Checkpoint service accounts

backend/src/models/index.ts

@@ -10,6 +10,9 @@ import MembershipOrg, { IMembershipOrg } from './membershipOrg';
 import Organization, { IOrganization } from './organization';
 import Secret, { ISecret } from './secret';
 import ServiceToken, { IServiceToken } from './serviceToken';
+import ServiceAccount, { IServiceAccount } from './serviceAccount'; // new
+import ServiceAccountKey, { IServiceAccountKey } from './serviceAccountKey'; // new 
+import ServiceAccountPermission, { IServiceAccountPermission } from './serviceAccountPermission';
 import TokenData, { ITokenData } from './tokenData';
 import User, { IUser } from './user';
 import UserAction, { IUserAction } from './userAction';
@@ -43,6 +46,12 @@ export {
 	ISecret,
 	ServiceToken,
 	IServiceToken,
+	ServiceAccount,
+	IServiceAccount,
+	ServiceAccountKey,
+	IServiceAccountKey,
+	ServiceAccountPermission,
+	IServiceAccountPermission,
 	TokenData,
 	ITokenData,
 	User,

backend/src/models/permission.ts

@@ -1,22 +0,0 @@
-import { Schema, model, Types, Document } from 'mongoose';
-
-export interface IPermission extends Document {
-    _id: Types.ObjectId;
-    name: string;
-}
-
-const permissionSchema = new Schema<IPermission>(
-    {
-        name: {
-            type: String,
-            required: true
-        }
-    },
-    {
-        timestamps: true
-    }
-);
-
-const Permission = model<IPermission>('Permission', permissionSchema);
-
-export default Permission;

backend/src/models/serviceAccount.ts

@@ -3,9 +3,8 @@ import { Schema, model, Types, Document } from 'mongoose';
 export interface IServiceAccount extends Document {
     _id: Types.ObjectId;
     name: string;
-    isActive: boolean;
     organization: Types.ObjectId;
-    createdBy: Types.ObjectId;
+    user: Types.ObjectId;
     publicKey: string;
     expiresAt: Date;
 }
@@ -16,16 +15,12 @@ const serviceAccountSchema = new Schema<IServiceAccount>(
             type: String,
             required: true
         },
-        isActive: {
-            type: Boolean,
-            required: true
-        },
         organization: {
             type: Schema.Types.ObjectId,
             ref: 'Organization',
             required: true
         },
-        createdBy: {
+        user: { // user who created the service account
             type: Schema.Types.ObjectId,
             ref: 'User',
             required: true

backend/src/models/serviceAccountKey.ts

@@ -9,7 +9,7 @@ export interface IServiceAccountKey {
     workspace: Types.ObjectId;
 }
 
-const serviceAccountSchema = new Schema<IServiceAccountKey>(
+const serviceAccountKeySchema = new Schema<IServiceAccountKey>(
     {
         encryptedKey: {
             type: String,
@@ -39,6 +39,6 @@ const serviceAccountSchema = new Schema<IServiceAccountKey>(
     }
 );
 
-const ServiceAccountKey = model<IServiceAccountKey>('ServiceAccountKey', serviceAccountSchema);
+const ServiceAccountKey = model<IServiceAccountKey>('ServiceAccountKey', serviceAccountKeySchema);
 
 export default ServiceAccountKey;

backend/src/models/serviceAccountPermission.ts

@@ -0,0 +1,37 @@
+import { Schema, model, Types, Document } from 'mongoose';
+
+export interface IServiceAccountPermission extends Document {
+    _id: Types.ObjectId;
+    serviceAccount: Types.ObjectId;
+    name: string;
+    workspace?: Types.ObjectId;
+    environment?: string;
+}
+
+const serviceAccountPermissionSchema = new Schema<IServiceAccountPermission>(
+    {
+        serviceAccount: {
+            type: Schema.Types.ObjectId,
+            ref: 'ServiceAccount',
+            required: true
+        },
+        name: {
+            type: String,
+            required: true
+        },
+        workspace: {
+            type: Schema.Types.ObjectId,
+            ref: 'Workspace',
+        },
+        environment: {
+            type: 'String'
+        }
+    },
+    {
+        timestamps: true
+    }
+);
+
+const ServiceAccountPermission = model<IServiceAccountPermission>('ServiceAccountPermission', serviceAccountPermissionSchema);
+
+export default ServiceAccountPermission;