Skip to content

feat: gateway enrollment token flow #183

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bernie-g merged 20 commits into from
Apr 16, 2026
Merged

feat: gateway enrollment token flow #183

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
20 commits
Select commit Hold shift + click to select a range
bd45820
feat: gateway enrollment token flow
bernie-g Apr 13, 2026
fe2bc62
feat: gateway name as positional arg with --name deprecated
bernie-g Apr 13, 2026
ea34f02
fix: persist effective domain during enrollment even without --domain…
bernie-g Apr 14, 2026
facc596
fix: skip stored token loading when explicit credentials are provided
bernie-g Apr 14, 2026
ce33e87
fix: use Geteuid instead of Getuid for effective root check in conf path
bernie-g Apr 14, 2026
38fe5b8
fix: use 0700 permissions for gateway config directory
bernie-g Apr 14, 2026
b602fff
feat: idempotent enrollment command for gateway restarts
bernie-g Apr 14, 2026
239c865
fix: remove --name flag references from command descriptions and exam…
bernie-g Apr 14, 2026
4d06796
refactor: use EnrollMethodStatic constant instead of magic string
bernie-g Apr 14, 2026
9b91827
fix: remove legacy auth method references from token flag descriptions
bernie-g Apr 14, 2026
62e520a
feat: scope gateway config files by name for multi-gateway support
bernie-g Apr 14, 2026
d464016
refactor: rename enroll-method from 'static' to 'token'
bernie-g Apr 14, 2026
d52b4f8
feat: use V3 token-auth/enroll endpoint for gateway enrollment
bernie-g Apr 14, 2026
72c78c3
fix: clean up per-gateway config directory on systemd uninstall
bernie-g Apr 15, 2026
856fc31
fix: check explicit CLI flags instead of env vars for hasExplicitCreds
bernie-g Apr 15, 2026
625ec1c
fix: use enrolled access token directly instead of re-reading via env…
bernie-g Apr 15, 2026
93160e9
feat: use V3 /connect for enrollment-flow gateways, add CallConnectGa…
bernie-g Apr 15, 2026
2730731
refactor: remove relay selection from enrollment, handled by connect
bernie-g Apr 15, 2026
feba1f7
fix: use access token for relay selection in enrollment flow
bernie-g Apr 15, 2026
32675c0
fix: pass relay name to systemd install, use correct operation name i…
bernie-g Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
42 changes: 42 additions & 0 deletions packages/api/api.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,8 @@ const (
operationCallRegisterOrgRelay = "CallRegisterOrgRelay"
operationCallGetOrgRelays = "CallGetOrgRelays"
operationCallRegisterGateway = "CallRegisterGateway"
operationCallConnectGateway = "CallConnectGateway"
operationCallEnrollGateway = "CallEnrollGateway"
Comment thread
sheensantoscapadngan marked this conversation as resolved.
operationCallPAMAccess = "CallPAMAccess"
operationCallPAMAccessApprovalRequest = "CallPAMAccessApprovalRequest"
operationCallPAMSessionCredentials = "CallPAMSessionCredentials"
Expand Down Expand Up @@ -895,6 +897,26 @@ func CallGetRelays(httpClient *resty.Client) (GetRelaysResponse, error) {
return resBody, nil
}

func CallConnectGateway(httpClient *resty.Client, request ConnectGatewayRequest) (RegisterGatewayResponse, error) {
var resBody RegisterGatewayResponse
response, err := httpClient.
R().
SetResult(&resBody).
SetHeader("User-Agent", USER_AGENT).
SetBody(request).
Post(fmt.Sprintf("%v/v3/gateways/connect", config.INFISICAL_URL))

if err != nil {
return RegisterGatewayResponse{}, NewGenericRequestError(operationCallConnectGateway, err)
}

if response.IsError() {
return RegisterGatewayResponse{}, NewAPIErrorWithResponse(operationCallConnectGateway, response, nil)
}
Comment thread
sheensantoscapadngan marked this conversation as resolved.

return resBody, nil
Comment thread
bernie-g marked this conversation as resolved.
}

func CallRegisterGateway(httpClient *resty.Client, request RegisterGatewayRequest) (RegisterGatewayResponse, error) {
var resBody RegisterGatewayResponse
response, err := httpClient.
Expand All @@ -915,6 +937,26 @@ func CallRegisterGateway(httpClient *resty.Client, request RegisterGatewayReques
return resBody, nil
}

func CallEnrollGateway(httpClient *resty.Client, request EnrollGatewayRequest) (EnrollGatewayResponse, error) {
var resBody EnrollGatewayResponse
response, err := httpClient.
R().
SetResult(&resBody).
SetHeader("User-Agent", USER_AGENT).
SetBody(request).
Post(fmt.Sprintf("%v/v3/gateways/token-auth/enroll", config.INFISICAL_URL))

if err != nil {
return EnrollGatewayResponse{}, NewGenericRequestError(operationCallEnrollGateway, err)
}

if response.IsError() {
return EnrollGatewayResponse{}, NewAPIErrorWithResponse(operationCallEnrollGateway, response, nil)
}

return resBody, nil
}

func CallPAMAccess(httpClient *resty.Client, request PAMAccessRequest) (PAMAccessResponse, error) {
var pamAccessResponse PAMAccessResponse
response, err := httpClient.
Expand Down
17 changes: 15 additions & 2 deletions packages/api/model.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -786,8 +786,21 @@ type Relay struct {
type GetRelaysResponse []Relay

type RegisterGatewayRequest struct {
RelayName string `json:"relayName"`
Name string `json:"name"`
RelayName string `json:"relayName,omitempty"`
Name string `json:"name,omitempty"`
}

type ConnectGatewayRequest struct {
RelayName string `json:"relayName,omitempty"`
}

type EnrollGatewayRequest struct {
Token string `json:"token"`
}

type EnrollGatewayResponse struct {
AccessToken string `json:"accessToken"`
GatewayID string `json:"gatewayId"`
}

type RegisterGatewayResponse struct {
Expand Down
Loading
Loading