Update identity-azure-auth-fns.ts

backend/src/lib/api-docs/constants.ts

@@ -70,13 +70,13 @@ export const UNIVERSAL_AUTH = {
       "The maximum number of times that an access token can be used; a value of 0 implies infinite number of uses."
   },
   RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
+    identityId: "The ID of the identity to retrieve."
   },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
+    identityId: "The ID of the identity to revoke."
   },
   UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
+    identityId: "The ID of the identity to update.",
     clientSecretTrustedIps: "The new list of IPs or CIDR ranges that the Client Secret can be used from.",
     accessTokenTrustedIps: "The new list of IPs or CIDR ranges that access tokens can be used from.",
     accessTokenTTL: "The new lifetime for an access token in seconds.",
@@ -119,228 +119,32 @@ export const AWS_AUTH = {
       "The base64-encoded body of the signed request. Most likely, the base64-encoding of Action=GetCallerIdentity&Version=2011-06-15.",
     iamRequestHeaders: "The base64-encoded headers of the sts:GetCallerIdentity signed request."
   },
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    allowedPrincipalArns:
-      "The comma-separated list of trusted IAM principal ARNs that are allowed to authenticate with Infisical.",
-    allowedAccountIds:
-      "The comma-separated list of trusted AWS account IDs that are allowed to authenticate with Infisical.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    stsEndpoint: "The endpoint URL for the AWS STS API.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    allowedPrincipalArns:
-      "The new comma-separated list of trusted IAM principal ARNs that are allowed to authenticate with Infisical.",
-    allowedAccountIds:
-      "The new comma-separated list of trusted AWS account IDs that are allowed to authenticate with Infisical.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    stsEndpoint: "The new endpoint URL for the AWS STS API.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
+    identityId: "The ID of the identity to revoke."
   }
 } as const;
 
 export const AZURE_AUTH = {
-  LOGIN: {
-    identityId: "The ID of the identity to login."
-  },
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    tenantId: "The tenant ID for the Azure AD organization.",
-    resource: "The resource URL for the application registered in Azure AD.",
-    allowedServicePrincipalIds:
-      "The comma-separated list of Azure AD service principal IDs that are allowed to authenticate with Infisical.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    tenantId: "The new tenant ID for the Azure AD organization.",
-    resource: "The new resource URL for the application registered in Azure AD.",
-    allowedServicePrincipalIds:
-      "The new comma-separated list of Azure AD service principal IDs that are allowed to authenticate with Infisical.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
+    identityId: "The ID of the identity to revoke."
   }
 } as const;
 
 export const GCP_AUTH = {
-  LOGIN: {
-    identityId: "The ID of the identity to login."
-  },
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    allowedServiceAccounts:
-      "The comma-separated list of trusted service account emails corresponding to the GCE resource(s) allowed to authenticate with Infisical.",
-    allowedProjects:
-      "The comma-separated list of trusted GCP projects that the GCE instance must belong to authenticate with Infisical.",
-    allowedZones:
-      "The comma-separated list of trusted zones that the GCE instances must belong to authenticate with Infisical.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    allowedServiceAccounts:
-      "The new comma-separated list of trusted service account emails corresponding to the GCE resource(s) allowed to authenticate with Infisical.",
-    allowedProjects:
-      "The new comma-separated list of trusted GCP projects that the GCE instance must belong to authenticate with Infisical.",
-    allowedZones:
-      "The new comma-separated list of trusted zones that the GCE instances must belong to authenticate with Infisical.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
+    identityId: "The ID of the identity to revoke."
   }
 } as const;
 
 export const KUBERNETES_AUTH = {
-  LOGIN: {
-    identityId: "The ID of the identity to login."
-  },
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    kubernetesHost: "The host string, host:port pair, or URL to the base of the Kubernetes API server.",
-    caCert: "The PEM-encoded CA cert for the Kubernetes API server.",
-    tokenReviewerJwt:
-      "The long-lived service account JWT token for Infisical to access the TokenReview API to validate other service account JWT tokens submitted by applications/pods.",
-    allowedNamespaces:
-      "The comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.",
-    allowedNames: "The comma-separated list of trusted service account names that can authenticate with Infisical.",
-    allowedAudience:
-      "The optional audience claim that the service account JWT token must have to authenticate with Infisical.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    kubernetesHost: "The new host string, host:port pair, or URL to the base of the Kubernetes API server.",
-    caCert: "The new PEM-encoded CA cert for the Kubernetes API server.",
-    tokenReviewerJwt:
-      "The new long-lived service account JWT token for Infisical to access the TokenReview API to validate other service account JWT tokens submitted by applications/pods.",
-    allowedNamespaces:
-      "The new comma-separated list of trusted namespaces that service accounts must belong to authenticate with Infisical.",
-    allowedNames: "The new comma-separated list of trusted service account names that can authenticate with Infisical.",
-    allowedAudience:
-      "The new optional audience claim that the service account JWT token must have to authenticate with Infisical.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
-  }
-} as const;
-
-export const TOKEN_AUTH = {
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
-  REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
-  },
-  GET_TOKENS: {
-    identityId: "The ID of the identity to list token metadata for.",
-    offset: "The offset to start from. If you enter 10, it will start from the 10th token.",
-    limit: "The number of tokens to return"
-  },
-  CREATE_TOKEN: {
-    identityId: "The ID of the identity to create the token for.",
-    name: "The name of the token to create"
-  },
-  UPDATE_TOKEN: {
-    tokenId: "The ID of the token to update metadata for",
-    name: "The name of the token to update to"
-  },
-  REVOKE_TOKEN: {
-    tokenId: "The ID of the token to revoke"
+    identityId: "The ID of the identity to revoke."
   }
 } as const;
 
 export const OIDC_AUTH = {
-  LOGIN: {
-    identityId: "The ID of the identity to login."
-  },
-  ATTACH: {
-    identityId: "The ID of the identity to attach the configuration onto.",
-    oidcDiscoveryUrl: "The URL used to retrieve the OpenID Connect configuration from the identity provider.",
-    caCert: "The PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.",
-    boundIssuer: "The unique identifier of the identity provider issuing the JWT.",
-    boundAudiences: "The list of intended recipients.",
-    boundClaims: "The attributes that should be present in the JWT for it to be valid.",
-    boundSubject: "The expected principal that is the subject of the JWT.",
-    accessTokenTrustedIps: "The IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The maximum number of times that an access token can be used."
-  },
-  UPDATE: {
-    identityId: "The ID of the identity to update the auth method for.",
-    oidcDiscoveryUrl: "The new URL used to retrieve the OpenID Connect configuration from the identity provider.",
-    caCert: "The new PEM-encoded CA cert for establishing secure communication with the Identity Provider endpoints.",
-    boundIssuer: "The new unique identifier of the identity provider issuing the JWT.",
-    boundAudiences: "The new list of intended recipients.",
-    boundClaims: "The new attributes that should be present in the JWT for it to be valid.",
-    boundSubject: "The new expected principal that is the subject of the JWT.",
-    accessTokenTrustedIps: "The new IPs or CIDR ranges that access tokens can be used from.",
-    accessTokenTTL: "The new lifetime for an acccess token in seconds.",
-    accessTokenMaxTTL: "The new maximum lifetime for an acccess token in seconds.",
-    accessTokenNumUsesLimit: "The new maximum number of times that an access token can be used."
-  },
-  RETRIEVE: {
-    identityId: "The ID of the identity to retrieve the auth method for."
-  },
   REVOKE: {
-    identityId: "The ID of the identity to revoke the auth method for."
+    identityId: "The ID of the identity to revoke."
   }
 } as const;
 

backend/src/server/routes/v1/identity-aws-iam-auth-router.ts

@@ -77,25 +77,19 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(AWS_AUTH.ATTACH.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
-        stsEndpoint: z
-          .string()
-          .trim()
-          .min(1)
-          .default("https://sts.amazonaws.com/")
-          .describe(AWS_AUTH.ATTACH.stsEndpoint),
-        allowedPrincipalArns: validatePrincipalArns.describe(AWS_AUTH.ATTACH.allowedPrincipalArns),
-        allowedAccountIds: validateAccountIds.describe(AWS_AUTH.ATTACH.allowedAccountIds),
+        stsEndpoint: z.string().trim().min(1).default("https://sts.amazonaws.com/"),
+        allowedPrincipalArns: validatePrincipalArns,
+        allowedAccountIds: validateAccountIds,
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(AWS_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -103,17 +97,15 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(AWS_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(AWS_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(AWS_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -168,22 +160,21 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().describe(AWS_AUTH.UPDATE.identityId)
+        identityId: z.string()
       }),
       body: z.object({
-        stsEndpoint: z.string().trim().min(1).optional().describe(AWS_AUTH.UPDATE.stsEndpoint),
-        allowedPrincipalArns: validatePrincipalArns.describe(AWS_AUTH.UPDATE.allowedPrincipalArns),
-        allowedAccountIds: validateAccountIds.describe(AWS_AUTH.UPDATE.allowedAccountIds),
+        stsEndpoint: z.string().trim().min(1).optional(),
+        allowedPrincipalArns: validatePrincipalArns,
+        allowedAccountIds: validateAccountIds,
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .optional()
-          .describe(AWS_AUTH.UPDATE.accessTokenTrustedIps),
-        accessTokenTTL: z.number().int().min(0).optional().describe(AWS_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(AWS_AUTH.UPDATE.accessTokenNumUsesLimit),
+          .optional(),
+        accessTokenTTL: z.number().int().min(0).optional(),
+        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
         accessTokenMaxTTL: z
           .number()
           .int()
@@ -191,7 +182,6 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
             message: "accessTokenMaxTTL must have a non zero number"
           })
           .optional()
-          .describe(AWS_AUTH.UPDATE.accessTokenMaxTTL)
       }),
       response: {
         200: z.object({
@@ -246,7 +236,7 @@ export const registerIdentityAwsAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().describe(AWS_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/identity-azure-auth-router.ts

@@ -19,7 +19,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
     schema: {
       description: "Login with Azure Auth",
       body: z.object({
-        identityId: z.string().describe(AZURE_AUTH.LOGIN.identityId),
+        identityId: z.string(),
         jwt: z.string()
       }),
       response: {
@@ -72,20 +72,19 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(AZURE_AUTH.LOGIN.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
-        tenantId: z.string().trim().describe(AZURE_AUTH.ATTACH.tenantId),
-        resource: z.string().trim().describe(AZURE_AUTH.ATTACH.resource),
-        allowedServicePrincipalIds: validateAzureAuthField.describe(AZURE_AUTH.ATTACH.allowedServicePrincipalIds),
+        tenantId: z.string().trim(),
+        resource: z.string().trim(),
+        allowedServicePrincipalIds: validateAzureAuthField,
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(AZURE_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -93,17 +92,15 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(AZURE_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(AZURE_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(AZURE_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -157,24 +154,21 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(AZURE_AUTH.UPDATE.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
-        tenantId: z.string().trim().optional().describe(AZURE_AUTH.UPDATE.tenantId),
-        resource: z.string().trim().optional().describe(AZURE_AUTH.UPDATE.resource),
-        allowedServicePrincipalIds: validateAzureAuthField
-          .optional()
-          .describe(AZURE_AUTH.UPDATE.allowedServicePrincipalIds),
+        tenantId: z.string().trim().optional(),
+        resource: z.string().trim().optional(),
+        allowedServicePrincipalIds: validateAzureAuthField.optional(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .optional()
-          .describe(AZURE_AUTH.UPDATE.accessTokenTrustedIps),
-        accessTokenTTL: z.number().int().min(0).optional().describe(AZURE_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(AZURE_AUTH.UPDATE.accessTokenNumUsesLimit),
+          .optional(),
+        accessTokenTTL: z.number().int().min(0).optional(),
+        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
         accessTokenMaxTTL: z
           .number()
           .int()
@@ -182,7 +176,6 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
             message: "accessTokenMaxTTL must have a non zero number"
           })
           .optional()
-          .describe(AZURE_AUTH.UPDATE.accessTokenMaxTTL)
       }),
       response: {
         200: z.object({
@@ -236,7 +229,7 @@ export const registerIdentityAzureAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().describe(AZURE_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/identity-gcp-auth-router.ts

@@ -19,7 +19,7 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
     schema: {
       description: "Login with GCP Auth",
       body: z.object({
-        identityId: z.string().describe(GCP_AUTH.LOGIN.identityId),
+        identityId: z.string(),
         jwt: z.string()
       }),
       response: {
@@ -72,21 +72,20 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(GCP_AUTH.ATTACH.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
         type: z.enum(["iam", "gce"]),
-        allowedServiceAccounts: validateGcpAuthField.describe(GCP_AUTH.ATTACH.allowedServiceAccounts),
-        allowedProjects: validateGcpAuthField.describe(GCP_AUTH.ATTACH.allowedProjects),
-        allowedZones: validateGcpAuthField.describe(GCP_AUTH.ATTACH.allowedZones),
+        allowedServiceAccounts: validateGcpAuthField,
+        allowedProjects: validateGcpAuthField,
+        allowedZones: validateGcpAuthField,
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(GCP_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -94,17 +93,15 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(GCP_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(GCP_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(GCP_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -160,23 +157,22 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(GCP_AUTH.UPDATE.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
         type: z.enum(["iam", "gce"]).optional(),
-        allowedServiceAccounts: validateGcpAuthField.optional().describe(GCP_AUTH.UPDATE.allowedServiceAccounts),
-        allowedProjects: validateGcpAuthField.optional().describe(GCP_AUTH.UPDATE.allowedProjects),
-        allowedZones: validateGcpAuthField.optional().describe(GCP_AUTH.UPDATE.allowedZones),
+        allowedServiceAccounts: validateGcpAuthField.optional(),
+        allowedProjects: validateGcpAuthField.optional(),
+        allowedZones: validateGcpAuthField.optional(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .optional()
-          .describe(GCP_AUTH.UPDATE.accessTokenTrustedIps),
-        accessTokenTTL: z.number().int().min(0).optional().describe(GCP_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(GCP_AUTH.UPDATE.accessTokenNumUsesLimit),
+          .optional(),
+        accessTokenTTL: z.number().int().min(0).optional(),
+        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
         accessTokenMaxTTL: z
           .number()
           .int()
@@ -184,7 +180,6 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
             message: "accessTokenMaxTTL must have a non zero number"
           })
           .optional()
-          .describe(GCP_AUTH.UPDATE.accessTokenMaxTTL)
       }),
       response: {
         200: z.object({
@@ -240,7 +235,7 @@ export const registerIdentityGcpAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().describe(GCP_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/identity-kubernetes-auth-router.ts

@@ -30,7 +30,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
     schema: {
       description: "Login with Kubernetes Auth",
       body: z.object({
-        identityId: z.string().trim().describe(KUBERNETES_AUTH.LOGIN.identityId),
+        identityId: z.string().trim(),
         jwt: z.string().trim()
       }),
       response: {
@@ -85,23 +85,22 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(KUBERNETES_AUTH.ATTACH.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
-        kubernetesHost: z.string().trim().min(1).describe(KUBERNETES_AUTH.ATTACH.kubernetesHost),
-        caCert: z.string().trim().default("").describe(KUBERNETES_AUTH.ATTACH.caCert),
-        tokenReviewerJwt: z.string().trim().min(1).describe(KUBERNETES_AUTH.ATTACH.tokenReviewerJwt),
-        allowedNamespaces: z.string().describe(KUBERNETES_AUTH.ATTACH.allowedNamespaces), // TODO: validation
-        allowedNames: z.string().describe(KUBERNETES_AUTH.ATTACH.allowedNames),
-        allowedAudience: z.string().describe(KUBERNETES_AUTH.ATTACH.allowedAudience),
+        kubernetesHost: z.string().trim().min(1),
+        caCert: z.string().trim().default(""),
+        tokenReviewerJwt: z.string().trim().min(1),
+        allowedNamespaces: z.string(), // TODO: validation
+        allowedNames: z.string(),
+        allowedAudience: z.string(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(KUBERNETES_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -109,22 +108,15 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(KUBERNETES_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(KUBERNETES_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z
-          .number()
-          .int()
-          .min(0)
-          .default(0)
-          .describe(KUBERNETES_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -179,30 +171,24 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         }
       ],
       params: z.object({
-        identityId: z.string().describe(KUBERNETES_AUTH.UPDATE.identityId)
+        identityId: z.string()
       }),
       body: z.object({
-        kubernetesHost: z.string().trim().min(1).optional().describe(KUBERNETES_AUTH.UPDATE.kubernetesHost),
-        caCert: z.string().trim().optional().describe(KUBERNETES_AUTH.UPDATE.caCert),
-        tokenReviewerJwt: z.string().trim().min(1).optional().describe(KUBERNETES_AUTH.UPDATE.tokenReviewerJwt),
-        allowedNamespaces: z.string().optional().describe(KUBERNETES_AUTH.UPDATE.allowedNamespaces), // TODO: validation
-        allowedNames: z.string().optional().describe(KUBERNETES_AUTH.UPDATE.allowedNames),
-        allowedAudience: z.string().optional().describe(KUBERNETES_AUTH.UPDATE.allowedAudience),
+        kubernetesHost: z.string().trim().min(1).optional(),
+        caCert: z.string().trim().optional(),
+        tokenReviewerJwt: z.string().trim().min(1).optional(),
+        allowedNamespaces: z.string().optional(), // TODO: validation
+        allowedNames: z.string().optional(),
+        allowedAudience: z.string().optional(),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .optional()
-          .describe(KUBERNETES_AUTH.UPDATE.accessTokenTrustedIps),
-        accessTokenTTL: z.number().int().min(0).optional().describe(KUBERNETES_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z
-          .number()
-          .int()
-          .min(0)
-          .optional()
-          .describe(KUBERNETES_AUTH.UPDATE.accessTokenNumUsesLimit),
+          .optional(),
+        accessTokenTTL: z.number().int().min(0).optional(),
+        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
         accessTokenMaxTTL: z
           .number()
           .int()
@@ -210,7 +196,6 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
             message: "accessTokenMaxTTL must have a non zero number"
           })
           .optional()
-          .describe(KUBERNETES_AUTH.UPDATE.accessTokenMaxTTL)
       }),
       response: {
         200: z.object({
@@ -265,7 +250,7 @@ export const registerIdentityKubernetesRouter = async (server: FastifyZodProvide
         }
       ],
       params: z.object({
-        identityId: z.string().describe(KUBERNETES_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/identity-oidc-auth-router.ts

@@ -30,7 +30,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
     schema: {
       description: "Login with OIDC Auth",
       body: z.object({
-        identityId: z.string().trim().describe(OIDC_AUTH.LOGIN.identityId),
+        identityId: z.string().trim(),
         jwt: z.string().trim()
       }),
       response: {
@@ -85,23 +85,16 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(OIDC_AUTH.ATTACH.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
-        oidcDiscoveryUrl: z.string().url().min(1).describe(OIDC_AUTH.ATTACH.oidcDiscoveryUrl),
-        caCert: z.string().trim().default("").describe(OIDC_AUTH.ATTACH.caCert),
-        boundIssuer: z.string().min(1).describe(OIDC_AUTH.ATTACH.boundIssuer),
-        boundAudiences: validateOidcAuthAudiencesField.describe(OIDC_AUTH.ATTACH.boundAudiences),
-        boundClaims: validateOidcBoundClaimsField.describe(OIDC_AUTH.ATTACH.boundClaims),
-        boundSubject: z.string().optional().default("").describe(OIDC_AUTH.ATTACH.boundSubject),
         accessTokenTrustedIps: z
           .object({
             ipAddress: z.string().trim()
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(OIDC_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -109,17 +102,21 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(OIDC_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(OIDC_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(OIDC_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0),
+        oidcDiscoveryUrl: z.string().url().min(1),
+        caCert: z.string().trim().default(""),
+        boundIssuer: z.string().min(1),
+        boundAudiences: validateOidcAuthAudiencesField,
+        boundClaims: validateOidcBoundClaimsField,
+        boundSubject: z.string().optional().default("")
       }),
       response: {
         200: z.object({
@@ -179,24 +176,17 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(OIDC_AUTH.UPDATE.identityId)
+        identityId: z.string().trim()
       }),
       body: z
         .object({
-          oidcDiscoveryUrl: z.string().url().min(1).describe(OIDC_AUTH.UPDATE.oidcDiscoveryUrl),
-          caCert: z.string().trim().default("").describe(OIDC_AUTH.UPDATE.caCert),
-          boundIssuer: z.string().min(1).describe(OIDC_AUTH.UPDATE.boundIssuer),
-          boundAudiences: validateOidcAuthAudiencesField.describe(OIDC_AUTH.UPDATE.boundAudiences),
-          boundClaims: validateOidcBoundClaimsField.describe(OIDC_AUTH.UPDATE.boundClaims),
-          boundSubject: z.string().optional().default("").describe(OIDC_AUTH.UPDATE.boundSubject),
           accessTokenTrustedIps: z
             .object({
               ipAddress: z.string().trim()
             })
             .array()
             .min(1)
-            .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-            .describe(OIDC_AUTH.UPDATE.accessTokenTrustedIps),
+            .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
           accessTokenTTL: z
             .number()
             .int()
@@ -204,18 +194,21 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
             .refine((value) => value !== 0, {
               message: "accessTokenTTL must have a non zero number"
             })
-            .default(2592000)
-            .describe(OIDC_AUTH.UPDATE.accessTokenTTL),
+            .default(2592000),
           accessTokenMaxTTL: z
             .number()
             .int()
             .refine((value) => value !== 0, {
               message: "accessTokenMaxTTL must have a non zero number"
             })
-            .default(2592000)
-            .describe(OIDC_AUTH.UPDATE.accessTokenMaxTTL),
-
-          accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(OIDC_AUTH.UPDATE.accessTokenNumUsesLimit)
+            .default(2592000),
+          accessTokenNumUsesLimit: z.number().int().min(0).default(0),
+          oidcDiscoveryUrl: z.string().url().min(1),
+          caCert: z.string().trim().default(""),
+          boundIssuer: z.string().min(1),
+          boundAudiences: validateOidcAuthAudiencesField,
+          boundClaims: validateOidcBoundClaimsField,
+          boundSubject: z.string().optional().default("")
         })
         .partial(),
       response: {
@@ -274,7 +267,7 @@ export const registerIdentityOidcAuthRouter = async (server: FastifyZodProvider)
         }
       ],
       params: z.object({
-        identityId: z.string().describe(OIDC_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({

backend/src/server/routes/v1/identity-token-auth-router.ts

@@ -2,7 +2,6 @@ import { z } from "zod";
 
 import { IdentityAccessTokensSchema, IdentityTokenAuthsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { TOKEN_AUTH } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
@@ -24,7 +23,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(TOKEN_AUTH.ATTACH.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
         accessTokenTrustedIps: z
@@ -33,8 +32,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
           })
           .array()
           .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }])
-          .describe(TOKEN_AUTH.ATTACH.accessTokenTrustedIps),
+          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
         accessTokenTTL: z
           .number()
           .int()
@@ -42,17 +40,15 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
           .refine((value) => value !== 0, {
             message: "accessTokenTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(TOKEN_AUTH.ATTACH.accessTokenTTL),
+          .default(2592000),
         accessTokenMaxTTL: z
           .number()
           .int()
           .refine((value) => value !== 0, {
             message: "accessTokenMaxTTL must have a non zero number"
           })
-          .default(2592000)
-          .describe(TOKEN_AUTH.ATTACH.accessTokenMaxTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0).describe(TOKEN_AUTH.ATTACH.accessTokenNumUsesLimit)
+          .default(2592000),
+        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
       }),
       response: {
         200: z.object({
@@ -106,7 +102,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().trim().describe(TOKEN_AUTH.UPDATE.identityId)
+        identityId: z.string().trim()
       }),
       body: z.object({
         accessTokenTrustedIps: z
@@ -115,10 +111,9 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
           })
           .array()
           .min(1)
-          .optional()
-          .describe(TOKEN_AUTH.UPDATE.accessTokenTrustedIps),
-        accessTokenTTL: z.number().int().min(0).optional().describe(TOKEN_AUTH.UPDATE.accessTokenTTL),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional().describe(TOKEN_AUTH.UPDATE.accessTokenNumUsesLimit),
+          .optional(),
+        accessTokenTTL: z.number().int().min(0).optional(),
+        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
         accessTokenMaxTTL: z
           .number()
           .int()
@@ -126,7 +121,6 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
             message: "accessTokenMaxTTL must have a non zero number"
           })
           .optional()
-          .describe(TOKEN_AUTH.UPDATE.accessTokenMaxTTL)
       }),
       response: {
         200: z.object({
@@ -180,7 +174,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().describe(TOKEN_AUTH.RETRIEVE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({
@@ -227,7 +221,7 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
         }
       ],
       params: z.object({
-        identityId: z.string().describe(TOKEN_AUTH.REVOKE.identityId)
+        identityId: z.string()
       }),
       response: {
         200: z.object({
@@ -259,6 +253,15 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     }
   });
 
+  // proposed
+  // update token by id: PATCH /token-auth/tokens/:tokenId
+  // revoke token by id: POST /token-auth/tokens/:tokenId/revoke
+
+  // current
+  // revoke token by id: POST /token/revoke-by-id
+
+  // token-auth/identities/:identityId/tokens
+
   server.route({
     method: "POST",
     url: "/token-auth/identities/:identityId/tokens",
@@ -267,17 +270,17 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Create token for identity with Token Auth",
+      description: "Create token for identity with Token Auth configured",
       security: [
         {
           bearerAuth: []
         }
       ],
       params: z.object({
-        identityId: z.string().describe(TOKEN_AUTH.CREATE_TOKEN.identityId)
+        identityId: z.string()
       }),
       body: z.object({
-        name: z.string().optional().describe(TOKEN_AUTH.CREATE_TOKEN.name)
+        name: z.string().optional()
       }),
       response: {
         200: z.object({
@@ -328,18 +331,18 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Get tokens for identity with Token Auth",
+      description: "Get tokens for identity with Token Auth configured",
       security: [
         {
           bearerAuth: []
         }
       ],
       params: z.object({
-        identityId: z.string().describe(TOKEN_AUTH.GET_TOKENS.identityId)
+        identityId: z.string()
       }),
       querystring: z.object({
-        offset: z.coerce.number().min(0).max(100).default(0).describe(TOKEN_AUTH.GET_TOKENS.offset),
-        limit: z.coerce.number().min(1).max(100).default(20).describe(TOKEN_AUTH.GET_TOKENS.limit)
+        offset: z.coerce.number().min(0).max(100).default(0),
+        limit: z.coerce.number().min(1).max(100).default(20)
       }),
       response: {
         200: z.object({
@@ -380,17 +383,17 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Update token for identity with Token Auth",
+      description: "Update token for identity with Token Auth configured",
       security: [
         {
           bearerAuth: []
         }
       ],
       params: z.object({
-        tokenId: z.string().describe(TOKEN_AUTH.UPDATE_TOKEN.tokenId)
+        tokenId: z.string()
       }),
       body: z.object({
-        name: z.string().optional().describe(TOKEN_AUTH.UPDATE_TOKEN.name)
+        name: z.string().optional()
       }),
       response: {
         200: z.object({
@@ -433,14 +436,14 @@ export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     schema: {
-      description: "Revoke token for identity with Token Auth",
+      description: "Revoke token for identity with Token Auth configured",
       security: [
         {
           bearerAuth: []
         }
       ],
       params: z.object({
-        tokenId: z.string().describe(TOKEN_AUTH.REVOKE_TOKEN.tokenId)
+        tokenId: z.string()
       }),
       response: {
         200: z.object({

backend/src/services/identity-access-token/identity-access-token-dal.ts

@@ -57,12 +57,6 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
             `${TableName.IdentityOidcAuth}.identityId`
           );
         })
-        .leftJoin(TableName.IdentityTokenAuth, (qb) => {
-          qb.on(`${TableName.Identity}.authMethod`, db.raw("?", [IdentityAuthMethod.TOKEN_AUTH])).andOn(
-            `${TableName.Identity}.id`,
-            `${TableName.IdentityTokenAuth}.identityId`
-          );
-        })
         .select(selectAllTableCols(TableName.IdentityAccessToken))
         .select(
           db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityUniversalAuth).as("accessTokenTrustedIpsUa"),
@@ -71,7 +65,6 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
           db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityAzureAuth).as("accessTokenTrustedIpsAzure"),
           db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityKubernetesAuth).as("accessTokenTrustedIpsK8s"),
           db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityOidcAuth).as("accessTokenTrustedIpsOidc"),
-          db.ref("accessTokenTrustedIps").withSchema(TableName.IdentityTokenAuth).as("accessTokenTrustedIpsToken"),
           db.ref("name").withSchema(TableName.Identity)
         )
         .first();
@@ -86,8 +79,7 @@ export const identityAccessTokenDALFactory = (db: TDbClient) => {
           doc.accessTokenTrustedIpsAws ||
           doc.accessTokenTrustedIpsAzure ||
           doc.accessTokenTrustedIpsK8s ||
-          doc.accessTokenTrustedIpsOidc ||
-          doc.accessTokenTrustedIpsToken
+          doc.accessTokenTrustedIpsOidc
       };
     } catch (error) {
       throw new DatabaseError({ error, name: "IdAccessTokenFindOne" });

backend/src/services/identity-azure-auth/identity-azure-auth-fns.ts

@@ -17,6 +17,7 @@ export const validateAzureIdentity = async ({
   const jwksUri = `https://login.microsoftonline.com/${tenantId}/discovery/keys`;
 
   const decodedJwt = jwt.decode(azureJwt, { complete: true }) as TDecodedAzureAuthJwt;
+
   const { kid } = decodedJwt.header;
 
   const { data }: { data: TAzureJwksUriResponse } = await axios.get(jwksUri);
@@ -27,6 +28,13 @@ export const validateAzureIdentity = async ({
 
   const publicKey = `-----BEGIN CERTIFICATE-----\n${signingKey.x5c[0]}\n-----END CERTIFICATE-----`;
 
+  // Case: This can happen when the user uses a custom resource (such as https://management.azure.com&client_id=value).
+  // In this case, the audience in the decoded JWT will not have a trailing slash, but the resource will.
+  if (!decodedJwt.payload.aud.endsWith("/") && resource.endsWith("/")) {
+    // eslint-disable-next-line no-param-reassign
+    resource = resource.slice(0, -1);
+  }
+
   return jwt.verify(azureJwt, publicKey, {
     audience: resource,
     issuer: `https://sts.windows.net/${tenantId}/`

docs/api-reference/endpoints/aws-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/aws-auth/identities/{identityId}"
----

docs/api-reference/endpoints/aws-auth/login.mdx

@@ -1,4 +0,0 @@
----
-title: "Login"
-openapi: "POST /api/v1/auth/aws-auth/login"
----

docs/api-reference/endpoints/aws-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/aws-auth/identities/{identityId}"
----

docs/api-reference/endpoints/aws-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/aws-auth/identities/{identityId}"
----

docs/api-reference/endpoints/aws-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/aws-auth/identities/{identityId}"
----

docs/api-reference/endpoints/azure-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/azure-auth/identities/{identityId}"
----

docs/api-reference/endpoints/azure-auth/login.mdx

@@ -1,4 +0,0 @@
----
-title: "Login"
-openapi: "POST /api/v1/auth/azure-auth/login"
----

docs/api-reference/endpoints/azure-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/azure-auth/identities/{identityId}"
----

docs/api-reference/endpoints/azure-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/azure-auth/identities/{identityId}"
----

docs/api-reference/endpoints/azure-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/azure-auth/identities/{identityId}"
----

docs/api-reference/endpoints/gcp-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/gcp-auth/identities/{identityId}"
----

docs/api-reference/endpoints/gcp-auth/login.mdx

@@ -1,4 +0,0 @@
----
-title: "Login"
-openapi: "POST /api/v1/auth/gcp-auth/login"
----

docs/api-reference/endpoints/gcp-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/gcp-auth/identities/{identityId}"
----

docs/api-reference/endpoints/gcp-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/gcp-auth/identities/{identityId}"
----

docs/api-reference/endpoints/gcp-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/gcp-auth/identities/{identityId}"
----

docs/api-reference/endpoints/kubernetes-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/kubernetes-auth/identities/{identityId}"
----

docs/api-reference/endpoints/kubernetes-auth/login.mdx

@@ -1,4 +0,0 @@
----
-title: "Login"
-openapi: "POST /api/v1/auth/kubernetes-auth/login"
----

docs/api-reference/endpoints/kubernetes-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/kubernetes-auth/identities/{identityId}"
----

docs/api-reference/endpoints/kubernetes-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/kubernetes-auth/identities/{identityId}"
----

docs/api-reference/endpoints/kubernetes-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/kubernetes-auth/identities/{identityId}"
----

docs/api-reference/endpoints/oidc-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/oidc-auth/identities/{identityId}"
----

docs/api-reference/endpoints/oidc-auth/login.mdx

@@ -1,4 +0,0 @@
----
-title: "Login"
-openapi: "POST /api/v1/auth/oidc-auth/login"
----

docs/api-reference/endpoints/oidc-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/oidc-auth/identities/{identityId}"
----

docs/api-reference/endpoints/oidc-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/oidc-auth/identities/{identityId}"
----

docs/api-reference/endpoints/oidc-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/oidc-auth/identities/{identityId}"
----

docs/api-reference/endpoints/token-auth/attach.mdx

@@ -1,4 +0,0 @@
----
-title: "Attach"
-openapi: "POST /api/v1/auth/token-auth/identities/{identityId}"
----

docs/api-reference/endpoints/token-auth/create-token.mdx

@@ -1,4 +0,0 @@
----
-title: "Create Token"
-openapi: "POST /api/v1/auth/token-auth/identities/{identityId}/tokens"
----

docs/api-reference/endpoints/token-auth/get-tokens.mdx

@@ -1,4 +0,0 @@
----
-title: "Get Tokens"
-openapi: "GET /api/v1/auth/token-auth/identities/{identityId}/tokens"
----

docs/api-reference/endpoints/token-auth/retrieve.mdx

@@ -1,4 +0,0 @@
----
-title: "Retrieve"
-openapi: "GET /api/v1/auth/token-auth/identities/{identityId}"
----

docs/api-reference/endpoints/token-auth/revoke-token.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke Token"
-openapi: "POST /api/v1/auth/token-auth/tokens/{tokenId}/revoke"
----

docs/api-reference/endpoints/token-auth/revoke.mdx

@@ -1,4 +0,0 @@
----
-title: "Revoke"
-openapi: "DELETE /api/v1/auth/token-auth/identities/{identityId}"
----

docs/api-reference/endpoints/token-auth/update-token.mdx

@@ -1,4 +0,0 @@
----
-title: "Update Token"
-openapi: "PATCH /api/v1/auth/token-auth/tokens/{tokenId}"
----

docs/api-reference/endpoints/token-auth/update.mdx

@@ -1,4 +0,0 @@
----
-title: "Update"
-openapi: "PATCH /api/v1/auth/token-auth/identities/{identityId}"
----

docs/mint.json

@@ -428,19 +428,6 @@
             "api-reference/endpoints/identities/list"
           ]
         },
-        {
-          "group": "Token Auth",
-          "pages": [
-            "api-reference/endpoints/token-auth/attach",
-            "api-reference/endpoints/token-auth/retrieve",
-            "api-reference/endpoints/token-auth/update",
-            "api-reference/endpoints/token-auth/revoke",
-            "api-reference/endpoints/token-auth/get-tokens",
-            "api-reference/endpoints/token-auth/create-token",
-            "api-reference/endpoints/token-auth/update-token",
-            "api-reference/endpoints/token-auth/revoke-token"
-          ]
-        },
         {
           "group": "Universal Auth",
           "pages": [
@@ -457,56 +444,6 @@
             "api-reference/endpoints/universal-auth/revoke-access-token"
           ]
         },
-        {
-          "group": "GCP Auth",
-          "pages": [
-            "api-reference/endpoints/gcp-auth/login",
-            "api-reference/endpoints/gcp-auth/attach",
-            "api-reference/endpoints/gcp-auth/retrieve",
-            "api-reference/endpoints/gcp-auth/update",
-            "api-reference/endpoints/gcp-auth/revoke"
-          ]
-        },
-        {
-          "group": "AWS Auth",
-          "pages": [
-            "api-reference/endpoints/aws-auth/login",
-            "api-reference/endpoints/aws-auth/attach",
-            "api-reference/endpoints/aws-auth/retrieve",
-            "api-reference/endpoints/aws-auth/update",
-            "api-reference/endpoints/aws-auth/revoke"
-          ]
-        },
-        {
-          "group": "Azure Auth",
-          "pages": [
-            "api-reference/endpoints/azure-auth/login",
-            "api-reference/endpoints/azure-auth/attach",
-            "api-reference/endpoints/azure-auth/retrieve",
-            "api-reference/endpoints/azure-auth/update",
-            "api-reference/endpoints/azure-auth/revoke"
-          ]
-        },
-        {
-          "group": "Kubernetes Auth",
-          "pages": [
-            "api-reference/endpoints/kubernetes-auth/login",
-            "api-reference/endpoints/kubernetes-auth/attach",
-            "api-reference/endpoints/kubernetes-auth/retrieve",
-            "api-reference/endpoints/kubernetes-auth/update",
-            "api-reference/endpoints/kubernetes-auth/revoke"
-          ]
-        },
-        {
-          "group": "OIDC Auth",
-          "pages": [
-            "api-reference/endpoints/oidc-auth/login",
-            "api-reference/endpoints/oidc-auth/attach",
-            "api-reference/endpoints/oidc-auth/retrieve",
-            "api-reference/endpoints/oidc-auth/update",
-            "api-reference/endpoints/oidc-auth/revoke"
-          ]
-        },
         {
           "group": "Organizations",
           "pages": [

frontend/src/views/Org/IdentityPage/components/IdentityProjectsSection/IdentityAddToProjectModal.tsx

@@ -4,7 +4,7 @@ import { zodResolver } from "@hookform/resolvers/zod";
 import { z } from "zod";
 
 import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, Modal, ModalContent, Select, SelectItem } from "@app/components/v2";
+import { Button, FormControl, Modal, ModalContent,Select, SelectItem } from "@app/components/v2";
 import { useWorkspace } from "@app/context";
 import {
   useAddIdentityToWorkspace,
@@ -54,7 +54,7 @@ export const IdentityAddToProjectModal = ({ identityId, popUp, handlePopUpToggle
   const filteredWorkspaces = useMemo(() => {
     const wsWorkspaceIds = new Map();
 
-    projectMemberships?.forEach((projectMembership) => {
+    projectMemberships?.forEach((projectMembership: any) => {
       wsWorkspaceIds.set(projectMembership.project.id, true);
     });
 

frontend/src/views/Org/IdentityPage/components/IdentityProjectsSection/IdentityProjectRow.tsx

@@ -1,12 +1,9 @@
-import { useMemo } from "react";
 import { useRouter } from "next/router";
 import { faTrash } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
 
-import { createNotification } from "@app/components/notifications";
 import { IconButton, Td, Tooltip, Tr } from "@app/components/v2";
-import { useWorkspace } from "@app/context";
 import { IdentityMembership } from "@app/hooks/api/identities/types";
 import { ProjectMembershipRole } from "@app/hooks/api/roles/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -24,7 +21,7 @@ const formatRoleName = (role: string, customRoleName?: string) => {
   if (role === ProjectMembershipRole.Admin) return "Admin";
   if (role === ProjectMembershipRole.Member) return "Developer";
   if (role === ProjectMembershipRole.Viewer) return "Viewer";
-  if (role === ProjectMembershipRole.NoAccess) return "No Access";
+  if (role === ProjectMembershipRole.NoAccess) return "No access";
   return role;
 };
 
@@ -32,34 +29,12 @@ export const IdentityProjectRow = ({
   membership: { id, createdAt, identity, project, roles },
   handlePopUpOpen
 }: Props) => {
-  const { workspaces } = useWorkspace();
   const router = useRouter();
-
-  const isAccessible = useMemo(() => {
-    const workspaceIds = new Map();
-
-    workspaces?.forEach((workspace) => {
-      workspaceIds.set(workspace.id, true);
-    });
-
-    return workspaceIds.has(project.id);
-  }, [workspaces, project]);
-
   return (
     <Tr
       className="group h-10 cursor-pointer transition-colors duration-300 hover:bg-mineshaft-700"
       key={`identity-project-membership-${id}`}
-      onClick={() => {
-        if (isAccessible) {
-          router.push(`/project/${project.id}/members`);
-          return;
-        }
-
-        createNotification({
-          text: "Unable to access project",
-          type: "error"
-        });
-      }}
+      onClick={() => router.push(`/project/${project.id}/members`)}
     >
       <Td>{project.name}</Td>
       <Td>{`${formatRoleName(roles[0].role, roles[0].customRoleName)}${
@@ -67,28 +42,26 @@ export const IdentityProjectRow = ({
       }`}</Td>
       <Td>{format(new Date(createdAt), "yyyy-MM-dd")}</Td>
       <Td>
-        {isAccessible && (
-          <div className="opacity-0 transition-opacity duration-300 group-hover:opacity-100">
-            <Tooltip content="Remove">
-              <IconButton
-                ariaLabel="copy icon"
-                variant="plain"
-                className="group relative"
-                onClick={(e) => {
-                  e.stopPropagation();
-                  handlePopUpOpen("removeIdentityFromProject", {
-                    identityId: identity.id,
-                    identityName: identity.name,
-                    projectId: project.id,
-                    projectName: project.name
-                  });
-                }}
-              >
-                <FontAwesomeIcon icon={faTrash} />
-              </IconButton>
-            </Tooltip>
-          </div>
-        )}
+        <div className="opacity-0 transition-opacity duration-300 group-hover:opacity-100">
+          <Tooltip content="Remove">
+            <IconButton
+              ariaLabel="copy icon"
+              variant="plain"
+              className="group relative"
+              onClick={(e) => {
+                e.stopPropagation();
+                handlePopUpOpen("removeIdentityFromProject", {
+                  identityId: identity.id,
+                  identityName: identity.name,
+                  projectId: project.id,
+                  projectName: project.name
+                });
+              }}
+            >
+              <FontAwesomeIcon icon={faTrash} />
+            </IconButton>
+          </Tooltip>
+        </div>
       </Td>
     </Tr>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx

@@ -108,7 +108,7 @@ export const IdentitySection = withPermission(
             )}
           </OrgPermissionCan>
         </div>
-        <IdentityTable handlePopUpOpen={handlePopUpOpen} />
+        <IdentityTable />
         <IdentityModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
         {/* <IdentityAuthMethodModal
           popUp={popUp}

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx

@@ -1,16 +1,13 @@
+import Link from "next/link";
 import { useRouter } from "next/router";
 import { faEllipsis, faServer } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
   EmptyState,
+  IconButton,
   Select,
   SelectItem,
   Table,
@@ -24,19 +21,8 @@ import {
 } from "@app/components/v2";
 import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useGetIdentityMembershipOrgs, useGetOrgRoles, useUpdateIdentity } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
 
-type Props = {
-  handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<["deleteIdentity"]>,
-    data?: {
-      identityId: string;
-      name: string;
-    }
-  ) => void;
-};
-
-export const IdentityTable = ({ handlePopUpOpen }: Props) => {
+export const IdentityTable = () => {
   const router = useRouter();
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
@@ -90,7 +76,9 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                   key={`identity-${id}`}
                   onClick={() => router.push(`/org/${orgId}/identities/${id}`)}
                 >
-                  <Td>{name}</Td>
+                  <Td>
+                    <Link href={`/org/${orgId}/identities/${id}`}>{name}</Link>
+                  </Td>
                   <Td>
                     <OrgPermissionCan
                       I={OrgPermissionActions.Edit}
@@ -121,58 +109,16 @@ export const IdentityTable = ({ handlePopUpOpen }: Props) => {
                     </OrgPermissionCan>
                   </Td>
                   <Td>
-                    <DropdownMenu>
-                      <DropdownMenuTrigger asChild className="rounded-lg">
-                        <div className="hover:text-primary-400 data-[state=open]:text-primary-400">
-                          <FontAwesomeIcon size="sm" icon={faEllipsis} />
-                        </div>
-                      </DropdownMenuTrigger>
-                      <DropdownMenuContent align="start" className="p-1">
-                        <OrgPermissionCan
-                          I={OrgPermissionActions.Edit}
-                          a={OrgPermissionSubjects.Identity}
-                        >
-                          {(isAllowed) => (
-                            <DropdownMenuItem
-                              className={twMerge(
-                                !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                              )}
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                router.push(`/org/${orgId}/identities/${id}`);
-                              }}
-                              disabled={!isAllowed}
-                            >
-                              Edit Identity
-                            </DropdownMenuItem>
-                          )}
-                        </OrgPermissionCan>
-                        <OrgPermissionCan
-                          I={OrgPermissionActions.Delete}
-                          a={OrgPermissionSubjects.Identity}
-                        >
-                          {(isAllowed) => (
-                            <DropdownMenuItem
-                              className={twMerge(
-                                isAllowed
-                                  ? "hover:!bg-red-500 hover:!text-white"
-                                  : "pointer-events-none cursor-not-allowed opacity-50"
-                              )}
-                              onClick={(e) => {
-                                e.stopPropagation();
-                                handlePopUpOpen("deleteIdentity", {
-                                  identityId: id,
-                                  name
-                                });
-                              }}
-                              disabled={!isAllowed}
-                            >
-                              Delete Identity
-                            </DropdownMenuItem>
-                          )}
-                        </OrgPermissionCan>
-                      </DropdownMenuContent>
-                    </DropdownMenu>
+                    <div className="flex items-center justify-end space-x-4">
+                      <IconButton
+                        ariaLabel="copy icon"
+                        variant="plain"
+                        className="group relative"
+                        onClick={() => router.push(`/org/${orgId}/identities/${id}`)}
+                      >
+                        <FontAwesomeIcon icon={faEllipsis} />
+                      </IconButton>
+                    </div>
                   </Td>
                 </Tr>
               );