address security #86

feat: allowed toggling login options as admin

backend/src/@types/fastify.d.ts

@@ -42,7 +42,6 @@ import { TIdentityAzureAuthServiceFactory } from "@app/services/identity-azure-a
 import { TIdentityGcpAuthServiceFactory } from "@app/services/identity-gcp-auth/identity-gcp-auth-service";
 import { TIdentityKubernetesAuthServiceFactory } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-service";
 import { TIdentityProjectServiceFactory } from "@app/services/identity-project/identity-project-service";
-import { TIdentityTokenAuthServiceFactory } from "@app/services/identity-token-auth/identity-token-auth-service";
 import { TIdentityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";
 import { TIntegrationServiceFactory } from "@app/services/integration/integration-service";
 import { TIntegrationAuthServiceFactory } from "@app/services/integration-auth/integration-auth-service";
@@ -128,7 +127,6 @@ declare module "fastify" {
       identity: TIdentityServiceFactory;
       identityAccessToken: TIdentityAccessTokenServiceFactory;
       identityProject: TIdentityProjectServiceFactory;
-      identityTokenAuth: TIdentityTokenAuthServiceFactory;
       identityUa: TIdentityUaServiceFactory;
       identityKubernetesAuth: TIdentityKubernetesAuthServiceFactory;
       identityGcpAuth: TIdentityGcpAuthServiceFactory;

backend/src/@types/knex.d.ts

@@ -104,9 +104,6 @@ import {
   TIdentityProjectMemberships,
   TIdentityProjectMembershipsInsert,
   TIdentityProjectMembershipsUpdate,
-  TIdentityTokenAuths,
-  TIdentityTokenAuthsInsert,
-  TIdentityTokenAuthsUpdate,
   TIdentityUaClientSecrets,
   TIdentityUaClientSecretsInsert,
   TIdentityUaClientSecretsUpdate,
@@ -453,11 +450,6 @@ declare module "knex/types/tables" {
       TIntegrationAuthsUpdate
     >;
     [TableName.Identity]: KnexOriginal.CompositeTableType<TIdentities, TIdentitiesInsert, TIdentitiesUpdate>;
-    [TableName.IdentityTokenAuth]: KnexOriginal.CompositeTableType<
-      TIdentityTokenAuths,
-      TIdentityTokenAuthsInsert,
-      TIdentityTokenAuthsUpdate
-    >;
     [TableName.IdentityUniversalAuth]: KnexOriginal.CompositeTableType<
       TIdentityUniversalAuths,
       TIdentityUniversalAuthsInsert,

backend/src/db/migrations/20240626115035_admin-login-method-config.ts

@@ -0,0 +1,19 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn(TableName.SuperAdmin, "enabledLoginMethods"))) {
+    await knex.schema.alterTable(TableName.SuperAdmin, (tb) => {
+      tb.specificType("enabledLoginMethods", "text[]");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.SuperAdmin, "enabledLoginMethods")) {
+    await knex.schema.alterTable(TableName.SuperAdmin, (t) => {
+      t.dropColumn("enabledLoginMethods");
+    });
+  }
+}

backend/src/db/migrations/20240702175124_identity-token-auth.ts

@@ -1,24 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  await knex.schema.createTable(TableName.IdentityTokenAuth, (t) => {
-    t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-    t.bigInteger("accessTokenTTL").defaultTo(7200).notNullable();
-    t.bigInteger("accessTokenMaxTTL").defaultTo(7200).notNullable();
-    t.bigInteger("accessTokenNumUsesLimit").defaultTo(0).notNullable();
-    t.jsonb("accessTokenTrustedIps").notNullable();
-    t.timestamps(true, true, true);
-    t.uuid("identityId").notNullable().unique();
-    t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
-  });
-
-  await createOnUpdateTrigger(knex, TableName.IdentityTokenAuth);
-}
-
-export async function down(knex: Knex): Promise<void> {
-  await knex.schema.dropTableIfExists(TableName.IdentityTokenAuth);
-  await dropOnUpdateTrigger(knex, TableName.IdentityTokenAuth);
-}

backend/src/db/migrations/20240704161322_identity-access-token-name.ts

@@ -1,24 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.IdentityAccessToken)) {
-    const hasNameColumn = await knex.schema.hasColumn(TableName.IdentityAccessToken, "name");
-    if (!hasNameColumn) {
-      await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
-        t.string("name").nullable();
-      });
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.IdentityAccessToken)) {
-    if (await knex.schema.hasColumn(TableName.IdentityAccessToken, "name")) {
-      await knex.schema.alterTable(TableName.IdentityAccessToken, (t) => {
-        t.dropColumn("name");
-      });
-    }
-  }
-}

backend/src/db/schemas/identity-access-tokens.ts

@@ -19,8 +19,7 @@ export const IdentityAccessTokensSchema = z.object({
   identityUAClientSecretId: z.string().nullable().optional(),
   identityId: z.string().uuid(),
   createdAt: z.date(),
-  updatedAt: z.date(),
-  name: z.string().nullable().optional()
+  updatedAt: z.date()
 });
 
 export type TIdentityAccessTokens = z.infer<typeof IdentityAccessTokensSchema>;

backend/src/db/schemas/identity-token-auths.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const IdentityTokenAuthsSchema = z.object({
-  id: z.string().uuid(),
-  accessTokenTTL: z.coerce.number().default(7200),
-  accessTokenMaxTTL: z.coerce.number().default(7200),
-  accessTokenNumUsesLimit: z.coerce.number().default(0),
-  accessTokenTrustedIps: z.unknown(),
-  createdAt: z.date(),
-  updatedAt: z.date(),
-  identityId: z.string().uuid()
-});
-
-export type TIdentityTokenAuths = z.infer<typeof IdentityTokenAuthsSchema>;
-export type TIdentityTokenAuthsInsert = Omit<z.input<typeof IdentityTokenAuthsSchema>, TImmutableDBKeys>;
-export type TIdentityTokenAuthsUpdate = Partial<Omit<z.input<typeof IdentityTokenAuthsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -32,7 +32,6 @@ export * from "./identity-org-memberships";
 export * from "./identity-project-additional-privilege";
 export * from "./identity-project-membership-role";
 export * from "./identity-project-memberships";
-export * from "./identity-token-auths";
 export * from "./identity-ua-client-secrets";
 export * from "./identity-universal-auths";
 export * from "./incident-contacts";

backend/src/db/schemas/models.ts

@@ -53,7 +53,6 @@ export enum TableName {
   Webhook = "webhooks",
   Identity = "identities",
   IdentityAccessToken = "identity_access_tokens",
-  IdentityTokenAuth = "identity_token_auths",
   IdentityUniversalAuth = "identity_universal_auths",
   IdentityKubernetesAuth = "identity_kubernetes_auths",
   IdentityGcpAuth = "identity_gcp_auths",
@@ -162,7 +161,6 @@ export enum ProjectUpgradeStatus {
 }
 
 export enum IdentityAuthMethod {
-  TOKEN_AUTH = "token-auth",
   Univeral = "universal-auth",
   KUBERNETES_AUTH = "kubernetes-auth",
   GCP_AUTH = "gcp-auth",

backend/src/db/schemas/super-admin.ts

@@ -18,7 +18,8 @@ export const SuperAdminSchema = z.object({
   trustSamlEmails: z.boolean().default(false).nullable().optional(),
   trustLdapEmails: z.boolean().default(false).nullable().optional(),
   trustOidcEmails: z.boolean().default(false).nullable().optional(),
-  defaultAuthOrgId: z.string().uuid().nullable().optional()
+  defaultAuthOrgId: z.string().uuid().nullable().optional(),
+  enabledLoginMethods: z.string().array().nullable().optional()
 });
 
 export type TSuperAdmin = z.infer<typeof SuperAdminSchema>;

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -66,13 +66,6 @@ export enum EventType {
   UPDATE_IDENTITY_UNIVERSAL_AUTH = "update-identity-universal-auth",
   GET_IDENTITY_UNIVERSAL_AUTH = "get-identity-universal-auth",
   REVOKE_IDENTITY_UNIVERSAL_AUTH = "revoke-identity-universal-auth",
-  CREATE_TOKEN_IDENTITY_TOKEN_AUTH = "create-token-identity-token-auth",
-  UPDATE_TOKEN_IDENTITY_TOKEN_AUTH = "update-token-identity-token-auth",
-  GET_TOKENS_IDENTITY_TOKEN_AUTH = "get-tokens-identity-token-auth",
-  ADD_IDENTITY_TOKEN_AUTH = "add-identity-token-auth",
-  UPDATE_IDENTITY_TOKEN_AUTH = "update-identity-token-auth",
-  GET_IDENTITY_TOKEN_AUTH = "get-identity-token-auth",
-  REVOKE_IDENTITY_TOKEN_AUTH = "revoke-identity-token-auth",
   LOGIN_IDENTITY_KUBERNETES_AUTH = "login-identity-kubernetes-auth",
   ADD_IDENTITY_KUBERNETES_AUTH = "add-identity-kubernetes-auth",
   UPDATE_IDENTITY_KUBENETES_AUTH = "update-identity-kubernetes-auth",
@@ -454,66 +447,6 @@ interface DeleteIdentityUniversalAuthEvent {
   };
 }
 
-interface CreateTokenIdentityTokenAuthEvent {
-  type: EventType.CREATE_TOKEN_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-    identityAccessTokenId: string;
-  };
-}
-
-interface UpdateTokenIdentityTokenAuthEvent {
-  type: EventType.UPDATE_TOKEN_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-    tokenId: string;
-    name?: string;
-  };
-}
-
-interface GetTokensIdentityTokenAuthEvent {
-  type: EventType.GET_TOKENS_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-  };
-}
-
-interface AddIdentityTokenAuthEvent {
-  type: EventType.ADD_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-    accessTokenTTL: number;
-    accessTokenMaxTTL: number;
-    accessTokenNumUsesLimit: number;
-    accessTokenTrustedIps: Array<TIdentityTrustedIp>;
-  };
-}
-
-interface UpdateIdentityTokenAuthEvent {
-  type: EventType.UPDATE_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-    accessTokenTTL?: number;
-    accessTokenMaxTTL?: number;
-    accessTokenNumUsesLimit?: number;
-    accessTokenTrustedIps?: Array<TIdentityTrustedIp>;
-  };
-}
-
-interface GetIdentityTokenAuthEvent {
-  type: EventType.GET_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-  };
-}
-
-interface DeleteIdentityTokenAuthEvent {
-  type: EventType.REVOKE_IDENTITY_TOKEN_AUTH;
-  metadata: {
-    identityId: string;
-  };
-}
-
 interface LoginIdentityKubernetesAuthEvent {
   type: EventType.LOGIN_IDENTITY_KUBERNETES_AUTH;
   metadata: {
@@ -1121,13 +1054,6 @@ export type Event =
   | UpdateIdentityUniversalAuthEvent
   | DeleteIdentityUniversalAuthEvent
   | GetIdentityUniversalAuthEvent
-  | CreateTokenIdentityTokenAuthEvent
-  | UpdateTokenIdentityTokenAuthEvent
-  | GetTokensIdentityTokenAuthEvent
-  | AddIdentityTokenAuthEvent
-  | UpdateIdentityTokenAuthEvent
-  | GetIdentityTokenAuthEvent
-  | DeleteIdentityTokenAuthEvent
   | LoginIdentityKubernetesAuthEvent
   | DeleteIdentityKubernetesAuthEvent
   | AddIdentityKubernetesAuthEvent

backend/src/ee/services/ldap-config/ldap-config-service.ts

@@ -34,6 +34,7 @@ import { TProjectBotDALFactory } from "@app/services/project-bot/project-bot-dal
 import { TProjectKeyDALFactory } from "@app/services/project-key/project-key-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
+import { LoginMethod } from "@app/services/super-admin/super-admin-types";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 import { normalizeUsername } from "@app/services/user/user-fns";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
@@ -417,6 +418,13 @@ export const ldapConfigServiceFactory = ({
   }: TLdapLoginDTO) => {
     const appCfg = getConfig();
     const serverCfg = await getServerCfg();
+
+    if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.LDAP)) {
+      throw new BadRequestError({
+        message: "Login with LDAP is disabled by administrator."
+      });
+    }
+
     let userAlias = await userAliasDAL.findOne({
       externalId,
       orgId,

backend/src/ee/services/oidc/oidc-config-service.ts

@@ -26,6 +26,7 @@ import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
+import { LoginMethod } from "@app/services/super-admin/super-admin-types";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 import { normalizeUsername } from "@app/services/user/user-fns";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
@@ -157,6 +158,13 @@ export const oidcConfigServiceFactory = ({
 
   const oidcLogin = async ({ externalId, email, firstName, lastName, orgId, callbackPort }: TOidcLoginDTO) => {
     const serverCfg = await getServerCfg();
+
+    if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.OIDC)) {
+      throw new BadRequestError({
+        message: "Login with OIDC is disabled by administrator."
+      });
+    }
+
     const appCfg = getConfig();
     const userAlias = await userAliasDAL.findOne({
       externalId,

backend/src/ee/services/saml-config/saml-config-service.ts

@@ -28,6 +28,7 @@ import { TOrgDALFactory } from "@app/services/org/org-dal";
 import { TOrgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
 import { SmtpTemplates, TSmtpService } from "@app/services/smtp/smtp-service";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
+import { LoginMethod } from "@app/services/super-admin/super-admin-types";
 import { TUserDALFactory } from "@app/services/user/user-dal";
 import { normalizeUsername } from "@app/services/user/user-fns";
 import { TUserAliasDALFactory } from "@app/services/user-alias/user-alias-dal";
@@ -335,6 +336,13 @@ export const samlConfigServiceFactory = ({
   }: TSamlLoginDTO) => {
     const appCfg = getConfig();
     const serverCfg = await getServerCfg();
+
+    if (serverCfg.enabledLoginMethods && !serverCfg.enabledLoginMethods.includes(LoginMethod.SAML)) {
+      throw new BadRequestError({
+        message: "Login with SAML is disabled by administrator."
+      });
+    }
+
     const userAlias = await userAliasDAL.findOne({
       externalId,
       orgId,

backend/src/server/routes/index.ts

@@ -105,8 +105,6 @@ import { identityKubernetesAuthServiceFactory } from "@app/services/identity-kub
 import { identityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 import { identityProjectMembershipRoleDALFactory } from "@app/services/identity-project/identity-project-membership-role-dal";
 import { identityProjectServiceFactory } from "@app/services/identity-project/identity-project-service";
-import { identityTokenAuthDALFactory } from "@app/services/identity-token-auth/identity-token-auth-dal";
-import { identityTokenAuthServiceFactory } from "@app/services/identity-token-auth/identity-token-auth-service";
 import { identityUaClientSecretDALFactory } from "@app/services/identity-ua/identity-ua-client-secret-dal";
 import { identityUaDALFactory } from "@app/services/identity-ua/identity-ua-dal";
 import { identityUaServiceFactory } from "@app/services/identity-ua/identity-ua-service";
@@ -235,7 +233,6 @@ export const registerRoutes = async (
   const identityProjectMembershipRoleDAL = identityProjectMembershipRoleDALFactory(db);
   const identityProjectAdditionalPrivilegeDAL = identityProjectAdditionalPrivilegeDALFactory(db);
 
-  const identityTokenAuthDAL = identityTokenAuthDALFactory(db);
   const identityUaDAL = identityUaDALFactory(db);
   const identityKubernetesAuthDAL = identityKubernetesAuthDALFactory(db);
   const identityUaClientSecretDAL = identityUaClientSecretDALFactory(db);
@@ -812,13 +809,11 @@ export const registerRoutes = async (
     permissionService,
     identityDAL,
     identityOrgMembershipDAL,
-    identityProjectDAL,
     licenseService
   });
   const identityAccessTokenService = identityAccessTokenServiceFactory({
     identityAccessTokenDAL,
-    identityOrgMembershipDAL,
-    permissionService
+    identityOrgMembershipDAL
   });
   const identityProjectService = identityProjectServiceFactory({
     permissionService,
@@ -834,14 +829,6 @@ export const registerRoutes = async (
     permissionService,
     identityProjectDAL
   });
-  const identityTokenAuthService = identityTokenAuthServiceFactory({
-    identityTokenAuthDAL,
-    identityDAL,
-    identityOrgMembershipDAL,
-    identityAccessTokenDAL,
-    permissionService,
-    licenseService
-  });
   const identityUaService = identityUaServiceFactory({
     identityOrgMembershipDAL,
     permissionService,
@@ -980,7 +967,6 @@ export const registerRoutes = async (
     identity: identityService,
     identityAccessToken: identityAccessTokenService,
     identityProject: identityProjectService,
-    identityTokenAuth: identityTokenAuthService,
     identityUa: identityUaService,
     identityKubernetesAuth: identityKubernetesAuthService,
     identityGcpAuth: identityGcpAuthService,

backend/src/server/routes/v1/admin-router.ts

@@ -8,6 +8,7 @@ import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
+import { LoginMethod } from "@app/services/super-admin/super-admin-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
 export const registerAdminRouter = async (server: FastifyZodProvider) => {
@@ -54,7 +55,14 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
         trustSamlEmails: z.boolean().optional(),
         trustLdapEmails: z.boolean().optional(),
         trustOidcEmails: z.boolean().optional(),
-        defaultAuthOrgId: z.string().optional().nullable()
+        defaultAuthOrgId: z.string().optional().nullable(),
+        enabledLoginMethods: z
+          .nativeEnum(LoginMethod)
+          .array()
+          .optional()
+          .refine((methods) => !methods || methods.length > 0, {
+            message: "At least one login method should be enabled."
+          })
       }),
       response: {
         200: z.object({
@@ -70,7 +78,7 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
       });
     },
     handler: async (req) => {
-      const config = await server.services.superAdmin.updateServerCfg(req.body);
+      const config = await server.services.superAdmin.updateServerCfg(req.body, req.permission.id);
       return { config };
     }
   });

backend/src/server/routes/v1/identity-access-token-router.ts

@@ -2,8 +2,6 @@ import { z } from "zod";
 
 import { UNIVERSAL_AUTH } from "@app/lib/api-docs";
 import { writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerIdentityAccessTokenRouter = async (server: FastifyZodProvider) => {
   server.route({
@@ -63,37 +61,4 @@ export const registerIdentityAccessTokenRouter = async (server: FastifyZodProvid
       };
     }
   });
-
-  server.route({
-    url: "/token/revoke-by-id",
-    method: "POST",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Revoke access token by the id of the token",
-      body: z.object({
-        tokenId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          message: z.string()
-        })
-      }
-    },
-    handler: async (req) => {
-      await server.services.identityAccessToken.revokeAccessTokenById({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-
-      return {
-        message: "Successfully revoked access token"
-      };
-    }
-  });
 };

backend/src/server/routes/v1/identity-router.ts

@@ -1,12 +1,6 @@
 import { z } from "zod";
 
-import {
-  IdentitiesSchema,
-  IdentityOrgMembershipsSchema,
-  OrgMembershipRole,
-  OrgRolesSchema,
-  ProjectsSchema
-} from "@app/db/schemas";
+import { IdentitiesSchema, IdentityOrgMembershipsSchema, OrgMembershipRole, OrgRolesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { IDENTITIES } from "@app/lib/api-docs";
 import { creationLimit, readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -266,63 +260,4 @@ export const registerIdentityRouter = async (server: FastifyZodProvider) => {
       return { identities };
     }
   });
-
-  server.route({
-    method: "GET",
-    url: "/:identityId/identity-memberships",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "List project memberships that identity with id is part of",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string().describe(IDENTITIES.GET_BY_ID.identityId)
-      }),
-      response: {
-        200: z.object({
-          identityMemberships: z.array(
-            z.object({
-              id: z.string(),
-              identityId: z.string(),
-              createdAt: z.date(),
-              updatedAt: z.date(),
-              roles: z.array(
-                z.object({
-                  id: z.string(),
-                  role: z.string(),
-                  customRoleId: z.string().optional().nullable(),
-                  customRoleName: z.string().optional().nullable(),
-                  customRoleSlug: z.string().optional().nullable(),
-                  isTemporary: z.boolean(),
-                  temporaryMode: z.string().optional().nullable(),
-                  temporaryRange: z.string().nullable().optional(),
-                  temporaryAccessStartTime: z.date().nullable().optional(),
-                  temporaryAccessEndTime: z.date().nullable().optional()
-                })
-              ),
-              identity: IdentitiesSchema.pick({ name: true, id: true, authMethod: true }),
-              project: ProjectsSchema.pick({ name: true, id: true })
-            })
-          )
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityMemberships = await server.services.identity.listProjectIdentitiesByIdentityId({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        identityId: req.params.identityId
-      });
-
-      return { identityMemberships };
-    }
-  });
 };

backend/src/server/routes/v1/identity-token-auth-router.ts

@@ -1,423 +0,0 @@
-import { z } from "zod";
-
-import { IdentityAccessTokensSchema, IdentityTokenAuthsSchema } from "@app/db/schemas";
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
-
-export const registerIdentityTokenAuthRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "POST",
-    url: "/token-auth/identities/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Attach Token Auth configuration onto identity",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string().trim()
-      }),
-      body: z.object({
-        accessTokenTrustedIps: z
-          .object({
-            ipAddress: z.string().trim()
-          })
-          .array()
-          .min(1)
-          .default([{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]),
-        accessTokenTTL: z
-          .number()
-          .int()
-          .min(1)
-          .refine((value) => value !== 0, {
-            message: "accessTokenTTL must have a non zero number"
-          })
-          .default(2592000),
-        accessTokenMaxTTL: z
-          .number()
-          .int()
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
-          .default(2592000),
-        accessTokenNumUsesLimit: z.number().int().min(0).default(0)
-      }),
-      response: {
-        200: z.object({
-          identityTokenAuth: IdentityTokenAuthsSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityTokenAuth = await server.services.identityTokenAuth.attachTokenAuth({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body,
-        identityId: req.params.identityId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityTokenAuth.orgId,
-        event: {
-          type: EventType.ADD_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: identityTokenAuth.identityId,
-            accessTokenTTL: identityTokenAuth.accessTokenTTL,
-            accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL,
-            accessTokenTrustedIps: identityTokenAuth.accessTokenTrustedIps as TIdentityTrustedIp[],
-            accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit
-          }
-        }
-      });
-
-      return {
-        identityTokenAuth
-      };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/token-auth/identities/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Update Token Auth configuration on identity",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string().trim()
-      }),
-      body: z.object({
-        accessTokenTrustedIps: z
-          .object({
-            ipAddress: z.string().trim()
-          })
-          .array()
-          .min(1)
-          .optional(),
-        accessTokenTTL: z.number().int().min(0).optional(),
-        accessTokenNumUsesLimit: z.number().int().min(0).optional(),
-        accessTokenMaxTTL: z
-          .number()
-          .int()
-          .refine((value) => value !== 0, {
-            message: "accessTokenMaxTTL must have a non zero number"
-          })
-          .optional()
-      }),
-      response: {
-        200: z.object({
-          identityTokenAuth: IdentityTokenAuthsSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityTokenAuth = await server.services.identityTokenAuth.updateTokenAuth({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod,
-        ...req.body,
-        identityId: req.params.identityId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityTokenAuth.orgId,
-        event: {
-          type: EventType.UPDATE_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: identityTokenAuth.identityId,
-            accessTokenTTL: identityTokenAuth.accessTokenTTL,
-            accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL,
-            accessTokenTrustedIps: identityTokenAuth.accessTokenTrustedIps as TIdentityTrustedIp[],
-            accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit
-          }
-        }
-      });
-
-      return {
-        identityTokenAuth
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/token-auth/identities/:identityId",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Retrieve Token Auth configuration on identity",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string()
-      }),
-      response: {
-        200: z.object({
-          identityTokenAuth: IdentityTokenAuthsSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityTokenAuth = await server.services.identityTokenAuth.getTokenAuth({
-        identityId: req.params.identityId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorOrgId: req.permission.orgId,
-        actorAuthMethod: req.permission.authMethod
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityTokenAuth.orgId,
-        event: {
-          type: EventType.GET_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: identityTokenAuth.identityId
-          }
-        }
-      });
-
-      return { identityTokenAuth };
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/token-auth/identities/:identityId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Delete Token Auth configuration on identity",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string()
-      }),
-      response: {
-        200: z.object({
-          identityTokenAuth: IdentityTokenAuthsSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const identityTokenAuth = await server.services.identityTokenAuth.revokeIdentityTokenAuth({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        identityId: req.params.identityId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityTokenAuth.orgId,
-        event: {
-          type: EventType.REVOKE_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: identityTokenAuth.identityId
-          }
-        }
-      });
-
-      return { identityTokenAuth };
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/token-auth/identities/:identityId/tokens",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Create token for identity with Token Auth configured",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string()
-      }),
-      body: z.object({
-        name: z.string().optional()
-      }),
-      response: {
-        200: z.object({
-          accessToken: z.string(),
-          expiresIn: z.coerce.number(),
-          accessTokenMaxTTL: z.coerce.number(),
-          tokenType: z.literal("Bearer")
-        })
-      }
-    },
-    handler: async (req) => {
-      const { identityTokenAuth, accessToken, identityAccessToken, identityMembershipOrg } =
-        await server.services.identityTokenAuth.createTokenTokenAuth({
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId,
-          identityId: req.params.identityId,
-          ...req.body
-        });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityMembershipOrg.orgId,
-        event: {
-          type: EventType.CREATE_TOKEN_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: identityTokenAuth.identityId,
-            identityAccessTokenId: identityAccessToken.id
-          }
-        }
-      });
-
-      return {
-        accessToken,
-        tokenType: "Bearer" as const,
-        expiresIn: identityTokenAuth.accessTokenTTL,
-        accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/token-auth/identities/:identityId/tokens",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Get tokens for identity with Token Auth configured",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string()
-      }),
-      querystring: z.object({
-        offset: z.coerce.number().min(0).max(100).default(0),
-        limit: z.coerce.number().min(1).max(100).default(20)
-      }),
-      response: {
-        200: z.object({
-          tokens: IdentityAccessTokensSchema.array()
-        })
-      }
-    },
-    handler: async (req) => {
-      const { tokens, identityMembershipOrg } = await server.services.identityTokenAuth.getTokensTokenAuth({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        identityId: req.params.identityId,
-        ...req.query
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityMembershipOrg.orgId,
-        event: {
-          type: EventType.GET_TOKENS_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: req.params.identityId
-          }
-        }
-      });
-
-      return { tokens };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/token-auth/identities/:identityId/tokens/:tokenId",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Update token for identity with Token Auth configured",
-      security: [
-        {
-          bearerAuth: []
-        }
-      ],
-      params: z.object({
-        identityId: z.string(),
-        tokenId: z.string()
-      }),
-      body: z.object({
-        name: z.string().optional()
-      }),
-      response: {
-        200: z.object({
-          token: IdentityAccessTokensSchema
-        })
-      }
-    },
-    handler: async (req) => {
-      const { token, identityMembershipOrg } = await server.services.identityTokenAuth.updateTokenTokenAuth({
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        identityId: req.params.identityId,
-        tokenId: req.params.tokenId,
-        ...req.body
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        orgId: identityMembershipOrg.orgId,
-        event: {
-          type: EventType.UPDATE_TOKEN_IDENTITY_TOKEN_AUTH,
-          metadata: {
-            identityId: req.params.identityId,
-            tokenId: token.id,
-            name: req.body.name
-          }
-        }
-      });
-
-      return { token };
-    }
-  });
-};

backend/src/server/routes/v1/index.ts

@@ -9,7 +9,6 @@ import { registerIdentityAzureAuthRouter } from "./identity-azure-auth-router";
 import { registerIdentityGcpAuthRouter } from "./identity-gcp-auth-router";
 import { registerIdentityKubernetesRouter } from "./identity-kubernetes-auth-router";
 import { registerIdentityRouter } from "./identity-router";
-import { registerIdentityTokenAuthRouter } from "./identity-token-auth-router";
 import { registerIdentityUaRouter } from "./identity-universal-auth-router";
 import { registerIntegrationAuthRouter } from "./integration-auth-router";
 import { registerIntegrationRouter } from "./integration-router";
@@ -34,7 +33,6 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(
     async (authRouter) => {
       await authRouter.register(registerAuthRoutes);
-      await authRouter.register(registerIdentityTokenAuthRouter);
       await authRouter.register(registerIdentityUaRouter);
       await authRouter.register(registerIdentityKubernetesRouter);
       await authRouter.register(registerIdentityGcpAuthRouter);

backend/src/services/auth/auth-login-service.ts

@@ -17,6 +17,7 @@ import { TAuthTokenServiceFactory } from "../auth-token/auth-token-service";
 import { TokenType } from "../auth-token/auth-token-types";
 import { TOrgDALFactory } from "../org/org-dal";
 import { SmtpTemplates, TSmtpService } from "../smtp/smtp-service";
+import { LoginMethod } from "../super-admin/super-admin-types";
 import { TUserDALFactory } from "../user/user-dal";
 import { enforceUserLockStatus, validateProviderAuthToken } from "./auth-fns";
 import {
@@ -158,9 +159,22 @@ export const authLoginServiceFactory = ({
     const userEnc = await userDAL.findUserEncKeyByUsername({
       username: email
     });
+    const serverCfg = await getServerCfg();
+
+    if (
+      serverCfg.enabledLoginMethods &&
+      !serverCfg.enabledLoginMethods.includes(LoginMethod.EMAIL) &&
+      !providerAuthToken
+    ) {
+      throw new BadRequestError({
+        message: "Login with email is disabled by administrator."
+      });
+    }
+
     if (!userEnc || (userEnc && !userEnc.isAccepted)) {
       throw new Error("Failed to find user");
     }
+
     if (!userEnc.authMethods?.includes(AuthMethod.EMAIL)) {
       validateProviderAuthToken(providerAuthToken as string, email);
     }
@@ -507,6 +521,40 @@ export const authLoginServiceFactory = ({
     let user = await userDAL.findUserByUsername(email);
     const serverCfg = await getServerCfg();
 
+    if (serverCfg.enabledLoginMethods) {
+      switch (authMethod) {
+        case AuthMethod.GITHUB: {
+          if (!serverCfg.enabledLoginMethods.includes(LoginMethod.GITHUB)) {
+            throw new BadRequestError({
+              message: "Login with Github is disabled by administrator.",
+              name: "Oauth 2 login"
+            });
+          }
+          break;
+        }
+        case AuthMethod.GOOGLE: {
+          if (!serverCfg.enabledLoginMethods.includes(LoginMethod.GOOGLE)) {
+            throw new BadRequestError({
+              message: "Login with Google is disabled by administrator.",
+              name: "Oauth 2 login"
+            });
+          }
+          break;
+        }
+        case AuthMethod.GITLAB: {
+          if (!serverCfg.enabledLoginMethods.includes(LoginMethod.GITLAB)) {
+            throw new BadRequestError({
+              message: "Login with Gitlab is disabled by administrator.",
+              name: "Oauth 2 login"
+            });
+          }
+          break;
+        }
+        default:
+          break;
+      }
+    }
+
     const appCfg = getConfig();
 
     if (!user) {

backend/src/services/identity-access-token/identity-access-token-service.ts

@@ -1,9 +1,6 @@
-import { ForbiddenError } from "@casl/ability";
 import jwt, { JwtPayload } from "jsonwebtoken";
 
 import { TableName, TIdentityAccessTokens } from "@app/db/schemas";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
@@ -11,24 +8,18 @@ import { checkIPAgainstBlocklist, TIp } from "@app/lib/ip";
 import { AuthTokenType } from "../auth/auth-type";
 import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
 import { TIdentityAccessTokenDALFactory } from "./identity-access-token-dal";
-import {
-  TIdentityAccessTokenJwtPayload,
-  TRenewAccessTokenDTO,
-  TRevokeAccessTokenByIdDTO
-} from "./identity-access-token-types";
+import { TIdentityAccessTokenJwtPayload, TRenewAccessTokenDTO } from "./identity-access-token-types";
 
 type TIdentityAccessTokenServiceFactoryDep = {
   identityAccessTokenDAL: TIdentityAccessTokenDALFactory;
   identityOrgMembershipDAL: TIdentityOrgDALFactory;
-  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
 };
 
 export type TIdentityAccessTokenServiceFactory = ReturnType<typeof identityAccessTokenServiceFactory>;
 
 export const identityAccessTokenServiceFactory = ({
   identityAccessTokenDAL,
-  identityOrgMembershipDAL,
-  permissionService
+  identityOrgMembershipDAL
 }: TIdentityAccessTokenServiceFactoryDep) => {
   const validateAccessTokenExp = async (identityAccessToken: TIdentityAccessTokens) => {
     const {
@@ -140,47 +131,7 @@ export const identityAccessTokenServiceFactory = ({
     });
     if (!identityAccessToken) throw new UnauthorizedError();
 
-    const revokedToken = await identityAccessTokenDAL.updateById(identityAccessToken.id, {
-      isAccessTokenRevoked: true
-    });
-
-    return { revokedToken };
-  };
-
-  const revokeAccessTokenById = async ({
-    tokenId,
-    actorId,
-    actor,
-    actorAuthMethod,
-    actorOrgId
-  }: TRevokeAccessTokenByIdDTO) => {
-    const identityAccessToken = await identityAccessTokenDAL.findOne({
-      [`${TableName.IdentityAccessToken}.id` as "id"]: tokenId,
-      isAccessTokenRevoked: false
-    });
-    if (!identityAccessToken) throw new UnauthorizedError();
-
-    const identityOrgMembership = await identityOrgMembershipDAL.findOne({
-      identityId: identityAccessToken.identityId
-    });
-
-    if (!identityOrgMembership) {
-      throw new UnauthorizedError({ message: "Identity does not belong to any organization" });
-    }
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityOrgMembership.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const revokedToken = await identityAccessTokenDAL.updateById(identityAccessToken.id, {
-      isAccessTokenRevoked: true
-    });
-
+    const revokedToken = await identityAccessTokenDAL.deleteById(identityAccessToken.id);
     return { revokedToken };
   };
 
@@ -190,10 +141,6 @@ export const identityAccessTokenServiceFactory = ({
       isAccessTokenRevoked: false
     });
     if (!identityAccessToken) throw new UnauthorizedError();
-    if (identityAccessToken.isAccessTokenRevoked)
-      throw new UnauthorizedError({
-        message: "Failed to authorize revoked access token"
-      });
 
     if (ipAddress && identityAccessToken) {
       checkIPAgainstBlocklist({
@@ -221,5 +168,5 @@ export const identityAccessTokenServiceFactory = ({
     return { ...identityAccessToken, orgId: identityOrgMembership.orgId };
   };
 
-  return { renewAccessToken, revokeAccessToken, revokeAccessTokenById, fnValidateIdentityAccessToken };
+  return { renewAccessToken, revokeAccessToken, fnValidateIdentityAccessToken };
 };

backend/src/services/identity-access-token/identity-access-token-types.ts

@@ -1,5 +1,3 @@
-import { TProjectPermission } from "@app/lib/types";
-
 export type TRenewAccessTokenDTO = {
   accessToken: string;
 };
@@ -10,7 +8,3 @@ export type TIdentityAccessTokenJwtPayload = {
   identityAccessTokenId: string;
   authTokenType: string;
 };
-
-export type TRevokeAccessTokenByIdDTO = {
-  tokenId: string;
-} & Omit<TProjectPermission, "projectId">;

backend/src/services/identity-project/identity-project-dal.ts

@@ -10,103 +10,6 @@ export type TIdentityProjectDALFactory = ReturnType<typeof identityProjectDALFac
 export const identityProjectDALFactory = (db: TDbClient) => {
   const identityProjectOrm = ormify(db, TableName.IdentityProjectMembership);
 
-  const findByIdentityId = async (identityId: string, tx?: Knex) => {
-    try {
-      const docs = await (tx || db.replicaNode())(TableName.IdentityProjectMembership)
-        .where(`${TableName.IdentityProjectMembership}.identityId`, identityId)
-        .join(TableName.Project, `${TableName.IdentityProjectMembership}.projectId`, `${TableName.Project}.id`)
-        .join(TableName.Identity, `${TableName.IdentityProjectMembership}.identityId`, `${TableName.Identity}.id`)
-        .join(
-          TableName.IdentityProjectMembershipRole,
-          `${TableName.IdentityProjectMembershipRole}.projectMembershipId`,
-          `${TableName.IdentityProjectMembership}.id`
-        )
-        .leftJoin(
-          TableName.ProjectRoles,
-          `${TableName.IdentityProjectMembershipRole}.customRoleId`,
-          `${TableName.ProjectRoles}.id`
-        )
-        .leftJoin(
-          TableName.IdentityProjectAdditionalPrivilege,
-          `${TableName.IdentityProjectMembership}.id`,
-          `${TableName.IdentityProjectAdditionalPrivilege}.projectMembershipId`
-        )
-        .select(
-          db.ref("id").withSchema(TableName.IdentityProjectMembership),
-          db.ref("createdAt").withSchema(TableName.IdentityProjectMembership),
-          db.ref("updatedAt").withSchema(TableName.IdentityProjectMembership),
-          db.ref("authMethod").as("identityAuthMethod").withSchema(TableName.Identity),
-          db.ref("id").as("identityId").withSchema(TableName.Identity),
-          db.ref("name").as("identityName").withSchema(TableName.Identity),
-          db.ref("id").withSchema(TableName.IdentityProjectMembership),
-          db.ref("role").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("id").withSchema(TableName.IdentityProjectMembershipRole).as("membershipRoleId"),
-          db.ref("customRoleId").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("name").withSchema(TableName.ProjectRoles).as("customRoleName"),
-          db.ref("slug").withSchema(TableName.ProjectRoles).as("customRoleSlug"),
-          db.ref("temporaryMode").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("isTemporary").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("temporaryRange").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("temporaryAccessStartTime").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("temporaryAccessEndTime").withSchema(TableName.IdentityProjectMembershipRole),
-          db.ref("projectId").withSchema(TableName.IdentityProjectMembership),
-          db.ref("name").as("projectName").withSchema(TableName.Project)
-        );
-
-      const members = sqlNestRelationships({
-        data: docs,
-        parentMapper: ({ identityName, identityAuthMethod, id, createdAt, updatedAt, projectId, projectName }) => ({
-          id,
-          identityId,
-          createdAt,
-          updatedAt,
-          identity: {
-            id: identityId,
-            name: identityName,
-            authMethod: identityAuthMethod
-          },
-          project: {
-            id: projectId,
-            name: projectName
-          }
-        }),
-        key: "id",
-        childrenMapper: [
-          {
-            label: "roles" as const,
-            key: "membershipRoleId",
-            mapper: ({
-              role,
-              customRoleId,
-              customRoleName,
-              customRoleSlug,
-              membershipRoleId,
-              temporaryRange,
-              temporaryMode,
-              temporaryAccessEndTime,
-              temporaryAccessStartTime,
-              isTemporary
-            }) => ({
-              id: membershipRoleId,
-              role,
-              customRoleId,
-              customRoleName,
-              customRoleSlug,
-              temporaryRange,
-              temporaryMode,
-              temporaryAccessEndTime,
-              temporaryAccessStartTime,
-              isTemporary
-            })
-          }
-        ]
-      });
-      return members;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "FindByIdentityId" });
-    }
-  };
-
   const findByProjectId = async (projectId: string, filter: { identityId?: string } = {}, tx?: Knex) => {
     try {
       const docs = await (tx || db.replicaNode())(TableName.IdentityProjectMembership)
@@ -202,9 +105,5 @@ export const identityProjectDALFactory = (db: TDbClient) => {
     }
   };
 
-  return {
-    ...identityProjectOrm,
-    findByIdentityId,
-    findByProjectId
-  };
+  return { ...identityProjectOrm, findByProjectId };
 };

backend/src/services/identity-token-auth/identity-token-auth-dal.ts

@@ -1,10 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TIdentityTokenAuthDALFactory = ReturnType<typeof identityTokenAuthDALFactory>;
-
-export const identityTokenAuthDALFactory = (db: TDbClient) => {
-  const tokenAuthOrm = ormify(db, TableName.IdentityTokenAuth);
-  return tokenAuthOrm;
-};

backend/src/services/identity-token-auth/identity-token-auth-service.ts

@@ -1,437 +0,0 @@
-import { ForbiddenError } from "@casl/ability";
-import jwt from "jsonwebtoken";
-
-import { IdentityAuthMethod } from "@app/db/schemas";
-import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
-import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { isAtLeastAsPrivileged } from "@app/lib/casl";
-import { getConfig } from "@app/lib/config/env";
-import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
-import { extractIPDetails, isValidIpOrCidr } from "@app/lib/ip";
-
-import { ActorType, AuthTokenType } from "../auth/auth-type";
-import { TIdentityDALFactory } from "../identity/identity-dal";
-import { TIdentityOrgDALFactory } from "../identity/identity-org-dal";
-import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
-import { TIdentityAccessTokenJwtPayload } from "../identity-access-token/identity-access-token-types";
-import { TIdentityTokenAuthDALFactory } from "./identity-token-auth-dal";
-import {
-  TAttachTokenAuthDTO,
-  TCreateTokenTokenAuthDTO,
-  TGetTokenAuthDTO,
-  TGetTokensTokenAuthDTO,
-  TRevokeTokenAuthDTO,
-  TUpdateTokenAuthDTO,
-  TUpdateTokenTokenAuthDTO
-} from "./identity-token-auth-types";
-
-type TIdentityTokenAuthServiceFactoryDep = {
-  identityTokenAuthDAL: Pick<
-    TIdentityTokenAuthDALFactory,
-    "transaction" | "create" | "findOne" | "updateById" | "delete"
-  >;
-  identityDAL: Pick<TIdentityDALFactory, "updateById">;
-  identityOrgMembershipDAL: Pick<TIdentityOrgDALFactory, "findOne">;
-  identityAccessTokenDAL: Pick<TIdentityAccessTokenDALFactory, "create" | "find" | "update">;
-  permissionService: Pick<TPermissionServiceFactory, "getOrgPermission">;
-  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
-};
-
-export type TIdentityTokenAuthServiceFactory = ReturnType<typeof identityTokenAuthServiceFactory>;
-
-export const identityTokenAuthServiceFactory = ({
-  identityTokenAuthDAL,
-  identityDAL,
-  identityOrgMembershipDAL,
-  identityAccessTokenDAL,
-  permissionService,
-  licenseService
-}: TIdentityTokenAuthServiceFactoryDep) => {
-  const attachTokenAuth = async ({
-    identityId,
-    accessTokenTTL,
-    accessTokenMaxTTL,
-    accessTokenNumUsesLimit,
-    accessTokenTrustedIps,
-    actorId,
-    actorAuthMethod,
-    actor,
-    actorOrgId
-  }: TAttachTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity.authMethod)
-      throw new BadRequestError({
-        message: "Failed to add Token Auth to already configured identity"
-      });
-
-    if (accessTokenMaxTTL > 0 && accessTokenTTL > accessTokenMaxTTL) {
-      throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
-    }
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Identity);
-
-    const plan = await licenseService.getPlan(identityMembershipOrg.orgId);
-    const reformattedAccessTokenTrustedIps = accessTokenTrustedIps.map((accessTokenTrustedIp) => {
-      if (
-        !plan.ipAllowlisting &&
-        accessTokenTrustedIp.ipAddress !== "0.0.0.0/0" &&
-        accessTokenTrustedIp.ipAddress !== "::/0"
-      )
-        throw new BadRequestError({
-          message:
-            "Failed to add IP access range to access token due to plan restriction. Upgrade plan to add IP access range."
-        });
-      if (!isValidIpOrCidr(accessTokenTrustedIp.ipAddress))
-        throw new BadRequestError({
-          message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-      return extractIPDetails(accessTokenTrustedIp.ipAddress);
-    });
-
-    const identityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => {
-      const doc = await identityTokenAuthDAL.create(
-        {
-          identityId: identityMembershipOrg.identityId,
-          accessTokenMaxTTL,
-          accessTokenTTL,
-          accessTokenNumUsesLimit,
-          accessTokenTrustedIps: JSON.stringify(reformattedAccessTokenTrustedIps)
-        },
-        tx
-      );
-      await identityDAL.updateById(
-        identityMembershipOrg.identityId,
-        {
-          authMethod: IdentityAuthMethod.TOKEN_AUTH
-        },
-        tx
-      );
-      return doc;
-    });
-    return { ...identityTokenAuth, orgId: identityMembershipOrg.orgId };
-  };
-
-  const updateTokenAuth = async ({
-    identityId,
-    accessTokenTTL,
-    accessTokenMaxTTL,
-    accessTokenNumUsesLimit,
-    accessTokenTrustedIps,
-    actorId,
-    actorAuthMethod,
-    actor,
-    actorOrgId
-  }: TUpdateTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "Failed to update Token Auth"
-      });
-
-    const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
-
-    if (
-      (accessTokenMaxTTL || identityTokenAuth.accessTokenMaxTTL) > 0 &&
-      (accessTokenTTL || identityTokenAuth.accessTokenMaxTTL) >
-        (accessTokenMaxTTL || identityTokenAuth.accessTokenMaxTTL)
-    ) {
-      throw new BadRequestError({ message: "Access token TTL cannot be greater than max TTL" });
-    }
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const plan = await licenseService.getPlan(identityMembershipOrg.orgId);
-    const reformattedAccessTokenTrustedIps = accessTokenTrustedIps?.map((accessTokenTrustedIp) => {
-      if (
-        !plan.ipAllowlisting &&
-        accessTokenTrustedIp.ipAddress !== "0.0.0.0/0" &&
-        accessTokenTrustedIp.ipAddress !== "::/0"
-      )
-        throw new BadRequestError({
-          message:
-            "Failed to add IP access range to access token due to plan restriction. Upgrade plan to add IP access range."
-        });
-      if (!isValidIpOrCidr(accessTokenTrustedIp.ipAddress))
-        throw new BadRequestError({
-          message: "The IP is not a valid IPv4, IPv6, or CIDR block"
-        });
-      return extractIPDetails(accessTokenTrustedIp.ipAddress);
-    });
-
-    const updatedTokenAuth = await identityTokenAuthDAL.updateById(identityTokenAuth.id, {
-      accessTokenMaxTTL,
-      accessTokenTTL,
-      accessTokenNumUsesLimit,
-      accessTokenTrustedIps: reformattedAccessTokenTrustedIps
-        ? JSON.stringify(reformattedAccessTokenTrustedIps)
-        : undefined
-    });
-
-    return {
-      ...updatedTokenAuth,
-      orgId: identityMembershipOrg.orgId
-    };
-  };
-
-  const getTokenAuth = async ({ identityId, actorId, actor, actorAuthMethod, actorOrgId }: TGetTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "The identity does not have Token Auth attached"
-      });
-
-    const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Identity);
-
-    return { ...identityTokenAuth, orgId: identityMembershipOrg.orgId };
-  };
-
-  const revokeIdentityTokenAuth = async ({
-    identityId,
-    actorId,
-    actor,
-    actorAuthMethod,
-    actorOrgId
-  }: TRevokeTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "The identity does not have Token Auth"
-      });
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const { permission: rolePermission } = await permissionService.getOrgPermission(
-      ActorType.IDENTITY,
-      identityMembershipOrg.identityId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
-      throw new ForbiddenRequestError({
-        message: "Failed to revoke Token Auth of identity with more privileged role"
-      });
-
-    const revokedIdentityTokenAuth = await identityTokenAuthDAL.transaction(async (tx) => {
-      const deletedTokenAuth = await identityTokenAuthDAL.delete({ identityId }, tx);
-      await identityDAL.updateById(identityId, { authMethod: null }, tx);
-      return { ...deletedTokenAuth?.[0], orgId: identityMembershipOrg.orgId };
-    });
-    return revokedIdentityTokenAuth;
-  };
-
-  const createTokenTokenAuth = async ({
-    identityId,
-    actorId,
-    actor,
-    actorAuthMethod,
-    actorOrgId,
-    name
-  }: TCreateTokenTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "The identity does not have Token Auth"
-      });
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const { permission: rolePermission } = await permissionService.getOrgPermission(
-      ActorType.IDENTITY,
-      identityMembershipOrg.identityId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
-      throw new ForbiddenRequestError({
-        message: "Failed to create token for identity with more privileged role"
-      });
-
-    const identityTokenAuth = await identityTokenAuthDAL.findOne({ identityId });
-
-    const identityAccessToken = await identityTokenAuthDAL.transaction(async (tx) => {
-      const newToken = await identityAccessTokenDAL.create(
-        {
-          identityId: identityTokenAuth.identityId,
-          isAccessTokenRevoked: false,
-          accessTokenTTL: identityTokenAuth.accessTokenTTL,
-          accessTokenMaxTTL: identityTokenAuth.accessTokenMaxTTL,
-          accessTokenNumUses: 0,
-          accessTokenNumUsesLimit: identityTokenAuth.accessTokenNumUsesLimit,
-          name
-        },
-        tx
-      );
-      return newToken;
-    });
-
-    const appCfg = getConfig();
-    const accessToken = jwt.sign(
-      {
-        identityId: identityTokenAuth.identityId,
-        identityAccessTokenId: identityAccessToken.id,
-        authTokenType: AuthTokenType.IDENTITY_ACCESS_TOKEN
-      } as TIdentityAccessTokenJwtPayload,
-      appCfg.AUTH_SECRET,
-      {
-        expiresIn:
-          Number(identityAccessToken.accessTokenMaxTTL) === 0
-            ? undefined
-            : Number(identityAccessToken.accessTokenMaxTTL)
-      }
-    );
-
-    return { accessToken, identityTokenAuth, identityAccessToken, identityMembershipOrg };
-  };
-
-  const getTokensTokenAuth = async ({
-    identityId,
-    offset = 0,
-    limit = 20,
-    actorId,
-    actor,
-    actorAuthMethod,
-    actorOrgId
-  }: TGetTokensTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "The identity does not have Token Auth"
-      });
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const { permission: rolePermission } = await permissionService.getOrgPermission(
-      ActorType.IDENTITY,
-      identityMembershipOrg.identityId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
-      throw new ForbiddenRequestError({
-        message: "Failed to get tokens for identity with more privileged role"
-      });
-
-    const tokens = await identityAccessTokenDAL.find(
-      {
-        identityId
-      },
-      { offset, limit, sort: [["updatedAt", "desc"]] }
-    );
-
-    return { tokens, identityMembershipOrg };
-  };
-
-  const updateTokenTokenAuth = async ({
-    identityId,
-    tokenId,
-    name,
-    actorId,
-    actor,
-    actorAuthMethod,
-    actorOrgId
-  }: TUpdateTokenTokenAuthDTO) => {
-    const identityMembershipOrg = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityMembershipOrg) throw new BadRequestError({ message: "Failed to find identity" });
-    if (identityMembershipOrg.identity?.authMethod !== IdentityAuthMethod.TOKEN_AUTH)
-      throw new BadRequestError({
-        message: "The identity does not have Token Auth"
-      });
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Identity);
-
-    const { permission: rolePermission } = await permissionService.getOrgPermission(
-      ActorType.IDENTITY,
-      identityMembershipOrg.identityId,
-      identityMembershipOrg.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    const hasPriviledge = isAtLeastAsPrivileged(permission, rolePermission);
-    if (!hasPriviledge)
-      throw new ForbiddenRequestError({
-        message: "Failed to update token for identity with more privileged role"
-      });
-
-    const [token] = await identityAccessTokenDAL.update(
-      {
-        identityId,
-        id: tokenId
-      },
-      {
-        name
-      }
-    );
-
-    return { token, identityMembershipOrg };
-  };
-
-  return {
-    attachTokenAuth,
-    updateTokenAuth,
-    getTokenAuth,
-    revokeIdentityTokenAuth,
-    createTokenTokenAuth,
-    getTokensTokenAuth,
-    updateTokenTokenAuth
-  };
-};

backend/src/services/identity-token-auth/identity-token-auth-types.ts

@@ -1,42 +0,0 @@
-import { TProjectPermission } from "@app/lib/types";
-
-export type TAttachTokenAuthDTO = {
-  identityId: string;
-  accessTokenTTL: number;
-  accessTokenMaxTTL: number;
-  accessTokenNumUsesLimit: number;
-  accessTokenTrustedIps: { ipAddress: string }[];
-} & Omit<TProjectPermission, "projectId">;
-
-export type TUpdateTokenAuthDTO = {
-  identityId: string;
-  accessTokenTTL?: number;
-  accessTokenMaxTTL?: number;
-  accessTokenNumUsesLimit?: number;
-  accessTokenTrustedIps?: { ipAddress: string }[];
-} & Omit<TProjectPermission, "projectId">;
-
-export type TGetTokenAuthDTO = {
-  identityId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TRevokeTokenAuthDTO = {
-  identityId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TCreateTokenTokenAuthDTO = {
-  identityId: string;
-  name?: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TGetTokensTokenAuthDTO = {
-  identityId: string;
-  offset: number;
-  limit: number;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TUpdateTokenTokenAuthDTO = {
-  identityId: string;
-  tokenId: string;
-  name?: string;
-} & Omit<TProjectPermission, "projectId">;

backend/src/services/identity/identity-service.ts

@@ -7,23 +7,15 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { BadRequestError, ForbiddenRequestError } from "@app/lib/errors";
 import { TOrgPermission } from "@app/lib/types";
-import { TIdentityProjectDALFactory } from "@app/services/identity-project/identity-project-dal";
 
 import { ActorType } from "../auth/auth-type";
 import { TIdentityDALFactory } from "./identity-dal";
 import { TIdentityOrgDALFactory } from "./identity-org-dal";
-import {
-  TCreateIdentityDTO,
-  TDeleteIdentityDTO,
-  TGetIdentityByIdDTO,
-  TListProjectIdentitiesByIdentityIdDTO,
-  TUpdateIdentityDTO
-} from "./identity-types";
+import { TCreateIdentityDTO, TDeleteIdentityDTO, TGetIdentityByIdDTO, TUpdateIdentityDTO } from "./identity-types";
 
 type TIdentityServiceFactoryDep = {
   identityDAL: TIdentityDALFactory;
   identityOrgMembershipDAL: TIdentityOrgDALFactory;
-  identityProjectDAL: Pick<TIdentityProjectDALFactory, "findByIdentityId">;
   permissionService: Pick<TPermissionServiceFactory, "getOrgPermission" | "getOrgPermissionByRole">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan" | "updateSubscriptionOrgMemberCount">;
 };
@@ -33,7 +25,6 @@ export type TIdentityServiceFactory = ReturnType<typeof identityServiceFactory>;
 export const identityServiceFactory = ({
   identityDAL,
   identityOrgMembershipDAL,
-  identityProjectDAL,
   permissionService,
   licenseService
 }: TIdentityServiceFactoryDep) => {
@@ -205,35 +196,11 @@ export const identityServiceFactory = ({
     return identityMemberships;
   };
 
-  const listProjectIdentitiesByIdentityId = async ({
-    identityId,
-    actor,
-    actorId,
-    actorAuthMethod,
-    actorOrgId
-  }: TListProjectIdentitiesByIdentityIdDTO) => {
-    const identityOrgMembership = await identityOrgMembershipDAL.findOne({ identityId });
-    if (!identityOrgMembership) throw new BadRequestError({ message: `Failed to find identity with id ${identityId}` });
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor,
-      actorId,
-      identityOrgMembership.orgId,
-      actorAuthMethod,
-      actorOrgId
-    );
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Identity);
-
-    const identityMemberships = await identityProjectDAL.findByIdentityId(identityId);
-    return identityMemberships;
-  };
-
   return {
     createIdentity,
     updateIdentity,
     deleteIdentity,
     listOrgIdentities,
-    getIdentityById,
-    listProjectIdentitiesByIdentityId
+    getIdentityById
   };
 };

backend/src/services/identity/identity-types.ts

@@ -25,7 +25,3 @@ export interface TIdentityTrustedIp {
   type: IPType;
   prefix: number;
 }
-
-export type TListProjectIdentitiesByIdentityIdDTO = {
-  identityId: string;
-} & Omit<TOrgPermission, "orgId">;

backend/src/services/super-admin/super-admin-service.ts

@@ -12,7 +12,7 @@ import { AuthMethod } from "../auth/auth-type";
 import { TOrgServiceFactory } from "../org/org-service";
 import { TUserDALFactory } from "../user/user-dal";
 import { TSuperAdminDALFactory } from "./super-admin-dal";
-import { TAdminSignUpDTO } from "./super-admin-types";
+import { LoginMethod, TAdminSignUpDTO } from "./super-admin-types";
 
 type TSuperAdminServiceFactoryDep = {
   serverCfgDAL: TSuperAdminDALFactory;
@@ -79,7 +79,37 @@ export const superAdminServiceFactory = ({
     return newCfg;
   };
 
-  const updateServerCfg = async (data: TSuperAdminUpdate) => {
+  const updateServerCfg = async (data: TSuperAdminUpdate, userId: string) => {
+    if (data.enabledLoginMethods) {
+      const superAdminUser = await userDAL.findById(userId);
+      const loginMethodToAuthMethod = {
+        [LoginMethod.EMAIL]: [AuthMethod.EMAIL],
+        [LoginMethod.GOOGLE]: [AuthMethod.GOOGLE],
+        [LoginMethod.GITLAB]: [AuthMethod.GITLAB],
+        [LoginMethod.GITHUB]: [AuthMethod.GITHUB],
+        [LoginMethod.LDAP]: [AuthMethod.LDAP],
+        [LoginMethod.OIDC]: [AuthMethod.OIDC],
+        [LoginMethod.SAML]: [
+          AuthMethod.AZURE_SAML,
+          AuthMethod.GOOGLE_SAML,
+          AuthMethod.JUMPCLOUD_SAML,
+          AuthMethod.KEYCLOAK_SAML,
+          AuthMethod.OKTA_SAML
+        ]
+      };
+
+      if (
+        !data.enabledLoginMethods.some((loginMethod) =>
+          loginMethodToAuthMethod[loginMethod as LoginMethod].some(
+            (authMethod) => superAdminUser.authMethods?.includes(authMethod)
+          )
+        )
+      ) {
+        throw new BadRequestError({
+          message: "You must configure at least one auth method to prevent account lockout"
+        });
+      }
+    }
     const updatedServerCfg = await serverCfgDAL.updateById(ADMIN_CONFIG_DB_UUID, data);
 
     await keyStore.setItemWithExpiry(ADMIN_CONFIG_KEY, ADMIN_CONFIG_KEY_EXP, JSON.stringify(updatedServerCfg));
@@ -167,7 +197,7 @@ export const superAdminServiceFactory = ({
       orgName: initialOrganizationName
     });
 
-    await updateServerCfg({ initialized: true });
+    await updateServerCfg({ initialized: true }, userInfo.user.id);
     const token = await authService.generateUserTokens({
       user: userInfo.user,
       authMethod: AuthMethod.EMAIL,

backend/src/services/super-admin/super-admin-types.ts

@@ -15,3 +15,13 @@ export type TAdminSignUpDTO = {
   ip: string;
   userAgent: string;
 };
+
+export enum LoginMethod {
+  EMAIL = "email",
+  GOOGLE = "google",
+  GITHUB = "github",
+  GITLAB = "gitlab",
+  SAML = "saml",
+  LDAP = "ldap",
+  OIDC = "oidc"
+}

frontend/src/components/signup/InitialSignupStep.tsx

@@ -4,6 +4,9 @@ import { faGithub, faGitlab, faGoogle } from "@fortawesome/free-brands-svg-icons
 import { faEnvelope } from "@fortawesome/free-regular-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 
+import { useServerConfig } from "@app/context";
+import { LoginMethod } from "@app/hooks/api/admin/types";
+
 import { Button } from "../v2";
 
 export default function InitialSignupStep({
@@ -12,67 +15,79 @@ export default function InitialSignupStep({
   setIsSignupWithEmail: (value: boolean) => void;
 }) {
   const { t } = useTranslation();
+  const { config } = useServerConfig();
+
+  const shouldDisplaySignupMethod = (method: LoginMethod) =>
+    !config.enabledLoginMethods || config.enabledLoginMethods.includes(method);
 
   return (
     <div className="mx-auto flex w-full flex-col items-center justify-center">
       <h1 className="mb-8 bg-gradient-to-b from-white to-bunker-200 bg-clip-text text-center text-xl font-medium text-transparent">
         {t("signup.initial-title")}
       </h1>
-      <div className="w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="solid"
-          onClick={() => {
-            window.open("/api/v1/sso/redirect/google");
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-2" />}
-          className="mx-0 h-12 w-full"
-        >
-          {t("signup.continue-with-google")}
-        </Button>
-      </div>
-      <div className="mt-4 w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            window.open("/api/v1/sso/redirect/github");
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGithub} className="mr-2" />}
-          className="mx-0 h-12 w-full"
-        >
-          Continue with GitHub
-        </Button>
-      </div>
-      <div className="mt-4 w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            window.open("/api/v1/sso/redirect/gitlab");
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGitlab} className="mr-2" />}
-          className="mx-0 h-12 w-full"
-        >
-          Continue with GitLab
-        </Button>
-      </div>
-      <div className="mt-4 w-1/4 min-w-[20rem] rounded-md text-center lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            setIsSignupWithEmail(true);
-          }}
-          leftIcon={<FontAwesomeIcon icon={faEnvelope} className="mr-2" />}
-          className="mx-0 h-12 w-full"
-        >
-          Continue with Email
-        </Button>
-      </div>
+      {shouldDisplaySignupMethod(LoginMethod.GOOGLE) && (
+        <div className="w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="solid"
+            onClick={() => {
+              window.open("/api/v1/sso/redirect/google");
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-2" />}
+            className="mx-0 h-12 w-full"
+          >
+            {t("signup.continue-with-google")}
+          </Button>
+        </div>
+      )}
+      {shouldDisplaySignupMethod(LoginMethod.GITHUB) && (
+        <div className="mt-4 w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              window.open("/api/v1/sso/redirect/github");
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGithub} className="mr-2" />}
+            className="mx-0 h-12 w-full"
+          >
+            Continue with GitHub
+          </Button>
+        </div>
+      )}
+      {shouldDisplaySignupMethod(LoginMethod.GITLAB) && (
+        <div className="mt-4 w-1/4 min-w-[20rem] rounded-md lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              window.open("/api/v1/sso/redirect/gitlab");
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGitlab} className="mr-2" />}
+            className="mx-0 h-12 w-full"
+          >
+            Continue with GitLab
+          </Button>
+        </div>
+      )}
+      {shouldDisplaySignupMethod(LoginMethod.EMAIL) && (
+        <div className="mt-4 w-1/4 min-w-[20rem] rounded-md text-center lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              setIsSignupWithEmail(true);
+            }}
+            leftIcon={<FontAwesomeIcon icon={faEnvelope} className="mr-2" />}
+            className="mx-0 h-12 w-full"
+          >
+            Continue with Email
+          </Button>
+        </div>
+      )}
       <div className="mt-6 w-1/4 min-w-[20rem] px-8 text-center text-xs text-bunker-400 lg:w-1/6">
         {t("signup.create-policy")}
       </div>

frontend/src/hooks/api/admin/types.ts

@@ -1,3 +1,13 @@
+export enum LoginMethod {
+  EMAIL = "email",
+  GOOGLE = "google",
+  GITHUB = "github",
+  GITLAB = "gitlab",
+  SAML = "saml",
+  LDAP = "ldap",
+  OIDC = "oidc"
+}
+
 export type TServerConfig = {
   initialized: boolean;
   allowSignUp: boolean;
@@ -9,6 +19,7 @@ export type TServerConfig = {
   isSecretScanningDisabled: boolean;
   defaultAuthOrgSlug: string | null;
   defaultAuthOrgId: string | null;
+  enabledLoginMethods: LoginMethod[];
 };
 
 export type TCreateAdminUserDTO = {

frontend/src/hooks/api/identities/constants.tsx

@@ -1,7 +1,6 @@
 import { IdentityAuthMethod } from "./enums";
 
 export const identityAuthToNameMap: { [I in IdentityAuthMethod]: string } = {
-  [IdentityAuthMethod.TOKEN_AUTH]: "Token Auth",
   [IdentityAuthMethod.UNIVERSAL_AUTH]: "Universal Auth",
   [IdentityAuthMethod.KUBERNETES_AUTH]: "Kubernetes Auth",
   [IdentityAuthMethod.GCP_AUTH]: "GCP Auth",

frontend/src/hooks/api/identities/enums.tsx

@@ -1,5 +1,4 @@
 export enum IdentityAuthMethod {
-  TOKEN_AUTH = "token-auth",
   UNIVERSAL_AUTH = "universal-auth",
   KUBERNETES_AUTH = "kubernetes-auth",
   GCP_AUTH = "gcp-auth",

frontend/src/hooks/api/identities/index.tsx

@@ -5,36 +5,23 @@ export {
   useAddIdentityAzureAuth,
   useAddIdentityGcpAuth,
   useAddIdentityKubernetesAuth,
-  useAddIdentityTokenAuth,
   useAddIdentityUniversalAuth,
   useCreateIdentity,
   useCreateIdentityUniversalAuthClientSecret,
-  useCreateTokenIdentityTokenAuth,
   useDeleteIdentity,
-  useDeleteIdentityAwsAuth,
-  useDeleteIdentityAzureAuth,
-  useDeleteIdentityGcpAuth,
-  useDeleteIdentityKubernetesAuth,
-  useDeleteIdentityTokenAuth,
-  useDeleteIdentityUniversalAuth,
   useRevokeIdentityUniversalAuthClientSecret,
-  useRevokeToken,
   useUpdateIdentity,
   useUpdateIdentityAwsAuth,
   useUpdateIdentityAzureAuth,
   useUpdateIdentityGcpAuth,
   useUpdateIdentityKubernetesAuth,
-  useUpdateIdentityTokenAuth,
-  useUpdateIdentityUniversalAuth,
-  useUpdateTokenIdentityTokenAuth} from "./mutations";
+  useUpdateIdentityUniversalAuth
+} from "./mutations";
 export {
   useGetIdentityAwsAuth,
   useGetIdentityAzureAuth,
-  useGetIdentityById,
   useGetIdentityGcpAuth,
   useGetIdentityKubernetesAuth,
-  useGetIdentityProjectMemberships,
-  useGetIdentityTokenAuth,
-  useGetIdentityTokensTokenAuth,
   useGetIdentityUniversalAuth,
-  useGetIdentityUniversalAuthClientSecrets} from "./queries";
+  useGetIdentityUniversalAuthClientSecrets
+} from "./queries";

frontend/src/hooks/api/identities/mutations.tsx

@@ -9,40 +9,26 @@ import {
   AddIdentityAzureAuthDTO,
   AddIdentityGcpAuthDTO,
   AddIdentityKubernetesAuthDTO,
-  AddIdentityTokenAuthDTO,
   AddIdentityUniversalAuthDTO,
   ClientSecretData,
   CreateIdentityDTO,
   CreateIdentityUniversalAuthClientSecretDTO,
   CreateIdentityUniversalAuthClientSecretRes,
-  CreateTokenIdentityTokenAuthDTO,
-  CreateTokenIdentityTokenAuthRes,
-  DeleteIdentityAwsAuthDTO,
-  DeleteIdentityAzureAuthDTO,
   DeleteIdentityDTO,
-  DeleteIdentityGcpAuthDTO,
-  DeleteIdentityKubernetesAuthDTO,
-  DeleteIdentityTokenAuthDTO,
   DeleteIdentityUniversalAuthClientSecretDTO,
-  DeleteIdentityUniversalAuthDTO,
   Identity,
-  IdentityAccessToken,
   IdentityAwsAuth,
   IdentityAzureAuth,
   IdentityGcpAuth,
   IdentityKubernetesAuth,
-  IdentityTokenAuth,
   IdentityUniversalAuth,
-  RevokeTokenDTO,
-  RevokeTokenRes,
   UpdateIdentityAwsAuthDTO,
   UpdateIdentityAzureAuthDTO,
   UpdateIdentityDTO,
   UpdateIdentityGcpAuthDTO,
   UpdateIdentityKubernetesAuthDTO,
-  UpdateIdentityTokenAuthDTO,
-  UpdateIdentityUniversalAuthDTO,
-  UpdateTokenIdentityTokenAuthDTO} from "./types";
+  UpdateIdentityUniversalAuthDTO
+} from "./types";
 
 export const useCreateIdentity = () => {
   const queryClient = useQueryClient();
@@ -72,9 +58,8 @@ export const useUpdateIdentity = () => {
 
       return identity;
     },
-    onSuccess: (_, { organizationId, identityId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
     }
   });
 };
@@ -118,10 +103,8 @@ export const useAddIdentityUniversalAuth = () => {
       });
       return identityUniversalAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityUniversalAuth(identityId));
     }
   });
 };
@@ -148,27 +131,8 @@ export const useUpdateIdentityUniversalAuth = () => {
       });
       return identityUniversalAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityUniversalAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityUniversalAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityUniversalAuth, {}, DeleteIdentityUniversalAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityUniversalAuth }
-      } = await apiRequest.delete(`/api/v1/auth/universal-auth/identities/${identityId}`);
-      return identityUniversalAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityUniversalAuth(identityId));
     }
   });
 };
@@ -250,10 +214,8 @@ export const useAddIdentityGcpAuth = () => {
 
       return identityGcpAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityGcpAuth(identityId));
     }
   });
 };
@@ -290,27 +252,8 @@ export const useUpdateIdentityGcpAuth = () => {
 
       return identityGcpAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityGcpAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityGcpAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityGcpAuth, {}, DeleteIdentityGcpAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityGcpAuth }
-      } = await apiRequest.delete(`/api/v1/auth/gcp-auth/identities/${identityId}`);
-      return identityGcpAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityGcpAuth(identityId));
     }
   });
 };
@@ -345,10 +288,8 @@ export const useAddIdentityAwsAuth = () => {
 
       return identityAwsAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAwsAuth(identityId));
     }
   });
 };
@@ -383,27 +324,8 @@ export const useUpdateIdentityAwsAuth = () => {
 
       return identityAwsAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAwsAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityAwsAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityAwsAuth, {}, DeleteIdentityAwsAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityAwsAuth }
-      } = await apiRequest.delete(`/api/v1/auth/aws-auth/identities/${identityId}`);
-      return identityAwsAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAwsAuth(identityId));
     }
   });
 };
@@ -438,10 +360,8 @@ export const useAddIdentityAzureAuth = () => {
 
       return identityAzureAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityKubernetesAuth(identityId));
     }
   });
 };
@@ -482,10 +402,8 @@ export const useAddIdentityKubernetesAuth = () => {
 
       return identityKubernetesAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAzureAuth(identityId));
     }
   });
 };
@@ -520,27 +438,8 @@ export const useUpdateIdentityAzureAuth = () => {
 
       return identityAzureAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAzureAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityAzureAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityAzureAuth, {}, DeleteIdentityAzureAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityAzureAuth }
-      } = await apiRequest.delete(`/api/v1/auth/azure-auth/identities/${identityId}`);
-      return identityAzureAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityAzureAuth(identityId));
     }
   });
 };
@@ -581,164 +480,8 @@ export const useUpdateIdentityKubernetesAuth = () => {
 
       return identityKubernetesAuth;
     },
-    onSuccess: (_, { identityId, organizationId }) => {
+    onSuccess: (_, { organizationId }) => {
       queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityKubernetesAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityKubernetesAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityTokenAuth, {}, DeleteIdentityKubernetesAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityKubernetesAuth }
-      } = await apiRequest.delete(`/api/v1/auth/kubernetes-auth/identities/${identityId}`);
-      return identityKubernetesAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityKubernetesAuth(identityId));
-    }
-  });
-};
-
-export const useAddIdentityTokenAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityTokenAuth, {}, AddIdentityTokenAuthDTO>({
-    mutationFn: async ({
-      identityId,
-      accessTokenTTL,
-      accessTokenMaxTTL,
-      accessTokenNumUsesLimit,
-      accessTokenTrustedIps
-    }) => {
-      const {
-        data: { identityTokenAuth }
-      } = await apiRequest.post<{ identityTokenAuth: IdentityTokenAuth }>(
-        `/api/v1/auth/token-auth/identities/${identityId}`,
-        {
-          accessTokenTTL,
-          accessTokenMaxTTL,
-          accessTokenNumUsesLimit,
-          accessTokenTrustedIps
-        }
-      );
-
-      return identityTokenAuth;
-    },
-    onSuccess: (_, { identityId, organizationId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityUniversalAuth(identityId));
-    }
-  });
-};
-
-export const useUpdateIdentityTokenAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityTokenAuth, {}, UpdateIdentityTokenAuthDTO>({
-    mutationFn: async ({
-      identityId,
-      accessTokenTTL,
-      accessTokenMaxTTL,
-      accessTokenNumUsesLimit,
-      accessTokenTrustedIps
-    }) => {
-      const {
-        data: { identityTokenAuth }
-      } = await apiRequest.patch<{ identityTokenAuth: IdentityTokenAuth }>(
-        `/api/v1/auth/token-auth/identities/${identityId}`,
-        {
-          accessTokenTTL,
-          accessTokenMaxTTL,
-          accessTokenNumUsesLimit,
-          accessTokenTrustedIps
-        }
-      );
-
-      return identityTokenAuth;
-    },
-    onSuccess: (_, { identityId, organizationId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityUniversalAuth(identityId));
-    }
-  });
-};
-
-export const useDeleteIdentityTokenAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityTokenAuth, {}, DeleteIdentityTokenAuthDTO>({
-    mutationFn: async ({ identityId }) => {
-      const {
-        data: { identityTokenAuth }
-      } = await apiRequest.delete(`/api/v1/auth/token-auth/identities/${identityId}`);
-      return identityTokenAuth;
-    },
-    onSuccess: (_, { organizationId, identityId }) => {
-      queryClient.invalidateQueries(organizationKeys.getOrgIdentityMemberships(organizationId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityById(identityId));
-      queryClient.invalidateQueries(identitiesKeys.getIdentityTokenAuth(identityId));
-    }
-  });
-};
-
-export const useCreateTokenIdentityTokenAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<CreateTokenIdentityTokenAuthRes, {}, CreateTokenIdentityTokenAuthDTO>({
-    mutationFn: async ({ identityId, name }) => {
-      const { data } = await apiRequest.post<CreateTokenIdentityTokenAuthRes>(
-        `/api/v1/auth/token-auth/identities/${identityId}/tokens`,
-        {
-          name
-        }
-      );
-
-      return data;
-    },
-    onSuccess: (_, { identityId }) => {
-      queryClient.invalidateQueries(identitiesKeys.getIdentityTokensTokenAuth(identityId));
-    }
-  });
-};
-
-export const useUpdateTokenIdentityTokenAuth = () => {
-  const queryClient = useQueryClient();
-  return useMutation<IdentityAccessToken, {}, UpdateTokenIdentityTokenAuthDTO>({
-    mutationFn: async ({ identityId, tokenId, name }) => {
-      const {
-        data: { token }
-      } = await apiRequest.patch<{ token: IdentityAccessToken }>(
-        `/api/v1/auth/token-auth/identities/${identityId}/tokens/${tokenId}`,
-        {
-          name
-        }
-      );
-
-      return token;
-    },
-    onSuccess: (_, { identityId }) => {
-      queryClient.invalidateQueries(identitiesKeys.getIdentityTokensTokenAuth(identityId));
-    }
-  });
-};
-
-export const useRevokeToken = () => {
-  const queryClient = useQueryClient();
-  return useMutation<RevokeTokenRes, {}, RevokeTokenDTO>({
-    mutationFn: async ({ tokenId }) => {
-      const { data } = await apiRequest.post<RevokeTokenRes>("/api/v1/auth/token/revoke-by-id", {
-        tokenId
-      });
-
-      return data;
-    },
-    onSuccess: (_, { identityId }) => {
-      queryClient.invalidateQueries(identitiesKeys.getIdentityTokensTokenAuth(identityId));
     }
   });
 };

frontend/src/hooks/api/identities/queries.tsx

@@ -4,17 +4,13 @@ import { apiRequest } from "@app/config/request";
 
 import {
   ClientSecretData,
-  IdentityAccessToken,
   IdentityAwsAuth,
   IdentityAzureAuth,
   IdentityGcpAuth,
   IdentityKubernetesAuth,
-  IdentityMembershipOrg,
-  IdentityTokenAuth,
   IdentityUniversalAuth} from "./types";
 
 export const identitiesKeys = {
-  getIdentityById: (identityId: string) => [{ identityId }, "identity"] as const,
   getIdentityUniversalAuth: (identityId: string) =>
     [{ identityId }, "identity-universal-auth"] as const,
   getIdentityUniversalAuthClientSecrets: (identityId: string) =>
@@ -23,40 +19,7 @@ export const identitiesKeys = {
     [{ identityId }, "identity-kubernetes-auth"] as const,
   getIdentityGcpAuth: (identityId: string) => [{ identityId }, "identity-gcp-auth"] as const,
   getIdentityAwsAuth: (identityId: string) => [{ identityId }, "identity-aws-auth"] as const,
-  getIdentityAzureAuth: (identityId: string) => [{ identityId }, "identity-azure-auth"] as const,
-  getIdentityTokenAuth: (identityId: string) => [{ identityId }, "identity-token-auth"] as const,
-  getIdentityTokensTokenAuth: (identityId: string) =>
-    [{ identityId }, "identity-tokens-token-auth"] as const,
-  getIdentityProjectMemberships: (identityId: string) =>
-    [{ identityId }, "identity-project-memberships"] as const
-};
-
-export const useGetIdentityById = (identityId: string) => {
-  return useQuery({
-    enabled: Boolean(identityId),
-    queryKey: identitiesKeys.getIdentityById(identityId),
-    queryFn: async () => {
-      const {
-        data: { identity }
-      } = await apiRequest.get<{ identity: IdentityMembershipOrg }>(
-        `/api/v1/identities/${identityId}`
-      );
-      return identity;
-    }
-  });
-};
-
-export const useGetIdentityProjectMemberships = (identityId: string) => {
-  return useQuery({
-    enabled: Boolean(identityId),
-    queryKey: identitiesKeys.getIdentityProjectMemberships(identityId),
-    queryFn: async () => {
-      const {
-        data: { identityMemberships }
-      } = await apiRequest.get(`/api/v1/identities/${identityId}/identity-memberships`);
-      return identityMemberships;
-    }
-  });
+  getIdentityAzureAuth: (identityId: string) => [{ identityId }, "identity-azure-auth"] as const
 };
 
 export const useGetIdentityUniversalAuth = (identityId: string) => {
@@ -70,9 +33,7 @@ export const useGetIdentityUniversalAuth = (identityId: string) => {
         `/api/v1/auth/universal-auth/identities/${identityId}`
       );
       return identityUniversalAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
+    }
   });
 };
 
@@ -102,9 +63,7 @@ export const useGetIdentityGcpAuth = (identityId: string) => {
         `/api/v1/auth/gcp-auth/identities/${identityId}`
       );
       return identityGcpAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
+    }
   });
 };
 
@@ -119,9 +78,7 @@ export const useGetIdentityAwsAuth = (identityId: string) => {
         `/api/v1/auth/aws-auth/identities/${identityId}`
       );
       return identityAwsAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
+    }
   });
 };
 
@@ -136,9 +93,7 @@ export const useGetIdentityAzureAuth = (identityId: string) => {
         `/api/v1/auth/azure-auth/identities/${identityId}`
       );
       return identityAzureAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
+    }
   });
 };
 
@@ -153,40 +108,6 @@ export const useGetIdentityKubernetesAuth = (identityId: string) => {
         `/api/v1/auth/kubernetes-auth/identities/${identityId}`
       );
       return identityKubernetesAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
-  });
-};
-
-export const useGetIdentityTokenAuth = (identityId: string) => {
-  return useQuery({
-    enabled: Boolean(identityId),
-    queryKey: identitiesKeys.getIdentityTokenAuth(identityId),
-    queryFn: async () => {
-      const {
-        data: { identityTokenAuth }
-      } = await apiRequest.get<{ identityTokenAuth: IdentityTokenAuth }>(
-        `/api/v1/auth/token-auth/identities/${identityId}`
-      );
-      return identityTokenAuth;
-    },
-    staleTime: 0,
-    cacheTime: 0
-  });
-};
-
-export const useGetIdentityTokensTokenAuth = (identityId: string) => {
-  return useQuery({
-    enabled: Boolean(identityId),
-    queryKey: identitiesKeys.getIdentityTokensTokenAuth(identityId),
-    queryFn: async () => {
-      const {
-        data: { tokens }
-      } = await apiRequest.get<{ tokens: IdentityAccessToken[] }>(
-        `/api/v1/auth/token-auth/identities/${identityId}/tokens`
-      );
-      return tokens;
     }
   });
 };

frontend/src/hooks/api/identities/types.ts

@@ -16,22 +16,6 @@ export type Identity = {
   updatedAt: string;
 };
 
-export type IdentityAccessToken = {
-  id: string;
-  accessTokenTTL: number;
-  accessTokenMaxTTL: number;
-  accessTokenNumUses: number;
-  accessTokenNumUsesLimit: number;
-  accessTokenLastUsedAt: string | null;
-  accessTokenLastRenewedAt: string | null;
-  isAccessTokenRevoked: boolean;
-  identityUAClientSecretId: string | null;
-  identityId: string;
-  createdAt: string;
-  updatedAt: string;
-  name: string | null;
-};
-
 export type IdentityMembershipOrg = {
   id: string;
   identity: Identity;
@@ -129,11 +113,6 @@ export type UpdateIdentityUniversalAuthDTO = {
   }[];
 };
 
-export type DeleteIdentityUniversalAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
 export type IdentityGcpAuth = {
   identityId: string;
   type: "iam" | "gce";
@@ -176,11 +155,6 @@ export type UpdateIdentityGcpAuthDTO = {
   }[];
 };
 
-export type DeleteIdentityGcpAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
 export type IdentityAwsAuth = {
   identityId: string;
   type: "iam";
@@ -221,11 +195,6 @@ export type UpdateIdentityAwsAuthDTO = {
   }[];
 };
 
-export type DeleteIdentityAwsAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
 export type IdentityAzureAuth = {
   identityId: string;
   tenantId: string;
@@ -265,11 +234,6 @@ export type UpdateIdentityAzureAuthDTO = {
   }[];
 };
 
-export type DeleteIdentityAzureAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
 export type IdentityKubernetesAuth = {
   identityId: string;
   kubernetesHost: string;
@@ -318,11 +282,6 @@ export type UpdateIdentityKubernetesAuthDTO = {
   }[];
 };
 
-export type DeleteIdentityKubernetesAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
 export type CreateIdentityUniversalAuthClientSecretDTO = {
   identityId: string;
   description?: string;
@@ -352,65 +311,3 @@ export type DeleteIdentityUniversalAuthClientSecretDTO = {
   identityId: string;
   clientSecretId: string;
 };
-
-export type IdentityTokenAuth = {
-  identityId: string;
-  accessTokenTTL: number;
-  accessTokenMaxTTL: number;
-  accessTokenNumUsesLimit: number;
-  accessTokenTrustedIps: IdentityTrustedIp[];
-};
-
-export type AddIdentityTokenAuthDTO = {
-  organizationId: string;
-  identityId: string;
-  accessTokenTTL: number;
-  accessTokenMaxTTL: number;
-  accessTokenNumUsesLimit: number;
-  accessTokenTrustedIps: {
-    ipAddress: string;
-  }[];
-};
-
-export type UpdateIdentityTokenAuthDTO = {
-  organizationId: string;
-  identityId: string;
-  accessTokenTTL?: number;
-  accessTokenMaxTTL?: number;
-  accessTokenNumUsesLimit?: number;
-  accessTokenTrustedIps?: {
-    ipAddress: string;
-  }[];
-};
-
-export type DeleteIdentityTokenAuthDTO = {
-  organizationId: string;
-  identityId: string;
-};
-
-export type CreateTokenIdentityTokenAuthDTO = {
-  identityId: string;
-  name: string;
-};
-
-export type CreateTokenIdentityTokenAuthRes = {
-  accessToken: string;
-  tokenType: string;
-  expiresIn: number;
-  accessTokenMaxTTL: number;
-};
-
-export type UpdateTokenIdentityTokenAuthDTO = {
-  identityId: string;
-  tokenId: string;
-  name?: string;
-};
-
-export type RevokeTokenDTO = {
-  identityId: string;
-  tokenId: string;
-};
-
-export type RevokeTokenRes = {
-  message: string;
-};

frontend/src/pages/org/[id]/identities/[identityId]/index.tsx

@@ -1,20 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import { useTranslation } from "react-i18next";
-import Head from "next/head";
-
-import { IdentityPage } from "@app/views/Org/IdentityPage";
-
-export default function Identity() {
-  const { t } = useTranslation();
-  return (
-    <>
-      <Head>
-        <title>{t("common.head-title", { title: t("settings.org.title") })}</title>
-        <link rel="icon" href="/infisical.ico" />
-      </Head>
-      <IdentityPage />
-    </>
-  );
-}
-
-Identity.requireAuth = true;

frontend/src/views/Login/components/InitialStep/InitialStep.tsx

@@ -15,6 +15,7 @@ import { CAPTCHA_SITE_KEY } from "@app/components/utilities/config";
 import { Button, Input } from "@app/components/v2";
 import { useServerConfig } from "@app/context";
 import { useFetchServerStatus } from "@app/hooks/api";
+import { LoginMethod } from "@app/hooks/api/admin/types";
 
 import { useNavigateToSelectOrganization } from "../../Login.utils";
 
@@ -61,6 +62,9 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
     }
   }, []);
 
+  const shouldDisplayLoginMethod = (method: LoginMethod) =>
+    !config.enabledLoginMethods || config.enabledLoginMethods.includes(method);
+
   const handleLogin = async (e: FormEvent<HTMLFormElement>) => {
     e.preventDefault();
     try {
@@ -162,156 +166,179 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
       <h1 className="mb-8 bg-gradient-to-b from-white to-bunker-200 bg-clip-text text-center text-xl font-medium text-transparent">
         Login to Infisical
       </h1>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            const callbackPort = queryParams.get("callback_port");
+      {shouldDisplayLoginMethod(LoginMethod.GOOGLE) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              const callbackPort = queryParams.get("callback_port");
 
-            window.open(
-              `/api/v1/sso/redirect/google${callbackPort ? `?callback_port=${callbackPort}` : ""}`
-            );
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          {t("login.continue-with-google")}
-        </Button>
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            const callbackPort = queryParams.get("callback_port");
-
-            window.open(
-              `/api/v1/sso/redirect/github${callbackPort ? `?callback_port=${callbackPort}` : ""}`
-            );
-
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGithub} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          Continue with GitHub
-        </Button>
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            const callbackPort = queryParams.get("callback_port");
-
-            window.open(
-              `/api/v1/sso/redirect/gitlab${callbackPort ? `?callback_port=${callbackPort}` : ""}`
-            );
-
-            window.close();
-          }}
-          leftIcon={<FontAwesomeIcon icon={faGitlab} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          Continue with GitLab
-        </Button>
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            handleSaml(2);
-          }}
-          leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          Continue with SAML
-        </Button>
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            setStep(3);
-          }}
-          leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          Continue with OIDC
-        </Button>
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          colorSchema="primary"
-          variant="outline_bg"
-          onClick={() => {
-            router.push("/login/ldap");
-          }}
-          leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
-          className="mx-0 h-10 w-full"
-        >
-          Continue with LDAP
-        </Button>
-      </div>
-      <div className="my-4 flex w-1/4 min-w-[20rem] flex-row items-center py-2 lg:w-1/6">
-        <div className="w-full border-t border-mineshaft-400/60" />
-        <span className="mx-2 text-xs text-mineshaft-200">or</span>
-        <div className="w-full border-t border-mineshaft-400/60" />
-      </div>
-      <div className="w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Input
-          value={email}
-          onChange={(e) => setEmail(e.target.value)}
-          type="email"
-          placeholder="Enter your email..."
-          isRequired
-          autoComplete="username"
-          className="h-10"
-        />
-      </div>
-      <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Input
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-          type="password"
-          placeholder="Enter your password..."
-          isRequired
-          autoComplete="current-password"
-          id="current-password"
-          className="select:-webkit-autofill:focus h-10"
-        />
-      </div>
-      {shouldShowCaptcha && (
-        <div className="mt-4">
-          <HCaptcha
-            theme="dark"
-            sitekey={CAPTCHA_SITE_KEY}
-            onVerify={(token) => setCaptchaToken(token)}
-            ref={captchaRef}
-          />
+              window.open(
+                `/api/v1/sso/redirect/google${callbackPort ? `?callback_port=${callbackPort}` : ""}`
+              );
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGoogle} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            {t("login.continue-with-google")}
+          </Button>
         </div>
       )}
-      <div className="mt-3 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
-        <Button
-          disabled={shouldShowCaptcha && captchaToken === ""}
-          type="submit"
-          size="sm"
-          isFullWidth
-          className="h-10"
-          colorSchema="primary"
-          variant="solid"
-          isLoading={isLoading}
-        >
-          {" "}
-          Continue with Email{" "}
-        </Button>
-      </div>
+      {shouldDisplayLoginMethod(LoginMethod.GITHUB) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              const callbackPort = queryParams.get("callback_port");
+
+              window.open(
+                `/api/v1/sso/redirect/github${callbackPort ? `?callback_port=${callbackPort}` : ""}`
+              );
+
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGithub} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            Continue with GitHub
+          </Button>
+        </div>
+      )}
+      {shouldDisplayLoginMethod(LoginMethod.GITLAB) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              const callbackPort = queryParams.get("callback_port");
+
+              window.open(
+                `/api/v1/sso/redirect/gitlab${callbackPort ? `?callback_port=${callbackPort}` : ""}`
+              );
+
+              window.close();
+            }}
+            leftIcon={<FontAwesomeIcon icon={faGitlab} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            Continue with GitLab
+          </Button>
+        </div>
+      )}
+      {shouldDisplayLoginMethod(LoginMethod.SAML) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              handleSaml(2);
+            }}
+            leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            Continue with SAML
+          </Button>
+        </div>
+      )}
+      {shouldDisplayLoginMethod(LoginMethod.OIDC) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              setStep(3);
+            }}
+            leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            Continue with OIDC
+          </Button>
+        </div>
+      )}
+      {shouldDisplayLoginMethod(LoginMethod.LDAP) && (
+        <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+          <Button
+            colorSchema="primary"
+            variant="outline_bg"
+            onClick={() => {
+              router.push("/login/ldap");
+            }}
+            leftIcon={<FontAwesomeIcon icon={faLock} className="mr-2" />}
+            className="mx-0 h-10 w-full"
+          >
+            Continue with LDAP
+          </Button>
+        </div>
+      )}
+      {(!config.enabledLoginMethods ||
+        (shouldDisplayLoginMethod(LoginMethod.EMAIL) && config.enabledLoginMethods.length > 1)) && (
+        <div className="my-4 flex w-1/4 min-w-[20rem] flex-row items-center py-2 lg:w-1/6">
+          <div className="w-full border-t border-mineshaft-400/60" />
+          <span className="mx-2 text-xs text-mineshaft-200">or</span>
+          <div className="w-full border-t border-mineshaft-400/60" />
+        </div>
+      )}
+      {shouldDisplayLoginMethod(LoginMethod.EMAIL) && (
+        <>
+          <div className="w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+            <Input
+              value={email}
+              onChange={(e) => setEmail(e.target.value)}
+              type="email"
+              placeholder="Enter your email..."
+              isRequired
+              autoComplete="username"
+              className="h-10"
+            />
+          </div>
+          <div className="mt-2 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+            <Input
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
+              type="password"
+              placeholder="Enter your password..."
+              isRequired
+              autoComplete="current-password"
+              id="current-password"
+              className="select:-webkit-autofill:focus h-10"
+            />
+          </div>
+          {shouldShowCaptcha && (
+            <div className="mt-4">
+              <HCaptcha
+                theme="dark"
+                sitekey={CAPTCHA_SITE_KEY}
+                onVerify={(token) => setCaptchaToken(token)}
+                ref={captchaRef}
+              />
+            </div>
+          )}
+          <div className="mt-3 w-1/4 min-w-[21.2rem] rounded-md text-center md:min-w-[20.1rem] lg:w-1/6">
+            <Button
+              disabled={shouldShowCaptcha && captchaToken === ""}
+              type="submit"
+              size="sm"
+              isFullWidth
+              className="h-10"
+              colorSchema="primary"
+              variant="solid"
+              isLoading={isLoading}
+            >
+              {" "}
+              Continue with Email{" "}
+            </Button>
+          </div>
+        </>
+      )}
       {!isLoading && loginError && <Error text={t("login.error-login") ?? ""} />}
-      {config.allowSignUp ? (
+      {config.allowSignUp &&
+      (shouldDisplayLoginMethod(LoginMethod.EMAIL) ||
+        shouldDisplayLoginMethod(LoginMethod.GOOGLE) ||
+        shouldDisplayLoginMethod(LoginMethod.GITHUB) ||
+        shouldDisplayLoginMethod(LoginMethod.GITLAB)) ? (
         <div className="mt-6 flex flex-row text-sm text-bunker-400">
           <Link href="/signup">
             <span className="cursor-pointer duration-200 hover:text-bunker-200 hover:underline hover:decoration-primary-700 hover:underline-offset-4">
@@ -322,13 +349,15 @@ export const InitialStep = ({ setStep, email, setEmail, password, setPassword }:
       ) : (
         <div className="mt-4" />
       )}
-      <div className="mt-2 flex flex-row text-sm text-bunker-400">
-        <Link href="/verify-email">
-          <span className="cursor-pointer duration-200 hover:text-bunker-200 hover:underline hover:decoration-primary-700 hover:underline-offset-4">
-            Forgot password? Recover your account
-          </span>
-        </Link>
-      </div>
+      {shouldDisplayLoginMethod(LoginMethod.EMAIL) && (
+        <div className="mt-2 flex flex-row text-sm text-bunker-400">
+          <Link href="/verify-email">
+            <span className="cursor-pointer duration-200 hover:text-bunker-200 hover:underline hover:decoration-primary-700 hover:underline-offset-4">
+              Forgot password? Recover your account
+            </span>
+          </Link>
+        </div>
+      )}
     </form>
   );
 };

frontend/src/views/Org/IdentityPage/IdentityPage.tsx

@@ -1,332 +0,0 @@
-/* eslint-disable @typescript-eslint/no-unused-vars */
-import { useRouter } from "next/router";
-import { faChevronLeft, faEllipsis } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { twMerge } from "tailwind-merge";
-
-import { createNotification } from "@app/components/notifications";
-import { OrgPermissionCan } from "@app/components/permissions";
-import {
-  Button,
-  DeleteActionModal,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-  Tooltip,
-  UpgradePlanModal
-} from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
-import { withPermission } from "@app/hoc";
-import {
-  useDeleteIdentity,
-  useGetIdentityById,
-  useRevokeIdentityUniversalAuthClientSecret,
-  useRevokeToken
-} from "@app/hooks/api";
-import { usePopUp } from "@app/hooks/usePopUp";
-
-import { IdentityAuthMethodModal } from "../MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthMethodModal";
-import { IdentityModal } from "../MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal";
-import { IdentityUniversalAuthClientSecretModal } from "../MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal";
-import {
-  IdentityAuthenticationSection,
-  IdentityClientSecretModal,
-  IdentityDetailsSection,
-  IdentityProjectsSection,
-  IdentityTokenListModal,
-  IdentityTokenModal} from "./components";
-
-export const IdentityPage = withPermission(
-  () => {
-    const router = useRouter();
-    const identityId = router.query.identityId as string;
-    const { currentOrg } = useOrganization();
-    const orgId = currentOrg?.id || "";
-    const { data } = useGetIdentityById(identityId);
-    const { mutateAsync: deleteIdentity } = useDeleteIdentity();
-    const { mutateAsync: revokeToken } = useRevokeToken();
-    const { mutateAsync: revokeClientSecret } = useRevokeIdentityUniversalAuthClientSecret();
-
-    const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
-      "identity",
-      "deleteIdentity",
-      "identityAuthMethod",
-      "token",
-      "tokenList",
-      "revokeToken",
-      "clientSecret",
-      "revokeClientSecret",
-      "universalAuthClientSecret", // list of client secrets
-      "upgradePlan"
-    ] as const);
-
-    const onDeleteIdentitySubmit = async (id: string) => {
-      try {
-        await deleteIdentity({
-          identityId: id,
-          organizationId: orgId
-        });
-
-        createNotification({
-          text: "Successfully deleted identity",
-          type: "success"
-        });
-
-        handlePopUpClose("deleteIdentity");
-        router.push(`/org/${orgId}/members`);
-      } catch (err) {
-        console.error(err);
-        const error = err as any;
-        const text = error?.response?.data?.message ?? "Failed to delete identity";
-
-        createNotification({
-          text,
-          type: "error"
-        });
-      }
-    };
-
-    const onRevokeTokenSubmit = async ({
-      identityId: parentIdentityId,
-      tokenId,
-      name
-    }: {
-      identityId: string;
-      tokenId: string;
-      name: string;
-    }) => {
-      try {
-        await revokeToken({
-          identityId: parentIdentityId,
-          tokenId
-        });
-
-        handlePopUpClose("revokeToken");
-
-        createNotification({
-          text: `Successfully revoked token ${name ?? ""}`,
-          type: "success"
-        });
-      } catch (err) {
-        console.error(err);
-        const error = err as any;
-        const text = error?.response?.data?.message ?? "Failed to delete identity";
-
-        createNotification({
-          text,
-          type: "error"
-        });
-      }
-    };
-
-    const onDeleteClientSecretSubmit = async ({ clientSecretId }: { clientSecretId: string }) => {
-      try {
-        if (!data?.identity.id) return;
-
-        await revokeClientSecret({
-          identityId: data?.identity.id,
-          clientSecretId
-        });
-
-        handlePopUpToggle("revokeClientSecret", false);
-
-        createNotification({
-          text: "Successfully deleted client secret",
-          type: "success"
-        });
-      } catch (err) {
-        console.error(err);
-        createNotification({
-          text: "Failed to delete client secret",
-          type: "error"
-        });
-      }
-    };
-
-    return (
-      <div className="container mx-auto flex flex-col justify-between bg-bunker-800 text-white">
-        {data && (
-          <div className="mx-auto mb-6 w-full max-w-7xl py-6 px-6">
-            <Button
-              variant="link"
-              type="submit"
-              leftIcon={<FontAwesomeIcon icon={faChevronLeft} />}
-              onClick={() => {
-                router.push(`/org/${orgId}/members`);
-              }}
-              className="mb-4"
-            >
-              Identities
-            </Button>
-            <div className="mb-4 flex items-center justify-between">
-              <p className="text-3xl font-semibold text-white">{data.identity.name}</p>
-              <DropdownMenu>
-                <DropdownMenuTrigger asChild className="rounded-lg">
-                  <div className="hover:text-primary-400 data-[state=open]:text-primary-400">
-                    <Tooltip content="More options">
-                      <FontAwesomeIcon size="sm" icon={faEllipsis} />
-                    </Tooltip>
-                  </div>
-                </DropdownMenuTrigger>
-                <DropdownMenuContent align="start" className="p-1">
-                  <OrgPermissionCan
-                    I={OrgPermissionActions.Edit}
-                    a={OrgPermissionSubjects.Identity}
-                  >
-                    {(isAllowed) => (
-                      <DropdownMenuItem
-                        className={twMerge(
-                          !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                        )}
-                        onClick={async () => {
-                          handlePopUpOpen("identity", {
-                            identityId,
-                            name: data.identity.name,
-                            role: data.role,
-                            customRole: data.customRole
-                          });
-                        }}
-                        disabled={!isAllowed}
-                      >
-                        Edit Identity
-                      </DropdownMenuItem>
-                    )}
-                  </OrgPermissionCan>
-                  <OrgPermissionCan
-                    I={OrgPermissionActions.Edit}
-                    a={OrgPermissionSubjects.Identity}
-                  >
-                    {(isAllowed) => (
-                      <DropdownMenuItem
-                        className={twMerge(
-                          !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
-                        )}
-                        onClick={async () => {
-                          handlePopUpOpen("identityAuthMethod", {
-                            identityId,
-                            name: data.identity.name,
-                            authMethod: data.identity.authMethod
-                          });
-                        }}
-                        disabled={!isAllowed}
-                      >
-                        {`${data.identity.authMethod ? "Edit" : "Configure"} Auth Method`}
-                      </DropdownMenuItem>
-                    )}
-                  </OrgPermissionCan>
-                  <OrgPermissionCan
-                    I={OrgPermissionActions.Delete}
-                    a={OrgPermissionSubjects.Identity}
-                  >
-                    {(isAllowed) => (
-                      <DropdownMenuItem
-                        className={twMerge(
-                          isAllowed
-                            ? "hover:!bg-red-500 hover:!text-white"
-                            : "pointer-events-none cursor-not-allowed opacity-50"
-                        )}
-                        onClick={async () => {
-                          handlePopUpOpen("deleteIdentity", {
-                            identityId,
-                            name: data.identity.name
-                          });
-                        }}
-                        disabled={!isAllowed}
-                      >
-                        Delete Identity
-                      </DropdownMenuItem>
-                    )}
-                  </OrgPermissionCan>
-                </DropdownMenuContent>
-              </DropdownMenu>
-            </div>
-            <div className="flex">
-              <div className="mr-4 w-96">
-                <IdentityDetailsSection identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
-                <IdentityAuthenticationSection
-                  identityId={identityId}
-                  handlePopUpOpen={handlePopUpOpen}
-                />
-              </div>
-              <IdentityProjectsSection identityId={identityId} />
-            </div>
-          </div>
-        )}
-        <IdentityModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-        <IdentityAuthMethodModal
-          popUp={popUp}
-          handlePopUpOpen={handlePopUpOpen}
-          handlePopUpToggle={handlePopUpToggle}
-        />
-        <IdentityTokenModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-        <IdentityTokenListModal
-          popUp={popUp}
-          handlePopUpOpen={handlePopUpOpen}
-          handlePopUpToggle={handlePopUpToggle}
-        />
-        <IdentityClientSecretModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
-        <IdentityUniversalAuthClientSecretModal
-          popUp={popUp}
-          handlePopUpOpen={handlePopUpOpen}
-          handlePopUpToggle={handlePopUpToggle}
-        />
-        <UpgradePlanModal
-          isOpen={popUp.upgradePlan.isOpen}
-          onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}
-          text={(popUp.upgradePlan?.data as { description: string })?.description}
-        />
-        <DeleteActionModal
-          isOpen={popUp.deleteIdentity.isOpen}
-          title={`Are you sure want to delete ${
-            (popUp?.deleteIdentity?.data as { name: string })?.name || ""
-          }?`}
-          onChange={(isOpen) => handlePopUpToggle("deleteIdentity", isOpen)}
-          deleteKey="confirm"
-          onDeleteApproved={() =>
-            onDeleteIdentitySubmit(
-              (popUp?.deleteIdentity?.data as { identityId: string })?.identityId
-            )
-          }
-        />
-        <DeleteActionModal
-          isOpen={popUp.revokeToken.isOpen}
-          title={`Are you sure want to revoke ${
-            (popUp?.revokeToken?.data as { name: string })?.name || ""
-          }?`}
-          onChange={(isOpen) => handlePopUpToggle("revokeToken", isOpen)}
-          deleteKey="confirm"
-          onDeleteApproved={() => {
-            const revokeTokenData = popUp?.revokeToken?.data as {
-              identityId: string;
-              tokenId: string;
-              name: string;
-            };
-
-            return onRevokeTokenSubmit(revokeTokenData);
-          }}
-        />
-        <DeleteActionModal
-          isOpen={popUp.revokeClientSecret.isOpen}
-          title={`Are you sure want to delete the client secret ${
-            (popUp?.revokeClientSecret?.data as { clientSecretPrefix: string })
-              ?.clientSecretPrefix || ""
-          }************?`}
-          onChange={(isOpen) => handlePopUpToggle("revokeClientSecret", isOpen)}
-          deleteKey="confirm"
-          onDeleteApproved={() => {
-            const deleteClientSecretData = popUp?.revokeClientSecret?.data as {
-              clientSecretId: string;
-              clientSecretPrefix: string;
-            };
-
-            return onDeleteClientSecretSubmit({
-              clientSecretId: deleteClientSecretData.clientSecretId
-            });
-          }}
-        />
-      </div>
-    );
-  },
-  { action: OrgPermissionActions.Read, subject: OrgPermissionSubjects.Identity }
-);

frontend/src/views/Org/IdentityPage/components/IdentityAuthenticationSection/IdentityAuthenticationSection.tsx

@@ -1,98 +0,0 @@
-import { faPencil } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-
-import { OrgPermissionCan } from "@app/components/permissions";
-import {
-  IconButton,
-  // Button,
-  Tooltip
-} from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
-import { useGetIdentityById } from "@app/hooks/api";
-import { IdentityAuthMethod, identityAuthToNameMap } from "@app/hooks/api/identities";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-import { IdentityClientSecrets } from "./IdentityClientSecrets";
-import { IdentityTokens } from "./IdentityTokens";
-
-type Props = {
-  identityId: string;
-  handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<
-      [
-        "clientSecret",
-        "identityAuthMethod",
-        "revokeClientSecret",
-        "token",
-        "revokeToken",
-        "universalAuthClientSecret",
-        "tokenList"
-      ]
-    >,
-    data?: {}
-  ) => void;
-};
-
-export const IdentityAuthenticationSection = ({ identityId, handlePopUpOpen }: Props) => {
-  const { data } = useGetIdentityById(identityId);
-  return data ? (
-    <div className="mt-4 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="flex items-center justify-between border-b border-mineshaft-400 pb-4">
-        <h3 className="text-lg font-semibold text-mineshaft-100">Authentication</h3>
-        <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Identity}>
-          {(isAllowed) => {
-            return (
-              <Tooltip content={`${data.identity.authMethod ? "Edit" : "Configure"} Auth Method`}>
-                <IconButton
-                  isDisabled={!isAllowed}
-                  ariaLabel="copy icon"
-                  variant="plain"
-                  className="group relative"
-                  onClick={() =>
-                    handlePopUpOpen("identityAuthMethod", {
-                      identityId,
-                      name: data.identity.name,
-                      authMethod: data.identity.authMethod
-                    })
-                  }
-                >
-                  <FontAwesomeIcon icon={faPencil} />
-                </IconButton>
-              </Tooltip>
-            );
-          }}
-        </OrgPermissionCan>
-      </div>
-      <div className="py-4">
-        <div className="flex justify-between">
-          <p className="text-sm font-semibold text-mineshaft-300">Auth Method</p>
-          {/* <Button
-            variant="link"
-            onClick={() => {
-              handlePopUpOpen("identityAuthMethod", {
-                identityId,
-                name: data.identity.name,
-                authMethod: data.identity.authMethod
-              });
-            }}
-          >
-            Manage
-          </Button> */}
-        </div>
-        <p className="text-sm text-mineshaft-300">
-          {data.identity.authMethod
-            ? identityAuthToNameMap[data.identity.authMethod]
-            : "Not configured"}
-        </p>
-      </div>
-      {data.identity.authMethod === IdentityAuthMethod.UNIVERSAL_AUTH && (
-        <IdentityClientSecrets identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
-      )}
-      {data.identity.authMethod === IdentityAuthMethod.TOKEN_AUTH && (
-        <IdentityTokens identityId={identityId} handlePopUpOpen={handlePopUpOpen} />
-      )}
-    </div>
-  ) : (
-    <div />
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityAuthenticationSection/IdentityClientSecrets.tsx

@@ -1,120 +0,0 @@
-import { faKey, faTrash } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { format } from "date-fns";
-
-import { OrgPermissionCan } from "@app/components/permissions";
-import { Button, IconButton, Tooltip } from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
-import {
-  useGetIdentityById,
-  useGetIdentityUniversalAuth,
-  useGetIdentityUniversalAuthClientSecrets
-} from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-type Props = {
-  identityId: string;
-  handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<
-      ["clientSecret", "revokeClientSecret", "universalAuthClientSecret"]
-    >,
-    data?: {}
-  ) => void;
-};
-
-const SHOW_LIMIT = 3;
-
-export const IdentityClientSecrets = ({ identityId, handlePopUpOpen }: Props) => {
-  const { data } = useGetIdentityById(identityId);
-  const { data: identityUniversalAuth } = useGetIdentityUniversalAuth(identityId);
-  const { data: clientSecrets } = useGetIdentityUniversalAuthClientSecrets(identityId);
-  return (
-    <div>
-      <div className="mb-4">
-        <p className="text-sm font-semibold text-mineshaft-300">Client ID</p>
-        <p className="text-sm text-mineshaft-300">{identityUniversalAuth?.clientId ?? ""}</p>
-      </div>
-      {clientSecrets?.length ? (
-        <div className="flex justify-between">
-          <p className="text-sm font-semibold text-mineshaft-300">{`Client Secrets (${clientSecrets.length})`}</p>
-          <Button
-            variant="link"
-            onClick={() => {
-              handlePopUpOpen("universalAuthClientSecret", {
-                identityId,
-                name: data?.identity.name ?? ""
-              });
-            }}
-          >
-            Manage
-          </Button>
-        </div>
-      ) : (
-        <div />
-      )}
-      {clientSecrets
-        ?.slice(0, SHOW_LIMIT)
-        .map(({ id, clientSecretTTL, clientSecretPrefix, createdAt }) => {
-          let expiresAt;
-          if (clientSecretTTL > 0) {
-            expiresAt = new Date(new Date(createdAt).getTime() + clientSecretTTL * 1000);
-          }
-
-          return (
-            <div
-              className="group flex items-center justify-between py-2 last:pb-0"
-              key={`client-secret-${id}`}
-            >
-              <div className="flex items-center">
-                <FontAwesomeIcon size="1x" icon={faKey} />
-                <div className="ml-4">
-                  <p className="text-sm font-semibold text-mineshaft-300">
-                    {`${clientSecretPrefix}****`}
-                  </p>
-                  <p className="text-sm text-mineshaft-300">
-                    {expiresAt ? `Expires on ${format(expiresAt, "yyyy-MM-dd")}` : "No Expiry"}
-                  </p>
-                </div>
-              </div>
-              <div className="opacity-0 transition-opacity duration-300 group-hover:opacity-100">
-                <Tooltip content="Revoke Client Secret">
-                  <IconButton
-                    ariaLabel="copy icon"
-                    variant="plain"
-                    className="group relative"
-                    onClick={() => {
-                      handlePopUpOpen("revokeClientSecret", {
-                        clientSecretId: id,
-                        clientSecretPrefix
-                      });
-                    }}
-                  >
-                    <FontAwesomeIcon icon={faTrash} />
-                  </IconButton>
-                </Tooltip>
-              </div>
-            </div>
-          );
-        })}
-      <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Identity}>
-        {(isAllowed) => {
-          return (
-            <Button
-              isDisabled={!isAllowed}
-              className="mt-4 w-full"
-              colorSchema="primary"
-              type="submit"
-              onClick={() => {
-                handlePopUpOpen("clientSecret", {
-                  identityId
-                });
-              }}
-            >
-              Create Client Secret
-            </Button>
-          );
-        }}
-      </OrgPermissionCan>
-    </div>
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityAuthenticationSection/IdentityTokens.tsx

@@ -1,119 +0,0 @@
-import { faEllipsis, faKey } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { format } from "date-fns";
-
-import {
-  Button,
-  DropdownMenu,
-  DropdownMenuContent,
-  DropdownMenuItem,
-  DropdownMenuTrigger,
-  Tooltip
-} from "@app/components/v2";
-import { useGetIdentityById, useGetIdentityTokensTokenAuth } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-type Props = {
-  identityId: string;
-  handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<["token", "tokenList", "revokeToken"]>,
-    data?: {}
-  ) => void;
-};
-
-export const IdentityTokens = ({ identityId, handlePopUpOpen }: Props) => {
-  const { data } = useGetIdentityById(identityId);
-  const { data: tokens } = useGetIdentityTokensTokenAuth(identityId);
-  return (
-    <div>
-      {tokens?.length ? (
-        <div className="flex justify-between">
-          <p className="text-sm font-semibold text-mineshaft-300">{`Access Tokens (${tokens.length})`}</p>
-          <Button
-            variant="link"
-            onClick={() => {
-              handlePopUpOpen("tokenList", {
-                identityId,
-                name: data?.identity.name ?? ""
-              });
-            }}
-          >
-            Manage
-          </Button>
-        </div>
-      ) : (
-        <div />
-      )}
-      {tokens?.map((token) => {
-        const expiresAt = new Date(
-          new Date(token.createdAt).getTime() + token.accessTokenMaxTTL * 1000
-        );
-        return (
-          <div
-            className="group flex items-center justify-between py-2 last:pb-0"
-            key={`identity-token-${token.id}`}
-          >
-            <div className="flex items-center">
-              <FontAwesomeIcon size="1x" icon={faKey} />
-              <div className="ml-4">
-                <p className="text-sm font-semibold text-mineshaft-300">
-                  {token.name ? token.name : "-"}
-                </p>
-                <p className="text-sm text-mineshaft-300">
-                  {token.isAccessTokenRevoked
-                    ? "Revoked"
-                    : `Expires on ${format(expiresAt, "yyyy-MM-dd")}`}
-                </p>
-              </div>
-            </div>
-            <DropdownMenu>
-              <DropdownMenuTrigger asChild className="rounded-lg">
-                <div className="opacity-0 transition-opacity duration-300 hover:text-primary-400 group-hover:opacity-100 data-[state=open]:text-primary-400">
-                  <Tooltip content="More options">
-                    <FontAwesomeIcon size="sm" icon={faEllipsis} />
-                  </Tooltip>
-                </div>
-              </DropdownMenuTrigger>
-              <DropdownMenuContent align="start" className="p-1">
-                <DropdownMenuItem
-                  onClick={async () => {
-                    handlePopUpOpen("token", {
-                      identityId,
-                      tokenId: token.id,
-                      name: token.name
-                    });
-                  }}
-                >
-                  Edit Token
-                </DropdownMenuItem>
-                <DropdownMenuItem
-                  onClick={async () => {
-                    handlePopUpOpen("revokeToken", {
-                      identityId,
-                      tokenId: token.id,
-                      name: token.name
-                    });
-                  }}
-                >
-                  Revoke Token
-                </DropdownMenuItem>
-              </DropdownMenuContent>
-            </DropdownMenu>
-          </div>
-        );
-      })}
-      <Button
-        className="mt-4 mr-4 w-full"
-        colorSchema="primary"
-        type="submit"
-        onClick={() => {
-          handlePopUpOpen("token", {
-            identityId
-          });
-        }}
-      >
-        Create Token
-      </Button>
-    </div>
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityAuthenticationSection/index.tsx

@@ -1 +0,0 @@
-export { IdentityAuthenticationSection } from "./IdentityAuthenticationSection";

frontend/src/views/Org/IdentityPage/components/IdentityClientSecretModal.tsx

@@ -1,191 +0,0 @@
-import { useState } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  FormControl,
-  IconButton,
-  Input,
-  Modal,
-  ModalContent,
-  Tooltip
-} from "@app/components/v2";
-import { useTimedReset } from "@app/hooks";
-import { useCreateIdentityUniversalAuthClientSecret } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-const schema = z
-  .object({
-    description: z.string(),
-    ttl: z.string(),
-    numUsesLimit: z.string()
-  })
-  .required();
-
-export type FormData = z.infer<typeof schema>;
-
-type Props = {
-  popUp: UsePopUpState<["clientSecret"]>;
-  handlePopUpToggle: (popUpName: keyof UsePopUpState<["clientSecret"]>, state?: boolean) => void;
-};
-
-export const IdentityClientSecretModal = ({ popUp, handlePopUpToggle }: Props) => {
-  const { mutateAsync: createClientSecret } = useCreateIdentityUniversalAuthClientSecret();
-  const [token, setToken] = useState("");
-  const [copyTextToken, isCopyingToken, setCopyTextToken] = useTimedReset<string>({
-    initialState: "Copy to clipboard"
-  });
-  const hasToken = Boolean(token);
-
-  const {
-    control,
-    handleSubmit,
-    reset,
-    formState: { isSubmitting }
-  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      description: "",
-      ttl: "",
-      numUsesLimit: ""
-    }
-  });
-
-  const popUpData = popUp?.clientSecret?.data as {
-    identityId: string;
-  };
-
-  const onFormSubmit = async ({ description, ttl, numUsesLimit }: FormData) => {
-    try {
-      const { clientSecret } = await createClientSecret({
-        identityId: popUpData.identityId,
-        description,
-        ttl: Number(ttl),
-        numUsesLimit: Number(numUsesLimit)
-      });
-
-      setToken(clientSecret);
-
-      createNotification({
-        text: "Successfully created client secret",
-        type: "success"
-      });
-
-      reset();
-    } catch (err) {
-      console.error(err);
-      const error = err as any;
-      const text = error?.response?.data?.message ?? "Failed to create client secret";
-
-      createNotification({
-        text,
-        type: "error"
-      });
-    }
-  };
-
-  return (
-    <Modal
-      isOpen={popUp?.clientSecret?.isOpen}
-      onOpenChange={(isOpen) => {
-        handlePopUpToggle("clientSecret", isOpen);
-        reset();
-        setToken("");
-      }}
-    >
-      <ModalContent
-        title="Create Client Secret"
-        subTitle={hasToken ? "We will only show this secret once" : ""}
-      >
-        {!hasToken ? (
-          <form onSubmit={handleSubmit(onFormSubmit)}>
-            <Controller
-              control={control}
-              defaultValue=""
-              name="description"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl
-                  label="Description"
-                  isError={Boolean(error)}
-                  errorText={error?.message}
-                >
-                  <Input {...field} placeholder="My Client Secret" />
-                </FormControl>
-              )}
-            />
-            <Controller
-              control={control}
-              defaultValue=""
-              name="ttl"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl
-                  label="TTL (seconds - optional)"
-                  isError={Boolean(error)}
-                  errorText={error?.message}
-                >
-                  <div className="flex">
-                    <Input {...field} placeholder="0" type="number" min="0" step="1" />
-                  </div>
-                </FormControl>
-              )}
-            />
-            <Controller
-              control={control}
-              defaultValue=""
-              name="numUsesLimit"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl
-                  label="Max Number of Uses"
-                  isError={Boolean(error)}
-                  errorText={error?.message}
-                >
-                  <Input {...field} placeholder="0" type="number" min="0" step="1" />
-                </FormControl>
-              )}
-            />
-            <div className="flex items-center">
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                Create
-              </Button>
-              <Button
-                colorSchema="secondary"
-                variant="plain"
-                onClick={() => handlePopUpToggle("clientSecret", false)}
-              >
-                Cancel
-              </Button>
-            </div>
-          </form>
-        ) : (
-          <div className="mt-2 mb-3 mr-2 flex items-center justify-end rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-            <p className="mr-4 break-all">{token}</p>
-            <Tooltip content={copyTextToken}>
-              <IconButton
-                ariaLabel="copy icon"
-                colorSchema="secondary"
-                className="group relative"
-                onClick={() => {
-                  navigator.clipboard.writeText(token);
-                  setCopyTextToken("Copied");
-                }}
-              >
-                <FontAwesomeIcon icon={isCopyingToken ? faCheck : faCopy} />
-              </IconButton>
-            </Tooltip>
-          </div>
-        )}
-      </ModalContent>
-    </Modal>
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityDetailsSection.tsx

@@ -1,67 +0,0 @@
-import { faPencil } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-
-import { OrgPermissionCan } from "@app/components/permissions";
-import { IconButton,Tooltip } from "@app/components/v2";
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
-import { useGetIdentityById } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-type Props = {
-  identityId: string;
-  handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<["identity", "identityAuthMethod", "token", "clientSecret"]>,
-    data?: {}
-  ) => void;
-};
-
-export const IdentityDetailsSection = ({ identityId, handlePopUpOpen }: Props) => {
-  const { data } = useGetIdentityById(identityId);
-  return data ? (
-    <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="flex items-center justify-between border-b border-mineshaft-400 pb-4">
-        <h3 className="text-lg font-semibold text-mineshaft-100">Details</h3>
-        <OrgPermissionCan I={OrgPermissionActions.Edit} a={OrgPermissionSubjects.Identity}>
-          {(isAllowed) => {
-            return (
-              <Tooltip content="Edit Identity">
-                <IconButton
-                  isDisabled={!isAllowed}
-                  ariaLabel="copy icon"
-                  variant="plain"
-                  className="group relative"
-                  onClick={() => {
-                    handlePopUpOpen("identity", {
-                      identityId,
-                      name: data.identity.name,
-                      role: data.role,
-                      customRole: data.customRole
-                    });
-                  }}
-                >
-                  <FontAwesomeIcon icon={faPencil} />
-                </IconButton>
-              </Tooltip>
-            );
-          }}
-        </OrgPermissionCan>
-      </div>
-      <div className="pt-4">
-        <div className="mb-4">
-          <p className="text-sm font-semibold text-mineshaft-300">ID</p>
-          <p className="text-sm text-mineshaft-300">{data.identity.id}</p>
-        </div>
-        <div className="mb-4">
-          <p className="text-sm font-semibold text-mineshaft-300">Name</p>
-          <p className="text-sm text-mineshaft-300">{data.identity.name}</p>
-        </div>
-        <div>
-          <p className="text-sm font-semibold text-mineshaft-300">Organization Role</p>
-          <p className="text-sm text-mineshaft-300">{data.role}</p>
-        </div>
-      </div>
-    </div>
-  ) : (
-    <div />
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityProjectsSection.tsx

@@ -1,57 +0,0 @@
-import { faKey } from "@fortawesome/free-solid-svg-icons";
-
-import {
-  EmptyState,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
-import { useGetIdentityProjectMemberships } from "@app/hooks/api";
-
-type Props = {
-  identityId: string;
-};
-
-export const IdentityProjectsSection = ({ identityId }: Props) => {
-  const { data: projectMemberships, isLoading } = useGetIdentityProjectMemberships(identityId);
-  return (
-    <div className="w-full rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4">
-      <div className="border-b border-mineshaft-400 pb-4">
-        <h3 className="text-lg font-semibold text-mineshaft-100">Projects</h3>
-      </div>
-      <div className="py-4">
-        <TableContainer>
-          <Table>
-            <THead>
-              <Tr>
-                <Th>Name</Th>
-                <Th>Role</Th>
-              </Tr>
-            </THead>
-            <TBody>
-              {isLoading && <TableSkeleton columns={2} innerKey="identity-project-memberships" />}
-              {!isLoading &&
-                projectMemberships?.map((membership: any) => {
-                  // TODO: fix any
-                  return (
-                    <Tr className="h-10" key={`identity-project-membership-${membership.id}`}>
-                      <Td>{membership.project.name}</Td>
-                      <Td>{membership.roles[0].role}</Td>
-                    </Tr>
-                  );
-                })}
-            </TBody>
-          </Table>
-          {!isLoading && !projectMemberships?.length && (
-            <EmptyState title="This identity has not been assigned to any projects" icon={faKey} />
-          )}
-        </TableContainer>
-      </div>
-    </div>
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityTokenListModal.tsx

@@ -1,269 +0,0 @@
-import { useEffect, useState } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { useTranslation } from "react-i18next";
-import { faCheck, faCopy, faKey, faXmark } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { format } from "date-fns";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  EmptyState,
-  FormControl,
-  IconButton,
-  Input,
-  Modal,
-  ModalContent,
-  Table,
-  TableContainer,
-  TableSkeleton,
-  TBody,
-  Td,
-  Th,
-  THead,
-  Tr
-} from "@app/components/v2";
-import { useToggle } from "@app/hooks";
-import {
-  useCreateTokenIdentityTokenAuth,
-  useGetIdentityTokensTokenAuth,
-  useGetIdentityUniversalAuthClientSecrets} from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-const schema = z.object({
-  name: z.string()
-});
-
-export type FormData = z.infer<typeof schema>;
-
-type Props = {
-  popUp: UsePopUpState<["tokenList", "revokeToken"]>;
-  handlePopUpOpen: (popUpName: keyof UsePopUpState<["revokeToken"]>, data?: {}) => void;
-  handlePopUpToggle: (
-    popUpName: keyof UsePopUpState<["tokenList", "revokeToken"]>,
-    state?: boolean
-  ) => void;
-};
-
-export const IdentityTokenListModal = ({ popUp, handlePopUpOpen, handlePopUpToggle }: Props) => {
-  const { t } = useTranslation();
-
-  const [token, setToken] = useState("");
-  const [isClientSecretCopied, setIsClientSecretCopied] = useToggle(false);
-  const [isClientIdCopied, setIsClientIdCopied] = useToggle(false);
-
-  const popUpData = popUp?.tokenList?.data as {
-    identityId: string;
-    name: string;
-  };
-
-  const { data: tokens } = useGetIdentityTokensTokenAuth(popUpData?.identityId ?? "");
-  const { data, isLoading } = useGetIdentityUniversalAuthClientSecrets(popUpData?.identityId ?? "");
-
-  const { mutateAsync: createToken } = useCreateTokenIdentityTokenAuth();
-
-  const {
-    control,
-    handleSubmit,
-    reset,
-    formState: { isSubmitting }
-  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      name: ""
-    }
-  });
-
-  useEffect(() => {
-    let timer: NodeJS.Timeout;
-    if (isClientSecretCopied) {
-      timer = setTimeout(() => setIsClientSecretCopied.off(), 2000);
-    }
-
-    return () => clearTimeout(timer);
-  }, [isClientSecretCopied]);
-
-  useEffect(() => {
-    let timer: NodeJS.Timeout;
-    if (isClientIdCopied) {
-      timer = setTimeout(() => setIsClientIdCopied.off(), 2000);
-    }
-
-    return () => clearTimeout(timer);
-  }, [isClientIdCopied]);
-
-  const onFormSubmit = async ({ name }: FormData) => {
-    try {
-      if (!popUpData?.identityId) return;
-
-      const newTokenData = await createToken({
-        identityId: popUpData.identityId,
-        name
-      });
-
-      setToken(newTokenData.accessToken);
-
-      createNotification({
-        text: "Successfully created token",
-        type: "success"
-      });
-    } catch (err) {
-      console.error(err);
-      createNotification({
-        text: "Failed to create token",
-        type: "error"
-      });
-    }
-  };
-
-  const hasToken = Boolean(token);
-
-  return (
-    <Modal
-      isOpen={popUp?.tokenList?.isOpen}
-      onOpenChange={(isOpen) => {
-        handlePopUpToggle("tokenList", isOpen);
-        reset();
-        setToken("");
-      }}
-    >
-      <ModalContent title={`Manage Access Tokens for ${popUpData?.name ?? ""}`}>
-        <h2 className="mb-4">New Token</h2>
-        {hasToken ? (
-          <div>
-            <div className="mb-4 flex items-center justify-between">
-              <p>We will only show this token once</p>
-              <Button
-                colorSchema="secondary"
-                type="submit"
-                onClick={() => {
-                  reset();
-                  setToken("");
-                }}
-              >
-                Got it
-              </Button>
-            </div>
-            <div className="mb-8 flex items-center justify-between rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-              <p className="mr-4 break-all">{token}</p>
-              <IconButton
-                ariaLabel="copy icon"
-                colorSchema="secondary"
-                className="group relative"
-                onClick={() => {
-                  navigator.clipboard.writeText(token);
-                  setIsClientSecretCopied.on();
-                }}
-              >
-                <FontAwesomeIcon icon={isClientSecretCopied ? faCheck : faCopy} />
-                <span className="absolute -left-8 -top-20 hidden w-28 translate-y-full rounded-md bg-bunker-800 py-2 pl-3 text-center text-sm text-gray-400 group-hover:flex group-hover:animate-fadeIn">
-                  {t("common.click-to-copy")}
-                </span>
-              </IconButton>
-            </div>
-          </div>
-        ) : (
-          <form onSubmit={handleSubmit(onFormSubmit)} className="mb-8">
-            <Controller
-              control={control}
-              name="name"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl label="Name" isError={Boolean(error)} errorText={error?.message}>
-                  <div className="flex">
-                    <Input {...field} placeholder="My Token" />
-                    <Button
-                      className="ml-4"
-                      size="sm"
-                      type="submit"
-                      isLoading={isSubmitting}
-                      isDisabled={isSubmitting}
-                    >
-                      Create
-                    </Button>
-                  </div>
-                </FormControl>
-              )}
-            />
-          </form>
-        )}
-        <h2 className="mb-4">Tokens</h2>
-        <TableContainer>
-          <Table>
-            <THead>
-              <Tr>
-                <Th>name</Th>
-                <Th>Num Uses</Th>
-                <Th>Created At</Th>
-                <Th>Max Expires At</Th>
-                <Th className="w-5" />
-              </Tr>
-            </THead>
-            <TBody>
-              {isLoading && <TableSkeleton columns={5} innerKey="identities-tokens" />}
-              {!isLoading &&
-                tokens?.map(
-                  ({
-                    id,
-                    createdAt,
-                    name,
-                    accessTokenNumUses,
-                    accessTokenNumUsesLimit,
-                    accessTokenMaxTTL,
-                    isAccessTokenRevoked
-                  }) => {
-                    const expiresAt = new Date(
-                      new Date(createdAt).getTime() + accessTokenMaxTTL * 1000
-                    );
-
-                    return (
-                      <Tr className="h-10 items-center" key={`mi-client-secret-${id}`}>
-                        <Td>{name === "" ? "-" : name}</Td>
-                        <Td>{`${accessTokenNumUses}${
-                          accessTokenNumUsesLimit ? `/${accessTokenNumUsesLimit}` : ""
-                        }`}</Td>
-                        <Td>{format(new Date(createdAt), "yyyy-MM-dd")}</Td>
-                        <Td>
-                          {isAccessTokenRevoked ? "Revoked" : `${format(expiresAt, "yyyy-MM-dd")}`}
-                        </Td>
-                        <Td>
-                          {!isAccessTokenRevoked && (
-                            <IconButton
-                              onClick={() => {
-                                handlePopUpOpen("revokeToken", {
-                                  identityId: popUpData?.identityId,
-                                  tokenId: id,
-                                  name
-                                });
-                              }}
-                              size="lg"
-                              colorSchema="primary"
-                              variant="plain"
-                              ariaLabel="update"
-                            >
-                              <FontAwesomeIcon icon={faXmark} />
-                            </IconButton>
-                          )}
-                        </Td>
-                      </Tr>
-                    );
-                  }
-                )}
-              {!isLoading && data && data?.length === 0 && (
-                <Tr>
-                  <Td colSpan={5}>
-                    <EmptyState
-                      title="No tokens have been created for this identity yet"
-                      icon={faKey}
-                    />
-                  </Td>
-                </Tr>
-              )}
-            </TBody>
-          </Table>
-        </TableContainer>
-      </ModalContent>
-    </Modal>
-  );
-};

frontend/src/views/Org/IdentityPage/components/IdentityTokenModal.tsx

@@ -1,183 +0,0 @@
-import { useEffect, useState } from "react";
-import { Controller, useForm } from "react-hook-form";
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import {
-  Button,
-  FormControl,
-  IconButton,
-  Input,
-  Modal,
-  ModalContent,
-  Tooltip
-} from "@app/components/v2";
-import { useTimedReset } from "@app/hooks";
-import { useCreateTokenIdentityTokenAuth, useUpdateTokenIdentityTokenAuth } from "@app/hooks/api";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-const schema = z
-  .object({
-    name: z.string()
-  })
-  .required();
-
-export type FormData = z.infer<typeof schema>;
-
-type Props = {
-  popUp: UsePopUpState<["token"]>;
-  handlePopUpToggle: (popUpName: keyof UsePopUpState<["token"]>, state?: boolean) => void;
-};
-
-export const IdentityTokenModal = ({ popUp, handlePopUpToggle }: Props) => {
-  const { mutateAsync: createToken } = useCreateTokenIdentityTokenAuth();
-  const { mutateAsync: updateToken } = useUpdateTokenIdentityTokenAuth();
-  const [token, setToken] = useState("");
-  const [copyTextToken, isCopyingToken, setCopyTextToken] = useTimedReset<string>({
-    initialState: "Copy to clipboard"
-  });
-  const hasToken = Boolean(token);
-
-  const {
-    control,
-    handleSubmit,
-    reset,
-    formState: { isSubmitting }
-  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      name: ""
-    }
-  });
-
-  const tokenData = popUp?.token?.data as {
-    identityId: string;
-    tokenId?: string;
-    name?: string;
-  };
-
-  useEffect(() => {
-    if (tokenData?.tokenId && tokenData?.name) {
-      reset({
-        name: tokenData.name
-      });
-    } else {
-      reset({
-        name: ""
-      });
-    }
-  }, [popUp?.token?.data]);
-
-  const onFormSubmit = async ({ name }: FormData) => {
-    try {
-      if (tokenData?.tokenId) {
-        // update
-
-        await updateToken({
-          identityId: tokenData.identityId,
-          tokenId: tokenData.tokenId,
-          name
-        });
-
-        handlePopUpToggle("token", false);
-      } else {
-        // create
-
-        const newTokenData = await createToken({
-          identityId: tokenData.identityId,
-          name
-        });
-
-        setToken(newTokenData.accessToken);
-        // note: may be helpful to tell user ttl etc.
-      }
-
-      createNotification({
-        text: `Successfully ${popUp?.token?.data ? "updated" : "created"} token`,
-        type: "success"
-      });
-
-      reset();
-    } catch (err) {
-      console.error(err);
-      const error = err as any;
-      const text =
-        error?.response?.data?.message ??
-        `Failed to ${popUp?.token?.data ? "update" : "create"} token`;
-
-      createNotification({
-        text,
-        type: "error"
-      });
-    }
-  };
-
-  return (
-    <Modal
-      isOpen={popUp?.token?.isOpen}
-      onOpenChange={(isOpen) => {
-        handlePopUpToggle("token", isOpen);
-        reset();
-        setToken("");
-      }}
-    >
-      <ModalContent
-        title={`${tokenData?.tokenId ? "Update" : "Create"} Access Token`}
-        subTitle={hasToken ? "We will only show this token once" : ""}
-      >
-        {!hasToken ? (
-          <form onSubmit={handleSubmit(onFormSubmit)}>
-            <Controller
-              control={control}
-              defaultValue=""
-              name="name"
-              render={({ field, fieldState: { error } }) => (
-                <FormControl label="Name" isError={Boolean(error)} errorText={error?.message}>
-                  <Input {...field} placeholder="My Token" />
-                </FormControl>
-              )}
-            />
-            <div className="flex items-center">
-              <Button
-                className="mr-4"
-                size="sm"
-                type="submit"
-                isLoading={isSubmitting}
-                isDisabled={isSubmitting}
-              >
-                {tokenData?.name ? "Update" : "Create"}
-              </Button>
-              <Button
-                colorSchema="secondary"
-                variant="plain"
-                onClick={() => handlePopUpToggle("token", false)}
-              >
-                Cancel
-              </Button>
-            </div>
-          </form>
-        ) : (
-          <div className="mt-2 mb-3 mr-2 flex items-center justify-end rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-            <p className="mr-4 break-all">{token}</p>
-            <Tooltip content={copyTextToken}>
-              <IconButton
-                ariaLabel="copy icon"
-                colorSchema="secondary"
-                className="group relative"
-                onClick={() => {
-                  navigator.clipboard.writeText(token);
-                  setCopyTextToken("Copied");
-                }}
-              >
-                <FontAwesomeIcon icon={isCopyingToken ? faCheck : faCopy} />
-              </IconButton>
-            </Tooltip>
-          </div>
-        )}
-      </ModalContent>
-    </Modal>
-  );
-};

frontend/src/views/Org/IdentityPage/components/index.tsx

@@ -1,6 +0,0 @@
-export { IdentityAuthenticationSection } from "./IdentityAuthenticationSection/IdentityAuthenticationSection";
-export { IdentityClientSecretModal } from "./IdentityClientSecretModal";
-export { IdentityDetailsSection } from "./IdentityDetailsSection";
-export { IdentityProjectsSection } from "./IdentityProjectsSection";
-export { IdentityTokenListModal } from "./IdentityTokenListModal";
-export { IdentityTokenModal } from "./IdentityTokenModal";

frontend/src/views/Org/IdentityPage/index.tsx

@@ -1 +0,0 @@
-export { IdentityPage } from "./IdentityPage";

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAuthMethodModal.tsx

@@ -18,7 +18,6 @@ import { IdentityAwsAuthForm } from "./IdentityAwsAuthForm";
 import { IdentityAzureAuthForm } from "./IdentityAzureAuthForm";
 import { IdentityGcpAuthForm } from "./IdentityGcpAuthForm";
 import { IdentityKubernetesAuthForm } from "./IdentityKubernetesAuthForm";
-import { IdentityTokenAuthForm } from "./IdentityTokenAuthForm";
 import { IdentityUniversalAuthForm } from "./IdentityUniversalAuthForm";
 
 type Props = {
@@ -31,7 +30,6 @@ type Props = {
 };
 
 const identityAuthMethods = [
-  { label: "Token Auth", value: IdentityAuthMethod.TOKEN_AUTH },
   { label: "Universal Auth", value: IdentityAuthMethod.UNIVERSAL_AUTH },
   { label: "Kubernetes Auth", value: IdentityAuthMethod.KUBERNETES_AUTH },
   { label: "GCP Auth", value: IdentityAuthMethod.GCP_AUTH },
@@ -119,16 +117,6 @@ export const IdentityAuthMethodModal = ({ popUp, handlePopUpOpen, handlePopUpTog
           />
         );
       }
-      case IdentityAuthMethod.TOKEN_AUTH: {
-        return (
-          <IdentityTokenAuthForm
-            handlePopUpOpen={handlePopUpOpen}
-            handlePopUpToggle={handlePopUpToggle}
-            identityAuthMethodData={identityAuthMethodData}
-          />
-        );
-      }
-
       default: {
         return <div />;
       }

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAwsAuthForm.tsx

@@ -10,9 +10,9 @@ import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityAwsAuth,
-  useDeleteIdentityAwsAuth,
   useGetIdentityAwsAuth,
-  useUpdateIdentityAwsAuth} from "@app/hooks/api";
+  useUpdateIdentityAwsAuth
+} from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -63,7 +63,6 @@ export const IdentityAwsAuthForm = ({
 
   const { mutateAsync: addMutateAsync } = useAddIdentityAwsAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityAwsAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityAwsAuth();
 
   const { data } = useGetIdentityAwsAuth(identityAuthMethodData?.identityId ?? "");
 
@@ -330,43 +329,23 @@ export const IdentityAwsAuthForm = ({
           Add IP Address
         </Button>
       </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
       </div>
     </form>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityAzureAuthForm.tsx

@@ -10,9 +10,9 @@ import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityAzureAuth,
-  useDeleteIdentityAzureAuth,
   useGetIdentityAzureAuth,
-  useUpdateIdentityAzureAuth} from "@app/hooks/api";
+  useUpdateIdentityAzureAuth
+} from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -61,7 +61,6 @@ export const IdentityAzureAuthForm = ({
 
   const { mutateAsync: addMutateAsync } = useAddIdentityAzureAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityAzureAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityAzureAuth();
 
   const { data } = useGetIdentityAzureAuth(identityAuthMethodData?.identityId ?? "");
 
@@ -328,43 +327,23 @@ export const IdentityAzureAuthForm = ({
           Add IP Address
         </Button>
       </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
       </div>
     </form>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityGcpAuthForm.tsx

@@ -10,9 +10,9 @@ import { Button, FormControl, IconButton, Input, Select, SelectItem } from "@app
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityGcpAuth,
-  useDeleteIdentityGcpAuth,
   useGetIdentityGcpAuth,
-  useUpdateIdentityGcpAuth} from "@app/hooks/api";
+  useUpdateIdentityGcpAuth
+} from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -62,7 +62,6 @@ export const IdentityGcpAuthForm = ({
 
   const { mutateAsync: addMutateAsync } = useAddIdentityGcpAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityGcpAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityGcpAuth();
 
   const { data } = useGetIdentityGcpAuth(identityAuthMethodData?.identityId ?? "");
 
@@ -362,43 +361,23 @@ export const IdentityGcpAuthForm = ({
           Add IP Address
         </Button>
       </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
       </div>
     </form>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityKubernetesAuthForm.tsx

@@ -10,13 +10,15 @@ import { Button, FormControl, IconButton, Input, TextArea } from "@app/component
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityKubernetesAuth,
-  useDeleteIdentityKubernetesAuth,
   useGetIdentityKubernetesAuth,
-  useUpdateIdentityKubernetesAuth} from "@app/hooks/api";
+  useUpdateIdentityKubernetesAuth
+} from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
+// TODO: Add CA cert and token reviewer JWT fields
+
 const schema = z
   .object({
     kubernetesHost: z.string(),
@@ -64,7 +66,6 @@ export const IdentityKubernetesAuthForm = ({
 
   const { mutateAsync: addMutateAsync } = useAddIdentityKubernetesAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityKubernetesAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityKubernetesAuth();
 
   const { data } = useGetIdentityKubernetesAuth(identityAuthMethodData?.identityId ?? "");
 
@@ -76,11 +77,11 @@ export const IdentityKubernetesAuthForm = ({
   } = useForm<FormData>({
     resolver: zodResolver(schema),
     defaultValues: {
-      kubernetesHost: "",
+      kubernetesHost: "", // TODO
       tokenReviewerJwt: "",
-      allowedNames: "",
-      allowedNamespaces: "",
-      allowedAudience: "",
+      allowedNames: "", // TODO
+      allowedNamespaces: "", // TODO
+      allowedAudience: "", // TODO
       caCert: "",
       accessTokenTTL: "2592000",
       accessTokenMaxTTL: "2592000",
@@ -117,7 +118,7 @@ export const IdentityKubernetesAuthForm = ({
       });
     } else {
       reset({
-        kubernetesHost: "",
+        kubernetesHost: "", // TODO
         tokenReviewerJwt: "",
         allowedNames: "",
         allowedNamespaces: "",
@@ -383,43 +384,23 @@ export const IdentityKubernetesAuthForm = ({
           Add IP Address
         </Button>
       </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
       </div>
     </form>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityModal.tsx

@@ -1,6 +1,5 @@
 import { useEffect } from "react";
 import { Controller, useForm } from "react-hook-form";
-import { useRouter } from "next/router";
 import { yupResolver } from "@hookform/resolvers/yup";
 import * as yup from "yup";
 
@@ -17,8 +16,8 @@ import {
 import { useOrganization } from "@app/context";
 import { useCreateIdentity, useGetOrgRoles, useUpdateIdentity } from "@app/hooks/api";
 import {
-  // IdentityAuthMethod,
-  useAddIdentityUniversalAuth
+  IdentityAuthMethod
+  // useAddIdentityUniversalAuth
 } from "@app/hooks/api/identities";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -33,19 +32,18 @@ export type FormData = yup.InferType<typeof schema>;
 
 type Props = {
   popUp: UsePopUpState<["identity"]>;
-  // handlePopUpOpen: (
-  //   popUpName: keyof UsePopUpState<["identityAuthMethod"]>,
-  //   data: {
-  //     identityId: string;
-  //     name: string;
-  //     authMethod?: IdentityAuthMethod;
-  //   }
-  // ) => void;
+  handlePopUpOpen: (
+    popUpName: keyof UsePopUpState<["identityAuthMethod"]>,
+    data: {
+      identityId: string;
+      name: string;
+      authMethod?: IdentityAuthMethod;
+    }
+  ) => void;
   handlePopUpToggle: (popUpName: keyof UsePopUpState<["identity"]>, state?: boolean) => void;
 };
 
-export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
-  const router = useRouter();
+export const IdentityModal = ({ popUp, handlePopUpOpen, handlePopUpToggle }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
 
@@ -53,7 +51,7 @@ export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
 
   const { mutateAsync: createMutateAsync } = useCreateIdentity();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentity();
-  const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth();
+  // const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth();
 
   const {
     control,
@@ -115,30 +113,32 @@ export const IdentityModal = ({ popUp, handlePopUpToggle }: Props) => {
       } else {
         // create
 
-        const { id: createdId } = await createMutateAsync({
+        const {
+          id: createdId,
+          name: createdName,
+          authMethod
+        } = await createMutateAsync({
           name,
           role: role || undefined,
           organizationId: orgId
         });
 
-        await addMutateAsync({
-          organizationId: orgId,
-          identityId: createdId,
-          clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
-          accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
-          accessTokenTTL: 2592000,
-          accessTokenMaxTTL: 2592000,
-          accessTokenNumUsesLimit: 0
-        });
+        // await addMutateAsync({
+        //   organizationId: orgId,
+        //   identityId: createdId,
+        //   clientSecretTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
+        //   accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }],
+        //   accessTokenTTL: 2592000,
+        //   accessTokenMaxTTL: 2592000,
+        //   accessTokenNumUsesLimit: 0
+        // });
 
         handlePopUpToggle("identity", false);
-        router.push(`/org/${orgId}/identities/${createdId}`);
-
-        // handlePopUpOpen("identityAuthMethod", {
-        //   identityId: createdId,
-        //   name: createdName,
-        //   authMethod
-        // });
+        handlePopUpOpen("identityAuthMethod", {
+          identityId: createdId,
+          name: createdName,
+          authMethod
+        });
       }
 
       createNotification({

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentitySection.tsx

@@ -18,8 +18,7 @@ import { usePopUp } from "@app/hooks/usePopUp";
 import { IdentityAuthMethodModal } from "./IdentityAuthMethodModal";
 import { IdentityModal } from "./IdentityModal";
 import { IdentityTable } from "./IdentityTable";
-import { IdentityTokenAuthTokenModal } from "./IdentityTokenAuthTokenModal";
-// import { IdentityUniversalAuthClientSecretModal } from "./IdentityUniversalAuthClientSecretModal";
+import { IdentityUniversalAuthClientSecretModal } from "./IdentityUniversalAuthClientSecretModal";
 
 export const IdentitySection = withPermission(
   () => {
@@ -34,8 +33,7 @@ export const IdentitySection = withPermission(
       "deleteIdentity",
       "universalAuthClientSecret",
       "deleteUniversalAuthClientSecret",
-      "upgradePlan",
-      "tokenAuthToken"
+      "upgradePlan"
     ] as const);
 
     const isMoreIdentitiesAllowed = subscription?.identityLimit
@@ -108,19 +106,22 @@ export const IdentitySection = withPermission(
             )}
           </OrgPermissionCan>
         </div>
-        <IdentityTable />
-        <IdentityModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        <IdentityTable handlePopUpOpen={handlePopUpOpen} />
+        <IdentityModal
+          popUp={popUp}
+          handlePopUpOpen={handlePopUpOpen}
+          handlePopUpToggle={handlePopUpToggle}
+        />
         <IdentityAuthMethodModal
           popUp={popUp}
           handlePopUpOpen={handlePopUpOpen}
           handlePopUpToggle={handlePopUpToggle}
         />
-        {/* <IdentityUniversalAuthClientSecretModal
+        <IdentityUniversalAuthClientSecretModal
           popUp={popUp}
           handlePopUpOpen={handlePopUpOpen}
           handlePopUpToggle={handlePopUpToggle}
-        /> */}
-        <IdentityTokenAuthTokenModal popUp={popUp} handlePopUpToggle={handlePopUpToggle} />
+        />
         <DeleteActionModal
           isOpen={popUp.deleteIdentity.isOpen}
           title={`Are you sure want to delete ${

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTable.tsx

@@ -1,11 +1,22 @@
-import Link from "next/link";
-import { useRouter } from "next/router";
-import { faEllipsis, faServer } from "@fortawesome/free-solid-svg-icons";
+import {
+  faCopy,
+  faEllipsis,
+  faKey,
+  faLock,
+  faPencil,
+  faServer,
+  faXmark
+} from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
+import { twMerge } from "tailwind-merge";
 
 import { createNotification } from "@app/components/notifications";
 import { OrgPermissionCan } from "@app/components/permissions";
 import {
+  DropdownMenu,
+  DropdownMenuContent,
+  DropdownMenuItem,
+  DropdownMenuTrigger,
   EmptyState,
   IconButton,
   Select,
@@ -17,13 +28,33 @@ import {
   Td,
   Th,
   THead,
+  Tooltip,
   Tr
 } from "@app/components/v2";
 import { OrgPermissionActions, OrgPermissionSubjects, useOrganization } from "@app/context";
 import { useGetIdentityMembershipOrgs, useGetOrgRoles, useUpdateIdentity } from "@app/hooks/api";
+import { IdentityAuthMethod, identityAuthToNameMap } from "@app/hooks/api/identities";
+import { UsePopUpState } from "@app/hooks/usePopUp";
 
-export const IdentityTable = () => {
-  const router = useRouter();
+type Props = {
+  handlePopUpOpen: (
+    popUpName: keyof UsePopUpState<
+      ["deleteIdentity", "identity", "universalAuthClientSecret", "identityAuthMethod"]
+    >,
+    data?: {
+      identityId?: string;
+      name?: string;
+      authMethod?: string;
+      role?: string;
+      customRole?: {
+        name: string;
+        slug: string;
+      };
+    }
+  ) => void;
+};
+
+export const IdentityTable = ({ handlePopUpOpen }: Props) => {
   const { currentOrg } = useOrganization();
   const orgId = currentOrg?.id || "";
 
@@ -63,6 +94,7 @@ export const IdentityTable = () => {
           <Tr>
             <Th>Name</Th>
             <Th>Role</Th>
+            <Th>Auth Method</Th>
             <Th className="w-5" />
           </Tr>
         </THead>
@@ -71,12 +103,10 @@ export const IdentityTable = () => {
           {!isLoading &&
             data &&
             data.length > 0 &&
-            data.map(({ identity: { id, name }, role, customRole }) => {
+            data.map(({ identity: { id, name, authMethod }, role, customRole }) => {
               return (
                 <Tr className="h-10" key={`identity-${id}`}>
-                  <Td>
-                    <Link href={`/org/${orgId}/identities/${id}`}>{name}</Link>
-                  </Td>
+                  <Td>{name}</Td>
                   <Td>
                     <OrgPermissionCan
                       I={OrgPermissionActions.Edit}
@@ -106,16 +136,124 @@ export const IdentityTable = () => {
                       }}
                     </OrgPermissionCan>
                   </Td>
+                  <Td>{authMethod ? identityAuthToNameMap[authMethod] : "Not configured"}</Td>
                   <Td>
                     <div className="flex items-center justify-end space-x-4">
-                      <IconButton
-                        ariaLabel="copy icon"
-                        variant="plain"
-                        className="group relative"
-                        onClick={() => router.push(`/org/${orgId}/identities/${id}`)}
+                      {authMethod === IdentityAuthMethod.UNIVERSAL_AUTH && (
+                        <Tooltip content="Manage client ID/secrets">
+                          <IconButton
+                            onClick={async () => {
+                              handlePopUpOpen("universalAuthClientSecret", {
+                                identityId: id,
+                                name
+                              });
+                            }}
+                            size="lg"
+                            colorSchema="primary"
+                            variant="plain"
+                            ariaLabel="update"
+                          >
+                            <FontAwesomeIcon icon={faKey} />
+                          </IconButton>
+                        </Tooltip>
+                      )}
+                      <OrgPermissionCan
+                        I={OrgPermissionActions.Edit}
+                        a={OrgPermissionSubjects.Identity}
                       >
-                        <FontAwesomeIcon icon={faEllipsis} />
-                      </IconButton>
+                        {(isAllowed) => (
+                          <Tooltip content="Manage auth method">
+                            <IconButton
+                              onClick={async () => {
+                                handlePopUpOpen("identityAuthMethod", {
+                                  identityId: id,
+                                  name,
+                                  authMethod
+                                });
+                              }}
+                              size="lg"
+                              colorSchema="primary"
+                              variant="plain"
+                              ariaLabel="update"
+                              isDisabled={!isAllowed}
+                            >
+                              <FontAwesomeIcon icon={faLock} />
+                            </IconButton>
+                          </Tooltip>
+                        )}
+                      </OrgPermissionCan>
+                      <DropdownMenu>
+                        <DropdownMenuTrigger asChild className="rounded-lg">
+                          <div className="hover:text-primary-400 data-[state=open]:text-primary-400">
+                            <Tooltip content="More options">
+                              <FontAwesomeIcon size="lg" icon={faEllipsis} />
+                            </Tooltip>
+                          </div>
+                        </DropdownMenuTrigger>
+                        <DropdownMenuContent align="start" className="p-1">
+                          <OrgPermissionCan
+                            I={OrgPermissionActions.Edit}
+                            a={OrgPermissionSubjects.Identity}
+                          >
+                            {(isAllowed) => (
+                              <DropdownMenuItem
+                                className={twMerge(
+                                  !isAllowed && "pointer-events-none cursor-not-allowed opacity-50"
+                                )}
+                                onClick={async () => {
+                                  if (!isAllowed) return;
+                                  handlePopUpOpen("identity", {
+                                    identityId: id,
+                                    name,
+                                    role,
+                                    customRole
+                                  });
+                                }}
+                                disabled={!isAllowed}
+                                icon={<FontAwesomeIcon icon={faPencil} />}
+                              >
+                                Update identity
+                              </DropdownMenuItem>
+                            )}
+                          </OrgPermissionCan>
+                          <OrgPermissionCan
+                            I={OrgPermissionActions.Delete}
+                            a={OrgPermissionSubjects.Identity}
+                          >
+                            {(isAllowed) => (
+                              <DropdownMenuItem
+                                className={twMerge(
+                                  isAllowed
+                                    ? "hover:!bg-red-500 hover:!text-white"
+                                    : "pointer-events-none cursor-not-allowed opacity-50"
+                                )}
+                                onClick={() => {
+                                  if (!isAllowed) return;
+                                  handlePopUpOpen("deleteIdentity", {
+                                    identityId: id,
+                                    name
+                                  });
+                                }}
+                                icon={<FontAwesomeIcon icon={faXmark} />}
+                              >
+                                Delete identity
+                              </DropdownMenuItem>
+                            )}
+                          </OrgPermissionCan>
+                          <DropdownMenuItem
+                            onClick={() => {
+                              navigator.clipboard.writeText(id);
+                              createNotification({
+                                text: "Copied identity internal ID to clipboard",
+                                type: "success"
+                              });
+                            }}
+                            icon={<FontAwesomeIcon icon={faCopy} />}
+                          >
+                            Copy Identity ID
+                          </DropdownMenuItem>
+                        </DropdownMenuContent>
+                      </DropdownMenu>
                     </div>
                   </Td>
                 </Tr>

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthForm.tsx

@@ -1,283 +0,0 @@
-import { Controller, useFieldArray, useForm } from "react-hook-form";
-import { faPlus, faXmark } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-import { zodResolver } from "@hookform/resolvers/zod";
-import { z } from "zod";
-
-import { createNotification } from "@app/components/notifications";
-import { Button, FormControl, IconButton, Input } from "@app/components/v2";
-import { useOrganization, useSubscription } from "@app/context";
-import {
-  useAddIdentityTokenAuth,
-  useDeleteIdentityTokenAuth,
-  useGetIdentityTokenAuth,
-  useUpdateIdentityTokenAuth} from "@app/hooks/api";
-import { IdentityAuthMethod } from "@app/hooks/api/identities";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-const schema = z
-  .object({
-    accessTokenTTL: z.string(),
-    accessTokenMaxTTL: z.string(),
-    accessTokenNumUsesLimit: z.string(),
-    accessTokenTrustedIps: z
-      .array(
-        z.object({
-          ipAddress: z.string().max(50)
-        })
-      )
-      .min(1)
-  })
-  .required();
-
-export type FormData = z.infer<typeof schema>;
-
-type Props = {
-  handlePopUpOpen: (popUpName: keyof UsePopUpState<["upgradePlan"]>) => void;
-  handlePopUpToggle: (
-    popUpName: keyof UsePopUpState<["identityAuthMethod"]>,
-    state?: boolean
-  ) => void;
-  identityAuthMethodData: {
-    identityId: string;
-    name: string;
-    authMethod?: IdentityAuthMethod;
-  };
-};
-
-export const IdentityTokenAuthForm = ({
-  handlePopUpOpen,
-  handlePopUpToggle,
-  identityAuthMethodData
-}: Props) => {
-  const { currentOrg } = useOrganization();
-  const orgId = currentOrg?.id || "";
-  const { subscription } = useSubscription();
-
-  const { mutateAsync: addMutateAsync } = useAddIdentityTokenAuth();
-  const { mutateAsync: updateMutateAsync } = useUpdateIdentityTokenAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityTokenAuth();
-
-  const { data } = useGetIdentityTokenAuth(identityAuthMethodData?.identityId ?? "");
-
-  const {
-    control,
-    handleSubmit,
-    reset,
-    formState: { isSubmitting }
-  } = useForm<FormData>({
-    resolver: zodResolver(schema),
-    defaultValues: {
-      accessTokenTTL: "2592000",
-      accessTokenMaxTTL: "2592000",
-      accessTokenNumUsesLimit: "0",
-      accessTokenTrustedIps: [{ ipAddress: "0.0.0.0/0" }, { ipAddress: "::/0" }]
-    }
-  });
-
-  const {
-    fields: accessTokenTrustedIpsFields,
-    append: appendAccessTokenTrustedIp,
-    remove: removeAccessTokenTrustedIp
-  } = useFieldArray({ control, name: "accessTokenTrustedIps" });
-
-  const onFormSubmit = async ({
-    accessTokenTTL,
-    accessTokenMaxTTL,
-    accessTokenNumUsesLimit,
-    accessTokenTrustedIps
-  }: FormData) => {
-    try {
-      if (!identityAuthMethodData) return;
-
-      if (data) {
-        await updateMutateAsync({
-          organizationId: orgId,
-          identityId: identityAuthMethodData.identityId,
-          accessTokenTTL: Number(accessTokenTTL),
-          accessTokenMaxTTL: Number(accessTokenMaxTTL),
-          accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
-          accessTokenTrustedIps
-        });
-      } else {
-        await addMutateAsync({
-          organizationId: orgId,
-          identityId: identityAuthMethodData.identityId,
-          accessTokenTTL: Number(accessTokenTTL),
-          accessTokenMaxTTL: Number(accessTokenMaxTTL),
-          accessTokenNumUsesLimit: Number(accessTokenNumUsesLimit),
-          accessTokenTrustedIps
-        });
-      }
-
-      handlePopUpToggle("identityAuthMethod", false);
-
-      createNotification({
-        text: `Successfully ${
-          identityAuthMethodData?.authMethod ? "updated" : "configured"
-        } auth method`,
-        type: "success"
-      });
-
-      reset();
-    } catch (err) {
-      createNotification({
-        text: `Failed to ${identityAuthMethodData?.authMethod ? "update" : "configure"} identity`,
-        type: "error"
-      });
-    }
-  };
-
-  return (
-    <form onSubmit={handleSubmit(onFormSubmit)}>
-      <Controller
-        control={control}
-        defaultValue="2592000"
-        name="accessTokenTTL"
-        render={({ field, fieldState: { error } }) => (
-          <FormControl
-            label="Access Token TTL (seconds)"
-            isError={Boolean(error)}
-            errorText={error?.message}
-          >
-            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-          </FormControl>
-        )}
-      />
-      <Controller
-        control={control}
-        defaultValue="2592000"
-        name="accessTokenMaxTTL"
-        render={({ field, fieldState: { error } }) => (
-          <FormControl
-            label="Access Token Max TTL (seconds)"
-            isError={Boolean(error)}
-            errorText={error?.message}
-          >
-            <Input {...field} placeholder="2592000" type="number" min="1" step="1" />
-          </FormControl>
-        )}
-      />
-      <Controller
-        control={control}
-        defaultValue="0"
-        name="accessTokenNumUsesLimit"
-        render={({ field, fieldState: { error } }) => (
-          <FormControl
-            label="Access Token Max Number of Uses"
-            isError={Boolean(error)}
-            errorText={error?.message}
-          >
-            <Input {...field} placeholder="0" type="number" min="0" step="1" />
-          </FormControl>
-        )}
-      />
-      {accessTokenTrustedIpsFields.map(({ id }, index) => (
-        <div className="mb-3 flex items-end space-x-2" key={id}>
-          <Controller
-            control={control}
-            name={`accessTokenTrustedIps.${index}.ipAddress`}
-            defaultValue="0.0.0.0/0"
-            render={({ field, fieldState: { error } }) => {
-              return (
-                <FormControl
-                  className="mb-0 flex-grow"
-                  label={index === 0 ? "Access Token Trusted IPs" : undefined}
-                  isError={Boolean(error)}
-                  errorText={error?.message}
-                >
-                  <Input
-                    value={field.value}
-                    onChange={(e) => {
-                      if (subscription?.ipAllowlisting) {
-                        field.onChange(e);
-                        return;
-                      }
-
-                      handlePopUpOpen("upgradePlan");
-                    }}
-                    placeholder="123.456.789.0"
-                  />
-                </FormControl>
-              );
-            }}
-          />
-          <IconButton
-            onClick={() => {
-              if (subscription?.ipAllowlisting) {
-                removeAccessTokenTrustedIp(index);
-                return;
-              }
-
-              handlePopUpOpen("upgradePlan");
-            }}
-            size="lg"
-            colorSchema="danger"
-            variant="plain"
-            ariaLabel="update"
-            className="p-3"
-          >
-            <FontAwesomeIcon icon={faXmark} />
-          </IconButton>
-        </div>
-      ))}
-      <div className="my-4 ml-1">
-        <Button
-          variant="outline_bg"
-          onClick={() => {
-            if (subscription?.ipAllowlisting) {
-              appendAccessTokenTrustedIp({
-                ipAddress: "0.0.0.0/0"
-              });
-              return;
-            }
-
-            handlePopUpOpen("upgradePlan");
-          }}
-          leftIcon={<FontAwesomeIcon icon={faPlus} />}
-          size="xs"
-        >
-          Add IP Address
-        </Button>
-      </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
-      </div>
-    </form>
-  );
-};

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityTokenAuthTokenModal.tsx

@@ -1,53 +0,0 @@
-import { faCheck, faCopy } from "@fortawesome/free-solid-svg-icons";
-import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
-
-import { IconButton, Modal, ModalContent, Tooltip } from "@app/components/v2";
-import { useTimedReset } from "@app/hooks";
-import { UsePopUpState } from "@app/hooks/usePopUp";
-
-type Props = {
-  popUp: UsePopUpState<["tokenAuthToken"]>;
-  handlePopUpToggle: (popUpName: keyof UsePopUpState<["tokenAuthToken"]>, state?: boolean) => void;
-};
-
-export const IdentityTokenAuthTokenModal = ({ popUp, handlePopUpToggle }: Props) => {
-  const [copyTextAccessToken, isCopyingAccessToken, setCopyTextAccessToken] = useTimedReset<string>(
-    {
-      initialState: "Copy to clipboard"
-    }
-  );
-
-  const popUpData = popUp?.tokenAuthToken?.data as {
-    accessToken: string;
-  };
-
-  return (
-    <Modal
-      isOpen={popUp?.tokenAuthToken?.isOpen}
-      onOpenChange={(isOpen) => {
-        handlePopUpToggle("tokenAuthToken", isOpen);
-      }}
-    >
-      <ModalContent title="Access Token">
-        {popUpData?.accessToken && (
-          <div className="mb-8 flex items-center justify-between rounded-md bg-white/[0.07] p-2 text-base text-gray-400">
-              <p className="mr-4 break-all">{popUpData.accessToken}</p>
-              <Tooltip content={copyTextAccessToken}>
-                <IconButton
-                  ariaLabel="copy icon"
-                  colorSchema="secondary"
-                  className="group relative"
-                  onClick={() => {
-                    navigator.clipboard.writeText(popUpData.accessToken);
-                    setCopyTextAccessToken("Copied");
-                  }}
-                >
-                  <FontAwesomeIcon icon={isCopyingAccessToken ? faCheck : faCopy} />
-                </IconButton>
-              </Tooltip>
-            </div>
-        )}
-      </ModalContent>
-    </Modal>
-  );
-};

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthClientSecretModal.tsx

@@ -10,7 +10,7 @@ import * as yup from "yup";
 import { createNotification } from "@app/components/notifications";
 import {
   Button,
-  // DeleteActionModal,
+  DeleteActionModal,
   EmptyState,
   FormControl,
   IconButton,
@@ -30,7 +30,8 @@ import { useToggle } from "@app/hooks";
 import {
   useCreateIdentityUniversalAuthClientSecret,
   useGetIdentityUniversalAuth,
-  useGetIdentityUniversalAuthClientSecrets
+  useGetIdentityUniversalAuthClientSecrets,
+  useRevokeIdentityUniversalAuthClientSecret
 } from "@app/hooks/api";
 import { UsePopUpState } from "@app/hooks/usePopUp";
 
@@ -43,16 +44,18 @@ const schema = yup.object({
 export type FormData = yup.InferType<typeof schema>;
 
 type Props = {
-  popUp: UsePopUpState<["universalAuthClientSecret", "revokeClientSecret"]>;
+  popUp: UsePopUpState<["universalAuthClientSecret", "deleteUniversalAuthClientSecret"]>;
   handlePopUpOpen: (
-    popUpName: keyof UsePopUpState<["revokeClientSecret"]>,
+    popUpName: keyof UsePopUpState<["deleteUniversalAuthClientSecret"]>,
     data?: {
       clientSecretPrefix: string;
       clientSecretId: string;
     }
   ) => void;
   handlePopUpToggle: (
-    popUpName: keyof UsePopUpState<["universalAuthClientSecret", "revokeClientSecret"]>,
+    popUpName: keyof UsePopUpState<
+      ["universalAuthClientSecret", "deleteUniversalAuthClientSecret"]
+    >,
     state?: boolean
   ) => void;
 };
@@ -63,7 +66,7 @@ export const IdentityUniversalAuthClientSecretModal = ({
   handlePopUpToggle
 }: Props) => {
   const { t } = useTranslation();
-
+  
   const [token, setToken] = useState("");
   const [isClientSecretCopied, setIsClientSecretCopied] = useToggle(false);
   const [isClientIdCopied, setIsClientIdCopied] = useToggle(false);
@@ -78,6 +81,8 @@ export const IdentityUniversalAuthClientSecretModal = ({
 
   const { mutateAsync: createClientSecretMutateAsync } =
     useCreateIdentityUniversalAuthClientSecret();
+  const { mutateAsync: revokeClientSecretMutateAsync } =
+    useRevokeIdentityUniversalAuthClientSecret();
 
   const {
     control,
@@ -137,6 +142,41 @@ export const IdentityUniversalAuthClientSecretModal = ({
     }
   };
 
+  const onDeleteClientSecretSubmit = async ({
+    clientSecretId,
+    clientSecretPrefix
+  }: {
+    clientSecretId: string;
+    clientSecretPrefix: string;
+  }) => {
+    try {
+      if (!popUpData?.identityId) return;
+
+      await revokeClientSecretMutateAsync({
+        identityId: popUpData.identityId,
+        clientSecretId
+      });
+
+      if (token.startsWith(clientSecretPrefix)) {
+        reset();
+        setToken("");
+      }
+
+      handlePopUpToggle("deleteUniversalAuthClientSecret", false);
+
+      createNotification({
+        text: "Successfully deleted client secret",
+        type: "success"
+      });
+    } catch (err) {
+      console.error(err);
+      createNotification({
+        text: "Failed to delete client secret",
+        type: "error"
+      });
+    }
+  };
+
   const hasToken = Boolean(token);
 
   return (
@@ -306,7 +346,7 @@ export const IdentityUniversalAuthClientSecretModal = ({
                         <Td>
                           <IconButton
                             onClick={() => {
-                              handlePopUpOpen("revokeClientSecret", {
+                              handlePopUpOpen("deleteUniversalAuthClientSecret", {
                                 clientSecretPrefix,
                                 clientSecretId: id
                               });
@@ -336,6 +376,26 @@ export const IdentityUniversalAuthClientSecretModal = ({
             </TBody>
           </Table>
         </TableContainer>
+        <DeleteActionModal
+          isOpen={popUp.deleteUniversalAuthClientSecret.isOpen}
+          title={`Are you sure want to delete the client secret ${
+            (popUp?.deleteUniversalAuthClientSecret?.data as { clientSecretPrefix: string })
+              ?.clientSecretPrefix || ""
+          }************?`}
+          onChange={(isOpen) => handlePopUpToggle("deleteUniversalAuthClientSecret", isOpen)}
+          deleteKey="confirm"
+          onDeleteApproved={() => {
+            const deleteClientSecretData = popUp?.deleteUniversalAuthClientSecret?.data as {
+              clientSecretId: string;
+              clientSecretPrefix: string;
+            };
+
+            return onDeleteClientSecretSubmit({
+              clientSecretId: deleteClientSecretData.clientSecretId,
+              clientSecretPrefix: deleteClientSecretData.clientSecretPrefix
+            });
+          }}
+        />
       </ModalContent>
     </Modal>
   );

frontend/src/views/Org/MembersPage/components/OrgIdentityTab/components/IdentitySection/IdentityUniversalAuthForm.tsx

@@ -10,9 +10,9 @@ import { Button, FormControl, IconButton, Input } from "@app/components/v2";
 import { useOrganization, useSubscription } from "@app/context";
 import {
   useAddIdentityUniversalAuth,
-  useDeleteIdentityUniversalAuth,
   useGetIdentityUniversalAuth,
-  useUpdateIdentityUniversalAuth} from "@app/hooks/api";
+  useUpdateIdentityUniversalAuth
+} from "@app/hooks/api";
 import { IdentityAuthMethod } from "@app/hooks/api/identities";
 import { IdentityTrustedIp } from "@app/hooks/api/identities/types";
 import { UsePopUpState } from "@app/hooks/usePopUp";
@@ -68,7 +68,6 @@ export const IdentityUniversalAuthForm = ({
   const { subscription } = useSubscription();
   const { mutateAsync: addMutateAsync } = useAddIdentityUniversalAuth();
   const { mutateAsync: updateMutateAsync } = useUpdateIdentityUniversalAuth();
-  const { mutateAsync: deleteMutateAsync } = useDeleteIdentityUniversalAuth();
   const { data } = useGetIdentityUniversalAuth(identityAuthMethodData?.identityId ?? "");
 
   const {
@@ -369,43 +368,23 @@ export const IdentityUniversalAuthForm = ({
           Add IP Address
         </Button>
       </div>
-      <div className="flex justify-between">
-        <div className="flex items-center">
-          <Button
-            className="mr-4"
-            size="sm"
-            type="submit"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-          >
-            {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
-          </Button>
-          <Button
-            colorSchema="secondary"
-            variant="plain"
-            onClick={() => handlePopUpToggle("identityAuthMethod", false)}
-          >
-            {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
-          </Button>
-        </div>
-        {identityAuthMethodData?.authMethod && (
-          <Button
-            size="sm"
-            colorSchema="danger"
-            isLoading={isSubmitting}
-            isDisabled={isSubmitting}
-            onClick={async () => {
-              await deleteMutateAsync({
-                identityId: identityAuthMethodData.identityId,
-                organizationId: orgId
-              });
-
-              handlePopUpToggle("identityAuthMethod", false);
-            }}
-          >
-            Remove Auth Method
-          </Button>
-        )}
+      <div className="flex items-center">
+        <Button
+          className="mr-4"
+          size="sm"
+          type="submit"
+          isLoading={isSubmitting}
+          isDisabled={isSubmitting}
+        >
+          {identityAuthMethodData?.authMethod ? "Update" : "Configure"}
+        </Button>
+        <Button
+          colorSchema="secondary"
+          variant="plain"
+          onClick={() => handlePopUpToggle("identityAuthMethod", false)}
+        >
+          {identityAuthMethodData?.authMethod ? "Cancel" : "Skip"}
+        </Button>
       </div>
     </form>
   );

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgAuthTab.tsx

@@ -1,5 +1,6 @@
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context";
+import { OrgPermissionActions, OrgPermissionSubjects, useServerConfig } from "@app/context";
 import { withPermission } from "@app/hoc";
+import { LoginMethod } from "@app/hooks/api/admin/types";
 
 import { OrgGeneralAuthSection } from "./OrgGeneralAuthSection";
 import { OrgLDAPSection } from "./OrgLDAPSection";
@@ -9,12 +10,23 @@ import { OrgSSOSection } from "./OrgSSOSection";
 
 export const OrgAuthTab = withPermission(
   () => {
+    const {
+      config: { enabledLoginMethods }
+    } = useServerConfig();
+
+    const shouldDisplaySection = (method: LoginMethod) =>
+      !enabledLoginMethods || enabledLoginMethods.includes(method);
+
     return (
       <div className="rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-6">
-        <OrgGeneralAuthSection />
-        <OrgSSOSection />
-        <OrgOIDCSection />
-        <OrgLDAPSection />
+        {shouldDisplaySection(LoginMethod.SAML) && (
+          <>
+            <OrgGeneralAuthSection />
+            <OrgSSOSection />
+          </>
+        )}
+        {shouldDisplaySection(LoginMethod.OIDC) && <OrgOIDCSection />}
+        {shouldDisplaySection(LoginMethod.LDAP) && <OrgLDAPSection />}
         <OrgScimSection />
       </div>
     );

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgGeneralAuthSection.tsx

@@ -11,7 +11,6 @@ import { useLogoutUser, useUpdateOrg } from "@app/hooks/api";
 import { usePopUp } from "@app/hooks/usePopUp";
 
 export const OrgGeneralAuthSection = () => {
-  
   const { currentOrg } = useOrganization();
   const { subscription } = useSubscription();
   const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp(["upgradePlan"] as const);
@@ -88,6 +87,7 @@ export const OrgGeneralAuthSection = () => {
           Enforce members to authenticate via SAML to access this organization
         </p>
       </div>
+      <hr className="border-mineshaft-600" />
       <UpgradePlanModal
         isOpen={popUp.upgradePlan.isOpen}
         onOpenChange={(isOpen) => handlePopUpToggle("upgradePlan", isOpen)}

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgLDAPSection.tsx

@@ -95,7 +95,6 @@ export const OrgLDAPSection = (): JSX.Element => {
 
   return (
     <>
-      <hr className="border-mineshaft-600" />
       <div className="py-4">
         <div className="mb-2 flex items-center justify-between">
           <h2 className="text-md text-mineshaft-100">LDAP</h2>
@@ -152,6 +151,7 @@ export const OrgLDAPSection = (): JSX.Element => {
           </p>
         </div>
       )}
+      <hr className="border-mineshaft-600" />
       <LDAPModal
         popUp={popUp}
         handlePopUpClose={handlePopUpClose}

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgOIDCSection.tsx

@@ -61,7 +61,6 @@ export const OrgOIDCSection = (): JSX.Element => {
 
   return (
     <>
-      <hr className="border-mineshaft-600" />
       <div className="py-4">
         <div className="mb-2 flex items-center justify-between">
           <h2 className="text-md text-mineshaft-100">OIDC</h2>
@@ -103,6 +102,7 @@ export const OrgOIDCSection = (): JSX.Element => {
           </p>
         </div>
       )}
+      <hr className="border-mineshaft-600" />
       <OIDCModal
         popUp={popUp}
         handlePopUpClose={handlePopUpClose}

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgSCIMSection.tsx

@@ -13,7 +13,6 @@ import { usePopUp } from "@app/hooks/usePopUp";
 import { ScimTokenModal } from "./ScimTokenModal";
 
 export const OrgScimSection = () => {
-  
   const { currentOrg } = useOrganization();
   const { subscription } = useSubscription();
   const { popUp, handlePopUpOpen, handlePopUpToggle } = usePopUp([
@@ -59,7 +58,6 @@ export const OrgScimSection = () => {
 
   return (
     <>
-      <hr className="border-mineshaft-600" />
       <div className="py-4">
         <div className="mb-2 flex items-center justify-between">
           <h2 className="text-md text-mineshaft-100">SCIM</h2>

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/OrgSSOSection.tsx

@@ -15,7 +15,7 @@ import { SSOModal } from "./SSOModal";
 export const OrgSSOSection = (): JSX.Element => {
   const { currentOrg } = useOrganization();
   const { subscription } = useSubscription();
-  
+
   const { data, isLoading } = useGetSSOConfig(currentOrg?.id ?? "");
   const { mutateAsync } = useUpdateSSOConfig();
   const { popUp, handlePopUpOpen, handlePopUpClose, handlePopUpToggle } = usePopUp([
@@ -115,6 +115,7 @@ export const OrgSSOSection = (): JSX.Element => {
           Allow members to authenticate into Infisical with SAML
         </p>
       </div>
+      <hr className="border-mineshaft-600" />
       <SSOModal
         popUp={popUp}
         handlePopUpClose={handlePopUpClose}

frontend/src/views/Settings/PersonalSettingsPage/AuthMethodSection/AuthMethodSection.tsx

@@ -8,23 +8,24 @@ import * as yup from "yup";
 
 import { createNotification } from "@app/components/notifications";
 import { Switch } from "@app/components/v2";
-import { useUser } from "@app/context";
+import { useServerConfig, useUser } from "@app/context";
 import { useUpdateUserAuthMethods } from "@app/hooks/api";
+import { LoginMethod } from "@app/hooks/api/admin/types";
 import { AuthMethod } from "@app/hooks/api/users/types";
 
 interface AuthMethodOption {
   label: string;
   value: AuthMethod;
   icon: IconDefinition;
+  loginMethod: LoginMethod;
 }
 
 const authMethodOpts: AuthMethodOption[] = [
-  { label: "Email", value: AuthMethod.EMAIL, icon: faEnvelope },
-  { label: "Google", value: AuthMethod.GOOGLE, icon: faGoogle },
-  { label: "GitHub", value: AuthMethod.GITHUB, icon: faGithub },
-  { label: "GitLab", value: AuthMethod.GITLAB, icon: faGitlab }
+  { label: "Email", value: AuthMethod.EMAIL, icon: faEnvelope, loginMethod: LoginMethod.EMAIL },
+  { label: "Google", value: AuthMethod.GOOGLE, icon: faGoogle, loginMethod: LoginMethod.GOOGLE },
+  { label: "GitHub", value: AuthMethod.GITHUB, icon: faGithub, loginMethod: LoginMethod.GITHUB },
+  { label: "GitLab", value: AuthMethod.GITLAB, icon: faGitlab, loginMethod: LoginMethod.GITLAB }
 ];
-
 const schema = yup.object({
   authMethods: yup.array().required("Auth method is required")
 });
@@ -32,8 +33,8 @@ const schema = yup.object({
 export type FormData = yup.InferType<typeof schema>;
 
 export const AuthMethodSection = () => {
-  
   const { user } = useUser();
+  const { config } = useServerConfig();
   const { mutateAsync } = useUpdateUserAuthMethods();
 
   const { reset, setValue, watch } = useForm<FormData>({
@@ -102,6 +103,14 @@ export const AuthMethodSection = () => {
       <div className="mb-4">
         {user &&
           authMethodOpts.map((authMethodOpt) => {
+            // only filter when enabledLoginMethods is explicitly configured by admin
+            if (
+              config.enabledLoginMethods &&
+              !config.enabledLoginMethods.includes(authMethodOpt.loginMethod)
+            ) {
+              return null;
+            }
+
             return (
               <div className="flex items-center p-4" key={`auth-method-${authMethodOpt.value}`}>
                 <div className="flex items-center">

frontend/src/views/admin/DashboardPage/AuthPanel.tsx

@@ -0,0 +1,252 @@
+import { Controller, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import { z } from "zod";
+
+import { createNotification } from "@app/components/notifications";
+import { Button, FormControl, Switch } from "@app/components/v2";
+import { useServerConfig } from "@app/context";
+import { useUpdateServerConfig } from "@app/hooks/api";
+import { LoginMethod } from "@app/hooks/api/admin/types";
+
+const formSchema = z.object({
+  isEmailEnabled: z.boolean(),
+  isGoogleEnabled: z.boolean(),
+  isGithubEnabled: z.boolean(),
+  isGitlabEnabled: z.boolean(),
+  isSamlEnabled: z.boolean(),
+  isLdapEnabled: z.boolean(),
+  isOidcEnabled: z.boolean()
+});
+
+type TAuthForm = z.infer<typeof formSchema>;
+
+export const AuthPanel = () => {
+  const { config } = useServerConfig();
+  const { enabledLoginMethods } = config;
+  const { mutateAsync: updateServerConfig } = useUpdateServerConfig();
+
+  const {
+    control,
+    handleSubmit,
+    formState: { isSubmitting, isDirty }
+  } = useForm<TAuthForm>({
+    resolver: zodResolver(formSchema),
+    // if not yet explicitly defined by the admin, all login methods should be enabled by default
+    values: enabledLoginMethods
+      ? {
+          isEmailEnabled: enabledLoginMethods.includes(LoginMethod.EMAIL),
+          isGoogleEnabled: enabledLoginMethods.includes(LoginMethod.GOOGLE),
+          isGithubEnabled: enabledLoginMethods.includes(LoginMethod.GITHUB),
+          isGitlabEnabled: enabledLoginMethods.includes(LoginMethod.GITLAB),
+          isSamlEnabled: enabledLoginMethods.includes(LoginMethod.SAML),
+          isLdapEnabled: enabledLoginMethods.includes(LoginMethod.LDAP),
+          isOidcEnabled: enabledLoginMethods.includes(LoginMethod.OIDC)
+        }
+      : {
+          isEmailEnabled: true,
+          isGoogleEnabled: true,
+          isGithubEnabled: true,
+          isGitlabEnabled: true,
+          isSamlEnabled: true,
+          isLdapEnabled: true,
+          isOidcEnabled: true
+        }
+  });
+
+  const onAuthFormSubmit = async (formData: TAuthForm) => {
+    try {
+      const enabledMethods: LoginMethod[] = [];
+      if (formData.isEmailEnabled) {
+        enabledMethods.push(LoginMethod.EMAIL);
+      }
+
+      if (formData.isGoogleEnabled) {
+        enabledMethods.push(LoginMethod.GOOGLE);
+      }
+
+      if (formData.isGithubEnabled) {
+        enabledMethods.push(LoginMethod.GITHUB);
+      }
+
+      if (formData.isGitlabEnabled) {
+        enabledMethods.push(LoginMethod.GITLAB);
+      }
+
+      if (formData.isSamlEnabled) {
+        enabledMethods.push(LoginMethod.SAML);
+      }
+
+      if (formData.isLdapEnabled) {
+        enabledMethods.push(LoginMethod.LDAP);
+      }
+
+      if (formData.isOidcEnabled) {
+        enabledMethods.push(LoginMethod.OIDC);
+      }
+
+      if (!enabledMethods.length) {
+        createNotification({
+          type: "error",
+          text: "At least one login method should be enabled."
+        });
+        return;
+      }
+
+      await updateServerConfig({
+        enabledLoginMethods: enabledMethods
+      });
+
+      createNotification({
+        text: "Login methods have been successfully updated.",
+        type: "success"
+      });
+    } catch (e) {
+      console.error(e);
+      createNotification({
+        type: "error",
+        text: "Failed to update login methods."
+      });
+    }
+  };
+
+  return (
+    <form
+      className="mb-6 rounded-lg border border-mineshaft-600 bg-mineshaft-900 p-4"
+      onSubmit={handleSubmit(onAuthFormSubmit)}
+    >
+      <div className="flex flex-col justify-start">
+        <div className="mb-2 text-xl font-semibold text-mineshaft-100">Login Methods</div>
+        <div className="mb-4 max-w-sm text-sm text-mineshaft-400">
+          Select the login methods you wish to allow for all users of this instance.
+        </div>
+        <Controller
+          control={control}
+          name="isEmailEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="email-enabled"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">Email</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+        <Controller
+          control={control}
+          name="isGoogleEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="google-enabled"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">Google SSO</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+        <Controller
+          control={control}
+          name="isGithubEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="enable-github"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">Github SSO</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+        <Controller
+          control={control}
+          name="isGitlabEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="enable-gitlab"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">Gitlab SSO</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+        <Controller
+          control={control}
+          name="isSamlEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="enable-saml"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">SAML SSO</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+        <Controller
+          control={control}
+          name="isOidcEnabled"
+          render={({ field, fieldState: { error } }) => {
+            return (
+              <FormControl isError={Boolean(error)} errorText={error?.message}>
+                <Switch
+                  id="enable-oidc"
+                  onCheckedChange={(value) => field.onChange(value)}
+                  isChecked={field.value}
+                >
+                  <p className="w-24">OIDC SSO</p>
+                </Switch>
+              </FormControl>
+            );
+          }}
+        />
+      </div>
+      <Controller
+        control={control}
+        name="isLdapEnabled"
+        render={({ field, fieldState: { error } }) => {
+          return (
+            <FormControl isError={Boolean(error)} errorText={error?.message}>
+              <Switch
+                id="enable-ldap"
+                onCheckedChange={(value) => field.onChange(value)}
+                isChecked={field.value}
+              >
+                <p className="w-24">LDAP</p>
+              </Switch>
+            </FormControl>
+          );
+        }}
+      />
+      <Button
+        className="mt-2"
+        type="submit"
+        isLoading={isSubmitting}
+        isDisabled={isSubmitting || !isDirty}
+      >
+        Save
+      </Button>
+    </form>
+  );
+};

frontend/src/views/admin/DashboardPage/DashboardPage.tsx

@@ -24,10 +24,12 @@ import {
 import { useOrganization, useServerConfig, useUser } from "@app/context";
 import { useGetOrganizations, useUpdateServerConfig } from "@app/hooks/api";
 
+import { AuthPanel } from "./AuthPanel";
 import { RateLimitPanel } from "./RateLimitPanel";
 
 enum TabSections {
   Settings = "settings",
+  Auth = "auth",
   RateLimit = "rate-limit"
 }
 
@@ -120,7 +122,7 @@ export const AdminDashboardPage = () => {
       <div className="mx-auto mb-6 w-full max-w-7xl pt-6">
         <div className="mb-8 flex flex-col items-start justify-between text-xl">
           <h1 className="text-3xl font-semibold">Admin Dashboard</h1>
-          <p className="text-base text-bunker-300">Manage your Infisical instance.</p>
+          <p className="text-base text-bunker-300">Manage your instance level configurations.</p>
         </div>
       </div>
       {isUserLoading || isNotAllowed ? (
@@ -131,6 +133,7 @@ export const AdminDashboardPage = () => {
             <TabList>
               <div className="flex w-full flex-row border-b border-mineshaft-600">
                 <Tab value={TabSections.Settings}>General</Tab>
+                <Tab value={TabSections.Auth}>Authentication</Tab>
                 <Tab value={TabSections.RateLimit}>Rate Limit</Tab>
               </div>
             </TabList>
@@ -203,7 +206,8 @@ export const AdminDashboardPage = () => {
                     Default organization
                   </div>
                   <div className="mb-4 max-w-sm text-sm text-mineshaft-400">
-                    Select the default organization you want to set for SAML/LDAP based logins. When selected, user logins will be automatically scoped to the selected organization.
+                    Select the default organization you want to set for SAML/LDAP based logins. When
+                    selected, user logins will be automatically scoped to the selected organization.
                   </div>
                   <Controller
                     control={control}
@@ -310,6 +314,9 @@ export const AdminDashboardPage = () => {
                 </Button>
               </form>
             </TabPanel>
+            <TabPanel value={TabSections.Auth}>
+              <AuthPanel />
+            </TabPanel>
             <TabPanel value={TabSections.RateLimit}>
               <RateLimitPanel />
             </TabPanel>

migration/package-lock.json

@@ -10,6 +10,7 @@
       "license": "ISC",
       "dependencies": {
         "dotenv": "^16.0.3",
+        "ip": "^2.0.1",
         "mongoose": "^7.2.1"
       }
     },
@@ -70,9 +71,9 @@
       }
     },
     "node_modules/ip": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz",
-      "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ=="
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
+      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ=="
     },
     "node_modules/kareem": {
       "version": "2.5.1",
@@ -308,9 +309,9 @@
       "integrity": "sha512-7GO6HghkA5fYG9TYnNxi14/7K9f5occMlp3zXAuSxn7CKCxt9xbNWG7yF8hTCSUchlfWSe3uLmlPfigevRItzQ=="
     },
     "ip": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz",
-      "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ=="
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
+      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ=="
     },
     "kareem": {
       "version": "2.5.1",

migration/package.json

@@ -10,6 +10,7 @@
   "license": "ISC",
   "dependencies": {
     "dotenv": "^16.0.3",
+    "ip": "^2.0.1",
     "mongoose": "^7.2.1"
   }
 }