feat: service accounts

backend/api/auth.py

@@ -1,18 +1,22 @@
 from api.utils.rest import (
     get_org_member_from_user_token,
+    get_service_account_from_token,
     get_service_token,
     get_token_type,
     token_is_expired_or_deleted,
 )
 from api.models import Environment
-from api.utils.access.permissions import user_can_access_environment
+from api.utils.access.permissions import (
+    service_account_can_access_environment,
+    user_can_access_environment,
+)
 from rest_framework import authentication, exceptions
 
 
 class PhaseTokenAuthentication(authentication.BaseAuthentication):
     def authenticate(self, request):
 
-        token_types = ["User", "Service"]
+        token_types = ["User", "Service", "ServiceAccount"]
 
         auth_token = request.headers.get("Authorization")
 
@@ -24,7 +28,14 @@ def authenticate(self, request):
         if token_type not in token_types:
             raise exceptions.AuthenticationFailed("Invalid token")
 
-        auth = {"token": auth_token, "org_member": None, "service_token": None}
+        auth = {
+            "token": auth_token,
+            "auth_type": token_type,
+            "org_member": None,
+            "service_token": None,
+            "service_account": None,
+            "service_account_token": None,
+        }
 
         if token_is_expired_or_deleted(auth_token):
             raise exceptions.AuthenticationFailed("Token expired or deleted")
@@ -62,9 +73,27 @@ def authenticate(self, request):
             except Exception as ex:
                 raise exceptions.NotFound("User not found")
 
-        else:
+        elif token_type == "Service":
             service_token = get_service_token(auth_token)
             auth["service_token"] = service_token
             user = service_token.created_by.user
 
+        if token_type == "ServiceAccount":
+
+            try:
+                service_token = get_service_token(auth_token)
+                service_account = get_service_account_from_token(auth_token)
+                user = service_token.created_by.user
+                auth["service_account"] = service_account
+                auth["service_account_token"] = service_token
+
+                if not service_account_can_access_environment(
+                    service_account.id, env.id
+                ):
+                    raise exceptions.AuthenticationFailed(
+                        "Service account cannot access this environment"
+                    )
+            except Exception as ex:
+                raise exceptions.NotFound("Service account not found")
+
         return (user, auth)

backend/api/migrations/0085_serviceaccount_environmentkey_paths_and_more.py

@@ -0,0 +1,58 @@
+# Generated by Django 4.2.15 on 2024-10-20 09:12
+
+from django.db import migrations, models
+import django.db.models.deletion
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0084_auto_20241008_0708'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='ServiceAccount',
+            fields=[
+                ('id', models.TextField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=255)),
+                ('identity_key', models.CharField(blank=True, max_length=256, null=True)),
+                ('server_wrapped_keyring', models.TextField(null=True)),
+                ('server_wrapped_recovery', models.TextField(null=True)),
+                ('created_at', models.DateTimeField(auto_now_add=True, null=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('apps', models.ManyToManyField(related_name='apps', to='api.app')),
+                ('organisation', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='api.organisation')),
+                ('role', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='api.role')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='environmentkey',
+            name='paths',
+            field=models.TextField(blank=True, null=True),
+        ),
+        migrations.CreateModel(
+            name='ServiceAccountHandler',
+            fields=[
+                ('id', models.TextField(default=uuid.uuid4, primary_key=True, serialize=False)),
+                ('wrapped_keyring', models.TextField()),
+                ('wrapped_recovery', models.TextField()),
+                ('created_at', models.DateTimeField(auto_now_add=True, null=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('service_account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='api.serviceaccount')),
+                ('user', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='api.organisationmember')),
+            ],
+        ),
+        migrations.AddField(
+            model_name='environmentkey',
+            name='service_account',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to='api.serviceaccount'),
+        ),
+        migrations.AddField(
+            model_name='servicetoken',
+            name='service_account',
+            field=models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, to='api.serviceaccount'),
+        ),
+    ]

backend/api/migrations/0086_remove_servicetoken_service_account_and_more.py

@@ -0,0 +1,35 @@
+# Generated by Django 4.2.15 on 2024-10-22 07:29
+
+from django.db import migrations, models
+import django.db.models.deletion
+import uuid
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0085_serviceaccount_environmentkey_paths_and_more'),
+    ]
+
+    operations = [
+        migrations.RemoveField(
+            model_name='servicetoken',
+            name='service_account',
+        ),
+        migrations.CreateModel(
+            name='ServiceAccountToken',
+            fields=[
+                ('id', models.TextField(default=uuid.uuid4, editable=False, primary_key=True, serialize=False)),
+                ('name', models.CharField(max_length=64)),
+                ('identity_key', models.CharField(max_length=256)),
+                ('token', models.CharField(max_length=64)),
+                ('wrapped_key_share', models.CharField(max_length=406)),
+                ('created_at', models.DateTimeField(auto_now_add=True, null=True)),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('deleted_at', models.DateTimeField(blank=True, null=True)),
+                ('expires_at', models.DateTimeField(null=True)),
+                ('created_by', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.CASCADE, to='api.organisationmember')),
+                ('service_account', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='api.serviceaccount')),
+            ],
+        ),
+    ]

backend/api/migrations/0087_alter_serviceaccount_apps.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.15 on 2024-10-24 12:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0086_remove_servicetoken_service_account_and_more'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='serviceaccount',
+            name='apps',
+            field=models.ManyToManyField(related_name='service_accounts', to='api.app'),
+        ),
+    ]

backend/api/migrations/0088_secretevent_service_account.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.15 on 2024-10-28 08:43
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0087_alter_serviceaccount_apps'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='secretevent',
+            name='service_account',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='api.serviceaccount'),
+        ),
+    ]

backend/api/migrations/0089_alter_serviceaccounthandler_service_account.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.15 on 2024-10-30 07:10
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0088_secretevent_service_account'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='serviceaccounthandler',
+            name='service_account',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='handlers', to='api.serviceaccount'),
+        ),
+    ]

backend/api/migrations/0090_alter_serviceaccount_organisation.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.15 on 2024-10-30 07:11
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0089_alter_serviceaccounthandler_service_account'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='serviceaccount',
+            name='organisation',
+            field=models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='service_accounts', to='api.organisation'),
+        ),
+    ]

backend/api/migrations/0091_add_managed_manager_service_roles.py

@@ -0,0 +1,30 @@
+# Generated by Django 4.2.15 on 2024-11-04 08:36
+
+from django.db import migrations
+from api.utils.access.roles import default_roles
+
+
+def add_default_roles(apps, schema_editor):
+    Organisation = apps.get_model("api", "Organisation")
+    Role = apps.get_model("api", "Role")
+    OrganisationMember = apps.get_model("api", "OrganisationMember")
+
+    # Create default roles for each organisation
+    for organisation in Organisation.objects.all():
+        for role_name, _ in default_roles.items():
+            Role.objects.get_or_create(
+                name=role_name,
+                organisation=organisation,
+                is_default=True,
+            )
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("api", "0090_alter_serviceaccount_organisation"),
+    ]
+
+    operations = [
+        migrations.RunPython(add_default_roles),
+    ]

backend/api/migrations/0092_secretevent_service_account_token.py

@@ -0,0 +1,19 @@
+# Generated by Django 4.2.15 on 2024-11-13 14:47
+
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0091_add_managed_manager_service_roles'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='secretevent',
+            name='service_account_token',
+            field=models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to='api.serviceaccounttoken'),
+        ),
+    ]

backend/api/migrations/0093_merge_20241116_0744.py

@@ -0,0 +1,14 @@
+# Generated by Django 4.2.15 on 2024-11-16 07:44
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('api', '0086_alter_environmentsync_service'),
+        ('api', '0092_secretevent_service_account_token'),
+    ]
+
+    operations = [
+    ]

backend/api/models.py

@@ -215,6 +215,39 @@ def delete(self, *args, **kwargs):
         self.save()
 
 
+class ServiceAccount(models.Model):
+    id = models.TextField(default=uuid4, primary_key=True, editable=False)
+    name = models.CharField(max_length=255)
+    organisation = models.ForeignKey(
+        Organisation, on_delete=models.CASCADE, related_name="service_accounts"
+    )
+    role = models.ForeignKey(
+        Role,
+        on_delete=models.SET_NULL,
+        null=True,
+        blank=True,
+    )
+    apps = models.ManyToManyField(App, related_name="service_accounts")
+    identity_key = models.CharField(max_length=256, null=True, blank=True)
+    server_wrapped_keyring = models.TextField(null=True)
+    server_wrapped_recovery = models.TextField(null=True)
+    created_at = models.DateTimeField(auto_now_add=True, blank=True, null=True)
+    updated_at = models.DateTimeField(auto_now=True)
+    deleted_at = models.DateTimeField(null=True, blank=True)
+
+
+class ServiceAccountHandler(models.Model):
+    id = models.TextField(default=uuid4, primary_key=True)
+    service_account = models.ForeignKey(
+        ServiceAccount, on_delete=models.CASCADE, related_name="handlers"
+    )
+    user = models.ForeignKey(OrganisationMember, on_delete=models.CASCADE)
+    wrapped_keyring = models.TextField()
+    wrapped_recovery = models.TextField()
+    created_at = models.DateTimeField(auto_now_add=True, blank=True, null=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+
 class OrganisationMemberInviteManager(models.Manager):
     def create(self, *args, **kwargs):
         organisation = kwargs.get("organisation")
@@ -299,6 +332,10 @@ class EnvironmentKey(models.Model):
     user = models.ForeignKey(
         OrganisationMember, on_delete=models.CASCADE, blank=True, null=True
     )
+    service_account = models.ForeignKey(
+        ServiceAccount, on_delete=models.CASCADE, blank=True, null=True
+    )
+    paths = models.TextField(blank=True, null=True)
     identity_key = models.CharField(max_length=256)
     wrapped_seed = models.CharField(max_length=256)
     wrapped_salt = models.CharField(max_length=256)
@@ -429,6 +466,22 @@ class ServiceToken(models.Model):
     objects = ServiceTokenManager()
 
 
+class ServiceAccountToken(models.Model):
+    id = models.TextField(default=uuid4, primary_key=True, editable=False)
+    service_account = models.ForeignKey(ServiceAccount, on_delete=models.CASCADE)
+    name = models.CharField(max_length=64)
+    identity_key = models.CharField(max_length=256)
+    token = models.CharField(max_length=64)
+    wrapped_key_share = models.CharField(max_length=406)
+    created_by = models.ForeignKey(
+        OrganisationMember, on_delete=models.CASCADE, blank=True, null=True
+    )
+    created_at = models.DateTimeField(auto_now_add=True, blank=True, null=True)
+    updated_at = models.DateTimeField(auto_now=True)
+    deleted_at = models.DateTimeField(blank=True, null=True)
+    expires_at = models.DateTimeField(null=True)
+
+
 class UserToken(models.Model):
     id = models.TextField(default=uuid4, primary_key=True, editable=False)
     user = models.ForeignKey(
@@ -517,6 +570,12 @@ class SecretEvent(models.Model):
     service_token = models.ForeignKey(
         ServiceToken, on_delete=models.SET_NULL, blank=True, null=True
     )
+    service_account = models.ForeignKey(
+        ServiceAccount, on_delete=models.SET_NULL, blank=True, null=True
+    )
+    service_account_token = models.ForeignKey(
+        ServiceAccountToken, on_delete=models.SET_NULL, blank=True, null=True
+    )
     key = models.TextField()
     key_digest = models.TextField()
     value = models.TextField()