feat(external-migrations): vault migrations

[DanielHougaard]

Description 📣

Added a new vault migration option. This allows users to migrate from Vault self-hosted/dedicated to Infisical. Currently the migration only supports Vault Key Vault (KV) V2. But we can extend it as we please in the future.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[maidul98]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

[greptile-apps]

Greptile Summary

This PR adds functionality to migrate secrets from HashiCorp Vault (KV V2) to Infisical. The implementation allows users to transfer their secrets from self-hosted or dedicated Vault instances while preserving their hierarchical structure. The changes span both frontend and backend:

• Frontend changes add a new Vault platform option in the import selection modal with a dedicated form for Vault credentials
• Backend implements the migration logic with support for two mapping types: namespace-based and key-vault based
• The implementation follows existing patterns used for EnvKey migrations, using a queue-based system for processing
• Data transformation handles the conversion between Vault's structure and Infisical's project/environment/folder hierarchy

Confidence score: 2/5

1. This PR has significant security implications and needs careful review before merging
2. Score reflects multiple security concerns in error handling and input validation
3. The following files need particular attention:
   • frontend/src/hooks/api/migration/mutations.tsx (error handling issues)
   • backend/src/services/external-migration/external-migration-fns/vault.ts (URL construction)
   • backend/src/server/routes/v3/external-migration-router.ts (rate limiting configuration)

Security Concerns:

1. The mutations.tsx file has poor error handling that swallows errors and only logs them
2. User-controlled input (vaultUrl) is used to construct API calls without proper URL validation
3. Sensitive information (vault tokens) may be exposed in logs
4. Rate limiting configuration needs review to prevent DoS attacks
5. Need to ensure proper sanitization of imported secret values
   a
   _{13 files reviewed, 13 comments}

_{Edit Code Review Bot Settings | Greptile}

[greptile-apps]

logic: Validate the baseUrl before creating axios instance - potential SSRF vulnerability if not validated