Move MI endpoints from v3 to v1

backend/src/controllers/v2/workspaceController.ts

@@ -26,7 +26,7 @@ import {
   ProjectPermissionActions,
   ProjectPermissionSub,
   getAuthDataProjectPermissions,
-  getRolePermissions,
+  getWorkspaceRolePermissions,
   isAtLeastAsPrivilegedWorkspace
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
@@ -550,7 +550,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: "Failed to add machine identity to project in another organization"
   });
 
-  const rolePermission = await getRolePermissions(role, workspaceId);
+  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
   
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
@@ -621,7 +621,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: `Machine identity with id ${machineId} does not exist in project with id ${workspaceId}`
   });
   
-  const machineIdentityRolePermission = await getRolePermissions(
+  const machineIdentityRolePermission = await getWorkspaceRolePermissions(
     machineMembership?.customRole?.slug ?? machineMembership.role, 
     machineMembership.workspace.toString()
   );
@@ -630,7 +630,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
       message: "Failed to update role of more privileged MI"
   });
 
-  const rolePermission = await getRolePermissions(role, workspaceId);
+  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
   
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
@@ -705,7 +705,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: `Machine with id ${machineId} does not exist in project with id ${workspaceId}`
   });
   
-  const machineIdentityRolePermission = await getRolePermissions(
+  const machineIdentityRolePermission = await getWorkspaceRolePermissions(
     machineMembership?.customRole?.slug ?? machineMembership.role, 
     machineMembership.workspace.toString()
   );

backend/src/ee/controllers/v1/index.ts

@@ -1,3 +1,4 @@
+import * as machineIdentitiesController from "./machineIdentitiesController";
 import * as secretController from "./secretController";
 import * as secretSnapshotController from "./secretSnapshotController";
 import * as organizationsController from "./organizationsController";
@@ -13,6 +14,7 @@ import * as secretRotationProviderController from "./secretRotationProviderContr
 import * as secretRotationController from "./secretRotationController";
 
 export {
+  machineIdentitiesController,
   secretController,
   secretSnapshotController,
   organizationsController,

backend/src/ee/controllers/v3/index.ts

@@ -1,7 +1,5 @@
-import * as machineIdentityController from "./machineIdentityController";
 import * as apiKeyDataController from "./apiKeyDataController";
 
 export {
-    machineIdentityController,
     apiKeyDataController
 }

backend/src/ee/routes/v1/index.ts

@@ -1,3 +1,4 @@
+import machineIdentities from "./machineIdentities";
 import secret from "./secret";
 import secretSnapshot from "./secretSnapshot";
 import organizations from "./organizations";
@@ -13,6 +14,7 @@ import secretRotationProvider from "./secretRotationProvider";
 import secretRotation from "./secretRotation";
 
 export {
+  machineIdentities,
   secret,
   secretSnapshot,
   organizations,

backend/src/ee/routes/v1/machineIdentities.ts

@@ -2,14 +2,14 @@ import express from "express";
 const router = express.Router();
 import { requireAuth } from "../../../middleware";
 import { AuthMode } from "../../../variables";
-import { machineIdentityController } from "../../controllers/v3";
+import { machineIdentitiesController } from "../../controllers/v1";
 
 router.get(
   "/:machineId/client-secrets",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.getMIClientSecrets
+  machineIdentitiesController.getMIClientSecrets
 );
 
 router.post(
@@ -17,7 +17,7 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.createMIClientSecret
+  machineIdentitiesController.createMIClientSecret
 );
 
 router.delete(
@@ -25,13 +25,12 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.deleteMIClientSecret
+  machineIdentitiesController.deleteMIClientSecret
 );
 
-// consider moving to /auth/machine/login
 router.post(
   "/login",
-  machineIdentityController.loginMI
+  machineIdentitiesController.loginMI
 );
 
 router.post(
@@ -39,7 +38,7 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.MACHINE_ACCESS_TOKEN]
   }),
-  machineIdentityController.createMachineIdentity
+  machineIdentitiesController.createMachineIdentity
 );
 
 router.patch(
@@ -47,7 +46,7 @@ router.patch(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.updateMachineIdentity
+  machineIdentitiesController.updateMachineIdentity
 );
 
 router.delete(
@@ -55,7 +54,7 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.deleteMachineIdentity
+  machineIdentitiesController.deleteMachineIdentity
 );
 
 export default router;

backend/src/ee/routes/v3/index.ts

@@ -1,7 +1,5 @@
-import machineIdentity from "./machineIdentity";
 import apiKeyData from "./apiKeyData";
 
 export {
-    machineIdentity,
     apiKeyData
 }

backend/src/ee/services/ProjectRoleService.ts

@@ -362,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({
   }
 }
 
-export const getRolePermissions = async (role: string, workspaceId: string) => {
+export const getWorkspaceRolePermissions = async (role: string, workspaceId: string) => {
   const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const workspaceRole = await Role.findOne({

backend/src/index.ts

@@ -25,6 +25,7 @@ import {
   secretSnapshot as eeSecretSnapshotRouter,
   users as eeUsersRouter,
   workspace as eeWorkspaceRouter,
+  machineIdentities as v1MachineIdentitiesRouter,
   roles as v1RoleRouter,
   secretApprovalPolicy as v1SecretApprovalPolicyRouter,
   secretApprovalRequest as v1SecretApprovalRequestRouter,
@@ -33,7 +34,6 @@ import {
   secretScanning as v1SecretScanningRouter
 } from "./ee/routes/v1";
 import { apiKeyData as v3apiKeyDataRouter } from "./ee/routes/v3";
-import { machineIdentity as v3MachineIdentityRouter } from "./ee/routes/v3";
 import {
   admin as v1AdminRouter,
   auth as v1AuthRouter,
@@ -198,6 +198,7 @@ const main = async () => {
   }
 
   // (EE) routes
+  app.use("/api/v1/machine-identities", v1MachineIdentitiesRouter);
   app.use("/api/v1/secret", eeSecretRouter);
   app.use("/api/v1/secret-snapshot", eeSecretSnapshotRouter);
   app.use("/api/v1/users", eeUsersRouter);
@@ -206,7 +207,6 @@ const main = async () => {
   app.use("/api/v1/sso", eeSSORouter);
   app.use("/api/v1/cloud-products", eeCloudProductsRouter);
   app.use("/api/v3/api-key", v3apiKeyDataRouter);
-  app.use("/api/v3/machines", v3MachineIdentityRouter); // TODO: consider moving to v1
   app.use("/api/v1/secret-rotation-providers", v1SecretRotationProviderRouter);
   app.use("/api/v1/secret-rotations", v1SecretRotation);
 
@@ -247,7 +247,7 @@ const main = async () => {
   app.use("/api/v2/workspace", v2TagsRouter);
   app.use("/api/v2/workspace", v2WorkspaceRouter);
   app.use("/api/v2/secret", v2SecretRouter); // deprecate
-  app.use("/api/v2/secrets", v2SecretsRouter); // note: in the process of moving to v3/secrets
+  app.use("/api/v2/secrets", v2SecretsRouter);
   app.use("/api/v2/service-token", v2ServiceTokenDataRouter);
 
   // v3 routes (experimental)