diff --git a/backend/src/controllers/v2/workspaceController.ts b/backend/src/controllers/v2/workspaceController.ts index 7f2cc3441..e400b3de5 100644 --- a/backend/src/controllers/v2/workspaceController.ts +++ b/backend/src/controllers/v2/workspaceController.ts @@ -26,7 +26,7 @@ import { ProjectPermissionActions, ProjectPermissionSub, getAuthDataProjectPermissions, - getRolePermissions, + getWorkspaceRolePermissions, isAtLeastAsPrivilegedWorkspace } from "../../ee/services/ProjectRoleService"; import { ForbiddenError } from "@casl/ability"; @@ -550,7 +550,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => { message: "Failed to add machine identity to project in another organization" }); - const rolePermission = await getRolePermissions(role, workspaceId); + const rolePermission = await getWorkspaceRolePermissions(role, workspaceId); const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission); if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({ @@ -621,7 +621,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => { message: `Machine identity with id ${machineId} does not exist in project with id ${workspaceId}` }); - const machineIdentityRolePermission = await getRolePermissions( + const machineIdentityRolePermission = await getWorkspaceRolePermissions( machineMembership?.customRole?.slug ?? machineMembership.role, machineMembership.workspace.toString() ); @@ -630,7 +630,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => { message: "Failed to update role of more privileged MI" }); - const rolePermission = await getRolePermissions(role, workspaceId); + const rolePermission = await getWorkspaceRolePermissions(role, workspaceId); const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission); if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({ @@ -705,7 +705,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => { message: `Machine with id ${machineId} does not exist in project with id ${workspaceId}` }); - const machineIdentityRolePermission = await getRolePermissions( + const machineIdentityRolePermission = await getWorkspaceRolePermissions( machineMembership?.customRole?.slug ?? machineMembership.role, machineMembership.workspace.toString() ); diff --git a/backend/src/ee/controllers/v1/index.ts b/backend/src/ee/controllers/v1/index.ts index a80916733..0e3f18e29 100644 --- a/backend/src/ee/controllers/v1/index.ts +++ b/backend/src/ee/controllers/v1/index.ts @@ -1,3 +1,4 @@ +import * as machineIdentitiesController from "./machineIdentitiesController"; import * as secretController from "./secretController"; import * as secretSnapshotController from "./secretSnapshotController"; import * as organizationsController from "./organizationsController"; @@ -13,6 +14,7 @@ import * as secretRotationProviderController from "./secretRotationProviderContr import * as secretRotationController from "./secretRotationController"; export { + machineIdentitiesController, secretController, secretSnapshotController, organizationsController, diff --git a/backend/src/ee/controllers/v3/machineIdentityController.ts b/backend/src/ee/controllers/v1/machineIdentitiesController.ts similarity index 100% rename from backend/src/ee/controllers/v3/machineIdentityController.ts rename to backend/src/ee/controllers/v1/machineIdentitiesController.ts diff --git a/backend/src/ee/controllers/v3/index.ts b/backend/src/ee/controllers/v3/index.ts index 72706ea6e..2a8f130dd 100644 --- a/backend/src/ee/controllers/v3/index.ts +++ b/backend/src/ee/controllers/v3/index.ts @@ -1,7 +1,5 @@ -import * as machineIdentityController from "./machineIdentityController"; import * as apiKeyDataController from "./apiKeyDataController"; export { - machineIdentityController, apiKeyDataController } \ No newline at end of file diff --git a/backend/src/ee/routes/v1/index.ts b/backend/src/ee/routes/v1/index.ts index d5168e402..f04fb2767 100644 --- a/backend/src/ee/routes/v1/index.ts +++ b/backend/src/ee/routes/v1/index.ts @@ -1,3 +1,4 @@ +import machineIdentities from "./machineIdentities"; import secret from "./secret"; import secretSnapshot from "./secretSnapshot"; import organizations from "./organizations"; @@ -13,6 +14,7 @@ import secretRotationProvider from "./secretRotationProvider"; import secretRotation from "./secretRotation"; export { + machineIdentities, secret, secretSnapshot, organizations, diff --git a/backend/src/ee/routes/v3/machineIdentity.ts b/backend/src/ee/routes/v1/machineIdentities.ts similarity index 66% rename from backend/src/ee/routes/v3/machineIdentity.ts rename to backend/src/ee/routes/v1/machineIdentities.ts index 0550cf14f..f7fa8c586 100644 --- a/backend/src/ee/routes/v3/machineIdentity.ts +++ b/backend/src/ee/routes/v1/machineIdentities.ts @@ -2,14 +2,14 @@ import express from "express"; const router = express.Router(); import { requireAuth } from "../../../middleware"; import { AuthMode } from "../../../variables"; -import { machineIdentityController } from "../../controllers/v3"; +import { machineIdentitiesController } from "../../controllers/v1"; router.get( "/:machineId/client-secrets", requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), - machineIdentityController.getMIClientSecrets + machineIdentitiesController.getMIClientSecrets ); router.post( @@ -17,7 +17,7 @@ router.post( requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), - machineIdentityController.createMIClientSecret + machineIdentitiesController.createMIClientSecret ); router.delete( @@ -25,13 +25,12 @@ router.delete( requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), - machineIdentityController.deleteMIClientSecret + machineIdentitiesController.deleteMIClientSecret ); -// consider moving to /auth/machine/login router.post( "/login", - machineIdentityController.loginMI + machineIdentitiesController.loginMI ); router.post( @@ -39,7 +38,7 @@ router.post( requireAuth({ acceptedAuthModes: [AuthMode.JWT, AuthMode.MACHINE_ACCESS_TOKEN] }), - machineIdentityController.createMachineIdentity + machineIdentitiesController.createMachineIdentity ); router.patch( @@ -47,7 +46,7 @@ router.patch( requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), - machineIdentityController.updateMachineIdentity + machineIdentitiesController.updateMachineIdentity ); router.delete( @@ -55,7 +54,7 @@ router.delete( requireAuth({ acceptedAuthModes: [AuthMode.JWT] }), - machineIdentityController.deleteMachineIdentity + machineIdentitiesController.deleteMachineIdentity ); export default router; \ No newline at end of file diff --git a/backend/src/ee/routes/v3/index.ts b/backend/src/ee/routes/v3/index.ts index 2569a9d2a..c534640e3 100644 --- a/backend/src/ee/routes/v3/index.ts +++ b/backend/src/ee/routes/v3/index.ts @@ -1,7 +1,5 @@ -import machineIdentity from "./machineIdentity"; import apiKeyData from "./apiKeyData"; export { - machineIdentity, apiKeyData } \ No newline at end of file diff --git a/backend/src/ee/services/ProjectRoleService.ts b/backend/src/ee/services/ProjectRoleService.ts index 822ee9c07..bfba10b1d 100644 --- a/backend/src/ee/services/ProjectRoleService.ts +++ b/backend/src/ee/services/ProjectRoleService.ts @@ -362,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({ } } -export const getRolePermissions = async (role: string, workspaceId: string) => { +export const getWorkspaceRolePermissions = async (role: string, workspaceId: string) => { const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role); if (isCustomRole) { const workspaceRole = await Role.findOne({ diff --git a/backend/src/index.ts b/backend/src/index.ts index 8c608b3c6..35104edc3 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -25,6 +25,7 @@ import { secretSnapshot as eeSecretSnapshotRouter, users as eeUsersRouter, workspace as eeWorkspaceRouter, + machineIdentities as v1MachineIdentitiesRouter, roles as v1RoleRouter, secretApprovalPolicy as v1SecretApprovalPolicyRouter, secretApprovalRequest as v1SecretApprovalRequestRouter, @@ -33,7 +34,6 @@ import { secretScanning as v1SecretScanningRouter } from "./ee/routes/v1"; import { apiKeyData as v3apiKeyDataRouter } from "./ee/routes/v3"; -import { machineIdentity as v3MachineIdentityRouter } from "./ee/routes/v3"; import { admin as v1AdminRouter, auth as v1AuthRouter, @@ -198,6 +198,7 @@ const main = async () => { } // (EE) routes + app.use("/api/v1/machine-identities", v1MachineIdentitiesRouter); app.use("/api/v1/secret", eeSecretRouter); app.use("/api/v1/secret-snapshot", eeSecretSnapshotRouter); app.use("/api/v1/users", eeUsersRouter); @@ -206,7 +207,6 @@ const main = async () => { app.use("/api/v1/sso", eeSSORouter); app.use("/api/v1/cloud-products", eeCloudProductsRouter); app.use("/api/v3/api-key", v3apiKeyDataRouter); - app.use("/api/v3/machines", v3MachineIdentityRouter); // TODO: consider moving to v1 app.use("/api/v1/secret-rotation-providers", v1SecretRotationProviderRouter); app.use("/api/v1/secret-rotations", v1SecretRotation); @@ -247,7 +247,7 @@ const main = async () => { app.use("/api/v2/workspace", v2TagsRouter); app.use("/api/v2/workspace", v2WorkspaceRouter); app.use("/api/v2/secret", v2SecretRouter); // deprecate - app.use("/api/v2/secrets", v2SecretsRouter); // note: in the process of moving to v3/secrets + app.use("/api/v2/secrets", v2SecretsRouter); app.use("/api/v2/service-token", v2ServiceTokenDataRouter); // v3 routes (experimental) diff --git a/docs/documentation/platform/machine-identity.mdx b/docs/documentation/platform/machine-identity.mdx index dc957cd19..e1255d527 100644 --- a/docs/documentation/platform/machine-identity.mdx +++ b/docs/documentation/platform/machine-identity.mdx @@ -82,12 +82,12 @@ In the following steps, we explore how to create and use MIs for your applicatio To access the Infisical API as the MI, you should first perform a login operation that is to exchange the **Client ID** and **Client Secret** of the MI for an access token - by making a request to the `/api/v3/machines/login` endpoint. + by making a request to the `/api/v1/machine-identities/login` endpoint. #### Sample request ``` - curl --location --request POST 'https://app.infisical.com/api/v3/machines/login' \ + curl --location --request POST 'https://app.infisical.com/api/v1/machine-identities/login' \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data-urlencode 'clientSecret=...' \ --data-urlencode 'clientId=...' diff --git a/frontend/src/hooks/api/machineIdentities/mutations.tsx b/frontend/src/hooks/api/machineIdentities/mutations.tsx index a74327d4b..675d98704 100644 --- a/frontend/src/hooks/api/machineIdentities/mutations.tsx +++ b/frontend/src/hooks/api/machineIdentities/mutations.tsx @@ -18,7 +18,7 @@ export const useCreateMachineIdentity = () => { const queryClient = useQueryClient(); return useMutation({ mutationFn: async (body) => { - const { data } = await apiRequest.post("/api/v3/machines/", body); + const { data } = await apiRequest.post("/api/v1/machine-identities/", body); return data; }, onSuccess: ({ machineIdentity }) => { @@ -37,7 +37,7 @@ export const useCreateMachineIdentityClientSecret = () => { usageLimit }) => { - const { data } = await apiRequest.post(`/api/v3/machines/${machineId}/client-secrets`, { + const { data } = await apiRequest.post(`/api/v1/machine-identities/${machineId}/client-secrets`, { machineId, description, ttl, @@ -62,7 +62,7 @@ export const useDeleteMachineIdentityClientSecret = () => { machineId:string; clientSecretId: string; }) => { - const { data } = await apiRequest.delete(`/api/v3/machines/${machineId}/client-secrets/${clientSecretId}`); + const { data } = await apiRequest.delete(`/api/v1/machine-identities/${machineId}/client-secrets/${clientSecretId}`); return data; }, onSuccess: (_, { machineId }) => { @@ -83,7 +83,7 @@ export const useUpdateMachineIdentity = () => { accessTokenTTL }) => { - const { data: { machineIdentity } } = await apiRequest.patch(`/api/v3/machines/${machineId}`, { + const { data: { machineIdentity } } = await apiRequest.patch(`/api/v1/machine-identities/${machineId}`, { name, role, clientSecretTrustedIps, @@ -105,7 +105,7 @@ export const useDeleteMachineIdentity = () => { mutationFn: async ({ machineId }) => { - const { data: { machineIdentity } } = await apiRequest.delete(`/api/v3/machines/${machineId}`); + const { data: { machineIdentity } } = await apiRequest.delete(`/api/v1/machine-identities/${machineId}`); return machineIdentity; }, onSuccess: ({ organization }) => { diff --git a/frontend/src/hooks/api/machineIdentities/queries.tsx b/frontend/src/hooks/api/machineIdentities/queries.tsx index 86e1a7462..347ae9661 100644 --- a/frontend/src/hooks/api/machineIdentities/queries.tsx +++ b/frontend/src/hooks/api/machineIdentities/queries.tsx @@ -14,8 +14,10 @@ export const useGetMachineIdentityClientSecrets = (machineId: string) => { return useQuery({ queryKey: machineIdentityKeys.getMachineIdentityClientSecrets(machineId), queryFn: async () => { + if (machineId === "") return []; + const { data: { clientSecretData } } = await apiRequest.get<{ clientSecretData: MachineIdentityClientSecret[] }>( - `/api/v3/machines/${machineId}/client-secrets` + `/api/v1/machine-identities/${machineId}/client-secrets` ); return clientSecretData; diff --git a/frontend/src/views/Org/MembersPage/MembersPage.tsx b/frontend/src/views/Org/MembersPage/MembersPage.tsx index 03680c486..3a768b8bb 100644 --- a/frontend/src/views/Org/MembersPage/MembersPage.tsx +++ b/frontend/src/views/Org/MembersPage/MembersPage.tsx @@ -20,7 +20,7 @@ export const MembersPage = withPermission(

- Access Control + Organization Access Control

diff --git a/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx b/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx index 23a37d927..090944069 100644 --- a/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx +++ b/frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx @@ -244,7 +244,7 @@ export const CreateClientSecretModal = ({

- Access Control + Project Access Control