improvements: address feedback

backend/src/ee/services/secret-rotation-v2/auth0-client-secret/auth0-client-secret-rotation-fns.ts

@@ -10,6 +10,7 @@ import {
   TRotationFactoryRotateCredentials
 } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-types";
 import { request } from "@app/lib/config/request";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { getAuth0ConnectionAccessToken } from "@app/services/app-connection/auth0";
 
 import { generatePassword } from "../shared/utils";
@@ -26,11 +27,13 @@ export const auth0ClientSecretRotationFactory: TRotationFactory<
 
   const $rotateClientSecret = async () => {
     const accessToken = await getAuth0ConnectionAccessToken(connection, appConnectionDAL, kmsService);
+    const { audience } = connection.credentials;
+    await blockLocalAndPrivateIpAddresses(audience);
     const clientSecret = generatePassword();
 
     await request.request({
       method: "PATCH",
-      url: `${connection.credentials.audience}clients/${clientId}`,
+      url: `${audience}clients/${clientId}`,
       headers: { authorization: `Bearer ${accessToken}` },
       data: {
         client_secret: clientSecret
@@ -53,11 +56,13 @@ export const auth0ClientSecretRotationFactory: TRotationFactory<
     callback
   ) => {
     const accessToken = await getAuth0ConnectionAccessToken(connection, appConnectionDAL, kmsService);
+    const { audience } = connection.credentials;
+    await blockLocalAndPrivateIpAddresses(audience);
 
     // we just trigger an auth0 rotation to negate our credentials
     await request.request({
       method: "POST",
-      url: `${connection.credentials.audience}clients/${clientId}/rotate-secret`,
+      url: `${audience}clients/${clientId}/rotate-secret`,
       headers: { authorization: `Bearer ${accessToken}` }
     });
 

backend/src/ee/services/secret-rotation-v2/auth0-client-secret/auth0-client-secret-rotation-schemas.ts

@@ -28,7 +28,7 @@ const Auth0ClientSecretRotationParametersSchema = z.object({
 });
 
 const Auth0ClientSecretRotationSecretsMappingSchema = z.object({
-  clientId: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AUTH0_CLIENT_SECRET.clientID),
+  clientId: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AUTH0_CLIENT_SECRET.clientId),
   clientSecret: SecretNameSchema.describe(SecretRotations.SECRETS_MAPPING.AUTH0_CLIENT_SECRET.clientSecret)
 });
 

backend/src/lib/api-docs/constants.ts

@@ -1979,7 +1979,7 @@ export const SecretRotations = {
       password: "The name of the secret that the generated password will be mapped to."
     },
     AUTH0_CLIENT_SECRET: {
-      clientID: "The name of the secret that the client ID will be mapped to.",
+      clientId: "The name of the secret that the client ID will be mapped to.",
       clientSecret: "The name of the secret that the rotated client secret will be mapped to."
     }
   }

backend/src/server/routes/v1/app-connection-routers/auth0-connection-router.ts

@@ -1,9 +1,14 @@
+import { z } from "zod";
+
+import { readLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import {
   CreateAuth0ConnectionSchema,
   SanitizedAuth0ConnectionSchema,
   UpdateAuth0ConnectionSchema
 } from "@app/services/app-connection/auth0";
+import { AuthMode } from "@app/services/auth/auth-type";
 
 import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
 
@@ -15,4 +20,32 @@ export const registerAuth0ConnectionRouter = async (server: FastifyZodProvider)
     createSchema: CreateAuth0ConnectionSchema,
     updateSchema: UpdateAuth0ConnectionSchema
   });
+
+  // The below endpoints are not exposed and for Infisical App use
+
+  server.route({
+    method: "GET",
+    url: `/:connectionId/clients`,
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      params: z.object({
+        connectionId: z.string().uuid()
+      }),
+      response: {
+        200: z.object({
+          clients: z.object({ name: z.string(), id: z.string() }).array()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT]),
+    handler: async (req) => {
+      const { connectionId } = req.params;
+
+      const clients = await server.services.appConnection.auth0.listClients(connectionId, req.permission);
+
+      return { clients };
+    }
+  });
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -14,6 +14,7 @@ import {
   TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM,
   validateAppConnectionCredentials
 } from "@app/services/app-connection/app-connection-fns";
+import { auth0ConnectionService } from "@app/services/app-connection/auth0/auth0-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TAppConnectionDALFactory } from "./app-connection-dal";
@@ -440,6 +441,7 @@ export const appConnectionServiceFactory = ({
     aws: awsConnectionService(connectAppConnectionById),
     humanitec: humanitecConnectionService(connectAppConnectionById),
     camunda: camundaConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
-    vercel: vercelConnectionService(connectAppConnectionById)
+    vercel: vercelConnectionService(connectAppConnectionById),
+    auth0: auth0ConnectionService(connectAppConnectionById, appConnectionDAL, kmsService)
   };
 };

backend/src/services/app-connection/auth0/auth0-connection-fns.ts

@@ -1,5 +1,3 @@
-import { AxiosError } from "axios";
-
 import { request } from "@app/lib/config/request";
 import { BadRequestError } from "@app/lib/errors";
 import { removeTrailingSlash } from "@app/lib/fn";
@@ -45,7 +43,11 @@ const authorizeAuth0Connection = async ({
     throw new Error(`Unhandled token type: ${data.token_type}`);
   }
 
-  return { accessToken: data.access_token, expiresAt: data.expires_in * 1000 + Date.now() };
+  return {
+    accessToken: data.access_token,
+    // cap token lifespan to 10 minutes
+    expiresAt: Math.min(data.expires_in * 1000, 600000) + Date.now()
+  };
 };
 
 export const getAuth0ConnectionAccessToken = async (
@@ -53,7 +55,12 @@ export const getAuth0ConnectionAccessToken = async (
   appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
-  // just getting a new auth token every time because if permissions change the previous token doesn't have the changes
+  const { expiresAt, accessToken } = credentials;
+
+  // get new token if expired or less than 5 minutes until expiry
+  if (Date.now() < expiresAt - 300000) {
+    return accessToken;
+  }
 
   const authData = await authorizeAuth0Connection(credentials);
 
@@ -84,7 +91,7 @@ export const validateAuth0ConnectionCredentials = async ({ credentials }: TAuth0
     };
   } catch (e: unknown) {
     throw new BadRequestError({
-      message: (e as AxiosError).message ?? `Unable to validate connection: verify credentials`
+      message: (e as Error).message ?? `Unable to validate connection: verify credentials`
     });
   }
 };

backend/src/services/app-connection/auth0/auth0-connection-service.ts

@@ -0,0 +1,71 @@
+import { request } from "@app/lib/config/request";
+import { OrgServiceActor } from "@app/lib/types";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { getAuth0ConnectionAccessToken } from "@app/services/app-connection/auth0/auth0-connection-fns";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+
+import { TAuth0Connection, TAuth0ListClient, TAuth0ListClientsResponse } from "./auth0-connection-types";
+
+type TGetAppConnectionFunc = (
+  app: AppConnection,
+  connectionId: string,
+  actor: OrgServiceActor
+) => Promise<TAuth0Connection>;
+
+const listAuth0Clients = async (
+  appConnection: TAuth0Connection,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+) => {
+  const accessToken = await getAuth0ConnectionAccessToken(appConnection, appConnectionDAL, kmsService);
+
+  const { audience, clientId: connectionClientId } = appConnection.credentials;
+  await blockLocalAndPrivateIpAddresses(audience);
+
+  const clients: TAuth0ListClient[] = [];
+  let hasMore = true;
+  let page = 0;
+
+  while (hasMore) {
+    // eslint-disable-next-line no-await-in-loop
+    const { data: clientsPage } = await request.get<TAuth0ListClientsResponse>(`${audience}clients`, {
+      headers: {
+        Authorization: `Bearer ${accessToken}`,
+        "Accept-Encoding": "application/json"
+      },
+      params: {
+        include_totals: true,
+        per_page: 100,
+        page
+      }
+    });
+
+    clients.push(...clientsPage.clients);
+    page += 1;
+    hasMore = clientsPage.total > clients.length;
+  }
+
+  return (
+    clients.filter((client) => client.client_id !== connectionClientId && client.name !== "All Applications") ?? []
+  );
+};
+
+export const auth0ConnectionService = (
+  getAppConnection: TGetAppConnectionFunc,
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "updateById">,
+  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
+) => {
+  const listClients = async (connectionId: string, actor: OrgServiceActor) => {
+    const appConnection = await getAppConnection(AppConnection.Auth0, connectionId, actor);
+
+    const clients = await listAuth0Clients(appConnection, appConnectionDAL, kmsService);
+
+    return clients.map((client) => ({ id: client.client_id, name: client.name }));
+  };
+
+  return {
+    listClients
+  };
+};

backend/src/services/app-connection/auth0/auth0-connection-types.ts

@@ -27,3 +27,13 @@ export type TAuth0AccessTokenResponse = {
   scope: string;
   token_type: string;
 };
+
+export type TAuth0ListClient = {
+  name: string;
+  client_id: string;
+};
+
+export type TAuth0ListClientsResponse = {
+  total: number;
+  clients: TAuth0ListClient[];
+};