Merge pull request #5123 from barrynorman/feat/vault-phase-provider

feat(vault): add Phase.dev secrets provider

apps/dokploy/__test__/env/vault.test.ts

@@ -20,6 +20,7 @@ import {
 import { azureClient } from "@dokploy/server/utils/vault/azure";
 import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
 import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
+import { phaseClient } from "@dokploy/server/utils/vault/phase";
 import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";
 
 const mockFetch = vi.fn();
@@ -616,3 +617,129 @@ describe("scaleway client", () => {
 		expect(result).toBe("DB_PASSWORD=s3cret");
 	});
 });
+
+describe("phase client", () => {
+	const config = {
+		providerType: "phase" as const,
+		token: "phase-rest-token",
+		appId: "app-123",
+		env: "Production",
+		path: "/",
+		apiUrl: "https://api.phase.dev",
+	};
+
+	it("fetches secrets by key and sends ServiceAccount auth", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([
+				{ key: "DB_URL", value: "postgres://real", path: "/" },
+				{ key: "API_KEY", value: "key-123", path: "/" },
+			]),
+		);
+
+		const result = await phaseClient.getSecrets(config, ["DB_URL", "API_KEY"]);
+
+		expect(result).toEqual({ DB_URL: "postgres://real", API_KEY: "key-123" });
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toBe(
+			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
+		);
+		expect((init.headers as Record<string, string>).Authorization).toBe(
+			"Bearer ServiceAccount phase-rest-token",
+		);
+	});
+
+	it("throws when a requested secret is missing", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([{ key: "DB_URL", value: "postgres://real", path: "/" }]),
+		);
+
+		await expect(phaseClient.getSecrets(config, ["MISSING"])).rejects.toThrow(
+			'secret "MISSING" not found in environment "Production"',
+		);
+	});
+
+	it("reports authentication failures with the status code", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ error: "unauthorized" }, false, 401),
+		);
+
+		await expect(phaseClient.getSecrets(config, ["DB_URL"])).rejects.toThrow(
+			"authentication failed (status 401: unauthorized)",
+		);
+	});
+
+	it("rejects apps without SSE enabled during testConnection", async () => {
+		mockFetch.mockResolvedValueOnce(
+			jsonResponse({
+				id: "app-123",
+				name: "My App",
+				sseEnabled: false,
+			}),
+		);
+
+		await expect(phaseClient.testConnection(config)).rejects.toThrow(
+			"enable Server-side Encryption (SSE)",
+		);
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://api.phase.dev/v1/apps/app-123/",
+		);
+	});
+
+	it("tests connection against the app then secrets listing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(
+				jsonResponse({
+					id: "app-123",
+					name: "My App",
+					sseEnabled: true,
+				}),
+			)
+			.mockResolvedValueOnce(jsonResponse([]));
+
+		await phaseClient.testConnection(config);
+
+		expect(mockFetch).toHaveBeenCalledTimes(2);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://api.phase.dev/v1/apps/app-123/",
+		);
+		expect(mockFetch.mock.calls[1]?.[0]).toBe(
+			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
+		);
+	});
+
+	it("lists secret names from the configured path", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([
+				{ key: "DB_URL", value: "x", path: "/" },
+				{ key: "API_KEY", value: "y", path: "/" },
+			]),
+		);
+
+		const names = await phaseClient.listSecretNames?.(config);
+
+		expect(names).toEqual(["DB_URL", "API_KEY"]);
+	});
+
+	it("resolves env refs end to end through a phase provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "phase-prod",
+				providerType: "phase",
+				config,
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(
+			jsonResponse([{ key: "DB_PASSWORD", value: "s3cret", path: "/" }]),
+		);
+
+		const result = await resolveVaultReferences(
+			"DB_PASSWORD=${{vault.phase-prod.DB_PASSWORD}}",
+			scope,
+		);
+
+		expect(result).toBe("DB_PASSWORD=s3cret");
+	});
+});

apps/dokploy/components/dashboard/settings/vault/handle-vault-provider.tsx

@@ -43,6 +43,7 @@ const providerLabels = {
 	doppler: "Doppler",
 	azure: "Azure Key Vault",
 	scaleway: "Scaleway Secret Manager",
+	phase: "Phase",
 } as const;
 
 type ProviderType = keyof typeof providerLabels;
@@ -63,6 +64,7 @@ const VaultProviderSchema = z
 			"doppler",
 			"azure",
 			"scaleway",
+			"phase",
 		]),
 		url: z.string(),
 		token: z.string(),
@@ -89,6 +91,11 @@ const VaultProviderSchema = z
 		scalewayProjectId: z.string(),
 		scalewaySecretKey: z.string(),
 		scalewayApiUrl: z.string(),
+		phaseToken: z.string(),
+		phaseAppId: z.string(),
+		phaseEnv: z.string(),
+		phasePath: z.string(),
+		phaseApiUrl: z.string(),
 		assignments: z.array(
 			z.object({
 				projectId: z.string(),
@@ -161,6 +168,17 @@ const VaultProviderSchema = z
 				path: ["siteUrl"],
 			});
 		}
+		if (
+			data.providerType === "phase" &&
+			data.phaseApiUrl &&
+			!isValidUrl(data.phaseApiUrl)
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Enter a valid URL (e.g. https://api.phase.dev)",
+				path: ["phaseApiUrl"],
+			});
+		}
 
 		const required: Partial<
 			Record<ProviderType, [keyof typeof data, string][]>
@@ -194,6 +212,11 @@ const VaultProviderSchema = z
 				["scalewayProjectId", "Project ID is required"],
 				["scalewaySecretKey", "Secret Key is required"],
 			],
+			phase: [
+				["phaseToken", "Service Account REST API token is required"],
+				["phaseAppId", "App ID is required"],
+				["phaseEnv", "Environment is required"],
+			],
 		};
 
 		for (const [field, message] of required[data.providerType] ?? []) {
@@ -254,6 +277,11 @@ const defaultValues: VaultProviderForm = {
 	scalewayProjectId: "",
 	scalewaySecretKey: "",
 	scalewayApiUrl: "https://api.scaleway.com",
+	phaseToken: "",
+	phaseAppId: "",
+	phaseEnv: "",
+	phasePath: "/",
+	phaseApiUrl: "https://api.phase.dev",
 	assignments: [],
 };
 
@@ -308,6 +336,15 @@ const buildConfig = (data: VaultProviderForm) => {
 				secretKey: data.scalewaySecretKey,
 				apiUrl: data.scalewayApiUrl || "https://api.scaleway.com",
 			};
+		case "phase":
+			return {
+				providerType: "phase" as const,
+				token: data.phaseToken,
+				appId: data.phaseAppId,
+				env: data.phaseEnv,
+				path: data.phasePath || "/",
+				apiUrl: data.phaseApiUrl || "https://api.phase.dev",
+			};
 	}
 };
 
@@ -429,6 +466,13 @@ export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
 					scalewaySecretKey: provider.config.secretKey,
 					scalewayApiUrl: provider.config.apiUrl,
 				}),
+				...(provider.config.providerType === "phase" && {
+					phaseToken: provider.config.token,
+					phaseAppId: provider.config.appId,
+					phaseEnv: provider.config.env,
+					phasePath: provider.config.path,
+					phaseApiUrl: provider.config.apiUrl,
+				}),
 			});
 		} else if (!vaultProviderId) {
 			form.reset(defaultValues);
@@ -996,6 +1040,94 @@ export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
 							</>
 						)}
 
+						{providerType === "phase" && (
+							<>
+								<FormField
+									control={form.control}
+									name="phaseToken"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Service Account REST API Token</FormLabel>
+											<FormControl>
+												<Input type="password" {...field} />
+											</FormControl>
+											<FormDescription>
+												Use the REST API token from a Service Account — not the
+												CLI/SDK <code>pss_*</code> token. The Phase App must
+												have Server-side Encryption (SSE) enabled.
+											</FormDescription>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="phaseAppId"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>App ID</FormLabel>
+												<FormControl>
+													<Input
+														placeholder="00000000-0000-0000-0000-000000000000"
+														{...field}
+													/>
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="phaseEnv"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Environment</FormLabel>
+												<FormControl>
+													<Input placeholder="Production" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<FormField
+									control={form.control}
+									name="phasePath"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Secret Path</FormLabel>
+											<FormControl>
+												<Input placeholder="/" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="phaseApiUrl"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>API URL</FormLabel>
+											<FormControl>
+												<Input placeholder="https://api.phase.dev" {...field} />
+											</FormControl>
+											<FormDescription>
+												Self-hosted Phase defaults to{" "}
+												<code>{"${HTTP_PROTOCOL}${HOST}/service/public"}</code>
+											</FormDescription>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormDescription>
+									Reference format:{" "}
+									<code>{"${{vault.<name>.SECRET_KEY}}"}</code>
+								</FormDescription>
+							</>
+						)}
+
 						<div className="flex flex-col gap-2 rounded-lg border p-3">
 							<FormLabel>Access</FormLabel>
 							<FormDescription>

apps/dokploy/components/dashboard/settings/vault/show-vault-providers.tsx

@@ -21,6 +21,7 @@ const providerLabels: Record<string, string> = {
 	doppler: "Doppler",
 	azure: "Azure Key Vault",
 	scaleway: "Scaleway Secret Manager",
+	phase: "Phase",
 };
 
 export const ShowVaultProviders = () => {

apps/dokploy/components/icons/vault-provider-icons.tsx

@@ -582,6 +582,28 @@ export const ScalewayIcon = ({ className }: Props) => (
 	</svg>
 );
 
+export const PhaseIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 24 24"
+		fill="none"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<path
+			d="M12 2L3.5 6.5v11L12 22l8.5-4.5v-11L12 2z"
+			stroke="currentColor"
+			strokeWidth="1.75"
+			strokeLinejoin="round"
+		/>
+		<path
+			d="M12 2v20M3.5 6.5L12 11l8.5-4.5M3.5 17.5L12 13l8.5 4.5"
+			stroke="currentColor"
+			strokeWidth="1.75"
+			strokeLinejoin="round"
+		/>
+	</svg>
+);
+
 export const vaultProviderIcons = {
 	hashicorp: HashicorpVaultIcon,
 	infisical: InfisicalIcon,
@@ -589,4 +611,5 @@ export const vaultProviderIcons = {
 	doppler: DopplerIcon,
 	azure: AzureIcon,
 	scaleway: ScalewayIcon,
+	phase: PhaseIcon,
 } as const;

apps/dokploy/components/proprietary/roles/manage-custom-roles.tsx

@@ -173,7 +173,7 @@ const RESOURCE_META: Record<string, { label: string; description: string }> = {
 	vaultProvider: {
 		label: "Secrets Providers",
 		description:
-			"Manage external secret managers (HashiCorp Vault, AWS, Azure, Infisical, Doppler, Scaleway) and where their secrets can be referenced",
+			"Manage external secret managers (HashiCorp Vault, AWS, Azure, Infisical, Doppler, Scaleway, Phase) and where their secrets can be referenced",
 	},
 	dnsProvider: {
 		label: "DNS Providers",

apps/dokploy/drizzle/0188_volatile_piledriver.sql

@@ -0,0 +1 @@
+ALTER TYPE "public"."VaultProviderType" ADD VALUE 'phase';

apps/dokploy/drizzle/meta/_journal.json

@@ -1317,6 +1317,13 @@
       "when": 1787937580323,
       "tag": "0187_grant_terminal_permission_to_read_roles",
       "breakpoints": true
+    },
+    {
+      "idx": 188,
+      "version": "7",
+      "when": 1788249519837,
+      "tag": "0188_volatile_piledriver",
+      "breakpoints": true
     }
   ]
 }

packages/server/src/db/schema/vault-provider.ts

@@ -11,6 +11,7 @@ export const vaultProviderType = pgEnum("VaultProviderType", [
 	"doppler",
 	"azure",
 	"scaleway",
+	"phase",
 ]);
 
 export const hashicorpVaultConfigSchema = z.object({
@@ -62,6 +63,15 @@ export const scalewayVaultConfigSchema = z.object({
 	apiUrl: z.string().url().default("https://api.scaleway.com"),
 });
 
+export const phaseVaultConfigSchema = z.object({
+	providerType: z.literal("phase"),
+	token: z.string().min(1),
+	appId: z.string().min(1),
+	env: z.string().min(1),
+	path: z.string().default("/"),
+	apiUrl: z.string().url().default("https://api.phase.dev"),
+});
+
 export const vaultProviderConfigSchema = z.discriminatedUnion("providerType", [
 	hashicorpVaultConfigSchema,
 	infisicalVaultConfigSchema,
@@ -69,6 +79,7 @@ export const vaultProviderConfigSchema = z.discriminatedUnion("providerType", [
 	dopplerVaultConfigSchema,
 	azureVaultConfigSchema,
 	scalewayVaultConfigSchema,
+	phaseVaultConfigSchema,
 ]);
 
 export type VaultProviderConfig = z.infer<typeof vaultProviderConfigSchema>;

packages/server/src/services/vault-provider.ts

@@ -23,6 +23,7 @@ const SENSITIVE_FIELDS: Record<VaultProviderConfig["providerType"], string[]> =
 		doppler: ["serviceToken"],
 		azure: ["clientSecret"],
 		scaleway: ["secretKey"],
+		phase: ["token"],
 	};
 
 export const maskVaultProviderConfig = (

packages/server/src/utils/traefik/application.ts

@@ -5,7 +5,11 @@ import { paths } from "@dokploy/server/constants";
 import type { Domain } from "@dokploy/server/services/domain";
 import { quote } from "shell-quote";
 import { parse, stringify } from "yaml";
-import { execAsync, execAsyncRemote, writeFileRemote } from "../process/execAsync";
+import {
+	execAsync,
+	execAsyncRemote,
+	writeFileRemote,
+} from "../process/execAsync";
 import type { FileConfig, HttpLoadBalancerService } from "./file-types";
 
 export const createTraefikConfig = (appName: string) => {

packages/server/src/utils/vault/phase.ts

@@ -0,0 +1,106 @@
+import type { phaseVaultConfigSchema } from "@dokploy/server/db/schema";
+import type { z } from "zod";
+import { type VaultClient, vaultFetch } from "./types";
+
+type PhaseConfig = z.infer<typeof phaseVaultConfigSchema>;
+
+type PhaseSecret = {
+	key: string;
+	value: string;
+	path?: string;
+};
+
+const baseUrl = (config: PhaseConfig) => config.apiUrl.replace(/\/+$/, "");
+
+const authHeaders = (config: PhaseConfig) => ({
+	Authorization: `Bearer ServiceAccount ${config.token}`,
+	Accept: "application/json",
+});
+
+const parseErrorDetail = async (response: Response) => {
+	try {
+		const body = (await response.json()) as {
+			error?: string;
+			message?: string;
+		};
+		return body.error ?? body.message ?? "";
+	} catch {
+		return "";
+	}
+};
+
+const request = async (
+	config: PhaseConfig,
+	path: string,
+	params?: Record<string, string>,
+) => {
+	const url = new URL(`${baseUrl(config)}${path}`);
+	if (params) {
+		for (const [key, value] of Object.entries(params)) {
+			url.searchParams.set(key, value);
+		}
+	}
+
+	const response = await vaultFetch(url.toString(), {
+		headers: authHeaders(config),
+	});
+
+	if (response.ok) {
+		return response;
+	}
+
+	const detail = await parseErrorDetail(response);
+	const reason =
+		response.status === 401 || response.status === 403
+			? "authentication failed"
+			: "request failed";
+	throw new Error(
+		`Phase: ${reason} (status ${response.status}${detail ? `: ${detail}` : ""})`,
+	);
+};
+
+const fetchSecrets = async (config: PhaseConfig) => {
+	const response = await request(config, "/v1/secrets/", {
+		app_id: config.appId,
+		env: config.env,
+		path: config.path || "/",
+	});
+	const body = (await response.json()) as PhaseSecret[];
+	const secrets: Record<string, string> = {};
+	for (const secret of body ?? []) {
+		secrets[secret.key] = secret.value;
+	}
+	return secrets;
+};
+
+export const phaseClient: VaultClient<PhaseConfig> = {
+	async getSecrets(config, refs) {
+		const secrets = await fetchSecrets(config);
+		const result: Record<string, string> = {};
+		for (const ref of refs) {
+			if (secrets[ref] === undefined) {
+				throw new Error(
+					`Phase: secret "${ref}" not found in environment "${config.env}"`,
+				);
+			}
+			result[ref] = secrets[ref];
+		}
+		return result;
+	},
+
+	async testConnection(config) {
+		const appResponse = await request(config, `/v1/apps/${config.appId}/`);
+		const app = (await appResponse.json()) as { sseEnabled?: boolean };
+		if (app.sseEnabled === false) {
+			throw new Error(
+				"Phase: enable Server-side Encryption (SSE) on this Phase App to use the REST secrets API",
+			);
+		}
+		await fetchSecrets(config);
+	},
+
+	async listSecretNames(config) {
+		const secrets = await fetchSecrets(config);
+		return Object.keys(secrets);
+	},
+};