fix(ui): add secret approval request role to allow users view CR other than theirs by IgorHorta · Pull Request #5345 · Infisical/infisical

IgorHorta · 2026-02-02T20:09:30Z

Context

Adds SecretApprovalRequest.Read permission that allows users to view all secret approval requests in a project, not just ones where they are committer or approver.

Permission	Access
None (default)	Only requests where user is committer/approver
`SecretApprovalRequest.Read`	All requests in the project

Note: Secret values still respect secret.ReadValue permissions per environment/path. Admins get this permission by default.

Screenshots

Steps to verify the change

Test Case 1: No Permission (Default)

Create a custom role with NO SecretApprovalRequest permissions
Assign role to a test user
Create an approval request with a different user
Expected: Test user only sees requests where they are committer or approver
Expected: Counter only shows their own requests

Test Case 2: Read Permission

Create a custom role with SecretApprovalRequest.Read
Assign role to a test user (also give them Secrets.ReadValue for /dev/ but NOT /prod/)
Create an approval request containing secrets from both /dev/ and /prod/
Expected: Test user sees ALL requests in the list view
Expected: Counter shows ALL requests
Expected: Test user can click and view the request details
Expected: In the details view:
- Secrets from /dev/ have values visible
- Secrets from /prod/ have values masked as <hidden-by-infisical>

Test Case 3: Admin Role

Log in as Admin
Expected: Admin sees all requests and all details (Read permission granted by default)

Test Case 4: Committer/Approver Access (Unchanged)

User A creates an approval request
User B is an approver on the policy
User C has no permissions and is not committer/approver
Expected: User A and B can see the request and its details
Expected: User C cannot see the request at all (unless they have Read permission)

Test Case 5: Mixed Secrets with Different Permissions

Create a role with SecretApprovalRequest.Read + Secrets.ReadValue for /dev/ only
Create an approval request that modifies secrets in both /dev/api/ and /prod/database/
Expected: User can view the request details
Expected:
- Secret in /dev/api/ shows its value
- Secret in /prod/database/ shows value masked as <hidden-by-infisical>

Type

Checklist

Title follows conventional commit format
Tested locally
Updated docs
Read the contributing guide

…t approval requests This adds a new RBAC permission that allows non-admin users to view all secret approval requests in a project. Without this permission, users only see requests where they are the committer or an approver (existing behavior). - Add ProjectPermissionSecretApprovalRequestActions enum with Read action - Add SecretApprovalRequest subject to ProjectPermissionSub - Update secret-approval-request service to check new permission for list/details - Grant permission to Admin role by default - Add UI for permission in role editor (Secret Manager projects only) - Secret values remain filtered by normal secret permissions (secretValueHidden) Co-authored-by: Cursor <cursoragent@cursor.com>

maidul98 · 2026-02-02T20:11:05Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-02-02T20:12:26Z

Greptile Overview

Greptile Summary

Added SecretApprovalRequest.Read permission to allow users to view all secret approval requests in a project, not just ones where they are committer or approver.

Key Changes:

New permission subject secret-approval-request with read action
Admin role receives this permission by default
User access filtering made conditional - bypassed when user has Read permission
Secret values still respect secrets.readValue permissions per environment/path
Frontend UI updated to support configuring this permission in custom roles
Documentation added explaining permission behavior

Security Model:

Project isolation maintained - all queries still filter by projectId
Secret values are controlled by existing secrets.readValue permissions, not overridden by this new permission
Permission only grants visibility to request metadata and details, not automatic access to secret values
Users without permission continue to see only requests where they are committer/approver (existing behavior)

Confidence Score: 5/5

This PR is safe to merge with no critical issues found
The implementation is well-structured with proper security controls: project isolation is maintained, secret values are protected by existing permissions, OR queries are properly grouped, and the permission model is correctly integrated throughout the stack
No files require special attention

Important Files Changed

Filename	Overview
backend/src/ee/services/permission/project-permission.ts	Added new `SecretApprovalRequest` subject and `Read` action to permission system for viewing all approval requests
backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts	Made `userId` optional and extracted user access filter to helper function, properly grouped OR conditions
backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts	Added permission checks to conditionally show all requests vs user-specific requests based on new permission
frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx	Added UI support for configuring `SecretApprovalRequest.Read` permission in role editor, includes fix to skip empty permissions

greptile-apps

_{6 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

backend/src/ee/services/permission/project-permission.ts

IgorHorta · 2026-02-02T21:50:29Z

Didn't add the Describe permission since it would be essentially the same as read.. since read does not allow users to see secret value by default, unless they have permission to see that secret

greptile-apps

_{8 files reviewed, 4 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts

greptile-apps · 2026-02-03T14:18:53Z

Additional Comments (3)

backend/src/ee/services/license/license-fns.ts
[P0] Unrelated on-prem feature flags flipped to true by default

In getDefaultOnPremFeatures, several EE features (e.g. secretApproval, secretRotation, secretAccessInsights, enterpriseSecretSyncs, secretShareExternalBranding) were changed from false to true (e.g. backend/src/ee/services/license/license-fns.ts:55-116). If this function is used as the baseline feature set for unlicensed/default on-prem installs, this would effectively enable paid/enterprise features without an explicit license grant. That’s likely unintended for an RBAC permission PR and could have billing/security implications (features exposed without entitlement).

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts
[P1] Group approvers may lose details-view access due to mismatched approver checks

getSecretApprovals/DAL filtering treats a user as having access if they’re in an approver group (via UserGroupMembership), but the details endpoint gates access with !policy.approvers.find(({ userId }) => userId === actorId) (see backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts:313-320). If a policy approver is defined via group (no direct userId), a legitimate group-based approver could see the request in the list but get a 403 when opening details unless they also have SecretApprovalRequest.Read or are Admin/committer. That inconsistency is user-visible and likely not intended.

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx
[P3] return inside forEach callback is easy to misread

In formRolePermission2API, the new early-exit (if (caslActions.length === 0) return;) only returns from the inner rules.forEach callback (not formRolePermission2API), which is correct but can be misread during maintenance (frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx:1539-1549). Consider using continue-like control via a plain for...of loop, or add a small comment clarifying the intent, to avoid accidental refactors that change behavior.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

Disable various license features including secret access insights, secret approval, secret rotation, enterprise secret syncs, and external branding.

scott-ray-wilson

Functionally this works great! few comments and thoughts

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx

backend/src/ee/services/permission/project-permission.ts

…r non-approvers - Use existing Approval Requests (Read) for listing secret approval requests - Remove SecretApprovalRequest permission; mask diff view by default with eye toggle - Hide Review button for non-approvers; skip permissions with no actions in form Co-authored-by: Cursor <cursoragent@cursor.com>

…licies Co-authored-by: Cursor <cursoragent@cursor.com>

…ants in Secret Manager - Restore ProjectPermissionSub.SecretApprovalRequest with Read action (backend + frontend) - Use SecretApprovalRequest.Read in secret-approval-request-service for list/count/details - Grant SecretApprovalRequest.Read to Admin in default-roles - Add Secret Approval Requests policy to role editor (Secret Manager only) - Filter out Approval Requests and Approval Request Grants from Secret Manager project role UI - Keep hide Review button for non-approvers (unchanged) Co-authored-by: Cursor <cursoragent@cursor.com>

- Document secret-approval-request subject (Read action, Secret Manager only) - Fix note under secret-approval to reference secret-approval-request instead of approval-requests Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/internals/permissions/project-permissions.mdx

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx

...pprovalsPage/components/SecretApprovalRequest/components/SecretApprovalRequestChangeItem.tsx

scott-ray-wilson

LGTM, tested permission behavior with outlined scenarios

IgorHorta and others added 2 commits February 2, 2026 16:05

fix: issue with updating read value

1a87f2d

greptile-apps bot reviewed Feb 2, 2026

View reviewed changes

backend/src/ee/services/permission/project-permission.ts Show resolved Hide resolved

IgorHorta added 2 commits February 2, 2026 18:09

support describe and read for secret approval

5035980

fix: removing describe since it would be the same as read

cc89fc0

IgorHorta changed the title ~~Igor/secrets 72 view all approval change requests if part of project~~ fix(ui): add secret approval request role to allow users view CR other than theirs Feb 2, 2026

IgorHorta marked this pull request as draft February 3, 2026 14:13

IgorHorta marked this pull request as ready for review February 3, 2026 14:13

greptile-apps bot reviewed Feb 3, 2026

View reviewed changes

backend/src/ee/services/secret-approval-request/secret-approval-request-dal.ts Show resolved Hide resolved

IgorHorta and others added 2 commits February 3, 2026 11:19

Disable multiple license features

716bcbe

Disable various license features including secret access insights, secret approval, secret rotation, enterprise secret syncs, and external branding.

fix: lint

65b0f1d

IgorHorta marked this pull request as draft February 3, 2026 16:50

IgorHorta marked this pull request as ready for review February 3, 2026 16:51

scott-ray-wilson requested changes Feb 4, 2026

View reviewed changes

IgorHorta requested a review from scott-ray-wilson February 4, 2026 15:11

IgorHorta and others added 5 commits February 4, 2026 12:20

Hide ApprovalRequests Create action in Secret Manager project role po…

b8c9b78

…licies Co-authored-by: Cursor <cursoragent@cursor.com>

docs: update project-permissions for Secret Approval Requests

9249fb8

- Document secret-approval-request subject (Read action, Secret Manager only) - Fix note under secret-approval to reference secret-approval-request instead of approval-requests Co-authored-by: Cursor <cursoragent@cursor.com>

Remove unused hiddenActions prop from GeneralPermissionPolicies

b07a29a

Co-authored-by: Cursor <cursoragent@cursor.com>

fix: import error

49ddbdc

IgorHorta requested a review from maidul98 February 4, 2026 17:37

scott-ray-wilson requested changes Feb 4, 2026

View reviewed changes

fix: address pr review

48a7950

IgorHorta requested a review from scott-ray-wilson February 4, 2026 21:25

fix: addressing code review concerns

356254f

scott-ray-wilson approved these changes Feb 4, 2026

View reviewed changes

IgorHorta merged commit 40fc3ba into main Feb 4, 2026
12 checks passed

Conversation

IgorHorta commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Test Case 1: No Permission (Default)

Test Case 2: Read Permission

Test Case 3: Admin Role

Test Case 4: Committer/Approver Access (Unchanged)

Test Case 5: Mixed Secrets with Different Permissions

Type

Checklist

Uh oh!

maidul98 commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Feb 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

IgorHorta commented Feb 2, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot commented Feb 3, 2026

Uh oh!

scott-ray-wilson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

scott-ray-wilson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

IgorHorta commented Feb 2, 2026 •

edited

Loading

maidul98 commented Feb 2, 2026 •

edited

Loading

greptile-apps bot commented Feb 2, 2026 •

edited

Loading