Update MI fields numUses, numUsesLimit, ttl, added modal for delete client secret confirmation

backend/src/ee/controllers/v3/machineIdentityController.ts

@@ -44,9 +44,9 @@ const packageClientSecretData = (clientSecretData: IMachineIdentityClientSecretD
     isActive: clientSecretData.isActive,
     description: clientSecretData.description,
     clientSecretPrefix: clientSecretData.clientSecretPrefix,
-    clientSecretUsageCount: clientSecretData.clientSecretUsageCount,
+    clientSecretNumUses: clientSecretData.clientSecretNumUses,
-    clientSecretUsageLimit: clientSecretData.clientSecretUsageLimit,
+    clientSecretNumUsesLimit: clientSecretData.clientSecretNumUsesLimit,
-    expiresAt: clientSecretData.expiresAt
+    clientSecretTTL: clientSecretData.clientSecretTTL
 });
 
 /**
@@ -121,7 +121,7 @@ export const createMIClientSecret = async (req: Request, res: Response) => {
         body: {
             description,
             ttl,
-            usageLimit
+            numUsesLimit
         }
     } = await validateRequest(reqValidator.CreateClientSecretV3, req);
     
@@ -145,11 +145,6 @@ export const createMIClientSecret = async (req: Request, res: Response) => {
         message: "Failed to create client secret for more privileged MI"
     });
 
-    let expiresAt;
-    if (ttl > 0) {
-        expiresAt = new Date(new Date().getTime() + ttl * 1000);
-    }
-
     const clientSecret = crypto.randomBytes(32).toString("hex");
     const clientSecretHash = await bcrypt.hash(clientSecret, await getSaltRounds());
     
@@ -159,10 +154,10 @@ export const createMIClientSecret = async (req: Request, res: Response) => {
         description,
         clientSecretPrefix: clientSecret.slice(0, 4),
         clientSecretHash,
-        clientSecretUsageCount: 0,
+        clientSecretNumUses: 0,
-        clientSecretUsageLimit: usageLimit,
+        clientSecretNumUsesLimit: numUsesLimit,
+        clientSecretTTL: ttl,
         accessTokenVersion: 1,
-        expiresAt
     }).save();
 
     await EEAuditLogService.createAuditLog(
@@ -294,27 +289,30 @@ export const loginMI = async (req: Request, res: Response) => {
     if (!validatedClientSecretDatum) throw UnauthorizedRequestError();
     
     const {
-        expiresAt,
+        clientSecretTTL,
-        clientSecretUsageCount,
+        clientSecretNumUses,
-        clientSecretUsageLimit
+        clientSecretNumUsesLimit,
     } = validatedClientSecretDatum;
 
-    if (expiresAt && new Date(expiresAt) < new Date()) {
+    if (clientSecretTTL > 0) {
-        // client secret expired
+        const expiresAt = new Date(new Date().getTime() + clientSecretTTL * 1000);
-        await MachineIdentityClientSecretData.findByIdAndUpdate(
-            validatedClientSecretDatum._id,
-            {
-                isActive: false
-            },
-            {
-                new: true
-            }
-        );
         
-        throw UnauthorizedRequestError();
+        if (expiresAt < new Date()) {
+            await MachineIdentityClientSecretData.findByIdAndUpdate(
+                validatedClientSecretDatum._id,
+                {
+                    isActive: false
+                },
+                {
+                    new: true
+                }
+            );
+    
+            throw UnauthorizedRequestError();
+        }
     }
     
-    if (clientSecretUsageLimit > 0 && clientSecretUsageCount === clientSecretUsageLimit) {
+    if (clientSecretNumUses > 0 && clientSecretNumUses === clientSecretNumUsesLimit) {
         // number of times client secret can be used for 
         // a login operation reached
         await MachineIdentityClientSecretData.findByIdAndUpdate(
@@ -334,7 +332,7 @@ export const loginMI = async (req: Request, res: Response) => {
     await MachineIdentityClientSecretData.findByIdAndUpdate(
         validatedClientSecretDatum._id,
         {
-            $inc: { clientSecretUsageCount: 1 }
+            $inc: { clientSecretNumUses: 1 }
         },
         {
             new: true

backend/src/models/machineIdentityClientSecretData.ts

@@ -8,10 +8,12 @@ export interface IMachineIdentityClientSecretData extends Document {
     clientSecretPrefix: string;
     clientSecretHash: string;
     clientSecretLastUsed?: Date;
-    clientSecretUsageCount: number;
+    clientSecretNumUses: number;
-    clientSecretUsageLimit: number;
+    clientSecretNumUsesLimit: number;
+    clientSecretTTL: number;
     accessTokenVersion: number;
-    expiresAt?: Date;
+    updatedAt: Date;
+    createdAt: Date;
 }
 
 const machineIdentityClientSecretDataSchema = new Schema(
@@ -42,29 +44,30 @@ const machineIdentityClientSecretDataSchema = new Schema(
             type: Date,
             required: false
         },
-        clientSecretUsageCount: {
+        clientSecretNumUses: {
             // number of times client secret has been used
             // in login operation
             type: Number,
             default: 0,
             required: true
         },
-        clientSecretUsageLimit: {
+        clientSecretNumUsesLimit: {
             // number of times client secret can be used for
             // a login operation
             type: Number,
             default: 0, // default: used as many times as needed
             required: true
         },
+        clientSecretTTL: {
+            type: Number,
+            default: 0, // default: does not expire
+            required: true
+        },
         accessTokenVersion: {
             type: Number,
             default: 1,
             required: true
         },
-        expiresAt: {
-            type: Date,
-            required: false
-        }
     },
     {
         timestamps: true

backend/src/validation/machineIdentity.ts

@@ -13,7 +13,7 @@ export const CreateClientSecretV3 = z.object({
   }),
   body: z.object({
     description: z.string().trim().default(""),
-    usageLimit: z.number().min(0).default(0),
+    numUsesLimit: z.number().min(0).default(0),
     ttl: z.number().min(0).default(0),
   }),
 });

frontend/src/hooks/api/machineIdentities/types.ts

@@ -28,9 +28,11 @@ export type MachineIdentityClientSecret = {
     isActive: boolean;
     description: string;
     clientSecretPrefix: string;
-    clientSecretUsageCount: number;
+    clientSecretNumUses: number;
-    clientSecretUsageLimit: number;
+    clientSecretNumUsesLimit: number;
-    expiresAt: string;
+    clientSecretTTL: number;
+    createdAt: string;
+    updatedAt: string;
 }
 
 export type MachineMembershipOrg = {
@@ -78,8 +80,8 @@ export type CreateMachineIdentityClientSecretRes = {
     machineIdentity: string;
     isActive: boolean;
     description: string;
-    clientSecretUsageCount: number;
+    clientSecretNumUses: number;
-    clientSecretUsageLimit: number;
+    clientSecretNumUsesLimit: number;
     expiresAt?: Date;
 }
 

frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/CreateClientSecretModal.tsx

@@ -10,13 +10,13 @@ import * as yup from "yup";
 import { useNotificationContext } from "@app/components/context/Notifications/NotificationProvider";
 import {
     Button,
+    DeleteActionModal,
     EmptyState,
     FormControl,
     IconButton,
     Input,
     Modal,
-    ModalContent
+    ModalContent,
-,
     Table,
     TableContainer,
     TableSkeleton,
@@ -41,12 +41,20 @@ const schema = yup.object({
 export type FormData = yup.InferType<typeof schema>;
 
 type Props = {
-  popUp: UsePopUpState<["clientSecret"]>;
+    popUp: UsePopUpState<["clientSecret", "deleteClientSecret"]>;
-  handlePopUpToggle: (popUpName: keyof UsePopUpState<["clientSecret"]>, state?: boolean) => void;
+    handlePopUpOpen: (
+        popUpName: keyof UsePopUpState<["deleteClientSecret"]>,
+        data?: {
+            clientSecretPrefix: string;
+            clientSecretId: string;
+        }
+    ) => void;
+    handlePopUpToggle: (popUpName: keyof UsePopUpState<["clientSecret", "deleteClientSecret"]>, state?: boolean) => void;
 };
 
 export const CreateClientSecretModal = ({
     popUp,
+    handlePopUpOpen,
     handlePopUpToggle
 }: Props) => {
     const { t } = useTranslation();
@@ -120,6 +128,43 @@ export const CreateClientSecretModal = ({
         }
     }
     
+    const onDeleteClientSecretSubmit = async ({
+        clientSecretId,
+        clientSecretPrefix
+    }: {
+        clientSecretId: string;
+        clientSecretPrefix: string;
+    }) => {
+        try {
+            
+            if (!popUpData?.machineId) return;
+
+            await deleteClientSecretMutateAsync({
+                machineId: popUpData.machineId,
+                clientSecretId
+            });
+
+            if (token.startsWith(clientSecretPrefix)) {
+                reset();
+                setToken("");
+            }
+            
+            handlePopUpToggle("deleteClientSecret", false);
+        
+            createNotification({
+                text: "Successfully deleted client secret",
+                type: "success"
+            });
+        } catch (err) {
+            console.error(err);
+            createNotification({
+                text: "Failed to delete client secret",
+                type: "error"
+            });
+            
+        }
+    }
+
     const hasToken = Boolean(token);
 
     return (
@@ -238,20 +283,24 @@ export const CreateClientSecretModal = ({
                             data.map(({
                                 _id,
                                 description,
-                                machineIdentity,
+                                clientSecretTTL,
-                                expiresAt,
                                 clientSecretPrefix
                             }) => {
+                                let expiresAt;
+                                if (clientSecretTTL > 0) {
+                                    expiresAt = new Date(new Date().getTime() + clientSecretTTL * 1000);
+                                }
+                                
                                 return (
                                     <Tr className="h-10" key={`mi-client-secret-${_id}`}>
                                         <Td>{description === "" ? "-" : description}</Td>
-                                        <Td>{expiresAt ? format(new Date(expiresAt), "yyyy-MM-dd") : "-"}</Td>
+                                        <Td>{expiresAt ? format(expiresAt, "yyyy-MM-dd") : "-"}</Td>
                                         <Td>{`${clientSecretPrefix}************`}</Td>
                                         <Td className="flex">
                                             <IconButton
-                                                onClick={async () => {
+                                                onClick={() => {
-                                                    await deleteClientSecretMutateAsync({
+                                                    handlePopUpOpen("deleteClientSecret", {
-                                                        machineId: machineIdentity,
+                                                        clientSecretPrefix,
                                                         clientSecretId: _id
                                                     });
                                                 }}
@@ -277,6 +326,25 @@ export const CreateClientSecretModal = ({
                         </TBody>
                     </Table>
                 </TableContainer>
+                <DeleteActionModal
+                    isOpen={popUp.deleteClientSecret.isOpen}
+                    title={`Are you sure want to delete the client secret ${
+                        (popUp?.deleteClientSecret?.data as { clientSecretPrefix: string })?.clientSecretPrefix || ""
+                    }************?`}
+                    onChange={(isOpen) => handlePopUpToggle("deleteClientSecret", isOpen)}
+                    deleteKey="confirm"
+                    onDeleteApproved={() => {
+                        const deleteClientSecretData = (popUp?.deleteClientSecret?.data as {
+                            clientSecretId: string;
+                            clientSecretPrefix: string;
+                        });
+                        
+                        return onDeleteClientSecretSubmit({
+                            clientSecretId: deleteClientSecretData.clientSecretId,
+                            clientSecretPrefix: deleteClientSecretData.clientSecretPrefix
+                        });
+                    }}
+                />
             </ModalContent>
         </Modal>
     );

frontend/src/views/Org/MembersPage/components/OrgMachineIdentityTab/components/MachineIdentitySection/MachineIdentitySection.tsx

@@ -24,6 +24,7 @@ export const MachineIdentitySection = withPermission(
       "machineIdentity",
       "deleteMachineIdentity",
       "clientSecret",
+      "deleteClientSecret",
       "upgradePlan"
     ] as const);
     
@@ -80,6 +81,7 @@ export const MachineIdentitySection = withPermission(
           />
           <CreateClientSecretModal 
             popUp={popUp}
+            handlePopUpOpen={handlePopUpOpen}
             handlePopUpToggle={handlePopUpToggle}
           />
           <DeleteActionModal