fix: GET token-auth-token endpoint

backend/src/lib/api-docs/constants.ts

@@ -595,7 +595,6 @@ export const TOKEN_AUTH = {
     limit: "The number of tokens to return."
   },
   GET_TOKEN: {
-    identityId: "The ID of the machine identity to get the token for.",
     tokenId: "The ID of the token to get metadata for."
   },
   CREATE_TOKEN: {

backend/src/server/routes/v1/identity-token-auth-router.ts

@@ -410,7 +410,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
 
   server.route({
     method: "GET",
-    url: "/token-auth/identities/:identityId/tokens/:tokenId",
+    url: "/token-auth/tokens/:tokenId",
     config: {
       rateLimit: readLimit
     },
@@ -425,7 +425,6 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().describe(TOKEN_AUTH.GET_TOKEN.identityId),
         tokenId: z.string().describe(TOKEN_AUTH.GET_TOKEN.tokenId)
       }),
       response: {
@@ -436,7 +435,6 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     },
     handler: async (req) => {
       const { token, identityMembershipOrg } = await server.services.identityTokenAuth.getTokenAuthTokenById({
-        identityId: req.params.identityId,
         tokenId: req.params.tokenId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -451,7 +449,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         event: {
           type: EventType.GET_TOKEN_IDENTITY_TOKEN_AUTH,
           metadata: {
-            identityId: token.identityId,
+            identityId: identityMembershipOrg.identity.id,
             identityName: identityMembershipOrg.identity.name,
             tokenId: token.id
           }

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -621,29 +621,52 @@ export const identityTokenAuthServiceFactory = ({
 
   const getTokenAuthTokenById = async ({
     tokenId,
-    identityId,
     isActorSuperAdmin,
     actorId,
     actor,
     actorAuthMethod,
     actorOrgId
   }: TGetTokenAuthTokenByIdDTO) => {
-    await validateIdentityUpdateForSuperAdminPrivileges(identityId, isActorSuperAdmin);
+    const foundToken = await identityAccessTokenDAL.findOne({
+      [`${TableName.IdentityAccessToken}.id` as "id"]: tokenId,
+      [`${TableName.IdentityAccessToken}.authMethod` as "authMethod"]: IdentityAuthMethod.TOKEN_AUTH
+    });
+    if (!foundToken) throw new NotFoundError({ message: `Token with ID ${tokenId} not found` });
 
     const identityMembershipOrg = await membershipIdentityDAL.getIdentityById({
       scopeData: {
         scope: AccessScope.Organization,
         orgId: actorOrgId
       },
-      identityId
+      identityId: foundToken.identityId
     });
-    if (!identityMembershipOrg) throw new NotFoundError({ message: `Failed to find identity with ID ${identityId}` });
+    if (!identityMembershipOrg) {
+      throw new NotFoundError({ message: `Failed to find identity with ID ${foundToken.identityId}` });
+    }
+
+    await validateIdentityUpdateForSuperAdminPrivileges(foundToken.identityId, isActorSuperAdmin);
 
     if (!identityMembershipOrg.identity.authMethods.includes(IdentityAuthMethod.TOKEN_AUTH)) {
       throw new BadRequestError({
         message: "The identity does not have Token Auth"
       });
     }
+
+    if (identityMembershipOrg.identity.projectId) {
+      const { permission } = await permissionService.getProjectPermission({
+        actionProjectType: ActionProjectType.Any,
+        actor,
+        actorId,
+        projectId: identityMembershipOrg.identity.projectId,
+        actorAuthMethod,
+        actorOrgId
+      });
+
+      ForbiddenError.from(permission).throwUnlessCan(
+        ProjectPermissionIdentityActions.Read,
+        subject(ProjectPermissionSub.Identity, { identityId: identityMembershipOrg.identity.id })
+      );
+    } else {
       const { permission } = await permissionService.getOrgPermission({
         scope: OrganizationActionScope.Any,
         actor,
@@ -653,16 +676,9 @@ export const identityTokenAuthServiceFactory = ({
         actorOrgId
       });
       ForbiddenError.from(permission).throwUnlessCan(OrgPermissionIdentityActions.Read, OrgPermissionSubjects.Identity);
+    }
 
-    const token = await identityAccessTokenDAL.findOne({
-      [`${TableName.IdentityAccessToken}.id` as "id"]: tokenId,
-      [`${TableName.IdentityAccessToken}.authMethod` as "authMethod"]: IdentityAuthMethod.TOKEN_AUTH,
-      [`${TableName.IdentityAccessToken}.identityId` as "identityId"]: identityId
-    });
-
-    if (!token) throw new NotFoundError({ message: `Token with ID ${tokenId} not found` });
-
-    return { token, identityMembershipOrg };
+    return { token: foundToken, identityMembershipOrg };
   };
 
   const updateTokenAuthToken = async ({

backend/src/services/identity-token-auth/identity-token-auth-types.ts

@@ -42,7 +42,6 @@ export type TGetTokenAuthTokensDTO = {
 
 export type TGetTokenAuthTokenByIdDTO = {
   tokenId: string;
-  identityId: string;
   isActorSuperAdmin?: boolean;
 } & Omit<TProjectPermission, "projectId">;
 

docs/api-reference/endpoints/token-auth/get-token.mdx

@@ -0,0 +1,4 @@
+---
+title: "Get Token"
+openapi: "GET /api/v1/auth/token-auth/tokens/{tokenId}"
+---