From e603a6155055bd83eebd8b2d6b41b04a8c97b875 Mon Sep 17 00:00:00 2001
From: Mireya Andres <mandres@gitlab.com>
Date: Fri, 3 Oct 2025 23:10:23 +0800
Subject: [PATCH 1/2] Scaffold group secrets manager page

This will be the foundation for the secrets manager in
group context. Requires the `secrets_manager_group` FF.
---
 .../secret_form/secret_form_wrapper.vue       | 13 +--
 .../ci/secrets/components/secrets_app.vue     | 20 +++--
 .../secrets_table/secrets_table.vue           | 11 +++
 .../javascripts/ci/secrets/constants.js       |  1 +
 ee/app/assets/javascripts/ci/secrets/index.js |  4 +-
 .../assets/javascripts/ci/secrets/router.js   |  8 +-
 .../controllers/groups/secrets_controller.rb  | 26 ++++++
 ee/app/helpers/secrets_helper.rb              |  8 +-
 ee/app/views/groups/secrets/index.html.haml   |  3 +
 .../wip/secrets_manager_group.yml             | 10 +++
 ee/config/routes/group.rb                     |  2 +
 .../secret_form/secret_form_wrapper_spec.js   | 16 +++-
 .../ci/secrets/components/secrets_app_spec.js | 22 ++++-
 .../secrets_table/secrets_table_spec.js       | 18 +++-
 .../groups/secrets_controller_spec.rb         | 84 +++++++++++++++++++
 15 files changed, 224 insertions(+), 22 deletions(-)
 create mode 100644 ee/app/controllers/groups/secrets_controller.rb
 create mode 100644 ee/app/views/groups/secrets/index.html.haml
 create mode 100644 ee/config/feature_flags/wip/secrets_manager_group.yml
 create mode 100644 ee/spec/requests/groups/secrets_controller_spec.rb

diff --git a/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue b/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
index 158a96e5fb30f1..e715a7c7e7621e 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
@@ -9,7 +9,7 @@ import {
   ENVIRONMENT_QUERY_LIMIT,
   mapEnvironmentNames,
 } from '~/ci/common/private/ci_environments_dropdown';
-import { ENTITY_PROJECT, FAILED_TO_LOAD_ERROR_MESSAGE } from '../../constants';
+import { ENTITY_GROUP, ENTITY_PROJECT, FAILED_TO_LOAD_ERROR_MESSAGE } from '../../constants';
 import getSecretDetailsQuery from '../../graphql/queries/get_secret_details.query.graphql';
 import SecretForm from './secret_form.vue';
 
@@ -30,7 +30,7 @@ export default {
     SecretForm,
   },
   props: {
-    entity: {
+    context: {
       type: String,
       required: true,
     },
@@ -58,8 +58,11 @@ export default {
   },
   apollo: {
     environments: {
+      skip() {
+        return ![ENTITY_PROJECT, ENTITY_GROUP].includes(this.context);
+      },
       query() {
-        return this.entity === ENTITY_PROJECT ? getProjectEnvironments : getGroupEnvironments;
+        return this.context === ENTITY_PROJECT ? getProjectEnvironments : getGroupEnvironments;
       },
       variables() {
         return {
@@ -69,7 +72,7 @@ export default {
         };
       },
       update(data) {
-        if (this.entity === ENTITY_PROJECT) {
+        if (this.context === ENTITY_PROJECT) {
           return mapEnvironmentNames(data.project?.environments?.nodes || []);
         }
 
@@ -106,7 +109,7 @@ export default {
       return this.isEditing && this.$apollo.queries.secretData.loading;
     },
     pageDescription() {
-      if (this.entity === ENTITY_PROJECT) {
+      if (this.context === ENTITY_PROJECT) {
         return this.$options.i18n.descriptionProject;
       }
 
diff --git a/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue b/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
index 3a35ac6f7448e3..3d38e3f976dc49 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
@@ -3,8 +3,8 @@ import { GlLoadingIcon } from '@gitlab/ui';
 import { s__ } from '~/locale';
 import { createAlert } from '~/alert';
 import { captureException } from '~/sentry/sentry_browser_wrapper';
-import getSecretManagerStatusQuery from '../graphql/queries/get_secret_manager_status.query.graphql';
-import { POLL_INTERVAL, SECRET_MANAGER_STATUS_PROVISIONING } from '../constants';
+import getProjectSecretsManagerStatusQuery from '../graphql/queries/get_secret_manager_status.query.graphql';
+import { ENTITY_PROJECT, POLL_INTERVAL, SECRET_MANAGER_STATUS_PROVISIONING } from '../constants';
 
 export default {
   name: 'SecretsApp',
@@ -12,6 +12,10 @@ export default {
     GlLoadingIcon,
   },
   props: {
+    context: {
+      type: String,
+      required: true,
+    },
     fullPath: {
       type: String,
       required: true,
@@ -24,7 +28,10 @@ export default {
   },
   apollo: {
     secretManagerStatus: {
-      query: getSecretManagerStatusQuery,
+      query: getProjectSecretsManagerStatusQuery,
+      skip() {
+        return !this.isProjectContext;
+      },
       variables() {
         return {
           projectPath: this.fullPath,
@@ -51,6 +58,9 @@ export default {
     },
   },
   computed: {
+    isProjectContext() {
+      return this.context === ENTITY_PROJECT;
+    },
     isProvisioning() {
       return this.secretManagerStatus === SECRET_MANAGER_STATUS_PROVISIONING;
     },
@@ -64,12 +74,12 @@ export default {
 </script>
 <template>
   <gl-loading-icon
-    v-if="!secretManagerStatus"
+    v-if="isProjectContext && !secretManagerStatus"
     data-testid="secrets-manager-loading-status"
     class="gl-mt-5"
   />
   <div
-    v-else-if="isProvisioning"
+    v-else-if="isProjectContext && isProvisioning"
     data-testid="secrets-manager-provisioning-text"
     class="gl-mt-5 gl-text-center"
   >
diff --git a/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue b/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
index 44141adcb134f3..e450620bacc572 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
@@ -24,6 +24,7 @@ import getProjectSecretsNeedingRotation from '../../graphql/queries/get_project_
 import {
   DETAILS_ROUTE_NAME,
   EDIT_ROUTE_NAME,
+  ENTITY_PROJECT,
   NEW_ROUTE_NAME,
   PAGE_SIZE,
   SCOPED_LABEL_COLOR,
@@ -55,6 +56,10 @@ export default {
     GlTooltip: GlTooltipDirective,
   },
   props: {
+    context: {
+      type: String,
+      required: true,
+    },
     fullPath: {
       type: String,
       required: true,
@@ -79,6 +84,9 @@ export default {
   apollo: {
     secrets: {
       query: getProjectSecretsQuery,
+      skip() {
+        return this.context !== ENTITY_PROJECT;
+      },
       variables() {
         return {
           projectPath: this.fullPath,
@@ -104,6 +112,9 @@ export default {
     },
     secretsNeedingRotation: {
       query: getProjectSecretsNeedingRotation,
+      skip() {
+        return this.context !== ENTITY_PROJECT;
+      },
       variables() {
         return {
           projectPath: this.fullPath,
diff --git a/ee/app/assets/javascripts/ci/secrets/constants.js b/ee/app/assets/javascripts/ci/secrets/constants.js
index accb7e52e127d8..9ddcee28cf8a70 100644
--- a/ee/app/assets/javascripts/ci/secrets/constants.js
+++ b/ee/app/assets/javascripts/ci/secrets/constants.js
@@ -13,6 +13,7 @@ export const UNSCOPED_LABEL_COLOR = '#DCDCDE';
 
 export const PAGE_SIZE = 10;
 
+// contexts the secrets manager page works in
 export const ENTITY_GROUP = 'group';
 export const ENTITY_PROJECT = 'project';
 
diff --git a/ee/app/assets/javascripts/ci/secrets/index.js b/ee/app/assets/javascripts/ci/secrets/index.js
index 3c07eb702e5300..d2fbcc164b23ab 100644
--- a/ee/app/assets/javascripts/ci/secrets/index.js
+++ b/ee/app/assets/javascripts/ci/secrets/index.js
@@ -43,7 +43,7 @@ export const initGroupSecretsApp = () => {
 
   const { groupPath, basePath } = el.dataset;
 
-  return initSecretsApp(el, SecretsApp, { entity: ENTITY_GROUP, fullPath: groupPath }, basePath);
+  return initSecretsApp(el, SecretsApp, { context: ENTITY_GROUP, fullPath: groupPath }, basePath);
 };
 
 export const initProjectSecretsApp = () => {
@@ -58,7 +58,7 @@ export const initProjectSecretsApp = () => {
   return initSecretsApp(
     el,
     SecretsApp,
-    { entity: ENTITY_PROJECT, fullPath: projectPath },
+    { context: ENTITY_PROJECT, fullPath: projectPath },
     basePath,
   );
 };
diff --git a/ee/app/assets/javascripts/ci/secrets/router.js b/ee/app/assets/javascripts/ci/secrets/router.js
index 4c42cd73943cb8..2e8f947a8247d5 100644
--- a/ee/app/assets/javascripts/ci/secrets/router.js
+++ b/ee/app/assets/javascripts/ci/secrets/router.js
@@ -9,7 +9,7 @@ import SecretsTable from './components/secrets_table/secrets_table.vue';
 Vue.use(VueRouter);
 
 export default (base, props) => {
-  const { fullPath, entity } = props;
+  const { context, fullPath } = props;
 
   const router = new VueRouter({
     base,
@@ -19,7 +19,7 @@ export default (base, props) => {
         path: '/',
         component: SecretsTable,
         props: () => {
-          return { fullPath };
+          return { context, fullPath };
         },
         meta: {
           getBreadcrumbText: () => s__('SecretsManager|Secrets'),
@@ -31,7 +31,7 @@ export default (base, props) => {
         path: '/new',
         component: SecretFormWrapper,
         props: () => {
-          return { entity, fullPath };
+          return { context, fullPath };
         },
         meta: {
           getBreadcrumbText: () => s__('SecretsManager|New secret'),
@@ -55,7 +55,7 @@ export default (base, props) => {
         component: SecretFormWrapper,
         props: ({ params: { secretName } }) => {
           return {
-            entity,
+            context,
             fullPath,
             isEditing: true,
             secretName,
diff --git a/ee/app/controllers/groups/secrets_controller.rb b/ee/app/controllers/groups/secrets_controller.rb
new file mode 100644
index 00000000000000..14c52b9c3d94ff
--- /dev/null
+++ b/ee/app/controllers/groups/secrets_controller.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Groups
+  class SecretsController < Groups::ApplicationController
+    feature_category :secrets_management
+    urgency :low, [:index]
+
+    layout 'group'
+
+    before_action :authorize_view_secrets!
+    before_action :check_secrets_enabled!
+
+    private
+
+    def authorize_view_secrets!
+      render_404 unless can?(current_user, :reporter_access, group)
+    end
+
+    def check_secrets_enabled!
+      # TODO: check that secrets manager is provisioned and active
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/577453
+      render_404 unless Feature.enabled?(:secrets_manager_group, group) &&
+        group.licensed_feature_available?(:native_secrets_management)
+    end
+  end
+end
diff --git a/ee/app/helpers/secrets_helper.rb b/ee/app/helpers/secrets_helper.rb
index f655994e21e881..49877069469508 100644
--- a/ee/app/helpers/secrets_helper.rb
+++ b/ee/app/helpers/secrets_helper.rb
@@ -4,8 +4,14 @@ module SecretsHelper
   def project_secrets_app_data(project)
     {
       project_path: project.full_path,
-      project_id: project.id,
       base_path: project_secrets_path(project)
     }
   end
+
+  def group_secrets_app_data(group)
+    {
+      group_path: group.full_path,
+      base_path: group_secrets_path(group)
+    }
+  end
 end
diff --git a/ee/app/views/groups/secrets/index.html.haml b/ee/app/views/groups/secrets/index.html.haml
new file mode 100644
index 00000000000000..b944626009798c
--- /dev/null
+++ b/ee/app/views/groups/secrets/index.html.haml
@@ -0,0 +1,3 @@
+- page_title s_('SecretsManager|Secrets')
+
+#js-group-secrets-manager{ data: group_secrets_app_data(@group) }
diff --git a/ee/config/feature_flags/wip/secrets_manager_group.yml b/ee/config/feature_flags/wip/secrets_manager_group.yml
new file mode 100644
index 00000000000000..8f1922a9415954
--- /dev/null
+++ b/ee/config/feature_flags/wip/secrets_manager_group.yml
@@ -0,0 +1,10 @@
+---
+name: secrets_manager_group
+description: For enabling the secrets manager in a group context
+feature_issue_url: https://gitlab.com/groups/gitlab-org/-/epics/17904
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/207457
+rollout_issue_url:
+milestone: '18.6'
+group: group::pipeline security
+type: wip
+default_enabled: false
diff --git a/ee/config/routes/group.rb b/ee/config/routes/group.rb
index 7d691833026f58..a8390a6c1cd54a 100644
--- a/ee/config/routes/group.rb
+++ b/ee/config/routes/group.rb
@@ -283,5 +283,7 @@
     end
 
     draw :virtual_registries
+
+    resources :secrets, path: 'secrets(/*vueroute)', only: [:index]
   end
 end
diff --git a/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js b/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
index 0d957721ef4dee..c14096a51f3554 100644
--- a/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
+++ b/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
@@ -34,7 +34,7 @@ describe('SecretFormWrapper component', () => {
   let mockSecretQuery;
 
   const defaultProps = {
-    entity: ENTITY_GROUP,
+    context: ENTITY_GROUP,
     fullPath: 'full/path/to/entity',
     isEditing: false,
   };
@@ -131,9 +131,19 @@ describe('SecretFormWrapper component', () => {
   });
 
   describe('environments dropdown', () => {
+    it('skips query when context is not project or group', async () => {
+      await createComponent({
+        props: { context: 'INSTANCE' },
+        stubs: { SecretForm, CiEnvironmentsDropdown },
+      });
+
+      expect(mockProjectEnvQuery).not.toHaveBeenCalled();
+      expect(mockGroupEnvQuery).not.toHaveBeenCalled();
+    });
+
     it('uses group environments query for group secrets app', async () => {
       await createComponent({
-        props: { entity: ENTITY_GROUP },
+        props: { context: ENTITY_GROUP },
         stubs: { SecretForm, CiEnvironmentsDropdown },
       });
 
@@ -149,7 +159,7 @@ describe('SecretFormWrapper component', () => {
 
     it('uses project environments query for project secrets app', async () => {
       await createComponent({
-        props: { entity: ENTITY_PROJECT },
+        props: { context: ENTITY_PROJECT },
         stubs: { SecretForm, CiEnvironmentsDropdown },
       });
 
diff --git a/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js b/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
index cf227ddb20637a..443fbe500b1abe 100644
--- a/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
+++ b/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
@@ -11,6 +11,7 @@ import SecretsApp from 'ee/ci/secrets/components/secrets_app.vue';
 import getSecretManagerStatusQuery from 'ee/ci/secrets/graphql/queries/get_secret_manager_status.query.graphql';
 import {
   POLL_INTERVAL,
+  ENTITY_GROUP,
   ENTITY_PROJECT,
   SECRET_MANAGER_STATUS_ACTIVE,
   SECRET_MANAGER_STATUS_PROVISIONING,
@@ -40,6 +41,7 @@ describe('SecretsApp', () => {
       router,
       propsData: {
         fullPath: '/path/to/project',
+        context: ENTITY_PROJECT,
       },
       stubs,
       apolloProvider,
@@ -180,7 +182,7 @@ describe('SecretsApp', () => {
     beforeEach(async () => {
       await createComponent({
         router: createRouter('/-/secrets', {
-          entity: ENTITY_PROJECT,
+          context: ENTITY_PROJECT,
           fullPath: '/path/to/project',
         }),
       });
@@ -193,4 +195,22 @@ describe('SecretsApp', () => {
       expect(mockToastShow).toHaveBeenCalledWith('This is a toast message.');
     });
   });
+
+  describe('group context', () => {
+    beforeEach(async () => {
+      await createComponent({
+        stubs: { RouterView: true },
+        props: { context: ENTITY_GROUP },
+      });
+    });
+
+    it('skips secrets manager status query', () => {
+      expect(mockSecretManagerStatus).not.toHaveBeenCalled();
+    });
+
+    it('does not show loading icon or provisioning state', () => {
+      expect(findLoadingIcon().exists()).toBe(false);
+      expect(findProvisioningText().exists()).toBe(false);
+    });
+  });
 });
diff --git a/ee/spec/frontend/ci/secrets/components/secrets_table/secrets_table_spec.js b/ee/spec/frontend/ci/secrets/components/secrets_table/secrets_table_spec.js
index 3a7f325aa30da2..86aa4771306bd4 100644
--- a/ee/spec/frontend/ci/secrets/components/secrets_table/secrets_table_spec.js
+++ b/ee/spec/frontend/ci/secrets/components/secrets_table/secrets_table_spec.js
@@ -14,7 +14,7 @@ import { createAlert } from '~/alert';
 import { mountExtended } from 'helpers/vue_test_utils_helper';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
-import { PAGE_SIZE } from 'ee/ci/secrets/constants';
+import { ENTITY_GROUP, ENTITY_PROJECT, PAGE_SIZE } from 'ee/ci/secrets/constants';
 import SecretsTable from 'ee/ci/secrets/components/secrets_table/secrets_table.vue';
 import SecretActionsCell from 'ee/ci/secrets/components/secrets_table/secret_actions_cell.vue';
 import SecretDeleteModal from 'ee/ci/secrets/components/secret_delete_modal.vue';
@@ -69,6 +69,7 @@ describe('SecretsTable component', () => {
     wrapper = mountExtended(SecretsTable, {
       propsData: {
         fullPath: `path/to/project`,
+        context: ENTITY_PROJECT,
         ...props,
       },
       apolloProvider,
@@ -449,4 +450,19 @@ describe('SecretsTable component', () => {
       });
     });
   });
+
+  describe('group context', () => {
+    beforeEach(async () => {
+      await createComponent({ props: { context: ENTITY_GROUP } });
+    });
+
+    it('skips project secrets query and project secrets rotation query', () => {
+      expect(mockProjectSecretsResponse).not.toHaveBeenCalled();
+      expect(mockSecretsNeedingRotationResponse).not.toHaveBeenCalled();
+    });
+
+    it('shows empty state', () => {
+      expect(findEmptyState().exists()).toBe(true);
+    });
+  });
 });
diff --git a/ee/spec/requests/groups/secrets_controller_spec.rb b/ee/spec/requests/groups/secrets_controller_spec.rb
new file mode 100644
index 00000000000000..4e600678316a06
--- /dev/null
+++ b/ee/spec/requests/groups/secrets_controller_spec.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Groups::SecretsController, feature_category: :secrets_management do
+  let_it_be(:developer) { create(:user) }
+  let_it_be(:reporter) { create(:user, :with_namespace) }
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:group) { create(:group) }
+
+  shared_examples 'group secrets manager page' do
+    it 'renders the group secrets index template' do
+      subject
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response).to render_template('groups/secrets/index')
+    end
+  end
+
+  shared_examples 'page not found' do
+    it 'returns a "not found" response' do
+      subject
+
+      expect(response).to have_gitlab_http_status(:not_found)
+    end
+  end
+
+  describe 'GET /:namespace/:group/-/secrets' do
+    subject(:request) { get group_secrets_url(group), params: { group_id: group.to_param } }
+
+    before_all do
+      stub_feature_flags(secrets_manager_group: group)
+      group.add_developer(developer)
+      group.add_reporter(reporter)
+      group.add_guest(guest)
+    end
+
+    context 'when all conditions are met' do
+      before do
+        stub_licensed_features(native_secrets_management: true)
+        sign_in(reporter)
+      end
+
+      it_behaves_like 'group secrets manager page'
+    end
+
+    context 'when user has a role higher than reporter' do
+      before do
+        stub_licensed_features(native_secrets_management: true)
+        sign_in(developer)
+      end
+
+      it_behaves_like 'group secrets manager page'
+    end
+
+    context 'when user is not Reporter+' do
+      before do
+        stub_licensed_features(native_secrets_management: true)
+        sign_in(guest)
+      end
+
+      it_behaves_like 'page not found'
+    end
+
+    context 'when feature flag is disabled' do
+      before do
+        stub_licensed_features(native_secrets_management: true)
+        stub_feature_flags(secrets_manager_group: false)
+        sign_in(reporter)
+      end
+
+      it_behaves_like 'page not found'
+    end
+
+    context 'when feature license is disabled' do
+      before do
+        stub_licensed_features(native_secrets_management: false)
+        sign_in(reporter)
+      end
+
+      it_behaves_like 'page not found'
+    end
+  end
+end
-- 
GitLab


From d9b28ea81e954e6601b3252a4823af877db9035c Mon Sep 17 00:00:00 2001
From: Mireya Andres <mandres@gitlab.com>
Date: Thu, 23 Oct 2025 11:38:35 +0800
Subject: [PATCH 2/2] Add validator to context prop and fix tests

---
 .../components/secret_form/secret_form_wrapper.vue     |  8 +++++++-
 .../javascripts/ci/secrets/components/secrets_app.vue  |  8 +++++++-
 .../secrets/components/secrets_table/secrets_table.vue |  2 ++
 ee/app/assets/javascripts/ci/secrets/constants.js      |  1 +
 .../components/secret_form/secret_form_wrapper_spec.js | 10 ----------
 .../frontend/ci/secrets/components/secrets_app_spec.js |  3 ++-
 ee/spec/frontend/ci/secrets/router_spec.js             |  4 ++--
 7 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue b/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
index e715a7c7e7621e..7ab8a557ffa4db 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secret_form/secret_form_wrapper.vue
@@ -9,7 +9,12 @@ import {
   ENVIRONMENT_QUERY_LIMIT,
   mapEnvironmentNames,
 } from '~/ci/common/private/ci_environments_dropdown';
-import { ENTITY_GROUP, ENTITY_PROJECT, FAILED_TO_LOAD_ERROR_MESSAGE } from '../../constants';
+import {
+  ACCEPTED_CONTEXTS,
+  ENTITY_GROUP,
+  ENTITY_PROJECT,
+  FAILED_TO_LOAD_ERROR_MESSAGE,
+} from '../../constants';
 import getSecretDetailsQuery from '../../graphql/queries/get_secret_details.query.graphql';
 import SecretForm from './secret_form.vue';
 
@@ -33,6 +38,7 @@ export default {
     context: {
       type: String,
       required: true,
+      validator: (value) => ACCEPTED_CONTEXTS.includes(value),
     },
     fullPath: {
       type: String,
diff --git a/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue b/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
index 3d38e3f976dc49..ef4d34c27902c1 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secrets_app.vue
@@ -4,7 +4,12 @@ import { s__ } from '~/locale';
 import { createAlert } from '~/alert';
 import { captureException } from '~/sentry/sentry_browser_wrapper';
 import getProjectSecretsManagerStatusQuery from '../graphql/queries/get_secret_manager_status.query.graphql';
-import { ENTITY_PROJECT, POLL_INTERVAL, SECRET_MANAGER_STATUS_PROVISIONING } from '../constants';
+import {
+  ACCEPTED_CONTEXTS,
+  ENTITY_PROJECT,
+  POLL_INTERVAL,
+  SECRET_MANAGER_STATUS_PROVISIONING,
+} from '../constants';
 
 export default {
   name: 'SecretsApp',
@@ -15,6 +20,7 @@ export default {
     context: {
       type: String,
       required: true,
+      validator: (value) => ACCEPTED_CONTEXTS.includes(value),
     },
     fullPath: {
       type: String,
diff --git a/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue b/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
index e450620bacc572..6f5fca04377cb0 100644
--- a/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
+++ b/ee/app/assets/javascripts/ci/secrets/components/secrets_table/secrets_table.vue
@@ -22,6 +22,7 @@ import { convertEnvironmentScope } from '~/ci/common/private/ci_environments_dro
 import getProjectSecretsQuery from '../../graphql/queries/get_project_secrets.query.graphql';
 import getProjectSecretsNeedingRotation from '../../graphql/queries/get_project_secrets_needing_rotation.query.graphql';
 import {
+  ACCEPTED_CONTEXTS,
   DETAILS_ROUTE_NAME,
   EDIT_ROUTE_NAME,
   ENTITY_PROJECT,
@@ -59,6 +60,7 @@ export default {
     context: {
       type: String,
       required: true,
+      validator: (value) => ACCEPTED_CONTEXTS.includes(value),
     },
     fullPath: {
       type: String,
diff --git a/ee/app/assets/javascripts/ci/secrets/constants.js b/ee/app/assets/javascripts/ci/secrets/constants.js
index 9ddcee28cf8a70..a37b9d06301064 100644
--- a/ee/app/assets/javascripts/ci/secrets/constants.js
+++ b/ee/app/assets/javascripts/ci/secrets/constants.js
@@ -16,6 +16,7 @@ export const PAGE_SIZE = 10;
 // contexts the secrets manager page works in
 export const ENTITY_GROUP = 'group';
 export const ENTITY_PROJECT = 'project';
+export const ACCEPTED_CONTEXTS = [ENTITY_GROUP, ENTITY_PROJECT];
 
 export const ACTION_ENABLE_SECRET_MANAGER = 'ENABLE_SECRET_MANAGER';
 export const SECRET_MANAGER_STATUS_ACTIVE = 'ACTIVE';
diff --git a/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js b/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
index c14096a51f3554..c81c15d2651170 100644
--- a/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
+++ b/ee/spec/frontend/ci/secrets/components/secret_form/secret_form_wrapper_spec.js
@@ -131,16 +131,6 @@ describe('SecretFormWrapper component', () => {
   });
 
   describe('environments dropdown', () => {
-    it('skips query when context is not project or group', async () => {
-      await createComponent({
-        props: { context: 'INSTANCE' },
-        stubs: { SecretForm, CiEnvironmentsDropdown },
-      });
-
-      expect(mockProjectEnvQuery).not.toHaveBeenCalled();
-      expect(mockGroupEnvQuery).not.toHaveBeenCalled();
-    });
-
     it('uses group environments query for group secrets app', async () => {
       await createComponent({
         props: { context: ENTITY_GROUP },
diff --git a/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js b/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
index 443fbe500b1abe..7d50d59e46156a 100644
--- a/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
+++ b/ee/spec/frontend/ci/secrets/components/secrets_app_spec.js
@@ -32,7 +32,7 @@ describe('SecretsApp', () => {
 
   const findRouterView = () => wrapper.findComponent({ ref: 'router-view' });
 
-  const createComponent = async ({ stubs, router, isLoading = false } = {}) => {
+  const createComponent = async ({ stubs, router, props, isLoading = false } = {}) => {
     const handlers = [[getSecretManagerStatusQuery, mockSecretManagerStatus]];
 
     apolloProvider = createMockApollo(handlers);
@@ -42,6 +42,7 @@ describe('SecretsApp', () => {
       propsData: {
         fullPath: '/path/to/project',
         context: ENTITY_PROJECT,
+        ...props,
       },
       stubs,
       apolloProvider,
diff --git a/ee/spec/frontend/ci/secrets/router_spec.js b/ee/spec/frontend/ci/secrets/router_spec.js
index 229d61bdd68520..3b975a893ee04a 100644
--- a/ee/spec/frontend/ci/secrets/router_spec.js
+++ b/ee/spec/frontend/ci/secrets/router_spec.js
@@ -36,12 +36,12 @@ describe('Secrets router', () => {
   const base = '/-/secrets';
 
   const groupProps = {
-    entity: ENTITY_GROUP,
+    context: ENTITY_GROUP,
     fullPath: '/path/to/group',
   };
 
   const projectProps = {
-    entity: ENTITY_PROJECT,
+    context: ENTITY_PROJECT,
     fullPath: '/path/to/project',
   };
 
-- 
GitLab