Merge pull request #3079 from Infisical/feat/kmip-client-management

feat: kmip

frontend/src/hooks/api/auditLogs/constants.tsx

@@ -121,7 +121,24 @@ export const eventToNameMap: { [K in EventType]: string } = {
   [EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_ASSIGN_USER]:
     "OIDC group membership mapping assigned user to groups",
   [EventType.OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER]:
-    "OIDC group membership mapping removed user from groups"
+    "OIDC group membership mapping removed user from groups",
+  [EventType.CREATE_KMIP_CLIENT]: "Create KMIP client",
+  [EventType.UPDATE_KMIP_CLIENT]: "Update KMIP client",
+  [EventType.DELETE_KMIP_CLIENT]: "Delete KMIP client",
+  [EventType.GET_KMIP_CLIENT]: "Get KMIP client",
+  [EventType.GET_KMIP_CLIENTS]: "Get KMIP clients",
+  [EventType.CREATE_KMIP_CLIENT_CERTIFICATE]: "Create KMIP client certificate",
+  [EventType.SETUP_KMIP]: "Setup KMIP configuration",
+  [EventType.GET_KMIP]: "Get KMIP configuration",
+  [EventType.REGISTER_KMIP_SERVER]: "Register KMIP server",
+  [EventType.KMIP_OPERATION_CREATE]: "KMIP operation create",
+  [EventType.KMIP_OPERATION_GET]: "KMIP operation get",
+  [EventType.KMIP_OPERATION_DESTROY]: "KMIP operation destroy",
+  [EventType.KMIP_OPERATION_GET_ATTRIBUTES]: "KMIP operation get attributes",
+  [EventType.KMIP_OPERATION_ACTIVATE]: "KMIP operation activate",
+  [EventType.KMIP_OPERATION_REVOKE]: "KMIP operation revoke",
+  [EventType.KMIP_OPERATION_LOCATE]: "KMIP operation locate",
+  [EventType.KMIP_OPERATION_REGISTER]: "KMIP operation register"
 };
 
 export const userAgentTTypeoNameMap: { [K in UserAgentType]: string } = {

frontend/src/hooks/api/auditLogs/enums.tsx

@@ -1,5 +1,6 @@
 export enum ActorType {
   PLATFORM = "platform",
+  KMIP_CLIENT = "kmipClient",
   USER = "user",
   SERVICE = "service",
   IDENTITY = "identity",
@@ -132,5 +133,22 @@ export enum EventType {
   SECRET_SYNC_IMPORT_SECRETS = "secret-sync-import-secrets",
   SECRET_SYNC_REMOVE_SECRETS = "secret-sync-remove-secrets",
   OIDC_GROUP_MEMBERSHIP_MAPPING_ASSIGN_USER = "oidc-group-membership-mapping-assign-user",
-  OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER = "oidc-group-membership-mapping-remove-user"
+  OIDC_GROUP_MEMBERSHIP_MAPPING_REMOVE_USER = "oidc-group-membership-mapping-remove-user",
+  CREATE_KMIP_CLIENT = "create-kmip-client",
+  UPDATE_KMIP_CLIENT = "update-kmip-client",
+  DELETE_KMIP_CLIENT = "delete-kmip-client",
+  GET_KMIP_CLIENT = "get-kmip-client",
+  GET_KMIP_CLIENTS = "get-kmip-clients",
+  CREATE_KMIP_CLIENT_CERTIFICATE = "create-kmip-client-certificate",
+  SETUP_KMIP = "setup-kmip",
+  GET_KMIP = "get-kmip",
+  REGISTER_KMIP_SERVER = "register-kmip-server",
+  KMIP_OPERATION_CREATE = "kmip-operation-create",
+  KMIP_OPERATION_GET = "kmip-operation-get",
+  KMIP_OPERATION_DESTROY = "kmip-operation-destroy",
+  KMIP_OPERATION_GET_ATTRIBUTES = "kmip-operation-get-attributes",
+  KMIP_OPERATION_ACTIVATE = "kmip-operation-activate",
+  KMIP_OPERATION_REVOKE = "kmip-operation-revoke",
+  KMIP_OPERATION_LOCATE = "kmip-operation-locate",
+  KMIP_OPERATION_REGISTER = "kmip-operation-register"
 }

frontend/src/hooks/api/auditLogs/types.tsx

@@ -30,6 +30,10 @@ interface IdentityActorMetadata {
   identityId: string;
   name: string;
 }
+interface KmipClientActorMetadata {
+  clientId: string;
+  name: string;
+}
 
 interface UserActor {
   type: ActorType.USER;
@@ -51,11 +55,22 @@ export interface PlatformActor {
   metadata: object;
 }
 
+export interface KmipClientActor {
+  type: ActorType.KMIP_CLIENT;
+  metadata: KmipClientActorMetadata;
+}
+
 export interface UnknownUserActor {
   type: ActorType.UNKNOWN_USER;
 }
 
-export type Actor = UserActor | ServiceActor | IdentityActor | PlatformActor | UnknownUserActor;
+export type Actor =
+  | UserActor
+  | ServiceActor
+  | IdentityActor
+  | PlatformActor
+  | UnknownUserActor
+  | KmipClientActor;
 
 interface GetSecretsEvent {
   type: EventType.GET_SECRETS;

frontend/src/hooks/api/kmip/index.ts

@@ -0,0 +1,2 @@
+export * from "./mutation";
+export * from "./queries";

frontend/src/hooks/api/kmip/mutation.ts

@@ -0,0 +1,90 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { kmipKeys } from "./queries";
+import {
+  KmipClientCertificate,
+  TCreateKmipClient,
+  TDeleteKmipClient,
+  TGenerateKmipClientCertificate,
+  TSetupOrgKmipDTO,
+  TUpdateKmipClient
+} from "./types";
+
+export const useCreateKmipClient = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (payload: TCreateKmipClient) => {
+      const { data } = await apiRequest.post("/api/v1/kmip/clients", payload);
+
+      return data;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: kmipKeys.getKmipClientsByProjectId({ projectId })
+      });
+    }
+  });
+};
+
+export const useUpdateKmipClient = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ id, name, description, permissions }: TUpdateKmipClient) => {
+      const { data } = await apiRequest.patch(`/api/v1/kmip/clients/${id}`, {
+        name,
+        description,
+        permissions
+      });
+
+      return data;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: kmipKeys.getKmipClientsByProjectId({ projectId })
+      });
+    }
+  });
+};
+
+export const useDeleteKmipClients = () => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async ({ id }: TDeleteKmipClient) => {
+      const { data } = await apiRequest.delete(`/api/v1/kmip/clients/${id}`);
+
+      return data;
+    },
+    onSuccess: (_, { projectId }) => {
+      queryClient.invalidateQueries({
+        queryKey: kmipKeys.getKmipClientsByProjectId({ projectId })
+      });
+    }
+  });
+};
+
+export const useGenerateKmipClientCertificate = () => {
+  return useMutation({
+    mutationFn: async (payload: TGenerateKmipClientCertificate) => {
+      const { data } = await apiRequest.post<KmipClientCertificate>(
+        `/api/v1/kmip/clients/${payload.clientId}/certificates`,
+        payload
+      );
+
+      return data;
+    }
+  });
+};
+
+export const useSetupOrgKmip = (orgId: string) => {
+  const queryClient = useQueryClient();
+  return useMutation({
+    mutationFn: async (payload: TSetupOrgKmipDTO) => {
+      await apiRequest.post("/api/v1/kmip", payload);
+    },
+    onSuccess: () => {
+      queryClient.invalidateQueries({ queryKey: kmipKeys.getOrgKmip(orgId) });
+    }
+  });
+};

frontend/src/hooks/api/kmip/queries.tsx

@@ -0,0 +1,69 @@
+import { useQuery, UseQueryOptions } from "@tanstack/react-query";
+
+import { apiRequest } from "@app/config/request";
+
+import { OrderByDirection } from "../generic/types";
+import {
+  KmipClientOrderBy,
+  OrgKmipConfig,
+  TListProjectKmipClientsDTO,
+  TProjectKmipClientList
+} from "./types";
+
+export const kmipKeys = {
+  getKmipClientsByProjectId: ({ projectId, ...filters }: TListProjectKmipClientsDTO) =>
+    [projectId, filters] as const,
+  getOrgKmip: (orgId: string) => [{ orgId }, "org-kmip-config"] as const
+};
+
+export const useGetKmipClientsByProjectId = (
+  {
+    projectId,
+    offset = 0,
+    limit = 100,
+    orderBy = KmipClientOrderBy.Name,
+    orderDirection = OrderByDirection.ASC,
+    search = ""
+  }: TListProjectKmipClientsDTO,
+  options?: Omit<
+    UseQueryOptions<
+      TProjectKmipClientList,
+      unknown,
+      TProjectKmipClientList,
+      ReturnType<typeof kmipKeys.getKmipClientsByProjectId>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: kmipKeys.getKmipClientsByProjectId({
+      projectId,
+      offset,
+      limit,
+      orderBy,
+      orderDirection,
+      search
+    }),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<TProjectKmipClientList>("/api/v1/kmip/clients", {
+        params: { projectId, offset, limit, search, orderBy, orderDirection }
+      });
+
+      return data;
+    },
+    enabled: Boolean(projectId) && (options?.enabled ?? true),
+    placeholderData: (previousData) => previousData,
+    ...options
+  });
+};
+
+export const useGetOrgKmipConfig = (orgId: string) => {
+  return useQuery({
+    queryKey: kmipKeys.getOrgKmip(orgId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<OrgKmipConfig>("/api/v1/kmip");
+
+      return data;
+    }
+  });
+};

frontend/src/hooks/api/kmip/types.ts

@@ -0,0 +1,81 @@
+import { CertKeyAlgorithm } from "../certificates/enums";
+import { OrderByDirection } from "../generic/types";
+
+export enum KmipPermission {
+  Create = "create",
+  Locate = "locate",
+  Check = "check",
+  Get = "get",
+  GetAttributes = "get-attributes",
+  Activate = "activate",
+  Revoke = "revoke",
+  Destroy = "destroy",
+  Register = "register"
+}
+
+export type TKmipClient = {
+  id: string;
+  name: string;
+  description?: string;
+  permissions: KmipPermission[];
+  projectId: string;
+};
+
+type ProjectRef = { projectId: string };
+type KeyRef = { id: string };
+
+export type TCreateKmipClient = Pick<TKmipClient, "name" | "description" | "permissions"> &
+  ProjectRef;
+
+export type TUpdateKmipClient = KeyRef &
+  Partial<Pick<TKmipClient, "name" | "description" | "permissions">> &
+  ProjectRef;
+
+export type TProjectKmipClientList = {
+  kmipClients: TKmipClient[];
+  totalCount: number;
+};
+
+export type TGenerateKmipClientCertificate = {
+  keyAlgorithm: CertKeyAlgorithm;
+  ttl: string;
+  clientId: string;
+};
+
+export type KmipClientCertificate = {
+  serialNumber: string;
+  certificate: string;
+  certificateChain: string;
+  privateKey: string;
+};
+
+export type TDeleteKmipClient = KeyRef & ProjectRef;
+
+export type TListProjectKmipClientsDTO = {
+  projectId: string;
+  offset?: number;
+  limit?: number;
+  orderBy?: KmipClientOrderBy;
+  orderDirection?: OrderByDirection;
+  search?: string;
+};
+
+export enum KmipClientOrderBy {
+  Name = "name"
+}
+
+export type OrgKmipConfig = {
+  serverCertificateChain: string;
+  clientCertificateChain: string;
+};
+
+export type TSetupOrgKmipDTO = {
+  caKeyAlgorithm: CertKeyAlgorithm;
+};
+
+export type OrgKmipServerCert = {
+  serialNumber: string;
+  certificate: string;
+  certificateChain: string;
+  privateKey: string;
+};

frontend/src/hooks/api/subscriptions/types.ts

@@ -46,4 +46,5 @@ export type SubscriptionPlan = {
   pkiEst: boolean;
   enforceMfa: boolean;
   projectTemplates: boolean;
+  kmip: boolean;
 };