Move MI endpoints from v3 to v1

backend/src/controllers/v2/workspaceController.ts

@@ -26,7 +26,7 @@ import {
   ProjectPermissionActions,
   ProjectPermissionSub,
   getAuthDataProjectPermissions,
-  getRolePermissions,
+  getWorkspaceRolePermissions,
   isAtLeastAsPrivilegedWorkspace
 } from "../../ee/services/ProjectRoleService";
 import { ForbiddenError } from "@casl/ability";
@@ -550,7 +550,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: "Failed to add machine identity to project in another organization"
   });
 
-  const rolePermission = await getRolePermissions(role, workspaceId);
+  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
   
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
@@ -621,7 +621,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: `Machine identity with id ${machineId} does not exist in project with id ${workspaceId}`
   });
   
-  const machineIdentityRolePermission = await getRolePermissions(
+  const machineIdentityRolePermission = await getWorkspaceRolePermissions(
     machineMembership?.customRole?.slug ?? machineMembership.role, 
     machineMembership.workspace.toString()
   );
@@ -630,7 +630,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
       message: "Failed to update role of more privileged MI"
   });
 
-  const rolePermission = await getRolePermissions(role, workspaceId);
+  const rolePermission = await getWorkspaceRolePermissions(role, workspaceId);
   const isAsPrivilegedAsIntendedRole = isAtLeastAsPrivilegedWorkspace(permission, rolePermission);
   
   if (!isAsPrivilegedAsIntendedRole) throw ForbiddenRequestError({
@@ -705,7 +705,7 @@ export const addMachineToWorkspace = async (req: Request, res: Response) => {
     message: `Machine with id ${machineId} does not exist in project with id ${workspaceId}`
   });
   
-  const machineIdentityRolePermission = await getRolePermissions(
+  const machineIdentityRolePermission = await getWorkspaceRolePermissions(
     machineMembership?.customRole?.slug ?? machineMembership.role, 
     machineMembership.workspace.toString()
   );

backend/src/ee/controllers/v1/index.ts

@@ -1,3 +1,4 @@
+import * as machineIdentitiesController from "./machineIdentitiesController";
 import * as secretController from "./secretController";
 import * as secretSnapshotController from "./secretSnapshotController";
 import * as organizationsController from "./organizationsController";
@@ -13,6 +14,7 @@ import * as secretRotationProviderController from "./secretRotationProviderContr
 import * as secretRotationController from "./secretRotationController";
 
 export {
+  machineIdentitiesController,
   secretController,
   secretSnapshotController,
   organizationsController,

backend/src/ee/controllers/v3/index.ts

@@ -1,7 +1,5 @@
-import * as machineIdentityController from "./machineIdentityController";
 import * as apiKeyDataController from "./apiKeyDataController";
 
 export {
-    machineIdentityController,
     apiKeyDataController
 }

backend/src/ee/routes/v1/index.ts

@@ -1,3 +1,4 @@
+import machineIdentities from "./machineIdentities";
 import secret from "./secret";
 import secretSnapshot from "./secretSnapshot";
 import organizations from "./organizations";
@@ -13,6 +14,7 @@ import secretRotationProvider from "./secretRotationProvider";
 import secretRotation from "./secretRotation";
 
 export {
+  machineIdentities,
   secret,
   secretSnapshot,
   organizations,

backend/src/ee/routes/v1/machineIdentities.ts

@@ -2,14 +2,14 @@ import express from "express";
 const router = express.Router();
 import { requireAuth } from "../../../middleware";
 import { AuthMode } from "../../../variables";
-import { machineIdentityController } from "../../controllers/v3";
+import { machineIdentitiesController } from "../../controllers/v1";
 
 router.get(
   "/:machineId/client-secrets",
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.getMIClientSecrets
+  machineIdentitiesController.getMIClientSecrets
 );
 
 router.post(
@@ -17,7 +17,7 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.createMIClientSecret
+  machineIdentitiesController.createMIClientSecret
 );
 
 router.delete(
@@ -25,13 +25,12 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.deleteMIClientSecret
+  machineIdentitiesController.deleteMIClientSecret
 );
 
-// consider moving to /auth/machine/login
 router.post(
   "/login",
-  machineIdentityController.loginMI
+  machineIdentitiesController.loginMI
 );
 
 router.post(
@@ -39,7 +38,7 @@ router.post(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT, AuthMode.MACHINE_ACCESS_TOKEN]
   }),
-  machineIdentityController.createMachineIdentity
+  machineIdentitiesController.createMachineIdentity
 );
 
 router.patch(
@@ -47,7 +46,7 @@ router.patch(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.updateMachineIdentity
+  machineIdentitiesController.updateMachineIdentity
 );
 
 router.delete(
@@ -55,7 +54,7 @@ router.delete(
   requireAuth({
     acceptedAuthModes: [AuthMode.JWT]
   }),
-  machineIdentityController.deleteMachineIdentity
+  machineIdentitiesController.deleteMachineIdentity
 );
 
 export default router;

backend/src/ee/routes/v3/index.ts

@@ -1,7 +1,5 @@
-import machineIdentity from "./machineIdentity";
 import apiKeyData from "./apiKeyData";
 
 export {
-    machineIdentity,
     apiKeyData
 }

backend/src/ee/services/ProjectRoleService.ts

@@ -362,7 +362,7 @@ export const getAuthDataProjectPermissions = async ({
   }
 }
 
-export const getRolePermissions = async (role: string, workspaceId: string) => {
+export const getWorkspaceRolePermissions = async (role: string, workspaceId: string) => {
   const isCustomRole = ![ADMIN, MEMBER, VIEWER, NO_ACCESS].includes(role);
   if (isCustomRole) {
     const workspaceRole = await Role.findOne({

backend/src/index.ts

@@ -25,6 +25,7 @@ import {
   secretSnapshot as eeSecretSnapshotRouter,
   users as eeUsersRouter,
   workspace as eeWorkspaceRouter,
+  machineIdentities as v1MachineIdentitiesRouter,
   roles as v1RoleRouter,
   secretApprovalPolicy as v1SecretApprovalPolicyRouter,
   secretApprovalRequest as v1SecretApprovalRequestRouter,
@@ -33,7 +34,6 @@ import {
   secretScanning as v1SecretScanningRouter
 } from "./ee/routes/v1";
 import { apiKeyData as v3apiKeyDataRouter } from "./ee/routes/v3";
-import { machineIdentity as v3MachineIdentityRouter } from "./ee/routes/v3";
 import {
   admin as v1AdminRouter,
   auth as v1AuthRouter,
@@ -198,6 +198,7 @@ const main = async () => {
   }
 
   // (EE) routes
+  app.use("/api/v1/machine-identities", v1MachineIdentitiesRouter);
   app.use("/api/v1/secret", eeSecretRouter);
   app.use("/api/v1/secret-snapshot", eeSecretSnapshotRouter);
   app.use("/api/v1/users", eeUsersRouter);
@@ -206,7 +207,6 @@ const main = async () => {
   app.use("/api/v1/sso", eeSSORouter);
   app.use("/api/v1/cloud-products", eeCloudProductsRouter);
   app.use("/api/v3/api-key", v3apiKeyDataRouter);
-  app.use("/api/v3/machines", v3MachineIdentityRouter); // TODO: consider moving to v1
   app.use("/api/v1/secret-rotation-providers", v1SecretRotationProviderRouter);
   app.use("/api/v1/secret-rotations", v1SecretRotation);
 
@@ -247,7 +247,7 @@ const main = async () => {
   app.use("/api/v2/workspace", v2TagsRouter);
   app.use("/api/v2/workspace", v2WorkspaceRouter);
   app.use("/api/v2/secret", v2SecretRouter); // deprecate
-  app.use("/api/v2/secrets", v2SecretsRouter); // note: in the process of moving to v3/secrets
+  app.use("/api/v2/secrets", v2SecretsRouter);
   app.use("/api/v2/service-token", v2ServiceTokenDataRouter);
 
   // v3 routes (experimental)

docs/documentation/platform/machine-identity.mdx

@@ -82,12 +82,12 @@ In the following steps, we explore how to create and use MIs for your applicatio
   <Step title="Accessing the Infisical API with the MI">
     To access the Infisical API as the MI, you should first perform a login operation
     that is to exchange the **Client ID** and **Client Secret** of the MI for an access token
-    by making a request to the `/api/v3/machines/login` endpoint.
+    by making a request to the `/api/v1/machine-identities/login` endpoint.
     
     #### Sample request
 
     ```
-    curl --location --request POST 'https://app.infisical.com/api/v3/machines/login' \
+    curl --location --request POST 'https://app.infisical.com/api/v1/machine-identities/login' \
       --header 'Content-Type: application/x-www-form-urlencoded' \
       --data-urlencode 'clientSecret=...' \
       --data-urlencode 'clientId=...'

frontend/src/hooks/api/machineIdentities/mutations.tsx

@@ -18,7 +18,7 @@ export const useCreateMachineIdentity = () => {
     const queryClient = useQueryClient();
     return useMutation<CreateMachineIdentityRes, {}, CreateMachineIdentityDTO>({
         mutationFn: async (body) => {
-            const { data } = await apiRequest.post("/api/v3/machines/", body);
+            const { data } = await apiRequest.post("/api/v1/machine-identities/", body);
             return data;
         },
         onSuccess: ({ machineIdentity }) => {
@@ -37,7 +37,7 @@ export const useCreateMachineIdentityClientSecret = () => {
             usageLimit
         }) => {
 
-            const { data } = await apiRequest.post(`/api/v3/machines/${machineId}/client-secrets`, {
+            const { data } = await apiRequest.post(`/api/v1/machine-identities/${machineId}/client-secrets`, {
                 machineId,
                 description,
                 ttl,
@@ -62,7 +62,7 @@ export const useDeleteMachineIdentityClientSecret = () => {
             machineId:string;
             clientSecretId: string;
         }) => {
-            const { data } = await apiRequest.delete(`/api/v3/machines/${machineId}/client-secrets/${clientSecretId}`);
+            const { data } = await apiRequest.delete(`/api/v1/machine-identities/${machineId}/client-secrets/${clientSecretId}`);
             return data;
         },
         onSuccess: (_, { machineId }) => {
@@ -83,7 +83,7 @@ export const useUpdateMachineIdentity = () => {
             accessTokenTTL
         }) => {
             
-            const { data: { machineIdentity } } = await apiRequest.patch(`/api/v3/machines/${machineId}`, {
+            const { data: { machineIdentity } } = await apiRequest.patch(`/api/v1/machine-identities/${machineId}`, {
                 name,
                 role,
                 clientSecretTrustedIps,
@@ -105,7 +105,7 @@ export const useDeleteMachineIdentity = () => {
         mutationFn: async ({
             machineId
         }) => {
-            const { data: { machineIdentity } } = await apiRequest.delete(`/api/v3/machines/${machineId}`);
+            const { data: { machineIdentity } } = await apiRequest.delete(`/api/v1/machine-identities/${machineId}`);
             return machineIdentity;
         },
         onSuccess: ({ organization }) => {

frontend/src/hooks/api/machineIdentities/queries.tsx

@@ -14,8 +14,10 @@ export const useGetMachineIdentityClientSecrets = (machineId: string) => {
     return useQuery({
         queryKey: machineIdentityKeys.getMachineIdentityClientSecrets(machineId),
         queryFn: async () => {
+            if (machineId === "") return [];
+
             const { data: { clientSecretData } } = await apiRequest.get<{ clientSecretData: MachineIdentityClientSecret[] }>(
-                `/api/v3/machines/${machineId}/client-secrets`
+                `/api/v1/machine-identities/${machineId}/client-secrets`
             );
         
             return clientSecretData;

frontend/src/views/Org/MembersPage/MembersPage.tsx

@@ -20,7 +20,7 @@ export const MembersPage = withPermission(
       <div className="container mx-auto flex flex-col justify-between bg-bunker-800 text-white">
         <div className="mb-6 w-full py-6 px-6 max-w-7xl mx-auto">
           <p className="mr-4 mb-4 text-3xl font-semibold text-white">
-            Access Control
+            Organization Access Control
           </p>
           <Tabs defaultValue={TabSections.Member}>
             <TabList>

frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx

@@ -244,7 +244,7 @@ export const CreateClientSecretModal = ({
                                     <div className="flex">
                                         <Input 
                                             {...field} 
-                                            placeholder="7200"
+                                            placeholder="0"
                                             type="number"
                                             min="0"
                                             step="1"

frontend/src/views/Project/MembersPage/MembersPage.tsx

@@ -25,7 +25,7 @@ export const MembersPage = withProjectPermission(
       <div className="container mx-auto flex flex-col justify-between bg-bunker-800 text-white">
         <div className="mb-6 w-full py-6 px-6 max-w-7xl mx-auto">
           <p className="mr-4 mb-4 text-3xl font-semibold text-white">
-            Access Control
+            Project Access Control
           </p>
           <Tabs defaultValue={TabSections.Member}>
             <TabList>