Move MI from refresh token to client id / client secrets approach

frontend/src/hooks/api/machineIdentities/index.tsx

@@ -1,4 +1,9 @@
 export {
     useCreateMachineIdentity,
+    useCreateMachineIdentityClientSecret,
     useDeleteMachineIdentity,
-    useUpdateMachineIdentity} from "./mutations";
+    useDeleteMachineIdentityClientSecret,
+    useUpdateMachineIdentity} from "./mutations";
+export {
+    useGetMachineIdentityClientSecrets
+} from "./queries";

frontend/src/hooks/api/machineIdentities/mutations.tsx

@@ -3,12 +3,16 @@ import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { apiRequest } from "@app/config/request";
 
 import { organizationKeys } from "../organization/queries";
+import { machineIdentityKeys } from "./queries";
 import {
+    CreateMachineIdentityClientSecretDTO,
+    CreateMachineIdentityClientSecretRes,
     CreateMachineIdentityDTO,
     CreateMachineIdentityRes,
     DeleteMachineIdentityDTO,
     MachineIdentity,
-    UpdateMachineIdentityDTO} from "./types";
+    UpdateMachineIdentityDTO,
+} from "./types";
 
 export const useCreateMachineIdentity = () => {
     const queryClient = useQueryClient();
@@ -17,12 +21,56 @@ export const useCreateMachineIdentity = () => {
             const { data } = await apiRequest.post("/api/v3/machines/", body);
             return data;
         },
-            onSuccess: ({ machineIdentity }) => {
+        onSuccess: ({ machineIdentity }) => {
             queryClient.invalidateQueries(organizationKeys.getOrgServiceMemberships(machineIdentity.organization));
         }
     });
 };
 
+export const useCreateMachineIdentityClientSecret = () => {
+    const queryClient = useQueryClient();
+    return useMutation<CreateMachineIdentityClientSecretRes, {}, CreateMachineIdentityClientSecretDTO>({
+        mutationFn: async ({
+            machineId,
+            description,
+            ttl,
+            usageLimit
+        }) => {
+
+            const { data } = await apiRequest.post(`/api/v3/machines/${machineId}/client-secrets`, {
+                machineId,
+                description,
+                ttl,
+                usageLimit
+            });
+
+            return data;
+        },
+        onSuccess: (_, { machineId }) => {
+            queryClient.invalidateQueries(machineIdentityKeys.getMachineIdentityClientSecrets(machineId));
+        }
+    });
+};
+
+export const useDeleteMachineIdentityClientSecret = () => {
+    const queryClient = useQueryClient();
+    return useMutation({
+        mutationFn: async ({
+            machineId,
+            clientSecretId
+        }: {
+            machineId:string;
+            clientSecretId: string;
+        }) => {
+            const { data } = await apiRequest.delete(`/api/v3/machines/${machineId}/client-secrets/${clientSecretId}`);
+            return data;
+        },
+        onSuccess: (_, { machineId }) => {
+            queryClient.invalidateQueries(machineIdentityKeys.getMachineIdentityClientSecrets(machineId));
+        }
+    });
+};
+
 export const useUpdateMachineIdentity = () => {
     const queryClient = useQueryClient();
     return useMutation<MachineIdentity, {}, UpdateMachineIdentityDTO>({
@@ -30,21 +78,17 @@ export const useUpdateMachineIdentity = () => {
             machineId,
             name,
             role,
-            isActive,
-            trustedIps,
-            expiresIn,
-            accessTokenTTL,
-            isRefreshTokenRotationEnabled
+            clientSecretTrustedIps,
+            accessTokenTrustedIps,
+            accessTokenTTL
         }) => {
             
             const { data: { machineIdentity } } = await apiRequest.patch(`/api/v3/machines/${machineId}`, {
                 name,
                 role,
-                isActive,
-                trustedIps,
-                expiresIn,
+                clientSecretTrustedIps,
+                accessTokenTrustedIps,
                 accessTokenTTL,
-                isRefreshTokenRotationEnabled
             });
 
             return machineIdentity;

frontend/src/hooks/api/machineIdentities/queries.tsx

@@ -0,0 +1,24 @@
+import { useQuery } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import {
+    MachineIdentityClientSecret
+} from "./types";
+
+export const machineIdentityKeys = {
+    getMachineIdentityClientSecrets: (machineId: string) => [{ machineId }, "machine-identity-client-secrets"] as const
+}
+
+export const useGetMachineIdentityClientSecrets = (machineId: string) => {
+    return useQuery({
+        queryKey: machineIdentityKeys.getMachineIdentityClientSecrets(machineId),
+        queryFn: async () => {
+            const { data: { clientSecretData } } = await apiRequest.get<{ clientSecretData: MachineIdentityClientSecret[] }>(
+                `/api/v3/machines/${machineId}/client-secrets`
+            );
+        
+            return clientSecretData;
+        }
+    });
+}

frontend/src/hooks/api/machineIdentities/types.ts

@@ -9,21 +9,30 @@ export type MachineTrustedIp = {
 
 export type MachineIdentity = {
     _id: string;
+    clientId: string;
     name: string;
     organization: string;
     isActive: boolean;
-    refreshTokenLastUsed?: string;
-    accessTokenLastUsed?: string;
-    refreshTokenUsageCount: number;
-    accessTokenUsageCount: number;
-    trustedIps: MachineTrustedIp[];
-    expiresAt?: string;
     accessTokenTTL: number;
-    isRefreshTokenRotationEnabled: boolean;
+    accessTokenLastUsed?: string;
+    accessTokenUsageCount: number;
+    clientSecretTrustedIps: MachineTrustedIp[];
+    accessTokenTrustedIps: MachineTrustedIp[];
     createdAt: string;
     updatedAt: string;
 };
 
+export type MachineIdentityClientSecret = {
+    _id: string;
+    machineIdentity: string;
+    isActive: boolean;
+    description: string;
+    clientSecretPrefix: string;
+    clientSecretUsageCount: number;
+    clientSecretUsageLimit: number;
+    expiresAt: string;
+}
+
 export type MachineMembershipOrg = {
     _id: string;
     machineIdentity: MachineIdentity;
@@ -48,30 +57,47 @@ export type CreateMachineIdentityDTO = {
     name: string;
     organizationId: string;
     role?: string;
-    trustedIps: {
+    clientSecretTrustedIps: {
+      ipAddress: string;
+    }[];
+    accessTokenTrustedIps: {
       ipAddress: string;
     }[];
-    expiresIn?: number;
     accessTokenTTL: number;
-    isRefreshTokenRotationEnabled: boolean;
+}
+
+export type CreateMachineIdentityClientSecretDTO = {
+    machineId: string;
+    description?: string;
+    ttl?: number;
+    usageLimit?: number;
+}
+
+export type CreateMachineIdentityClientSecretRes = {
+    clientSecret: string;
+    machineIdentity: string;
+    isActive: boolean;
+    description: string;
+    clientSecretUsageCount: number;
+    clientSecretUsageLimit: number;
+    expiresAt?: Date;
 }
 
 export type CreateMachineIdentityRes = {
-    refreshToken: string;
     machineIdentity: MachineIdentity;
 }
 
 export type UpdateMachineIdentityDTO = {
     machineId: string;
-    isActive?: boolean;
     name?: string;
     role?: string;
-    trustedIps?: {
+    clientSecretTrustedIps?: {
+        ipAddress: string;
+    }[];
+    accessTokenTrustedIps?: {
         ipAddress: string;
     }[];
-    expiresIn?: number;
     accessTokenTTL?: number;
-    isRefreshTokenRotationEnabled?: boolean;
 }
 
 export type DeleteMachineIdentityDTO = {