From 830a2f9581b3d1b8fb7b591ff4a533a5f00e1235 Mon Sep 17 00:00:00 2001
From: Carlos Monastyrski <charly.monastyrski@gmail.com>
Date: Mon, 4 Aug 2025 16:28:57 -0300
Subject: [PATCH] Renamed identity auth template permissions

---
 backend/src/ee/services/permission/org-permission.ts | 12 +++++++++---
 .../identity-auth-template-service.ts                |  2 +-
 .../identity-ldap-auth/identity-ldap-auth-service.ts |  4 ++--
 .../permissions/organization-permissions.mdx         |  2 +-
 frontend/src/context/OrgPermissionContext/types.ts   |  2 +-
 .../IdentitySection/IdentityLdapAuthForm.tsx         |  6 +++---
 .../components/OrgRoleModifySection.utils.ts         |  2 +-
 .../OrgPermissionMachineIdentityAuthTemplateRow.tsx  |  8 ++++----
 8 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts
index 7835cd19b..2436dae2a 100644
--- a/backend/src/ee/services/permission/org-permission.ts
+++ b/backend/src/ee/services/permission/org-permission.ts
@@ -34,7 +34,7 @@ export enum OrgPermissionMachineIdentityAuthTemplateActions {
   CreateTemplates = "create-templates",
   DeleteTemplates = "delete-templates",
   UnlinkTemplates = "unlink-templates",
-  UseTemplates = "use-templates"
+  AttachTemplates = "attach-templates"
 }
 
 export enum OrgPermissionAdminConsoleAction {
@@ -383,7 +383,10 @@ const buildAdminPermission = () => {
     OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates,
     OrgPermissionSubjects.MachineIdentityAuthTemplate
   );
-  can(OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates, OrgPermissionSubjects.MachineIdentityAuthTemplate);
+  can(
+    OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
+    OrgPermissionSubjects.MachineIdentityAuthTemplate
+  );
 
   can(OrgPermissionSecretShareAction.ManageSettings, OrgPermissionSubjects.SecretShare);
 
@@ -425,7 +428,10 @@ const buildMemberPermission = () => {
     OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates,
     OrgPermissionSubjects.MachineIdentityAuthTemplate
   );
-  can(OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates, OrgPermissionSubjects.MachineIdentityAuthTemplate);
+  can(
+    OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
+    OrgPermissionSubjects.MachineIdentityAuthTemplate
+  );
 
   return rules;
 };
diff --git a/backend/src/services/identity-auth-template/identity-auth-template-service.ts b/backend/src/services/identity-auth-template/identity-auth-template-service.ts
index 2920d309c..5fcd2614d 100644
--- a/backend/src/services/identity-auth-template/identity-auth-template-service.ts
+++ b/backend/src/services/identity-auth-template/identity-auth-template-service.ts
@@ -360,7 +360,7 @@ export const identityAuthTemplateServiceFactory = ({
       actorOrgId
     );
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates,
+      OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
       OrgPermissionSubjects.MachineIdentityAuthTemplate
     );
 
diff --git a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
index 25452f3ba..3d2fe1b54 100644
--- a/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
+++ b/backend/src/services/identity-ldap-auth/identity-ldap-auth-service.ts
@@ -224,7 +224,7 @@ export const identityLdapAuthServiceFactory = ({
 
     if (templateId) {
       ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates,
+        OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
         OrgPermissionSubjects.MachineIdentityAuthTemplate
       );
     }
@@ -386,7 +386,7 @@ export const identityLdapAuthServiceFactory = ({
 
     if (templateId) {
       ForbiddenError.from(permission).throwUnlessCan(
-        OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates,
+        OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
         OrgPermissionSubjects.MachineIdentityAuthTemplate
       );
     }
diff --git a/docs/internals/permissions/organization-permissions.mdx b/docs/internals/permissions/organization-permissions.mdx
index 1395db5b8..5f5fc962f 100644
--- a/docs/internals/permissions/organization-permissions.mdx
+++ b/docs/internals/permissions/organization-permissions.mdx
@@ -227,4 +227,4 @@ Supports conditions and permission inversion
 | `edit-templates`   | Modify existing identity auth templates        |
 | `delete-templates` | Remove identity auth templates                 |
 | `unlink-templates` | Unlink identity auth templates from identities |
-| `use-templates`    | Attach identity auth templates to identities   |
+| `attach-templates` | Attach identity auth templates to identities   |
diff --git a/frontend/src/context/OrgPermissionContext/types.ts b/frontend/src/context/OrgPermissionContext/types.ts
index ece704f12..50e147aa0 100644
--- a/frontend/src/context/OrgPermissionContext/types.ts
+++ b/frontend/src/context/OrgPermissionContext/types.ts
@@ -27,7 +27,7 @@ export enum OrgPermissionMachineIdentityAuthTemplateActions {
   EditTemplates = "edit-templates",
   DeleteTemplates = "delete-templates",
   UnlinkTemplates = "unlink-templates",
-  UseTemplates = "use-templates"
+  AttachTemplates = "attach-templates"
 }
 
 export enum OrgPermissionSubjects {
diff --git a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityLdapAuthForm.tsx b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityLdapAuthForm.tsx
index cc4db0369..ee0cddc5c 100644
--- a/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityLdapAuthForm.tsx
+++ b/frontend/src/pages/organization/AccessManagementPage/components/OrgIdentityTab/components/IdentitySection/IdentityLdapAuthForm.tsx
@@ -149,8 +149,8 @@ export const IdentityLdapAuthForm = ({
   const { data: templates } = useGetAvailableTemplates(MachineIdentityAuthMethod.LDAP);
   const { permission } = useOrgPermission();
 
-  const canUseTemplates = permission.can(
-    OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates,
+  const canAttachTemplates = permission.can(
+    OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
     OrgPermissionSubjects.MachineIdentityAuthTemplate
   );
 
@@ -352,7 +352,7 @@ export const IdentityLdapAuthForm = ({
           <Tab value={IdentityFormTab.Advanced}>Advanced</Tab>
         </TabList>
         <TabPanel value={IdentityFormTab.Configuration}>
-          {canUseTemplates && (
+          {canAttachTemplates && (
             <Controller
               control={control}
               name="scope"
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
index c88867611..275b73fd0 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
+++ b/frontend/src/pages/organization/RoleByIDPage/components/OrgRoleModifySection.utils.ts
@@ -90,7 +90,7 @@ const machineIdentityAuthTemplatePermissionSchema = z
     [OrgPermissionMachineIdentityAuthTemplateActions.DeleteTemplates]: z.boolean().optional(),
     [OrgPermissionMachineIdentityAuthTemplateActions.CreateTemplates]: z.boolean().optional(),
     [OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates]: z.boolean().optional(),
-    [OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates]: z.boolean().optional()
+    [OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates]: z.boolean().optional()
   })
   .optional();
 
diff --git a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionMachineIdentityAuthTemplateRow.tsx b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionMachineIdentityAuthTemplateRow.tsx
index 7b9e993c7..3fa782b1f 100644
--- a/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionMachineIdentityAuthTemplateRow.tsx
+++ b/frontend/src/pages/organization/RoleByIDPage/components/RolePermissionsSection/OrgPermissionMachineIdentityAuthTemplateRow.tsx
@@ -45,7 +45,7 @@ const PERMISSION_ACTIONS = [
     label: "Unlink Templates"
   },
   {
-    action: OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates,
+    action: OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates,
     label: "Attach Templates"
   }
 ] as const;
@@ -108,7 +108,7 @@ export const OrgPermissionMachineIdentityAuthTemplateRow = ({
             [OrgPermissionMachineIdentityAuthTemplateActions.CreateTemplates]: true,
             [OrgPermissionMachineIdentityAuthTemplateActions.DeleteTemplates]: true,
             [OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates]: true,
-            [OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates]: true
+            [OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates]: true
           },
           { shouldDirty: true }
         );
@@ -122,7 +122,7 @@ export const OrgPermissionMachineIdentityAuthTemplateRow = ({
             [OrgPermissionMachineIdentityAuthTemplateActions.CreateTemplates]: false,
             [OrgPermissionMachineIdentityAuthTemplateActions.DeleteTemplates]: false,
             [OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates]: false,
-            [OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates]: true
+            [OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates]: true
           },
           { shouldDirty: true }
         );
@@ -138,7 +138,7 @@ export const OrgPermissionMachineIdentityAuthTemplateRow = ({
             [OrgPermissionMachineIdentityAuthTemplateActions.CreateTemplates]: false,
             [OrgPermissionMachineIdentityAuthTemplateActions.DeleteTemplates]: false,
             [OrgPermissionMachineIdentityAuthTemplateActions.UnlinkTemplates]: false,
-            [OrgPermissionMachineIdentityAuthTemplateActions.UseTemplates]: false
+            [OrgPermissionMachineIdentityAuthTemplateActions.AttachTemplates]: false
           },
           { shouldDirty: true }
         );