Rename azure flag to enableVersions

backend/src/services/pki-sync/aws-certificate-manager/aws-certificate-manager-pki-sync-fns.ts

@@ -3,6 +3,7 @@ import * as AWS from "aws-sdk";
 import RE2 from "re2";
 import { z } from "zod";
 
+import { TCertificateSyncs } from "@app/db/schemas";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -397,11 +398,10 @@ export const awsCertificateManagerPkiSyncFactory = ({
     });
 
     const existingSyncRecords = await certificateSyncDAL.findByPkiSyncId(pkiSync.id);
-    type SyncRecord = (typeof existingSyncRecords)[0];
+    const syncRecordsByCertId = new Map<string, TCertificateSyncs>();
-    const syncRecordsByCertId = new Map<string, SyncRecord>();
+    const syncRecordsByExternalId = new Map<string, TCertificateSyncs>();
-    const syncRecordsByExternalId = new Map<string, SyncRecord>();
 
-    existingSyncRecords.forEach((record: SyncRecord) => {
+    existingSyncRecords.forEach((record: TCertificateSyncs) => {
       if (record.certificateId) {
         syncRecordsByCertId.set(record.certificateId, record);
       }

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts

@@ -2,6 +2,7 @@
 import { AxiosError } from "axios";
 import * as crypto from "crypto";
 
+import { TCertificateSyncs } from "@app/db/schemas";
 import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
@@ -346,11 +347,10 @@ export const azureKeyVaultPkiSyncFactory = ({
     );
 
     const existingSyncRecords = await certificateSyncDAL.findByPkiSyncId(pkiSync.id);
-    type SyncRecord = (typeof existingSyncRecords)[0];
+    const syncRecordsByCertId = new Map<string, TCertificateSyncs>();
-    const syncRecordsByCertId = new Map<string, SyncRecord>();
+    const syncRecordsByExternalId = new Map<string, TCertificateSyncs>();
-    const syncRecordsByExternalId = new Map<string, SyncRecord>();
 
-    existingSyncRecords.forEach((record: SyncRecord) => {
+    existingSyncRecords.forEach((record: TCertificateSyncs) => {
       if (record.certificateId) {
         syncRecordsByCertId.set(record.certificateId, record);
       }
@@ -368,10 +368,10 @@ export const azureKeyVaultPkiSyncFactory = ({
     }[] = [];
 
     const syncOptions = pkiSync.syncOptions as
-      | { certificateNameSchema?: string; canRemoveCertificates?: boolean; preserveVersion?: boolean }
+      | { certificateNameSchema?: string; canRemoveCertificates?: boolean; enableVersioning?: boolean }
       | undefined;
     const canRemoveCertificates = syncOptions?.canRemoveCertificates ?? true;
-    const preserveVersion = syncOptions?.preserveVersion ?? true;
+    const enableVersioning = syncOptions?.enableVersioning ?? true;
 
     const activeExternalIdentifiers = new Set<string>();
 
@@ -382,7 +382,7 @@ export const azureKeyVaultPkiSyncFactory = ({
         continue;
       }
 
-      if (preserveVersion && typeof certificateId === "string") {
+      if (enableVersioning && typeof certificateId === "string") {
         const certificate = await certificateDAL.findById(certificateId);
         if (certificate?.renewedByCertificateId) {
           // eslint-disable-next-line no-continue
@@ -399,7 +399,7 @@ export const azureKeyVaultPkiSyncFactory = ({
         if (existingSyncRecord?.externalIdentifier) {
           const existingAzureCert = vaultCertificates[existingSyncRecord.externalIdentifier];
 
-          if (existingAzureCert && preserveVersion) {
+          if (existingAzureCert && enableVersioning) {
             targetCertName = existingSyncRecord.externalIdentifier;
             activeExternalIdentifiers.add(targetCertName);
 
@@ -409,7 +409,7 @@ export const azureKeyVaultPkiSyncFactory = ({
             }
           } else if (!existingAzureCert) {
             shouldCreateNew = true;
-          } else if (!preserveVersion) {
+          } else if (!enableVersioning) {
             shouldCreateNew = true;
           }
         } else {
@@ -544,7 +544,7 @@ export const azureKeyVaultPkiSyncFactory = ({
               ]);
             }
 
-            if (preserveVersion) {
+            if (enableVersioning) {
               const currentCertificate = await certificateDAL.findById(certificateId);
               if (currentCertificate?.renewedFromCertificateId) {
                 await certificateSyncDAL.removeCertificates(pkiSync.id, [currentCertificate.renewedFromCertificateId]);

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts

@@ -14,7 +14,7 @@ export const AzureKeyVaultPkiSyncConfigSchema = z.object({
 const AzureKeyVaultPkiSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
-  preserveVersion: z.boolean().default(true),
+  enableVersioning: z.boolean().default(true),
   certificateNameSchema: z
     .string()
     .optional()

backend/src/services/pki-sync/pki-sync-service.ts

@@ -95,10 +95,17 @@ export const pkiSyncServiceFactory = ({
       });
     }
 
-    const invalidCertificates = certificates.filter((cert) => cert.projectId !== expectedProjectId);
+    const invalidProjectCertificates = certificates.filter((cert) => cert.projectId !== expectedProjectId);
-    if (invalidCertificates.length > 0) {
+    if (invalidProjectCertificates.length > 0) {
       throw new BadRequestError({
-        message: `Certificates do not belong to the same project: ${invalidCertificates.map((cert) => cert.id).join(", ")}`
+        message: `Certificates do not belong to the same project: ${invalidProjectCertificates.map((cert) => cert.id).join(", ")}`
+      });
+    }
+
+    const invalidRenewedCertificates = certificates.filter((cert) => cert.renewedByCertificateId);
+    if (invalidRenewedCertificates.length > 0) {
+      throw new BadRequestError({
+        message: `Cannot add renewed certificates to PKI sync: ${invalidRenewedCertificates.map((cert) => cert.id).join(", ")}`
       });
     }
   };

frontend/src/components/pki-syncs/forms/PkiSyncConnectionField.tsx

@@ -69,7 +69,7 @@ export const PkiSyncConnectionField = ({ onChange: callback }: Props) => {
       <Controller
         render={({ field: { value, onChange }, fieldState: { error } }) => (
           <FormControl
-            tooltipText="App Connections can be created from the Organization Settings page."
+            tooltipText="App Connections can be created from the Project Settings page."
             isError={Boolean(error)}
             errorText={error?.message}
             label={`${connectionName} Connection`}

frontend/src/components/pki-syncs/forms/PkiSyncOptionsFields/PkiSyncOptionsFields.tsx

@@ -141,7 +141,7 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
       {currentDestination === PkiSync.AzureKeyVault && (
         <Controller
           control={control}
-          name="syncOptions.preserveVersion"
+          name="syncOptions.enableVersioning"
           render={({ field: { value, onChange }, fieldState: { error } }) => (
             <FormControl isError={Boolean(error)} errorText={error?.message}>
               <Switch
@@ -160,7 +160,7 @@ export const PkiSyncOptionsFields = ({ destination }: Props) => {
                         <p>
                           When enabled, Infisical will create a new version of the existing
                           certificate in Azure Key Vault during certificate renewal syncs,
-                          preserving the certificate name.
+                          preserving the original certificate name.
                         </p>
                         <p className="mt-4">
                           This allows consuming services to continue using the same certificate name

frontend/src/components/pki-syncs/forms/schemas/azure-key-vault-pki-sync-destination-schema.ts

@@ -7,7 +7,7 @@ import { BasePkiSyncSchema } from "./base-pki-sync-schema";
 const AzureKeyVaultSyncOptionsSchema = z.object({
   canImportCertificates: z.boolean().default(false),
   canRemoveCertificates: z.boolean().default(true),
-  preserveVersion: z.boolean().default(true),
+  enableVersioning: z.boolean().default(true),
   certificateNameSchema: z
     .string()
     .optional()

frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx

@@ -458,31 +458,33 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
                             </ProjectPermissionCan>
                           );
                         })()}
-                        {/* PKI Sync management - only for active certificates */}
+                        {/* PKI Sync management - only for active certificates that are not renewed */}
-                        {certificate.status === CertStatus.ACTIVE && (
+                        {certificate.status === CertStatus.ACTIVE &&
-                          <ProjectPermissionCan
+                          !certificate.renewedByCertificateId && (
-                            I={ProjectPermissionCertificateActions.Edit}
+                            <ProjectPermissionCan
-                            a={ProjectPermissionSub.Certificates}
+                              I={ProjectPermissionCertificateActions.Edit}
-                          >
+                              a={ProjectPermissionSub.Certificates}
-                            {(isAllowed) => (
+                            >
-                              <DropdownMenuItem
+                              {(isAllowed) => (
-                                className={twMerge(
+                                <DropdownMenuItem
-                                  !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
+                                  className={twMerge(
-                                )}
+                                    !isAllowed &&
-                                onClick={async () =>
+                                      "pointer-events-none cursor-not-allowed opacity-50"
-                                  handlePopUpOpen("managePkiSyncs", {
+                                  )}
-                                    certificateId: certificate.id,
+                                  onClick={async () =>
-                                    commonName: certificate.commonName
+                                    handlePopUpOpen("managePkiSyncs", {
-                                  })
+                                      certificateId: certificate.id,
-                                }
+                                      commonName: certificate.commonName
-                                disabled={!isAllowed}
+                                    })
-                                icon={<FontAwesomeIcon icon={faLink} />}
+                                  }
-                              >
+                                  disabled={!isAllowed}
-                                Manage PKI Syncs
+                                  icon={<FontAwesomeIcon icon={faLink} />}
-                              </DropdownMenuItem>
+                                >
-                            )}
+                                  Manage PKI Syncs
-                          </ProjectPermissionCan>
+                                </DropdownMenuItem>
-                        )}
+                              )}
+                            </ProjectPermissionCan>
+                          )}
                         {/* Only show revoke button if CA supports revocation */}
                         {(() => {
                           const caType = caCapabilityMap[certificate.caId];