feature: doppler in-platform migration and unified external migrations UI by IgorHorta · Pull Request #5875 · Infisical/infisical

IgorHorta · 2026-03-31T00:15:30Z

Summary

Add Doppler app connection and in-platform migration (org settings + secret overview import).
Unify External Migrations settings: single table, provider picker, v3 UI, row actions menu.
Rename vault migration config storage to external_migration_configs with provider; filter Vault API responses to vault-only rows.
Docs: Doppler guide, overview and Vault setup updates.

Test plan

Run DB migration; verify Vault and Doppler configs in External Migrations.
Doppler: App Connection, add config, Import from settings and from project overview.
Vault: existing namespace config and secret overview import still work.

Made with Cursor

Add migration to rename vault_external_migration_config to external_migration_configs, introduce nullable namespace and provider field, and register the Zod schema plus Knex typings. Made-with: Cursor

Update joins and queries to use external_migration_configs (renamed table) while preserving connection hydration behavior. Made-with: Cursor

Implement Doppler connection schema, service helpers, and v1 router; register enum, maps, and factory wiring alongside existing app connections. Made-with: Cursor

Add Doppler config CRUD, project/environment listing, and secret import; scope vault migration endpoints to provider=vault so Doppler rows do not break response validation. Register v3 external-migration routes. Made-with: Cursor

Add Doppler to APP_CONNECTION_MAP, hooks enums and option types, form component, and integration logo asset. Made-with: Cursor

Add query keys, Doppler config mutations, import mutation, and Doppler project/environment fetchers. Made-with: Cursor

Replace per-provider sections with provider picker, merged v3 table and row actions menu, Doppler config/import modals, Vault/Doppler docs link in header, and remove legacy Vault-only section component. Made-with: Cursor

Add Add from Doppler to the overview Add Secret menu when a Doppler migration config exists, with modal for project/environment selection and useImportDopplerSecrets targeting the current folder. Made-with: Cursor

Document unified in-platform tooling, update Vault namespace setup for Add configuration flow, add Doppler migration page and nav entry. Made-with: Cursor

linear · 2026-03-31T00:15:32Z

ENG-4649 Create migration tool from Doppler to Infisical

mintlify · 2026-03-31T00:15:32Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
infisical	🟢 Ready	View Preview	Mar 31, 2026, 12:18 AM

maidul98 · 2026-03-31T00:16:10Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

…perations Add explicit checks to ensure updateDopplerExternalMigration and deleteDopplerExternalMigration only operate on Doppler configs, not other provider types. This prevents accidental modification or deletion of wrong config types.

… for Doppler imports Validate that the Doppler connection exists and is accessible before updating a migration config. When importing Doppler secrets, detect if the operation requires approval and return status indicating approval-required or imported state. This allows the frontend to surface different messaging based on whether secrets are imported immediately or pending approval.

…erations Add response schema to updateDopplerExternalMigrationV3 and deleteDopplerExternalMigrationV3 endpoints showing the returned config object. Update importDopplerSecretsV3 response to include status field alongside imported count. Fix type casting for raw secret values to ensure TypeScript type safety.

…count Update useImportDopplerSecrets mutation to return the API response object containing status and imported count, allowing the caller to conditionally handle approval-required vs imported states.

…andle import status Upgrade from v2 (Modal, FormControl, Input) to v3 (Dialog, Field, UnstableInput, Tooltip) components with improved styling. Add useEffect to reset form when modal opens. Update success notification to show different message based on import status: either submission for approval or count of imported secrets. Add reset() call to cleanup handlers.

Upgrade from v2 (Modal, ModalContent, FormControl) to v3 (Dialog, DialogContent, Field, Tooltip) components. Standardize form structure with consistent spacing via form className. Update footer layout with DialogFooter component and proper button ordering (Cancel, Create/Update).

Replace FontAwesome icons with lucide-react (Plus). Migrate custom documentation badge to DocumentationLinkBadge component from v3. Update semantic color tokens from mineshaft theme to modern v3 palette (border, card, foreground, muted). Refactor button to use v3 variant system with proper spacing.

The Doppler mark fills more of its asset bounds than Vault. Use a smaller px width (36px) for Doppler compared to default 50px to achieve visual size parity with Vault icon.

…ystem Upgrade ExternalMigrationsTab modals and supporting components from v2 to v3: - EnvKeyPlatformModal, GenericDropzone, InPlatformMigrationSection - SelectImportFromPlatformModal, SelectInPlatformMigrationProviderModal - VaultNamespaceConfigModal, VaultPlatformModal - New MigrationConfigDeleteDialog component Changes include: v2→v3 component imports, updated semantic colors (border, card, foreground, muted), Dialog/Field/Tooltip replacements for v2 Modal/ FormControl, lucide-react icon usage, improved form spacing and button styling.

…ation

…ayer SQL treats NULL != NULL so the unique constraint never fires for Doppler rows (which have namespace = null). Add an explicit existence check for the same orgId + provider + connectionId combination before creating, throwing BadRequestError if a config already exists.

…indOne filter type - Rename `vaultConfig` to `existingConfig` in getVaultConnectionForConfig for clarity - Add `connectionId` to the `findOne` filter type to support Doppler uniqueness check

…ternal-migration-config-dal

…ation DAL and service

…ove nested ternaries

…istDopplerEnvironments

…wPage

…ImportModal

…uires project context unavailable in org settings

…DopplerImportModal

…ng project route context

…multiple configs exist, fix path autocomplete truncation

…ource labels in import modal

…cretImportModal

…ance

…await-in-loop, floating promises

…xternal-migration-config-dal

…pler-to-infisical

gitguardian · 2026-04-04T01:09:02Z

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secrets in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
29206045	Triggered	Generic Password	`02d396a`	backend/src/ee/services/pki-scep/pki-scep-service.ts	View secret
28944329	Triggered	PostHog Project API Key	`94043e1`	docs/docs.json	View secret

🛠 Guidelines to remediate hardcoded secrets

Understand the implications of revoking this secret by investigating where it is used in your code.
Replace and store your secrets safely. Learn here the best practices.
Revoke and rotate these secrets.
If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

following these best practices for managing and storing secrets including API keys and other credentials
install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

…pler-to-infisical

victorvhs017 · 2026-04-08T15:53:23Z

backend/src/db/migrations/20260330172252_rename-vault-to-external-migration-config.ts

+  if (!(await knex.schema.hasTable(TableName.ExternalMigrationConfig))) {
+    await knex.schema.createTable(TableName.ExternalMigrationConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("provider").notNullable();
+      t.binary("encryptedConfig").notNullable();
+      t.uuid("connectionId");
+      t.foreign("connectionId").references("id").inTable(TableName.AppConnection);
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.ExternalMigrationConfig);
+
+    if (await knex.schema.hasTable(TableName.VaultExternalMigrationConfig)) {
+      const existingVaultConfigs = await knex(TableName.VaultExternalMigrationConfig).select(
+        selectAllTableCols(TableName.VaultExternalMigrationConfig)
+      );
+
+      await Promise.all(
+        existingVaultConfigs.map(async (vaultConfig) => {
+          const { encryptor } = await kmsService.createCipherPairWithDataKey({
+            orgId: vaultConfig.orgId,
+            type: KmsDataKey.Organization
+          });
+
+          const config = {
+            namespace: vaultConfig.namespace
+          };
+          const { cipherTextBlob: encryptedConfig } = encryptor({ plainText: Buffer.from(JSON.stringify(config)) });
+
+          await knex(TableName.ExternalMigrationConfig).insert({
+            orgId: vaultConfig.orgId,
+            provider: ExternalMigrationProviders.Vault,
+            encryptedConfig,
+            connectionId: vaultConfig.connectionId
+          });
+        })
+      );
+    }
+  }
+}


This migration is not idempotent. If it fails in one of the promises, the migration will be marked as failed. When we try again, we'll skip the data migration because the table already exists.

We could do this inside a transaction, and a failed promise would also rollback the table creation. But only if we don't have too many existingVaultConfigs to migrate, which I'm assuming is the case here for EU and US.

victorvhs017 · 2026-04-08T16:01:19Z

backend/src/server/routes/v3/external-migration-router.ts

optional because they were already missing:

Can we add some audit logs for the add, update, and delete external migrations requests?

victorvhs017 · 2026-04-08T16:17:11Z

backend/src/services/app-connection/doppler/doppler-connection-fns.ts

+  while (hasMore && page <= maxPages) {
+    // eslint-disable-next-line no-await-in-loop
+    const res = await request.get<{ environments: TDopplerEnvironment[] }>(`${DOPPLER_API_URL}/v3/environments`, {
+      params: { project: projectSlug, page, per_page: perPage },
+      headers: { Authorization: `Bearer ${apiToken}` }
+    });


https://docs.doppler.com/reference/environments-list. Their API doesn't have page or per_page parameters here. This pagination may be dead code.

victorvhs017 · 2026-04-08T16:40:12Z

backend/src/services/external-migration/external-migration-service.ts

+      });
+    }
+
+    return { status: VaultImportStatus.Imported, imported: Object.keys(dopplerSecrets).length };


We should rename this VaultImportStatus to ExternalMigrationImportStatus or something like that

victorvhs017 · 2026-04-08T17:15:44Z

...tion/SettingsPage/components/ExternalMigrationsTab/components/InPlatformMigrationSection.tsx

In v3 components we use yellow for configurations inside the project; here, we should have these buttons blue, as we do in the suborg tab

Oh, and the modal button too:

victorvhs017 · 2026-04-08T18:13:19Z

backend/src/@types/knex.d.ts

Ignore the placement of the comment.

I don't understand why we need this configuration here, where we are only selecting the app connection:

Couldn't we just select the app connection here and cut that previous step completely?

victorvhs017 · 2026-04-08T18:16:06Z

...c/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx

+import {
+  Button,
+  FilterableSelect,
+  FormControl,
+  Modal,
+  ModalClose,
+  ModalContent
+} from "@app/components/v2";


Can we update these to use v3?

victorvhs017 · 2026-04-08T18:18:18Z

...c/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx

We are showing these loading indicators as soon as we open the modal, which is a bit misleading. We should show these when we are actually fetching.

victorvhs017 · 2026-04-08T18:34:25Z

...c/pages/secret-manager/SecretDashboardPage/components/ActionBar/DopplerSecretImportModal.tsx

I've created this project:

But nothing is showing up here:

I followed the Doppler app connection documentation, and what we are missing there is that when you create a service account, the default role doesn't have any permissions.

It only worked after I added some here:

We should update the docs to make it clear because we recommend the creation of a new service account. Also, we should list the permissions we need to do the migration, then the user can use a least privilege service account.

victorvhs017 · 2026-04-08T18:38:58Z

docs/documentation/platform/external-migrations/doppler.mdx

+<Info>
+  **First time in this project?** Create a [project](/documentation/platform/project) and environments if you have not already. The overview import always targets the project you are viewing.
+</Info>


I didn't understand this part. It seems to be mixing project and environment concepts. I think we can remove this.

IgorHorta added 9 commits March 30, 2026 21:12

chore(db): rename vault migration config table and add provider column

ec39898

Add migration to rename vault_external_migration_config to external_migration_configs, introduce nullable namespace and provider field, and register the Zod schema plus Knex typings. Made-with: Cursor

refactor(backend): point external migration config DAL at shared table

ed8b12e

Update joins and queries to use external_migration_configs (renamed table) while preserving connection hydration behavior. Made-with: Cursor

feat(backend): add Doppler app connection type and API router

6616132

Implement Doppler connection schema, service helpers, and v1 router; register enum, maps, and factory wiring alongside existing app connections. Made-with: Cursor

feat(frontend): Doppler app connection form and types

9f8d8fe

Add Doppler to APP_CONNECTION_MAP, hooks enums and option types, form component, and integration logo asset. Made-with: Cursor

feat(frontend): migration API hooks for Doppler external migration

483bbf0

Add query keys, Doppler config mutations, import mutation, and Doppler project/environment fetchers. Made-with: Cursor

feat(frontend): unified external migrations settings UI

206d1a9

Replace per-provider sections with provider picker, merged v3 table and row actions menu, Doppler config/import modals, Vault/Doppler docs link in header, and remove legacy Vault-only section component. Made-with: Cursor

feat(frontend): import Doppler secrets from secret overview

0e7c716

Add Add from Doppler to the overview Add Secret menu when a Doppler migration config exists, with modal for project/environment selection and useImportDopplerSecrets targeting the current folder. Made-with: Cursor

docs: external migrations overview, Vault flow, and Doppler guide

237023b

Document unified in-platform tooling, update Vault namespace setup for Add configuration flow, add Doppler migration page and nav entry. Made-with: Cursor

mintlify bot deployed to staging - docs March 31, 2026 00:18 View deployment

IgorHorta added 9 commits March 30, 2026 22:07

feat(frontend): update import mutation to return status and imported …

d21b835

…count Update useImportDopplerSecrets mutation to return the API response object containing status and imported count, allowing the caller to conditionally handle approval-required vs imported states.

refactor(frontend): adjust Doppler icon sizing for visual consistency

f8cc354

The Doppler mark fills more of its asset bounds than Vault. Use a smaller px width (36px) for Doppler compared to default 50px to achieve visual size parity with Vault icon.

IgorHorta force-pushed the igor/eng-4649-create-migration-tool-from-doppler-to-infisical branch from 8f53bc9 to 8d81e31 Compare March 31, 2026 01:10

IgorHorta added 4 commits March 31, 2026 14:23

docs: add Doppler app connection guide and images

8f4ab9c

docs: add Doppler app connection API reference endpoints

29eee09

docs: add Doppler external migration API reference endpoints

2842603

docs: improve Doppler migration guide, fix accuracy, and update navig…

7094de2

…ation

IgorHorta changed the title ~~ENG-4649: Doppler in-platform migration and unified external migrations UI~~ feature: Doppler in-platform migration and unified external migrations UI Mar 31, 2026

fix: resolve TS errors and DB schema drift from Doppler migration

281d6d7

mintlify bot deployed to staging - docs March 31, 2026 17:43 View deployment

IgorHorta added 5 commits March 31, 2026 15:35

refactor(migration): rename vaultConfig to existingConfig and widen f…

12d6bb0

…indOne filter type - Rename `vaultConfig` to `existingConfig` in getVaultConnectionForConfig for clarity - Add `connectionId` to the `findOne` filter type to support Doppler uniqueness check

refactor(migration): rename vault-external-migration-config-dal to ex…

bbc3a2d

…ternal-migration-config-dal

refactor(migration): rename stale vault* identifiers in external migr…

7cc3d64

…ation DAL and service

refactor(migration): extract getInPlatformImportTooltip helper to rem…

0b2952b

…ove nested ternaries

mintlify bot deployed to staging - docs March 31, 2026 19:04 View deployment

fix(doppler): cap pagination at 20 pages in listDopplerProjects and l…

43a0158

…istDopplerEnvironments

IgorHorta marked this pull request as ready for review March 31, 2026 19:05

IgorHorta added 12 commits March 31, 2026 16:10

fix(frontend): sort imports in appConnections types index and Overvie…

1cfb619

…wPage

feat(migration): use SecretPathInput for secret path field in Doppler…

3b7a933

…ImportModal

revert(migration): revert SecretPathInput in DopplerImportModal — req…

5af5d72

…uires project context unavailable in org settings

feat(migration): add projectId prop to SecretPathInput and use it in …

6ae7911

…DopplerImportModal

fix(SecretPathInput): support explicit projectId prop without requiri…

8a8e1b2

…ng project route context

feat(migration): show config picker in DopplerSecretImportModal when …

672b5e5

…multiple configs exist, fix path autocomplete truncation

fix(migration): fix Doppler project options not loading and clarify s…

985e41d

…ource labels in import modal

fix(migration): fix useListAppConnections call signature in DopplerSe…

1765efa

…cretImportModal

fix(migration): fix import ordering and formatting for CI lint compli…

f66bf91

…ance

fix(migration): fix lint errors — import sort, unsafe any access, no-…

8c6ce94

…await-in-loop, floating promises

fix: lint issues

4528342

fix(migration): fix no-misused-promises and no-unsafe-assignment in e…

b086577

…xternal-migration-config-dal

IgorHorta requested a review from varonix0 April 1, 2026 01:02

Merge branch 'main' into igor/eng-4649-create-migration-tool-from-dop…

02d396a

…pler-to-infisical

mintlify bot deployed to staging - docs April 4, 2026 01:10 View deployment

varonix0 added 2 commits April 8, 2026 04:20

fix: refactor pr

4048f13

Merge branch 'main' into igor/eng-4649-create-migration-tool-from-dop…

94043e1

…pler-to-infisical

mintlify bot deployed to staging - docs April 8, 2026 02:27 View deployment

requested changes

c65caf9

varonix0 requested a review from victorvhs017 April 8, 2026 02:57

victorvhs017 requested changes Apr 8, 2026

View reviewed changes

Conversation

IgorHorta commented Mar 31, 2026

Summary

Test plan

Uh oh!

linear bot commented Mar 31, 2026

Uh oh!

mintlify bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maidul98 commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

gitguardian bot commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ GitGuardian has uncovered 2 secrets following the scan of your pull request.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mintlify bot commented Mar 31, 2026 •

edited

Loading

maidul98 commented Mar 31, 2026 •

edited

Loading

gitguardian bot commented Apr 4, 2026 •

edited

Loading