namespace :admin do
|
|||
scope :advanced do
|
||||
resources :broadcasts
|
||||
resources :response_templates, only: %i[index new edit create update destroy]
|
||||
resources :secrets, only: %i[index]
|
||||
put "secrets", to: "secrets#update"
|
||||
resources :tools, only: %i[index create] do
|
||||
collection do
|
||||
post "bust_cache"
|
||||
|
|
|
|||
|
|
@ -1,64 +0,0 @@
|
|||
require "rails_helper"
|
||||
|
||||
RSpec.describe "/admin/advanced/secrets", type: :request do
|
||||
before do
|
||||
allow(AppSecrets).to receive(:vault_enabled?).and_return(true)
|
||||
allow(AppSecrets).to receive(:[]=)
|
||||
end
|
||||
|
||||
context "when the user is not an admin" do
|
||||
it "blocks the request" do
|
||||
user = create(:user)
|
||||
sign_in user
|
||||
|
||||
expect do
|
||||
get admin_secrets_path
|
||||
end.to raise_error(Pundit::NotAuthorizedError)
|
||||
end
|
||||
end
|
||||
|
||||
context "when the user is an admin" do
|
||||
let(:admin) { create(:user, :admin) }
|
||||
|
||||
before { sign_in admin }
|
||||
|
||||
describe "GET /admin/advanced/secrets" do
|
||||
it "renders with status 200" do
|
||||
get admin_secrets_path
|
||||
expect(response).to have_http_status :ok
|
||||
end
|
||||
|
||||
it "displays an alert when Vault is not enabled" do
|
||||
allow(AppSecrets).to receive(:vault_enabled?).and_return(false)
|
||||
get admin_secrets_path
|
||||
expect(response.body).to include("Vault is not currently setup for your application")
|
||||
end
|
||||
end
|
||||
|
||||
describe "PUT /admin/advanced/secrets" do
|
||||
let(:valid_secret) { AppSecrets::SETTABLE_SECRETS.first }
|
||||
let(:valid_params) { { valid_secret => "SECRET_VALUE" } }
|
||||
|
||||
it "successfully sets a secret and shows flash message" do
|
||||
allow(AppSecrets).to receive(:[]=)
|
||||
put admin_secrets_path, params: valid_params
|
||||
expect(response).to have_http_status :found
|
||||
expect(AppSecrets).to have_received(:[]=).with(valid_secret, "SECRET_VALUE")
|
||||
expect(flash[:success]).to include("Secret #{valid_secret} was successfully updated in Vault")
|
||||
end
|
||||
|
||||
it "returns a bad_request with invalid params" do
|
||||
put admin_secrets_path, params: {}
|
||||
expect(response).to have_http_status :bad_request
|
||||
end
|
||||
|
||||
it "creates an audit log" do
|
||||
Audit::Subscribe.listen :internal
|
||||
expect do
|
||||
put admin_secrets_path, params: valid_params
|
||||
end.to change(AuditLog, :count).by(1)
|
||||
Audit::Subscribe.forget :internal
|
||||
end
|
||||
end
|
||||
end
|
||||
end
|
||||
Loading…
Add table
Reference in a new issue