Allow specifying allowedSecrets section to whitelist

Author: pantherman594

src/vscode-secrets/secrets.yml

@@ -1,3 +1,8 @@
 secrets:
   - name: "example-secret"
     valueVar: "EXAMPLE_SECRET"
+    # Optional: restrict which secret resources can be attached for this name.
+    # If omitted, any attached secret with this name is accepted.
+    # allowedSecrets:
+    #   - workspaceId: "workspace-uuid"
+    #     resourceId: "secret-resource-uuid"

startupscript/butane/055-provide-secrets.sh

@@ -158,6 +158,8 @@ for i in $(seq 0 $((PIPE_SECRET_COUNT - 1))); do
     exit 1
   fi
 
+  validate_allowed_secret "${SECRET_ENTRY}" "${SECRET_WORKSPACE_ID}" "${SECRET_RESOURCE_ID}"
+
   echo "Retrieving secret: ${SECRET_NAME}"
 
   { set +o xtrace; } 2>/dev/null

startupscript/butane/docker-credential-secrets.sh

@@ -56,15 +56,17 @@ if [[ ! -f "${SECRETS_JSON}" ]]; then
   exit 1
 fi
 
-secret_name="$(jq -r --arg registry "${registry_hostname}" \
-  '.[] | select(.dockerRegistry == $registry) | .name' \
-  "${SECRETS_JSON}" | head -1)"
+secret_entry="$(jq --arg registry "${registry_hostname}" \
+  '.[] | select(.dockerRegistry == $registry)' \
+  "${SECRETS_JSON}")"
 
-if [[ -z "${secret_name}" ]]; then
+if [[ -z "${secret_entry}" || "${secret_entry}" == "null" ]]; then
   echo "Error: No secret configured for registry ${registry_hostname}" >&2
   exit 1
 fi
 
+secret_name="$(echo "${secret_entry}" | jq -r '.name')"
+
 # shellcheck source=/dev/null
 source /home/core/metadata-utils.sh
 # shellcheck source=/dev/null
@@ -115,6 +117,8 @@ if [[ -z "${secret_workspace_id}" || "${secret_workspace_id}" == "null" || \
   exit 1
 fi
 
+validate_allowed_secret "${secret_entry}" "${secret_workspace_id}" "${secret_resource_id}"
+
 credential="$(retrieve_secret TOKEN "${WSM_URL}" "${RESOURCE_ID}" "${KEY_FILE}" \
   "${secret_workspace_id}" "${secret_resource_id}")"
 

startupscript/butane/secret-utils.sh

@@ -96,3 +96,37 @@ function retrieve_secret() {
   echo -n "${secret_value_b64}" | base64 -d
 }
 readonly -f retrieve_secret
+
+# Validates that an attached secret is permitted by the entry's allowedSecrets list.
+# No-op if allowedSecrets is not specified in the entry.
+# Args:
+#   $1 - secret entry JSON (from secrets.json)
+#   $2 - workspace ID of the attached secret
+#   $3 - resource ID of the attached secret
+# Returns: 0 if allowed (or no restriction), 1 if not allowed
+function validate_allowed_secret() {
+  local secret_entry="$1"
+  local workspace_id="$2"
+  local resource_id="$3"
+
+  local allowed_secrets
+  allowed_secrets="$(echo "${secret_entry}" | jq '.allowedSecrets // empty')"
+
+  if [[ -z "${allowed_secrets}" ]]; then
+    return 0
+  fi
+
+  local match
+  match="$(echo "${allowed_secrets}" | jq -e \
+    --arg wid "${workspace_id}" \
+    --arg rid "${resource_id}" \
+    '[.[] | select(.workspaceId == $wid and .resourceId == $rid)] | length > 0')"
+
+  if [[ "${match}" != "true" ]]; then
+    local secret_name
+    secret_name="$(echo "${secret_entry}" | jq -r '.name')"
+    >&2 echo "ERROR: Attached secret '${secret_name}' (workspace=${workspace_id}, resource=${resource_id}) is not in allowedSecrets."
+    return 1
+  fi
+}
+readonly -f validate_allowed_secret