Add Azure SQL Database Dynamic Secret

[carlosmonastyrski]

Description 📣

Add new option to manage Dynamic Secrets on Azure SQL Databases, pretty similar to MS SQL connection but with the particularity of having two different connections to different databases. Azure forces to manage users on a separated master database, and only then users can be added to the rest of the user databases.

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

Tests 🛠️

# Here's some code block to paste some code snippets

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[maidul98]

🎉 Snyk checks have passed. No issues have been found so far.

✅ security/snyk check is complete. No issues have been found. (View Details)

[carlosmonastyrski]

@greptile review this

[greptile-apps]

Greptile Overview

Summary

This PR adds Azure SQL Database dynamic secret support to Infisical, extending the existing SQL database capabilities with Azure-specific dual database connection handling.

Key Changes

• Backend Provider: Implements AzureSqlDatabaseProvider with master/target database separation for Azure SQL Database's unique architecture
• Schema Validation: Adds DynamicSecretAzureSqlDBSchema with proper validation for Azure-specific fields like masterDatabase
• Frontend Forms: Creates React components for creating and editing Azure SQL Database dynamic secrets with comprehensive UI controls
• Documentation: Provides detailed documentation explaining Azure SQL Database authentication model and setup process

Technical Implementation

The implementation correctly handles Azure SQL Database's two-tier system:

1. Creates logins in the master database using masterCreationStatement
2. Creates users in target databases using creationStatement
3. Properly routes cleanup operations during revocation

The code includes proper error handling, credential sanitization, and supports both gateway and direct connections with SSL/TLS encryption.

Confidence Score: 4/5

• This PR is safe to merge with minimal risk
• Score reflects well-implemented Azure SQL Database provider with proper security practices and minimal validation issues
• Frontend forms need username template validation fixes before merge

Important Files Changed

File Analysis

Filename	Score	Overview
backend/src/ee/services/dynamic-secret/providers/azure-sql-database.ts	4/5	Implements Azure SQL Database provider with dual database connection handling and proper error sanitization
frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/AzureSqlDatabaseInputForm.tsx	3/5	React form component for creating Azure SQL Database dynamic secrets, missing username template validation
frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretAzureSqlDatabaseForm.tsx	3/5	React form component for editing Azure SQL Database dynamic secrets, missing username template validation

Sequence Diagram

sequenceDiagram
    participant User as User/System
    participant Provider as AzureSqlDatabaseProvider
    participant Master as Master Database
    participant Target as Target Database
    participant Gateway as Gateway (Optional)

    User->>Provider: create(credentials, expireAt, template)
    
    alt Gateway Enabled
        Provider->>Gateway: establishProxy(targetHost, port)
        Gateway-->>Provider: localProxyPort
    end
    
    Provider->>Provider: generateUsername(template)
    Provider->>Provider: generatePassword(requirements)
    
    Provider->>Master: connect(masterDatabase)
    Provider->>Master: CREATE LOGIN [username] WITH PASSWORD
    Master-->>Provider: login created
    Provider->>Master: disconnect()
    
    Provider->>Target: connect(targetDatabase)
    Provider->>Target: CREATE USER [username] FOR LOGIN [username]
    Provider->>Target: GRANT permissions TO [username]
    Target-->>Provider: user created
    Provider->>Target: disconnect()
    
    Provider-->>User: {entityId: username, data: {DB_USERNAME, DB_PASSWORD}}
    
    User->>Provider: revoke(entityId)
    Provider->>Target: connect(targetDatabase)
    Provider->>Target: DROP USER [username]
    Target-->>Provider: user dropped
    Provider->>Target: disconnect()
    
    Provider->>Master: connect(masterDatabase)
    Provider->>Master: DROP LOGIN [username]
    Master-->>Provider: login dropped
    Provider->>Master: disconnect()
    
    Provider-->>User: {entityId: username}

Loading

_{12 files reviewed, 2 comments}

_{Edit Code Review Bot Settings | Greptile}

[scott-ray-wilson]

LGTM