Skip to content

fix(server-nestjs): enforce techoRO vault group typing - #2406

Closed
shikanime wants to merge 1 commit into
mainfrom
wphetsinorath/push-zrnloozxqqyy
Closed

fix(server-nestjs): enforce techoRO vault group typing#2406
shikanime wants to merge 1 commit into
mainfrom
wphetsinorath/push-zrnloozxqqyy

Conversation

@shikanime

@shikanime shikanime commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Change-Id: I08cebb0299114a86fdf4de4061d9f9586a6a6964

Issues liées

Extrait de: #2407

Quel est le comportement actuel ?

Quel est le nouveau comportement ?

Cette PR introduit-elle un breaking change ?

Autres informations

@github-actions github-actions Bot added the built label Aug 3, 2026
@shikanime

shikanime commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

Review — PR #2406 (verdict: APPROVE)

Scope: apps/server-nestjs/src/modules/vault/vault-client.service.ts (+7/−2). Type-safety hardening on the tech-RO vault path.

Security

No issues. No secret-handling or injection-surface change. vault-client.service.ts only adds/adjusts interfaces and a return type.

Correctness

  • MirrorUserSecret (MIRROR_USER / MIRROR_TOKEN) exactly matches what writeTechReadOnlyCreds writes (gitlab.service.ts:505-509), and what getOrRotateMirrorCreds consumes. Return type now Promise<VaultSecret<MirrorUserSecret> | null> — correct.
  • SONAR_PASSWORD? made optional. All in-repo writers still set it (sonarqube.service.ts:210,216); the sonar e2e assertion expect(...SONAR_PASSWORD).toBeTruthy() still holds. Optional is safe.

Standards

  • ESLint (eslint 10.5.0) on the changed file: clean (exit 0).
  • tsc --noEmit: zero errors referencing the changed file. (Repo-wide tsc shows pre-existing env errors only — @cpn-console/shared/@cpn-console/hooks workspace pkgs not built and Prisma client not generated; unrelated to this diff.)

Test coverage

  • gitlab.service.spec.ts:467 already asserts the exact { MIRROR_USER, MIRROR_TOKEN } shape written via writeTechReadOnlyCreds.
  • vault.e2e-spec.ts covers the vault module end-to-end.

nit

gitlab.service.ts:494 — return vaultSecret.data as { MIRROR_USER: string, MIRROR_TOKEN: string } is now a redundant cast since readTechnReadOnlyCreds is typed VaultSecret<MirrorUserSecret>. Drop the as for consistency. Not a blocker; can be a follow-up.

Overall: clean, correct, minimal, lint/type green. Approve.

@shikanime shikanime mentioned this pull request Aug 4, 2026
Merged
shikanime added a commit that referenced this pull request Aug 4, 2026
@shikanime shikanime
test(server-nestjs): align E2E specs with DSO orchestration
afb53a6 
Realign apps/server-nestjs/test/*.e2e-spec.ts with DSO orchestration
docs and fix E2E gating. Test-only change; no production source.

Source fixes tracked separately and must merge first:
- #2403 sonarqube user creation uses project.owner.email
- #2405 gitlab token/user hardening (ciConfigPath, canCreateGroup,
  forceRandomPassword, projectsLimit, 1-year expiry, revoke old tokens)
- #2406 vault group restructure and techRO path divergence

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
@shikanime
shikanime force-pushed the wphetsinorath/push-zrnloozxqqyy branch 2 times, most recently from 15d518e to 344faee Compare August 4, 2026 10:54
@shikanime shikanime self-assigned this Aug 4, 2026
@shikanime shikanime added the bug Something isn't working label Aug 4, 2026
@shikanime shikanime added this to the 9.24.0 milestone Aug 4, 2026
@shikanime shikanime changed the title fix(server-nestjs): keep vault group restructure and techRO path dive… fix(server-nestjs): keep vault group restructure and techRO path Aug 4, 2026
@shikanime
shikanime marked this pull request as draft August 4, 2026 10:55
@shikanime shikanime changed the title fix(server-nestjs): keep vault group restructure and techRO path fix(server-nestjs): enforce techoRO vault group restructure Aug 4, 2026
@shikanime shikanime changed the title fix(server-nestjs): enforce techoRO vault group restructure fix(server-nestjs): enforce techoRO vault group typing Aug 4, 2026
@shikanime
shikanime force-pushed the wphetsinorath/push-zrnloozxqqyy branch from 344faee to 986228a Compare August 4, 2026 11:10
@shikanime
fix(server-nestjs): use project owner email for sonarqube user creation
27b5bf5 
Use project.owner.email instead of synthetic {slug}@{slug}.

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
Change-Id: I8776cb553c3a3ef9394ac60aeee526776a6a6964
@shikanime
shikanime force-pushed the wphetsinorath/push-zrnloozxqqyy branch from 986228a to 27b5bf5 Compare August 4, 2026 11:10
@shikanime shikanime closed this Aug 4, 2026
@shikanime

shikanime commented Aug 4, 2026

Copy link
Copy Markdown
Member Author

Merged into #2403

@cloud-pi-native-sonarqube

cloud-pi-native-sonarqube Bot commented Aug 4, 2026

Copy link
Copy Markdown

Passed Quality Gate passed

Issues

Measures

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube

@shikanime shikanime mentioned this pull request Aug 4, 2026
Merged
shikanime added a commit to shikanime/cloud-pi-native-console that referenced this pull request Aug 5, 2026
@shikanime
test(server-nestjs): align E2E specs with DSO orchestration
d4343a3 
Realign apps/server-nestjs/test/*.e2e-spec.ts with DSO orchestration
docs and fix E2E gating. Test-only change; no production source.

Source fixes tracked separately and must merge first:
- cloud-pi-native#2403 sonarqube user creation uses project.owner.email
- cloud-pi-native#2405 gitlab token/user hardening (ciConfigPath, canCreateGroup,
  forceRandomPassword, projectsLimit, 1-year expiry, revoke old tokens)
- cloud-pi-native#2406 vault group restructure and techRO path divergence

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
shikanime added a commit to shikanime/cloud-pi-native-console that referenced this pull request Aug 5, 2026
@shikanime
test(server-nestjs): align E2E specs with DSO orchestration
4531e33 
Realign apps/server-nestjs/test/*.e2e-spec.ts with DSO orchestration
docs and fix E2E gating. Test-only change; no production source.

Source fixes tracked separately and must merge first:
- cloud-pi-native#2403 sonarqube user creation uses project.owner.email
- cloud-pi-native#2405 gitlab token/user hardening (ciConfigPath, canCreateGroup,
  forceRandomPassword, projectsLimit, 1-year expiry, revoke old tokens)
- cloud-pi-native#2406 vault group restructure and techRO path divergence

Signed-off-by: William Phetsinorath <william.phetsinorath-open@interieur.gouv.fr>
@StephaneTrebel StephaneTrebel removed this from the 9.24.0 milestone Aug 7, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@KepoParis KepoParis Awaiting requested review from KepoParis
@StephaneTrebel StephaneTrebel Awaiting requested review from StephaneTrebel

Assignees

@shikanime shikanime

Labels

bug Something isn't working built

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@shikanime @StephaneTrebel