mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-10-13 20:29:34 +00:00
Switch access token tracking to be persistent, add num uses, draft token renewal, update docs
This commit is contained in:
Tuan Dang
@@ -34,14 +34,14 @@ export const useCreateMachineIdentityClientSecret = () => {
|
||||
machineId,
|
||||
description,
|
||||
ttl,
|
||||
usageLimit
|
||||
numUsesLimit
|
||||
}) => {
|
||||
|
||||
const { data } = await apiRequest.post(`/api/v1/machine-identities/${machineId}/client-secrets`, {
|
||||
machineId,
|
||||
description,
|
||||
ttl,
|
||||
usageLimit
|
||||
numUsesLimit
|
||||
});
|
||||
|
||||
return data;
|
||||
@@ -80,7 +80,8 @@ export const useUpdateMachineIdentity = () => {
|
||||
role,
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps,
|
||||
accessTokenTTL
|
||||
accessTokenTTL,
|
||||
accessTokenNumUsesLimit
|
||||
}) => {
|
||||
|
||||
const { data: { machineIdentity } } = await apiRequest.patch(`/api/v1/machine-identities/${machineId}`, {
|
||||
@@ -89,6 +90,7 @@ export const useUpdateMachineIdentity = () => {
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps,
|
||||
accessTokenTTL,
|
||||
accessTokenNumUsesLimit
|
||||
});
|
||||
|
||||
return machineIdentity;
|
||||
|
||||
@@ -12,10 +12,9 @@ export type MachineIdentity = {
|
||||
clientId: string;
|
||||
name: string;
|
||||
organization: string;
|
||||
isActive: boolean;
|
||||
accessTokenTTL: number;
|
||||
accessTokenLastUsed?: string;
|
||||
accessTokenUsageCount: number;
|
||||
accessTokenMaxTTL: number;
|
||||
accessTokenNumUsesLimit: number;
|
||||
clientSecretTrustedIps: MachineTrustedIp[];
|
||||
accessTokenTrustedIps: MachineTrustedIp[];
|
||||
createdAt: string;
|
||||
@@ -25,7 +24,6 @@ export type MachineIdentity = {
|
||||
export type MachineIdentityClientSecret = {
|
||||
_id: string;
|
||||
machineIdentity: string;
|
||||
isActive: boolean;
|
||||
description: string;
|
||||
clientSecretPrefix: string;
|
||||
clientSecretNumUses: number;
|
||||
@@ -33,6 +31,7 @@ export type MachineIdentityClientSecret = {
|
||||
clientSecretTTL: number;
|
||||
createdAt: string;
|
||||
updatedAt: string;
|
||||
isClientSecretRevoked: boolean;
|
||||
}
|
||||
|
||||
export type MachineMembershipOrg = {
|
||||
@@ -66,13 +65,15 @@ export type CreateMachineIdentityDTO = {
|
||||
ipAddress: string;
|
||||
}[];
|
||||
accessTokenTTL: number;
|
||||
accessTokenMaxTTL: number;
|
||||
accessTokenNumUsesLimit: number;
|
||||
}
|
||||
|
||||
export type CreateMachineIdentityClientSecretDTO = {
|
||||
machineId: string;
|
||||
description?: string;
|
||||
ttl?: number;
|
||||
usageLimit?: number;
|
||||
numUsesLimit?: number;
|
||||
}
|
||||
|
||||
export type CreateMachineIdentityClientSecretRes = {
|
||||
@@ -100,6 +101,8 @@ export type UpdateMachineIdentityDTO = {
|
||||
ipAddress: string;
|
||||
}[];
|
||||
accessTokenTTL?: number;
|
||||
accessTokenMaxTTL?: number;
|
||||
accessTokenNumUsesLimit?: number;
|
||||
}
|
||||
|
||||
export type DeleteMachineIdentityDTO = {
|
||||
|
||||
+66
-11
@@ -43,15 +43,13 @@ const schema = yup.object({
|
||||
name: yup.string().required("MI name is required"),
|
||||
accessTokenTTL: yup
|
||||
.string()
|
||||
.test("is-positive-integer", "Access Token TTL must be a positive integer", (value) => {
|
||||
if (typeof value === "undefined") {
|
||||
return false;
|
||||
}
|
||||
|
||||
const num = parseInt(value, 10);
|
||||
return !Number.isNaN(num) && num > 0 && String(num) === value;
|
||||
})
|
||||
.required("Access Token TTL is required"),
|
||||
accessTokenMaxTTL: yup
|
||||
.string()
|
||||
.required("Access Max Token TTL is required"),
|
||||
accessTokenNumUsesLimit: yup
|
||||
.string()
|
||||
.required("Access Token Max Number of Uses is required"),
|
||||
role: yup.string(),
|
||||
clientSecretTrustedIps: yup
|
||||
.array(
|
||||
@@ -111,6 +109,8 @@ export const AddMachineIdentityModal = ({
|
||||
defaultValues: {
|
||||
name: "",
|
||||
accessTokenTTL: "7200",
|
||||
accessTokenMaxTTL: "7200",
|
||||
accessTokenNumUsesLimit: "0",
|
||||
clientSecretTrustedIps: [{
|
||||
ipAddress: "0.0.0.0/0"
|
||||
}],
|
||||
@@ -143,6 +143,8 @@ export const AddMachineIdentityModal = ({
|
||||
clientSecretTrustedIps: MachineTrustedIp[];
|
||||
accessTokenTrustedIps: MachineTrustedIp[];
|
||||
accessTokenTTL: number;
|
||||
accessTokenMaxTTL: number;
|
||||
accessTokenNumUsesLimit: number;
|
||||
};
|
||||
|
||||
if (!roles?.length) return;
|
||||
@@ -150,6 +152,7 @@ export const AddMachineIdentityModal = ({
|
||||
if (machineIdentity) {
|
||||
reset({
|
||||
name: machineIdentity.name,
|
||||
accessTokenNumUsesLimit: String(machineIdentity.accessTokenNumUsesLimit),
|
||||
role: machineIdentity?.customRole?.slug ?? machineIdentity.role,
|
||||
clientSecretTrustedIps: machineIdentity.clientSecretTrustedIps.map(({
|
||||
ipAddress,
|
||||
@@ -167,12 +170,15 @@ export const AddMachineIdentityModal = ({
|
||||
ipAddress: `${ipAddress}${prefix !== undefined ? `/${prefix}` : ""}`
|
||||
});
|
||||
}),
|
||||
accessTokenTTL: String(machineIdentity.accessTokenTTL)
|
||||
accessTokenTTL: String(machineIdentity.accessTokenTTL),
|
||||
accessTokenMaxTTL: String(machineIdentity.accessTokenMaxTTL)
|
||||
});
|
||||
} else {
|
||||
reset({
|
||||
name: "",
|
||||
accessTokenTTL: "7200",
|
||||
accessTokenMaxTTL: "7200",
|
||||
accessTokenNumUsesLimit: "0",
|
||||
role: roles[0].slug,
|
||||
clientSecretTrustedIps: [{
|
||||
ipAddress: "0.0.0.0/0"
|
||||
@@ -198,9 +204,11 @@ export const AddMachineIdentityModal = ({
|
||||
const onFormSubmit = async ({
|
||||
name,
|
||||
accessTokenTTL,
|
||||
accessTokenMaxTTL,
|
||||
role,
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps
|
||||
accessTokenTrustedIps,
|
||||
accessTokenNumUsesLimit
|
||||
}: FormData) => {
|
||||
try {
|
||||
|
||||
@@ -219,7 +227,9 @@ export const AddMachineIdentityModal = ({
|
||||
role: role || undefined,
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps,
|
||||
accessTokenTTL: Number(accessTokenTTL)
|
||||
accessTokenTTL: Number(accessTokenTTL),
|
||||
accessTokenMaxTTL: Number(accessTokenMaxTTL),
|
||||
accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit)
|
||||
});
|
||||
|
||||
handlePopUpToggle("machineIdentity", false);
|
||||
@@ -232,6 +242,8 @@ export const AddMachineIdentityModal = ({
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps,
|
||||
accessTokenTTL: Number(accessTokenTTL),
|
||||
accessTokenMaxTTL: Number(accessTokenMaxTTL),
|
||||
accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit)
|
||||
});
|
||||
|
||||
handlePopUpToggle("machineIdentity", false);
|
||||
@@ -355,6 +367,26 @@ export const AddMachineIdentityModal = ({
|
||||
</FormControl>
|
||||
)}
|
||||
/> */}
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue="7200"
|
||||
name="accessTokenMaxTTL"
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
label="Access Token Max TTL (seconds)"
|
||||
isError={Boolean(error)}
|
||||
errorText={error?.message}
|
||||
>
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="7200"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue="7200"
|
||||
@@ -368,6 +400,29 @@ export const AddMachineIdentityModal = ({
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="7200"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue="0"
|
||||
name="accessTokenNumUsesLimit"
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
label="Access Token Max Number of Uses"
|
||||
isError={Boolean(error)}
|
||||
errorText={error?.message}
|
||||
>
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="0"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
</FormControl>
|
||||
)}
|
||||
|
||||
+78
-45
@@ -35,7 +35,8 @@ import { UsePopUpState } from "@app/hooks/usePopUp";
|
||||
|
||||
const schema = yup.object({
|
||||
description: yup.string(),
|
||||
ttl: yup.string() // TODO: optional
|
||||
ttl: yup.string(),
|
||||
numUsesLimit: yup.string()
|
||||
});
|
||||
|
||||
export type FormData = yup.InferType<typeof schema>;
|
||||
@@ -81,7 +82,8 @@ export const CreateClientSecretModal = ({
|
||||
resolver: yupResolver(schema),
|
||||
defaultValues: {
|
||||
description: "",
|
||||
ttl: ""
|
||||
ttl: "",
|
||||
numUsesLimit: ""
|
||||
}
|
||||
});
|
||||
|
||||
@@ -101,7 +103,8 @@ export const CreateClientSecretModal = ({
|
||||
|
||||
const onFormSubmit = async ({
|
||||
description,
|
||||
ttl
|
||||
ttl,
|
||||
numUsesLimit
|
||||
}: FormData) => {
|
||||
try {
|
||||
|
||||
@@ -110,7 +113,8 @@ export const CreateClientSecretModal = ({
|
||||
const { clientSecret } = await createClientSecretMutateAsync({
|
||||
machineId: popUpData.machineId,
|
||||
description,
|
||||
ttl: Number(ttl)
|
||||
ttl: Number(ttl),
|
||||
numUsesLimit: Number(numUsesLimit)
|
||||
});
|
||||
|
||||
setToken(clientSecret);
|
||||
@@ -211,7 +215,7 @@ export const CreateClientSecretModal = ({
|
||||
) : (
|
||||
<form
|
||||
onSubmit={handleSubmit(onFormSubmit)}
|
||||
className="flex mb-8"
|
||||
className="mb-8"
|
||||
>
|
||||
<Controller
|
||||
control={control}
|
||||
@@ -230,38 +234,63 @@ export const CreateClientSecretModal = ({
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue=""
|
||||
name="ttl"
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
label="TTL (optional)"
|
||||
isError={Boolean(error)}
|
||||
errorText={error?.message}
|
||||
className="ml-4"
|
||||
>
|
||||
<div className="flex">
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="0"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
<Button
|
||||
className="ml-4"
|
||||
size="sm"
|
||||
type="submit"
|
||||
isLoading={isSubmitting}
|
||||
isDisabled={isSubmitting}
|
||||
>
|
||||
Create
|
||||
</Button>
|
||||
</div>
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
<div className="flex">
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue=""
|
||||
name="ttl"
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
label="TTL (seconds - optional)"
|
||||
isError={Boolean(error)}
|
||||
errorText={error?.message}
|
||||
>
|
||||
<div className="flex">
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="0"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
|
||||
</div>
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
<Controller
|
||||
control={control}
|
||||
defaultValue="0"
|
||||
name="numUsesLimit"
|
||||
render={({ field, fieldState: { error } }) => (
|
||||
<FormControl
|
||||
label="Max Number of Uses"
|
||||
isError={Boolean(error)}
|
||||
errorText={error?.message}
|
||||
className="ml-4"
|
||||
>
|
||||
<div className="flex">
|
||||
<Input
|
||||
{...field}
|
||||
placeholder="0"
|
||||
type="number"
|
||||
min="0"
|
||||
step="1"
|
||||
/>
|
||||
<Button
|
||||
className="ml-4"
|
||||
size="sm"
|
||||
type="submit"
|
||||
isLoading={isSubmitting}
|
||||
isDisabled={isSubmitting}
|
||||
>
|
||||
Create
|
||||
</Button>
|
||||
</div>
|
||||
</FormControl>
|
||||
)}
|
||||
/>
|
||||
</div>
|
||||
</form>
|
||||
)}
|
||||
<h2 className="mb-4">Client Secrets</h2>
|
||||
@@ -270,13 +299,14 @@ export const CreateClientSecretModal = ({
|
||||
<THead>
|
||||
<Tr>
|
||||
<Th>Description</Th>
|
||||
<Th>Num Uses</Th>
|
||||
<Th>Expires At</Th>
|
||||
<Th>Client Secret</Th>
|
||||
<Th className="w-5" />
|
||||
</Tr>
|
||||
</THead>
|
||||
<TBody>
|
||||
{isLoading && <TableSkeleton columns={4} innerKey="org-machine-identities-client-secrets" />}
|
||||
{isLoading && <TableSkeleton columns={5} innerKey="org-machine-identities-client-secrets" />}
|
||||
{!isLoading &&
|
||||
data &&
|
||||
data.length > 0 &&
|
||||
@@ -284,19 +314,23 @@ export const CreateClientSecretModal = ({
|
||||
_id,
|
||||
description,
|
||||
clientSecretTTL,
|
||||
clientSecretPrefix
|
||||
clientSecretPrefix,
|
||||
clientSecretNumUses,
|
||||
clientSecretNumUsesLimit,
|
||||
createdAt
|
||||
}) => {
|
||||
let expiresAt;
|
||||
if (clientSecretTTL > 0) {
|
||||
expiresAt = new Date(new Date().getTime() + clientSecretTTL * 1000);
|
||||
expiresAt = new Date(new Date(createdAt).getTime() + clientSecretTTL * 1000);
|
||||
}
|
||||
|
||||
return (
|
||||
<Tr className="h-10" key={`mi-client-secret-${_id}`}>
|
||||
<Tr className="h-10 items-center" key={`mi-client-secret-${_id}`}>
|
||||
<Td>{description === "" ? "-" : description}</Td>
|
||||
<Td>{`${clientSecretNumUses}${clientSecretNumUsesLimit ? `/${clientSecretNumUsesLimit}` : ""}`}</Td>
|
||||
<Td>{expiresAt ? format(expiresAt, "yyyy-MM-dd") : "-"}</Td>
|
||||
<Td>{`${clientSecretPrefix}************`}</Td>
|
||||
<Td className="flex">
|
||||
<Td>{`${clientSecretPrefix}****`}</Td>
|
||||
<Td>
|
||||
<IconButton
|
||||
onClick={() => {
|
||||
handlePopUpOpen("deleteClientSecret", {
|
||||
@@ -308,7 +342,6 @@ export const CreateClientSecretModal = ({
|
||||
colorSchema="primary"
|
||||
variant="plain"
|
||||
ariaLabel="update"
|
||||
className="ml-4"
|
||||
>
|
||||
<FontAwesomeIcon icon={faXmark} />
|
||||
</IconButton>
|
||||
@@ -318,7 +351,7 @@ export const CreateClientSecretModal = ({
|
||||
})}
|
||||
{!isLoading && data && data?.length === 0 && (
|
||||
<Tr>
|
||||
<Td colSpan={4}>
|
||||
<Td colSpan={5}>
|
||||
<EmptyState title="No client secrets have been created for this machine identity yet" icon={faKey} />
|
||||
</Td>
|
||||
</Tr>
|
||||
|
||||
+6
@@ -42,7 +42,9 @@ type Props = {
|
||||
};
|
||||
clientSecretTrustedIps?: MachineTrustedIp[];
|
||||
accessTokenTrustedIps?: MachineTrustedIp[];
|
||||
accessTokenMaxTTL?: number;
|
||||
accessTokenTTL?: number;
|
||||
accessTokenNumUsesLimit?: number;
|
||||
}
|
||||
) => void;
|
||||
};
|
||||
@@ -148,7 +150,9 @@ export const MachineIdentityTable = ({
|
||||
accessTokenTrustedIps,
|
||||
// createdAt,
|
||||
// expiresAt,
|
||||
accessTokenMaxTTL,
|
||||
accessTokenTTL,
|
||||
accessTokenNumUsesLimit
|
||||
},
|
||||
role,
|
||||
customRole
|
||||
@@ -223,6 +227,8 @@ export const MachineIdentityTable = ({
|
||||
clientSecretTrustedIps,
|
||||
accessTokenTrustedIps,
|
||||
accessTokenTTL,
|
||||
accessTokenMaxTTL,
|
||||
accessTokenNumUsesLimit
|
||||
});
|
||||
}}
|
||||
size="lg"
|
||||
|
||||
Reference in New Issue
Block a user