awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

requested changes

Browse Source
This commit is contained in:
Daniel Hougaard
2025-02-07 07:42:32 +04:00
parent ba42ea736b
commit a67badf660
55 changed files with 872 additions and 428 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
backend/src/server/routes/v1/app-connection-routers/app-connection-endpoints.ts
View File

@@ -8,7 +8,6 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
import { TAppConnection, TAppConnectionInput } from "@app/services/app-connection/app-connection-types";
import { AzureResources } from "@app/services/app-connection/azure";
import { AuthMode } from "@app/services/auth/auth-type";
export const registerAppConnectionEndpoints = <T extends TAppConnection, I extends TAppConnectionInput>({
@@ -78,8 +77,7 @@ export const registerAppConnectionEndpoints = <T extends TAppConnection, I exten
.object({
app: z.literal(app),
name: z.string(),
id: z.string().uuid(),
azureResource: z.nativeEnum(AzureResources).optional()
id: z.string().uuid()
})
.array()
})

15
backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts
View File

@@ -4,7 +4,14 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
import { readLimit } from "@app/server/config/rateLimiter";
import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
import { AzureConnectionListItemSchema, SanitizedAzureConnectionSchema } from "@app/services/app-connection/azure";
import {
AzureAppConfigurationConnectionListItemSchema,
SanitizedAzureAppConfigurationConnectionSchema
} from "@app/services/app-connection/azure-app-configuration";
import {
AzureKeyVaultConnectionListItemSchema,
SanitizedAzureKeyVaultConnectionSchema
} from "@app/services/app-connection/azure-key-vault";
import { GcpConnectionListItemSchema, SanitizedGcpConnectionSchema } from "@app/services/app-connection/gcp";
import { GitHubConnectionListItemSchema, SanitizedGitHubConnectionSchema } from "@app/services/app-connection/github";
import { AuthMode } from "@app/services/auth/auth-type";
@@ -14,14 +21,16 @@ const SanitizedAppConnectionSchema = z.union([
...SanitizedAwsConnectionSchema.options,
...SanitizedGitHubConnectionSchema.options,
...SanitizedGcpConnectionSchema.options,
...SanitizedAzureConnectionSchema.options
...SanitizedAzureKeyVaultConnectionSchema.options,
...SanitizedAzureAppConfigurationConnectionSchema.options
]);
const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
AwsConnectionListItemSchema,
GitHubConnectionListItemSchema,
GcpConnectionListItemSchema,
AzureConnectionListItemSchema
AzureKeyVaultConnectionListItemSchema,
AzureAppConfigurationConnectionListItemSchema
]);
export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

18
backend/src/server/routes/v1/app-connection-routers/azure-app-configuration-connection-router.ts Normal file
View File

@@ -0,0 +1,18 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureAppConfigurationConnectionSchema,
SanitizedAzureAppConfigurationConnectionSchema,
UpdateAzureAppConfigurationConnectionSchema
} from "@app/services/app-connection/azure-app-configuration";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureAppConfigurationConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.AzureAppConfiguration,
server,
sanitizedResponseSchema: SanitizedAzureAppConfigurationConnectionSchema,
createSchema: CreateAzureAppConfigurationConnectionSchema,
updateSchema: UpdateAzureAppConfigurationConnectionSchema
});
};

18
backend/src/server/routes/v1/app-connection-routers/azure-connection-router.ts
View File

@@ -1,18 +0,0 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureConnectionSchema,
SanitizedAzureConnectionSchema,
UpdateAzureConnectionSchema
} from "@app/services/app-connection/azure";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.Azure,
server,
sanitizedResponseSchema: SanitizedAzureConnectionSchema,
createSchema: CreateAzureConnectionSchema,
updateSchema: UpdateAzureConnectionSchema
});
};

18
backend/src/server/routes/v1/app-connection-routers/azure-key-vault-connection-router.ts Normal file
View File

@@ -0,0 +1,18 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
CreateAzureKeyVaultConnectionSchema,
SanitizedAzureKeyVaultConnectionSchema,
UpdateAzureKeyVaultConnectionSchema
} from "@app/services/app-connection/azure-key-vault";
import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
export const registerAzureKeyVaultConnectionRouter = async (server: FastifyZodProvider) => {
registerAppConnectionEndpoints({
app: AppConnection.AzureKeyVault,
server,
sanitizedResponseSchema: SanitizedAzureKeyVaultConnectionSchema,
createSchema: CreateAzureKeyVaultConnectionSchema,
updateSchema: UpdateAzureKeyVaultConnectionSchema
});
};

6
backend/src/server/routes/v1/app-connection-routers/index.ts
View File

@@ -1,7 +1,8 @@
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import { registerAwsConnectionRouter } from "./aws-connection-router";
import { registerAzureConnectionRouter } from "./azure-connection-router";
import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
import { registerAzureKeyVaultConnectionRouter } from "./azure-key-vault-connection-router";
import { registerGcpConnectionRouter } from "./gcp-connection-router";
import { registerGitHubConnectionRouter } from "./github-connection-router";
@@ -12,5 +13,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
[AppConnection.AWS]: registerAwsConnectionRouter,
[AppConnection.GitHub]: registerGitHubConnectionRouter,
[AppConnection.GCP]: registerGcpConnectionRouter,
[AppConnection.Azure]: registerAzureConnectionRouter
[AppConnection.AzureKeyVault]: registerAzureKeyVaultConnectionRouter,
[AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter
};

3
backend/src/services/app-connection/app-connection-enums.ts
View File

@@ -2,7 +2,8 @@ export enum AppConnection {
GitHub = "github",
AWS = "aws",
GCP = "gcp",
Azure = "azure"
AzureKeyVault = "azure-key-vault",
AzureAppConfiguration = "azure-app-configuration"
}
export enum AWSRegion {

23
backend/src/services/app-connection/app-connection-fns.ts
View File

@@ -20,14 +20,24 @@ import {
} from "@app/services/app-connection/github";
import { KmsDataKey } from "@app/services/kms/kms-types";
import { AzureConnectionMethod, getAzureConnectionListItem, validateAzureConnectionCredentials } from "./azure";
import {
AzureAppConfigurationConnectionMethod,
getAzureAppConfigurationConnectionListItem,
validateAzureAppConfigurationConnectionCredentials
} from "./azure-app-configuration";
import {
AzureKeyVaultConnectionMethod,
getAzureKeyVaultConnectionListItem,
validateAzureKeyVaultConnectionCredentials
} from "./azure-key-vault";
export const listAppConnectionOptions = () => {
return [
getAwsAppConnectionListItem(),
getGitHubConnectionListItem(),
getGcpAppConnectionListItem(),
getAzureConnectionListItem()
getAzureKeyVaultConnectionListItem(),
getAzureAppConfigurationConnectionListItem()
].sort((a, b) => a.name.localeCompare(b.name));
};
@@ -84,8 +94,10 @@ export const validateAppConnectionCredentials = async (
return validateGitHubConnectionCredentials(appConnection);
case AppConnection.GCP:
return validateGcpConnectionCredentials(appConnection);
case AppConnection.Azure:
return validateAzureConnectionCredentials(appConnection);
case AppConnection.AzureKeyVault:
return validateAzureKeyVaultConnectionCredentials(appConnection);
case AppConnection.AzureAppConfiguration:
return validateAzureAppConfigurationConnectionCredentials(appConnection);
default:
// eslint-disable-next-line @typescript-eslint/restrict-template-expressions
throw new Error(`Unhandled App Connection ${app}`);
@@ -96,7 +108,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
switch (method) {
case GitHubConnectionMethod.App:
return "GitHub App";
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
case AzureAppConfigurationConnectionMethod.OAuth:
case GitHubConnectionMethod.OAuth:
return "OAuth";
case AwsConnectionMethod.AccessKey:

3
backend/src/services/app-connection/app-connection-maps.ts
View File

@@ -4,5 +4,6 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
[AppConnection.AWS]: "AWS",
[AppConnection.GitHub]: "GitHub",
[AppConnection.GCP]: "GCP",
[AppConnection.Azure]: "Azure"
[AppConnection.AzureKeyVault]: "Azure Key Vault",
[AppConnection.AzureAppConfiguration]: "Azure App Configuration"
};

28
backend/src/services/app-connection/app-connection-service.ts
View File

@@ -27,9 +27,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "@app/services/app-con
import { githubConnectionService } from "@app/services/app-connection/github/github-connection-service";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { KmsDataKey } from "../kms/kms-types";
import { TAppConnectionDALFactory } from "./app-connection-dal";
import { AzureResources } from "./azure";
import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
import { gcpConnectionService } from "./gcp/gcp-connection-service";
@@ -45,7 +44,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
[AppConnection.AWS]: ValidateAwsConnectionCredentialsSchema,
[AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
[AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
[AppConnection.Azure]: ValidateGcpConnectionCredentialsSchema
[AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
[AppConnection.AzureAppConfiguration]: ValidateAzureKeyVaultConnectionCredentialsSchema
};
export const appConnectionServiceFactory = ({
@@ -350,27 +350,7 @@ export const appConnectionServiceFactory = ({
)
);
const { decryptor } = await kmsService.createCipherPairWithDataKey({
type: KmsDataKey.Organization,
orgId: actor.orgId
});
const decryptedConnections = availableConnections.map((connection) => {
const decryptedPlainTextBlob = decryptor({
cipherTextBlob: connection.encryptedCredentials
});
const credentials = JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
return {
...connection,
...(app === AppConnection.Azure && {
azureResource: (credentials as { resource: AzureResources }).resource
})
};
});
return decryptedConnections as Omit<TAppConnection, "credentials">[];
return availableConnections as Omit<TAppConnection, "credentials">[];
};
return {

33
backend/src/services/app-connection/app-connection-types.ts
View File

@@ -12,20 +12,33 @@ import {
} from "@app/services/app-connection/github";
import {
TAzureConnection,
TAzureConnectionConfig,
TAzureConnectionInput,
TValidateAzureConnectionCredentials
} from "./azure";
TAzureAppConfigurationConnection,
TAzureAppConfigurationConnectionConfig,
TAzureAppConfigurationConnectionInput,
TValidateAzureAppConfigurationConnectionCredentials
} from "./azure-app-configuration";
import {
TAzureKeyVaultConnection,
TAzureKeyVaultConnectionConfig,
TAzureKeyVaultConnectionInput,
TValidateAzureKeyVaultConnectionCredentials
} from "./azure-key-vault";
import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection);
export type TAppConnection = { id: string } & (
| TAwsConnection
| TGitHubConnection
| TGcpConnection
| TAzureKeyVaultConnection
| TAzureAppConfigurationConnection
);
export type TAppConnectionInput = { id: string } & (
| TAwsConnectionInput
| TGitHubConnectionInput
| TGcpConnectionInput
| TAzureConnectionInput
| TAzureKeyVaultConnectionInput
| TAzureAppConfigurationConnectionInput
);
export type TCreateAppConnectionDTO = Pick<
@@ -41,10 +54,12 @@ export type TAppConnectionConfig =
| TAwsConnectionConfig
| TGitHubConnectionConfig
| TGcpConnectionConfig
| TAzureConnectionConfig;
| TAzureKeyVaultConnectionConfig
| TAzureAppConfigurationConnectionConfig;
export type TValidateAppConnectionCredentials =
| TValidateAwsConnectionCredentials
| TValidateGitHubConnectionCredentials
| TValidateGcpConnectionCredentials
| TValidateAzureConnectionCredentials;
| TValidateAzureKeyVaultConnectionCredentials
| TValidateAzureAppConfigurationConnectionCredentials;

3
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-enums.ts Normal file
View File

@@ -0,0 +1,3 @@
export enum AzureAppConfigurationConnectionMethod {
OAuth = "oauth"
}

98
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-fns.ts Normal file
View File

@@ -0,0 +1,98 @@
import { AxiosError, AxiosResponse } from "axios";
import { getConfig } from "@app/lib/config/env";
import { request } from "@app/lib/config/request";
import { BadRequestError, InternalServerError } from "@app/lib/errors";
import { getAppConnectionMethodName } from "@app/services/app-connection/app-connection-fns";
import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
import { AppConnection } from "../app-connection-enums";
import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
import {
ExchangeCodeAzureResponse,
TAzureAppConfigurationConnectionConfig
} from "./azure-app-configuration-connection-types";
export const getAzureAppConfigurationConnectionListItem = () => {
const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
return {
name: "Azure App Configuration" as const,
app: AppConnection.AzureAppConfiguration as const,
methods: Object.values(AzureAppConfigurationConnectionMethod) as [AzureAppConfigurationConnectionMethod.OAuth],
oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
};
};
export const validateAzureAppConfigurationConnectionCredentials = async (
config: TAzureAppConfigurationConnectionConfig
) => {
const { credentials: inputCredentials, method } = config;
const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
throw new InternalServerError({
message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
});
}
let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
let tokenError: AxiosError | null = null;
try {
tokenResp = await request.post<ExchangeCodeAzureResponse>(
IntegrationUrls.AZURE_TOKEN_URL.replace("common", inputCredentials.tenantId || "common"),
new URLSearchParams({
grant_type: "authorization_code",
code: inputCredentials.code,
scope: `openid offline_access https://azconfig.io/.default`,
client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
})
);
} catch (e: unknown) {
if (e instanceof AxiosError) {
tokenError = e;
} else {
throw new BadRequestError({
message: `Unable to validate connection - verify credentials`
});
}
}
if (tokenError) {
if (tokenError instanceof AxiosError) {
throw new BadRequestError({
message: `Failed to get access token: ${
(tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
}`
});
} else {
throw new InternalServerError({
message: "Failed to get access token"
});
}
}
if (!tokenResp) {
throw new InternalServerError({
message: `Failed to get access token: Token was empty with no error`
});
}
switch (method) {
case AzureAppConfigurationConnectionMethod.OAuth:
return {
tenantId: inputCredentials.tenantId,
accessToken: tokenResp.data.access_token,
refreshToken: tokenResp.data.refresh_token,
expiresAt: Date.now() + tokenResp.data.expires_in * 1000
};
default:
throw new InternalServerError({
message: `Unhandled Azure connection method: ${method as AzureAppConfigurationConnectionMethod}`
});
}
};

77
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-schemas.ts Normal file
View File

@@ -0,0 +1,77 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
export const AzureAppConfigurationConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional()
});
export const AzureAppConfigurationConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number()
});
export const ValidateAzureAppConfigurationConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(AzureAppConfigurationConnectionMethod.OAuth)
.describe(AppConnections.CREATE(AppConnection.AzureAppConfiguration).method),
credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.AzureAppConfiguration).credentials
)
})
]);
export const CreateAzureAppConfigurationConnectionSchema = ValidateAzureAppConfigurationConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration)
);
export const UpdateAzureAppConfigurationConnectionSchema = z
.object({
credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.AzureAppConfiguration).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration));
const BaseAzureAppConfigurationConnectionSchema = BaseAppConnectionSchema.extend({
app: z.literal(AppConnection.AzureAppConfiguration)
});
export const AzureAppConfigurationConnectionSchema = z.intersection(
BaseAzureAppConfigurationConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureAppConfigurationConnectionSchema = z.discriminatedUnion("method", [
BaseAzureAppConfigurationConnectionSchema.extend({
method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema.pick({
resource: true,
tenantId: true
})
})
]);
export const AzureAppConfigurationConnectionListItemSchema = z.object({
name: z.literal("Azure App Configuration"),
app: z.literal(AppConnection.AzureAppConfiguration),
methods: z.nativeEnum(AzureAppConfigurationConnectionMethod).array(),
oauthClientId: z.string().optional()
});

41
backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-types.ts Normal file
View File

@@ -0,0 +1,41 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureAppConfigurationConnectionOAuthOutputCredentialsSchema,
AzureAppConfigurationConnectionSchema,
CreateAzureAppConfigurationConnectionSchema,
ValidateAzureAppConfigurationConnectionCredentialsSchema
} from "./azure-app-configuration-connection-schemas";
export type TAzureAppConfigurationConnection = z.infer<typeof AzureAppConfigurationConnectionSchema>;
export type TAzureAppConfigurationConnectionInput = z.infer<typeof CreateAzureAppConfigurationConnectionSchema> & {
app: AppConnection.AzureAppConfiguration;
};
export type TValidateAzureAppConfigurationConnectionCredentials =
typeof ValidateAzureAppConfigurationConnectionCredentialsSchema;
export type TAzureAppConfigurationConnectionConfig = DiscriminativePick<
TAzureAppConfigurationConnectionInput,
"method" | "app" | "credentials"
> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureAppConfigurationConnectionCredentials = z.infer<
typeof AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
>;

4
backend/src/services/app-connection/azure-app-configuration/index.ts Normal file
View File

@@ -0,0 +1,4 @@
export * from "./azure-app-configuration-connection-enums";
export * from "./azure-app-configuration-connection-fns";
export * from "./azure-app-configuration-connection-schemas";
export * from "./azure-app-configuration-connection-types";

3
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-enums.ts Normal file
View File

@@ -0,0 +1,3 @@
export enum AzureKeyVaultConnectionMethod {
OAuth = "oauth"
}

48
backend/src/services/app-connection/azure/azure-connection-fns.ts → backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts
View File

@@ -13,17 +13,12 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TAppConnectionDALFactory } from "../app-connection-dal";
import { AppConnection } from "../app-connection-enums";
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
import {
ExchangeCodeAzureResponse,
TAzureConnectionConfig,
TAzureConnectionCredentials
} from "./azure-connection-types";
const resourceScopes: Record<AzureResources, string> = {
[AzureResources.AppConfiguration]: "https://azconfig.io/.default",
[AzureResources.KeyVault]: "https://vault.azure.net/.default"
};
TAzureKeyVaultConnectionConfig,
TAzureKeyVaultConnectionCredentials
} from "./azure-key-vault-connection-types";
export const getAzureConnectionAccessToken = async (
connectionId: string,
@@ -31,6 +26,11 @@ export const getAzureConnectionAccessToken = async (
kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
) => {
const appCfg = getConfig();
if (!appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID || !appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
throw new BadRequestError({
message: `Azure environment variables have not been configured`
});
}
const appConnection = await appConnectionDAL.findById(connectionId);
@@ -38,23 +38,23 @@ export const getAzureConnectionAccessToken = async (
throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
}
if (appConnection.app !== AppConnection.Azure) {
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure connection` });
if (appConnection.app !== AppConnection.AzureKeyVault && appConnection.app !== AppConnection.AzureAppConfiguration) {
throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` });
}
const credentials = (await decryptAppConnectionCredentials({
orgId: appConnection.orgId,
kmsService,
encryptedCredentials: appConnection.encryptedCredentials
})) as TAzureConnectionCredentials;
})) as TAzureKeyVaultConnectionCredentials;
const { data } = await request.post<ExchangeCodeAzureResponse>(
IntegrationUrls.AZURE_TOKEN_URL.replace("common", credentials.tenantId || "common"),
new URLSearchParams({
grant_type: "refresh_token",
scope: `openid offline_access`,
client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID!,
client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET!,
client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
refresh_token: credentials.refreshToken
})
);
@@ -87,18 +87,18 @@ export const getAzureConnectionAccessToken = async (
};
};
export const getAzureConnectionListItem = () => {
export const getAzureKeyVaultConnectionListItem = () => {
const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
return {
name: "Azure" as const,
app: AppConnection.Azure as const,
methods: Object.values(AzureConnectionMethod) as [AzureConnectionMethod.OAuth],
name: "Azure Key Vault" as const,
app: AppConnection.AzureKeyVault as const,
methods: Object.values(AzureKeyVaultConnectionMethod) as [AzureKeyVaultConnectionMethod.OAuth],
oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
};
};
export const validateAzureConnectionCredentials = async (config: TAzureConnectionConfig) => {
export const validateAzureKeyVaultConnectionCredentials = async (config: TAzureKeyVaultConnectionConfig) => {
const { credentials: inputCredentials, method } = config;
const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
@@ -118,7 +118,7 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
new URLSearchParams({
grant_type: "authorization_code",
code: inputCredentials.code,
scope: `openid offline_access ${resourceScopes[inputCredentials.resource]}`,
scope: `openid offline_access https://vault.azure.net/.default`,
client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
@@ -155,16 +155,16 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
}
switch (method) {
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
return {
tenantId: inputCredentials.tenantId,
accessToken: tokenResp.data.access_token,
refreshToken: tokenResp.data.refresh_token,
expiresAt: Date.now() + tokenResp.data.expires_in * 1000,
resource: inputCredentials.resource
expiresAt: Date.now() + tokenResp.data.expires_in * 1000
};
default:
throw new InternalServerError({
message: `Unhandled Azure connection method: ${method as AzureConnectionMethod}`
message: `Unhandled Azure connection method: ${method as AzureKeyVaultConnectionMethod}`
});
}
};

77
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-schemas.ts Normal file
View File

@@ -0,0 +1,77 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
export const AzureKeyVaultConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional()
});
export const AzureKeyVaultConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number()
});
export const ValidateAzureKeyVaultConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z
.literal(AzureKeyVaultConnectionMethod.OAuth)
.describe(AppConnections.CREATE(AppConnection.AzureKeyVault).method),
credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.AzureKeyVault).credentials
)
})
]);
export const CreateAzureKeyVaultConnectionSchema = ValidateAzureKeyVaultConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.AzureKeyVault)
);
export const UpdateAzureKeyVaultConnectionSchema = z
.object({
credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.AzureKeyVault).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureKeyVault));
const BaseAzureKeyVaultConnectionSchema = BaseAppConnectionSchema.extend({
app: z.literal(AppConnection.AzureKeyVault)
});
export const AzureKeyVaultConnectionSchema = z.intersection(
BaseAzureKeyVaultConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureKeyVaultConnectionSchema = z.discriminatedUnion("method", [
BaseAzureKeyVaultConnectionSchema.extend({
method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema.pick({
resource: true,
tenantId: true
})
})
]);
export const AzureKeyVaultConnectionListItemSchema = z.object({
name: z.literal("Azure Key Vault"),
app: z.literal(AppConnection.AzureKeyVault),
methods: z.nativeEnum(AzureKeyVaultConnectionMethod).array(),
oauthClientId: z.string().optional()
});

38
backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-types.ts Normal file
View File

@@ -0,0 +1,38 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureKeyVaultConnectionOAuthOutputCredentialsSchema,
AzureKeyVaultConnectionSchema,
CreateAzureKeyVaultConnectionSchema,
ValidateAzureKeyVaultConnectionCredentialsSchema
} from "./azure-key-vault-connection-schemas";
export type TAzureKeyVaultConnection = z.infer<typeof AzureKeyVaultConnectionSchema>;
export type TAzureKeyVaultConnectionInput = z.infer<typeof CreateAzureKeyVaultConnectionSchema> & {
app: AppConnection.AzureKeyVault;
};
export type TValidateAzureKeyVaultConnectionCredentials = typeof ValidateAzureKeyVaultConnectionCredentialsSchema;
export type TAzureKeyVaultConnectionConfig = DiscriminativePick<
TAzureKeyVaultConnectionInput,
"method" | "app" | "credentials"
> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureKeyVaultConnectionCredentials = z.infer<typeof AzureKeyVaultConnectionOAuthOutputCredentialsSchema>;

4
backend/src/services/app-connection/azure-key-vault/index.ts Normal file
View File

@@ -0,0 +1,4 @@
export * from "./azure-key-vault-connection-enums";
export * from "./azure-key-vault-connection-fns";
export * from "./azure-key-vault-connection-schemas";
export * from "./azure-key-vault-connection-types";

8
backend/src/services/app-connection/azure/azure-connection-enums.ts
View File

@@ -1,8 +0,0 @@
export enum AzureConnectionMethod {
OAuth = "oauth"
}
export enum AzureResources {
KeyVault = "key-vault",
AppConfiguration = "app-configuration"
}

74
backend/src/services/app-connection/azure/azure-connection-schemas.ts
View File

@@ -1,74 +0,0 @@
import { z } from "zod";
import { AppConnections } from "@app/lib/api-docs";
import { AppConnection } from "@app/services/app-connection/app-connection-enums";
import {
BaseAppConnectionSchema,
GenericCreateAppConnectionFieldsSchema,
GenericUpdateAppConnectionFieldsSchema
} from "@app/services/app-connection/app-connection-schemas";
import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
export const AzureConnectionOAuthInputCredentialsSchema = z.object({
code: z.string().trim().min(1, "OAuth code required"),
tenantId: z.string().trim().optional(),
resource: z.nativeEnum(AzureResources)
});
export const AzureConnectionOAuthOutputCredentialsSchema = z.object({
tenantId: z.string().optional(),
accessToken: z.string(),
refreshToken: z.string(),
expiresAt: z.number(), // unix timestamp,
resource: z.nativeEnum(AzureResources)
});
export const ValidateAzureConnectionCredentialsSchema = z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.Azure).method),
credentials: AzureConnectionOAuthInputCredentialsSchema.describe(
AppConnections.CREATE(AppConnection.Azure).credentials
)
})
]);
export const CreateAzureConnectionSchema = ValidateAzureConnectionCredentialsSchema.and(
GenericCreateAppConnectionFieldsSchema(AppConnection.Azure)
);
export const UpdateAzureConnectionSchema = z
.object({
credentials: AzureConnectionOAuthInputCredentialsSchema.optional().describe(
AppConnections.UPDATE(AppConnection.Azure).credentials
)
})
.and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Azure));
const BaseAzureConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Azure) });
export const AzureConnectionSchema = z.intersection(
BaseAzureConnectionSchema,
z.discriminatedUnion("method", [
z.object({
method: z.literal(AzureConnectionMethod.OAuth),
credentials: AzureConnectionOAuthOutputCredentialsSchema
})
])
);
export const SanitizedAzureConnectionSchema = z.discriminatedUnion("method", [
BaseAzureConnectionSchema.extend({
method: z.literal(AzureConnectionMethod.OAuth),
credentials: AzureConnectionOAuthOutputCredentialsSchema.pick({
resource: true
})
})
]);
export const AzureConnectionListItemSchema = z.object({
name: z.literal("Azure"),
app: z.literal(AppConnection.Azure),
methods: z.nativeEnum(AzureConnectionMethod).array(),
oauthClientId: z.string().optional()
});

35
backend/src/services/app-connection/azure/azure-connection-types.ts
View File

@@ -1,35 +0,0 @@
import z from "zod";
import { DiscriminativePick } from "@app/lib/types";
import { AppConnection } from "../app-connection-enums";
import {
AzureConnectionOAuthOutputCredentialsSchema,
AzureConnectionSchema,
CreateAzureConnectionSchema,
ValidateAzureConnectionCredentialsSchema
} from "./azure-connection-schemas";
export type TAzureConnection = z.infer<typeof AzureConnectionSchema>;
export type TAzureConnectionInput = z.infer<typeof CreateAzureConnectionSchema> & {
app: AppConnection.Azure;
};
export type TValidateAzureConnectionCredentials = typeof ValidateAzureConnectionCredentialsSchema;
export type TAzureConnectionConfig = DiscriminativePick<TAzureConnectionInput, "method" | "app" | "credentials"> & {
orgId: string;
};
export type ExchangeCodeAzureResponse = {
token_type: string;
scope: string;
expires_in: number;
ext_expires_in: number;
access_token: string;
refresh_token: string;
id_token: string;
};
export type TAzureConnectionCredentials = z.infer<typeof AzureConnectionOAuthOutputCredentialsSchema>;

4
backend/src/services/app-connection/azure/index.ts
View File

@@ -1,4 +0,0 @@
export * from "./azure-connection-enums";
export * from "./azure-connection-fns";
export * from "./azure-connection-schemas";
export * from "./azure-connection-types";

4
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-constants.ts
View File

@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
export const AZURE_APP_CONFIGURATION_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Azure App Configuration",
destination: SecretSync.AzureAppConfiguration,
connection: AppConnection.Azure,
canImportSecrets: false
connection: AppConnection.AzureAppConfiguration,
canImportSecrets: true
};

2
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-fns.ts
View File

@@ -4,7 +4,7 @@ import https from "https";
import { request } from "@app/lib/config/request";
import { BadRequestError } from "@app/lib/errors";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
import { isAzureKeyVaultReference } from "@app/services/integration-auth/integration-sync-secret-fns";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";

4
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-schemas.ts
View File

@@ -40,7 +40,7 @@ export const UpdateAzureAppConfigurationSyncSchema = GenericUpdateSecretSyncFiel
export const AzureAppConfigurationSyncListItemSchema = z.object({
name: z.literal("Azure App Configuration"),
connection: z.literal(AppConnection.Azure),
connection: z.literal(AppConnection.AzureAppConfiguration),
destination: z.literal(SecretSync.AzureAppConfiguration),
canImportSecrets: z.literal(false)
canImportSecrets: z.literal(true)
});

4
backend/src/services/secret-sync/azure-app-configuration/azure-app-configuration-sync-types.ts
View File

@@ -1,6 +1,6 @@
import { z } from "zod";
import { TAzureConnection } from "@app/services/app-connection/azure";
import { TAzureAppConfigurationConnection } from "@app/services/app-connection/azure-app-configuration";
import {
AzureAppConfigurationSyncListItemSchema,
@@ -15,5 +15,5 @@ export type TAzureAppConfigurationSyncInput = z.infer<typeof CreateAzureAppConfi
export type TAzureAppConfigurationSyncListItem = z.infer<typeof AzureAppConfigurationSyncListItemSchema>;
export type TAzureAppConfigurationSyncWithCredentials = TAzureAppConfigurationSync & {
connection: TAzureConnection;
connection: TAzureAppConfigurationConnection;
};

4
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-constants.ts
View File

@@ -5,6 +5,6 @@ import { TSecretSyncListItem } from "@app/services/secret-sync/secret-sync-types
export const AZURE_KEY_VAULT_SYNC_LIST_OPTION: TSecretSyncListItem = {
name: "Azure Key Vault",
destination: SecretSync.AzureKeyVault,
connection: AppConnection.Azure,
canImportSecrets: false
connection: AppConnection.AzureKeyVault,
canImportSecrets: true
};

6
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-fns.ts
View File

@@ -3,7 +3,7 @@ import { AxiosError } from "axios";
import { request } from "@app/lib/config/request";
import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure";
import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
import { TKmsServiceFactory } from "@app/services/kms/kms-service";
import { TSecretMap } from "@app/services/secret-sync/secret-sync-types";
@@ -172,6 +172,10 @@ export const azureKeyVaultSecretSyncFactory = ({
}
}
}
if (!isSecretSet) {
throw new Error(`Failed to set secret ${key}`);
}
};
for await (const setSecret of setSecrets) {

6
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-schemas.ts
View File

@@ -10,7 +10,7 @@ import {
import { TSyncOptionsConfig } from "@app/services/secret-sync/secret-sync-types";
const AzureKeyVaultSyncDestinationConfigSchema = z.object({
vaultBaseUrl: z.string().min(1, "Vault base URL required")
vaultBaseUrl: z.string().url("Invalid vault base URL format").min(1, "Vault base URL required")
});
const AzureKeyVaultSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: false };
@@ -39,7 +39,7 @@ export const UpdateAzureKeyVaultSyncSchema = GenericUpdateSecretSyncFieldsSchema
export const AzureKeyVaultSyncListItemSchema = z.object({
name: z.literal("Azure Key Vault"),
connection: z.literal(AppConnection.Azure),
connection: z.literal(AppConnection.AzureKeyVault),
destination: z.literal(SecretSync.AzureKeyVault),
canImportSecrets: z.literal(false)
canImportSecrets: z.literal(true)
});

4
backend/src/services/secret-sync/azure-key-vault/azure-key-vault-sync-types.ts
View File

@@ -1,6 +1,6 @@
import { z } from "zod";
import { TAzureConnection } from "@app/services/app-connection/azure";
import { TAzureKeyVaultConnection } from "@app/services/app-connection/azure-key-vault";
import {
AzureKeyVaultSyncListItemSchema,
@@ -15,7 +15,7 @@ export type TAzureKeyVaultSyncInput = z.infer<typeof CreateAzureKeyVaultSyncSche
export type TAzureKeyVaultSyncListItem = z.infer<typeof AzureKeyVaultSyncListItemSchema>;
export type TAzureKeyVaultSyncWithCredentials = TAzureKeyVaultSync & {
connection: TAzureConnection;
connection: TAzureKeyVaultConnection;
};
export interface GetAzureKeyVaultSecret {

60
backend/src/services/secret-sync/secret-sync-fns.ts
View File

@@ -93,16 +93,6 @@ export const SecretSyncFns = {
): Promise<void> => {
// const affixedSecretMap = addAffixes(secretSync, secretMap);
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
return AwsParameterStoreSyncFns.syncSecrets(secretSync, secretMap);
@@ -113,9 +103,15 @@ export const SecretSyncFns = {
case SecretSync.GCPSecretManager:
return GcpSyncFns.syncSecrets(secretSync, secretMap);
case SecretSync.AzureKeyVault:
return azureKeyVaultSecretSync.syncSecrets(secretSync, secretMap);
return azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).syncSecrets(secretSync, secretMap);
case SecretSync.AzureAppConfiguration:
return azureAppConfigurationSecretSync.syncSecrets(secretSync, secretMap);
return azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).syncSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for sync secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`
@@ -126,16 +122,6 @@ export const SecretSyncFns = {
secretSync: TSecretSyncWithCredentials,
{ kmsService, appConnectionDAL }: TSyncSecretDeps
): Promise<TSecretMap> => {
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
let secretMap: TSecretMap;
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
@@ -151,10 +137,16 @@ export const SecretSyncFns = {
secretMap = await GcpSyncFns.getSecrets(secretSync);
break;
case SecretSync.AzureKeyVault:
secretMap = await azureKeyVaultSecretSync.getSecrets(secretSync);
secretMap = await azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).getSecrets(secretSync);
break;
case SecretSync.AzureAppConfiguration:
secretMap = await azureAppConfigurationSecretSync.getSecrets(secretSync);
secretMap = await azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).getSecrets(secretSync);
break;
default:
throw new Error(
@@ -172,16 +164,6 @@ export const SecretSyncFns = {
): Promise<void> => {
// const affixedSecretMap = addAffixes(secretSync, secretMap);
const azureKeyVaultSecretSync = azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
});
const azureAppConfigurationSecretSync = azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
});
switch (secretSync.destination) {
case SecretSync.AWSParameterStore:
return AwsParameterStoreSyncFns.removeSecrets(secretSync, secretMap);
@@ -192,9 +174,15 @@ export const SecretSyncFns = {
case SecretSync.GCPSecretManager:
return GcpSyncFns.removeSecrets(secretSync, secretMap);
case SecretSync.AzureKeyVault:
return azureKeyVaultSecretSync.removeSecrets(secretSync, secretMap);
return azureKeyVaultSecretSyncFactory({
appConnectionDAL,
kmsService
}).removeSecrets(secretSync, secretMap);
case SecretSync.AzureAppConfiguration:
return azureAppConfigurationSecretSync.removeSecrets(secretSync, secretMap);
return azureAppConfigurationSecretSyncFactory({
appConnectionDAL,
kmsService
}).removeSecrets(secretSync, secretMap);
default:
throw new Error(
`Unhandled sync destination for remove secrets fns: ${(secretSync as TSecretSyncWithCredentials).destination}`

4
backend/src/services/secret-sync/secret-sync-maps.ts
View File

@@ -15,6 +15,6 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.AWSSecretsManager]: AppConnection.AWS,
[SecretSync.GitHub]: AppConnection.GitHub,
[SecretSync.GCPSecretManager]: AppConnection.GCP,
[SecretSync.AzureKeyVault]: AppConnection.Azure,
[SecretSync.AzureAppConfiguration]: AppConnection.Azure
[SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
[SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration
};

9
frontend/src/components/secret-syncs/forms/SecretSyncConnectionField.tsx
View File

@@ -18,9 +18,6 @@ import { TSecretSyncForm } from "./schemas";
type Props = {
onChange?: VoidFunction;
filterConnections?: (
connections?: TAvailableAppConnection[]
) => TAvailableAppConnection[] | undefined;
};
export const SecretSyncConnectionField = ({ onChange: callback, filterConnections }: Props) => {
@@ -30,7 +27,7 @@ export const SecretSyncConnectionField = ({ onChange: callback, filterConnection
const destination = watch("destination");
const app = SECRET_SYNC_CONNECTION_MAP[destination];
const { data: allConnections, isLoading } = useListAvailableAppConnections(app);
const { data: availableConnections, isLoading } = useListAvailableAppConnections(app);
const connectionName = APP_CONNECTION_MAP[app].name;
@@ -39,10 +36,6 @@ export const SecretSyncConnectionField = ({ onChange: callback, filterConnection
OrgPermissionSubjects.AppConnections
);
const availableConnections = useMemo(() => {
return filterConnections ? filterConnections(allConnections) : allConnections;
}, [allConnections]);
const appName = APP_CONNECTION_MAP[SECRET_SYNC_CONNECTION_MAP[destination]].name;
return (

11
frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/AzureAppConfigurationSyncFields.tsx
View File

@@ -2,8 +2,6 @@ import { Controller, useFormContext } from "react-hook-form";
import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
import { FormControl, Input } from "@app/components/v2";
import { AzureResources } from "@app/hooks/api/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { SecretSync } from "@app/hooks/api/secretSyncs";
import { TSecretSyncForm } from "../schemas";
@@ -19,15 +17,6 @@ export const AzureAppConfigurationSyncFields = () => {
onChange={() => {
setValue("destinationConfig.configurationUrl", "");
}}
filterConnections={(connections) => {
if (!connections) return connections;
return connections.filter(
(connection) =>
connection.app === AppConnection.Azure &&
connection.azureResource === AzureResources.AppConfiguration
);
}}
/>
<Controller
name="destinationConfig.configurationUrl"

11
frontend/src/components/secret-syncs/forms/SecretSyncDestinationFields/AzureKeyVaultSyncFields.tsx
View File

@@ -2,8 +2,6 @@ import { Controller, useFormContext } from "react-hook-form";
import { SecretSyncConnectionField } from "@app/components/secret-syncs/forms/SecretSyncConnectionField";
import { FormControl, Input } from "@app/components/v2";
import { AzureResources } from "@app/hooks/api/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { SecretSync } from "@app/hooks/api/secretSyncs";
import { TSecretSyncForm } from "../schemas";
@@ -19,15 +17,6 @@ export const AzureKeyVaultSyncFields = () => {
onChange={() => {
setValue("destinationConfig.vaultBaseUrl", "");
}}
filterConnections={(connections) => {
if (!connections) return connections;
return connections.filter(
(connection) =>
connection.app === AppConnection.Azure &&
connection.azureResource === AzureResources.KeyVault
);
}}
/>
<Controller
name="destinationConfig.vaultBaseUrl"

2
frontend/src/components/secret-syncs/forms/schemas/azure-key-vault-sync-destination-schema.ts
View File

@@ -5,6 +5,6 @@ import { SecretSync } from "@app/hooks/api/secretSyncs";
export const AzureKeyVaultSyncDestinationSchema = z.object({
destination: z.literal(SecretSync.AzureKeyVault),
destinationConfig: z.object({
vaultBaseUrl: z.string().min(1, "Vault Base URL required")
vaultBaseUrl: z.string().url("Invalid vault base URL format").min(1, "Vault base URL required")
})
});

10
frontend/src/helpers/appConnections.ts
View File

@@ -4,6 +4,8 @@ import { faKey, faPassport, faUser } from "@fortawesome/free-solid-svg-icons";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import {
AwsConnectionMethod,
AzureAppConfigurationConnectionMethod,
AzureKeyVaultConnectionMethod,
GcpConnectionMethod,
GitHubConnectionMethod,
TAppConnection
@@ -16,13 +18,19 @@ export const APP_CONNECTION_MAP: Record<AppConnection, { name: string; image: st
name: "GCP",
image: "Google Cloud Platform.png"
},
[AppConnection.Azure]: { name: "Azure", image: "Microsoft Azure.png" }
[AppConnection.AzureKeyVault]: { name: "Azure Key Vault", image: "Microsoft Azure.png" },
[AppConnection.AzureAppConfiguration]: {
name: "Azure App Configuration",
image: "Microsoft Azure.png"
}
};
export const getAppConnectionMethodDetails = (method: TAppConnection["method"]) => {
switch (method) {
case GitHubConnectionMethod.App:
return { name: "GitHub App", icon: faGithub };
case AzureKeyVaultConnectionMethod.OAuth:
case AzureAppConfigurationConnectionMethod.OAuth:
case GitHubConnectionMethod.OAuth:
return { name: "OAuth", icon: faPassport };
case AwsConnectionMethod.AccessKey:

4
frontend/src/helpers/secretSyncs.ts
View File

@@ -22,8 +22,8 @@ export const SECRET_SYNC_CONNECTION_MAP: Record<SecretSync, AppConnection> = {
[SecretSync.AWSSecretsManager]: AppConnection.AWS,
[SecretSync.GitHub]: AppConnection.GitHub,
[SecretSync.GCPSecretManager]: AppConnection.GCP,
[SecretSync.AzureKeyVault]: AppConnection.Azure,
[SecretSync.AzureAppConfiguration]: AppConnection.Azure
[SecretSync.AzureKeyVault]: AppConnection.AzureKeyVault,
[SecretSync.AzureAppConfiguration]: AppConnection.AzureAppConfiguration
};
export const SECRET_SYNC_INITIAL_SYNC_BEHAVIOR_MAP: Record<

3
frontend/src/hooks/api/appConnections/enums.ts
View File

@@ -2,5 +2,6 @@ export enum AppConnection {
AWS = "aws",
GitHub = "github",
GCP = "gcp",
Azure = "azure"
AzureKeyVault = "azure-key-vault",
AzureAppConfiguration = "azure-app-configuration"
}

12
frontend/src/hooks/api/appConnections/types/app-options.ts
View File

@@ -20,8 +20,13 @@ export type TGcpConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.GCP;
};
export type TAzureConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.Azure;
export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.AzureKeyVault;
oauthClientId?: string;
};
export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
app: AppConnection.AzureKeyVault;
oauthClientId?: string;
};
@@ -31,5 +36,6 @@ export type TAppConnectionOptionMap = {
[AppConnection.AWS]: TAwsConnectionOption;
[AppConnection.GitHub]: TGitHubConnectionOption;
[AppConnection.GCP]: TGcpConnectionOption;
[AppConnection.Azure]: TAzureConnectionOption;
[AppConnection.AzureKeyVault]: TAzureKeyVaultConnectionOption;
[AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnectionOption;
};

16
frontend/src/hooks/api/appConnections/types/azure-app-configuration-connection.ts Normal file
View File

@@ -0,0 +1,16 @@
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
export enum AzureAppConfigurationConnectionMethod {
OAuth = "oauth"
}
export type TAzureAppConfigurationConnection = TRootAppConnection & {
app: AppConnection.AzureAppConfiguration;
} & {
method: AzureAppConfigurationConnectionMethod.OAuth;
credentials: {
code: string;
tenantId?: string;
};
};

26
frontend/src/hooks/api/appConnections/types/azure-connection.ts
View File

@@ -1,26 +0,0 @@
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
export enum AzureConnectionMethod {
OAuth = "oauth"
}
export enum AzureResources {
KeyVault = "key-vault",
AppConfiguration = "app-configuration"
}
export const azureResourcesMap: Record<AzureResources, string> = {
[AzureResources.AppConfiguration]: "App Configuration",
[AzureResources.KeyVault]: "Key Vault"
};
export type TAzureConnection = TRootAppConnection & { app: AppConnection.Azure } & {
method: AzureConnectionMethod.OAuth;
resource: AzureResources;
credentials: {
code: string;
tenantId?: string;
resource: AzureResources;
};
};

14
frontend/src/hooks/api/appConnections/types/azure-key-vault-connection.ts Normal file
View File

@@ -0,0 +1,14 @@
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { TRootAppConnection } from "@app/hooks/api/appConnections/types/root-connection";
export enum AzureKeyVaultConnectionMethod {
OAuth = "oauth"
}
export type TAzureKeyVaultConnection = TRootAppConnection & { app: AppConnection.AzureKeyVault } & {
method: AzureKeyVaultConnectionMethod.OAuth;
credentials: {
code: string;
tenantId?: string;
};
};

23
frontend/src/hooks/api/appConnections/types/index.ts
View File

@@ -3,22 +3,24 @@ import { TAppConnectionOption } from "@app/hooks/api/appConnections/types/app-op
import { TAwsConnection } from "@app/hooks/api/appConnections/types/aws-connection";
import { TGitHubConnection } from "@app/hooks/api/appConnections/types/github-connection";
import { AzureResources, TAzureConnection } from "./azure-connection";
import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
import { TAzureKeyVaultConnection } from "./azure-key-vault-connection";
import { TGcpConnection } from "./gcp-connection";
export * from "./aws-connection";
export * from "./azure-connection";
export * from "./azure-app-configuration-connection";
export * from "./azure-key-vault-connection";
export * from "./gcp-connection";
export * from "./github-connection";
export type TAppConnection = TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection;
export type TAppConnection =
| TAwsConnection
| TGitHubConnection
| TGcpConnection
| TAzureKeyVaultConnection
| TAzureAppConfigurationConnection;
export type TAvailableAppConnection =
| (Pick<TAppConnection, "name" | "id"> & { app: Exclude<AppConnection, AppConnection.Azure> })
| (Pick<TAppConnection, "name" | "id"> & {
app: AppConnection.Azure;
azureResource?: AzureResources;
});
export type TAvailableAppConnection = Pick<TAppConnection, "name" | "id">;
export type TListAppConnections<T extends TAppConnection> = { appConnections: T[] };
export type TGetAppConnection<T extends TAppConnection> = { appConnection: T };
@@ -47,5 +49,6 @@ export type TAppConnectionMap = {
[AppConnection.AWS]: TAwsConnection;
[AppConnection.GitHub]: TGitHubConnection;
[AppConnection.GCP]: TGcpConnection;
[AppConnection.Azure]: TAzureConnection;
[AppConnection.AzureKeyVault]: TAzureKeyVaultConnection;
[AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
};

2
frontend/src/hooks/api/secretSyncs/types/azure-app-configuration-sync.ts
View File

@@ -9,7 +9,7 @@ export type TAzureAppConfigurationSync = TRootSecretSync & {
label?: string;
};
connection: {
app: AppConnection.Azure;
app: AppConnection.AzureAppConfiguration;
name: string;
id: string;
};

2
frontend/src/hooks/api/secretSyncs/types/azure-key-vault-sync.ts
View File

@@ -8,7 +8,7 @@ export type TAzureKeyVaultSync = TRootSecretSync & {
vaultBaseUrl: string;
};
connection: {
app: AppConnection.Azure;
app: AppConnection.AzureKeyVault;
name: string;
id: string;
};

94
frontend/src/pages/organization/AppConnections/OauthCallbackPage/OauthCallbackPage.tsx
View File

@@ -5,9 +5,10 @@ import { createNotification } from "@app/components/notifications";
import { ContentLoader } from "@app/components/v2";
import { ROUTE_PATHS } from "@app/const/routes";
import {
AzureConnectionMethod,
AzureResources,
AzureAppConfigurationConnectionMethod,
AzureKeyVaultConnectionMethod,
GitHubConnectionMethod,
TAzureKeyVaultConnection,
TGitHubConnection,
useCreateAppConnection,
useUpdateAppConnection
@@ -22,18 +23,20 @@ type GithubFormData = Pick<TGitHubConnection, "name" | "method" | "description">
type AzureFormData = Pick<TGitHubConnection, "name" | "method" | "description"> & {
returnUrl?: string;
connectionId?: string;
tenantId?: string;
resource: AzureResources;
};
} & Pick<TAzureKeyVaultConnection["credentials"], "tenantId">;
type FormDataMap = {
[AppConnection.GitHub]: GithubFormData & { app: AppConnection.GitHub };
[AppConnection.Azure]: AzureFormData & { app: AppConnection.Azure };
[AppConnection.AzureKeyVault]: AzureFormData & { app: AppConnection.AzureKeyVault };
[AppConnection.AzureAppConfiguration]: AzureFormData & {
app: AppConnection.AzureAppConfiguration;
};
};
const formDataStorageFieldMap: Partial<Record<AppConnection, string>> = {
[AppConnection.GitHub]: "githubConnectionFormData",
[AppConnection.Azure]: "azureConnectionFormData"
[AppConnection.AzureKeyVault]: "azureKeyVaultConnectionFormData",
[AppConnection.AzureAppConfiguration]: "azureAppConfigurationConnectionFormData"
};
export const OAuthCallbackPage = () => {
@@ -44,7 +47,7 @@ export const OAuthCallbackPage = () => {
from: ROUTE_PATHS.Organization.AppConnections.OauthCallbackPage.id
});
const appConnection = useParams({
const rawAppConnection = useParams({
strict: false,
select: (el) => el?.appConnection as AppConnection
});
@@ -52,7 +55,10 @@ export const OAuthCallbackPage = () => {
const updateAppConnection = useUpdateAppConnection();
const createAppConnection = useCreateAppConnection();
const { code, state, installation_id: installationId } = search;
const { code, state: rawState, installation_id: installationId } = search;
const state = rawState.includes("<:>") ? rawState.split("<:>")[0] : rawState;
const appConnection = rawState.includes("<:>") ? rawState.split("<:>")[1] : rawAppConnection;
const clearState = (app: AppConnection) => {
if (state !== localStorage.getItem("latestCSRFToken")) {
@@ -85,18 +91,18 @@ export const OAuthCallbackPage = () => {
}
};
const handleAzure = useCallback(async () => {
const formData = getFormData(AppConnection.Azure);
const handleAzureKeyVault = useCallback(async () => {
const formData = getFormData(AppConnection.AzureKeyVault);
if (formData === null) return null;
clearState(AppConnection.Azure);
clearState(AppConnection.AzureKeyVault);
const { connectionId, name, description, returnUrl } = formData;
try {
if (connectionId) {
await updateAppConnection.mutateAsync({
app: AppConnection.Azure,
app: AppConnection.AzureKeyVault,
connectionId,
credentials: {
code: code as string
@@ -104,12 +110,11 @@ export const OAuthCallbackPage = () => {
});
} else {
await createAppConnection.mutateAsync({
app: AppConnection.Azure,
app: AppConnection.AzureKeyVault,
name,
description,
method: AzureConnectionMethod.OAuth,
method: AzureKeyVaultConnectionMethod.OAuth,
credentials: {
resource: formData.resource,
tenantId: formData.tenantId,
code: code as string
}
@@ -133,6 +138,52 @@ export const OAuthCallbackPage = () => {
};
}, []);
const handleAzureAppConfiguration = useCallback(async () => {
const formData = getFormData(AppConnection.AzureAppConfiguration);
if (formData === null) return null;
clearState(AppConnection.AzureAppConfiguration);
const { connectionId, name, description, returnUrl } = formData;
try {
if (connectionId) {
await updateAppConnection.mutateAsync({
app: AppConnection.AzureAppConfiguration,
connectionId,
credentials: {
code: code as string
}
});
} else {
await createAppConnection.mutateAsync({
app: AppConnection.AzureAppConfiguration,
name,
description,
method: AzureAppConfigurationConnectionMethod.OAuth,
credentials: {
code: code as string
}
});
}
} catch (err: any) {
createNotification({
title: `Failed to ${connectionId ? "update" : "add"} Azure Connection`,
text: err?.message,
type: "error"
});
navigate({
to: returnUrl ?? "/organization/settings?selectedTab=app-connections"
});
}
return {
connectionId,
returnUrl,
appConnectionName: formData.app
};
}, []);
const handleGithub = useCallback(async () => {
const formData = getFormData(AppConnection.GitHub);
if (formData === null) return null;
@@ -215,8 +266,10 @@ export const OAuthCallbackPage = () => {
if (appConnection === AppConnection.GitHub) {
data = await handleGithub();
} else if (appConnection === AppConnection.Azure) {
data = await handleAzure();
} else if (appConnection === AppConnection.AzureKeyVault) {
data = await handleAzureKeyVault();
} else if (appConnection === AppConnection.AzureAppConfiguration) {
data = await handleAzureAppConfiguration();
}
if (data) {
@@ -224,6 +277,11 @@ export const OAuthCallbackPage = () => {
text: `Successfully ${data.connectionId ? "updated" : "added"} ${data.appConnectionName || ""} Connection`,
type: "success"
});
} else {
createNotification({
text: "Failed to add connection",
type: "error"
});
}
await navigate({

15
frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AppConnectionForm.tsx
View File

@@ -10,7 +10,8 @@ import { DiscriminativePick } from "@app/types";
import { AppConnectionHeader } from "../AppConnectionHeader";
import { AwsConnectionForm } from "./AwsConnectionForm";
import { AzureConnectionForm } from "./AzureConnectionForm";
import { AzureAppConfigurationConnectionForm } from "./AzureAppConfigurationConnectionForm";
import { AzureKeyVaultConnectionForm } from "./AzureKeyVaultConnectionForm";
import { GcpConnectionForm } from "./GcpConnectionForm";
import { GitHubConnectionForm } from "./GitHubConnectionForm";
@@ -54,8 +55,10 @@ const CreateForm = ({ app, onComplete }: CreateFormProps) => {
return <GitHubConnectionForm />;
case AppConnection.GCP:
return <GcpConnectionForm onSubmit={onSubmit} />;
case AppConnection.Azure:
return <AzureConnectionForm />;
case AppConnection.AzureKeyVault:
return <AzureKeyVaultConnectionForm />;
case AppConnection.AzureAppConfiguration:
return <AzureAppConfigurationConnectionForm />;
default:
throw new Error(`Unhandled App ${app}`);
}
@@ -95,8 +98,10 @@ const UpdateForm = ({ appConnection, onComplete }: UpdateFormProps) => {
return <GitHubConnectionForm appConnection={appConnection} />;
case AppConnection.GCP:
return <GcpConnectionForm appConnection={appConnection} onSubmit={onSubmit} />;
case AppConnection.Azure:
return <AzureConnectionForm appConnection={appConnection} />;
case AppConnection.AzureKeyVault:
return <AzureKeyVaultConnectionForm appConnection={appConnection} />;
case AppConnection.AzureAppConfiguration:
return <AzureAppConfigurationConnectionForm appConnection={appConnection} />;
default:
throw new Error(`Unhandled App ${(appConnection as TAppConnection).app}`);
}

177
frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AzureAppConfigurationConnectionForm.tsx Normal file
View File

@@ -0,0 +1,177 @@
import crypto from "crypto";
import { useState } from "react";
import { Controller, FormProvider, useForm } from "react-hook-form";
import { zodResolver } from "@hookform/resolvers/zod";
import { z } from "zod";
import { Button, FormControl, Input, ModalClose, Select, SelectItem } from "@app/components/v2";
import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
import { isInfisicalCloud } from "@app/helpers/platform";
import {
AzureAppConfigurationConnectionMethod,
TAzureAppConfigurationConnection,
useGetAppConnectionOption
} from "@app/hooks/api/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import {
genericAppConnectionFieldsSchema,
GenericAppConnectionsFields
} from "./GenericAppConnectionFields";
type Props = {
appConnection?: TAzureAppConfigurationConnection;
};
const formSchema = genericAppConnectionFieldsSchema.extend({
app: z.literal(AppConnection.AzureAppConfiguration),
method: z.nativeEnum(AzureAppConfigurationConnectionMethod),
tenantId: z.string().trim().optional()
});
type FormData = z.infer<typeof formSchema>;
export const AzureAppConfigurationConnectionForm = ({ appConnection }: Props) => {
const isUpdate = Boolean(appConnection);
const [isRedirecting, setIsRedirecting] = useState(false);
const {
option: { oauthClientId },
isLoading
} = useGetAppConnectionOption(AppConnection.AzureAppConfiguration);
const form = useForm<FormData>({
resolver: zodResolver(formSchema),
defaultValues: appConnection
? {
...appConnection
}
: {
app: AppConnection.AzureAppConfiguration,
method: AzureAppConfigurationConnectionMethod.OAuth
}
});
const {
handleSubmit,
control,
watch,
formState: { isSubmitting, isDirty }
} = form;
const selectedMethod = watch("method");
const onSubmit = (formData: FormData) => {
setIsRedirecting(true);
const state = crypto.randomBytes(16).toString("hex");
localStorage.setItem("latestCSRFToken", state);
localStorage.setItem(
"azureAppConfigurationConnectionFormData",
JSON.stringify({ ...formData, connectionId: appConnection?.id })
);
switch (formData.method) {
case AzureAppConfigurationConnectionMethod.OAuth:
window.location.assign(
`https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://azconfig.io/.default%20openid%20offline_access&state=${state}<:>azure-app-configuration`
);
break;
default:
throw new Error(`Unhandled Azure Connection method: ${(formData as FormData).method}`);
}
};
let isMissingConfig: boolean;
switch (selectedMethod) {
case AzureAppConfigurationConnectionMethod.OAuth:
isMissingConfig = !oauthClientId;
break;
default:
throw new Error(`Unhandled Azure Connection method: ${selectedMethod}`);
}
const methodDetails = getAppConnectionMethodDetails(selectedMethod);
return (
<FormProvider {...form}>
<form onSubmit={handleSubmit(onSubmit)}>
{!isUpdate && <GenericAppConnectionsFields />}
<Controller
name="tenantId"
control={control}
render={({ field, fieldState: { error } }) => (
<FormControl
tooltipText="The Azure Active Directory (Entra ID) Tenant ID."
isError={Boolean(error?.message)}
label="Tenant ID"
isOptional
errorText={error?.message}
>
<Input {...field} placeholder="e4f34ea5-ad23-4291-8585-66d20d603cc8" />
</FormControl>
)}
/>
<Controller
name="method"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
tooltipText={`The method you would like to use to connect with ${
APP_CONNECTION_MAP[AppConnection.AzureAppConfiguration].name
}. This field cannot be changed after creation.`}
errorText={
!isLoading && isMissingConfig
? `Environment variables have not been configured. ${
isInfisicalCloud()
? "Please contact Infisical."
: `See documentation to configure Azure ${methodDetails.name} Connections.`
}`
: error?.message
}
isError={Boolean(error?.message) || isMissingConfig}
label="Method"
>
<Select
isDisabled={isUpdate}
value={value}
onValueChange={(val) => onChange(val)}
className="w-full border border-mineshaft-500"
position="popper"
dropdownContainerClassName="max-w-none"
>
{Object.values(AzureAppConfigurationConnectionMethod).map((method) => {
return (
<SelectItem value={method} key={method}>
{getAppConnectionMethodDetails(method).name}
</SelectItem>
);
})}
</Select>
</FormControl>
)}
/>
<div className="mt-8 flex items-center">
<Button
className="mr-4"
size="sm"
type="submit"
colorSchema="secondary"
isLoading={isSubmitting || isRedirecting}
isDisabled={isSubmitting || (!isUpdate && !isDirty) || isMissingConfig || isRedirecting}
>
{isUpdate ? "Reconnect to Azure" : "Connect to Azure"}
</Button>
<ModalClose asChild>
<Button colorSchema="secondary" variant="plain">
Cancel
</Button>
</ModalClose>
</div>
</form>
</FormProvider>
);
};

74
frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AzureConnectionForm.tsx → frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionForm/AzureKeyVaultConnectionForm.tsx
View File

@@ -11,10 +11,9 @@ import { isInfisicalCloud } from "@app/helpers/platform";
import { useGetAppConnectionOption } from "@app/hooks/api/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import {
AzureConnectionMethod,
AzureResources,
TAzureConnection
} from "@app/hooks/api/appConnections/types/azure-connection";
AzureKeyVaultConnectionMethod,
TAzureKeyVaultConnection
} from "@app/hooks/api/appConnections/types/azure-key-vault-connection";
import {
genericAppConnectionFieldsSchema,
@@ -22,43 +21,35 @@ import {
} from "./GenericAppConnectionFields";
type Props = {
appConnection?: TAzureConnection;
};
const resourceScopes: Record<AzureResources, string> = {
[AzureResources.AppConfiguration]: "https://azconfig.io/.default",
[AzureResources.KeyVault]: "https://vault.azure.net/.default"
appConnection?: TAzureKeyVaultConnection;
};
const formSchema = genericAppConnectionFieldsSchema.extend({
app: z.literal(AppConnection.Azure),
method: z.nativeEnum(AzureConnectionMethod),
tenantId: z.string().trim().optional(),
resource: z.nativeEnum(AzureResources)
app: z.literal(AppConnection.AzureKeyVault),
method: z.nativeEnum(AzureKeyVaultConnectionMethod),
tenantId: z.string().trim().optional()
});
type FormData = z.infer<typeof formSchema>;
export const AzureConnectionForm = ({ appConnection }: Props) => {
export const AzureKeyVaultConnectionForm = ({ appConnection }: Props) => {
const isUpdate = Boolean(appConnection);
const [isRedirecting, setIsRedirecting] = useState(false);
const {
option: { oauthClientId },
isLoading
} = useGetAppConnectionOption(AppConnection.Azure);
} = useGetAppConnectionOption(AppConnection.AzureKeyVault);
const form = useForm<FormData>({
resolver: zodResolver(formSchema),
defaultValues: appConnection
? {
...appConnection,
resource: appConnection?.credentials.resource
...appConnection
}
: {
app: AppConnection.Azure,
method: AzureConnectionMethod.OAuth,
resource: AzureResources.KeyVault
app: AppConnection.AzureKeyVault,
method: AzureKeyVaultConnectionMethod.OAuth
}
});
@@ -76,14 +67,14 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
const state = crypto.randomBytes(16).toString("hex");
localStorage.setItem("latestCSRFToken", state);
localStorage.setItem(
"azureConnectionFormData",
"azureKeyVaultConnectionFormData",
JSON.stringify({ ...formData, connectionId: appConnection?.id })
);
switch (formData.method) {
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
window.location.assign(
`https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=${resourceScopes[formData.resource]}%20openid%20offline_access&state=${state}`
`https://login.microsoftonline.com/${formData.tenantId || "common"}/oauth2/v2.0/authorize?client_id=${oauthClientId}&response_type=code&redirect_uri=${window.location.origin}/organization/app-connections/azure/oauth/callback&response_mode=query&scope=https://vault.azure.net/.default%20openid%20offline_access&state=${state}<:>azure-key-vault`
);
break;
default:
@@ -94,7 +85,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
let isMissingConfig: boolean;
switch (selectedMethod) {
case AzureConnectionMethod.OAuth:
case AzureKeyVaultConnectionMethod.OAuth:
isMissingConfig = !oauthClientId;
break;
default:
@@ -113,7 +104,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
control={control}
render={({ field, fieldState: { error } }) => (
<FormControl
tooltipText="The Azure Active Directory (Entra ID) Tenant ID. This field cannot be changed after creation."
tooltipText="The Azure Active Directory (Entra ID) Tenant ID."
isError={Boolean(error?.message)}
label="Tenant ID"
isOptional
@@ -124,40 +115,13 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
)}
/>
<Controller
name="resource"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
tooltipText="Select the Azure resource you would like the app connection to access."
errorText={error?.message}
isError={Boolean(error?.message)}
label="Resource"
>
<Select
isDisabled={isUpdate}
value={value}
onValueChange={(val) => onChange(val)}
className="w-full border border-mineshaft-500"
position="popper"
dropdownContainerClassName="max-w-none"
>
<SelectItem value={AzureResources.KeyVault}>Azure Key Vault</SelectItem>
<SelectItem value={AzureResources.AppConfiguration}>
Azure App Configuration
</SelectItem>
</Select>
</FormControl>
)}
/>
<Controller
name="method"
control={control}
render={({ field: { value, onChange }, fieldState: { error } }) => (
<FormControl
tooltipText={`The method you would like to use to connect with ${
APP_CONNECTION_MAP[AppConnection.Azure].name
APP_CONNECTION_MAP[AppConnection.AzureKeyVault].name
}. This field cannot be changed after creation.`}
errorText={
!isLoading && isMissingConfig
@@ -179,7 +143,7 @@ export const AzureConnectionForm = ({ appConnection }: Props) => {
position="popper"
dropdownContainerClassName="max-w-none"
>
{Object.values(AzureConnectionMethod).map((method) => {
{Object.values(AzureKeyVaultConnectionMethod).map((method) => {
return (
<SelectItem value={method} key={method}>
{getAppConnectionMethodDetails(method).name}

10
frontend/src/pages/organization/SettingsPage/components/AppConnectionsTab/components/AppConnectionRow.tsx
View File

@@ -27,8 +27,7 @@ import { OrgPermissionSubjects } from "@app/context";
import { OrgPermissionAppConnectionActions } from "@app/context/OrgPermissionContext/types";
import { APP_CONNECTION_MAP, getAppConnectionMethodDetails } from "@app/helpers/appConnections";
import { useToggle } from "@app/hooks";
import { azureResourcesMap, TAppConnection } from "@app/hooks/api/appConnections";
import { AppConnection } from "@app/hooks/api/appConnections/enums";
import { TAppConnection } from "@app/hooks/api/appConnections";
type Props = {
appConnection: TAppConnection;
@@ -43,7 +42,7 @@ export const AppConnectionRow = ({
onEditCredentials,
onEditDetails
}: Props) => {
const { id, name, method, app, description, credentials } = appConnection;
const { id, name, method, app, description } = appConnection;
const [isIdCopied, setIsIdCopied] = useToggle(false);
@@ -76,10 +75,7 @@ export const AppConnectionRow = ({
src={`/images/integrations/${APP_CONNECTION_MAP[app].image}`}
className="mr-0.5 h-5 w-5"
/>
<span className="hidden lg:inline">
{APP_CONNECTION_MAP[app].name}
{app === AppConnection.Azure && ` ${azureResourcesMap[credentials.resource]}`}
</span>
<span className="hidden lg:inline">{APP_CONNECTION_MAP[app].name}</span>
</div>
</Td>
<Td className="!min-w-[8rem] max-w-0">

4
frontend/src/pages/secret-manager/SecretSyncDetailsByIDPage/components/SecretSyncDestinationSection/AzureAppConfigurationSyncDestinationSection.tsx
View File

@@ -13,9 +13,7 @@ export const AzureAppConfigurationSyncDestinationSection = ({ secretSync }: Prop
return (
<>
<SecretSyncLabel label="Configuration URL">{configurationUrl}</SecretSyncLabel>
<SecretSyncLabel label="Label">
{label && label.length > 0 ? label : <span className="opacity-40">Not set</span>}
</SecretSyncLabel>
<SecretSyncLabel label="Label">{label}</SecretSyncLabel>
</>
);
};