Add no access role, replace ST V3 refs with machine

backend/src/ee/controllers/v1/workspaceController.ts

@@ -17,10 +17,10 @@ import {
   FolderVersion,
   IPType,
   ISecretVersion,
+  MachineActor,
   SecretSnapshot,
   SecretVersion,
   ServiceActor,
-  ServiceActorV3,
   TFolderRootVersionSchema,
   TrustedIP,
   UserActor
@@ -757,12 +757,12 @@ export const getWorkspaceAuditLogActorFilterOpts = async (req: Request, res: Res
     }
   }));
 
-  const serviceV3Actors: ServiceActorV3[] = (
+  const serviceV3Actors: MachineActor[] = (
     await MachineIdentity.find({
       workspace: new Types.ObjectId(workspaceId)
     })
   ).map((machineIdentity) => ({
-    type: ActorType.SERVICE_V3,
+    type: ActorType.MACHINE,
     metadata: {
       serviceId: machineIdentity._id.toString(),
       name: machineIdentity.name

backend/src/ee/controllers/v3/machineIdentityController.ts

@@ -44,11 +44,11 @@ import { ForbiddenError } from "@casl/ability";
         }
     } = await validateRequest(reqValidator.RefreshTokenV3, req);
 
-    const decodedToken = <jwt.ServiceRefreshTokenJwtPayload>(
+    const decodedToken = <jwt.MachineRefreshTokenJwtPayload>(
 		jwt.verify(refreshToken, await getAuthSecret())
 	);
     
-    if (decodedToken.authTokenType !== AuthTokenType.SERVICE_REFRESH_TOKEN) throw UnauthorizedRequestError();
+    if (decodedToken.authTokenType !== AuthTokenType.MACHINE_REFRESH_TOKEN) throw UnauthorizedRequestError();
     
     let machineIdentity = await MachineIdentity.findOne({
         _id: new Types.ObjectId(decodedToken.serviceTokenDataId),
@@ -92,7 +92,7 @@ import { ForbiddenError } from "@casl/ability";
         response.refreshToken = createToken({
             payload: {
                 serviceTokenDataId: machineIdentity._id.toString(),
-                authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
+                authTokenType: AuthTokenType.MACHINE_REFRESH_TOKEN,
                 tokenVersion: machineIdentity.tokenVersion
             },
             secret: await getAuthSecret()
@@ -101,8 +101,8 @@ import { ForbiddenError } from "@casl/ability";
 
     response.accessToken = createToken({
         payload: {
-            serviceTokenDataId: machineIdentity._id.toString(), // TODO: fix this
-            authTokenType: AuthTokenType.SERVICE_ACCESS_TOKEN,
+            _id: machineIdentity._id.toString(), // TODO: fix this
+            authTokenType: AuthTokenType.MACHINE_ACCESS_TOKEN,
             tokenVersion: machineIdentity.tokenVersion
         },
         expiresIn: machineIdentity.accessTokenTTL,
@@ -226,8 +226,8 @@ export const createMachineIdentity = async (req: Request, res: Response) => {
     
     const refreshToken = createToken({
         payload: {
-            serviceTokenDataId: machineIdentity._id.toString(), // TODO: update
-            authTokenType: AuthTokenType.SERVICE_REFRESH_TOKEN,
+            _id: machineIdentity._id.toString(),
+            authTokenType: AuthTokenType.MACHINE_REFRESH_TOKEN,
             tokenVersion: machineIdentity.tokenVersion
         },
         secret: await getAuthSecret()

backend/src/ee/models/auditLog/enums.ts

@@ -1,8 +1,7 @@
 export enum ActorType {
   USER = "user",
   SERVICE = "service",
-  SERVICE_V3 = "service-v3",
-  // Machine = "machine"
+  MACHINE = "machine"
 }
 
 export enum UserAgentType {

backend/src/ee/models/auditLog/types.ts

@@ -11,6 +11,11 @@ interface ServiceActorMetadata {
   name: string;
 }
 
+interface MachineActorMetadata {
+  machineId: string;
+  name: string;
+}
+
 export interface UserActor {
   type: ActorType.USER;
   metadata: UserActorMetadata;
@@ -21,16 +26,16 @@ export interface ServiceActor {
   metadata: ServiceActorMetadata;
 }
 
-export interface ServiceActorV3 {
-  type: ActorType.SERVICE_V3;
-  metadata: ServiceActorMetadata;
+export interface MachineActor {
+  type: ActorType.MACHINE;
+  metadata: MachineActorMetadata;
 }
 
 // export interface MachineActor {
 //   type: ActorType.Machine;
 // }
 
-export type Actor = UserActor | ServiceActor | ServiceActorV3;
+export type Actor = UserActor | ServiceActor | MachineActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;

backend/src/ee/services/ProjectRoleService.ts

@@ -310,7 +310,7 @@ export const getAuthDataProjectPermissions = async ({
       role = "viewer";
       break;
     }
-    case ActorType.SERVICE_V3: {
+    case ActorType.MACHINE: {
       const machineMembership = await MachineMembership.findOne({
         machineIdentity: authData.authPayload._id,
         workspace: workspaceId