[Backend] Add Expiration Management to Secret Permissions

Why are we doing this work

The aim of the issue is to Enhance OpenBao ACL policies by adding expired_at metadata for secret permissions and implementing runtime expiry validation during access attempts.

Things to be done:

  1. Add expired_at in the ACL policy's metadata.
  2. While providing access to secrets add an additional check to make sure the permissions are not expired.

Relevant links

Non-functional requirements

  • Documentation:
  • Testing:

Implementation plan

  1. Add expired_at in ee/lib/secrets_management/acl_policy_path.rb, extend AclPolicyPath to carry expired_at and render it under metadata as an expiration name to openBao attributes
  2. Add a validation on expired_at in SecretsManagement::SecretPermission
  3. Tests

Verification steps

  1. Apply Rails-rendered policy to OpenBao → accepted without error.
  2. Policy with future expired_at → secret read succeeds.
  3. Policy with past expired_at → secret read denied (403 permission denied).
  4. Invalid timestamp format → OpenBao rejects policy.
  5. Existing policies without expired_at continue to work.
Edited by Dmytro Biryukov