feat(pam): view sensitive credentials/password for PAM accounts#5925
feat(pam): view sensitive credentials/password for PAM accounts#5925saifsmailbox98 merged 24 commits intomainfrom
Conversation
Add a new endpoint and UI for viewing full (unsanitized) PAM account credentials and resource connection details behind a dedicated ReadCredentials permission, with optional MFA enforcement and audit logging.
Only show account credentials in the view credentials feature, not resource connection details, to avoid coupling the two entities.
…s gate Replace the modal dialog approach with an inline card-based UI. Public fields (username, host) are always visible, while sensitive fields (password, private key) are behind a gated area that handles MFA verification and permission checks in-place.
Move project and user DB lookups inside the MFA-required block so they are skipped when MFA is not needed. Simplify credentials gate UI by consolidating loading/MFA-verifying states into the button, adding descriptive text for non-MFA mode, and removing unnecessary fragments and section comments.
Replace the dashed-border gate box with a simple full-width button. Use v3 Button isPending for loading/MFA states with inline MFA status text. Remove MFA detail leaking to users without permission.
… field defs Use readLimit instead of writeLimit for the GET credentials endpoint. Simplify RESOURCE_FIELD_DEFS to only contain sensitive fields since non-sensitive fields are already rendered by CredentialsContent.
Accounts like SSH certificate auth and AWS IAM have no sensitive credentials beyond the sanitized view. The API now returns a 400 early (before MFA/audit log), and the frontend uses an account-aware function to decide whether to show the button.
…ubernetes sensitive check - Remove error state from RevealState and SensitiveCredentialsGate; all errors now show a toast notification and reset to the initial button view - MFA timeout notification includes popup blocker hint - Remove redundant "Waiting for MFA..." button text (keep only the p tag) - Add Kubernetes to hasSensitiveCredentials exclusion list to match frontend - Remove unused onRetry prop from SensitiveCredentialsGate
- Replace Lottie isPending spinner with LoaderCircleIcon for all loading states - Loading state shows spinner only, MFA state shows spinner + "Waiting for MFA..." - Extract ButtonContent component to avoid nested ternary lint error - Change children prop to React.ReactElement to avoid useless fragment
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Greptile SummaryThis PR adds a "View Credentials" feature for PAM accounts, allowing authorized users to reveal sensitive fields (passwords, private keys) that are intentionally omitted from the sanitized account response. The implementation includes a new Key highlights:
Confidence Score: 5/5Safe to merge; all previously flagged P1 concerns are resolved and remaining findings are P2 style/hardening suggestions Auth, permission, and MFA logic are correctly implemented. Both remaining comments are P2: one is a hardening suggestion about mfaSessionId in a URL query param (low practical risk given one-time-use tokens), and one is a forward-looking note about hasSensitiveCredentials opt-out pattern. Neither blocks merge. backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts (mfaSessionId as query param), backend/src/ee/services/pam-account/pam-account-fns.ts (hasSensitiveCredentials default-true) Important Files Changed
Reviews (2): Last reviewed commit: "fix: add re-entrancy guard to MFA pollin..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
…ct conditions to credentials gate - Change ReadCredentials audit event metadata from resourceName to resourceId to match Delete/Rotation/RotationFailed event patterns - Pass accountName, resourceName, and metadata to SensitiveCredentialsGate so ProjectPermissionCan evaluates resource-scoped ReadCredentials policies
|
@greptile re-review this pr |
|
@codex review this PR |
|
Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits. |
…word-view-feature-for-accounts
x032205
left a comment
x032205
left a comment
There was a problem hiding this comment.
Discovered account without a password throw a 500 error when clicking view password. Zod error I think where strings must be non-empty. Let's just show a front-end error that password does not exist for this account.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
3 participants
Context
Provides users with a UI to view account credentials/password with proper audit logging.
Useful for:
Screenshots
Steps to verify the change
Type
Checklist
type(scope): short description(scope is optional, e.g.,fix: prevent crash on syncorfix(api): handle null response).