fix: v4 api and improvements to list and get methods

varonix0 · varonix0 · commit 3bd77863a448 · 2026-07-19T22:06:27.000+04:00
diff --git a/README.md b/README.md
@@ -52,6 +52,12 @@ client.auth.access_token("existing-access-token")
 
 ```ruby
 client.secrets.list(project_id: "...", environment: "dev", secret_path: "/")
+
+# Imported secrets are folded in by default; pass include_imports: false to
+# opt out. Recursive mode collapses duplicate keys across folders to one
+# secret per key unless skip_unique_validation: true is passed.
+client.secrets.list(project_id: "...", environment: "dev", recursive: true)
+
 client.secrets.get("DATABASE_URL", project_id: "...", environment: "dev")
 client.secrets.create("DATABASE_URL", "postgres://...", project_id: "...", environment: "dev")
 client.secrets.update("DATABASE_URL", project_id: "...", environment: "dev", secret_value: "postgres://...")
diff --git a/lib/infisical/secrets.rb b/lib/infisical/secrets.rb
@@ -5,40 +5,40 @@
 require_relative "models/secret"
 
 module Infisical
-  # CRUD operations against Infisical's raw secrets API.
+  # CRUD operations against Infisical's v4 secrets API.
   class Secrets
-    BASE_PATH = "api/v3/secrets/raw"
+    BASE_PATH = "api/v4/secrets"
 
     def initialize(http_client)
       @http_client = http_client
     end
 
-    def list(project_id:, environment:, secret_path: "/", expand_secret_references: true,
-             include_imports: false, recursive: false)
+    def list(project_id:, environment:, secret_path: "/", include_imports: true, recursive: false,
+             skip_unique_validation: false)
       response = @http_client.get(
         BASE_PATH,
         params: {
-          workspaceId: project_id,
+          projectId: project_id,
           environment: environment,
           secretPath: secret_path,
-          expandSecretReferences: expand_secret_references,
           includeImports: include_imports,
           recursive: recursive
         }
       )
 
-      Array(response["secrets"]).map { |secret| Models::Secret.from_api(secret) }
+      secrets = Array(response["secrets"]).map { |secret| Models::Secret.from_api(secret) }
+      secrets = ensure_unique_secrets_by_key(secrets, skip_unique_validation) if recursive
+      secrets = merge_imported_secrets(secrets, response["imports"]) if include_imports
+      secrets.sort_by(&:secret_key)
     end
 
-    def get(secret_name, project_id:, environment:, secret_path: "/",
-            expand_secret_references: true, include_imports: false)
+    def get(secret_name, project_id:, environment:, secret_path: "/", include_imports: true)
       response = @http_client.get(
         secret_path_for(secret_name),
         params: {
-          workspaceId: project_id,
+          projectId: project_id,
           environment: environment,
           secretPath: secret_path,
-          expandSecretReferences: expand_secret_references,
           includeImports: include_imports
         }
       )
@@ -50,7 +50,7 @@ def create(secret_name, secret_value, project_id:, environment:, secret_path: "/
       response = @http_client.post(
         secret_path_for(secret_name),
         body: {
-          workspaceId: project_id,
+          projectId: project_id,
           environment: environment,
           secretPath: secret_path,
           secretValue: secret_value,
@@ -69,7 +69,7 @@ def update(secret_name, project_id:, environment:, secret_value: nil, new_secret
       response = @http_client.patch(
         secret_path_for(secret_name),
         body: {
-          workspaceId: project_id,
+          projectId: project_id,
           environment: environment,
           secretPath: secret_path,
           secretValue: secret_value,
@@ -84,7 +84,7 @@ def delete(secret_name, project_id:, environment:, secret_path: "/")
       response = @http_client.delete(
         secret_path_for(secret_name),
         body: {
-          workspaceId: project_id,
+          projectId: project_id,
           environment: environment,
           secretPath: secret_path
         }
@@ -95,6 +95,37 @@ def delete(secret_name, project_id:, environment:, secret_path: "/")
 
     private
 
+    # In recursive mode the same key can exist at several paths; collapse to
+    # one secret per key (the last occurrence wins). With
+    # skip_unique_validation, secrets are instead kept unique per
+    # path+key, so same-named secrets at different paths all survive.
+    def ensure_unique_secrets_by_key(secrets, skip_unique_validation)
+      secrets.each_with_object({}) do |secret, by_key|
+        key = skip_unique_validation ? "#{secret.secret_path}:#{secret.secret_key}" : secret.secret_key
+        by_key[key] = secret
+      end.values
+    end
+
+    # Folds secrets from import blocks into the main list. Secrets already
+    # present win over imports, and earlier import blocks win over later
+    # ones.
+    def merge_imported_secrets(secrets, import_blocks)
+      merged = secrets.dup
+      seen = merged.to_h { |secret| [secret.secret_key, true] }
+
+      Array(import_blocks).each do |block|
+        Array(block["secrets"]).each do |data|
+          secret = Models::Secret.from_api(data)
+          next if seen[secret.secret_key]
+
+          seen[secret.secret_key] = true
+          merged << secret
+        end
+      end
+
+      merged
+    end
+
     # Escapes a secret name for safe use as a single URI path segment, so
     # names containing "/", "?", "#", or "%" can't be misread as path
     # separators or query-string tokens.
diff --git a/spec/infisical/secrets_spec.rb b/spec/infisical/secrets_spec.rb
@@ -5,29 +5,100 @@
   let(:http_client) { Infisical::HTTPClient.new(base_url: base_url, sleeper: ->(_seconds) {}) }
   let(:secrets) { described_class.new(http_client) }
 
+  def secret_payload(key, value: "v", path: "/")
+    { id: key.downcase, secretKey: key, secretValue: value, secretPath: path, version: 1, type: "shared" }
+  end
+
   describe "#list" do
-    it "lists secrets for a project/environment" do
-      stub_request(:get, "#{base_url}/api/v3/secrets/raw")
-        .with(query: hash_including("workspaceId" => "proj-1", "environment" => "dev"))
+    it "lists secrets for a project/environment, sorted by key" do
+      stub_request(:get, "#{base_url}/api/v4/secrets")
+        .with(query: hash_including("projectId" => "proj-1", "environment" => "dev",
+                                    "includeImports" => "true", "recursive" => "false"))
         .to_return(
           status: 200,
-          body: { secrets: [{ id: "1", workspace: "proj-1", environment: "dev", secretKey: "FOO",
-                              secretValue: "bar", secretPath: "/", version: 1, type: "shared" }] }.to_json
+          body: { secrets: [secret_payload("FOO", value: "bar"), secret_payload("BAR")] }.to_json
         )
 
       result = secrets.list(project_id: "proj-1", environment: "dev")
 
-      expect(result.size).to eq(1)
-      expect(result.first).to be_a(Infisical::Models::Secret)
-      expect(result.first.secret_key).to eq("FOO")
-      expect(result.first.secret_value).to eq("bar")
+      expect(result.map(&:secret_key)).to eq(%w[BAR FOO])
+      expect(result).to all(be_a(Infisical::Models::Secret))
+      expect(result.last.secret_value).to eq("bar")
+    end
+
+    it "does not send expandSecretReferences (the v4 API defaults it to true)" do
+      stub = stub_request(:get, "#{base_url}/api/v4/secrets")
+             .with(query: hash_excluding("expandSecretReferences"))
+             .to_return(status: 200, body: { secrets: [] }.to_json)
+
+      secrets.list(project_id: "proj-1", environment: "dev")
+
+      expect(stub).to have_been_requested
+    end
+
+    context "when recursive" do
+      it "collapses duplicate keys from different paths, keeping the last occurrence" do
+        stub_request(:get, "#{base_url}/api/v4/secrets")
+          .with(query: hash_including("recursive" => "true"))
+          .to_return(
+            status: 200,
+            body: { secrets: [secret_payload("FOO", value: "root", path: "/"),
+                              secret_payload("FOO", value: "nested", path: "/app"),
+                              secret_payload("BAR")] }.to_json
+          )
+
+        result = secrets.list(project_id: "proj-1", environment: "dev", recursive: true)
+
+        expect(result.map(&:secret_key)).to eq(%w[BAR FOO])
+        expect(result.last.secret_value).to eq("nested")
+      end
+
+      it "keeps same-named secrets from different paths with skip_unique_validation" do
+        stub_request(:get, "#{base_url}/api/v4/secrets")
+          .with(query: hash_including("recursive" => "true"))
+          .to_return(
+            status: 200,
+            body: { secrets: [secret_payload("FOO", value: "root", path: "/"),
+                              secret_payload("FOO", value: "nested", path: "/app")] }.to_json
+          )
+
+        result = secrets.list(project_id: "proj-1", environment: "dev",
+                              recursive: true, skip_unique_validation: true)
+
+        expect(result.map(&:secret_value)).to contain_exactly("root", "nested")
+      end
+    end
+
+    context "when include_imports" do
+      it "appends imported secrets, with direct secrets taking precedence on key conflicts" do
+        stub_request(:get, "#{base_url}/api/v4/secrets")
+          .with(query: hash_including("includeImports" => "true"))
+          .to_return(
+            status: 200,
+            body: {
+              secrets: [secret_payload("FOO", value: "direct")],
+              imports: [
+                { secretPath: "/shared", environment: "dev",
+                  secrets: [secret_payload("FOO", value: "imported"), secret_payload("DB_URL")] },
+                { secretPath: "/other", environment: "dev",
+                  secrets: [secret_payload("DB_URL", value: "later-import")] }
+              ]
+            }.to_json
+          )
+
+        result = secrets.list(project_id: "proj-1", environment: "dev", include_imports: true)
+
+        expect(result.map(&:secret_key)).to eq(%w[DB_URL FOO])
+        expect(result.find { |s| s.secret_key == "FOO" }.secret_value).to eq("direct")
+        expect(result.find { |s| s.secret_key == "DB_URL" }.secret_value).to eq("v")
+      end
     end
   end
 
   describe "#get" do
     it "fetches a single secret by name" do
-      stub_request(:get, "#{base_url}/api/v3/secrets/raw/FOO")
-        .with(query: hash_including("workspaceId" => "proj-1", "environment" => "dev"))
+      stub_request(:get, "#{base_url}/api/v4/secrets/FOO")
+        .with(query: hash_including("projectId" => "proj-1", "environment" => "dev"))
         .to_return(status: 200, body: { secret: { id: "1", secretKey: "FOO", secretValue: "bar" } }.to_json)
 
       secret = secrets.get("FOO", project_id: "proj-1", environment: "dev")
@@ -37,8 +108,8 @@
     end
 
     it "URL-encodes secret names containing reserved characters" do
-      stub = stub_request(:get, "#{base_url}/api/v3/secrets/raw/FOO%2FBAR")
-             .with(query: hash_including("workspaceId" => "proj-1"))
+      stub = stub_request(:get, "#{base_url}/api/v4/secrets/FOO%2FBAR")
+             .with(query: hash_including("projectId" => "proj-1"))
              .to_return(status: 200, body: { secret: { id: "1", secretKey: "FOO/BAR" } }.to_json)
 
       secrets.get("FOO/BAR", project_id: "proj-1", environment: "dev")
@@ -49,8 +120,8 @@
 
   describe "#create" do
     it "creates a secret with the given value" do
-      stub = stub_request(:post, "#{base_url}/api/v3/secrets/raw/FOO")
-             .with(body: hash_including("workspaceId" => "proj-1", "environment" => "dev", "secretValue" => "bar"))
+      stub = stub_request(:post, "#{base_url}/api/v4/secrets/FOO")
+             .with(body: hash_including("projectId" => "proj-1", "environment" => "dev", "secretValue" => "bar"))
              .to_return(status: 200, body: { secret: { id: "1", secretKey: "FOO", secretValue: "bar" } }.to_json)
 
       secret = secrets.create("FOO", "bar", project_id: "proj-1", environment: "dev")
@@ -62,8 +133,8 @@
 
   describe "#update" do
     it "updates a secret's value" do
-      stub = stub_request(:patch, "#{base_url}/api/v3/secrets/raw/FOO")
-             .with(body: hash_including("secretValue" => "new-val"))
+      stub = stub_request(:patch, "#{base_url}/api/v4/secrets/FOO")
+             .with(body: hash_including("projectId" => "proj-1", "secretValue" => "new-val"))
              .to_return(status: 200, body: { secret: { id: "1", secretKey: "FOO", secretValue: "new-val" } }.to_json)
 
       secret = secrets.update("FOO", project_id: "proj-1", environment: "dev", secret_value: "new-val")
@@ -73,7 +144,7 @@
     end
 
     it "supports renaming via new_secret_name" do
-      stub = stub_request(:patch, "#{base_url}/api/v3/secrets/raw/FOO")
+      stub = stub_request(:patch, "#{base_url}/api/v4/secrets/FOO")
              .with(body: hash_including("newSecretName" => "BAR"))
              .to_return(status: 200, body: { secret: { id: "1", secretKey: "BAR" } }.to_json)
 
@@ -90,8 +161,8 @@
 
   describe "#delete" do
     it "deletes a secret by name" do
-      stub = stub_request(:delete, "#{base_url}/api/v3/secrets/raw/FOO")
-             .with(body: hash_including("workspaceId" => "proj-1", "environment" => "dev"))
+      stub = stub_request(:delete, "#{base_url}/api/v4/secrets/FOO")
+             .with(body: hash_including("projectId" => "proj-1", "environment" => "dev"))
              .to_return(status: 200, body: { secret: { id: "1", secretKey: "FOO" } }.to_json)
 
       secret = secrets.delete("FOO", project_id: "proj-1", environment: "dev")
