requested changes

backend/src/services/app-connection/app-connection-enums.ts

@@ -2,7 +2,8 @@ export enum AppConnection {
   GitHub = "github",
   AWS = "aws",
   GCP = "gcp",
-  Azure = "azure"
+  AzureKeyVault = "azure-key-vault",
+  AzureAppConfiguration = "azure-app-configuration"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -20,14 +20,24 @@ import {
 } from "@app/services/app-connection/github";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
-import { AzureConnectionMethod, getAzureConnectionListItem, validateAzureConnectionCredentials } from "./azure";
+import {
+  AzureAppConfigurationConnectionMethod,
+  getAzureAppConfigurationConnectionListItem,
+  validateAzureAppConfigurationConnectionCredentials
+} from "./azure-app-configuration";
+import {
+  AzureKeyVaultConnectionMethod,
+  getAzureKeyVaultConnectionListItem,
+  validateAzureKeyVaultConnectionCredentials
+} from "./azure-key-vault";
 
 export const listAppConnectionOptions = () => {
   return [
     getAwsAppConnectionListItem(),
     getGitHubConnectionListItem(),
     getGcpAppConnectionListItem(),
-    getAzureConnectionListItem()
+    getAzureKeyVaultConnectionListItem(),
+    getAzureAppConfigurationConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -84,8 +94,10 @@ export const validateAppConnectionCredentials = async (
       return validateGitHubConnectionCredentials(appConnection);
     case AppConnection.GCP:
       return validateGcpConnectionCredentials(appConnection);
-    case AppConnection.Azure:
-      return validateAzureConnectionCredentials(appConnection);
+    case AppConnection.AzureKeyVault:
+      return validateAzureKeyVaultConnectionCredentials(appConnection);
+    case AppConnection.AzureAppConfiguration:
+      return validateAzureAppConfigurationConnectionCredentials(appConnection);
     default:
       // eslint-disable-next-line @typescript-eslint/restrict-template-expressions
       throw new Error(`Unhandled App Connection ${app}`);
@@ -96,7 +108,8 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
   switch (method) {
     case GitHubConnectionMethod.App:
       return "GitHub App";
-    case AzureConnectionMethod.OAuth:
+    case AzureKeyVaultConnectionMethod.OAuth:
+    case AzureAppConfigurationConnectionMethod.OAuth:
     case GitHubConnectionMethod.OAuth:
       return "OAuth";
     case AwsConnectionMethod.AccessKey:

backend/src/services/app-connection/app-connection-maps.ts

@@ -4,5 +4,6 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.AWS]: "AWS",
   [AppConnection.GitHub]: "GitHub",
   [AppConnection.GCP]: "GCP",
-  [AppConnection.Azure]: "Azure"
+  [AppConnection.AzureKeyVault]: "Azure Key Vault",
+  [AppConnection.AzureAppConfiguration]: "Azure App Configuration"
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -27,9 +27,8 @@ import { ValidateGitHubConnectionCredentialsSchema } from "@app/services/app-con
 import { githubConnectionService } from "@app/services/app-connection/github/github-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
-import { KmsDataKey } from "../kms/kms-types";
 import { TAppConnectionDALFactory } from "./app-connection-dal";
-import { AzureResources } from "./azure";
+import { ValidateAzureKeyVaultConnectionCredentialsSchema } from "./azure-key-vault";
 import { ValidateGcpConnectionCredentialsSchema } from "./gcp";
 import { gcpConnectionService } from "./gcp/gcp-connection-service";
 
@@ -45,7 +44,8 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.AWS]: ValidateAwsConnectionCredentialsSchema,
   [AppConnection.GitHub]: ValidateGitHubConnectionCredentialsSchema,
   [AppConnection.GCP]: ValidateGcpConnectionCredentialsSchema,
-  [AppConnection.Azure]: ValidateGcpConnectionCredentialsSchema
+  [AppConnection.AzureKeyVault]: ValidateAzureKeyVaultConnectionCredentialsSchema,
+  [AppConnection.AzureAppConfiguration]: ValidateAzureKeyVaultConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -350,27 +350,7 @@ export const appConnectionServiceFactory = ({
       )
     );
 
-    const { decryptor } = await kmsService.createCipherPairWithDataKey({
-      type: KmsDataKey.Organization,
-      orgId: actor.orgId
-    });
-
-    const decryptedConnections = availableConnections.map((connection) => {
-      const decryptedPlainTextBlob = decryptor({
-        cipherTextBlob: connection.encryptedCredentials
-      });
-
-      const credentials = JSON.parse(decryptedPlainTextBlob.toString()) as TAppConnection["credentials"];
-
-      return {
-        ...connection,
-        ...(app === AppConnection.Azure && {
-          azureResource: (credentials as { resource: AzureResources }).resource
-        })
-      };
-    });
-
-    return decryptedConnections as Omit<TAppConnection, "credentials">[];
+    return availableConnections as Omit<TAppConnection, "credentials">[];
   };
 
   return {

backend/src/services/app-connection/app-connection-types.ts

@@ -12,20 +12,33 @@ import {
 } from "@app/services/app-connection/github";
 
 import {
-  TAzureConnection,
-  TAzureConnectionConfig,
-  TAzureConnectionInput,
-  TValidateAzureConnectionCredentials
-} from "./azure";
+  TAzureAppConfigurationConnection,
+  TAzureAppConfigurationConnectionConfig,
+  TAzureAppConfigurationConnectionInput,
+  TValidateAzureAppConfigurationConnectionCredentials
+} from "./azure-app-configuration";
+import {
+  TAzureKeyVaultConnection,
+  TAzureKeyVaultConnectionConfig,
+  TAzureKeyVaultConnectionInput,
+  TValidateAzureKeyVaultConnectionCredentials
+} from "./azure-key-vault";
 import { TGcpConnection, TGcpConnectionConfig, TGcpConnectionInput, TValidateGcpConnectionCredentials } from "./gcp";
 
-export type TAppConnection = { id: string } & (TAwsConnection | TGitHubConnection | TGcpConnection | TAzureConnection);
+export type TAppConnection = { id: string } & (
+  | TAwsConnection
+  | TGitHubConnection
+  | TGcpConnection
+  | TAzureKeyVaultConnection
+  | TAzureAppConfigurationConnection
+);
 
 export type TAppConnectionInput = { id: string } & (
   | TAwsConnectionInput
   | TGitHubConnectionInput
   | TGcpConnectionInput
-  | TAzureConnectionInput
+  | TAzureKeyVaultConnectionInput
+  | TAzureAppConfigurationConnectionInput
 );
 
 export type TCreateAppConnectionDTO = Pick<
@@ -41,10 +54,12 @@ export type TAppConnectionConfig =
   | TAwsConnectionConfig
   | TGitHubConnectionConfig
   | TGcpConnectionConfig
-  | TAzureConnectionConfig;
+  | TAzureKeyVaultConnectionConfig
+  | TAzureAppConfigurationConnectionConfig;
 
 export type TValidateAppConnectionCredentials =
   | TValidateAwsConnectionCredentials
   | TValidateGitHubConnectionCredentials
   | TValidateGcpConnectionCredentials
-  | TValidateAzureConnectionCredentials;
+  | TValidateAzureKeyVaultConnectionCredentials
+  | TValidateAzureAppConfigurationConnectionCredentials;

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum AzureAppConfigurationConnectionMethod {
+  OAuth = "oauth"
+}

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-fns.ts

@@ -0,0 +1,98 @@
+import { AxiosError, AxiosResponse } from "axios";
+
+import { getConfig } from "@app/lib/config/env";
+import { request } from "@app/lib/config/request";
+import { BadRequestError, InternalServerError } from "@app/lib/errors";
+import { getAppConnectionMethodName } from "@app/services/app-connection/app-connection-fns";
+import { IntegrationUrls } from "@app/services/integration-auth/integration-list";
+
+import { AppConnection } from "../app-connection-enums";
+import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
+import {
+  ExchangeCodeAzureResponse,
+  TAzureAppConfigurationConnectionConfig
+} from "./azure-app-configuration-connection-types";
+
+export const getAzureAppConfigurationConnectionListItem = () => {
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
+
+  return {
+    name: "Azure App Configuration" as const,
+    app: AppConnection.AzureAppConfiguration as const,
+    methods: Object.values(AzureAppConfigurationConnectionMethod) as [AzureAppConfigurationConnectionMethod.OAuth],
+    oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
+  };
+};
+
+export const validateAzureAppConfigurationConnectionCredentials = async (
+  config: TAzureAppConfigurationConnectionConfig
+) => {
+  const { credentials: inputCredentials, method } = config;
+
+  const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
+
+  if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+    throw new InternalServerError({
+      message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`
+    });
+  }
+
+  let tokenResp: AxiosResponse<ExchangeCodeAzureResponse> | null = null;
+  let tokenError: AxiosError | null = null;
+
+  try {
+    tokenResp = await request.post<ExchangeCodeAzureResponse>(
+      IntegrationUrls.AZURE_TOKEN_URL.replace("common", inputCredentials.tenantId || "common"),
+      new URLSearchParams({
+        grant_type: "authorization_code",
+        code: inputCredentials.code,
+        scope: `openid offline_access https://azconfig.io/.default`,
+        client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
+        client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
+        redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
+      })
+    );
+  } catch (e: unknown) {
+    if (e instanceof AxiosError) {
+      tokenError = e;
+    } else {
+      throw new BadRequestError({
+        message: `Unable to validate connection - verify credentials`
+      });
+    }
+  }
+
+  if (tokenError) {
+    if (tokenError instanceof AxiosError) {
+      throw new BadRequestError({
+        message: `Failed to get access token: ${
+          (tokenError?.response?.data as { error_description?: string })?.error_description || "Unknown error"
+        }`
+      });
+    } else {
+      throw new InternalServerError({
+        message: "Failed to get access token"
+      });
+    }
+  }
+
+  if (!tokenResp) {
+    throw new InternalServerError({
+      message: `Failed to get access token: Token was empty with no error`
+    });
+  }
+
+  switch (method) {
+    case AzureAppConfigurationConnectionMethod.OAuth:
+      return {
+        tenantId: inputCredentials.tenantId,
+        accessToken: tokenResp.data.access_token,
+        refreshToken: tokenResp.data.refresh_token,
+        expiresAt: Date.now() + tokenResp.data.expires_in * 1000
+      };
+    default:
+      throw new InternalServerError({
+        message: `Unhandled Azure connection method: ${method as AzureAppConfigurationConnectionMethod}`
+      });
+  }
+};

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-schemas.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AzureAppConfigurationConnectionMethod } from "./azure-app-configuration-connection-enums";
+
+export const AzureAppConfigurationConnectionOAuthInputCredentialsSchema = z.object({
+  code: z.string().trim().min(1, "OAuth code required"),
+  tenantId: z.string().trim().optional()
+});
+
+export const AzureAppConfigurationConnectionOAuthOutputCredentialsSchema = z.object({
+  tenantId: z.string().optional(),
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.number()
+});
+
+export const ValidateAzureAppConfigurationConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(AzureAppConfigurationConnectionMethod.OAuth)
+      .describe(AppConnections.CREATE(AppConnection.AzureAppConfiguration).method),
+    credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureAppConfiguration).credentials
+    )
+  })
+]);
+
+export const CreateAzureAppConfigurationConnectionSchema = ValidateAzureAppConfigurationConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration)
+);
+
+export const UpdateAzureAppConfigurationConnectionSchema = z
+  .object({
+    credentials: AzureAppConfigurationConnectionOAuthInputCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.AzureAppConfiguration).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureAppConfiguration));
+
+const BaseAzureAppConfigurationConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.AzureAppConfiguration)
+});
+
+export const AzureAppConfigurationConnectionSchema = z.intersection(
+  BaseAzureAppConfigurationConnectionSchema,
+  z.discriminatedUnion("method", [
+    z.object({
+      method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
+      credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
+    })
+  ])
+);
+
+export const SanitizedAzureAppConfigurationConnectionSchema = z.discriminatedUnion("method", [
+  BaseAzureAppConfigurationConnectionSchema.extend({
+    method: z.literal(AzureAppConfigurationConnectionMethod.OAuth),
+    credentials: AzureAppConfigurationConnectionOAuthOutputCredentialsSchema.pick({
+      resource: true,
+      tenantId: true
+    })
+  })
+]);
+
+export const AzureAppConfigurationConnectionListItemSchema = z.object({
+  name: z.literal("Azure App Configuration"),
+  app: z.literal(AppConnection.AzureAppConfiguration),
+  methods: z.nativeEnum(AzureAppConfigurationConnectionMethod).array(),
+  oauthClientId: z.string().optional()
+});

backend/src/services/app-connection/azure-app-configuration/azure-app-configuration-connection-types.ts

@@ -0,0 +1,41 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  AzureAppConfigurationConnectionOAuthOutputCredentialsSchema,
+  AzureAppConfigurationConnectionSchema,
+  CreateAzureAppConfigurationConnectionSchema,
+  ValidateAzureAppConfigurationConnectionCredentialsSchema
+} from "./azure-app-configuration-connection-schemas";
+
+export type TAzureAppConfigurationConnection = z.infer<typeof AzureAppConfigurationConnectionSchema>;
+
+export type TAzureAppConfigurationConnectionInput = z.infer<typeof CreateAzureAppConfigurationConnectionSchema> & {
+  app: AppConnection.AzureAppConfiguration;
+};
+
+export type TValidateAzureAppConfigurationConnectionCredentials =
+  typeof ValidateAzureAppConfigurationConnectionCredentialsSchema;
+
+export type TAzureAppConfigurationConnectionConfig = DiscriminativePick<
+  TAzureAppConfigurationConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type ExchangeCodeAzureResponse = {
+  token_type: string;
+  scope: string;
+  expires_in: number;
+  ext_expires_in: number;
+  access_token: string;
+  refresh_token: string;
+  id_token: string;
+};
+
+export type TAzureAppConfigurationConnectionCredentials = z.infer<
+  typeof AzureAppConfigurationConnectionOAuthOutputCredentialsSchema
+>;

backend/src/services/app-connection/azure-app-configuration/index.ts

@@ -0,0 +1,4 @@
+export * from "./azure-app-configuration-connection-enums";
+export * from "./azure-app-configuration-connection-fns";
+export * from "./azure-app-configuration-connection-schemas";
+export * from "./azure-app-configuration-connection-types";

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-enums.ts

@@ -0,0 +1,3 @@
+export enum AzureKeyVaultConnectionMethod {
+  OAuth = "oauth"
+}

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts

@@ -13,17 +13,12 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TAppConnectionDALFactory } from "../app-connection-dal";
 import { AppConnection } from "../app-connection-enums";
-import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
+import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
 import {
   ExchangeCodeAzureResponse,
-  TAzureConnectionConfig,
-  TAzureConnectionCredentials
-} from "./azure-connection-types";
-
-const resourceScopes: Record<AzureResources, string> = {
-  [AzureResources.AppConfiguration]: "https://azconfig.io/.default",
-  [AzureResources.KeyVault]: "https://vault.azure.net/.default"
-};
+  TAzureKeyVaultConnectionConfig,
+  TAzureKeyVaultConnectionCredentials
+} from "./azure-key-vault-connection-types";
 
 export const getAzureConnectionAccessToken = async (
   connectionId: string,
@@ -31,6 +26,11 @@ export const getAzureConnectionAccessToken = async (
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
   const appCfg = getConfig();
+  if (!appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID || !appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
+    throw new BadRequestError({
+      message: `Azure environment variables have not been configured`
+    });
+  }
 
   const appConnection = await appConnectionDAL.findById(connectionId);
 
@@ -38,23 +38,23 @@ export const getAzureConnectionAccessToken = async (
     throw new NotFoundError({ message: `Connection with ID '${connectionId}' not found` });
   }
 
-  if (appConnection.app !== AppConnection.Azure) {
-    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure connection` });
+  if (appConnection.app !== AppConnection.AzureKeyVault && appConnection.app !== AppConnection.AzureAppConfiguration) {
+    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` });
   }
 
   const credentials = (await decryptAppConnectionCredentials({
     orgId: appConnection.orgId,
     kmsService,
     encryptedCredentials: appConnection.encryptedCredentials
-  })) as TAzureConnectionCredentials;
+  })) as TAzureKeyVaultConnectionCredentials;
 
   const { data } = await request.post<ExchangeCodeAzureResponse>(
     IntegrationUrls.AZURE_TOKEN_URL.replace("common", credentials.tenantId || "common"),
     new URLSearchParams({
       grant_type: "refresh_token",
       scope: `openid offline_access`,
-      client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID!,
-      client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET!,
+      client_id: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_ID,
+      client_secret: appCfg.INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
       refresh_token: credentials.refreshToken
     })
   );
@@ -87,18 +87,18 @@ export const getAzureConnectionAccessToken = async (
   };
 };
 
-export const getAzureConnectionListItem = () => {
+export const getAzureKeyVaultConnectionListItem = () => {
   const { INF_APP_CONNECTION_AZURE_CLIENT_ID } = getConfig();
 
   return {
-    name: "Azure" as const,
-    app: AppConnection.Azure as const,
-    methods: Object.values(AzureConnectionMethod) as [AzureConnectionMethod.OAuth],
+    name: "Azure Key Vault" as const,
+    app: AppConnection.AzureKeyVault as const,
+    methods: Object.values(AzureKeyVaultConnectionMethod) as [AzureKeyVaultConnectionMethod.OAuth],
     oauthClientId: INF_APP_CONNECTION_AZURE_CLIENT_ID
   };
 };
 
-export const validateAzureConnectionCredentials = async (config: TAzureConnectionConfig) => {
+export const validateAzureKeyVaultConnectionCredentials = async (config: TAzureKeyVaultConnectionConfig) => {
   const { credentials: inputCredentials, method } = config;
 
   const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
@@ -118,7 +118,7 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
       new URLSearchParams({
         grant_type: "authorization_code",
         code: inputCredentials.code,
-        scope: `openid offline_access ${resourceScopes[inputCredentials.resource]}`,
+        scope: `openid offline_access https://vault.azure.net/.default`,
         client_id: INF_APP_CONNECTION_AZURE_CLIENT_ID,
         client_secret: INF_APP_CONNECTION_AZURE_CLIENT_SECRET,
         redirect_uri: `${SITE_URL}/organization/app-connections/azure/oauth/callback`
@@ -155,16 +155,16 @@ export const validateAzureConnectionCredentials = async (config: TAzureConnectio
   }
 
   switch (method) {
-    case AzureConnectionMethod.OAuth:
+    case AzureKeyVaultConnectionMethod.OAuth:
       return {
+        tenantId: inputCredentials.tenantId,
         accessToken: tokenResp.data.access_token,
         refreshToken: tokenResp.data.refresh_token,
-        expiresAt: Date.now() + tokenResp.data.expires_in * 1000,
-        resource: inputCredentials.resource
+        expiresAt: Date.now() + tokenResp.data.expires_in * 1000
       };
     default:
       throw new InternalServerError({
-        message: `Unhandled Azure connection method: ${method as AzureConnectionMethod}`
+        message: `Unhandled Azure connection method: ${method as AzureKeyVaultConnectionMethod}`
       });
   }
 };

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-schemas.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+
+import { AppConnections } from "@app/lib/api-docs";
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import {
+  BaseAppConnectionSchema,
+  GenericCreateAppConnectionFieldsSchema,
+  GenericUpdateAppConnectionFieldsSchema
+} from "@app/services/app-connection/app-connection-schemas";
+
+import { AzureKeyVaultConnectionMethod } from "./azure-key-vault-connection-enums";
+
+export const AzureKeyVaultConnectionOAuthInputCredentialsSchema = z.object({
+  code: z.string().trim().min(1, "OAuth code required"),
+  tenantId: z.string().trim().optional()
+});
+
+export const AzureKeyVaultConnectionOAuthOutputCredentialsSchema = z.object({
+  tenantId: z.string().optional(),
+  accessToken: z.string(),
+  refreshToken: z.string(),
+  expiresAt: z.number()
+});
+
+export const ValidateAzureKeyVaultConnectionCredentialsSchema = z.discriminatedUnion("method", [
+  z.object({
+    method: z
+      .literal(AzureKeyVaultConnectionMethod.OAuth)
+      .describe(AppConnections.CREATE(AppConnection.AzureKeyVault).method),
+    credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.describe(
+      AppConnections.CREATE(AppConnection.AzureKeyVault).credentials
+    )
+  })
+]);
+
+export const CreateAzureKeyVaultConnectionSchema = ValidateAzureKeyVaultConnectionCredentialsSchema.and(
+  GenericCreateAppConnectionFieldsSchema(AppConnection.AzureKeyVault)
+);
+
+export const UpdateAzureKeyVaultConnectionSchema = z
+  .object({
+    credentials: AzureKeyVaultConnectionOAuthInputCredentialsSchema.optional().describe(
+      AppConnections.UPDATE(AppConnection.AzureKeyVault).credentials
+    )
+  })
+  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.AzureKeyVault));
+
+const BaseAzureKeyVaultConnectionSchema = BaseAppConnectionSchema.extend({
+  app: z.literal(AppConnection.AzureKeyVault)
+});
+
+export const AzureKeyVaultConnectionSchema = z.intersection(
+  BaseAzureKeyVaultConnectionSchema,
+  z.discriminatedUnion("method", [
+    z.object({
+      method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
+      credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema
+    })
+  ])
+);
+
+export const SanitizedAzureKeyVaultConnectionSchema = z.discriminatedUnion("method", [
+  BaseAzureKeyVaultConnectionSchema.extend({
+    method: z.literal(AzureKeyVaultConnectionMethod.OAuth),
+    credentials: AzureKeyVaultConnectionOAuthOutputCredentialsSchema.pick({
+      resource: true,
+      tenantId: true
+    })
+  })
+]);
+
+export const AzureKeyVaultConnectionListItemSchema = z.object({
+  name: z.literal("Azure Key Vault"),
+  app: z.literal(AppConnection.AzureKeyVault),
+  methods: z.nativeEnum(AzureKeyVaultConnectionMethod).array(),
+  oauthClientId: z.string().optional()
+});

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-types.ts

@@ -0,0 +1,38 @@
+import z from "zod";
+
+import { DiscriminativePick } from "@app/lib/types";
+
+import { AppConnection } from "../app-connection-enums";
+import {
+  AzureKeyVaultConnectionOAuthOutputCredentialsSchema,
+  AzureKeyVaultConnectionSchema,
+  CreateAzureKeyVaultConnectionSchema,
+  ValidateAzureKeyVaultConnectionCredentialsSchema
+} from "./azure-key-vault-connection-schemas";
+
+export type TAzureKeyVaultConnection = z.infer<typeof AzureKeyVaultConnectionSchema>;
+
+export type TAzureKeyVaultConnectionInput = z.infer<typeof CreateAzureKeyVaultConnectionSchema> & {
+  app: AppConnection.AzureKeyVault;
+};
+
+export type TValidateAzureKeyVaultConnectionCredentials = typeof ValidateAzureKeyVaultConnectionCredentialsSchema;
+
+export type TAzureKeyVaultConnectionConfig = DiscriminativePick<
+  TAzureKeyVaultConnectionInput,
+  "method" | "app" | "credentials"
+> & {
+  orgId: string;
+};
+
+export type ExchangeCodeAzureResponse = {
+  token_type: string;
+  scope: string;
+  expires_in: number;
+  ext_expires_in: number;
+  access_token: string;
+  refresh_token: string;
+  id_token: string;
+};
+
+export type TAzureKeyVaultConnectionCredentials = z.infer<typeof AzureKeyVaultConnectionOAuthOutputCredentialsSchema>;

backend/src/services/app-connection/azure-key-vault/index.ts

@@ -0,0 +1,4 @@
+export * from "./azure-key-vault-connection-enums";
+export * from "./azure-key-vault-connection-fns";
+export * from "./azure-key-vault-connection-schemas";
+export * from "./azure-key-vault-connection-types";

backend/src/services/app-connection/azure/azure-connection-enums.ts

@@ -1,8 +0,0 @@
-export enum AzureConnectionMethod {
-  OAuth = "oauth"
-}
-
-export enum AzureResources {
-  KeyVault = "key-vault",
-  AppConfiguration = "app-configuration"
-}

backend/src/services/app-connection/azure/azure-connection-schemas.ts

@@ -1,74 +0,0 @@
-import { z } from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { AzureConnectionMethod, AzureResources } from "./azure-connection-enums";
-
-export const AzureConnectionOAuthInputCredentialsSchema = z.object({
-  code: z.string().trim().min(1, "OAuth code required"),
-  tenantId: z.string().trim().optional(),
-  resource: z.nativeEnum(AzureResources)
-});
-
-export const AzureConnectionOAuthOutputCredentialsSchema = z.object({
-  tenantId: z.string().optional(),
-  accessToken: z.string(),
-  refreshToken: z.string(),
-  expiresAt: z.number(), // unix timestamp,
-  resource: z.nativeEnum(AzureResources)
-});
-
-export const ValidateAzureConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(AzureConnectionMethod.OAuth).describe(AppConnections.CREATE(AppConnection.Azure).method),
-    credentials: AzureConnectionOAuthInputCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.Azure).credentials
-    )
-  })
-]);
-
-export const CreateAzureConnectionSchema = ValidateAzureConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.Azure)
-);
-
-export const UpdateAzureConnectionSchema = z
-  .object({
-    credentials: AzureConnectionOAuthInputCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.Azure).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Azure));
-
-const BaseAzureConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.Azure) });
-
-export const AzureConnectionSchema = z.intersection(
-  BaseAzureConnectionSchema,
-  z.discriminatedUnion("method", [
-    z.object({
-      method: z.literal(AzureConnectionMethod.OAuth),
-      credentials: AzureConnectionOAuthOutputCredentialsSchema
-    })
-  ])
-);
-
-export const SanitizedAzureConnectionSchema = z.discriminatedUnion("method", [
-  BaseAzureConnectionSchema.extend({
-    method: z.literal(AzureConnectionMethod.OAuth),
-    credentials: AzureConnectionOAuthOutputCredentialsSchema.pick({
-      resource: true
-    })
-  })
-]);
-
-export const AzureConnectionListItemSchema = z.object({
-  name: z.literal("Azure"),
-  app: z.literal(AppConnection.Azure),
-  methods: z.nativeEnum(AzureConnectionMethod).array(),
-  oauthClientId: z.string().optional()
-});

backend/src/services/app-connection/azure/azure-connection-types.ts

@@ -1,35 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  AzureConnectionOAuthOutputCredentialsSchema,
-  AzureConnectionSchema,
-  CreateAzureConnectionSchema,
-  ValidateAzureConnectionCredentialsSchema
-} from "./azure-connection-schemas";
-
-export type TAzureConnection = z.infer<typeof AzureConnectionSchema>;
-
-export type TAzureConnectionInput = z.infer<typeof CreateAzureConnectionSchema> & {
-  app: AppConnection.Azure;
-};
-
-export type TValidateAzureConnectionCredentials = typeof ValidateAzureConnectionCredentialsSchema;
-
-export type TAzureConnectionConfig = DiscriminativePick<TAzureConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};
-
-export type ExchangeCodeAzureResponse = {
-  token_type: string;
-  scope: string;
-  expires_in: number;
-  ext_expires_in: number;
-  access_token: string;
-  refresh_token: string;
-  id_token: string;
-};
-
-export type TAzureConnectionCredentials = z.infer<typeof AzureConnectionOAuthOutputCredentialsSchema>;

backend/src/services/app-connection/azure/index.ts

@@ -1,4 +0,0 @@
-export * from "./azure-connection-enums";
-export * from "./azure-connection-fns";
-export * from "./azure-connection-schemas";
-export * from "./azure-connection-types";