Merge branch 'ENG-3506' into ENG-3506-LDAP

frontend/src/hooks/api/appConnections/checkly/queries.tsx

@@ -8,7 +8,9 @@ import { TChecklyAccount } from "./types";
 const checklyConnectionKeys = {
   all: [...appConnectionKeys.all, "checkly"] as const,
   listAccounts: (connectionId: string) =>
-    [...checklyConnectionKeys.all, "workspace-scopes", connectionId] as const
+    [...checklyConnectionKeys.all, "workspace-scopes", connectionId] as const,
+  listGroups: (connectionId: string, accountId: string) =>
+    [...checklyConnectionKeys.all, "groups", connectionId, accountId] as const
 };
 
 export const useChecklyConnectionListAccounts = (
@@ -35,3 +37,29 @@ export const useChecklyConnectionListAccounts = (
     ...options
   });
 };
+
+export const useChecklyConnectionListGroups = (
+  connectionId: string,
+  accountId: string,
+  options?: Omit<
+    UseQueryOptions<
+      TChecklyAccount[],
+      unknown,
+      TChecklyAccount[],
+      ReturnType<typeof checklyConnectionKeys.listGroups>
+    >,
+    "queryKey" | "queryFn"
+  >
+) => {
+  return useQuery({
+    queryKey: checklyConnectionKeys.listGroups(connectionId, accountId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{ groups: TChecklyAccount[] }>(
+        `/api/v1/app-connections/checkly/${connectionId}/accounts/${accountId}/groups`
+      );
+
+      return data.groups;
+    },
+    ...options
+  });
+};

frontend/src/hooks/api/appConnections/enums.ts

@@ -7,6 +7,7 @@ export enum AppConnection {
   AzureAppConfiguration = "azure-app-configuration",
   AzureClientSecrets = "azure-client-secrets",
   AzureDevOps = "azure-devops",
+  AzureADCS = "azure-adcs",
   Databricks = "databricks",
   Humanitec = "humanitec",
   TerraformCloud = "terraform-cloud",

frontend/src/hooks/api/appConnections/queries.tsx

@@ -54,13 +54,13 @@ export const useAppConnectionOptions = (
 export const useGetAppConnectionOption = <T extends AppConnection>(app: T) => {
   const { data: options = [], isPending } = useAppConnectionOptions();
 
-  return useMemo(
-    () => ({
-      option: (options.find((opt) => opt.app === app) as TAppConnectionOptionMap[T]) ?? {},
+  return useMemo(() => {
+    const foundOption = options.find((opt) => opt.app === app);
+    return {
+      option: (foundOption as TAppConnectionOptionMap[T]) ?? {},
       isLoading: isPending
-    }),
-    [options, app, isPending]
-  );
+    };
+  }, [options, app, isPending]);
 };
 
 export const useListAppConnections = (

frontend/src/hooks/api/appConnections/types/app-options.ts

@@ -32,7 +32,7 @@ export type TAzureKeyVaultConnectionOption = TAppConnectionOptionBase & {
 };
 
 export type TAzureAppConfigurationConnectionOption = TAppConnectionOptionBase & {
-  app: AppConnection.AzureKeyVault;
+  app: AppConnection.AzureAppConfiguration;
   oauthClientId?: string;
 };
 
@@ -164,9 +164,14 @@ export type TOktaConnectionOption = TAppConnectionOptionBase & {
   app: AppConnection.Okta;
 };
 
+export type TAzureAdCsConnectionOption = TAppConnectionOptionBase & {
+  app: AppConnection.AzureADCS;
+};
+
 export type TAppConnectionOption =
   | TAwsConnectionOption
   | TGitHubConnectionOption
+  | TGitHubRadarConnectionOption
   | TGcpConnectionOption
   | TAzureAppConfigurationConnectionOption
   | TAzureKeyVaultConnectionOption
@@ -184,6 +189,7 @@ export type TAppConnectionOption =
   | TWindmillConnectionOption
   | TAuth0ConnectionOption
   | THCVaultConnectionOption
+  | TLdapConnectionOption
   | TTeamCityConnectionOption
   | TOCIConnectionOption
   | TOnePassConnectionOption
@@ -196,9 +202,11 @@ export type TAppConnectionOption =
   | TZabbixConnectionOption
   | TRailwayConnectionOption
   | TChecklyConnectionOption
+  | TSupabaseConnectionOption
   | TDigitalOceanConnectionOption
   | TNetlifyConnectionOption
-  | TOktaConnectionOption;
+  | TOktaConnectionOption
+  | TAzureAdCsConnectionOption;
 
 export type TAppConnectionOptionMap = {
   [AppConnection.AWS]: TAwsConnectionOption;
@@ -238,4 +246,5 @@ export type TAppConnectionOptionMap = {
   [AppConnection.DigitalOcean]: TDigitalOceanConnectionOption;
   [AppConnection.Netlify]: TNetlifyConnectionOption;
   [AppConnection.Okta]: TOktaConnectionOption;
+  [AppConnection.AzureADCS]: TAzureAdCsConnectionOption;
 };

frontend/src/hooks/api/appConnections/types/azure-adcs-connection.ts

@@ -0,0 +1,21 @@
+import { z } from "zod";
+
+import { AppConnection } from "../enums";
+import { TRootAppConnection } from "./root-connection";
+
+export enum AzureADCSConnectionMethod {
+  UsernamePassword = "username-password"
+}
+
+export const CreateAzureADCSConnectionSchema = z.object({
+  adcsUrl: z.string().url().min(1, "ADCS URL is required"),
+  username: z.string().min(1, "Username is required"),
+  password: z.string().min(1, "Password is required")
+});
+
+export type TCreateAzureADCSConnection = z.infer<typeof CreateAzureADCSConnectionSchema>;
+
+export type TAzureADCSConnection = TRootAppConnection & { app: AppConnection.AzureADCS } & {
+  method: AzureADCSConnectionMethod.UsernamePassword;
+  credentials: TCreateAzureADCSConnection;
+};

frontend/src/hooks/api/appConnections/types/index.ts

@@ -3,6 +3,7 @@ import { TOnePassConnection } from "./1password-connection";
 import { TAppConnectionOption } from "./app-options";
 import { TAuth0Connection } from "./auth0-connection";
 import { TAwsConnection } from "./aws-connection";
+import { TAzureADCSConnection } from "./azure-adcs-connection";
 import { TAzureAppConfigurationConnection } from "./azure-app-configuration-connection";
 import { TAzureClientSecretsConnection } from "./azure-client-secrets-connection";
 import { TAzureDevOpsConnection } from "./azure-devops-connection";
@@ -41,6 +42,7 @@ import { TZabbixConnection } from "./zabbix-connection";
 export * from "./1password-connection";
 export * from "./auth0-connection";
 export * from "./aws-connection";
+export * from "./azure-adcs-connection";
 export * from "./azure-app-configuration-connection";
 export * from "./azure-client-secrets-connection";
 export * from "./azure-devops-connection";
@@ -83,6 +85,7 @@ export type TAppConnection =
   | TAzureAppConfigurationConnection
   | TAzureClientSecretsConnection
   | TAzureDevOpsConnection
+  | TAzureADCSConnection
   | TDatabricksConnection
   | THumanitecConnection
   | TTerraformCloudConnection
@@ -156,6 +159,7 @@ export type TAppConnectionMap = {
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
   [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
   [AppConnection.AzureDevOps]: TAzureDevOpsConnection;
+  [AppConnection.AzureADCS]: TAzureADCSConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
   [AppConnection.TerraformCloud]: TTerraformCloudConnection;

frontend/src/hooks/api/ca/constants.tsx

@@ -1,7 +1,7 @@
 import { AppConnection } from "../appConnections/enums";
 import { SshCaStatus } from "../sshCa";
 import { SshCertTemplateStatus } from "../sshCertificateTemplates";
-import { AcmeDnsProvider, CaStatus, InternalCaType } from "./enums";
+import { AcmeDnsProvider, CaCapability, CaStatus, CaType, InternalCaType } from "./enums";
 
 export const caTypeToNameMap: { [K in InternalCaType]: string } = {
   [InternalCaType.ROOT]: "Root",
@@ -24,6 +24,28 @@ export const ACME_DNS_PROVIDER_APP_CONNECTION_MAP: Record<AcmeDnsProvider, AppCo
   [AcmeDnsProvider.Cloudflare]: AppConnection.Cloudflare
 };
 
+export const CA_TYPE_CAPABILITIES_MAP: Record<CaType, CaCapability[]> = {
+  [CaType.INTERNAL]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.ACME]: [
+    CaCapability.ISSUE_CERTIFICATES,
+    CaCapability.REVOKE_CERTIFICATES,
+    CaCapability.RENEW_CERTIFICATES
+  ],
+  [CaType.AZURE_AD_CS]: [CaCapability.ISSUE_CERTIFICATES, CaCapability.RENEW_CERTIFICATES]
+};
+
+/**
+ * Check if a certificate authority type supports a specific capability
+ */
+export const caSupportsCapability = (caType: CaType, capability: CaCapability): boolean => {
+  const capabilities = CA_TYPE_CAPABILITIES_MAP[caType] || [];
+  return capabilities.includes(capability);
+};
+
 export const getCaStatusBadgeVariant = (status: CaStatus | SshCaStatus | SshCertTemplateStatus) => {
   switch (status) {
     case CaStatus.ACTIVE:

frontend/src/hooks/api/ca/enums.tsx

@@ -1,6 +1,7 @@
 export enum CaType {
   INTERNAL = "internal",
-  ACME = "acme"
+  ACME = "acme",
+  AZURE_AD_CS = "azure-ad-cs"
 }
 
 export enum InternalCaType {
@@ -22,3 +23,9 @@ export enum AcmeDnsProvider {
   ROUTE53 = "route53",
   Cloudflare = "cloudflare"
 }
+
+export enum CaCapability {
+  ISSUE_CERTIFICATES = "issue-certificates",
+  REVOKE_CERTIFICATES = "revoke-certificates",
+  RENEW_CERTIFICATES = "renew-certificates"
+}

frontend/src/hooks/api/ca/index.tsx

@@ -9,6 +9,7 @@ export {
   useUpdateCa
 } from "./mutations";
 export {
+  useGetAzureAdcsTemplates,
   useGetCa,
   useGetCaById,
   useGetCaCert,
@@ -17,5 +18,6 @@ export {
   useGetCaCrls,
   useGetCaCsr,
   useListCasByProjectId,
-  useListCasByTypeAndProjectId
+  useListCasByTypeAndProjectId,
+  useListExternalCasByProjectId
 } from "./queries";

frontend/src/hooks/api/ca/mutations.tsx

@@ -39,6 +39,10 @@ export const useUpdateCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.getCaByNameAndProjectId(caName, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listExternalCasByProjectId(projectId)
+      });
     }
   });
 };
@@ -57,6 +61,10 @@ export const useCreateCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listExternalCasByProjectId(projectId)
+      });
     }
   });
 };
@@ -79,6 +87,10 @@ export const useDeleteCa = () => {
       queryClient.invalidateQueries({
         queryKey: caKeys.listCasByTypeAndProjectId(type, projectId)
       });
+      // Invalidate external CAs list
+      queryClient.invalidateQueries({
+        queryKey: caKeys.listExternalCasByProjectId(projectId)
+      });
     }
   });
 };

frontend/src/hooks/api/ca/queries.tsx

@@ -4,20 +4,25 @@ import { apiRequest } from "@app/config/request";
 
 import { TCertificateTemplate } from "../certificateTemplates/types";
 import { CaType } from "./enums";
-import { TCertificateAuthority, TUnifiedCertificateAuthority } from "./types";
+import { TAzureAdCsTemplate, TCertificateAuthority, TUnifiedCertificateAuthority } from "./types";
 
 export const caKeys = {
   getCaById: (caId: string) => [{ caId }, "ca"],
   getCaByNameAndProjectId: (caName: string, projectId: string) => [{ caName, projectId }, "ca"],
   listCasByTypeAndProjectId: (type: CaType, projectId: string) => [{ type, projectId }, "cas"],
   listCasByProjectId: (projectId: string) => [{ projectId }, "cas"],
+  listExternalCasByProjectId: (projectId: string) => [{ projectId }, "external-cas"],
   getCaCerts: (caId: string) => [{ caId }, "ca-cert"],
   getCaCrls: (caId: string) => [{ caId }, "ca-crls"],
   getCaCert: (caId: string) => [{ caId }, "ca-cert"],
   getCaCsr: (caId: string) => [{ caId }, "ca-csr"],
   getCaCrl: (caId: string) => [{ caId }, "ca-crl"],
   getCaCertTemplates: (caId: string) => [{ caId }, "ca-cert-templates"],
-  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"]
+  getCaEstConfig: (caId: string) => [{ caId }, "ca-est-config"],
+  getAzureAdcsTemplates: (caId: string, projectId: string) => [
+    { caId, projectId },
+    "azure-adcs-templates"
+  ]
 };
 
 export const useGetCa = ({
@@ -67,6 +72,34 @@ export const useListCasByProjectId = (projectId: string) => {
   });
 };
 
+export const useListExternalCasByProjectId = (projectId: string) => {
+  return useQuery({
+    queryKey: caKeys.listExternalCasByProjectId(projectId),
+    queryFn: async () => {
+      const [acmeResponse, azureAdCsResponse] = await Promise.allSettled([
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.ACME}?projectId=${projectId}`
+        ),
+        apiRequest.get<TUnifiedCertificateAuthority[]>(
+          `/api/v1/pki/ca/${CaType.AZURE_AD_CS}?projectId=${projectId}`
+        )
+      ]);
+
+      const allCas: TUnifiedCertificateAuthority[] = [];
+
+      if (acmeResponse.status === "fulfilled") {
+        allCas.push(...acmeResponse.value.data);
+      }
+
+      if (azureAdCsResponse.status === "fulfilled") {
+        allCas.push(...azureAdCsResponse.value.data);
+      }
+
+      return allCas;
+    }
+  });
+};
+
 export const useGetCaById = (caId: string) => {
   return useQuery({
     queryKey: caKeys.getCaById(caId),
@@ -156,3 +189,22 @@ export const useGetCaCertTemplates = (caId: string) => {
     enabled: Boolean(caId)
   });
 };
+
+export const useGetAzureAdcsTemplates = ({
+  caId,
+  projectId
+}: {
+  caId: string;
+  projectId: string;
+}) => {
+  return useQuery({
+    queryKey: caKeys.getAzureAdcsTemplates(caId, projectId),
+    queryFn: async () => {
+      const { data } = await apiRequest.get<{
+        templates: TAzureAdCsTemplate[];
+      }>(`/api/v1/pki/ca/azure-ad-cs/${caId}/templates?projectId=${projectId}`);
+      return data;
+    },
+    enabled: Boolean(caId && projectId)
+  });
+};

frontend/src/hooks/api/ca/types.ts

@@ -19,6 +19,19 @@ export type TAcmeCertificateAuthority = {
   };
 };
 
+export type TAzureAdCsCertificateAuthority = {
+  id: string;
+  projectId: string;
+  type: CaType.AZURE_AD_CS;
+  status: CaStatus;
+  name: string;
+  enableDirectIssuance: boolean;
+  configuration: {
+    azureAdcsConnectionId: string;
+    templateName: string;
+  };
+};
+
 export type TInternalCertificateAuthority = {
   id: string;
   projectId: string;
@@ -48,6 +61,7 @@ export type TInternalCertificateAuthority = {
 
 export type TUnifiedCertificateAuthority =
   | TAcmeCertificateAuthority
+  | TAzureAdCsCertificateAuthority
   | TInternalCertificateAuthority;
 
 export type TCreateCertificateAuthorityDTO = Omit<TUnifiedCertificateAuthority, "id">;
@@ -114,6 +128,12 @@ export type TSignIntermediateResponse = {
   serialNumber: string;
 };
 
+export type TAzureAdCsTemplate = {
+  id: string;
+  name: string;
+  description?: string;
+};
+
 export type TImportCaCertificateDTO = {
   caId: string;
   projectSlug: string;

frontend/src/hooks/api/pkiSubscriber/types.ts

@@ -10,6 +10,16 @@ export enum SubscriberOperationStatus {
   FAILED = "failed"
 }
 
+export type TPkiSubscriberProperties = {
+  azureTemplateType?: string;
+  organization?: string;
+  organizationalUnit?: string;
+  country?: string;
+  state?: string;
+  locality?: string;
+  emailAddress?: string;
+};
+
 export type TPkiSubscriber = {
   id: string;
   projectId: string;
@@ -27,6 +37,7 @@ export type TPkiSubscriber = {
   lastOperationStatus?: SubscriberOperationStatus;
   lastOperationMessage?: string;
   lastOperationAt?: string;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TCreatePkiSubscriberDTO = {
@@ -40,6 +51,7 @@ export type TCreatePkiSubscriberDTO = {
   extendedKeyUsages: CertExtendedKeyUsage[];
   enableAutoRenewal?: boolean;
   autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TUpdatePkiSubscriberDTO = {
@@ -55,6 +67,7 @@ export type TUpdatePkiSubscriberDTO = {
   extendedKeyUsages?: CertExtendedKeyUsage[];
   enableAutoRenewal?: boolean;
   autoRenewalPeriodInDays?: number;
+  properties?: TPkiSubscriberProperties;
 };
 
 export type TDeletePkiSubscriberDTO = {

frontend/src/hooks/api/secretSyncs/types/checkly-sync.ts

@@ -3,11 +3,17 @@ import { AppConnection } from "@app/hooks/api/appConnections/enums";
 import { SecretSync } from "@app/hooks/api/secretSyncs";
 import { TRootSecretSync } from "@app/hooks/api/secretSyncs/types/root-sync";
 
+export enum ChecklySyncScope {
+  Global = "global",
+  Group = "group"
+}
 export type TChecklySync = TRootSecretSync & {
   destination: SecretSync.Checkly;
   destinationConfig: {
     accountId: string;
     accountName: string;
+    groupId?: string;
+    groupName?: string;
   };
   connection: {
     app: AppConnection.Checkly;