Legacy UI redirect changes the requested KV secret version

[tc-tlv]

Describe the bug
Legacy Vault UI deep links using /ui/vault/secrets/... do not preserve the requested KV secret version when they are redirected to the new /ui/vault/secrets-engines/... route.

For example, a saved link that explicitly requests version 1:

https://vault/ui/vault/secrets/engine/kv/secret/details?version=1

is redirected to:

https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=2

The path migration is expected, but changing version=1 to version=2 is not. The equivalent URL that already uses the new route works correctly and displays version 1:

https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=1

This breaks durable links to historical secret versions stored in documentation, runbooks, tickets, and bookmarks. It can also cause users to view a different secret version than the one referenced by the original link.

To Reproduce
Steps to reproduce the behavior:

1. Use a KV v2 secret for which at least versions 1 and 2 exist.
2. Open a legacy UI deep link that explicitly requests version 1, replacing the host, mount, and secret path as needed: https://vault/ui/vault/secrets/engine/kv/secret/details?version=1.
3. Allow Vault UI to redirect the legacy /secrets/ route to /secrets-engines/.
4. Observe that the resulting URL requests version=2 instead of version=1.
5. Open https://vault/ui/vault/secrets-engines/engine/kv/secret/details?version=1 directly and observe that version 1 is displayed correctly.

Expected behavior
The legacy route should redirect to the equivalent new route while preserving the complete query string, including the requested KV version. In this example:

/ui/vault/secrets/engine/kv/secret/details?version=1

should redirect to:

/ui/vault/secrets-engines/engine/kv/secret/details?version=1

Existing documentation links and bookmarks should continue to reference the same secret version after the route migration.

Environment:

• Vault Server Version (retrieve with vault status): Not provided
• Vault CLI Version (retrieve with vault version): Not applicable to this UI redirect
• Server Operating System/Architecture: Not provided

Vault server configuration file(s):

# No configuration known to be relevant; the behavior occurs in the Vault UI route redirect.

Additional context
This appears related to the migration of Vault UI routes from /secrets to /secrets-engines. A previously reported deep-link redirect problem was addressed in #31939, but the redirect also needs to preserve query parameters and their values. Please add regression coverage for legacy KV deep links with ?version=<n> so the redirect cannot silently select the latest or another secret version.

[dosubot]

Thanks for the detailed report, @tc-tlv. This looks like a legitimate bug in the legacy redirect logic.

The root cause is in secrets-redirect-with-path.js — the beforeModel hook extracts only the path from transition.to.params and constructs a plain URL string for replaceWith(), but never reads or forwards query parameters from the original transition:

const path = params?.path;
if (path) {
  const newUrl = `/vault/secrets-engines/${path}`;
  this.router.replaceWith(newUrl);
}

[1]

Because query parameters like ?version=1 are not extracted from the transition and not appended to the new URL, they are silently dropped during the redirect. The page then loads with whatever version the KV engine defaults to (typically the latest), which is why you see version=2 instead of version=1.

This was introduced by the fix for #31939 [2], which addressed path preservation but didn't account for query parameters. I didn't find any open or merged PRs that fix this gap yet.

To fix this, the redirect would need to extract query parameters from the Ember transition object (e.g., transition.to.queryParams) and pass them through to replaceWith(). Could you share your Vault server version so we can confirm which release you're on?

Written by @dosu, approved by heatherezell

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[tc-tlv]

@dosu This behavior was noticed on Vault v2.0.2.

[dosubot]

Thanks for confirming, @tc-tlv. Vault 2.0.x is a supported and active version line [1], so this is definitely in scope.

I checked the git history for secrets-redirect-with-path.js and confirmed that no fix for query parameter preservation has been applied in any 2.0.x release after 2.0.2 (including 2.0.3 and 2.0.4), so upgrading within 2.0.x won't resolve this today.

The bug is clear-cut — the redirect constructs a plain path string without forwarding transition.to.queryParams, so ?version=N (and any other query parameters) are silently dropped. This should be straightforward to fix in the redirect route.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.

[tc-tlv]

@dosu Do you want me to provide a fix? Or will someone else take care of this?

[dosubot]

Community contributions are welcome, @tc-tlv! If you'd like to open a PR with a fix, that would be great. I can't speak to the maintainers' timeline for picking this up otherwise.

The fix itself should be small — in ui/app/routes/vault/cluster/secrets-redirect-with-path.js, the beforeModel hook needs to read transition.to.queryParams and forward them through the replaceWith() call. Something along these lines:

beforeModel(transition) {
  const params = transition.to.params;
  const path = params?.path;
  const queryParams = transition.to.queryParams;

  if (path) {
    const newUrl = `/vault/secrets-engines/${path}`;
    this.router.replaceWith(newUrl, { queryParams });
  } else {
    this.router.replaceWith('vault.cluster.secrets', { queryParams });
  }
}

You'd also want to add a test covering the ?version=N case to prevent regressions, as you suggested in the issue description. Just make sure the CLA is signed before opening the PR.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.