Merge remote-tracking branch 'origin/main' into feat/PKI-29

backend/src/services/certificate-profile/certificate-profile-service.test.ts

@@ -430,7 +430,10 @@ describe("CertificateProfileService", () => {
           projectId: "project-123",
           data: {
             ...validProfileData,
-            enrollmentType: EnrollmentType.ACME
+            enrollmentType: EnrollmentType.ACME,
+            acmeConfig: {},
+            apiConfig: undefined,
+            estConfig: undefined
           }
         })
       ).rejects.toThrowError(

backend/src/services/certificate-profile/certificate-profile-service.ts

@@ -213,7 +213,7 @@ export const certificateProfileServiceFactory = ({
       throw new NotFoundError({ message: "Project not found" });
     }
     const plan = await licenseService.getPlan(project.orgId);
-    if (!plan.pkiAcme) {
+    if (!plan.pkiAcme && data.enrollmentType === EnrollmentType.ACME) {
       throw new BadRequestError({
         message: "Failed to create certificate profile: Plan restriction. Upgrade plan to continue"
       });

backend/src/services/identity-access-token/identity-access-token-dal.ts

@@ -18,7 +18,6 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
         .where(filter)
         .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.IdentityAccessToken}.identityId`)
         .select(selectAllTableCols(TableName.IdentityAccessToken))
-        .select(db.ref("name").withSchema(TableName.Identity))
         .select(db.ref("orgId").withSchema(TableName.Identity).as("identityScopeOrgId"))
         .first();
 

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -38,6 +38,7 @@ import {
   TAttachTokenAuthDTO,
   TCreateTokenAuthTokenDTO,
   TGetTokenAuthDTO,
+  TGetTokenAuthTokenByIdDTO,
   TGetTokenAuthTokensDTO,
   TRevokeTokenAuthDTO,
   TRevokeTokenAuthTokenDTO,
@@ -618,6 +619,52 @@ export const identityTokenAuthServiceFactory = ({
     return { tokens, identityMembershipOrg };
   };
 
+  const getTokenAuthTokenById = async ({
+    tokenId,
+    identityId,
+    isActorSuperAdmin,
+    actorId,
+    actor,
+    actorAuthMethod,
+    actorOrgId
+  }: TGetTokenAuthTokenByIdDTO) => {
+    await validateIdentityUpdateForSuperAdminPrivileges(identityId, isActorSuperAdmin);
+
+    const identityMembershipOrg = await membershipIdentityDAL.getIdentityById({
+      scopeData: {
+        scope: AccessScope.Organization,
+        orgId: actorOrgId
+      },
+      identityId
+    });
+    if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
+
+    if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
+      throw new BadRequestError({
+        message: "The identity does not have Token Auth"
+      });
+    }
+    const { permission } = await permissionService.getOrgPermission({
+      scope: OrganizationActionScope.Any,
+      actor,
+      actorId,
+      orgId: identityMembershipOrg.scopeOrgId,
+      actorAuthMethod,
+      actorOrgId
+    });
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Read, OrgPermissionSubjects.Identity);
+
+    const token = await identityAccessTokenDAL.findOne({
+      [`${TableName.IdentityAccessToken}.id` as "id"]: tokenId,
+      [`${TableName.IdentityAccessToken}.authMethod` as "authMethod"]: IdentityAuthMethod.TOKEN_AUTH,
+      [`${TableName.IdentityAccessToken}.identityId` as "identityId"]: identityId
+    });
+
+    if (!token) throw new NotFoundError({ message: `Token with ID ${tokenId} not found` });
+
+    return { token, identityMembershipOrg };
+  };
+
   const updateTokenAuthToken = async ({
     tokenId,
     name,
@@ -797,6 +844,7 @@ export const identityTokenAuthServiceFactory = ({
     revokeIdentityTokenAuth,
     createTokenAuthToken,
     getTokenAuthTokens,
+    getTokenAuthTokenById,
     updateTokenAuthToken,
     revokeTokenAuthToken
   };

backend/src/services/identity-token-auth/identity-token-auth-types.ts

@@ -40,6 +40,12 @@ export type TGetTokenAuthTokensDTO = {
   isActorSuperAdmin?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 
+export type TGetTokenAuthTokenByIdDTO = {
+  tokenId: string;
+  identityId: string;
+  isActorSuperAdmin?: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
 export type TUpdateTokenAuthTokenDTO = {
   tokenId: string;
   name?: string;

backend/src/services/offline-usage-report/offline-usage-report-service.ts

@@ -1,7 +1,8 @@
 import crypto from "crypto";
 
+import { getLicenseKeyConfig } from "@app/ee/services/license/license-fns";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { getConfig } from "@app/lib/config/env";
+import { LicenseType } from "@app/ee/services/license/license-types";
 import { BadRequestError } from "@app/lib/errors";
 
 import { TOfflineUsageReportDALFactory } from "./offline-usage-report-dal";
@@ -30,10 +31,13 @@ export const offlineUsageReportServiceFactory = ({
   };
 
   const generateUsageReportCSV = async () => {
-    const cfg = getConfig();
-    if (!cfg.LICENSE_KEY_OFFLINE) {
+    const licenseKeyConfig = getLicenseKeyConfig();
+    const hasOfflineLicense = licenseKeyConfig.isValid && licenseKeyConfig.type === LicenseType.Offline;
+
+    if (!hasOfflineLicense) {
       throw new BadRequestError({
-        message: "Offline usage reports are not enabled. LICENSE_KEY_OFFLINE must be configured."
+        message:
+          "Offline usage reports are not enabled. Usage reports are only available for self-hosted offline instances"
       });
     }
 

backend/src/services/secret-sync/secret-sync-maps.ts

@@ -112,7 +112,7 @@ export const SECRET_SYNC_PLAN_MAP: Record<SecretSync, SecretSyncPlanType> = {
 
 export const SECRET_SYNC_SKIP_FIELDS_MAP: Record<SecretSync, string[]> = {
   [SecretSync.AWSParameterStore]: [],
-  [SecretSync.AWSSecretsManager]: ["mappingBehavior", "secretName"],
+  [SecretSync.AWSSecretsManager]: ["mappingBehavior"],
   [SecretSync.GitHub]: [],
   [SecretSync.GCPSecretManager]: [],
   [SecretSync.AzureKeyVault]: [],