✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Greptile Summary

This PR adds a $all ("Contains All") operator to the secretTags condition on the secrets permission subject, complementing the existing $in ("Contains") operator which acts as an OR match. The new operator requires a secret to have all specified tags before the permission condition is satisfied, enabling more precise tag-based access control.

The implementation is minimal and correct:

• Adds $ALL = "$all" to the PermissionConditionOperators enum in both backend and frontend
• Extends the SecretConditionV2Schema secretTags field to accept $all alongside $in
• Registers the same array-of-strings Zod validation for $all as exists for $in
• Adds the "Contains All" option to the frontend operator dropdown and its helper description text
• Leverages the natively supported $all operator in @ucast/mongo2js (via buildMongoQueryMatcher) — no custom interpreter needed

Issues found:

• The documentation at docs/internals/permissions/overview.mdx still states that secretTags "only supports $in operator". This needs to be updated to mention $all support, and the operators table on the same page should include an entry for $all.

Confidence Score: 4/5

• This PR is safe to merge; the change is additive, backwards-compatible, and relies on a natively supported CASL/mongo2js operator with no custom logic required.
• The implementation is clean, consistent with existing patterns, and uses a well-supported native operator. The only gap is an outdated documentation line that still describes secretTags as supporting only $in — not a runtime issue, but could mislead API users relying on the docs.
• docs/internals/permissions/overview.mdx — documentation for secretTags operators needs updating.

Important Files Changed

_{Last reviewed commit: ffb1238}