feat/openbao secret storage

[fiftin]

• feat(secrets): add openbao secret storage type routed to vault provider
• feat(ui): OpenBao secret storage provider

Summary by CodeRabbit

• New Features

  • Added support for a new secret storage type, OpenBao, across the app.
  • Users can now create OpenBao storage entries and see the correct OpenBao icon in storage lists and forms.
  • OpenBao-specific guidance is shown for namespace settings.

• Bug Fixes

  • OpenBao secret storage is now handled consistently wherever Vault-compatible storage types are supported.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 22a845e4-276f-42d3-8349-ee933ba891fa

📥 Commits

Reviewing files that changed from the base of the PR and between 439f861 and 2a09cbc.

📒 Files selected for processing (7)

• db/SecretStorage.go
• services/server/access_key_encryption_svc.go
• web/src/components/EnvironmentForm.vue
• web/src/components/OpenBaoIcon.vue
• web/src/components/SecretStorageForm.vue
• web/src/plugins/vuetify.js
• web/src/views/project/SecretStorages.vue

---

📝 Walkthrough

Walkthrough

Adds a new "openbao" secret storage type constant in the backend, reuses the existing Vault deserializer for OpenBao entries, and extends the frontend with a new OpenBao icon component, Vuetify icon registration, and form/dropdown UI support across EnvironmentForm, SecretStorageForm, and SecretStorages views.

Changes

OpenBao Secret Storage Support

Layer / File(s)	Summary
Backend constant and deserializer support db/SecretStorage.go, services/server/access_key_encryption_svc.go	Adds SecretStorageTypeOpenBao constant and updates getDeserializer to route OpenBao entries through the existing Vault deserializer.
OpenBao icon component and registration web/src/components/OpenBaoIcon.vue, web/src/plugins/vuetify.js	Adds a new inline SVG icon Vue component and registers it as openbao in the Vuetify icons map.
Form and dropdown UI integration web/src/components/EnvironmentForm.vue, web/src/components/SecretStorageForm.vue, web/src/views/project/SecretStorages.vue	Adds openbao icon mapping, extends the vault/openbao form section with a conditional Namespace hint, and adds an "OpenBao" entry to the New Storage dropdown with matching icon logic.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

Not applicable; changes are additive UI/config mappings and a small deserializer branch without multi-component orchestration flow.

Suggested labels: enhancement, frontend, backend

Suggested reviewers: semaphoreui maintainers

🐰 A vault of secrets, now with a new friend,
OpenBao joins in, from front to back end,
An icon, a hint, a dropdown anew,
Small hops of code, but the feature rings true!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is concise and clearly matches the main change: adding OpenBao secret storage support.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/openbao-secret-storage

---

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Security review — PR #4015

Outcome: No medium, high, or critical vulnerabilities identified in the added or modified code.

Scope reviewed: OpenBao secret storage type (db/SecretStorage.go), routing to the existing Vault deserializer (access_key_encryption_svc.go), and UI wiring (SecretStorageForm.vue, SecretStorages.vue, EnvironmentForm.vue, OpenBaoIcon.vue, vuetify.js).

Prior threads: None from earlier automation runs.

Notes:

• OpenBao is wired into the same authenticated, project-admin (CanManageProjectResources) secret-storage flow as HashiCorp Vault.
• Backend deserialization correctly includes openbao in the Vault provider switch; no alternate code path bypasses existing controls.
• Changes are additive UI/type plumbing; no new injection sinks, auth bypasses, or secret-handling logic were introduced.
• Inherited Vault behaviors (e.g., admin-configured backend URL, file/env token sources) are unchanged and out of scope for this diff.

  

_{Sent by Cursor Automation: Find vulnerabilities}