Merge branch 'main' into ENG-2800

frontend/src/components/secret-syncs/forms/SecretSyncOptionsFields/SecretSyncOptionsFields.tsx

@@ -146,11 +146,15 @@ export const SecretSyncOptionsFields = ({ hideInitialSync }: Props) => {
                       href="https://infisical.com/docs/integrations/secret-syncs/overview#key-schemas"
                       target="_blank"
                       rel="noopener noreferrer"
+                      className="underline"
                     >
                       Key Schema
                     </a>{" "}
                     to ensure that Infisical only manages the specific keys you intend, keeping
                     everything else untouched.
+                    <br />
+                    <br />
+                    Destination secrets that do not match the schema will not be deleted or updated.
                   </span>
                 }
               >

frontend/src/hooks/api/identities/mutations.tsx

@@ -163,7 +163,8 @@ export const useUpdateIdentityUniversalAuth = () => {
       accessTokenTTL,
       accessTokenMaxTTL,
       accessTokenNumUsesLimit,
-      accessTokenTrustedIps
+      accessTokenTrustedIps,
+      accessTokenPeriod
     }) => {
       const {
         data: { identityUniversalAuth }
@@ -172,7 +173,8 @@ export const useUpdateIdentityUniversalAuth = () => {
         accessTokenTTL,
         accessTokenMaxTTL,
         accessTokenNumUsesLimit,
-        accessTokenTrustedIps
+        accessTokenTrustedIps,
+        accessTokenPeriod
       });
       return identityUniversalAuth;
     },

frontend/src/hooks/api/identities/types.ts

@@ -107,6 +107,7 @@ export type IdentityUniversalAuth = {
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
   accessTokenTrustedIps: IdentityTrustedIp[];
+  accessTokenPeriod: number;
 };
 
 export type AddIdentityUniversalAuthDTO = {
@@ -118,6 +119,7 @@ export type AddIdentityUniversalAuthDTO = {
   accessTokenTTL: number;
   accessTokenMaxTTL: number;
   accessTokenNumUsesLimit: number;
+  accessTokenPeriod: number;
   accessTokenTrustedIps: {
     ipAddress: string;
   }[];
@@ -132,6 +134,7 @@ export type UpdateIdentityUniversalAuthDTO = {
   accessTokenTTL?: number;
   accessTokenMaxTTL?: number;
   accessTokenNumUsesLimit?: number;
+  accessTokenPeriod?: number;
   accessTokenTrustedIps?: {
     ipAddress: string;
   }[];

frontend/src/hooks/api/secretSharing/queries.ts

@@ -11,13 +11,10 @@ export const secretSharingKeys = {
   allSecretRequests: () => ["secretRequests"] as const,
   specificSecretRequests: ({ offset, limit }: { offset: number; limit: number }) =>
     [...secretSharingKeys.allSecretRequests(), { offset, limit }] as const,
-  getSecretById: (arg: {
-    id: string;
-    hashedHex: string | null;
-    password?: string;
-    email?: string;
-    hash?: string;
-  }) => ["shared-secret", arg],
+  getSecretById: (arg: { id: string; hashedHex: string | null; password?: string }) => [
+    "shared-secret",
+    arg
+  ],
   getSecretRequestById: (arg: { id: string }) => ["secret-request", arg] as const
 };
 
@@ -73,34 +70,24 @@ export const useGetSecretRequests = ({
 export const useGetActiveSharedSecretById = ({
   sharedSecretId,
   hashedHex,
-  password,
-  email,
-  hash
+  password
 }: {
   sharedSecretId: string;
   hashedHex: string | null;
   password?: string;
-
-  // For secrets shared to specific emails (optional)
-  email?: string;
-  hash?: string;
 }) => {
   return useQuery({
     queryKey: secretSharingKeys.getSecretById({
       id: sharedSecretId,
       hashedHex,
-      password,
-      email,
-      hash
+      password
     }),
     queryFn: async () => {
       const { data } = await apiRequest.post<TViewSharedSecretResponse>(
         `/api/v1/secret-sharing/shared/public/${sharedSecretId}`,
         {
           ...(hashedHex && { hashedHex }),
-          password,
-          email,
-          hash
+          password
         }
       );
 

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal.tsx

@@ -138,7 +138,8 @@ export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
           accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
           accessTokenTTL: 2592000,
           accessTokenMaxTTL: 2592000,
-          accessTokenNumUsesLimit: 0
+          accessTokenNumUsesLimit: 0,
+          accessTokenPeriod: 0
         });
 
         handlePopUpToggle("identity", false);

frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx

@@ -41,6 +41,13 @@ const schema = z
         (value) => Number(value) <= 315360000,
         "Access Max Token TTL cannot be greater than 315360000"
       ),
+    accessTokenPeriod: z
+      .string()
+      .optional()
+      .refine(
+        (value) => !value || Number(value) <= 315360000,
+        "Access Token Period cannot be greater than 315360000"
+      ),
     accessTokenNumUsesLimit: z.string(),
     clientSecretTrustedIps: z
       .object({
@@ -90,7 +97,8 @@ export const IdentityUniversalAuthForm = ({
     control,
     handleSubmit,
     reset,
-    formState: { isSubmitting }
+    formState: { isSubmitting },
+    watch
   } = useForm<FormData>({
     resolver: zodResolver(schema),
     defaultValues: {
@@ -98,10 +106,13 @@ export const IdentityUniversalAuthForm = ({
       accessTokenMaxTTL: "2592000",
       accessTokenNumUsesLimit: "0",
       clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
-      accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
+      accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
+      accessTokenPeriod: "0"
     }
   });
 
+  const accessTokenPeriodValue = Number(watch("accessTokenPeriod"));
+
   const {
     fields: clientSecretTrustedIpsFields,
     append: appendClientSecretTrustedIp,
@@ -119,6 +130,7 @@ export const IdentityUniversalAuthForm = ({
         accessTokenTTL: String(data.accessTokenTTL),
         accessTokenMaxTTL: String(data.accessTokenMaxTTL),
         accessTokenNumUsesLimit: String(data.accessTokenNumUsesLimit),
+        accessTokenPeriod: String(data.accessTokenPeriod),
         clientSecretTrustedIps: data.clientSecretTrustedIps.map(
           ({ ipAddress, prefix }: IdentityTrustedIp) => {
             return {
@@ -139,6 +151,7 @@ export const IdentityUniversalAuthForm = ({
         accessTokenTTL: "2592000",
         accessTokenMaxTTL: "2592000",
         accessTokenNumUsesLimit: "0",
+        accessTokenPeriod: "0",
         clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
         accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
       });
@@ -150,7 +163,8 @@ export const IdentityUniversalAuthForm = ({
     accessTokenMaxTTL,
     accessTokenNumUsesLimit,
     clientSecretTrustedIps,
-    accessTokenTrustedIps
+    accessTokenTrustedIps,
+    accessTokenPeriod
   }: FormData) => {
     try {
       if (!identityId) return;
@@ -164,7 +178,8 @@ export const IdentityUniversalAuthForm = ({
           accessTokenTTL: Number(accessTokenTTL),
           accessTokenMaxTTL: Number(accessTokenMaxTTL),
           accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
-          accessTokenTrustedIps
+          accessTokenTrustedIps,
+          accessTokenPeriod: Number(accessTokenPeriod)
         });
       } else {
         // create new universal auth configuration
@@ -176,7 +191,8 @@ export const IdentityUniversalAuthForm = ({
           accessTokenTTL: Number(accessTokenTTL),
           accessTokenMaxTTL: Number(accessTokenMaxTTL),
           accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
-          accessTokenTrustedIps
+          accessTokenTrustedIps,
+          accessTokenPeriod: Number(accessTokenPeriod)
         });
       }
 
@@ -214,34 +230,42 @@ export const IdentityUniversalAuthForm = ({
           <Tab value={IdentityFormTab.Advanced}>Advanced</Tab>
         </TabList>
         <TabPanel value={IdentityFormTab.Configuration}>
-          <Controller
-            control={control}
-            defaultValue="2592000"
-            name="accessTokenTTL"
-            render={({ field, fieldState: { error } }) => (
-              <FormControl
-                label="Access Token TTL (seconds)"
-                isError={Boolean(error)}
-                errorText={error?.message}
-              >
-                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
-              </FormControl>
-            )}
-          />
-          <Controller
-            control={control}
-            defaultValue="2592000"
-            name="accessTokenMaxTTL"
-            render={({ field, fieldState: { error } }) => (
-              <FormControl
-                label="Access Token Max TTL (seconds)"
-                isError={Boolean(error)}
-                errorText={error?.message}
-              >
-                <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
-              </FormControl>
-            )}
-          />
+          {accessTokenPeriodValue > 0 ? (
+            <div className="mb-4 text-xs text-bunker-400">
+              When Access Token Period is set, TTL and Max TTL are ignored.
+            </div>
+          ) : (
+            <>
+              <Controller
+                control={control}
+                defaultValue="2592000"
+                name="accessTokenTTL"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Access Token TTL (seconds)"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
+                  </FormControl>
+                )}
+              />
+              <Controller
+                control={control}
+                defaultValue="2592000"
+                name="accessTokenMaxTTL"
+                render={({ field, fieldState: { error } }) => (
+                  <FormControl
+                    label="Access Token Max TTL (seconds)"
+                    isError={Boolean(error)}
+                    errorText={error?.message}
+                  >
+                    <Input {...field} placeholder="2592000" type="number" min="0" step="1" />
+                  </FormControl>
+                )}
+              />
+            </>
+          )}
           <Controller
             control={control}
             defaultValue="0"
@@ -256,6 +280,21 @@ export const IdentityUniversalAuthForm = ({
               </FormControl>
             )}
           />
+          <Controller
+            control={control}
+            defaultValue="0"
+            name="accessTokenPeriod"
+            render={({ field, fieldState: { error } }) => (
+              <FormControl
+                label="Access Token Period (seconds)"
+                isError={Boolean(error)}
+                errorText={error?.message}
+                helperText="For periodic tokens: set a period (in seconds) to allow indefinite renewal. Set to 0 to disable periodic tokens and use TTL-based expiration."
+              >
+                <Input {...field} placeholder="0" type="number" min="0" step="1" />
+              </FormControl>
+            )}
+          />
         </TabPanel>
         <TabPanel value={IdentityFormTab.Advanced}>
           {clientSecretTrustedIpsFields.map(({ id }, index) => (

frontend/src/pages/organization/AccessManagementPage/components/UpgradePrivilegeSystemModal/UpgradePrivilegeSystemModal.tsx

@@ -4,7 +4,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, Checkbox, Modal, ModalContent } from "@app/components/v2";
+import { Button, Checkbox, Modal, ModalContent, Tooltip } from "@app/components/v2";
 import { useOrgPermission } from "@app/context";
 import { useUpgradePrivilegeSystem } from "@app/hooks/api";
 
@@ -262,7 +262,6 @@ export const UpgradePrivilegeSystemModal = ({ isOpen, onOpenChange }: Props) =>
                 </div>
               </div>
             </div>
-
             <form onSubmit={handleSubmit(handlePrivilegeSystemUpgrade)}>
               <div className="mt-6 flex items-center justify-end gap-4">
                 <button
@@ -272,17 +271,27 @@ export const UpgradePrivilegeSystemModal = ({ isOpen, onOpenChange }: Props) =>
                 >
                   Cancel
                 </button>
-                <Button
-                  type="submit"
-                  variant="solid"
-                  colorSchema="primary"
-                  size="md"
-                  className="w-[120px] bg-primary hover:bg-primary-600"
-                  isDisabled={!isAllChecksCompleted || !isAdmin}
-                  isLoading={isSubmitting}
+                <Tooltip
+                  content={
+                    !isAdmin
+                      ? `You cannot perform this upgrade because you are not an organization admin. (Your current role: ${membership?.role ?? "Unknown"})`
+                      : undefined
+                  }
                 >
-                  Upgrade
-                </Button>
+                  <div>
+                    <Button
+                      type="submit"
+                      variant="solid"
+                      colorSchema="primary"
+                      size="md"
+                      className="w-[120px] bg-primary hover:bg-primary-600"
+                      isDisabled={!isAllChecksCompleted || !isAdmin}
+                      isLoading={isSubmitting}
+                    >
+                      Upgrade
+                    </Button>
+                  </div>
+                </Tooltip>
               </div>
             </form>
           </div>

frontend/src/pages/organization/IdentityDetailsByIDPage/components/ViewIdentityAuthModal/ViewIdentityUniversalAuthContent.tsx

@@ -62,12 +62,20 @@ export const ViewIdentityUniversalAuthContent = ({
       onEdit={() => handlePopUpOpen("identityAuthMethod")}
       onDelete={onDelete}
     >
-      <IdentityAuthFieldDisplay label="Access Token TTL (seconds)">
-        {data.accessTokenTTL}
-      </IdentityAuthFieldDisplay>
-      <IdentityAuthFieldDisplay label="Access Token Max TTL (seconds)">
-        {data.accessTokenMaxTTL}
-      </IdentityAuthFieldDisplay>
+      {Number(data.accessTokenPeriod) > 0 ? (
+        <IdentityAuthFieldDisplay label="Access Token Period (seconds)">
+          {data.accessTokenPeriod}
+        </IdentityAuthFieldDisplay>
+      ) : (
+        <>
+          <IdentityAuthFieldDisplay label="Access Token TTL (seconds)">
+            {data.accessTokenTTL}
+          </IdentityAuthFieldDisplay>
+          <IdentityAuthFieldDisplay label="Access Token Max TTL (seconds)">
+            {data.accessTokenMaxTTL}
+          </IdentityAuthFieldDisplay>
+        </>
+      )}
       <IdentityAuthFieldDisplay label="Access Token Max Number of Uses">
         {data.accessTokenNumUsesLimit}
       </IdentityAuthFieldDisplay>

frontend/src/pages/public/ViewSharedSecretByIDPage/ViewSharedSecretByIDPage.tsx

@@ -38,14 +38,6 @@ export const ViewSharedSecretByIDPage = () => {
     from: ROUTE_PATHS.Public.ViewSharedSecretByIDPage.id,
     select: (el) => el.key
   });
-  const email = useSearch({
-    from: ROUTE_PATHS.Public.ViewSharedSecretByIDPage.id,
-    select: (el) => el.email
-  });
-  const hash = useSearch({
-    from: ROUTE_PATHS.Public.ViewSharedSecretByIDPage.id,
-    select: (el) => el.hash
-  });
   const [password, setPassword] = useState<string>();
   const { hashedHex, key } = extractDetailsFromUrl(urlEncodedKey);
 
@@ -57,9 +49,7 @@ export const ViewSharedSecretByIDPage = () => {
   } = useGetActiveSharedSecretById({
     sharedSecretId: id,
     hashedHex,
-    password,
-    email,
-    hash
+    password
   });
 
   const navigate = useNavigate();
@@ -94,6 +84,8 @@ export const ViewSharedSecretByIDPage = () => {
       navigate({
         to: "/login"
       });
+
+      return;
     }
 
     if (error) {

frontend/src/pages/public/ViewSharedSecretByIDPage/route.tsx

@@ -7,9 +7,7 @@ import { authKeys, fetchAuthToken } from "@app/hooks/api/auth/queries";
 import { ViewSharedSecretByIDPage } from "./ViewSharedSecretByIDPage";
 
 const SharedSecretByIDPageQuerySchema = z.object({
-  key: z.string().catch(""),
-  email: z.string().optional(),
-  hash: z.string().optional()
+  key: z.string().catch("")
 });
 
 export const Route = createFileRoute("/shared/secret/$secretId")({