Begin frontend for GCP IAM Auth

2026-09-22 13:39:35 +00:00 · 2024-05-07 12:40:19 -07:00
parent e96ca8d355
commit 1d40d9e448
7 changed files with 479 additions and 21 deletions
--- a/frontend/src/hooks/api/identities/constants.tsx
+++ b/frontend/src/hooks/api/identities/constants.tsx
@@ -1,5 +1,6 @@
 import { IdentityAuthMethod } from "./enums";

 export const identityAuthToNameMap: { [I in IdentityAuthMethod]: string } = {
-  [IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth"
+  [IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth",
+  [IdentityAuthMethod.GCP_IAM_AUTH]: "GCP IAM Auth"
 };
--- a/frontend/src/hooks/api/identities/enums.tsx
+++ b/frontend/src/hooks/api/identities/enums.tsx
@@ -1,3 +1,4 @@
 export enum IdentityAuthMethod {
-  UNIVERSAL_AUTH = "universal-auth"
+  UNIVERSAL_AUTH = "universal-auth",
+  GCP_IAM_AUTH = "gcp-iam-auth"
 }
--- a/frontend/src/hooks/api/identities/index.tsx
+++ b/frontend/src/hooks/api/identities/index.tsx
@@ -1,12 +1,16 @@
 export { identityAuthToNameMap } from "./constants";
 export { IdentityAuthMethod } from "./enums";
 export {
+  useAddIdentityGcpIamAuth,
  useAddIdentityUniversalAuth,
  useCreateIdentity,
  useCreateIdentityUniversalAuthClientSecret,
  useDeleteIdentity,
  useRevokeIdentityUniversalAuthClientSecret,
  useUpdateIdentity,
-  useUpdateIdentityUniversalAuth
-} from "./mutations";
-export { useGetIdentityUniversalAuth, useGetIdentityUniversalAuthClientSecrets } from "./queries";
+  useUpdateIdentityGcpIamAuth,
+  useUpdateIdentityUniversalAuth} from "./mutations";
+export {
+  useGetIdentityGcpIamAuth,
+  useGetIdentityUniversalAuth,
+  useGetIdentityUniversalAuthClientSecrets} from "./queries";
--- a/frontend/src/hooks/api/identities/mutations.tsx
+++ b/frontend/src/hooks/api/identities/mutations.tsx
@@ -5,6 +5,7 @@ import { apiRequest } from "@app/config/request";
 import { organizationKeys } from "../organization/queries";
 import { identitiesKeys } from "./queries";
 import {
+  AddIdentityGcpIamAuthDTO,
  AddIdentityUniversalAuthDTO,
  ClientSecretData,
  CreateIdentityDTO,
@@ -13,10 +14,11 @@ import {
  DeleteIdentityDTO,
  DeleteIdentityUniversalAuthClientSecretDTO,
  Identity,
+  IdentityGcpIamAuth,
  IdentityUniversalAuth,
  UpdateIdentityDTO,
-  UpdateIdentityUniversalAuthDTO
-} from "./types";
+  UpdateIdentityGcpIamAuthDTO,
+  UpdateIdentityUniversalAuthDTO} from "./types";

 export const useCreateIdentity = () => {
  const queryClient = useQueryClient();
@@ -169,3 +171,70 @@ export const useRevokeIdentityUniversalAuthClientSecret = () => {
    }
  });
 };
+
+export const useAddIdentityGcpIamAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityGcpIamAuth, {}, AddIdentityGcpIamAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      allowedServiceAccounts,
+      allowedProjects,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const {
+        data: { identityGcpIamAuth }
+      } = await apiRequest.post<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
+        `/api/v1/auth/gcp-iam-auth/identities/${identityId}`,
+        {
+          allowedServiceAccounts,
+          allowedProjects,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+
+      return identityGcpIamAuth;
+    },
+    onSuccess: (_, { organizationId }) => {
+      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
+    }
+  });
+};
+
+export const useUpdateIdentityGcpIamAuth = () => {
+  const queryClient = useQueryClient();
+  return useMutation<IdentityGcpIamAuth, {}, UpdateIdentityGcpIamAuthDTO>({
+    mutationFn: async ({
+      identityId,
+      allowedServiceAccounts,
+      allowedProjects,
+      accessTokenTTL,
+      accessTokenMaxTTL,
+      accessTokenNumUsesLimit,
+      accessTokenTrustedIps
+    }) => {
+      const {
+        data: { identityGcpIamAuth }
+      } = await apiRequest.patch<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
+        `/api/v1/auth/gcp-iam-auth/identities/${identityId}`,
+        {
+          allowedServiceAccounts,
+          allowedProjects,
+          accessTokenTTL,
+          accessTokenMaxTTL,
+          accessTokenNumUsesLimit,
+          accessTokenTrustedIps
+        }
+      );
+      return identityGcpIamAuth;
+    },
+    onSuccess: (_, { organizationId }) => {
+      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
+    }
+  });
+};
--- a/frontend/src/hooks/api/identities/queries.tsx
+++ b/frontend/src/hooks/api/identities/queries.tsx
@@ -2,13 +2,14 @@ import { useQuery } from "@tanstack/react-query";

 import { apiRequest } from "@app/config/request";

-import { ClientSecretData, IdentityUniversalAuth } from "./types";
+import { ClientSecretData, IdentityGcpIamAuth,IdentityUniversalAuth } from "./types";

 export const identitiesKeys = {
  getIdentityUniversalAuth: (identityId: string) =>
    [{ identityId }, "identity-universal-auth"] as const,
  getIdentityUniversalAuthClientSecrets: (identityId: string) =>
-    [{ identityId }, "identity-universal-auth-client-secrets"] as const
+    [{ identityId }, "identity-universal-auth-client-secrets"] as const,
+  getIdentityGcpIamAuth: (identityId: string) => [{ identityId }, "identity-gcp-iam-auth"] as const
 };

 export const useGetIdentityUniversalAuth = (identityId: string) => {
@@ -44,3 +45,18 @@ export const useGetIdentityUniversalAuthClientSecrets = (identityId: string) =>
    }
  });
 };
+
+export const useGetIdentityGcpIamAuth = (identityId: string) => {
+  return useQuery({
+    enabled: Boolean(identityId),
+    queryKey: identitiesKeys.getIdentityGcpIamAuth(identityId),
+    queryFn: async () => {
+      const {
+        data: { identityGcpIamAuth }
+      } = await apiRequest.get<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
+        `/api/v1/auth/gcp-iam-auth/identities/${identityId}`
+      );
+      return identityGcpIamAuth;
+    }
+  });
+};
--- a/frontend/src/hooks/api/identities/types.ts
+++ b/frontend/src/hooks/api/identities/types.ts
@@ -38,19 +38,19 @@ export type IdentityMembership = {
      customRoleSlug: string;
    } & (
      | {
-        isTemporary: false;
-        temporaryRange: null;
-        temporaryMode: null;
-        temporaryAccessEndTime: null;
-        temporaryAccessStartTime: null;
-      }
+          isTemporary: false;
+          temporaryRange: null;
+          temporaryMode: null;
+          temporaryAccessEndTime: null;
+          temporaryAccessStartTime: null;
+        }
      | {
-        isTemporary: true;
-        temporaryRange: string;
-        temporaryMode: string;
-        temporaryAccessEndTime: string;
-        temporaryAccessStartTime: string;
-      }
+          isTemporary: true;
+          temporaryRange: string;
+          temporaryMode: string;
+          temporaryAccessEndTime: string;
+          temporaryAccessStartTime: string;
+        }
    )
  >;
  createdAt: string;
@@ -113,6 +113,42 @@ export type UpdateIdentityUniversalAuthDTO = {
  }[];
 };

+export type IdentityGcpIamAuth = {
+  identityId: string;
+  allowedServiceAccounts: string;
+  allowedProjects: string;
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: IdentityTrustedIp[];
+};
+
+export type AddIdentityGcpIamAuthDTO = {
+  organizationId: string;
+  identityId: string;
+  allowedServiceAccounts: string;
+  allowedProjects: string;
+  accessTokenTTL: number;
+  accessTokenMaxTTL: number;
+  accessTokenNumUsesLimit: number;
+  accessTokenTrustedIps: {
+    ipAddress: string;
+  }[];
+};
+
+export type UpdateIdentityGcpIamAuthDTO = {
+  organizationId: string;
+  identityId: string;
+  allowedServiceAccounts?: string;
+  allowedProjects?: string;
+  accessTokenTTL?: number;
+  accessTokenMaxTTL?: number;
+  accessTokenNumUsesLimit?: number;
+  accessTokenTrustedIps?: {
+    ipAddress: string;
+  }[];
+};
+
 export type CreateIdentityUniversalAuthClientSecretDTO = {
  identityId: string;
  description?: string;
--- a/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpIamAuthForm.tsx
+++ b/frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpIamAuthForm.tsx
@@ -0,0 +1,331 @@
+import { useEffect } from "react";
+import { Controller, useFieldArray, useForm } from "react-hook-form";
+import { faPlus, faXmark } from "@fortawesome/free-solid-svg-icons";
+import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { yupResolver } from "@hookform/resolvers/yup";
+import * as yup from "yup";
+
+import { createNotification } from "@app/components/notifications";
+import { Button, FormControl, IconButton, Input } from "@app/components/v2";
+import { useOrganization, useSubscription } from "@app/context";
+import {
+  useAddIdentityGcpIamAuth,
+  useGetIdentityGcpIamAuth,
+  useUpdateIdentityGcpIamAuth
+} from "@app/hooks/api";
+import { IdentityAuthMethod } from "@app/hooks/api/identities";
+import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
+import { UsePopUpState } from "@app/hooks/usePopUp";
+
+const schema = yup
+  .object({
+    allowedServiceAccounts: yup.string(),
+    allowedProjects: yup.string(),
+    accessTokenTTL: yup.string().required("Access Token TTL is required"),
+    accessTokenMaxTTL: yup.string().required("Access Max Token TTL is required"),
+    accessTokenNumUsesLimit: yup.string().required("Access Token Max Number of Uses is required"),
+    accessTokenTrustedIps: yup
+      .array(
+        yup.object({
+          ipAddress: yup.string().max(50).required().label("IP Address")
+        })
+      )
+      .min(1)
+      .required()
+      .label("Access Token Trusted IP")
+  })
+  .required();
+
+export type FormData = yup.InferType<typeof schema>;
+
+type Props = {
+  handlePopUpOpen: (popUpName: keyof UsePopUpState<["upgradePlan"]>) => void;
+  handlePopUpToggle: (
+    popUpName: keyof UsePopUpState<["identityAuthMethod"]>,
+    state?: boolean
+  ) => void;
+  identityAuthMethodData: {
+    identityId: string;
+    name: string;
+    authMethod?: IdentityAuthMethod;
+  };
+};
+
+export const IdentityAwsIamAuthForm = ({
+  handlePopUpOpen,
+  handlePopUpToggle,
+  identityAuthMethodData
+}: Props) => {
+  const { currentOrg } = useOrganization();
+  const orgId = currentOrg?.id || "";
+  const { subscription } = useSubscription();
+
+  const { mutateAsync: addMutateAsync } = useAddIdentityGcpIamAuth();
+  const { mutateAsync: updateMutateAsync } = useUpdateIdentityGcpIamAuth();
+
+  const { data } = useGetIdentityGcpIamAuth(identityAuthMethodData?.identityId ?? "");
+
+  const {
+    control,
+    handleSubmit,
+    reset,
+    formState: { isSubmitting }
+  } = useForm<FormData>({
+    resolver: yupResolver(schema),
+    defaultValues: {
+      allowedServiceAccounts: "",
+      allowedProjects: "",
+      accessTokenTTL: "2592000",
+      accessTokenMaxTTL: "2592000",
+      accessTokenNumUsesLimit: "0",
+      accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
+    }
+  });
+
+  const {
+    fields: accessTokenTrustedIpsFields,
+    append: appendAccessTokenTrustedIp,
+    remove: removeAccessTokenTrustedIp
+  } = useFieldArray({ control, name: "accessTokenTrustedIps" });
+
+  useEffect(() => {
+    if (data) {
+      reset({
+        allowedServiceAccounts: data.allowedServiceAccounts,
+        allowedProjects: data.allowedProjects,
+        accessTokenTTL: String(data.accessTokenTTL),
+        accessTokenMaxTTL: String(data.accessTokenMaxTTL),
+        accessTokenNumUsesLimit: String(data.accessTokenNumUsesLimit),
+        accessTokenTrustedIps: data.accessTokenTrustedIps.map(
+          ({ ipAddress, prefix }: IdentityTrustedIp) => {
+            return {
+              ipAddress: `${ipAddress}${prefix !== undefined ? `/${prefix}` : ""}`
+            };
+          }
+        )
+      });
+    } else {
+      reset({
+        allowedServiceAccounts: "",
+        allowedProjects: "",
+        accessTokenTTL: "2592000",
+        accessTokenMaxTTL: "2592000",
+        accessTokenNumUsesLimit: "0",
+        accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
+      });
+    }
+  }, [data]);
+
+  const onFormSubmit = async ({
+    allowedServiceAccounts,
+    allowedProjects,
+    accessTokenTTL,
+    accessTokenMaxTTL,
+    accessTokenNumUsesLimit,
+    accessTokenTrustedIps
+  }: FormData) => {
+    try {
+      if (!identityAuthMethodData) return;
+
+      if (data) {
+        await updateMutateAsync({
+          organizationId: orgId,
+          allowedServiceAccounts,
+          allowedProjects,
+          identityId: identityAuthMethodData.identityId,
+          accessTokenTTL: Number(accessTokenTTL),
+          accessTokenMaxTTL: Number(accessTokenMaxTTL),
+          accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
+          accessTokenTrustedIps
+        });
+      } else {
+        await addMutateAsync({
+          organizationId: orgId,
+          identityId: identityAuthMethodData.identityId,
+          allowedServiceAccounts: allowedServiceAccounts || "",
+          allowedProjects: allowedProjects || "",
+          accessTokenTTL: Number(accessTokenTTL),
+          accessTokenMaxTTL: Number(accessTokenMaxTTL),
+          accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
+          accessTokenTrustedIps
+        });
+      }
+
+      handlePopUpToggle("identityAuthMethod", false);
+
+      createNotification({
+        text: `Successfully ${
+          identityAuthMethodData?.authMethod ? "updated" : "configured"
+        } auth method`,
+        type: "success"
+      });
+
+      reset();
+    } catch (err) {
+      createNotification({
+        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        type: "error"
+      });
+    }
+  };
+
+  return (
+    <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="allowedServiceAccounts"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Allowed Service Accounts"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input
+              {...field}
+              placeholder="test@project.iam.gserviceaccount.com, 12345-compute@developer.gserviceaccount.com"
+              type="text"
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        name="allowedProjects"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl label="Allowed Projects" isError={Boolean(error)} errorText={error?.message}>
+            <Input {...field} placeholder="123456789012, ..." />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="0"
+        name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
+        )}
+      />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
+
+                      handlePopUpOpen("upgradePlan");
+                    }}
+                    placeholder="123.456.789.0"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <IconButton
+            onClick={() => {
+              if (subscription?.ipAllowlisting) {
+                removeAccessTokenTrustedIp(index);
+                return;
+              }
+
+              handlePopUpOpen("upgradePlan");
+            }}
+            size="lg"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
+          >
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
+      </div>
+    </form>
+  );
+};