fix: vault secret path

[shikanime]

Issues liées

Issues numéro: #2400 #2401

---

Quel est le comportement actuel ?

Quel est le nouveau comportement ?

Cette PR introduit-elle un breaking change ?

Autres informations

[shikanime]

Review — PR #2412 (reviewer)

Verdict: REQUEST CHANGES ⛔ (cannot formally block my own PR, but these must be resolved before merge)

Blocker 1 — Vault secret-path restructure with no migration / dual-read

This PR moves Vault paths with no backward-compatibility read and no data migration:

• tech/NEXUS → forge/{slug}/NEXUS (nexus.service.ts getProjectVaultPath(..., 'NEXUS'))
• global GITLAB → forge/{slug}/GITLAB (new generateGitlabTriggerTokenPath, writeMirrorTriggerToken(projectSlug, ...))

On an environment with existing secrets, the new code reads a path that has no secret yet, and the old secret at the previous path is never read or cleaned up. Needs either a one-off migration (write new path from old, or reconcile in a cron) or documented manual steps before merge.

Worse: the Fastify plugins/gitlab still reads/writes the global GITLAB path (plugins/gitlab/src/class.ts:486, functions.ts:53,134). The two backends already disagree on Vault path conventions, so any cutover reasoning is more urgent, not less — please confirm the migration plan covers the legacy plugin path too.

Blocker 2 — Dead dependency

PR body / tracking says it depends on #2403/#2405/#2406. #2406 is CLOSED without merging. Either re-open/merge it or drop the reference. #2403 and #2405 are still open.

Warnings

• validateProjectToken relies on error.cause?.response.status === 401. The unit tests cover 401/502/active/revoked and pass; a one-line comment citing the expected GitbeakerRequestError.cause shape would help the next reader.
• mirrorTokenRotationThresholdDays removed; rotation is now driven by live token validity (1-year expiry). Confirm ops expects no age-based early rotation.

Nits

• e2e renames Controller→Service and the new handleDelete e2e improve coverage — good.

Build/lint/59 gitlab+nexus+vault specs: green. The Build application (client) job is green here (no client code touched).

[shikanime]

Review: PR #2412 vs #2400 / #2401

Three-axis review (Security → Correctness → Standards) on PR head 032f45538.

Verdict: APPROVE — 1 non-blocking warning

Blockers

None.

Warning

W1 — apps/server-nestjs/test/nexus.e2e-spec.ts:145 is now stale (not in this PR's changed files).
The e2e asserts the secret at getProjectVaultPath(projectsRootDir, slug, 'tech/NEXUS') → forge/<slug>/tech/NEXUS, but production now writes forge/<slug>/NEXUS via generateNexusCredPath. The e2e then reads that path expecting NEXUS_USERNAME, so it will fail when run with E2E=true. It is gated behind the E2E env var, so CI does not catch it.
Fix: change line 145 to generateNexusCredPath(config.projectsRootDir, testProjectSlug) (import from ../src/modules/nexus/nexus.utils).

Nit

• After W1 is fixed, getProjectVaultPath in nexus.utils.ts becomes dead (only the e2e used it post-PR; registry has its own copy with a different signature). Safe to remove then. Not blocking.

What is correct

• GITLAB (🐛 [BUG] - Le secret Vault GITLAB n'est pas créé dans l'espace du projet lors du provisionnement (server-nestjs) #2400): writeMirrorTriggerToken(projectSlug, secret) now scopes to forge/<slug>/GITLAB via generateGitlabTriggerTokenPath; caller updated (gitlab.service.ts:482). No in-repo reader of this path exists (consumed externally), so the move is safe.
• NEXUS (🐛 [BUG] - Le secret Vault NEXUS n'est pas créé au bon emplacement dans l'espace du projet lors du provisionnement (server-nestjs) #2401): tech/NEXUS → NEXUS via generateNexusCredPath, applied consistently to read (ensureUser) and delete (handleDelete).
• Both get unit tests (vault.utils.spec, nexus.utils.spec, vault-client.service.spec, nexus.service.spec). Ran vitest run on the 4 specs → 16 passed. Lint clean on all changed source files.

Tests run: 16 passed on PR head.

[StephaneTrebel]

Donc on est d'accord que ni le titre de la MR, ni le message de commit ne sont exacts ? Car là on corrige vault et nexus.

Non pas que ça me dérange, mais je préfère qu'on soit explicites 😉

[StephaneTrebel]

Me suis mélangé les crayons avec les reviewers 😅

je nettoie mon bazar

[StephaneTrebel]

je remets mon Request Changes

[StephaneTrebel]

je pense que GH est bien buggé là 😅

[cloud-pi-native-sonarqube]

Quality Gate passed

Issues

• 0 New Issues
• 0 Fixed Issues
• 0 Accepted Issues

Measures

• 0 Security Hotspots
• 0.00% Coverage (26.40% Estimated after merge)
• 0.00% Duplicated Code (4.20% Estimated after merge)

Project ID: cloud-pi-native_console_AYsa46O31ebDtzs-pYyZ

View in SonarQube

[StephaneTrebel]

Toujours un commit qui mélange Vault et Nexus, je dis ça… 😛