feat(pam): redis web access, arrow key support by saifsmailbox98 · Pull Request #5688 · Infisical/infisical

saifsmailbox98 · 2026-03-13T21:13:29Z

Context

Adds support for Redis Web Access - users can now access PAM Redis resource from the browser
Adds arrow key support - non-SSH web access interfaces will now support line editing and arrow keys for navigation and command history

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

linear · 2026-03-13T21:13:32Z

PAM-135 Web Launcher: Redis

maidul98 · 2026-03-13T21:14:15Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-03-13T21:17:54Z

Greptile Summary

This PR adds Redis web access support to the PAM module, allowing users to interact with Redis resources via a browser-based REPL, and replaces the hand-rolled line buffer for all non-SSH sessions (PostgreSQL included) with the xterm-readline addon for full arrow-key navigation and command history.

Key changes:

New pam-redis-session-handler.ts establishes an ioredis connection through the gateway relay, processes commands sequentially via a promise chain, and maps Redis replies to redis-cli-style output via the new pam-redis-formatter.ts utility.
pam-redis-formatter.ts provides tokenizeRedisInput (shell-style quoted-string tokenizer) and formatRedisReply (recursive redis-cli output formatter), both covered by a good unit test suite.
useWebAccessSession.ts replaces the previous manual onData keyboard handler for non-SSH sessions with Readline from xterm-readline, introducing a runReadLoop / waitForNextPrompt coordination pattern that correctly serialises input and prompt updates.
Documentation, sidebar navigation, and the connect modal are all updated to include Redis.

Issues found:

In pam-redis-formatter.ts, escapeRedisString calls str.replace(re2Instance, ...) (native String.prototype.replace) rather than the preferred re2Instance.replace(str, ...) pattern recommended by the RE2 usage convention.
In pam-redis-session-handler.ts, the session-established log omits the username field required by the project's logging convention for cloud queryability.
In pam-redis-formatter.ts, tokenizeRedisInput silently discards content inside an unclosed quoted string rather than signalling a parse error, causing a confusing ERR wrong number of arguments response from Redis.

Confidence Score: 4/5

This PR is safe to merge; all previously flagged critical issues (connection failure cleanup, credential forwarding, double-quote escaping) have been addressed, and the new code is well-structured with good test coverage.
The implementation closely mirrors the existing Postgres session handler pattern, includes unit tests, and correctly handles the gateway-relay credential injection model. The remaining issues are minor style/convention violations (RE2 usage pattern, missing log field, silent tokenizer behaviour on bad input) with no runtime correctness or security impact.
backend/src/ee/services/pam-web-access/pam-redis-formatter.ts — RE2 usage pattern and unterminated-quote tokenizer behaviour; backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts — missing username in log.

Important Files Changed

Filename	Overview
backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts	New Redis WebSocket session handler; correctly guards connection failure with early disconnect, uses sequential promise chaining for messages, and properly uses `enableReadyCheck: false` since credentials are gateway-injected. Minor: logger call missing username field per logging convention.
backend/src/ee/services/pam-web-access/pam-redis-formatter.ts	New Redis reply formatter and input tokenizer; correctly uses RE2 instances for string escaping but calls them via native `String.prototype.replace()` instead of the preferred `re2Instance.replace()` style. Tokenizer silently drops content inside an unterminated quoted string rather than signalling a parse error.
backend/src/ee/services/pam-web-access/pam-redis-formatter.test.ts	Comprehensive unit tests for both `tokenizeRedisInput` and `formatRedisReply`; covers null, undefined, integers, bigints, strings with escape characters, nested arrays, and Buffers. Missing a test for unterminated quoted strings.
backend/src/ee/services/pam-web-access/pam-web-access-service.ts	Minimal, correct change: adds `PamResource.Redis` to `SUPPORTED_WEB_ACCESS_RESOURCES` and dispatches to `handleRedisSession` in the resource-type switch. Follows the same pattern as Postgres and SSH handlers.
frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts	Replaces the hand-rolled line-buffer for non-SSH sessions with `xterm-readline`, providing arrow-key history and full line editing. The read-loop / waitForNextPrompt coordination is correctly serialised. There is a fallback path (`else if (!isSSH)` without `readlineRef.current`) that is effectively dead code since readline is always initialised before the WebSocket opens.

Comments Outside Diff (1)

backend/src/ee/services/pam-web-access/pam-redis-formatter.ts, line 8-41 (link)

Unterminated quoted strings are silently dropped

If a user types a command with an unclosed quote (e.g. SET key "hello), the partial content inside the unclosed quote is silently discarded. The tokenizer returns ["SET", "key"] instead of emitting a parse error, causing Redis to respond with ERR wrong number of arguments for 'set' command — which is a confusing error message given the user's input.

Consider returning an error signal when a quoted string is unterminated:
```
if (inQuote !== null) {
  // Unterminated quote — treat remainder as a token to avoid silent data loss,
  // or return an error marker so the caller can surface a clear message.
  if (current.length > 0) tokens.push(current);
  // Optionally: return null or throw to signal malformed input
}
```
This matches the behavior users would expect from redis-cli, which also flags unterminated quotes as an error.

_{Last reviewed commit: e4cb5f6}

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts

frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts

…nto a reusable module with thorough test coverage.

…d string handling in formatter.

…isconnection on failure

saifsmailbox98 · 2026-03-13T22:04:59Z

@greptile re-review this PR

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts

backend/src/ee/services/pam-web-access/pam-redis-formatter.ts

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts

…rresponding test cases

saifsmailbox98 · 2026-03-13T22:20:02Z

@greptile re-review this PR

saifsmailbox98 · 2026-03-13T22:38:48Z

@greptile re-review this PR

… check and reducing redundant code

…cher-redis

* main: (1418 commits) Minor UI improvements on code signing Update docs/documentation/getting-started/introduction.mdx Added what is infisical video to the corresponding docs page fix: correct audit log spread ordering to prevent org id being set undefined chore: update static IP for US and EU shared cloud Doc improvements fix: correct operator subset check to be more restrictive and add tests fix: specify down length improvement(auth): increase azure spid field length feat(pam): redis web access, arrow key support (Infisical#5688) Address PR comments fix: lint issue CA Certificate Support for LDAPS refactor(api): consolidate deletedSecretKeys population and remove TSyncSecretsResult annotation in AWS PS sync refactor(api): remove redundant TSyncSecretsResult return type annotation in AWS SM sync fix: replace empty .catch() with logger.error for telemetry event error handling improvement: make index creation concurrent Reduce Jargon improvement(pam): swap resources table to card grid and add favorites (Infisical#5701) Show dependencies on resources ... # Conflicts: # helm-charts/infisical-standalone-postgres/templates/infisical.yaml # helm-charts/infisical-standalone-postgres/values.yaml

saifsmailbox98 added 2 commits March 13, 2026 23:05

Add Redis web access support

2db6179

Add xterm-readline for enhanced input handling in non-SSH sessions

58343b0

greptile-apps bot reviewed Mar 13, 2026

View reviewed changes

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts Outdated Show resolved Hide resolved

frontend/src/pages/pam/PamAccountAccessPage/useWebAccessSession.ts Show resolved Hide resolved

saifsmailbox98 added 3 commits March 14, 2026 03:15

Extract and deduplicate tokenizeRedisInput and formatRedisReply i…

179e454

…nto a reusable module with thorough test coverage.

Handle "clear-buffer" Redis message and fix edge case for empty quote…

3794cea

…d string handling in formatter.

Add error handling for Redis connection readiness and ensure proper d…

98819bd

…isconnection on failure

greptile-apps bot reviewed Mar 13, 2026

View reviewed changes

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts Show resolved Hide resolved

backend/src/ee/services/pam-web-access/pam-redis-formatter.ts Show resolved Hide resolved

backend/src/ee/services/pam-web-access/pam-redis-session-handler.ts Show resolved Hide resolved

Escape backslashes and double quotes in formatRedisReply and add co…

9a7ff4c

…rresponding test cases

saifsmailbox98 added 2 commits March 14, 2026 04:02

Document Redis web access

ba502b3

Use RE2

e4cb5f6

saifsmailbox98 requested a review from x032205 March 13, 2026 22:58

saifsmailbox98 added 3 commits March 14, 2026 05:07

Remove enableReadyCheck from Redis session configuration

d9891c5

Improve Redis connection readiness handling by adding a "close" event…

dce7875

… check and reducing redundant code

Merge remote-tracking branch 'origin/main' into saif/pam-135-web-laun…

7d16b57

…cher-redis

x032205 approved these changes Mar 18, 2026

View reviewed changes

saifsmailbox98 merged commit 4bebbd6 into main Mar 18, 2026
12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(pam): redis web access, arrow key support#5688

feat(pam): redis web access, arrow key support#5688
saifsmailbox98 merged 11 commits intomainfrom
saif/pam-135-web-launcher-redis

saifsmailbox98 commented Mar 13, 2026

Uh oh!

linear bot commented Mar 13, 2026

Uh oh!

maidul98 commented Mar 13, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 13, 2026 •

edited

Loading

Comments Outside Diff (1)

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

saifsmailbox98 commented Mar 13, 2026

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear bot commented Mar 13, 2026

Uh oh!

maidul98 commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

Important Files Changed

Comments Outside Diff (1)

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

saifsmailbox98 commented Mar 13, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

maidul98 commented Mar 13, 2026 •

edited

Loading

greptile-apps bot commented Mar 13, 2026 •

edited

Loading