awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 04:29:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

Complete adding GCP GCE auth

Browse Source
This commit is contained in:
Tuan Dang
2024-05-08 15:51:09 -07:00
parent ac469dbe4f
commit e99182c141
32 changed files with 1178 additions and 545 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/hooks/api/identities/constants.tsx
+1 -1
View File
@@ -2,6 +2,6 @@ import { IdentityAuthMethod } from "./enums";
export const identityAuthToNameMap: { [I in IdentityAuthMethod]: string } = {
[IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth",
[IdentityAuthMethod.GCP_IAM_AUTH]: "GCP IAM Auth",
[IdentityAuthMethod.GCP_AUTH]: "GCP Auth",
[IdentityAuthMethod.AWS_IAM_AUTH]: "AWS IAM Auth"
};
frontend/src/hooks/api/identities/enums.tsx
+1 -1
View File
@@ -1,5 +1,5 @@
export enum IdentityAuthMethod {
UNIVERSAL_AUTH = "universal-auth",
GCP_IAM_AUTH = "gcp-iam-auth",
GCP_AUTH = "gcp-auth",
AWS_IAM_AUTH = "aws-iam-auth"
}
frontend/src/hooks/api/identities/index.tsx
+3 -3
View File
@@ -2,7 +2,7 @@ export { identityAuthToNameMap } from "./constants";
export { IdentityAuthMethod } from "./enums";
export {
useAddIdentityAwsIamAuth,
useAddIdentityGcpIamAuth,
useAddIdentityGcpAuth,
useAddIdentityUniversalAuth,
useCreateIdentity,
useCreateIdentityUniversalAuthClientSecret,
@@ -10,12 +10,12 @@ export {
useRevokeIdentityUniversalAuthClientSecret,
useUpdateIdentity,
useUpdateIdentityAwsIamAuth,
useUpdateIdentityGcpIamAuth,
useUpdateIdentityGcpAuth,
useUpdateIdentityUniversalAuth
} from "./mutations";
export {
useGetIdentityAwsIamAuth,
useGetIdentityGcpIamAuth,
useGetIdentityGcpAuth,
useGetIdentityUniversalAuth,
useGetIdentityUniversalAuthClientSecrets
} from "./queries";
frontend/src/hooks/api/identities/mutations.tsx
+55 -43
View File
@@ -6,7 +6,7 @@ import { organizationKeys } from "../organization/queries";
import { identitiesKeys } from "./queries";
import {
AddIdentityAwsIamAuthDTO,
AddIdentityGcpIamAuthDTO,
AddIdentityGcpAuthDTO,
AddIdentityUniversalAuthDTO,
ClientSecretData,
CreateIdentityDTO,
@@ -16,11 +16,11 @@ import {
DeleteIdentityUniversalAuthClientSecretDTO,
Identity,
IdentityAwsIamAuth,
IdentityGcpIamAuth,
IdentityGcpAuth,
IdentityUniversalAuth,
UpdateIdentityAwsIamAuthDTO,
UpdateIdentityDTO,
UpdateIdentityGcpIamAuthDTO,
UpdateIdentityGcpAuthDTO,
UpdateIdentityUniversalAuthDTO
} from "./types";
@@ -176,25 +176,31 @@ export const useRevokeIdentityUniversalAuthClientSecret = () => {
});
};
export const useAddIdentityGcpIamAuth = () => {
export const useAddIdentityGcpAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityGcpIamAuth, {}, AddIdentityGcpIamAuthDTO>({
return useMutation<IdentityGcpAuth, {}, AddIdentityGcpAuthDTO>({
mutationFn: async ({
identityId,
credentials,
type,
allowedServiceAccounts,
allowedProjects,
allowedZones,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}) => {
const {
data: { identityGcpIamAuth }
} = await apiRequest.post<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
`/api/v1/auth/gcp-iam-auth/identities/${identityId}`,
data: { identityGcpAuth }
} = await apiRequest.post<{ identityGcpAuth: IdentityGcpAuth }>(
`/api/v1/auth/gcp-auth/identities/${identityId}`,
{
credentials,
type,
allowedServiceAccounts,
allowedProjects,
allowedZones,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
@@ -202,7 +208,47 @@ export const useAddIdentityGcpIamAuth = () => {
}
);
return identityGcpIamAuth;
return identityGcpAuth;
},
onSuccess: (_, { organizationId }) => {
queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
}
});
};
export const useUpdateIdentityGcpAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityGcpAuth, {}, UpdateIdentityGcpAuthDTO>({
mutationFn: async ({
identityId,
credentials,
type,
allowedServiceAccounts,
allowedProjects,
allowedZones,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}) => {
const {
data: { identityGcpAuth }
} = await apiRequest.patch<{ identityGcpAuth: IdentityGcpAuth }>(
`/api/v1/auth/gcp-auth/identities/${identityId}`,
{
credentials,
type,
allowedServiceAccounts,
allowedProjects,
allowedZones,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}
);
return identityGcpAuth;
},
onSuccess: (_, { organizationId }) => {
queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
@@ -246,40 +292,6 @@ export const useAddIdentityAwsIamAuth = () => {
});
};
export const useUpdateIdentityGcpIamAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityGcpIamAuth, {}, UpdateIdentityGcpIamAuthDTO>({
mutationFn: async ({
identityId,
allowedServiceAccounts,
allowedProjects,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}) => {
const {
data: { identityGcpIamAuth }
} = await apiRequest.patch<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
`/api/v1/auth/gcp-iam-auth/identities/${identityId}`,
{
allowedServiceAccounts,
allowedProjects,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
accessTokenTrustedIps
}
);
return identityGcpIamAuth;
},
onSuccess: (_, { organizationId }) => {
queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
}
});
};
export const useUpdateIdentityAwsIamAuth = () => {
const queryClient = useQueryClient();
return useMutation<IdentityAwsIamAuth, {}, UpdateIdentityAwsIamAuthDTO>({
frontend/src/hooks/api/identities/queries.tsx
+8 -8
View File
@@ -5,7 +5,7 @@ import { apiRequest } from "@app/config/request";
import {
ClientSecretData,
IdentityAwsIamAuth,
IdentityGcpIamAuth,
IdentityGcpAuth,
IdentityUniversalAuth
} from "./types";
@@ -14,7 +14,7 @@ export const identitiesKeys = {
[{ identityId }, "identity-universal-auth"] as const,
getIdentityUniversalAuthClientSecrets: (identityId: string) =>
[{ identityId }, "identity-universal-auth-client-secrets"] as const,
getIdentityGcpIamAuth: (identityId: string) => [{ identityId }, "identity-gcp-iam-auth"] as const,
getIdentityGcpAuth: (identityId: string) => [{ identityId }, "identity-gcp-auth"] as const,
getIdentityAwsIamAuth: (identityId: string) => [{ identityId }, "identity-aws-iam-auth"] as const
};
@@ -48,17 +48,17 @@ export const useGetIdentityUniversalAuthClientSecrets = (identityId: string) =>
});
};
export const useGetIdentityGcpIamAuth = (identityId: string) => {
export const useGetIdentityGcpAuth = (identityId: string) => {
return useQuery({
enabled: Boolean(identityId),
queryKey: identitiesKeys.getIdentityGcpIamAuth(identityId),
queryKey: identitiesKeys.getIdentityGcpAuth(identityId),
queryFn: async () => {
const {
data: { identityGcpIamAuth }
} = await apiRequest.get<{ identityGcpIamAuth: IdentityGcpIamAuth }>(
`/api/v1/auth/gcp-iam-auth/identities/${identityId}`
data: { identityGcpAuth }
} = await apiRequest.get<{ identityGcpAuth: IdentityGcpAuth }>(
`/api/v1/auth/gcp-auth/identities/${identityId}`
);
return identityGcpIamAuth;
return identityGcpAuth;
}
});
};
frontend/src/hooks/api/identities/types.ts
+12 -3
View File
@@ -113,21 +113,27 @@ export type UpdateIdentityUniversalAuthDTO = {
}[];
};
export type IdentityGcpIamAuth = {
export type IdentityGcpAuth = {
identityId: string;
credentials: string;
type: "iam" | "gce";
allowedServiceAccounts: string;
allowedProjects: string;
allowedZones: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
accessTokenNumUsesLimit: number;
accessTokenTrustedIps: IdentityTrustedIp[];
};
export type AddIdentityGcpIamAuthDTO = {
export type AddIdentityGcpAuthDTO = {
organizationId: string;
identityId: string;
credentials: string;
type: "iam" | "gce";
allowedServiceAccounts: string;
allowedProjects: string;
allowedZones: string;
accessTokenTTL: number;
accessTokenMaxTTL: number;
accessTokenNumUsesLimit: number;
@@ -136,11 +142,14 @@ export type AddIdentityGcpIamAuthDTO = {
}[];
};
export type UpdateIdentityGcpIamAuthDTO = {
export type UpdateIdentityGcpAuthDTO = {
organizationId: string;
identityId: string;
credentials?: string;
type?: "iam" | "gce";
allowedServiceAccounts?: string;
allowedProjects?: string;
allowedZones?: string;
accessTokenTTL?: number;
accessTokenMaxTTL?: number;
accessTokenNumUsesLimit?: number;
frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthMethodModal.tsx
+4 -4
View File
@@ -15,7 +15,7 @@ import { IdentityAuthMethod } from "@app/hooks/api/identities";
import { UsePopUpState } from "@app/hooks/usePopUp";
import { IdentityAwsIamAuthForm } from "./IdentityAwsIamAuthForm";
import { IdentityGcpIamAuthForm } from "./IdentityGcpIamAuthForm";
import { IdentityGcpAuthForm } from "./IdentityGcpAuthForm";
import { IdentityUniversalAuthForm } from "./IdentityUniversalAuthForm";
type Props = {
@@ -30,7 +30,7 @@ type Props = {
const identityAuthMethods = [
{ label: "Universal Auth", value: IdentityAuthMethod.UNIVERSAL_AUTH },
{ label: "AWS IAM Auth", value: IdentityAuthMethod.AWS_IAM_AUTH },
{ label: "GCP Auth", value: IdentityAuthMethod.GCP_IAM_AUTH }
{ label: "GCP Auth", value: IdentityAuthMethod.GCP_AUTH }
];
const schema = yup
@@ -77,9 +77,9 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
/>
);
}
case IdentityAuthMethod.GCP_IAM_AUTH: {
case IdentityAuthMethod.GCP_AUTH: {
return (
<IdentityGcpIamAuthForm
<IdentityGcpAuthForm
handlePopUpOpen={handlePopUpOpen}
handlePopUpToggle={handlePopUpToggle}
identityAuthMethodData={identityAuthMethodData}
frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpIamAuthForm.tsx → frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx
+101 -26
View File
@@ -2,41 +2,50 @@ import { useEffect } from "react";
import { Controller, useFieldArray, useForm } from "react-hook-form";
import { faPlus, faXmark } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { yupResolver } from "@hookform/resolvers/yup";
import * as yup from "yup";
import { zodResolver } from "@hookform/resolvers/zod";
import { z } from "zod";
import { createNotification } from "@app/components/notifications";
import { Button, FormControl, IconButton, Input } from "@app/components/v2";
import {
Button,
FormControl,
IconButton,
Input,
Select,
SelectItem,
TextArea
} from "@app/components/v2";
import { useOrganization, useSubscription } from "@app/context";
import {
useAddIdentityGcpIamAuth,
useGetIdentityGcpIamAuth,
useUpdateIdentityGcpIamAuth
useAddIdentityGcpAuth,
useGetIdentityGcpAuth,
useUpdateIdentityGcpAuth
} from "@app/hooks/api";
import { IdentityAuthMethod } from "@app/hooks/api/identities";
import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
import { UsePopUpState } from "@app/hooks/usePopUp";
const schema = yup
const schema = z
.object({
allowedServiceAccounts: yup.string(),
allowedProjects: yup.string(),
accessTokenTTL: yup.string().required("Access Token TTL is required"),
accessTokenMaxTTL: yup.string().required("Access Max Token TTL is required"),
accessTokenNumUsesLimit: yup.string().required("Access Token Max Number of Uses is required"),
accessTokenTrustedIps: yup
credentials: z.string(),
type: z.enum(["iam", "gce"]),
allowedServiceAccounts: z.string(),
allowedProjects: z.string(),
allowedZones: z.string(),
accessTokenTTL: z.string(),
accessTokenMaxTTL: z.string(),
accessTokenNumUsesLimit: z.string(),
accessTokenTrustedIps: z
.array(
yup.object({
ipAddress: yup.string().max(50).required().label("IP Address")
z.object({
ipAddress: z.string().max(50)
})
)
.min(1)
.required()
.label("Access Token Trusted IP")
})
.required();
export type FormData = yup.InferType<typeof schema>;
export type FormData = z.infer<typeof schema>;
type Props = {
handlePopUpOpen: (popUpName: keyof UsePopUpState<["upgradePlan"]>) => void;
@@ -51,7 +60,7 @@ type Props = {
};
};
export const IdentityGcpIamAuthForm = ({
export const IdentityGcpAuthForm = ({
handlePopUpOpen,
handlePopUpToggle,
identityAuthMethodData
@@ -60,21 +69,25 @@ export const IdentityGcpIamAuthForm = ({
const orgId = currentOrg?.id || "";
const { subscription } = useSubscription();
const { mutateAsync: addMutateAsync } = useAddIdentityGcpIamAuth();
const { mutateAsync: updateMutateAsync } = useUpdateIdentityGcpIamAuth();
const { mutateAsync: addMutateAsync } = useAddIdentityGcpAuth();
const { mutateAsync: updateMutateAsync } = useUpdateIdentityGcpAuth();
const { data } = useGetIdentityGcpIamAuth(identityAuthMethodData?.identityId ?? "");
const { data } = useGetIdentityGcpAuth(identityAuthMethodData?.identityId ?? "");
const {
control,
handleSubmit,
reset,
formState: { isSubmitting }
formState: { isSubmitting },
watch
} = useForm<FormData>({
resolver: yupResolver(schema),
resolver: zodResolver(schema),
defaultValues: {
credentials: "",
type: "iam",
allowedServiceAccounts: "",
allowedProjects: "",
allowedZones: "",
accessTokenTTL: "2592000",
accessTokenMaxTTL: "2592000",
accessTokenNumUsesLimit: "0",
@@ -82,6 +95,8 @@ export const IdentityGcpIamAuthForm = ({
}
});
const watchedType = watch("type");
const {
fields: accessTokenTrustedIpsFields,
append: appendAccessTokenTrustedIp,
@@ -91,8 +106,11 @@ export const IdentityGcpIamAuthForm = ({
useEffect(() => {
if (data) {
reset({
credentials: data.credentials,
type: data.type,
allowedServiceAccounts: data.allowedServiceAccounts,
allowedProjects: data.allowedProjects,
allowedZones: data.allowedZones,
accessTokenTTL: String(data.accessTokenTTL),
accessTokenMaxTTL: String(data.accessTokenMaxTTL),
accessTokenNumUsesLimit: String(data.accessTokenNumUsesLimit),
@@ -106,8 +124,10 @@ export const IdentityGcpIamAuthForm = ({
});
} else {
reset({
type: "iam",
allowedServiceAccounts: "",
allowedProjects: "",
allowedZones: "",
accessTokenTTL: "2592000",
accessTokenMaxTTL: "2592000",
accessTokenNumUsesLimit: "0",
@@ -117,8 +137,11 @@ export const IdentityGcpIamAuthForm = ({
}, [data]);
const onFormSubmit = async ({
credentials,
type,
allowedServiceAccounts,
allowedProjects,
allowedZones,
accessTokenTTL,
accessTokenMaxTTL,
accessTokenNumUsesLimit,
@@ -129,10 +152,13 @@ export const IdentityGcpIamAuthForm = ({
if (data) {
await updateMutateAsync({
identityId: identityAuthMethodData.identityId,
organizationId: orgId,
credentials,
type,
allowedServiceAccounts,
allowedProjects,
identityId: identityAuthMethodData.identityId,
allowedZones,
accessTokenTTL: Number(accessTokenTTL),
accessTokenMaxTTL: Number(accessTokenMaxTTL),
accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
@@ -140,10 +166,13 @@ export const IdentityGcpIamAuthForm = ({
});
} else {
await addMutateAsync({
organizationId: orgId,
identityId: identityAuthMethodData.identityId,
organizationId: orgId,
credentials,
type,
allowedServiceAccounts: allowedServiceAccounts || "",
allowedProjects: allowedProjects || "",
allowedZones: allowedZones || "",
accessTokenTTL: Number(accessTokenTTL),
accessTokenMaxTTL: Number(accessTokenMaxTTL),
accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
@@ -171,6 +200,41 @@ export const IdentityGcpIamAuthForm = ({
return (
<form onSubmit={handleSubmit(onFormSubmit)}>
<Controller
control={control}
name="credentials"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Service Account JSON"
errorText={error?.message}
isError={Boolean(error)}
>
<TextArea {...field} placeholder="" />
</FormControl>
)}
/>
<Controller
control={control}
name="type"
render={({ field: { onChange, ...field }, fieldState: { error } }) => (
<FormControl label="Type" isError={Boolean(error)} errorText={error?.message}>
<Select
defaultValue={field.value}
{...field}
onValueChange={(e) => onChange(e)}
className="w-full"
>
<SelectItem value="iam" key="gcpiam">
IAM
</SelectItem>
<SelectItem value="gce" key="gcp-type-gce">
GCE
</SelectItem>
</Select>
</FormControl>
)}
/>
<Controller
control={control}
defaultValue="2592000"
@@ -198,6 +262,17 @@ export const IdentityGcpIamAuthForm = ({
</FormControl>
)}
/>
{watchedType === "gce" && (
<Controller
control={control}
name="allowedZones"
render={({ field, fieldState: { error } }) => (
<FormControl label="Allowed Zones" isError={Boolean(error)} errorText={error?.message}>
<Input {...field} placeholder="us-west2-a, us-central1-a, ..." />
</FormControl>
)}
/>
)}
<Controller
control={control}
defaultValue="2592000"