feat: adds GET endpoint for single auth token by ID

backend/src/server/routes/v1/identity-token-auth-router.ts

@@ -312,9 +312,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
       response: {
         200: z.object({
           accessToken: z.string(),
-          expiresIn: z.coerce.number(),
-          accessTokenMaxTTL: z.coerce.number(),
-          tokenType: z.literal("Bearer")
+          tokenData: IdentityAccessTokensSchema
         })
       }
     },
@@ -344,9 +342,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
 
       return {
         accessToken,
-        tokenType: "Bearer" as const,
-        expiresIn: identityTokenAuth.accessTokenTTL,
-        accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL
+        tokenData: identityAccessToken
       };
     }
   });
@@ -406,6 +402,59 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     }
   });
 
+  server.route({
+    method: "GET",
+    url: "/token-auth/identities/:identityId/tokens/:tokenId",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.TokenAuth],
+      description: "Get token for machine identity with Token Auth",
+      security: [
+        {
+          bearerAuth: []
+        }
+      ],
+      params: z.object({
+        identityId: z.string().describe(TOKEN_AUTH.GET_TOKEN.identityId),
+        tokenId: z.string().describe(TOKEN_AUTH.GET_TOKEN.tokenId)
+      }),
+      response: {
+        200: z.object({
+          token: IdentityAccessTokensSchema
+        })
+      }
+    },
+    handler: async (req) => {
+      const { token, identityMembershipOrg } = await server.services.identityTokenAuth.getTokenAuthTokenById({
+        identityId: req.params.identityId,
+        tokenId: req.params.tokenId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorOrgId: req.permission.orgId,
+        actorAuthMethod: req.permission.authMethod,
+        isActorSuperAdmin: isSuperAdmin(req.auth)
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: identityMembershipOrg.scopeOrgId,
+        event: {
+          type: EventType.GET_TOKEN_IDENTITY_TOKEN_AUTH,
+          metadata: {
+            identityId: token.identityId,
+            tokenId: token.id
+          }
+        }
+      });
+
+      return { token };
+    }
+  });
+
   server.route({
     method: "PATCH",
     url: "/token-auth/tokens/:tokenId",