feat: multiple auth methods for identities

backend/package.json

@@ -44,7 +44,7 @@
     "test:e2e-watch": "vitest -c vitest.e2e.config.ts --bail=1",
     "test:e2e-coverage": "vitest run --coverage -c vitest.e2e.config.ts",
     "generate:component": "tsx ./scripts/create-backend-file.ts",
-    "generate:schema": "tsx ./scripts/generate-schema-types.ts",
+    "generate:schema": "tsx ./scripts/generate-schema-types.ts && eslint --fix --ext ts ./src/db/schemas",
     "auditlog-migration:latest": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:latest",
     "auditlog-migration:up": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:up",
     "auditlog-migration:down": "knex --knexfile ./src/db/auditlog-knexfile.ts --client pg migrate:down",

backend/src/db/migrations/20241014084900_identity-multiple-auth-methods.ts

@@ -0,0 +1,55 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasAuthMethodColumnAccessToken = await knex.schema.hasColumn(TableName.IdentityAccessToken, "authMethod");
+
+  if (!hasAuthMethodColumnAccessToken) {
+    await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+      t.string("authMethod").nullable();
+    });
+
+    // Backfilling: Update the authMethod column in the IdentityAccessToken table to match the authMethod of the Identity
+    await knex(TableName.IdentityAccessToken).update({
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-ignore because generate schema happens after this
+      authMethod: knex(TableName.Identity)
+        .select("authMethod")
+        .whereRaw(`${TableName.IdentityAccessToken}."identityId" = ${TableName.Identity}.id`)
+        .whereNotNull("authMethod")
+        .first()
+    });
+
+    // ! We delete all access tokens where the identity has no auth method set!
+    // ! Which means un-configured identities that for some reason have access tokens, will have their access tokens deleted.
+    await knex(TableName.IdentityAccessToken)
+      .whereNotExists((queryBuilder) => {
+        void queryBuilder
+          .select("id")
+          .from(TableName.Identity)
+          .whereRaw(`${TableName.IdentityAccessToken}."identityId" = ${TableName.Identity}.id`)
+          .whereNotNull("authMethod");
+      })
+      .delete();
+
+    // Finally we set the authMethod to notNullable after populating the column.
+    // This will fail if the data is not populated correctly, so it's safe.
+    await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+      t.string("authMethod").notNullable().alter();
+    });
+  }
+
+  // ! We aren't dropping the authMethod column from the Identity itself, because we wan't to be able to easily rollback for the time being.
+}
+
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+export async function down(knex: Knex): Promise<void> {
+  const hasAuthMethodColumnAccessToken = await knex.schema.hasColumn(TableName.IdentityAccessToken, "authMethod");
+
+  if (hasAuthMethodColumnAccessToken) {
+    await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
+      t.dropColumn("authMethod");
+    });
+  }
+}

backend/src/db/schemas/identities.ts

@@ -10,7 +10,7 @@ import { TImmutableDBKeys } from "./models";
 export const IdentitiesSchema = z.object({
   id: z.string().uuid(),
   name: z.string(),
-  authMethod: z.string().nullable().optional(),
+  // authMethod: z.string().nullable().optional(),
   createdAt: z.date(),
   updatedAt: z.date()
 });

backend/src/db/schemas/identity-access-tokens.ts

@@ -20,7 +20,8 @@ export const IdentityAccessTokensSchema = z.object({
   identityId: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  name: z.string().nullable().optional()
+  name: z.string().nullable().optional(),
+  authMethod: z.string()
 });
 
 export type TIdentityAccessTokens = z.infer<typeof IdentityAccessTokensSchema>;

backend/src/db/schemas/models.ts

@@ -189,7 +189,7 @@ export enum ProjectUpgradeStatus {
 
 export enum IdentityAuthMethod {
   TOKEN_AUTH = "token-auth",
-  Univeral = "universal-auth",
+  UNIVERSAL_AUTH = "universal-auth",
   KUBERNETES_AUTH = "kubernetes-auth",
   GCP_AUTH = "gcp-auth",
   AWS_AUTH = "aws-auth",

backend/src/db/seeds/5-machine-identity.ts

@@ -16,7 +16,7 @@ export async function seed(knex: Knex): Promise<void> {
       // @ts-ignore
       id: seedData1.machineIdentity.id,
       name: seedData1.machineIdentity.name,
-      authMethod: IdentityAuthMethod.Univeral
+      authMethod: IdentityAuthMethod.UNIVERSAL_AUTH
     }
   ]);
   const identityUa = await knex(TableName.IdentityUniversalAuth)

backend/src/server/routes/index.ts

@@ -1087,7 +1087,6 @@ export const registerRoutes = async (
 
   const identityTokenAuthService = identityTokenAuthServiceFactory({
     identityTokenAuthDAL,
-    identityDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
     permissionService,
@@ -1096,7 +1095,6 @@ export const registerRoutes = async (
   const identityUaService = identityUaServiceFactory({
     identityOrgMembershipDAL,
     permissionService,
-    identityDAL,
     identityAccessTokenDAL,
     identityUaClientSecretDAL,
     identityUaDAL,
@@ -1106,7 +1104,6 @@ export const registerRoutes = async (
     identityKubernetesAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
-    identityDAL,
     orgBotDAL,
     permissionService,
     licenseService
@@ -1115,7 +1112,6 @@ export const registerRoutes = async (
     identityGcpAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
-    identityDAL,
     permissionService,
     licenseService
   });
@@ -1124,7 +1120,6 @@ export const registerRoutes = async (
     identityAccessTokenDAL,
     identityAwsAuthDAL,
     identityOrgMembershipDAL,
-    identityDAL,
     licenseService,
     permissionService
   });
@@ -1133,7 +1128,6 @@ export const registerRoutes = async (
     identityAzureAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
-    identityDAL,
     permissionService,
     licenseService
   });
@@ -1142,7 +1136,6 @@ export const registerRoutes = async (
     identityOidcAuthDAL,
     identityOrgMembershipDAL,
     identityAccessTokenDAL,
-    identityDAL,
     permissionService,
     licenseService,
     orgBotDAL

backend/src/server/routes/v1/identity-router.ts

@@ -1,6 +1,12 @@
 import { z } from "zod";
 
-import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
+import {
+  IdentitiesSchema,
+  IdentityAuthMethod,
+  IdentityOrgMembershipsSchema,
+  OrgMembershipRole,
+  OrgRolesSchema
+} from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { IDENTITIES } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -216,7 +222,9 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
               permissions: true,
               description: true
             }).optional(),
-            identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true })
+            identity: IdentitiesSchema.pick({ name: true, id: true }).extend({
+              authMethods: z.array(z.nativeEnum(IdentityAuthMethod))
+            })
           })
         })
       }

backend/src/server/routes/v2/identity-org-router.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
+import { IdentitiesSchema, IdentityAuthMethod, IdentityOrgMembershipsSchema, OrgRolesSchema } from "@app/db/schemas";
 import { ORGANIZATIONS } from "@app/lib/api-docs";
 import { OrderByDirection } from "@app/lib/types";
 import { readLimit } from "@app/server/config/rateLimiter";
@@ -58,7 +58,9 @@ export const registerIdentityOrgRouter = async (server: FastifyZodProvider) => {
                 permissions: true,
                 description: true
               }).optional(),
-              identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true })
+              identity: IdentitiesSchema.pick({ name: true, id: true }).extend({
+                authMethods: z.array(z.nativeEnum(IdentityAuthMethod))
+              })
             })
           ).array(),
           totalCount: z.number()

backend/src/services/identity-access-token/identity-access-token-dal.ts

@@ -1,7 +1,7 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { IdentityAuthMethod, TableName, TIdentityAccessTokens } from "@app/db/schemas";
+import { TableName, TIdentityAccessTokens } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols } from "@app/lib/knex";
 import { logger } from "@app/lib/logger";
@@ -17,54 +17,27 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
       const doc = await (tx || db.replicaNode())(TableName.IdentityAccessToken)
         .where(filter)
         .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.IdentityAccessToken}.identityId`)
-        .leftJoin(TableName.IdentityUaClientSecret, (qb) => {
+        .leftJoin(
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.Univeral])).andOn(
+          TableName.IdentityUaClientSecret,
-            `${TableName.IdentityAccessToken}.identityUAClientSecretId`,
+          `${TableName.IdentityAccessToken}.identityUAClientSecretId`,
-            `${TableName.IdentityUaClientSecret}.id`
+          `${TableName.IdentityUaClientSecret}.id`
-          );
+        )
-        })
+        .leftJoin(
-        .leftJoin(TableName.IdentityUniversalAuth, (qb) => {
+          TableName.IdentityUniversalAuth,
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.Univeral])).andOn(
+          `${TableName.IdentityUaClientSecret}.identityUAId`,
-            `${TableName.IdentityUaClientSecret}.identityUAId`,
+          `${TableName.IdentityUniversalAuth}.id`
-            `${TableName.IdentityUniversalAuth}.id`
+        )
-          );
+        .leftJoin(TableName.IdentityGcpAuth, `${TableName.Identity}.id`, `${TableName.IdentityGcpAuth}.identityId`)
-        })
+        .leftJoin(TableName.IdentityAwsAuth, `${TableName.Identity}.id`, `${TableName.IdentityAwsAuth}.identityId`)
-        .leftJoin(TableName.IdentityGcpAuth, (qb) => {
+        .leftJoin(TableName.IdentityAzureAuth, `${TableName.Identity}.id`, `${TableName.IdentityAzureAuth}.identityId`)
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.GCP_AUTH])).andOn(
+        .leftJoin(
-            `${TableName.Identity}.id`,
+          TableName.IdentityKubernetesAuth,
-            `${TableName.IdentityGcpAuth}.identityId`
+          `${TableName.Identity}.id`,
-          );
+          `${TableName.IdentityKubernetesAuth}.identityId`
-        })
+        )
-        .leftJoin(TableName.IdentityAwsAuth, (qb) => {
+        .leftJoin(TableName.IdentityOidcAuth, `${TableName.Identity}.id`, `${TableName.IdentityOidcAuth}.identityId`)
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.AWS_AUTH])).andOn(
+        .leftJoin(TableName.IdentityTokenAuth, `${TableName.Identity}.id`, `${TableName.IdentityTokenAuth}.identityId`)
-            `${TableName.Identity}.id`,
+
-            `${TableName.IdentityAwsAuth}.identityId`
-          );
-        })
-        .leftJoin(TableName.IdentityAzureAuth, (qb) => {
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.AZURE_AUTH])).andOn(
-            `${TableName.Identity}.id`,
-            `${TableName.IdentityAzureAuth}.identityId`
-          );
-        })
-        .leftJoin(TableName.IdentityKubernetesAuth, (qb) => {
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.KUBERNETES_AUTH])).andOn(
-            `${TableName.Identity}.id`,
-            `${TableName.IdentityKubernetesAuth}.identityId`
-          );
-        })
-        .leftJoin(TableName.IdentityOidcAuth, (qb) => {
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.OIDC_AUTH])).andOn(
-            `${TableName.Identity}.id`,
-            `${TableName.IdentityOidcAuth}.identityId`
-          );
-        })
-        .leftJoin(TableName.IdentityTokenAuth, (qb) => {
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.TOKEN_AUTH])).andOn(
-            `${TableName.Identity}.id`,
-            `${TableName.IdentityTokenAuth}.identityId`
-          );
-        })
         .select(selectAllTableCols(TableName.IdentityAccessToken))
         .select(
           db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityUniversalAuth).as("accessTokenTrustedIpsUa"),
@@ -82,14 +55,13 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
 
       return {
         ...doc,
-        accessTokenTrustedIps:
+        trustedIpsUniversalAuth: doc.accessTokenTrustedIpsUa,
-          doc.accessTokenTrustedIpsUa ||
+        trustedIpsGcpAuth: doc.accessTokenTrustedIpsGcp,
-          doc.accessTokenTrustedIpsGcp ||
+        trustedIpsAwsAuth: doc.accessTokenTrustedIpsAws,
-          doc.accessTokenTrustedIpsAws ||
+        trustedIpsAzureAuth: doc.accessTokenTrustedIpsAzure,
-          doc.accessTokenTrustedIpsAzure ||
+        trustedIpsKubernetesAuth: doc.accessTokenTrustedIpsK8s,
-          doc.accessTokenTrustedIpsK8s ||
+        trustedIpsOidcAuth: doc.accessTokenTrustedIpsOidc,
-          doc.accessTokenTrustedIpsOidc ||
+        trustedIpsAccessTokenAuth: doc.accessTokenTrustedIpsToken
-          doc.accessTokenTrustedIpsToken
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "IdAccessTokenFindOne" });

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -1,6 +1,6 @@
 import jwt, { JwtPayload } from "jsonwebtoken";
 
-import { TableName, TIdentityAccessTokens } from "@app/db/schemas";
+import { IdentityAuthMethod, TableName, TIdentityAccessTokens } from "@app/db/schemas";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
@@ -164,10 +164,22 @@ export const identityAccessTokenServiceFactory = ({
         message: "Failed to authorize revoked access token, access token is revoked"
       });
 
-    if (ipAddress && identityAccessToken) {
+    const trustedIpsMap: Record<IdentityAuthMethod, unknown> = {
+      [IdentityAuthMethod.UNIVERSAL_AUTH]: identityAccessToken.trustedIpsUniversalAuth,
+      [IdentityAuthMethod.GCP_AUTH]: identityAccessToken.trustedIpsGcpAuth,
+      [IdentityAuthMethod.AWS_AUTH]: identityAccessToken.trustedIpsAwsAuth,
+      [IdentityAuthMethod.AZURE_AUTH]: identityAccessToken.trustedIpsAzureAuth,
+      [IdentityAuthMethod.KUBERNETES_AUTH]: identityAccessToken.trustedIpsKubernetesAuth,
+      [IdentityAuthMethod.OIDC_AUTH]: identityAccessToken.trustedIpsOidcAuth,
+      [IdentityAuthMethod.TOKEN_AUTH]: identityAccessToken.trustedIpsAccessTokenAuth
+    };
+
+    const trustedIps = trustedIpsMap[identityAccessToken.authMethod as IdentityAuthMethod];
+
+    if (ipAddress) {
       checkIPAgainstBlocklist({
         ipAddress,
-        trustedIps: identityAccessToken?.accessTokenTrustedIps as TIp[]
+        trustedIps: trustedIps as TIp[]
       });
     }
 

backend/src/services/identity-aws-auth/identity-aws-auth-service.ts

@@ -13,7 +13,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedErro
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -33,7 +33,7 @@ type TIdentityAwsAuthServiceFactoryDep = {
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create">;
   identityAwsAuthDAL: Pick<TIdentityAwsAuthDALFactory, "findOne" | "transaction" | "create" | "updateById" | "delete">;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
 };
@@ -44,7 +44,7 @@ export const identityAwsAuthServiceFactory = ({
   identityAccessTokenDAL,
   identityAwsAuthDAL,
   identityOrgMembershipDAL,
-  identityDAL,
+  // identityDAL,
   licenseService,
   permissionService
 }: TIdentityAwsAuthServiceFactoryDep) => {
@@ -113,7 +113,8 @@ export const identityAwsAuthServiceFactory = ({
           accessTokenTTL: identityAwsAuth.accessTokenTTL,
           accessTokenMaxTTL: identityAwsAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityAwsAuth.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.AWS_AUTH
         },
         tx
       );
@@ -155,10 +156,12 @@ export const identityAwsAuthServiceFactory = ({
   }: TAttachAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AWS_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add AWS Auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -206,13 +209,6 @@ export const identityAwsAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.AWS_AUTH
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityAwsAuth, orgId: identityMembershipOrg.orgId };
@@ -234,10 +230,12 @@ export const identityAwsAuthServiceFactory = ({
   }: TUpdateAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AWS_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update AWS Auth"
       });
+    }
 
     const identityAwsAuth = await identityAwsAuthDAL.findOne({ identityId });
 
@@ -293,10 +291,12 @@ export const identityAwsAuthServiceFactory = ({
   const getAwsAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AWS_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have AWS Auth attached"
       });
+    }
 
     const awsIdentityAuth = await identityAwsAuthDAL.findOne({ identityId });
 
@@ -320,10 +320,11 @@ export const identityAwsAuthServiceFactory = ({
   }: TRevokeAwsAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AWS_AUTH)
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AWS_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have aws auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -348,7 +349,7 @@ export const identityAwsAuthServiceFactory = ({
 
     const revokedIdentityAwsAuth = await identityAwsAuthDAL.transaction(async (tx) => {
       const deletedAwsAuth = await identityAwsAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedAwsAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityAwsAuth;

backend/src/services/identity-azure-auth/identity-azure-auth-service.ts

@@ -11,7 +11,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedErro
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -32,7 +32,7 @@ type TIdentityAzureAuthServiceFactoryDep = {
   >;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create">;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
@@ -43,7 +43,7 @@ export const identityAzureAuthServiceFactory = ({
   identityAzureAuthDAL,
   identityOrgMembershipDAL,
   identityAccessTokenDAL,
-  identityDAL,
+  // identityDAL,
   permissionService,
   licenseService
 }: TIdentityAzureAuthServiceFactoryDep) => {
@@ -84,7 +84,8 @@ export const identityAzureAuthServiceFactory = ({
           accessTokenTTL: identityAzureAuth.accessTokenTTL,
           accessTokenMaxTTL: identityAzureAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityAzureAuth.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.AZURE_AUTH
         },
         tx
       );
@@ -126,11 +127,12 @@ export const identityAzureAuthServiceFactory = ({
   }: TAttachAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AZURE_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add Azure Auth to already configured identity"
       });
-
+    }
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
     }
@@ -176,13 +178,7 @@ export const identityAzureAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
+
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.AZURE_AUTH
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityAzureAuth, orgId: identityMembershipOrg.orgId };
@@ -204,10 +200,11 @@ export const identityAzureAuthServiceFactory = ({
   }: TUpdateAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AZURE_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update Azure Auth"
       });
+    }
 
     const identityGcpAuth = await identityAzureAuthDAL.findOne({ identityId });
 
@@ -266,10 +263,11 @@ export const identityAzureAuthServiceFactory = ({
   const getAzureAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AZURE_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Azure Auth attached"
       });
+    }
 
     const identityAzureAuth = await identityAzureAuthDAL.findOne({ identityId });
 
@@ -294,10 +292,11 @@ export const identityAzureAuthServiceFactory = ({
   }: TRevokeAzureAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.AZURE_AUTH)
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.AZURE_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have azure auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -321,7 +320,7 @@ export const identityAzureAuthServiceFactory = ({
 
     const revokedIdentityAzureAuth = await identityAzureAuthDAL.transaction(async (tx) => {
       const deletedAzureAuth = await identityAzureAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedAzureAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityAzureAuth;

backend/src/services/identity-gcp-auth/identity-gcp-auth-service.ts

@@ -11,7 +11,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedErro
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -30,7 +30,7 @@ type TIdentityGcpAuthServiceFactoryDep = {
   identityGcpAuthDAL: Pick<TIdentityGcpAuthDALFactory, "findOne" | "transaction" | "create" | "updateById" | "delete">;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create">;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
@@ -41,7 +41,7 @@ export const identityGcpAuthServiceFactory = ({
   identityGcpAuthDAL,
   identityOrgMembershipDAL,
   identityAccessTokenDAL,
-  identityDAL,
+  // identityDAL,
   permissionService,
   licenseService
 }: TIdentityGcpAuthServiceFactoryDep) => {
@@ -125,7 +125,8 @@ export const identityGcpAuthServiceFactory = ({
           accessTokenTTL: identityGcpAuth.accessTokenTTL,
           accessTokenMaxTTL: identityGcpAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityGcpAuth.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.GCP_AUTH
         },
         tx
       );
@@ -168,10 +169,12 @@ export const identityGcpAuthServiceFactory = ({
   }: TAttachGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.GCP_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add GCP Auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -219,13 +222,6 @@ export const identityGcpAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.GCP_AUTH
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityGcpAuth, orgId: identityMembershipOrg.orgId };
@@ -248,10 +244,12 @@ export const identityGcpAuthServiceFactory = ({
   }: TUpdateGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.GCP_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update GCP Auth"
       });
+    }
 
     const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId });
 
@@ -311,10 +309,12 @@ export const identityGcpAuthServiceFactory = ({
   const getGcpAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.GCP_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have GCP Auth attached"
       });
+    }
 
     const identityGcpAuth = await identityGcpAuthDAL.findOne({ identityId });
 
@@ -339,10 +339,12 @@ export const identityGcpAuthServiceFactory = ({
   }: TRevokeGcpAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.GCP_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.GCP_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have gcp auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -366,7 +368,7 @@ export const identityGcpAuthServiceFactory = ({
 
     const revokedIdentityGcpAuth = await identityGcpAuthDAL.transaction(async (tx) => {
       const deletedGcpAuth = await identityGcpAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedGcpAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityGcpAuth;

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -22,7 +22,7 @@ import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 import { TOrgBotDALFactory } from "@app/services/org/org-bot-dal";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -44,7 +44,7 @@ type TIdentityKubernetesAuthServiceFactoryDep = {
   >;
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create">;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne" | "findById">;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "transaction" | "create">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -56,7 +56,7 @@ export const identityKubernetesAuthServiceFactory = ({
   identityKubernetesAuthDAL,
   identityOrgMembershipDAL,
   identityAccessTokenDAL,
-  identityDAL,
+  // identityDAL,
   orgBotDAL,
   permissionService,
   licenseService
@@ -215,7 +215,8 @@ export const identityKubernetesAuthServiceFactory = ({
           accessTokenTTL: identityKubernetesAuth.accessTokenTTL,
           accessTokenMaxTTL: identityKubernetesAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityKubernetesAuth.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.KUBERNETES_AUTH
         },
         tx
       );
@@ -260,10 +261,12 @@ export const identityKubernetesAuthServiceFactory = ({
   }: TAttachKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.KUBERNETES_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add Kubernetes Auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -372,13 +375,6 @@ export const identityKubernetesAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.KUBERNETES_AUTH
-        },
-        tx
-      );
       return doc;
     });
 
@@ -404,10 +400,12 @@ export const identityKubernetesAuthServiceFactory = ({
   }: TUpdateKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.KUBERNETES_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update Kubernetes Auth"
       });
+    }
 
     const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
 
@@ -532,11 +530,12 @@ export const identityKubernetesAuthServiceFactory = ({
   }: TGetKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.KUBERNETES_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Kubernetes Auth attached"
       });
-
+    }
     const identityKubernetesAuth = await identityKubernetesAuthDAL.findOne({ identityId });
 
     const { permission } = await permissionService.getOrgPermission(
@@ -597,10 +596,12 @@ export const identityKubernetesAuthServiceFactory = ({
   }: TRevokeKubernetesAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.KUBERNETES_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.KUBERNETES_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have kubernetes auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -624,7 +625,7 @@ export const identityKubernetesAuthServiceFactory = ({
 
     const revokedIdentityKubernetesAuth = await identityKubernetesAuthDAL.transaction(async (tx) => {
       const deletedKubernetesAuth = await identityKubernetesAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedKubernetesAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityKubernetesAuth;

backend/src/services/identity-oidc-auth/identity-oidc-auth-service.ts

@@ -22,7 +22,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedErro
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -41,7 +41,7 @@ type TIdentityOidcAuthServiceFactoryDep = {
   identityOidcAuthDAL: TIdentityOidcAuthDALFactory;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
   identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create">;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   orgBotDAL: Pick<TOrgBotDALFactory, "findOne" | "transaction" | "create">;
@@ -52,7 +52,7 @@ export type TIdentityOidcAuthServiceFactory = ReturnType<typeof identityOidcAuth
 export const identityOidcAuthServiceFactory = ({
   identityOidcAuthDAL,
   identityOrgMembershipDAL,
-  identityDAL,
+  // identityDAL,
   permissionService,
   licenseService,
   identityAccessTokenDAL,
@@ -61,7 +61,7 @@ export const identityOidcAuthServiceFactory = ({
   const login = async ({ identityId, jwt: oidcJwt }: TLoginOidcAuthDTO) => {
     const identityOidcAuth = await identityOidcAuthDAL.findOne({ identityId });
     if (!identityOidcAuth) {
-      throw new NotFoundError({ message: "GCP auth method not found for identity, did you configure GCP auth?" });
+      throw new NotFoundError({ message: "OIDC auth method not found for identity, did you configure OIDC auth?" });
     }
 
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({
@@ -181,7 +181,8 @@ export const identityOidcAuthServiceFactory = ({
           accessTokenTTL: identityOidcAuth.accessTokenTTL,
           accessTokenMaxTTL: identityOidcAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityOidcAuth.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.OIDC_AUTH
         },
         tx
       );
@@ -228,10 +229,11 @@ export const identityOidcAuthServiceFactory = ({
     if (!identityMembershipOrg) {
       if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
     }
-    if (identityMembershipOrg.identity.authMethod)
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.OIDC_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add OIDC Auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -334,13 +336,6 @@ export const identityOidcAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.OIDC_AUTH
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityOidcAuth, orgId: identityMembershipOrg.orgId, caCert };
@@ -368,7 +363,7 @@ export const identityOidcAuthServiceFactory = ({
       if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
     }
 
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.OIDC_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update OIDC Auth"
       });
@@ -471,7 +466,7 @@ export const identityOidcAuthServiceFactory = ({
       if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
     }
 
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.OIDC_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have OIDC Auth attached"
       });
@@ -519,7 +514,7 @@ export const identityOidcAuthServiceFactory = ({
       throw new NotFoundError({ message: "Failed to find identity" });
     }
 
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.OIDC_AUTH) {
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.OIDC_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have OIDC auth"
       });
@@ -551,7 +546,7 @@ export const identityOidcAuthServiceFactory = ({
 
     const revokedIdentityOidcAuth = await identityOidcAuthDAL.transaction(async (tx) => {
       const deletedOidcAuth = await identityOidcAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedOidcAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
 

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -11,7 +11,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/
 import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -32,11 +32,11 @@ type TIdentityTokenAuthServiceFactoryDep = {
     TIdentityTokenAuthDALFactory,
     "transaction" | "create" | "findOne" | "updateById" | "delete"
   >;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
   identityAccessTokenDAL: Pick<
     TIdentityAccessTokenDALFactory,
-    "create" | "find" | "update" | "findById" | "findOne" | "updateById"
+    "create" | "find" | "update" | "findById" | "findOne" | "updateById" | "delete"
   >;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -46,7 +46,7 @@ export type TIdentityTokenAuthServiceFactory = ReturnType<typeof identityTokenAu
 
 export const identityTokenAuthServiceFactory = ({
   identityTokenAuthDAL,
-  identityDAL,
+  // identityDAL,
   identityOrgMembershipDAL,
   identityAccessTokenDAL,
   permissionService,
@@ -65,10 +65,12 @@ export const identityTokenAuthServiceFactory = ({
   }: TAttachTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add Token Auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -112,13 +114,6 @@ export const identityTokenAuthServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.TOKEN_AUTH
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityTokenAuth, orgId: identityMembershipOrg.orgId };
@@ -137,10 +132,12 @@ export const identityTokenAuthServiceFactory = ({
   }: TUpdateTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "Failed to update Token Auth"
       });
+    }
 
     const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
 
@@ -197,10 +194,12 @@ export const identityTokenAuthServiceFactory = ({
   const getTokenAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth attached"
       });
+    }
 
     const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
 
@@ -225,10 +224,12 @@ export const identityTokenAuthServiceFactory = ({
   }: TRevokeTokenAuthDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -254,7 +255,12 @@ export const identityTokenAuthServiceFactory = ({
 
     const revokedIdentityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => {
       const deletedTokenAuth = await identityTokenAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      await identityAccessTokenDAL.delete({
+        identityId,
+        authMethod: IdentityAuthMethod.TOKEN_AUTH
+      });
+
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedTokenAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityTokenAuth;
@@ -270,10 +276,12 @@ export const identityTokenAuthServiceFactory = ({
   }: TCreateTokenAuthTokenDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -307,7 +315,8 @@ export const identityTokenAuthServiceFactory = ({
           accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL,
           accessTokenNumUses: 0,
           accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit,
-          name
+          name,
+          authMethod: IdentityAuthMethod.TOKEN_AUTH
         },
         tx
       );
@@ -344,10 +353,12 @@ export const identityTokenAuthServiceFactory = ({
   }: TGetTokenAuthTokensDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -381,10 +392,11 @@ export const identityTokenAuthServiceFactory = ({
     if (!identityMembershipOrg) {
       throw new NotFoundError({ message: `Failed to find identity with ID ${foundToken.identityId}` });
     }
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,

backend/src/services/identity-ua/identity-ua-service.ts

@@ -14,7 +14,7 @@ import { BadRequestError, ForbiddenRequestError, NotFoundError, UnauthorizedErro
 import { checkIPAgainstBlocklist, extractIPDetails, isValidIpOrCidr, TIp } from "@app/lib/ip";
 
 import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
+// import { TIdentityDALFactory } from "../identity/identity-dal";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
@@ -36,7 +36,7 @@ type TIdentityUaServiceFactoryDep = {
   identityUaClientSecretDAL: TIdentityUaClientSecretDALFactory;
   identityAccessTokenDAL: TIdentityAccessTokenDALFactory;
   identityOrgMembershipDAL: TIdentityOrgDALFactory;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
+  // identityDAL: Pick<TIdentityDALFactory, "updateById">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
 };
@@ -48,7 +48,7 @@ export const identityUaServiceFactory = ({
   identityUaClientSecretDAL,
   identityAccessTokenDAL,
   identityOrgMembershipDAL,
-  identityDAL,
+  // identityDAL,
   permissionService,
   licenseService
 }: TIdentityUaServiceFactoryDep) => {
@@ -115,7 +115,8 @@ export const identityUaServiceFactory = ({
           accessTokenTTL: identityUa.accessTokenTTL,
           accessTokenMaxTTL: identityUa.accessTokenMaxTTL,
           accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit
+          accessTokenNumUsesLimit: identityUa.accessTokenNumUsesLimit,
+          authMethod: IdentityAuthMethod.UNIVERSAL_AUTH
         },
         tx
       );
@@ -156,10 +157,12 @@ export const identityUaServiceFactory = ({
   }: TAttachUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity.authMethod)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "Failed to add universal auth to already configured identity"
       });
+    }
 
     if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
       throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
@@ -221,13 +224,6 @@ export const identityUaServiceFactory = ({
         },
         tx
       );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.Univeral
-        },
-        tx
-      );
       return doc;
     });
     return { ...identityUa, orgId: identityMembershipOrg.orgId };
@@ -247,10 +243,12 @@ export const identityUaServiceFactory = ({
   }: TUpdateUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
-        message: "Failed to updated universal auth"
+        message: "Failed to update universal auth"
       });
+    }
 
     const uaIdentityAuth = await identityUaDAL.findOne({ identityId });
 
@@ -321,10 +319,12 @@ export const identityUaServiceFactory = ({
   const getIdentityUniversalAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
 
     const uaIdentityAuth = await identityUaDAL.findOne({ identityId });
 
@@ -348,10 +348,12 @@ export const identityUaServiceFactory = ({
   }: TRevokeUaDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -375,7 +377,7 @@ export const identityUaServiceFactory = ({
 
     const revokedIdentityUniversalAuth = await identityUaDAL.transaction(async (tx) => {
       const deletedUniversalAuth = await identityUaDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
+      // await identityDAL.updateById(identityId, { authMethod: null }, tx);
       return { ...deletedUniversalAuth?.[0], orgId: identityMembershipOrg.orgId };
     });
     return revokedIdentityUniversalAuth;
@@ -393,10 +395,13 @@ export const identityUaServiceFactory = ({
   }: TCreateUaClientSecretDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -422,12 +427,11 @@ export const identityUaServiceFactory = ({
     const appCfg = getConfig();
     const clientSecret = crypto.randomBytes(32).toString("hex");
     const clientSecretHash = await bcrypt.hash(clientSecret, appCfg.SALT_ROUNDS);
-    const identityUniversalAuth = await identityUaDAL.findOne({
+
-      identityId
+    const identityUaAuth = await identityUaDAL.findOne({ identityId: identityMembershipOrg.identityId });
-    });
 
     const identityUaClientSecret = await identityUaClientSecretDAL.create({
-      identityUAId: identityUniversalAuth.id,
+      identityUAId: identityUaAuth.id,
       description,
       clientSecretPrefix: clientSecret.slice(0, 4),
       clientSecretHash,
@@ -439,7 +443,6 @@ export const identityUaServiceFactory = ({
     return {
       clientSecret,
       clientSecretData: identityUaClientSecret,
-      uaAuth: identityUniversalAuth,
       orgId: identityMembershipOrg.orgId
     };
   };
@@ -453,10 +456,12 @@ export const identityUaServiceFactory = ({
   }: TGetUaClientSecretsDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -500,10 +505,13 @@ export const identityUaServiceFactory = ({
   }: TGetUniversalAuthClientSecretByIdDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,
@@ -539,10 +547,13 @@ export const identityUaServiceFactory = ({
   }: TRevokeUaClientSecretDTO) => {
     const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
     if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.Univeral)
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.UNIVERSAL_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have universal auth"
       });
+    }
+
     const { permission } = await permissionService.getOrgPermission(
       actor,
       actorId,

backend/src/services/identity/identity-org-dal.ts

@@ -1,12 +1,52 @@
 import { Knex } from "knex";
 
 import { TDbClient } from "@app/db";
-import { TableName, TIdentityOrgMemberships, TOrgRoles } from "@app/db/schemas";
+import {
+  IdentityAuthMethod,
+  TableName,
+  TIdentityAwsAuths,
+  TIdentityAzureAuths,
+  TIdentityGcpAuths,
+  TIdentityKubernetesAuths,
+  TIdentityOidcAuths,
+  TIdentityOrgMemberships,
+  TIdentityTokenAuths,
+  TIdentityUniversalAuths,
+  TOrgRoles
+} from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify, selectAllTableCols, sqlNestRelationships } from "@app/lib/knex";
 import { OrderByDirection } from "@app/lib/types";
 import { OrgIdentityOrderBy, TListOrgIdentitiesByOrgIdDTO } from "@app/services/identity/identity-types";
 
+const buildAuthMethods = ({
+  uaId,
+  gcpId,
+  awsId,
+  kubernetesId,
+  oidcId,
+  azureId,
+  tokenId
+}: {
+  uaId?: string;
+  gcpId?: string;
+  awsId?: string;
+  kubernetesId?: string;
+  oidcId?: string;
+  azureId?: string;
+  tokenId?: string;
+}) => {
+  return [
+    ...(uaId ? [IdentityAuthMethod.UNIVERSAL_AUTH] : []),
+    ...(gcpId ? [IdentityAuthMethod.GCP_AUTH] : []),
+    ...(awsId ? [IdentityAuthMethod.AWS_AUTH] : []),
+    ...(kubernetesId ? [IdentityAuthMethod.KUBERNETES_AUTH] : []),
+    ...(oidcId ? [IdentityAuthMethod.OIDC_AUTH] : []),
+    ...(azureId ? [IdentityAuthMethod.AZURE_AUTH] : []),
+    ...(tokenId ? [IdentityAuthMethod.TOKEN_AUTH] : [])
+  ].filter((authMethod) => authMethod);
+};
+
 export type TIdentityOrgDALFactory = ReturnType<typeof identityOrgDALFactory>;
 
 export const identityOrgDALFactory = (db: TDbClient) => {
@@ -15,14 +55,73 @@ export const identityOrgDALFactory = (db: TDbClient) => {
   const findOne = async (filter: Partial<TIdentityOrgMemberships>, tx?: Knex) => {
     try {
       const [data] = await (tx || db.replicaNode())(TableName.IdentityOrgMembership)
-        .where(filter)
+        .where((queryBuilder) => {
+          Object.entries(filter).forEach(([key, value]) => {
+            void queryBuilder.where(`${TableName.IdentityOrgMembership}.${key}`, value);
+          });
+        })
         .join(TableName.Identity, `${TableName.IdentityOrgMembership}.identityId`, `${TableName.Identity}.id`)
-        .select(selectAllTableCols(TableName.IdentityOrgMembership))
+
-        .select(db.ref("name").withSchema(TableName.Identity))
+        .leftJoin<TIdentityUniversalAuths>(
-        .select(db.ref("authMethod").withSchema(TableName.Identity));
+          TableName.IdentityUniversalAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityUniversalAuth}.identityId`
+        )
+        .leftJoin<TIdentityGcpAuths>(
+          TableName.IdentityGcpAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityGcpAuth}.identityId`
+        )
+        .leftJoin<TIdentityAwsAuths>(
+          TableName.IdentityAwsAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityAwsAuth}.identityId`
+        )
+        .leftJoin<TIdentityKubernetesAuths>(
+          TableName.IdentityKubernetesAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityKubernetesAuth}.identityId`
+        )
+        .leftJoin<TIdentityOidcAuths>(
+          TableName.IdentityOidcAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityOidcAuth}.identityId`
+        )
+        .leftJoin<TIdentityAzureAuths>(
+          TableName.IdentityAzureAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityAzureAuth}.identityId`
+        )
+        .leftJoin<TIdentityTokenAuths>(
+          TableName.IdentityTokenAuth,
+          `${TableName.IdentityOrgMembership}.identityId`,
+          `${TableName.IdentityTokenAuth}.identityId`
+        )
+
+        .select(
+          selectAllTableCols(TableName.IdentityOrgMembership),
+
+          db.ref("id").as("uaId").withSchema(TableName.IdentityUniversalAuth),
+          db.ref("id").as("gcpId").withSchema(TableName.IdentityGcpAuth),
+          db.ref("id").as("awsId").withSchema(TableName.IdentityAwsAuth),
+          db.ref("id").as("kubernetesId").withSchema(TableName.IdentityKubernetesAuth),
+          db.ref("id").as("oidcId").withSchema(TableName.IdentityOidcAuth),
+          db.ref("id").as("azureId").withSchema(TableName.IdentityAzureAuth),
+          db.ref("id").as("tokenId").withSchema(TableName.IdentityTokenAuth),
+
+          db.ref("name").withSchema(TableName.Identity)
+        );
+
       if (data) {
-        const { name, authMethod } = data;
+        const { name } = data;
-        return { ...data, identity: { id: data.identityId, name, authMethod } };
+        return {
+          ...data,
+          identity: {
+            id: data.identityId,
+            name,
+            authMethods: buildAuthMethods(data)
+          }
+        };
       }
     } catch (error) {
       throw new DatabaseError({ error, name: "FindOne" });
@@ -42,7 +141,7 @@ export const identityOrgDALFactory = (db: TDbClient) => {
     tx?: Knex
   ) => {
     try {
-      const paginatedIdentity = (tx || db.replicaNode())(TableName.Identity)
+      const paginatedIdentitySubquery = (tx || db.replicaNode())(TableName.Identity)
         .join(
           TableName.IdentityOrgMembership,
           `${TableName.IdentityOrgMembership}.identityId`,
@@ -51,30 +150,70 @@ export const identityOrgDALFactory = (db: TDbClient) => {
         .orderBy(`${TableName.Identity}.${orderBy}`, orderDirection)
         .select(
           selectAllTableCols(TableName.IdentityOrgMembership),
-          db.ref("name").withSchema(TableName.Identity).as("identityName"),
+          db.ref("name").withSchema(TableName.Identity).as("identityName")
-          db.ref("authMethod").withSchema(TableName.Identity).as("identityAuthMethod")
+          // db.ref("authMethod").withSchema(TableName.Identity).as("identityAuthMethod")
         )
         .where(filter)
         .as("paginatedIdentity");
 
       if (search?.length) {
-        void paginatedIdentity.whereILike(`${TableName.Identity}.name`, `%${search}%`);
+        void paginatedIdentitySubquery.whereILike(`${TableName.Identity}.name`, `%${search}%`);
       }
 
       if (limit) {
-        void paginatedIdentity.offset(offset).limit(limit);
+        void paginatedIdentitySubquery.offset(offset).limit(limit);
       }
 
+      const paginatedIdentity = paginatedIdentitySubquery.as("paginatedIdentity");
+
       // akhilmhdh: refer this for pagination with multiple left queries
       type TSubquery = Awaited<typeof paginatedIdentity>;
       const query = (tx || db.replicaNode())
         .from<TSubquery[number], TSubquery>(paginatedIdentity)
         .leftJoin<TOrgRoles>(TableName.OrgRoles, `paginatedIdentity.roleId`, `${TableName.OrgRoles}.id`)
+
         .leftJoin(TableName.IdentityMetadata, (queryBuilder) => {
           void queryBuilder
             .on(`paginatedIdentity.identityId`, `${TableName.IdentityMetadata}.identityId`)
             .andOn(`paginatedIdentity.orgId`, `${TableName.IdentityMetadata}.orgId`);
         })
+
+        .leftJoin<TIdentityUniversalAuths>(
+          TableName.IdentityUniversalAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityUniversalAuth}.identityId`
+        )
+        .leftJoin<TIdentityGcpAuths>(
+          TableName.IdentityGcpAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityGcpAuth}.identityId`
+        )
+        .leftJoin<TIdentityAwsAuths>(
+          TableName.IdentityAwsAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityAwsAuth}.identityId`
+        )
+        .leftJoin<TIdentityKubernetesAuths>(
+          TableName.IdentityKubernetesAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityKubernetesAuth}.identityId`
+        )
+        .leftJoin<TIdentityOidcAuths>(
+          TableName.IdentityOidcAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityOidcAuth}.identityId`
+        )
+        .leftJoin<TIdentityAzureAuths>(
+          TableName.IdentityAzureAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityAzureAuth}.identityId`
+        )
+        .leftJoin<TIdentityTokenAuths>(
+          TableName.IdentityTokenAuth,
+          "paginatedIdentity.identityId",
+          `${TableName.IdentityTokenAuth}.identityId`
+        )
+
         .select(
           db.ref("id").withSchema("paginatedIdentity"),
           db.ref("role").withSchema("paginatedIdentity"),
@@ -82,9 +221,16 @@ export const identityOrgDALFactory = (db: TDbClient) => {
           db.ref("orgId").withSchema("paginatedIdentity"),
           db.ref("createdAt").withSchema("paginatedIdentity"),
           db.ref("updatedAt").withSchema("paginatedIdentity"),
-          db.ref("identityId").withSchema("paginatedIdentity"),
+          db.ref("identityId").withSchema("paginatedIdentity").as("identityNewId"),
           db.ref("identityName").withSchema("paginatedIdentity"),
-          db.ref("identityAuthMethod").withSchema("paginatedIdentity")
+
+          db.ref("id").as("uaId").withSchema(TableName.IdentityUniversalAuth),
+          db.ref("id").as("gcpId").withSchema(TableName.IdentityGcpAuth),
+          db.ref("id").as("awsId").withSchema(TableName.IdentityAwsAuth),
+          db.ref("id").as("kubernetesId").withSchema(TableName.IdentityKubernetesAuth),
+          db.ref("id").as("oidcId").withSchema(TableName.IdentityOidcAuth),
+          db.ref("id").as("azureId").withSchema(TableName.IdentityAzureAuth),
+          db.ref("id").as("tokenId").withSchema(TableName.IdentityTokenAuth)
         )
         // cr stands for custom role
         .select(db.ref("id").as("crId").withSchema(TableName.OrgRoles))
@@ -112,20 +258,27 @@ export const identityOrgDALFactory = (db: TDbClient) => {
           crSlug,
           crPermission,
           crName,
-          identityId,
+          identityNewId,
           identityName,
-          identityAuthMethod,
           role,
           roleId,
           id,
           orgId,
+          uaId,
+          awsId,
+          gcpId,
+          kubernetesId,
+          oidcId,
+          azureId,
+          tokenId,
           createdAt,
           updatedAt
         }) => ({
           role,
           roleId,
-          identityId,
+          identityId: identityNewId,
           id,
+
           orgId,
           createdAt,
           updatedAt,
@@ -139,9 +292,17 @@ export const identityOrgDALFactory = (db: TDbClient) => {
               }
             : undefined,
           identity: {
-            id: identityId,
+            id: identityNewId,
             name: identityName,
-            authMethod: identityAuthMethod as string
+            authMethods: buildAuthMethods({
+              uaId,
+              awsId,
+              gcpId,
+              kubernetesId,
+              oidcId,
+              azureId,
+              tokenId
+            })
           }
         }),
         childrenMapper: [

frontend/src/components/v2/Badge/Badge.tsx

@@ -15,7 +15,8 @@ const badgeVariants = cva(
       variant: {
         primary: "bg-yellow/20 text-yellow",
         danger: "bg-red/20 text-red",
-        success: "bg-green/20 text-green"
+        success: "bg-green/20 text-green",
+        info: "bg-blue-500/20 text-blue-500"
       }
     }
   }

frontend/src/components/v2/Select/Select.tsx

@@ -127,8 +127,7 @@ export const SelectItem = forwardRef<HTMLDivElement, SelectItemProps>(
           cursor-pointer select-none items-center overflow-hidden text-ellipsis whitespace-nowrap rounded-md py-2
           pl-10 pr-4 text-sm outline-none transition-all hover:bg-mineshaft-500 data-[highlighted]:bg-mineshaft-700/80`,
           isSelected && "bg-primary",
-          isDisabled &&
+          isDisabled && "cursor-not-allowed  text-gray-600 opacity-80 hover:!bg-transparent",
-            "cursor-not-allowed text-gray-600 hover:bg-transparent hover:text-mineshaft-600",
           className
         )}
         ref={forwardedRef}

frontend/src/hooks/api/identities/mutations.tsx

@@ -137,6 +137,7 @@ export const useUpdateIdentityUniversalAuth = () => {
   return useMutation<IdentityUniversalAuth, {}, UpdateIdentityUniversalAuthDTO>({
     mutationFn: async ({
       identityId,
+
       clientSecretTrustedIps,
       accessTokenTTL,
       accessTokenMaxTTL,

frontend/src/hooks/api/identities/types.ts

@@ -12,7 +12,7 @@ export type IdentityTrustedIp = {
 export type Identity = {
   id: string;
   name: string;
-  authMethod?: IdentityAuthMethod;
+  authMethods: IdentityAuthMethod[];
   createdAt: string;
   updatedAt: string;
 };

frontend/src/views/Org/IdentityPage/IdentityPage.tsx

@@ -1,4 +1,5 @@
 /* eslint-disable @typescript-eslint/no-unused-vars */
+import { useState } from "react";
 import { useRouter } from "next/router";
 import { faChevronLeft, faEllipsis } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
@@ -19,12 +20,15 @@ import {
 import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { withPermission } from "@app/hoc";
 import {
+  IdentityAuthMethod,
   useDeleteIdentity,
   useGetIdentityById,
   useRevokeIdentityTokenAuthToken,
-  useRevokeIdentityUniversalAuthClientSecret} from "@app/hooks/api";
+  useRevokeIdentityUniversalAuthClientSecret
+} from "@app/hooks/api";
+import { Identity } from "@app/hooks/api/identities/types";
 import { usePopUp } from "@app/hooks/usePopUp";
-import { TabSections } from"@app/views/Org/Types";
+import { TabSections } from "@app/views/Org/Types";
 
 import { IdentityAuthMethodModal } from "../MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthMethodModal";
 import { IdentityModal } from "../MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal";
@@ -49,6 +53,10 @@ export const IdentityPage = withPermission(
     const { mutateAsync: revokeToken } = useRevokeIdentityTokenAuthToken();
     const { mutateAsync: revokeClientSecret } = useRevokeIdentityUniversalAuthClientSecret();
 
+    const [selectedAuthMethod, setSelectedAuthMethod] = useState<
+      Identity["authMethods"][number] | null
+    >(null);
+
     const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
       "identity",
       "deleteIdentity",
@@ -124,7 +132,7 @@ export const IdentityPage = withPermission(
 
     const onDeleteClientSecretSubmit = async ({ clientSecretId }: { clientSecretId: string }) => {
       try {
-        if (!data?.identity.id) return;
+        if (!data?.identity.id || selectedAuthMethod !== IdentityAuthMethod.UNIVERSAL_AUTH) return;
 
         await revokeClientSecret({
           identityId: data?.identity.id,
@@ -208,12 +216,13 @@ export const IdentityPage = withPermission(
                           handlePopUpOpen("identityAuthMethod", {
                             identityId,
                             name: data.identity.name,
-                            authMethod: data.identity.authMethod
+                            authMethod: selectedAuthMethod,
+                            allAuthMethods: data.identity.authMethods
                           });
                         }}
                         disabled={!isAllowed}
                       >
-                        {`${data.identity.authMethod ? "Edit" : "Configure"} Auth Method`}
+                        {`${data.identity.authMethods?.[0] ? "Edit" : "Configure"} Auth Method`}
                       </DropdownMenuItem>
                     )}
                   </OrgPermissionCan>
@@ -247,6 +256,8 @@ export const IdentityPage = withPermission(
               <div className="mr-4 w-96">
                 <IdentityDetailsSection identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
                 <IdentityAuthenticationSection
+                  selectedAuthMethod={selectedAuthMethod}
+                  setSelectedAuthMethod={setSelectedAuthMethod}
                   identityId={identityId}
                   handlePopUpOpen={handlePopUpOpen}
                 />

frontend/src/views/Org/IdentityPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx

@@ -1,15 +1,13 @@
-import { faPencil } from "@fortawesome/free-solid-svg-icons";
+import { useEffect } from "react";
+import { faPencil, faPlus } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
 import { OrgPermissionCan } from "@app/components/permissions";
-import {
+import { IconButton, Select, SelectItem, Tooltip } from "@app/components/v2";
-  IconButton,
-  // Button,
-  Tooltip
-} from "@app/components/v2";
 import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
 import { useGetIdentityById } from "@app/hooks/api";
 import { IdentityAuthMethod, identityAuthToNameMap } from "@app/hooks/api/identities";
+import { Identity } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
 import { IdentityClientSecrets } from "./IdentityClientSecrets";
@@ -17,6 +15,8 @@ import { IdentityTokens } from "./IdentityTokens";
 
 type Props = {
   identityId: string;
+  setSelectedAuthMethod: (authMethod: Identity["authMethods"][number] | null) => void;
+  selectedAuthMethod: Identity["authMethods"][number] | null;
   handlePopUpOpen: (
     popUpName: keyof UsePopUpState<
       [
@@ -33,16 +33,34 @@ type Props = {
   ) => void;
 };
 
-export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: Props) => {
+export const IdentityAuthenticationSection = ({
+  identityId,
+  setSelectedAuthMethod,
+  selectedAuthMethod,
+  handlePopUpOpen
+}: Props) => {
   const { data } = useGetIdentityById(identityId);
+
+  useEffect(() => {
+    if (!data?.identity) return;
+
+    if (data.identity.authMethods?.length) {
+      setSelectedAuthMethod(data.identity.authMethods[0]);
+    }
+
+    // eslint-disable-next-line consistent-return
+    return () => setSelectedAuthMethod(null);
+  }, [data?.identity]);
+
   return data ? (
     <div className="mt-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
       <div className="flex items-center justify-between border-b border-mineshaft-400 pb-4">
         <h3 className="text-lg font-semibold text-mineshaft-100">Authentication</h3>
+
         <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Identity}>
           {(isAllowed) => {
             return (
-              <Tooltip content={`${data.identity.authMethod ? "Edit" : "Configure"} Auth Method`}>
+              <Tooltip content="Add new auth method">
                 <IconButton
                   isDisabled={!isAllowed}
                   ariaLabel="copy icon"
@@ -52,31 +70,68 @@ export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: P
                     handlePopUpOpen("identityAuthMethod", {
                       identityId,
                       name: data.identity.name,
-                      authMethod: data.identity.authMethod
+                      // authMethod: IdentityAuthMethod.UNIVERSAL_AUTH,
+                      allAuthMethods: data.identity.authMethods
                     })
                   }
                 >
-                  <FontAwesomeIcon icon={faPencil} />
+                  <FontAwesomeIcon icon={faPlus} />
                 </IconButton>
               </Tooltip>
             );
           }}
         </OrgPermissionCan>
       </div>
+      <div className="flex w-full items-center gap-2 pt-2">
+        {data.identity.authMethods.length > 0 && (
+          <>
+            <div className="w-full">
+              <Select
+                className="w-full"
+                value={selectedAuthMethod as string}
+                onValueChange={(value) => setSelectedAuthMethod(value as IdentityAuthMethod)}
+              >
+                {(data.identity?.authMethods || []).map((authMethod) => (
+                  <SelectItem key={authMethod || authMethod} value={authMethod}>
+                    {identityAuthToNameMap[authMethod]}
+                  </SelectItem>
+                ))}
+              </Select>
+            </div>
+            <div>
+              <Tooltip content="Edit auth method">
+                <IconButton
+                  onClick={() => {
+                    handlePopUpOpen("identityAuthMethod", {
+                      identityId,
+                      name: data.identity.name,
+                      authMethod: selectedAuthMethod,
+                      allAuthMethods: data.identity.authMethods
+                    });
+                  }}
+                  ariaLabel="copy icon"
+                  variant="plain"
+                  className="group relative"
+                >
+                  <FontAwesomeIcon icon={faPencil} />
+                </IconButton>
+              </Tooltip>{" "}
+            </div>
+          </>
+        )}
+      </div>
       <div className="py-4">
         <div className="flex justify-between">
           <p className="text-sm font-semibold text-mineshaft-300">Auth Method</p>
         </div>
         <p className="text-sm text-mineshaft-300">
-          {data.identity.authMethod
+          {selectedAuthMethod ? identityAuthToNameMap[selectedAuthMethod] : "Not configured"}
-            ? identityAuthToNameMap[data.identity.authMethod]
-            : "Not configured"}
         </p>
       </div>
-      {data.identity.authMethod === IdentityAuthMethod.UNIVERSAL_AUTH && (
+      {selectedAuthMethod === IdentityAuthMethod.UNIVERSAL_AUTH && (
         <IdentityClientSecrets identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
       )}
-      {data.identity.authMethod === IdentityAuthMethod.TOKEN_AUTH && (
+      {selectedAuthMethod === IdentityAuthMethod.TOKEN_AUTH && (
         <IdentityTokens identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
       )}
     </div>

frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx

@@ -62,6 +62,8 @@ export const IdentityClientSecretModal = ({ popUp, handlePopUpToggle }: Props) =
     identityId: string;
   };
 
+  console.log(popUpData);
+
   const onFormSubmit = async ({ description, ttl, numUsesLimit }: FormData) => {
     try {
       const { clientSecret } = await createClientSecret({

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthMethodModal.tsx

@@ -5,12 +5,14 @@ import * as yup from "yup";
 
 import { createNotification } from "@app/components/notifications";
 import {
+  Badge,
   DeleteActionModal,
   FormControl,
   Modal,
   ModalContent,
   Select,
   SelectItem,
+  Tooltip,
   UpgradePlanModal
 } from "@app/components/v2";
 import { useOrganization } from "@app/context";
@@ -43,6 +45,16 @@ type Props = {
   ) => void;
 };
 
+type TRevokeOptions = {
+  identityId: string;
+  organizationId: string;
+};
+
+type TRevokeMethods = {
+  revokeMethod: (revokeOptions: TRevokeOptions) => Promise<any>;
+  render: () => JSX.Element;
+};
+
 const identityAuthMethods = [
   { label: "Token Auth", value: IdentityAuthMethod.TOKEN_AUTH },
   { label: "Universal Auth", value: IdentityAuthMethod.UNIVERSAL_AUTH },
@@ -86,187 +98,123 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
   });
 
   useEffect(() => {
-    // reset form on open
+    if (popUp.identityAuthMethod.isOpen) {
-    if (popUp.identityAuthMethod.isOpen)
       reset({ authMethod: popUp?.identityAuthMethod?.data?.authMethod });
+    }
   }, [popUp.identityAuthMethod.isOpen]);
 
+  const watchedAuthMethod = watch("authMethod");
+
   const identityAuthMethodData = {
     identityId: popUp?.identityAuthMethod.data?.identityId,
     name: popUp?.identityAuthMethod?.data?.name,
-    authMethod: watch("authMethod")
+    authMethod: watch("authMethod"),
+    configuredAuthMethods: popUp?.identityAuthMethod?.data?.allAuthMethods
   } as {
     identityId: string;
     name: string;
     authMethod?: IdentityAuthMethod;
+    configuredAuthMethods?: IdentityAuthMethod[];
   };
 
+  const isSelectedAuthAlreadyConfigured =
+    identityAuthMethodData?.configuredAuthMethods?.includes(watchedAuthMethod);
+
   useEffect(() => {
-    if (identityAuthMethodData?.authMethod) {
+    if (popUp?.identityAuthMethod?.data?.authMethod) {
-      setValue("authMethod", identityAuthMethodData.authMethod);
+      setValue("authMethod", popUp?.identityAuthMethod?.data?.authMethod);
-      return;
+    } else {
-    }
+      const firstAuthMethodNotConfiguredAuthMethod = identityAuthMethods.find(
+        ({ value }) => !identityAuthMethodData?.configuredAuthMethods?.includes(value)
+      );
 
-    setValue("authMethod", IdentityAuthMethod.UNIVERSAL_AUTH);
+      if (firstAuthMethodNotConfiguredAuthMethod) {
-  }, [identityAuthMethodData?.authMethod]);
+        setValue("authMethod", firstAuthMethodNotConfiguredAuthMethod.value);
-
-  const onRevokeAuthMethodSubmit = async (authMethod: IdentityAuthMethod) => {
-    if (!orgId || !authMethod) return;
-    try {
-      switch (authMethod) {
-        case IdentityAuthMethod.UNIVERSAL_AUTH: {
-          await revokeUniversalAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.TOKEN_AUTH: {
-          await revokeTokenAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.KUBERNETES_AUTH: {
-          await revokeKubernetesAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.GCP_AUTH: {
-          await revokeGcpAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.AWS_AUTH: {
-          await revokeAwsAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.AZURE_AUTH: {
-          await revokeAzureAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        case IdentityAuthMethod.OIDC_AUTH: {
-          await revokeOidcAuth({
-            identityId: identityAuthMethodData.identityId,
-            organizationId: orgId
-          });
-          break;
-        }
-        default:
-          break;
       }
+    }
+  }, [popUp.identityAuthMethod.isOpen]);
 
-      createNotification({
+  const methodMap: Record<IdentityAuthMethod, TRevokeMethods | undefined> = {
-        text: `Successfully removed ${identityAuthToNameMap[authMethod]} on ${identityAuthMethodData.name}`,
+    [IdentityAuthMethod.UNIVERSAL_AUTH]: {
-        type: "success"
+      revokeMethod: revokeUniversalAuth,
-      });
+      render: () => (
+        <IdentityUniversalAuthForm
+          identityAuthMethodData={identityAuthMethodData}
+          handlePopUpOpen={handlePopUpOpen}
+          handlePopUpToggle={handlePopUpToggle}
+        />
+      )
+    },
 
-      handlePopUpToggle("revokeAuthMethod", false);
+    [IdentityAuthMethod.OIDC_AUTH]: {
-      handlePopUpToggle("identityAuthMethod", false);
+      revokeMethod: revokeOidcAuth,
-    } catch (err) {
+      render: () => (
-      console.error(err);
+        <IdentityOidcAuthForm
-      createNotification({
+          identityAuthMethodData={identityAuthMethodData}
-        text: `Failed to remove ${identityAuthToNameMap[authMethod]} on ${identityAuthMethodData.name}`,
+          handlePopUpOpen={handlePopUpOpen}
-        type: "error"
+          handlePopUpToggle={handlePopUpToggle}
-      });
+        />
-    }
+      )
-  };
+    },
-  const renderIdentityAuthForm = () => {
+
-    switch (identityAuthMethodData.authMethod) {
+    [IdentityAuthMethod.TOKEN_AUTH]: {
-      case IdentityAuthMethod.AWS_AUTH: {
+      revokeMethod: revokeTokenAuth,
-        return (
+      render: () => (
-          <IdentityAwsAuthForm
+        <IdentityTokenAuthForm
-            handlePopUpOpen={handlePopUpOpen}
+          identityAuthMethodData={identityAuthMethodData}
-            handlePopUpToggle={handlePopUpToggle}
+          handlePopUpOpen={handlePopUpOpen}
-            identityAuthMethodData={identityAuthMethodData}
+          handlePopUpToggle={handlePopUpToggle}
-            initialAuthMethod={initialAuthMethod!}
+        />
-            revokeAuth={onRevokeAuthMethodSubmit}
+      )
-          />
+    },
-        );
+
-      }
+    [IdentityAuthMethod.AZURE_AUTH]: {
-      case IdentityAuthMethod.KUBERNETES_AUTH: {
+      revokeMethod: revokeAzureAuth,
-        return (
+      render: () => (
-          <IdentityKubernetesAuthForm
+        <IdentityAzureAuthForm
-            handlePopUpOpen={handlePopUpOpen}
+          identityAuthMethodData={identityAuthMethodData}
-            handlePopUpToggle={handlePopUpToggle}
+          handlePopUpOpen={handlePopUpOpen}
-            identityAuthMethodData={identityAuthMethodData}
+          handlePopUpToggle={handlePopUpToggle}
-            initialAuthMethod={initialAuthMethod!}
+        />
-            revokeAuth={onRevokeAuthMethodSubmit}
+      )
-          />
+    },
-        );
+
-      }
+    [IdentityAuthMethod.GCP_AUTH]: {
-      case IdentityAuthMethod.GCP_AUTH: {
+      revokeMethod: revokeGcpAuth,
-        return (
+      render: () => (
-          <IdentityGcpAuthForm
+        <IdentityGcpAuthForm
-            handlePopUpOpen={handlePopUpOpen}
+          identityAuthMethodData={identityAuthMethodData}
-            handlePopUpToggle={handlePopUpToggle}
+          handlePopUpOpen={handlePopUpOpen}
-            identityAuthMethodData={identityAuthMethodData}
+          handlePopUpToggle={handlePopUpToggle}
-            initialAuthMethod={initialAuthMethod!}
+        />
-            revokeAuth={onRevokeAuthMethodSubmit}
+      )
-          />
+    },
-        );
+
-      }
+    [IdentityAuthMethod.KUBERNETES_AUTH]: {
-      case IdentityAuthMethod.AZURE_AUTH: {
+      revokeMethod: revokeKubernetesAuth,
-        return (
+      render: () => (
-          <IdentityAzureAuthForm
+        <IdentityKubernetesAuthForm
-            handlePopUpOpen={handlePopUpOpen}
+          identityAuthMethodData={identityAuthMethodData}
-            handlePopUpToggle={handlePopUpToggle}
+          handlePopUpOpen={handlePopUpOpen}
-            identityAuthMethodData={identityAuthMethodData}
+          handlePopUpToggle={handlePopUpToggle}
-            initialAuthMethod={initialAuthMethod!}
+        />
-            revokeAuth={onRevokeAuthMethodSubmit}
+      )
-          />
+    },
-        );
+
-      }
+    [IdentityAuthMethod.AWS_AUTH]: {
-      case IdentityAuthMethod.UNIVERSAL_AUTH: {
+      revokeMethod: revokeAwsAuth,
-        return (
+      render: () => (
-          <IdentityUniversalAuthForm
+        <IdentityAwsAuthForm
-            handlePopUpOpen={handlePopUpOpen}
+          identityAuthMethodData={identityAuthMethodData}
-            handlePopUpToggle={handlePopUpToggle}
+          handlePopUpOpen={handlePopUpOpen}
-            identityAuthMethodData={identityAuthMethodData}
+          handlePopUpToggle={handlePopUpToggle}
-            initialAuthMethod={initialAuthMethod!}
+        />
-            revokeAuth={onRevokeAuthMethodSubmit}
+      )
-          />
-        );
-      }
-      case IdentityAuthMethod.OIDC_AUTH: {
-        return (
-          <IdentityOidcAuthForm
-            handlePopUpOpen={handlePopUpOpen}
-            handlePopUpToggle={handlePopUpToggle}
-            identityAuthMethodData={identityAuthMethodData}
-            initialAuthMethod={initialAuthMethod!}
-            revokeAuth={onRevokeAuthMethodSubmit}
-          />
-        );
-      }
-      case IdentityAuthMethod.TOKEN_AUTH: {
-        return (
-          <IdentityTokenAuthForm
-            handlePopUpOpen={handlePopUpOpen}
-            handlePopUpToggle={handlePopUpToggle}
-            identityAuthMethodData={identityAuthMethodData}
-            initialAuthMethod={initialAuthMethod!}
-            revokeAuth={onRevokeAuthMethodSubmit}
-          />
-        );
-      }
-      default: {
-        return <div />;
-      }
     }
   };
 
+  const selectedMethodItem = methodMap[identityAuthMethodData.authMethod!];
+
   return (
     <Modal
       isOpen={popUp?.identityAuthMethod?.isOpen}
@@ -275,11 +223,11 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
       }}
     >
       <ModalContent
-        title={`${
+        title={
-          identityAuthMethodData.authMethod === initialAuthMethod ? "Update" : "Configure"
+          isSelectedAuthAlreadyConfigured
-        } Identity Auth Method for ${
+            ? `Edit ${identityAuthToNameMap[identityAuthMethodData.authMethod!] ?? ""}`
-          identityAuthToNameMap[identityAuthMethodData.authMethod!] ?? ""
+            : `Create new ${identityAuthToNameMap[identityAuthMethodData.authMethod!] ?? ""}`
-        }`}
+        }
       >
         <Controller
           control={control}
@@ -288,23 +236,46 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
           render={({ field: { onChange, ...field }, fieldState: { error } }) => (
             <FormControl label="Auth Method" errorText={error?.message} isError={Boolean(error)}>
               <Select
+                isDisabled={isSelectedAuthAlreadyConfigured}
                 defaultValue={field.value}
                 {...field}
                 onValueChange={(e) => {
-                  onChange(e);
+                  const alreadyConfigured =
+                    popUp?.identityAuthMethod?.data?.allAuthMethods?.includes(e);
+
+                  if (!alreadyConfigured) {
+                    onChange(e);
+                  }
                 }}
                 className="w-full"
               >
-                {identityAuthMethods.map(({ label, value }) => (
+                {identityAuthMethods.map(({ label, value }) => {
-                  <SelectItem value={String(value || "")} key={label}>
+                  const alreadyConfigured =
-                    {label}
+                    popUp?.identityAuthMethod?.data?.allAuthMethods?.includes(value);
-                  </SelectItem>
+                  return (
-                ))}
+                    <Tooltip
+                      key={`auth-method-${value}`}
+                      content="Authentication method already configured"
+                      isDisabled={!alreadyConfigured}
+                    >
+                      <SelectItem
+                        isDisabled={alreadyConfigured}
+                        value={String(value || "")}
+                        key={label}
+                      >
+                        {label}{" "}
+                        {alreadyConfigured && !isSelectedAuthAlreadyConfigured && (
+                          <Badge variant="info">Configured</Badge>
+                        )}
+                      </SelectItem>
+                    </Tooltip>
+                  );
+                })}
               </Select>
             </FormControl>
           )}
         />
-        {renderIdentityAuthForm()}
+        {selectedMethodItem?.render ? selectedMethodItem.render() : <div />}
         <UpgradePlanModal
           isOpen={popUp?.upgradePlan?.isOpen}
           onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
@@ -320,7 +291,37 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
           onChange={(isOpen) => handlePopUpToggle("revokeAuthMethod", isOpen)}
           deleteKey="confirm"
           buttonText="Remove"
-          onDeleteApproved={() => onRevokeAuthMethodSubmit(identityAuthMethodData.authMethod!)}
+          onDeleteApproved={async () => {
+            if (!identityAuthMethodData.authMethod || !orgId) {
+              return;
+            }
+
+            const selectedRevoke = methodMap[identityAuthMethodData.authMethod];
+
+            if (!selectedRevoke) {
+              return;
+            }
+
+            try {
+              await selectedRevoke.revokeMethod({
+                identityId: identityAuthMethodData.identityId,
+                organizationId: orgId
+              });
+
+              createNotification({
+                text: "Successfully removed auth method",
+                type: "success"
+              });
+
+              handlePopUpToggle("revokeAuthMethod", false);
+              handlePopUpToggle("identityAuthMethod", false);
+            } catch (err) {
+              createNotification({
+                text: "Failed to remove auth method",
+                type: "error"
+              });
+            }
+          }}
         />
       </ModalContent>
     </Modal>

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx

@@ -6,7 +6,7 @@ import { yupResolver } from "@hookform/resolvers/yup";
 import * as yup from "yup";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal, FormControl, IconButton, Input } from "@app/components/v2";
+import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityAwsAuth,
@@ -15,7 +15,7 @@ import {
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = yup
   .object({
@@ -62,18 +62,15 @@ type Props = {
   identityAuthMethodData: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityAwsAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -82,13 +79,13 @@ export const IdentityAwsAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityAwsAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityAwsAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
   const { data } = useGetIdentityAwsAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
 
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
-
   const {
     control,
     handleSubmit,
@@ -184,230 +181,204 @@ export const IdentityAwsAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="allowedPrincipalArns"
-          name="allowedPrincipalArns"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Allowed Principal ARNs"
-              label="Allowed Principal ARNs"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input
-              <Input
+              {...field}
-                {...field}
+              placeholder="arn:aws:iam::123456789012:role/MyRoleName, arn:aws:iam::123456789012:user/MyUserName..."
-                placeholder="arn:aws:iam::123456789012:role/MyRoleName, arn:aws:iam::123456789012:user/MyUserName..."
+              type="text"
-                type="text"
-              />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          name="allowedAccountIds"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Allowed Account IDs"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="123456789012, ..." />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="https://sts.amazonaws.com/"
-          name="stsEndpoint"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl label="STS Endpoint" isError={Boolean(error)} errorText={error?.message}>
-              <Input {...field} placeholder="https://sts.amazonaws.com/" type="text" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenMaxTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="0"
-          name="accessTokenNumUsesLimit"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max Number of Uses"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
-            </FormControl>
-          )}
-        />
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
-              defaultValue="0.0.0.0/0"
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => {
-                        if (subscription?.ipAllowlisting) {
-                          field.onChange(e);
-                          return;
-                        }
-
-                        handlePopUpOpen("upgradePlan");
-                      }}
-                      placeholder="123.456.789.0"
-                    />
-                  </FormControl>
-                );
-              }}
             />
-            <IconButton
+          </FormControl>
-              onClick={() => {
+        )}
-                if (subscription?.ipAllowlisting) {
+      />
-                  removeAccessTokenTrustedIp(index);
+      <Controller
-                  return;
+        control={control}
-                }
+        name="allowedAccountIds"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Allowed Account IDs"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="123456789012, ..." />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="https://sts.amazonaws.com/"
+        name="stsEndpoint"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl label="STS Endpoint" isError={Boolean(error)} errorText={error?.message}>
+            <Input {...field} placeholder="https://sts.amazonaws.com/" type="text" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="0"
+        name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
+        )}
+      />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
 
-                handlePopUpOpen("upgradePlan");
+                      handlePopUpOpen("upgradePlan");
-              }}
+                    }}
-              size="lg"
+                    placeholder="123.456.789.0"
-              colorSchema="danger"
+                  />
-              variant="plain"
+                </FormControl>
-              ariaLabel="update"
+              );
-              className="p-3"
+            }}
-            >
+          />
-              <FontAwesomeIcon icon={faXmark} />
+          <IconButton
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {!isUpdate ? "Create" : "Edit"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          await revokeAuth(initialAuthMethod);
-          handleSubmit(onFormSubmit)();
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx

@@ -6,7 +6,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal, FormControl, IconButton, Input } from "@app/components/v2";
+import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityAzureAuth,
@@ -15,7 +15,7 @@ import {
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = z
   .object({
@@ -50,18 +50,15 @@ type Props = {
   identityAuthMethodData: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityAzureAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -70,18 +67,18 @@ export const IdentityAzureAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityAzureAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityAzureAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
   const { data } = useGetIdentityAzureAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
 
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
-
   const {
     control,
     handleSubmit,
     reset,
-    trigger,
+
     formState: { isSubmitting }
   } = useForm<FormData>({
     resolver: zodResolver(schema),
@@ -173,239 +170,204 @@ export const IdentityAzureAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="tenantId"
-          name="tenantId"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Tenant ID"
-              label="Tenant ID"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            isRequired
-              isRequired
+          >
-            >
+            <Input {...field} placeholder="00000000-0000-0000-0000-000000000000" type="text" />
-              <Input {...field} placeholder="00000000-0000-0000-0000-000000000000" type="text" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="resource"
-          name="resource"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Resource / Audience"
-              label="Resource / Audience"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="https://management.azure.com/" />
-              <Input {...field} placeholder="https://management.azure.com/" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="allowedServicePrincipalIds"
-          name="allowedServicePrincipalIds"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Allowed Service Principal IDs"
-              label="Allowed Service Principal IDs"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="00000000-0000-0000-0000-000000000000, ..." />
-              <Input {...field} placeholder="00000000-0000-0000-0000-000000000000, ..." />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenTTL"
-          name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token TTL (seconds)"
-              label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenMaxTTL"
-          name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max TTL (seconds)"
-              label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="0"
-          defaultValue="0"
+        name="accessTokenNumUsesLimit"
-          name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max Number of Uses"
-              label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
-          <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
-            <Controller
+            control={control}
-              control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
-              defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
-              render={({ field, fieldState: { error } }) => {
+              return (
-                return (
+                <FormControl
-                  <FormControl
+                  className="mb-0 flex-grow"
-                    className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
-                    isError={Boolean(error)}
+                  errorText={error?.message}
-                    errorText={error?.message}
+                >
-                  >
+                  <Input
-                    <Input
+                    value={field.value}
-                      value={field.value}
+                    onChange={(e) => {
-                      onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
-                        if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
-                          field.onChange(e);
+                        return;
-                          return;
+                      }
-                        }
 
-                        handlePopUpOpen("upgradePlan");
+                      handlePopUpOpen("upgradePlan");
-                      }}
+                    }}
-                      placeholder="123.456.789.0"
+                    placeholder="123.456.789.0"
-                    />
+                  />
-                  </FormControl>
+                </FormControl>
-                );
+              );
-              }}
+            }}
-            />
+          />
-            <IconButton
+          <IconButton
-              onClick={() => {
-                if (subscription?.ipAllowlisting) {
-                  removeAccessTokenTrustedIp(index);
-                  return;
-                }
-
-                handlePopUpOpen("upgradePlan");
-              }}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {!isUpdate ? "Create" : "Edit"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          const result = await trigger();
-          if (result) {
-            await revokeAuth(initialAuthMethod);
-            handleSubmit(onFormSubmit)();
-          } else {
-            createNotification({
-              text: "Please fill in all required fields",
-              type: "error"
-            });
-            internalPopUpState.handlePopUpToggle("overwriteAuthMethod", false);
-          }
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx

@@ -6,15 +6,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import {
+import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app/components/v2";
-  Button,
-  DeleteActionModal,
-  FormControl,
-  IconButton,
-  Input,
-  Select,
-  SelectItem
-} from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityGcpAuth,
@@ -23,7 +15,7 @@ import {
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = z
   .object({
@@ -59,18 +51,15 @@ type Props = {
   identityAuthMethodData: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityGcpAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  revokeAuth,
-  initialAuthMethod
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -79,11 +68,12 @@ export const IdentityGcpAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityGcpAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityGcpAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
   const { data } = useGetIdentityGcpAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
 
   const {
     control,
@@ -189,258 +179,228 @@ export const IdentityGcpAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="type"
-          name="type"
+        render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-          render={({ field: { onChange, ...field }, fieldState: { error } }) => (
+          <FormControl label="Type" isError={Boolean(error)} errorText={error?.message}>
-            <FormControl label="Type" isError={Boolean(error)} errorText={error?.message}>
+            <Select
-              <Select
+              defaultValue={field.value}
-                defaultValue={field.value}
+              {...field}
-                {...field}
+              onValueChange={(e) => onChange(e)}
-                onValueChange={(e) => onChange(e)}
+              className="w-full"
-                className="w-full"
-              >
-                <SelectItem value="gce" key="gce">
-                  GCP ID Token Auth (Recommended)
-                </SelectItem>
-                <SelectItem value="iam" key="iam">
-                  GCP IAM Auth
-                </SelectItem>
-              </Select>
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="allowedServiceAccounts"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Allowed Service Account Emails"
-              isError={Boolean(error)}
-              errorText={error?.message}
             >
-              <Input
+              <SelectItem value="gce" key="gce">
-                {...field}
+                GCP ID Token Auth (Recommended)
-                placeholder="[email protected], [email protected]"
+              </SelectItem>
-                type="text"
+              <SelectItem value="iam" key="iam">
-              />
+                GCP IAM Auth
-            </FormControl>
+              </SelectItem>
-          )}
+            </Select>
-        />
+          </FormControl>
-        {watchedType === "gce" && (
-          <Controller
-            control={control}
-            name="allowedProjects"
-            render={({ field, fieldState: { error } }) => (
-              <FormControl
-                label="Allowed Projects"
-                isError={Boolean(error)}
-                errorText={error?.message}
-              >
-                <Input {...field} placeholder="my-gcp-project, ..." />
-              </FormControl>
-            )}
-          />
         )}
-        {watchedType === "gce" && (
+      />
-          <Controller
+      <Controller
-            control={control}
+        control={control}
-            name="allowedZones"
+        defaultValue="2592000"
-            render={({ field, fieldState: { error } }) => (
+        name="allowedServiceAccounts"
-              <FormControl
+        render={({ field, fieldState: { error } }) => (
-                label="Allowed Zones"
+          <FormControl
-                isError={Boolean(error)}
+            label="Allowed Service Account Emails"
-                errorText={error?.message}
+            isError={Boolean(error)}
-              >
+            errorText={error?.message}
-                <Input {...field} placeholder="us-west2-a, us-central1-a, ..." />
+          >
-              </FormControl>
+            <Input
-            )}
+              {...field}
-          />
+              placeholder="[email protected], [email protected]"
-        )}
+              type="text"
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenMaxTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="0"
-          name="accessTokenNumUsesLimit"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max Number of Uses"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
-            </FormControl>
-          )}
-        />
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
-              defaultValue="0.0.0.0/0"
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => {
-                        if (subscription?.ipAllowlisting) {
-                          field.onChange(e);
-                          return;
-                        }
-
-                        handlePopUpOpen("upgradePlan");
-                      }}
-                      placeholder="123.456.789.0"
-                    />
-                  </FormControl>
-                );
-              }}
             />
-            <IconButton
+          </FormControl>
-              onClick={() => {
+        )}
-                if (subscription?.ipAllowlisting) {
+      />
-                  removeAccessTokenTrustedIp(index);
+      {watchedType === "gce" && (
-                  return;
+        <Controller
-                }
+          control={control}
-
+          name="allowedProjects"
-                handlePopUpOpen("upgradePlan");
+          render={({ field, fieldState: { error } }) => (
-              }}
+            <FormControl
-              size="lg"
+              label="Allowed Projects"
-              colorSchema="danger"
+              isError={Boolean(error)}
-              variant="plain"
+              errorText={error?.message}
-              ariaLabel="update"
-              className="p-3"
             >
-              <FontAwesomeIcon icon={faXmark} />
+              <Input {...field} placeholder="my-gcp-project, ..." />
-            </IconButton>
+            </FormControl>
-          </div>
+          )}
-        ))}
+        />
-        <div className="my-4 ml-1">
+      )}
-          <Button
+      {watchedType === "gce" && (
-            variant="outline_bg"
+        <Controller
+          control={control}
+          name="allowedZones"
+          render={({ field, fieldState: { error } }) => (
+            <FormControl label="Allowed Zones" isError={Boolean(error)} errorText={error?.message}>
+              <Input {...field} placeholder="us-west2-a, us-central1-a, ..." />
+            </FormControl>
+          )}
+        />
+      )}
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="0"
+        name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
+        )}
+      />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
+
+                      handlePopUpOpen("upgradePlan");
+                    }}
+                    placeholder="123.456.789.0"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <IconButton
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {!isUpdate ? "Create" : "Edit"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        buttonText="Overwrite"
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        onDeleteApproved={async () => {
-          await revokeAuth(initialAuthMethod);
-          handleSubmit(onFormSubmit)();
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx

@@ -6,14 +6,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import {
+import { Button, FormControl, IconButton, Input, TextArea } from "@app/components/v2";
-  Button,
-  DeleteActionModal,
-  FormControl,
-  IconButton,
-  Input,
-  TextArea
-} from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityKubernetesAuth,
@@ -22,7 +15,7 @@ import {
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = z
   .object({
@@ -60,18 +53,15 @@ type Props = {
   identityAuthMethodData: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityKubernetesAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -80,17 +70,18 @@ export const IdentityKubernetesAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityKubernetesAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityKubernetesAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
   const { data } = useGetIdentityKubernetesAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
 
   const {
     control,
     handleSubmit,
     reset,
-    trigger,
+
     formState: { isSubmitting }
   } = useForm<FormData>({
     resolver: zodResolver(schema),
@@ -200,291 +191,256 @@ export const IdentityKubernetesAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="kubernetesHost"
-          name="kubernetesHost"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Kubernetes Host / Base Kubernetes API URL "
-              label="Kubernetes Host / Base Kubernetes API URL "
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="The host string, host:port pair, or URL to the base of the Kubernetes API server. This can usually be obtained by running 'kubectl cluster-info'"
-              tooltipText="The host string, host:port pair, or URL to the base of the Kubernetes API server. This can usually be obtained by running 'kubectl cluster-info'"
+            isRequired
-              isRequired
+          >
-            >
+            <Input {...field} placeholder="https://my-example-k8s-api-host.com" type="text" />
-              <Input {...field} placeholder="https://my-example-k8s-api-host.com" type="text" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="tokenReviewerJwt"
-          name="tokenReviewerJwt"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Token Reviewer JWT"
-              label="Token Reviewer JWT"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="A long-lived service account JWT token for Infisical to access the TokenReview API to validate other service account JWT tokens submitted by applications/pods."
-              tooltipText="A long-lived service account JWT token for Infisical to access the TokenReview API to validate other service account JWT tokens submitted by applications/pods."
+            isRequired
-              isRequired
+          >
-            >
+            <Input {...field} placeholder="" type="password" />
-              <Input {...field} placeholder="" type="password" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="allowedNames"
-          name="allowedNames"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Allowed Service Account Names"
-              label="Allowed Service Account Names"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            tooltipText="An optional comma-separated list of trusted service account names that are allowed to authenticate with Infisical. Leave empty to allow any service account."
-              tooltipText="An optional comma-separated list of trusted service account names that are allowed to authenticate with Infisical. Leave empty to allow any service account."
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="service-account-1-name, service-account-1-name" />
-              <Input {...field} placeholder="service-account-1-name, service-account-1-name" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue=""
-          defaultValue=""
+        name="allowedNamespaces"
-          name="allowedNamespaces"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Allowed Namespaces"
-              label="Allowed Namespaces"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="A comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical."
-              tooltipText="A comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical."
+          >
-            >
+            <Input {...field} placeholder="namespaceA, namespaceB" type="text" />
-              <Input {...field} placeholder="namespaceA, namespaceB" type="text" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue=""
-          defaultValue=""
+        name="allowedAudience"
-          name="allowedAudience"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Allowed Audience"
-              label="Allowed Audience"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="An optional audience claim that the service account JWT token must have to authenticate with Infisical. Leave empty to allow any audience claim."
-              tooltipText="An optional audience claim that the service account JWT token must have to authenticate with Infisical. Leave empty to allow any audience claim."
+          >
-            >
+            <Input {...field} placeholder="" type="text" />
-              <Input {...field} placeholder="" type="text" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="caCert"
-          name="caCert"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="CA Certificate"
-              label="CA Certificate"
+            errorText={error?.message}
-              errorText={error?.message}
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            tooltipText="An optional PEM-encoded CA cert for the Kubernetes API server. This is used by the TLS client for secure communication with the Kubernetes API server."
-              tooltipText="An optional PEM-encoded CA cert for the Kubernetes API server. This is used by the TLS client for secure communication with the Kubernetes API server."
+          >
-            >
+            <TextArea {...field} placeholder="-----BEGIN CERTIFICATE----- ..." />
-              <TextArea {...field} placeholder="-----BEGIN CERTIFICATE----- ..." />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenTTL"
-          name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token TTL (seconds)"
-              label="Access Token TTL (seconds)"
+            tooltipText="The lifetime for an acccess token in seconds. This value will be referenced at renewal time."
-              tooltipText="The lifetime for an acccess token in seconds. This value will be referenced at renewal time."
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenMaxTTL"
-          name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max TTL (seconds)"
-              label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="The maximum lifetime for an access token in seconds. This value will be referenced at renewal time."
-              tooltipText="The maximum lifetime for an access token in seconds. This value will be referenced at renewal time."
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="0"
-          defaultValue="0"
+        name="accessTokenNumUsesLimit"
-          name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max Number of Uses"
-              label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+            tooltipText="The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses."
-              tooltipText="The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses."
+          >
-            >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
-          <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
-            <Controller
+            control={control}
-              control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
-              defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
-              render={({ field, fieldState: { error } }) => {
+              return (
-                return (
+                <FormControl
-                  <FormControl
+                  className="mb-0 flex-grow"
-                    className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
-                    isError={Boolean(error)}
+                  errorText={error?.message}
-                    errorText={error?.message}
+                  tooltipText="The IPs or CIDR ranges that access tokens can be used from. By default, each token is given the 0.0.0.0/0, allowing usage from any network address."
-                    tooltipText="The IPs or CIDR ranges that access tokens can be used from. By default, each token is given the 0.0.0.0/0, allowing usage from any network address."
+                >
-                  >
+                  <Input
-                    <Input
+                    value={field.value}
-                      value={field.value}
+                    onChange={(e) => {
-                      onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
-                        if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
-                          field.onChange(e);
+                        return;
-                          return;
+                      }
-                        }
 
-                        handlePopUpOpen("upgradePlan");
+                      handlePopUpOpen("upgradePlan");
-                      }}
+                    }}
-                      placeholder="123.456.789.0"
+                    placeholder="123.456.789.0"
-                    />
+                  />
-                  </FormControl>
+                </FormControl>
-                );
+              );
-              }}
+            }}
-            />
+          />
-            <IconButton
+          <IconButton
-              onClick={() => {
-                if (subscription?.ipAllowlisting) {
-                  removeAccessTokenTrustedIp(index);
-                  return;
-                }
-
-                handlePopUpOpen("upgradePlan");
-              }}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {isUpdate ? "Update" : "Create"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          const result = await trigger();
-          if (result) {
-            await revokeAuth(initialAuthMethod);
-            handleSubmit(onFormSubmit)();
-          } else {
-            createNotification({
-              text: "Please fill in all required fields",
-              type: "error"
-            });
-            internalPopUpState.handlePopUpToggle("overwriteAuthMethod", false);
-          }
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal.tsx

@@ -154,12 +154,6 @@ export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
 
         handlePopUpToggle("identity", false);
         router.push(`/org/${orgId}/identities/${createdId}`);
-
-        // handlePopUpOpen("identityAuthMethod", {
-        //   identityId: createdId,
-        //   name: createdName,
-        //   authMethod
-        // });
       }
 
       createNotification({

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityOidcAuthForm.tsx

@@ -7,21 +7,13 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import {
+import { Button, FormControl, IconButton, Input, TextArea, Tooltip } from "@app/components/v2";
-  Button,
-  DeleteActionModal,
-  FormControl,
-  IconButton,
-  Input,
-  TextArea,
-  Tooltip
-} from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import { useAddIdentityOidcAuth, useUpdateIdentityOidcAuth } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { useGetIdentityOidcAuth } from "@app/hooks/api/identities/queries";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = z.object({
   accessTokenTrustedIps: z
@@ -62,18 +54,15 @@ type Props = {
   identityAuthMethodData: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityOidcAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -82,17 +71,17 @@ export const IdentityOidcAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityOidcAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityOidcAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
   const { data } = useGetIdentityOidcAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
 
   const {
     control,
     handleSubmit,
     reset,
-    trigger,
     formState: { isSubmitting }
   } = useForm<FormData>({
     resolver: zodResolver(schema),
@@ -210,364 +199,329 @@ export const IdentityOidcAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        name="oidcDiscoveryUrl"
-          name="oidcDiscoveryUrl"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            isRequired
-              isRequired
+            label="OIDC Discovery URL"
-              label="OIDC Discovery URL"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
-            >
-              <Input
-                {...field}
-                placeholder="https://token.actions.githubusercontent.com"
-                type="text"
-              />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          name="boundIssuer"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              isRequired
-              label="Issuer"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input
-                {...field}
-                type="text"
-                placeholder="https://token.actions.githubusercontent.com"
-              />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          name="caCert"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl label="CA Certificate" errorText={error?.message} isError={Boolean(error)}>
-              <TextArea {...field} placeholder="-----BEGIN CERTIFICATE----- ..." />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          name="boundSubject"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Subject"
-              isError={Boolean(error)}
-              errorText={error?.message}
-              icon={
-                <Tooltip
-                  className="text-center"
-                  content={<span>This field supports glob patterns</span>}
-                >
-                  <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
-                </Tooltip>
-              }
-            >
-              <Input {...field} type="text" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          name="boundAudiences"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Audiences"
-              isError={Boolean(error)}
-              errorText={error?.message}
-              icon={
-                <Tooltip
-                  className="text-center"
-                  content={<span>This field supports glob patterns</span>}
-                >
-                  <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
-                </Tooltip>
-              }
-            >
-              <Input {...field} type="text" placeholder="service1, service2" />
-            </FormControl>
-          )}
-        />
-        {boundClaimsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`boundClaims.${index}.key`}
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Claims" : undefined}
-                    icon={
-                      index === 0 ? (
-                        <Tooltip
-                          className="text-center"
-                          content={<span>This field supports glob patterns</span>}
-                        >
-                          <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
-                        </Tooltip>
-                      ) : undefined
-                    }
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => field.onChange(e)}
-                      placeholder="property"
-                    />
-                  </FormControl>
-                );
-              }}
-            />
-            <Controller
-              control={control}
-              name={`boundClaims.${index}.value`}
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => field.onChange(e)}
-                      placeholder="value1, value2"
-                    />
-                  </FormControl>
-                );
-              }}
-            />
-
-            <IconButton
-              onClick={() => removeBoundClaimField(index)}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
-            onClick={() =>
-              appendBoundClaimField({
-                key: "",
-                value: ""
-              })
-            }
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
-            size="xs"
           >
-            Add Claims
+            <Input
-          </Button>
+              {...field}
-        </div>
+              placeholder="https://token.actions.githubusercontent.com"
-        <Controller
+              type="text"
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenMaxTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="0"
-          name="accessTokenNumUsesLimit"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max Number of Uses"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
-            </FormControl>
-          )}
-        />
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
-              defaultValue="0.0.0.0/0"
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => {
-                        if (subscription?.ipAllowlisting) {
-                          field.onChange(e);
-                          return;
-                        }
-
-                        handlePopUpOpen("upgradePlan");
-                      }}
-                      placeholder="123.456.789.0"
-                    />
-                  </FormControl>
-                );
-              }}
             />
-            <IconButton
+          </FormControl>
-              onClick={() => {
+        )}
-                if (subscription?.ipAllowlisting) {
+      />
-                  removeAccessTokenTrustedIp(index);
+      <Controller
-                  return;
+        control={control}
-                }
+        name="boundIssuer"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            isRequired
+            label="Issuer"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input
+              {...field}
+              type="text"
+              placeholder="https://token.actions.githubusercontent.com"
+            />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        name="caCert"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl label="CA Certificate" errorText={error?.message} isError={Boolean(error)}>
+            <TextArea {...field} placeholder="-----BEGIN CERTIFICATE----- ..." />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        name="boundSubject"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Subject"
+            isError={Boolean(error)}
+            errorText={error?.message}
+            icon={
+              <Tooltip
+                className="text-center"
+                content={<span>This field supports glob patterns</span>}
+              >
+                <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
+              </Tooltip>
+            }
+          >
+            <Input {...field} type="text" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        name="boundAudiences"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Audiences"
+            isError={Boolean(error)}
+            errorText={error?.message}
+            icon={
+              <Tooltip
+                className="text-center"
+                content={<span>This field supports glob patterns</span>}
+              >
+                <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
+              </Tooltip>
+            }
+          >
+            <Input {...field} type="text" placeholder="service1, service2" />
+          </FormControl>
+        )}
+      />
+      {boundClaimsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`boundClaims.${index}.key`}
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Claims" : undefined}
+                  icon={
+                    index === 0 ? (
+                      <Tooltip
+                        className="text-center"
+                        content={<span>This field supports glob patterns</span>}
+                      >
+                        <FontAwesomeIcon icon={faQuestionCircle} size="sm" />
+                      </Tooltip>
+                    ) : undefined
+                  }
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => field.onChange(e)}
+                    placeholder="property"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <Controller
+            control={control}
+            name={`boundClaims.${index}.value`}
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => field.onChange(e)}
+                    placeholder="value1, value2"
+                  />
+                </FormControl>
+              );
+            }}
+          />
 
-                handlePopUpOpen("upgradePlan");
+          <IconButton
-              }}
+            onClick={() => removeBoundClaimField(index)}
-              size="lg"
+            size="lg"
-              colorSchema="danger"
+            colorSchema="danger"
-              variant="plain"
+            variant="plain"
-              ariaLabel="update"
+            ariaLabel="update"
-              className="p-3"
+            className="p-3"
-            >
+          >
-              <FontAwesomeIcon icon={faXmark} />
+            <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
+          </IconButton>
-          </div>
+        </div>
-        ))}
+      ))}
-        <div className="my-4 ml-1">
+      <div className="my-4 ml-1">
-          <Button
+        <Button
-            variant="outline_bg"
+          variant="outline_bg"
+          onClick={() =>
+            appendBoundClaimField({
+              key: "",
+              value: ""
+            })
+          }
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add Claims
+        </Button>
+      </div>
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="0"
+        name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
+        )}
+      />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
+
+                      handlePopUpOpen("upgradePlan");
+                    }}
+                    placeholder="123.456.789.0"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <IconButton
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {isUpdate ? "Update" : "Create"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          const result = await trigger();
-          if (result) {
-            await revokeAuth(initialAuthMethod);
-            handleSubmit(onFormSubmit)();
-          } else {
-            createNotification({
-              text: "Please fill in all required fields",
-              type: "error"
-            });
-            internalPopUpState.handlePopUpToggle("overwriteAuthMethod", false);
-          }
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx

@@ -5,7 +5,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal, FormControl, IconButton, Input } from "@app/components/v2";
+import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityTokenAuth,
@@ -13,7 +13,7 @@ import {
   useUpdateIdentityTokenAuth
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = z
   .object({
@@ -42,21 +42,18 @@ type Props = {
     popUpName: keyof UsePopUpState<["identityAuthMethod", "revokeAuthMethod"]>,
     state?: boolean
   ) => void;
-  identityAuthMethodData: {
+  identityAuthMethodData?: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityTokenAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -65,11 +62,13 @@ export const IdentityTokenAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityTokenAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityTokenAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
+
   const { data } = useGetIdentityTokenAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
 
   const {
     control,
@@ -124,189 +123,163 @@ export const IdentityTokenAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "configured"} auth method`,
         type: "success"
       });
 
       reset();
     } catch (err) {
       createNotification({
-        text: `Failed to ${isCurrentAuthMethod ? "update" : "configure"} identity`,
+        text: `Failed to ${isUpdate ? "update" : "configure"} identity`,
         type: "error"
       });
     }
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenTTL"
-          name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token TTL (seconds)"
-              label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenMaxTTL"
-          name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max TTL (seconds)"
-              label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="0"
-          defaultValue="0"
+        name="accessTokenNumUsesLimit"
-          name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token Max Number of Uses"
-              label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
+          >
-            >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
-            </FormControl>
+        )}
-          )}
+      />
-        />
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
-          <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
-            <Controller
+            control={control}
-              control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
-              defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
-              render={({ field, fieldState: { error } }) => {
+              return (
-                return (
+                <FormControl
-                  <FormControl
+                  className="mb-0 flex-grow"
-                    className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
-                    isError={Boolean(error)}
+                  errorText={error?.message}
-                    errorText={error?.message}
+                >
-                  >
+                  <Input
-                    <Input
+                    value={field.value}
-                      value={field.value}
+                    onChange={(e) => {
-                      onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
-                        if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
-                          field.onChange(e);
+                        return;
-                          return;
+                      }
-                        }
 
-                        handlePopUpOpen("upgradePlan");
+                      handlePopUpOpen("upgradePlan");
-                      }}
+                    }}
-                      placeholder="123.456.789.0"
+                    placeholder="123.456.789.0"
-                    />
+                  />
-                  </FormControl>
+                </FormControl>
-                );
+              );
-              }}
+            }}
-            />
+          />
-            <IconButton
+          <IconButton
-              onClick={() => {
-                if (subscription?.ipAllowlisting) {
-                  removeAccessTokenTrustedIp(index);
-                  return;
-                }
-
-                handlePopUpOpen("upgradePlan");
-              }}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
             onClick={() => {
               if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
+                removeAccessTokenTrustedIp(index);
-                  ipAddress: "0.0.0.0/0"
-                });
                 return;
               }
 
               handlePopUpOpen("upgradePlan");
             }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
+            size="lg"
-            size="xs"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
           >
-            Add IP Address
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {isUpdate ? "Update" : "Create"}
+          </Button>
+
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
           </Button>
         </div>
-        <div className="flex justify-between">
+        {isUpdate && (
-          <div className="flex items-center">
+          <Button
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
+            size="sm"
-              <Button
+            colorSchema="danger"
-                className="mr-4"
+            isLoading={isSubmitting}
-                size="sm"
+            isDisabled={isSubmitting}
-                isLoading={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-                isDisabled={isSubmitting}
+          >
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
+            Remove Auth Method
-              >
+          </Button>
-                Overwrite
+        )}
-              </Button>
+      </div>
-            ) : (
+    </form>
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          await revokeAuth(initialAuthMethod);
-          handleSubmit(onFormSubmit)();
-        }}
-      />
-    </>
   );
 };

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx

@@ -6,7 +6,7 @@ import { yupResolver } from "@hookform/resolvers/yup";
 import * as yup from "yup";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, DeleteActionModal, FormControl, IconButton, Input } from "@app/components/v2";
+import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityUniversalAuth,
@@ -15,7 +15,7 @@ import {
 } from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
-import { usePopUp, UsePopUpState } from "@app/hooks/usePopUp";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
 const schema = yup
   .object({
@@ -65,21 +65,18 @@ type Props = {
     popUpName: keyof UsePopUpState<["identityAuthMethod", "revokeAuthMethod"]>,
     state?: boolean
   ) => void;
-  identityAuthMethodData: {
+  identityAuthMethodData?: {
     identityId: string;
     name: string;
+    configuredAuthMethods?: IdentityAuthMethod[];
     authMethod?: IdentityAuthMethod;
   };
-  initialAuthMethod: IdentityAuthMethod;
-  revokeAuth: (authMethod: IdentityAuthMethod) => Promise<void>;
 };
 
 export const IdentityUniversalAuthForm = ({
   handlePopUpOpen,
   handlePopUpToggle,
-  identityAuthMethodData,
+  identityAuthMethodData
-  initialAuthMethod,
-  revokeAuth
 }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -87,11 +84,13 @@ export const IdentityUniversalAuthForm = ({
   const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityUniversalAuth();
 
-  const isCurrentAuthMethod = identityAuthMethodData?.authMethod === initialAuthMethod;
+  const isUpdate = identityAuthMethodData?.configuredAuthMethods?.includes(
+    identityAuthMethodData.authMethod! || ""
+  );
+
   const { data } = useGetIdentityUniversalAuth(identityAuthMethodData?.identityId ?? "", {
-    enabled: isCurrentAuthMethod
+    enabled: isUpdate
   });
-  const internalPopUpState = usePopUp(["overwriteAuthMethod"] as const);
 
   const {
     control,
@@ -190,7 +189,7 @@ export const IdentityUniversalAuthForm = ({
       handlePopUpToggle("identityAuthMethod", false);
 
       createNotification({
-        text: `Successfully ${isCurrentAuthMethod ? "updated" : "configured"} auth method`,
+        text: `Successfully ${isUpdate ? "updated" : "created"} auth method`,
         type: "success"
       });
 
@@ -199,8 +198,7 @@ export const IdentityUniversalAuthForm = ({
       console.error(err);
       const error = err as any;
       const text =
-        error?.response?.data?.message ??
+        error?.response?.data?.message ?? `Failed to ${isUpdate ? "update" : "configure"} identity`;
-        `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`;
 
       createNotification({
         text,
@@ -210,243 +208,216 @@ export const IdentityUniversalAuthForm = ({
   };
 
   return (
-    <>
+    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <form onSubmit={handleSubmit(onFormSubmit)}>
+      <Controller
-        <Controller
+        control={control}
-          control={control}
+        defaultValue="2592000"
-          defaultValue="2592000"
+        name="accessTokenTTL"
-          name="accessTokenTTL"
+        render={({ field, fieldState: { error } }) => (
-          render={({ field, fieldState: { error } }) => (
+          <FormControl
-            <FormControl
+            label="Access Token TTL (seconds)"
-              label="Access Token TTL (seconds)"
+            isError={Boolean(error)}
-              isError={Boolean(error)}
+            errorText={error?.message}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="2592000"
-          name="accessTokenMaxTTL"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max TTL (seconds)"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-            </FormControl>
-          )}
-        />
-        <Controller
-          control={control}
-          defaultValue="0"
-          name="accessTokenNumUsesLimit"
-          render={({ field, fieldState: { error } }) => (
-            <FormControl
-              label="Access Token Max Number of Uses"
-              isError={Boolean(error)}
-              errorText={error?.message}
-            >
-              <Input {...field} placeholder="0" type="number" min="0" step="1" />
-            </FormControl>
-          )}
-        />
-        {clientSecretTrustedIpsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`clientSecretTrustedIps.${index}.ipAddress`}
-              defaultValue="0.0.0.0/0"
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Client Secret Trusted IPs" : undefined}
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => {
-                        if (subscription?.ipAllowlisting) {
-                          field.onChange(e);
-                          return;
-                        }
-
-                        handlePopUpOpen("upgradePlan");
-                      }}
-                      placeholder="123.456.789.0"
-                    />
-                  </FormControl>
-                );
-              }}
-            />
-            <IconButton
-              onClick={() => {
-                if (subscription?.ipAllowlisting) {
-                  removeClientSecretTrustedIp(index);
-                  return;
-                }
-
-                handlePopUpOpen("upgradePlan");
-              }}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
-            onClick={() => {
-              if (subscription?.ipAllowlisting) {
-                appendClientSecretTrustedIp({
-                  ipAddress: "0.0.0.0/0"
-                });
-                return;
-              }
-
-              handlePopUpOpen("upgradePlan");
-            }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
-            size="xs"
           >
-            Add IP Address
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-          </Button>
+          </FormControl>
-        </div>
+        )}
-        {accessTokenTrustedIpsFields.map(({ id }, index) => (
-          <div className="mb-3 flex items-end space-x-2" key={id}>
-            <Controller
-              control={control}
-              name={`accessTokenTrustedIps.${index}.ipAddress`}
-              defaultValue="0.0.0.0/0"
-              render={({ field, fieldState: { error } }) => {
-                return (
-                  <FormControl
-                    className="mb-0 flex-grow"
-                    label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                    isError={Boolean(error)}
-                    errorText={error?.message}
-                  >
-                    <Input
-                      value={field.value}
-                      onChange={(e) => {
-                        if (subscription?.ipAllowlisting) {
-                          field.onChange(e);
-                          return;
-                        }
-
-                        handlePopUpOpen("upgradePlan");
-                      }}
-                      placeholder="123.456.789.0"
-                    />
-                  </FormControl>
-                );
-              }}
-            />
-            <IconButton
-              onClick={() => {
-                if (subscription?.ipAllowlisting) {
-                  removeAccessTokenTrustedIp(index);
-                  return;
-                }
-
-                handlePopUpOpen("upgradePlan");
-              }}
-              size="lg"
-              colorSchema="danger"
-              variant="plain"
-              ariaLabel="update"
-              className="p-3"
-            >
-              <FontAwesomeIcon icon={faXmark} />
-            </IconButton>
-          </div>
-        ))}
-        <div className="my-4 ml-1">
-          <Button
-            variant="outline_bg"
-            onClick={() => {
-              if (subscription?.ipAllowlisting) {
-                appendAccessTokenTrustedIp({
-                  ipAddress: "0.0.0.0/0"
-                });
-                return;
-              }
-
-              handlePopUpOpen("upgradePlan");
-            }}
-            leftIcon={<FontAwesomeIcon icon={faPlus} />}
-            size="xs"
-          >
-            Add IP Address
-          </Button>
-        </div>
-        <div className="flex justify-between">
-          <div className="flex items-center">
-            {initialAuthMethod && identityAuthMethodData?.authMethod !== initialAuthMethod ? (
-              <Button
-                className="mr-4"
-                size="sm"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-                onClick={() => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", true)}
-              >
-                Overwrite
-              </Button>
-            ) : (
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Submit
-              </Button>
-            )}
-            <Button
-              colorSchema="secondary"
-              variant="plain"
-              onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-            >
-              Cancel
-            </Button>
-          </div>
-          {isCurrentAuthMethod && (
-            <Button
-              size="sm"
-              colorSchema="danger"
-              isLoading={isSubmitting}
-              isDisabled={isSubmitting}
-              onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
-            >
-              Remove Auth Method
-            </Button>
-          )}
-        </div>
-      </form>
-      <DeleteActionModal
-        isOpen={internalPopUpState.popUp.overwriteAuthMethod?.isOpen}
-        title={`Are you sure want to overwrite ${initialAuthMethod || "the auth method"} on ${
-          identityAuthMethodData?.name ?? ""
-        }?`}
-        onChange={(isOpen) => internalPopUpState.handlePopUpToggle("overwriteAuthMethod", isOpen)}
-        deleteKey="confirm"
-        buttonText="Overwrite"
-        onDeleteApproved={async () => {
-          await revokeAuth(initialAuthMethod);
-          handleSubmit(onFormSubmit)();
-        }}
       />
-    </>
+      <Controller
+        control={control}
+        defaultValue="2592000"
+        name="accessTokenMaxTTL"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max TTL (seconds)"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
+          </FormControl>
+        )}
+      />
+      <Controller
+        control={control}
+        defaultValue="0"
+        name="accessTokenNumUsesLimit"
+        render={({ field, fieldState: { error } }) => (
+          <FormControl
+            label="Access Token Max Number of Uses"
+            isError={Boolean(error)}
+            errorText={error?.message}
+          >
+            <Input {...field} placeholder="0" type="number" min="0" step="1" />
+          </FormControl>
+        )}
+      />
+      {clientSecretTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`clientSecretTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Client Secret Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
+
+                      handlePopUpOpen("upgradePlan");
+                    }}
+                    placeholder="123.456.789.0"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <IconButton
+            onClick={() => {
+              if (subscription?.ipAllowlisting) {
+                removeClientSecretTrustedIp(index);
+                return;
+              }
+
+              handlePopUpOpen("upgradePlan");
+            }}
+            size="lg"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
+          >
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendClientSecretTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      {accessTokenTrustedIpsFields.map(({ id }, index) => (
+        <div className="mb-3 flex items-end space-x-2" key={id}>
+          <Controller
+            control={control}
+            name={`accessTokenTrustedIps.${index}.ipAddress`}
+            defaultValue="0.0.0.0/0"
+            render={({ field, fieldState: { error } }) => {
+              return (
+                <FormControl
+                  className="mb-0 flex-grow"
+                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
+                  isError={Boolean(error)}
+                  errorText={error?.message}
+                >
+                  <Input
+                    value={field.value}
+                    onChange={(e) => {
+                      if (subscription?.ipAllowlisting) {
+                        field.onChange(e);
+                        return;
+                      }
+
+                      handlePopUpOpen("upgradePlan");
+                    }}
+                    placeholder="123.456.789.0"
+                  />
+                </FormControl>
+              );
+            }}
+          />
+          <IconButton
+            onClick={() => {
+              if (subscription?.ipAllowlisting) {
+                removeAccessTokenTrustedIp(index);
+                return;
+              }
+
+              handlePopUpOpen("upgradePlan");
+            }}
+            size="lg"
+            colorSchema="danger"
+            variant="plain"
+            ariaLabel="update"
+            className="p-3"
+          >
+            <FontAwesomeIcon icon={faXmark} />
+          </IconButton>
+        </div>
+      ))}
+      <div className="my-4 ml-1">
+        <Button
+          variant="outline_bg"
+          onClick={() => {
+            if (subscription?.ipAllowlisting) {
+              appendAccessTokenTrustedIp({
+                ipAddress: "0.0.0.0/0"
+              });
+              return;
+            }
+
+            handlePopUpOpen("upgradePlan");
+          }}
+          leftIcon={<FontAwesomeIcon icon={faPlus} />}
+          size="xs"
+        >
+          Add IP Address
+        </Button>
+      </div>
+      <div className="flex justify-between">
+        <div className="flex items-center">
+          <Button
+            className="mr-4"
+            size="sm"
+            type="submit"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+          >
+            {isUpdate ? "Edit" : "Create"}
+          </Button>
+          <Button
+            colorSchema="secondary"
+            variant="plain"
+            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+          >
+            Cancel
+          </Button>
+        </div>
+        {isUpdate && (
+          <Button
+            size="sm"
+            colorSchema="danger"
+            isLoading={isSubmitting}
+            isDisabled={isSubmitting}
+            onClick={() => handlePopUpToggle("revokeAuthMethod", true)}
+          >
+            Delete Auth Method
+          </Button>
+        )}
+      </div>
+    </form>
   );
 };