feat(core): Enable external secrets for projects (#26329)

Author: sandra0503

packages/@n8n/api-types/src/frontend-settings.ts

@@ -277,6 +277,8 @@ export type FrontendModuleSettings = {
 		multipleConnections: boolean;
 		/** Whether project-scoped external secrets are enabled. */
 		forProjects: boolean;
+		/** Whether role-based access control for external secrets is enabled. */
+		roleBasedAccess: boolean;
 	};
 };
 

packages/cli/src/modules/external-secrets.ee/external-secrets.config.ts

@@ -12,9 +12,13 @@ export class ExternalSecretsConfig {
 
 	/** Whether to enable project-scoped external secrets */
 	@Env('N8N_ENV_FEAT_EXTERNAL_SECRETS_FOR_PROJECTS')
-	externalSecretsForProjects: boolean = false;
+	externalSecretsForProjects: boolean = true;
 
 	/** Whether to enable multiple connections to global secret providers */
 	@Env('N8N_ENV_FEAT_EXTERNAL_SECRETS_MULTIPLE_CONNECTIONS')
 	externalSecretsMultipleConnections: boolean = true;
+
+	/** Whether to enable role based access control to manage secret providers */
+	@Env('N8N_ENV_FEAT_EXTERNAL_SECRETS_ROLE_BASED_ACCESS')
+	externalSecretsRoleBasedAccess: boolean = false;
 }

packages/cli/src/modules/external-secrets.ee/external-secrets.module.ts

@@ -29,6 +29,7 @@ export class ExternalSecretsModule implements ModuleInterface {
 		return {
 			multipleConnections: config.externalSecretsMultipleConnections,
 			forProjects: config.externalSecretsForProjects,
+			roleBasedAccess: config.externalSecretsRoleBasedAccess,
 		};
 	}
 

packages/cli/test/integration/external-secrets/external-secrets.api.test.ts

@@ -136,6 +136,7 @@ beforeAll(async () => {
 
 	// Get all service dependencies from Container
 	const config = Container.get(ExternalSecretsConfig);
+	config.externalSecretsForProjects = false;
 	config.externalSecretsMultipleConnections = false;
 	const settingsStore = Container.get(ExternalSecretsSettingsStore);
 	const providerRegistry = Container.get(ExternalSecretsProviderRegistry);

packages/frontend/@n8n/i18n/src/locales/en.json

@@ -3040,7 +3040,7 @@
 	"settings.externalSecrets.docs": "https://docs.n8n.io/external-secrets/",
 	"settings.externalSecrets.docs.use": "https://docs.n8n.io/external-secrets/#use-secrets-in-n8n-credentials",
 	"settings.secretsProviderConnections.title": "External Secrets",
-	"settings.secretsProviderConnections.emptyState.heading": "Add an external secrets store",
+	"settings.secretsProviderConnections.emptyState.heading": "Add an external secrets vault",
 	"settings.secretsProviderConnections.emptyState.description": "Manage credentials across multiple environments by adding an external secrets store. Keep sensitive credential information in your vault for added security.",
 	"settings.secretsProviderConnections.buttons.addSecretsStore": "Add secrets vault",
 	"settings.secretsProviderConnections.description": "Manage credentials across multiple environments by connecting an external secrets store. Keep sensitive credential information in your vault for added security.",
@@ -3053,7 +3053,7 @@
 	"settings.secretsProviderConnections.modal.scope.placeholder.project": "Assign globally or within selected project",
 	"settings.secretsProviderConnections.modal.scope.global": "Global",
 	"settings.secretsProviderConnections.modal.scope.emptyOptionsText": "No matching projects found",
-	"settings.secretsProviderConnections.modal.scope.info": "Selecting a project will share the secrets store with that project only. If you want to share the secrets store with all projects, select \"Global\".",
+	"settings.secretsProviderConnections.modal.scope.info": "Assigning a secret vault allows people to use external secrets in their credentials.",
 	"settings.secretsProviderConnections.modal.scope.label": "Scope",
 	"settings.secretsProviderConnections.modal.connectionName": "Vault name",
 	"settings.secretsProviderConnections.modal.providerType": "External secrets provider",
@@ -3079,8 +3079,8 @@
 	"settings.secretsProviderConnections.delete.confirmationLabel": "Type \"{name}\" to confirm.",
 	"settings.secretsProviderConnections.delete.success": "Secret store \"{name}\" deleted successfully",
 	"settings.secretsProviderConnections.delete.error": "Failed to delete secret store",
-	"settings.secretsProviderConnections.badge.tooltip.project": "This secrets store is shared with {projectName}.",
-	"settings.secretsProviderConnections.badge.tooltip.global": "This secrets store is available to all projects and users of this instance.",
+	"settings.secretsProviderConnections.badge.tooltip.project": "This secrets vault is shared with {projectName}.",
+	"settings.secretsProviderConnections.badge.tooltip.global": "This secrets vault is available to all projects and users of this instance.",
 	"settings.sourceControl.title": "Environments",
 	"settings.sourceControl.actionBox.title": "Available on the Enterprise plan",
 	"settings.sourceControl.actionBox.description": "Use multiple instances for different environments (dev, prod, etc.), deploying between them via a Git repository.",
@@ -4265,16 +4265,16 @@
 	"projects.settings.users.search.error": "An error occurred while searching for users",
 	"projects.settings.externalSecrets": "External secret stores",
 	"projects.settings.externalSecrets.emptyState.heading": "No external secrets available yet",
-	"projects.settings.externalSecrets.emptyState.instanceAdmin.noProjectProviders.description": "Share secrets store with this project to make external secrets available here. Once shared, secrets will appear automatically and can be referenced through aliases in credentials.",
-	"projects.settings.externalSecrets.emptyState.projectAdmin.description": "Add a secrets store and share it with this project to make external secrets available here. Once shared, secrets will appear automatically and can be referenced through aliases in credentials.",
+	"projects.settings.externalSecrets.emptyState.instanceAdmin.noProjectProviders.description": "Share secrets vault with this project to make external secrets available here. Once shared, secrets will appear automatically and can be referenced through aliases in credentials.",
+	"projects.settings.externalSecrets.emptyState.projectAdmin.description": "Add a secrets vault and share it with this project to make external secrets available here. Once shared, secrets will appear automatically and can be referenced through aliases in credentials.",
 	"projects.settings.externalSecrets.button.addSecretsStore": "Add secrets vault",
-	"projects.settings.externalSecrets.button.shareSecretsStore": "Share secrets store",
+	"projects.settings.externalSecrets.button.shareSecretsStore": "Share secrets vault",
 	"projects.settings.externalSecrets.table.header.secretName": "Secret name",
 	"projects.settings.externalSecrets.table.header.usedInCredentials": "Used in credentials",
 	"projects.settings.externalSecrets.search.placeholder": "Search secrets...",
 	"projects.settings.externalSecrets.load.error": "An error occurred while loading external secrets",
-	"projects.settings.externalSecrets.expand": "Expand external secrets store",
-	"projects.settings.externalSecrets.collapse": "Collapse external secrets store",
+	"projects.settings.externalSecrets.expand": "Expand external secrets vault",
+	"projects.settings.externalSecrets.collapse": "Collapse external secrets vault",
 	"projects.sharing.allUsers": "All users and projects",
 	"projects.sharing.noMatchingProjects": "There are no available projects",
 	"projects.sharing.noMatchingUsers": "No matching users or projects",

packages/frontend/editor-ui/src/features/integrations/secretsProviders.ee/components/SecretsProviderConnectionModal.ee.test.ts

@@ -139,6 +139,7 @@ const initialState = {
 			'external-secrets': {
 				multipleConnections: true,
 				forProjects: true,
+				roleBasedAccess: false,
 			},
 		},
 	},

packages/frontend/editor-ui/src/features/integrations/secretsProviders.ee/composables/useConnectionModal.ee.test.ts

@@ -208,7 +208,8 @@ describe('useConnectionModal', () => {
 		beforeEach(() => {
 			mockModuleSettings['external-secrets'] = {
 				multipleConnections: true,
-				forProjects: false,
+				forProjects: true,
+				roleBasedAccess: false,
 			};
 		});
 		it('should not provide option to create new infisical connection if multipleConnections is enabled', () => {

packages/frontend/editor-ui/src/features/project-roles/ProjectRoleView.test.ts

@@ -493,26 +493,26 @@ describe('ProjectRoleView', () => {
 	});
 
 	describe('External Secrets Scopes', () => {
-		it('should not render externalSecretsProvider scope type when forProjects is off', () => {
+		it('should not render externalSecretsProvider scope type when roleBasedAccess is off', () => {
 			const { queryByText } = renderComponent();
 
 			expect(queryByText('Secret stores')).not.toBeInTheDocument();
 			expect(queryByText('Secrets')).not.toBeInTheDocument();
 		});
 
-		it('should render externalSecretsProvider scope type when forProjects is on', () => {
+		it('should render externalSecretsProvider scope type when roleBasedAccess is on', () => {
 			settingsStore.moduleSettings = {
-				'external-secrets': { forProjects: true, multipleConnections: true },
+				'external-secrets': { roleBasedAccess: true, forProjects: true, multipleConnections: true },
 			};
 			const { getByText } = renderComponent();
 
 			expect(getByText('Secrets vaults')).toBeInTheDocument();
 			expect(getByText('Secrets')).toBeInTheDocument();
 		});
 
-		it('should show secrets checkboxes when forProjects is on', async () => {
+		it('should show secrets checkboxes when roleBasedAccess is on', async () => {
 			settingsStore.moduleSettings = {
-				'external-secrets': { forProjects: true, multipleConnections: true },
+				'external-secrets': { roleBasedAccess: true, forProjects: true, multipleConnections: true },
 			};
 			const { getByTestId } = renderComponent();
 

packages/frontend/editor-ui/src/features/project-roles/ProjectRoleView.vue

@@ -129,7 +129,7 @@ function resetForm(payload: Role | undefined) {
 }
 
 const scopeTypes = computed(() => {
-	if (!settingsStore.moduleSettings['external-secrets']?.forProjects) {
+	if (!settingsStore.moduleSettings['external-secrets']?.roleBasedAccess) {
 		return SCOPE_TYPES.filter(
 			(type) => type !== 'externalSecretsProvider' && type !== 'externalSecret',
 		);