PR fix suggestions

backend/src/ee/services/secret-rotation-v2/azure-client-secret/azure-client-secret-rotation-schemas.ts

@@ -20,7 +20,7 @@ export const AzureClientSecretRotationGeneratedCredentialsSchema = z
   .max(2);
 
 const AzureClientSecretRotationParametersSchema = z.object({
-  appId: z.string().trim().min(1, "Client ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId),
+  appId: z.string().trim().min(1, "App ID Required").describe(SecretRotations.PARAMETERS.AZURE_CLIENT_SECRET.appId),
   appName: z
     .string()
     .trim()

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-maps.ts

@@ -3,7 +3,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 
 export const SECRET_ROTATION_NAME_MAP: Record<SecretRotation, string> = {
   [SecretRotation.PostgresCredentials]: "PostgreSQL Credentials",
-  [SecretRotation.MsSqlCredentials]: "Microsoft SQL Sever Credentials",
+  [SecretRotation.MsSqlCredentials]: "Microsoft SQL Server Credentials",
   [SecretRotation.Auth0ClientSecret]: "Auth0 Client Secret",
   [SecretRotation.AzureClientSecret]: "Azure Client Secret"
 };

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -25,6 +25,7 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.GCP]: registerGcpConnectionRouter,
     [AppConnection.AzureKeyVault]: registerAzureKeyVaultConnectionRouter,
     [AppConnection.AzureAppConfiguration]: registerAzureAppConfigurationConnectionRouter,
+    [AppConnection.AzureClientSecrets]: registerAzureClientSecretsConnectionRouter,
     [AppConnection.Databricks]: registerDatabricksConnectionRouter,
     [AppConnection.Humanitec]: registerHumanitecConnectionRouter,
     [AppConnection.TerraformCloud]: registerTerraformCloudConnectionRouter,
@@ -32,7 +33,6 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.Postgres]: registerPostgresConnectionRouter,
     [AppConnection.MsSql]: registerMsSqlConnectionRouter,
     [AppConnection.Camunda]: registerCamundaConnectionRouter,
-    [AppConnection.AzureClientSecrets]: registerAzureClientSecretsConnectionRouter,
     [AppConnection.Windmill]: registerWindmillConnectionRouter,
     [AppConnection.Auth0]: registerAuth0ConnectionRouter
   };

backend/src/services/app-connection/app-connection-fns.ts

@@ -134,6 +134,8 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.AzureKeyVault]: validateAzureKeyVaultConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.AzureAppConfiguration]:
       validateAzureAppConfigurationConnectionCredentials as TAppConnectionCredentialsValidator,
+    [AppConnection.AzureClientSecrets]:
+      validateAzureClientSecretsConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Humanitec]: validateHumanitecConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Postgres]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.MsSql]: validateSqlConnectionCredentials as TAppConnectionCredentialsValidator,
@@ -141,8 +143,6 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.Vercel]: validateVercelConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.TerraformCloud]: validateTerraformCloudConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Auth0]: validateAuth0ConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.AzureClientSecrets]:
-      validateAzureClientSecretsConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.Windmill]: validateWindmillConnectionCredentials as TAppConnectionCredentialsValidator
   };
 

backend/src/services/app-connection/app-connection-service.ts

@@ -452,8 +452,8 @@ export const appConnectionServiceFactory = ({
     terraformCloud: terraformCloudConnectionService(connectAppConnectionById),
     camunda: camundaConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     vercel: vercelConnectionService(connectAppConnectionById),
-    auth0: auth0ConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     azureClientSecrets: azureClientSecretsConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
+    auth0: auth0ConnectionService(connectAppConnectionById, appConnectionDAL, kmsService),
     windmill: windmillConnectionService(connectAppConnectionById)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -145,12 +145,12 @@ export type TAppConnectionConfig =
   | TGcpConnectionConfig
   | TAzureKeyVaultConnectionConfig
   | TAzureAppConfigurationConnectionConfig
+  | TAzureClientSecretsConnectionConfig
   | TDatabricksConnectionConfig
   | THumanitecConnectionConfig
   | TTerraformCloudConnectionConfig
   | TSqlConnectionConfig
   | TCamundaConnectionConfig
-  | TAzureClientSecretsConnectionConfig
   | TVercelConnectionConfig
   | TWindmillConnectionConfig
   | TAuth0ConnectionConfig;
@@ -161,6 +161,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateGcpConnectionCredentialsSchema
   | TValidateAzureKeyVaultConnectionCredentialsSchema
   | TValidateAzureAppConfigurationConnectionCredentialsSchema
+  | TValidateAzureClientSecretsConnectionCredentialsSchema
   | TValidateDatabricksConnectionCredentialsSchema
   | TValidateHumanitecConnectionCredentialsSchema
   | TValidatePostgresConnectionCredentialsSchema
@@ -168,7 +169,6 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateCamundaConnectionCredentialsSchema
   | TValidateVercelConnectionCredentialsSchema
   | TValidateTerraformCloudConnectionCredentialsSchema
-  | TValidateAzureClientSecretsConnectionCredentialsSchema
   | TValidateWindmillConnectionCredentialsSchema
   | TValidateAuth0ConnectionCredentialsSchema;
 

backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-fns.ts

@@ -31,6 +31,8 @@ export const getAzureClientSecretsConnectionListItem = () => {
   };
 };
 
+const EXPIRATION_TIME = 300000;
+
 export const getAzureConnectionAccessToken = async (
   connectionId: string,
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">,
@@ -62,9 +64,10 @@ export const getAzureConnectionAccessToken = async (
   })) as TAzureClientSecretsConnectionCredentials;
 
   const { expiresAt, refreshToken } = credentials;
+  const currentTime = Date.now();
 
   // get new token if expired or less than 5 minutes until expiry
-  if (Date.now() < expiresAt - 300000) {
+  if (currentTime < expiresAt - EXPIRATION_TIME) {
     return credentials.accessToken;
   }
 
@@ -82,7 +85,7 @@ export const getAzureConnectionAccessToken = async (
   const updatedCredentials = {
     ...credentials,
     accessToken: data.access_token,
-    expiresAt: Date.now() + data.expires_in * 1000,
+    expiresAt: currentTime + data.expires_in * 1000,
     refreshToken: data.refresh_token
   };
 
@@ -102,6 +105,10 @@ export const validateAzureClientSecretsConnectionCredentials = async (config: TA
 
   const { INF_APP_CONNECTION_AZURE_CLIENT_ID, INF_APP_CONNECTION_AZURE_CLIENT_SECRET, SITE_URL } = getConfig();
 
+  if (!SITE_URL) {
+    throw new InternalServerError({ message: "SITE_URL env var is required to complete Azure OAuth flow" });
+  }
+
   if (!INF_APP_CONNECTION_AZURE_CLIENT_ID || !INF_APP_CONNECTION_AZURE_CLIENT_SECRET) {
     throw new InternalServerError({
       message: `Azure ${getAppConnectionMethodName(method)} environment variables have not been configured`

backend/src/services/app-connection/azure-client-secrets/azure-client-secrets-connection-types.ts

@@ -1,4 +1,4 @@
-import z from "zod";
+import { z } from "zod";
 
 import { DiscriminativePick } from "@app/lib/types";
 

backend/src/services/app-connection/azure-key-vault/azure-key-vault-connection-fns.ts

@@ -43,7 +43,7 @@ export const getAzureConnectionAccessToken = async (
     appConnection.app !== AppConnection.AzureAppConfiguration &&
     appConnection.app !== AppConnection.AzureClientSecrets
   ) {
-    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not an Azure Key Vault connection` });
+    throw new BadRequestError({ message: `Connection with ID '${connectionId}' is not a valid Azure connection` });
   }
 
   const credentials = (await decryptAppConnectionCredentials({

docs/integrations/app-connections/azure-client-secrets.mdx

@@ -1,6 +1,6 @@
 ---
 title: "Azure Client Secrets Connection"
-description: "Learn how to configure a Azure Client Secrets Connection for Infisical."
+description: "Learn how to configure an Azure Client Secrets Connection for Infisical."
 ---
 
 Infisical currently only supports one method for connecting to Azure, which is OAuth.
@@ -32,7 +32,7 @@ Infisical currently only supports one method for connecting to Azure, which is O
     </Step>
     <Step title="Assign API permissions to the application">
 
-      For the Azure Connection to work with Client Secrets, you need to assign multiple permissions to the application.
+      For the Azure Connection to work with Client Secrets, you need to assign the following permission to the application.
 
       #### Azure Client Secrets permissions
     
@@ -81,10 +81,10 @@ Infisical currently only supports one method for connecting to Azure, which is O
 	</Step>
 	<Step title="Grant Access">
 		You will then be redirected to Azure to grant Infisical access to your Azure account. Once granted,
-		you will redirect you back to Infisical's App Connections page. ![Azure Client Secrets
+		you will be redirected back to Infisical's App Connections page. ![Azure Client Secrets
 		Authorization](/images/app-connections/azure/grant-access.png)
 	</Step>
 	<Step title="Connection Created">
-		Your **Azure Client Secrets Connection** is now available for use. ![Assume Role AWS Connection](/images/app-connections/azure/client-secrets/oauth-connection.png)
+		Your **Azure Client Secrets Connection** is now available for use. ![Azure Client Secrets](/images/app-connections/azure/client-secrets/oauth-connection.png)
 	</Step>
 </Steps>

frontend/src/components/secret-rotations-v2/forms/SecretRotationV2SecretsMappingFields/AzureClientSecretRotationSecretsMappingFields.tsx

@@ -43,6 +43,7 @@ export const AzureClientSecretRotationSecretsMappingFields = () => {
               <Input
                 value={value}
                 onChange={onChange}
+                type="password"
                 placeholder={rotationOption?.template.secretsMapping.clientSecret}
               />
             </FormControl>

frontend/src/components/secret-rotations-v2/forms/schemas/index.ts

@@ -6,10 +6,10 @@ import { MsSqlCredentialsRotationSchema } from "@app/components/secret-rotations
 import { PostgresCredentialsRotationSchema } from "@app/components/secret-rotations-v2/forms/schemas/postgres-credentials-rotation-schema";
 
 const SecretRotationUnionSchema = z.discriminatedUnion("type", [
-  PostgresCredentialsRotationSchema,
-  MsSqlCredentialsRotationSchema,
   Auth0ClientSecretRotationSchema,
-  AzureClientSecretRotationSchema
+  AzureClientSecretRotationSchema,
+  PostgresCredentialsRotationSchema,
+  MsSqlCredentialsRotationSchema
 ]);
 
 export const SecretRotationV2FormSchema = SecretRotationUnionSchema;

frontend/src/hooks/api/appConnections/types/index.ts

@@ -80,6 +80,7 @@ export type TAppConnectionMap = {
   [AppConnection.GCP]: TGcpConnection;
   [AppConnection.AzureKeyVault]: TAzureKeyVaultConnection;
   [AppConnection.AzureAppConfiguration]: TAzureAppConfigurationConnection;
+  [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
   [AppConnection.Databricks]: TDatabricksConnection;
   [AppConnection.Humanitec]: THumanitecConnection;
   [AppConnection.TerraformCloud]: TTerraformCloudConnection;
@@ -87,7 +88,6 @@ export type TAppConnectionMap = {
   [AppConnection.Postgres]: TPostgresConnection;
   [AppConnection.MsSql]: TMsSqlConnection;
   [AppConnection.Camunda]: TCamundaConnection;
-  [AppConnection.AzureClientSecrets]: TAzureClientSecretsConnection;
   [AppConnection.Windmill]: TWindmillConnection;
   [AppConnection.Auth0]: TAuth0Connection;
 };

frontend/src/pages/organization/AppConnections/AppConnectionsPage/components/AppConnectionForm/AzureClientSecretsConnectionForm.tsx

@@ -83,15 +83,7 @@ export const AzureClientSecretsConnectionForm = ({ appConnection }: Props) => {
     }
   };
 
-  let isMissingConfig: boolean;
+  const isMissingConfig = !oauthClientId;
-
-  switch (selectedMethod) {
-    case AzureClientSecretsConnectionMethod.OAuth:
-      isMissingConfig = !oauthClientId;
-      break;
-    default:
-      throw new Error(`Unhandled Azure Connection method: ${selectedMethod}`);
-  }
 
   const methodDetails = getAppConnectionMethodDetails(selectedMethod);