Merge branch 'heads/main' into daniel/kms-sign-verify

frontend/src/pages/project/RoleDetailsBySlugPage/components/ProjectRoleModifySection.utils.tsx

@@ -17,6 +17,7 @@ import {
   ProjectPermissionKmipActions,
   ProjectPermissionMemberActions,
   ProjectPermissionSecretActions,
+  ProjectPermissionSecretRotationActions,
   ProjectPermissionSecretSyncActions,
   TPermissionCondition,
   TPermissionConditionOperators
@@ -68,6 +69,15 @@ const SecretSyncPolicyActionSchema = z.object({
   [ProjectPermissionSecretSyncActions.RemoveSecrets]: z.boolean().optional()
 });
 
+const SecretRotationPolicyActionSchema = z.object({
+  [ProjectPermissionSecretRotationActions.Read]: z.boolean().optional(),
+  [ProjectPermissionSecretRotationActions.ReadGeneratedCredentials]: z.boolean().optional(),
+  [ProjectPermissionSecretRotationActions.Create]: z.boolean().optional(),
+  [ProjectPermissionSecretRotationActions.Edit]: z.boolean().optional(),
+  [ProjectPermissionSecretRotationActions.Delete]: z.boolean().optional(),
+  [ProjectPermissionSecretRotationActions.RotateSecrets]: z.boolean().optional()
+});
+
 const KmipPolicyActionSchema = z.object({
   [ProjectPermissionKmipActions.ReadClients]: z.boolean().optional(),
   [ProjectPermissionKmipActions.CreateClients]: z.boolean().optional(),
@@ -211,7 +221,12 @@ export const projectRoleFormSchema = z.object({
       [ProjectPermissionSub.SecretRollback]: SecretRollbackPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Project]: WorkspacePolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Tags]: GeneralPolicyActionSchema.array().default([]),
-      [ProjectPermissionSub.SecretRotation]: GeneralPolicyActionSchema.array().default([]),
+      [ProjectPermissionSub.SecretRotation]: SecretRotationPolicyActionSchema.extend({
+        inverted: z.boolean().optional(),
+        conditions: ConditionSchema
+      })
+        .array()
+        .default([]),
       [ProjectPermissionSub.Kms]: GeneralPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.Cmek]: CmekPolicyActionSchema.array().default([]),
       [ProjectPermissionSub.SecretSyncs]: SecretSyncPolicyActionSchema.array().default([]),
@@ -228,6 +243,7 @@ type TConditionalFields =
   | ProjectPermissionSub.SecretFolders
   | ProjectPermissionSub.SecretImports
   | ProjectPermissionSub.DynamicSecrets
+  | ProjectPermissionSub.SecretRotation
   | ProjectPermissionSub.Identity;
 
 export const isConditionalSubjects = (
@@ -237,6 +253,7 @@ export const isConditionalSubjects = (
   subject === ProjectPermissionSub.DynamicSecrets ||
   subject === ProjectPermissionSub.SecretImports ||
   subject === ProjectPermissionSub.SecretFolders ||
+  subject === ProjectPermissionSub.SecretRotation ||
   subject === ProjectPermissionSub.Identity;
 
 const convertCaslConditionToFormOperator = (caslConditions: TPermissionCondition) => {
@@ -300,6 +317,30 @@ export const rolePermission2Form = (permissions: TProjectPermission[] = []) => {
       if (isConditionalSubjects(subject)) {
         if (!formVal[subject]) formVal[subject] = [];
 
+        if (subject === ProjectPermissionSub.SecretRotation) {
+          const canRead = action.includes(ProjectPermissionSecretRotationActions.Read);
+          const canReadCredentials = action.includes(
+            ProjectPermissionSecretRotationActions.ReadGeneratedCredentials
+          );
+          const canEdit = action.includes(ProjectPermissionSecretRotationActions.Edit);
+          const canDelete = action.includes(ProjectPermissionSecretRotationActions.Delete);
+          const canCreate = action.includes(ProjectPermissionSecretRotationActions.Create);
+          const canRotate = action.includes(ProjectPermissionSecretRotationActions.RotateSecrets);
+
+          // from above statement we are sure it won't be undefined
+          formVal[subject]!.push({
+            [ProjectPermissionSecretRotationActions.Read]: canRead,
+            [ProjectPermissionSecretRotationActions.ReadGeneratedCredentials]: canReadCredentials,
+            [ProjectPermissionSecretRotationActions.Create]: canCreate,
+            [ProjectPermissionSecretRotationActions.Edit]: canEdit,
+            [ProjectPermissionSecretRotationActions.Delete]: canDelete,
+            [ProjectPermissionSecretRotationActions.RotateSecrets]: canRotate,
+            conditions: conditions ? convertCaslConditionToFormOperator(conditions) : [],
+            inverted
+          });
+          return;
+        }
+
         if (subject === ProjectPermissionSub.DynamicSecrets) {
           const canRead = action.includes(ProjectPermissionDynamicSecretActions.ReadRootCredential);
           const canEdit = action.includes(ProjectPermissionDynamicSecretActions.EditRootCredential);
@@ -898,10 +939,15 @@ export const PROJECT_PERMISSION_OBJECT: TProjectPermissionObject = {
   [ProjectPermissionSub.SecretRotation]: {
     title: "Secret Rotation",
     actions: [
-      { label: "Read", value: "read" },
-      { label: "Create", value: "create" },
-      { label: "Modify", value: "edit" },
-      { label: "Remove", value: "delete" }
+      { label: "Read Config", value: ProjectPermissionSecretRotationActions.Read },
+      {
+        label: "Read Generated Credentials",
+        value: ProjectPermissionSecretRotationActions.ReadGeneratedCredentials
+      },
+      { label: "Create Config", value: ProjectPermissionSecretRotationActions.Create },
+      { label: "Modify Config", value: ProjectPermissionSecretRotationActions.Edit },
+      { label: "Remove Config", value: ProjectPermissionSecretRotationActions.Delete },
+      { label: "Rotate Secrets", value: ProjectPermissionSecretRotationActions.RotateSecrets }
     ]
   },
   [ProjectPermissionSub.SecretRollback]: {