Deprecate ZTA-related fields (#2851)

2025-09-11 07:24:30 +08:00 · 2024-11-08 15:47:34 -03:00 · 2024-11-08 15:47:34 -03:00 · 473830ada6
commit 473830ada6
parent 6021ddf39e
42 changed files with 135 additions and 243 deletions
--- a/lib/livebook/config.ex
+++ b/lib/livebook/config.ex
@ -8,52 +8,6 @@ defmodule Livebook.Config do
          | %{mode: :token, secret: String.t()}
          | %{mode: :disabled}

-  # Those are the public identity providers.
-  #
-  # There are still a :session and :custom identity providers,
-  # but those are handled internally.
-  #
-  # IMPORTANT: this list must be in sync with Livebook Teams.
-  @identity_providers [
-    %{
-      type: :basic_auth,
-      name: "Basic Auth",
-      value: "Credentials (username:password)",
-      module: Livebook.ZTA.BasicAuth,
-      placeholder: "username:password",
-      input: "password"
-    },
-    %{
-      type: :cloudflare,
-      name: "Cloudflare",
-      value: "Team name (domain)",
-      module: Livebook.ZTA.Cloudflare
-    },
-    %{
-      type: :google_iap,
-      name: "Google IAP",
-      value: "Audience (aud)",
-      module: Livebook.ZTA.GoogleIAP
-    },
-    %{
-      type: :livebook_teams,
-      name: "Livebook Teams",
-      module: Livebook.ZTA.LivebookTeams
-    },
-    %{
-      type: :tailscale,
-      name: "Tailscale",
-      value: "Tailscale CLI socket path",
-      module: Livebook.ZTA.Tailscale
-    }
-  ]
-
-  @identity_provider_no_id [Livebook.ZTA.BasicAuth, Livebook.ZTA.PassThrough]
-
-  @identity_provider_type_to_module Map.new(@identity_providers, fn provider ->
-                                      {Atom.to_string(provider.type), provider.module}
-                                    end)
-
  @doc """
  Returns docker images to be used when generating sample Dockerfiles.
  """
@ -282,16 +236,6 @@ defmodule Livebook.Config do
    Application.fetch_env!(:livebook, :shutdown_callback)
  end

-  @doc """
-  Returns all identity providers.
-
-  Internal identity providers, such as session and custom,
-  are not included.
-  """
-  def identity_providers do
-    @identity_providers
-  end
-
  @doc """
  Returns the identity provider.
  """
@ -303,6 +247,8 @@ defmodule Livebook.Config do
    end
  end

+  @identity_provider_no_id [Livebook.ZTA.BasicAuth, Livebook.ZTA.PassThrough]
+
  @doc """
  Returns if the identity data is readonly.
  """
@ -312,14 +258,6 @@ defmodule Livebook.Config do
    module not in @identity_provider_no_id
  end

-  @doc """
-  Returns metadata of a ZTA provider
-  """
-  @spec zta_metadata(atom()) :: map()
-  def zta_metadata(zta_provider) do
-    Enum.find(Livebook.Config.identity_providers(), &(&1.type == zta_provider))
-  end
-
  @doc """
  Returns whether the application is running inside an iframe.
  """
@ -750,6 +688,13 @@ defmodule Livebook.Config do
    end
  end

+  @identity_providers %{
+    "basic_auth" => Livebook.ZTA.BasicAuth,
+    "cloudflare" => Livebook.ZTA.Cloudflare,
+    "google_iap" => Livebook.ZTA.GoogleIAP,
+    "tailscale" => Livebook.ZTA.Tailscale
+  }
+
  @doc """
  Parses zero trust identity provider from env.
  """
@ -770,13 +715,11 @@ defmodule Livebook.Config do

      provider ->
        with [type, key] <- String.split(provider, ":", parts: 2),
-             %{^type => module} <- identity_provider_type_to_module() do
+             %{^type => module} <- @identity_providers do
          {:zta, module, key}
        else
          _ -> abort!("invalid configuration for identity provider given in #{env}")
        end
    end
  end
-
-  defp identity_provider_type_to_module, do: @identity_provider_type_to_module
 end
--- a/lib/livebook/hubs/dockerfile.ex
+++ b/lib/livebook/hubs/dockerfile.ex
@ -9,10 +9,16 @@ defmodule Livebook.Hubs.Dockerfile do
          deploy_all: boolean(),
          docker_tag: String.t(),
          clustering: nil | :auto | :dns,
-          zta_provider: atom() | nil,
-          zta_key: String.t() | nil
+          zta_provider: atom() | nil
        }

+  @types %{
+    deploy_all: :boolean,
+    docker_tag: :string,
+    clustering: Ecto.ParameterizedType.init(Ecto.Enum, values: [:auto, :dns]),
+    zta_provider: :atom
+  }
+
  @doc """
  Builds the default Dockerfile configuration.
  """
@ -24,8 +30,7 @@ defmodule Livebook.Hubs.Dockerfile do
      deploy_all: false,
      docker_tag: default_image.tag,
      clustering: nil,
-      zta_provider: nil,
-      zta_key: nil
+      zta_provider: nil
    }
  end

@ -37,8 +42,7 @@ defmodule Livebook.Hubs.Dockerfile do
    %{
      config_new()
      | clustering: deployment_group.clustering,
-        zta_provider: deployment_group.zta_provider,
-        zta_key: deployment_group.zta_key
+        zta_provider: deployment_group.zta_provider
    }
  end

@ -47,19 +51,8 @@ defmodule Livebook.Hubs.Dockerfile do
  """
  @spec config_changeset(config(), map()) :: Ecto.Changeset.t()
  def config_changeset(config, attrs \\ %{}) do
-    zta_types =
-      for provider <- Livebook.Config.identity_providers(),
-          do: provider.type
-
-    types = %{
-      deploy_all: :boolean,
-      docker_tag: :string,
-      clustering: Ecto.ParameterizedType.init(Ecto.Enum, values: [:auto, :dns]),
-      zta_provider: Ecto.ParameterizedType.init(Ecto.Enum, values: zta_types),
-      zta_key: :string
-    }
-
-    cast({config, types}, attrs, [:deploy_all, :docker_tag, :clustering, :zta_provider, :zta_key])
+    {config, @types}
+    |> cast(attrs, [:deploy_all, :docker_tag, :clustering, :zta_provider])
    |> validate_required([:deploy_all, :docker_tag])
  end

@ -201,7 +194,7 @@ defmodule Livebook.Hubs.Dockerfile do
    {Base.url_encode64(left, padding: false), "c_" <> Base.url_encode64(right, padding: false)}
  end

-  defp format_hub_config("team", config, hub, hub_file_systems, used_secrets) do
+  defp format_hub_config("team", _config, hub, hub_file_systems, used_secrets) do
    base_env =
      """
      ARG TEAMS_KEY="#{hub.teams_key}"
@ -225,14 +218,7 @@ defmodule Livebook.Hubs.Dockerfile do
        """
      end

-    zta =
-      if zta_configured?(config) do
-        """
-        ENV LIVEBOOK_IDENTITY_PROVIDER "#{config.zta_provider}:#{config.zta_key}"
-        """
-      end
-
-    [base_env, secrets, file_systems, zta]
+    [base_env, secrets, file_systems]
    |> Enum.reject(&is_nil/1)
    |> Enum.join()
  end
@ -308,10 +294,6 @@ defmodule Livebook.Hubs.Dockerfile do
    end
  end

-  defp zta_configured?(config) do
-    config.zta_provider != nil and config.zta_key != nil
-  end
-
  @doc """
  Returns information for deploying Livebook Agent using Docker.
  """
@ -331,13 +313,6 @@ defmodule Livebook.Hubs.Dockerfile do
       "online:#{hub.hub_name}:#{hub.org_id}:#{hub.org_key_id}:#{agent_key.key}"}
    ]

-    hub_env =
-      if zta_configured?(config) do
-        [{"LIVEBOOK_IDENTITY_PROVIDER", "#{config.zta_provider}:#{config.zta_key}"}]
-      else
-        []
-      end
-
    {secret_key_base, cookie} = deterministic_skb_and_cookie(hub.teams_key)

    clustering_env =
@ -361,7 +336,7 @@ defmodule Livebook.Hubs.Dockerfile do
          []
      end

-    %{image: image, env: base_image.env ++ env ++ hub_env ++ clustering_env}
+    %{image: image, env: base_image.env ++ env ++ clustering_env}
  end

  @doc """
@ -418,19 +393,18 @@ defmodule Livebook.Hubs.Dockerfile do
            end,
            if app_settings.access_type == :public do
              teams_link =
-                ~s{<a class="font-medium underline text-gray-900 hover:no-underline" href="https://livebook.dev/teams?ref=LivebookApp" target="_blank">Livebook Teams</a>}
+                ~s{<a class="font-medium underline text-gray-900 hover:no-underline" href="https://hexdocs.pm/livebook/authentication.html" target="_blank">Authentication</a>}

              "This app has no password configuration and anyone with access to the server will be able" <>
-                " to use it. You may either configure a password or use #{teams_link} to add Zero Trust Authentication" <>
-                " to your deployed notebooks."
+                " to use it. See the documentation on #{teams_link} for more information."
            end
          ]

        "team" ->
          [
-            if app_settings.access_type == :public and not zta_configured?(config) do
+            if app_settings.access_type == :public and config.zta_provider != :livebook_teams do
              "This app has no password configuration and anyone with access to the server will be able" <>
-                " to use it. You may either configure a password or configure Zero Trust Authentication."
+                " to use it. You may either configure a password or enable authentication with Livebook Teams."
            end
          ]
      end
--- a/lib/livebook/hubs/team_client.ex
+++ b/lib/livebook/hubs/team_client.ex
@ -436,7 +436,6 @@ defmodule Livebook.Hubs.TeamClient do
      agent_keys: agent_keys,
      clustering: nullify(deployment_group.clustering),
      zta_provider: atomize(deployment_group.zta_provider),
-      zta_key: nullify(deployment_group.zta_key),
      url: nullify(deployment_group.url)
    }
  end
@ -453,7 +452,6 @@ defmodule Livebook.Hubs.TeamClient do
      agent_keys: agent_keys,
      clustering: nullify(deployment_group_created.clustering),
      zta_provider: atomize(deployment_group_created.zta_provider),
-      zta_key: nullify(deployment_group_created.zta_key),
      url: nullify(deployment_group_created.url)
    }
  end
@ -470,7 +468,6 @@ defmodule Livebook.Hubs.TeamClient do
        agent_keys: agent_keys,
        clustering: atomize(deployment_group_updated.clustering),
        zta_provider: atomize(deployment_group_updated.zta_provider),
-        zta_key: nullify(deployment_group_updated.zta_key),
        url: nullify(deployment_group_updated.url)
    }
  end
--- a/lib/livebook/teams/deployment_group.ex
+++ b/lib/livebook/teams/deployment_group.ex
@ -5,7 +5,26 @@ defmodule Livebook.Teams.DeploymentGroup do
  alias Livebook.Secrets.Secret
  alias Livebook.Teams.AgentKey

-  @zta_providers Enum.map(Livebook.Config.identity_providers(), & &1.type)
+  @type t :: %__MODULE__{
+          id: String.t() | nil,
+          name: String.t() | nil,
+          url: String.t() | nil,
+          mode: :online | :offline,
+          clustering: :auto | :dns | nil,
+          hub_id: String.t() | nil,
+          secrets: Ecto.Schema.has_many(Secret.t()),
+          agent_keys: Ecto.Schema.has_many(AgentKey.t()),
+          zta_provider:
+            :basic_auth
+            | :cloudflare
+            | :google_iap
+            | :livebook_teams
+            | :tailscale
+            | nil
+        }
+
+  # TODO: Update this list to be only `:livebook_teams` in the future.
+  @zta_providers [:basic_auth, :cloudflare, :google_iap, :livebook_teams, :tailscale]

  @primary_key {:id, :string, autogenerate: false}
  embedded_schema do
@ -13,8 +32,7 @@ defmodule Livebook.Teams.DeploymentGroup do
    field :mode, Ecto.Enum, values: [:online, :offline], default: :online
    field :hub_id, :string
    field :clustering, Ecto.Enum, values: [:auto, :dns]
-    field :zta_provider, Ecto.Enum, values: @zta_providers
-    field :zta_key, :string
+    field :zta_provider, Ecto.Enum, values: @zta_providers, default: :livebook_teams
    field :url, :string

    has_many :secrets, Secret
@ -24,7 +42,7 @@ defmodule Livebook.Teams.DeploymentGroup do
  def changeset(deployment_group, attrs \\ %{}) do
    changeset =
      deployment_group
-      |> cast(attrs, [:id, :name, :mode, :hub_id, :clustering, :zta_provider, :zta_key, :url])
+      |> cast(attrs, [:id, :name, :mode, :hub_id, :clustering, :zta_provider, :url])
      |> validate_required([:name, :mode])
      |> update_change(:url, fn url ->
        if url do
@ -50,8 +68,8 @@ defmodule Livebook.Teams.DeploymentGroup do
        end
      end)

-    if get_field(changeset, :zta_provider) do
-      validate_required(changeset, [:zta_key])
+    if get_field(changeset, :mode) == :offline do
+      delete_change(changeset, :zta_provider)
    else
      changeset
    end
--- a/lib/livebook/teams/requests.ex
+++ b/lib/livebook/teams/requests.ex
@ -174,7 +174,6 @@ defmodule Livebook.Teams.Requests do
      mode: deployment_group.mode,
      clustering: deployment_group.clustering,
      zta_provider: deployment_group.zta_provider,
-      zta_key: deployment_group.zta_key,
      url: deployment_group.url
    }

--- a/lib/livebook/zta.ex
+++ b/lib/livebook/zta.ex
@ -57,10 +57,4 @@ defmodule Livebook.ZTA do
  def put(name, value) do
    :ets.insert(__MODULE__, [{name, value}])
  end
-
-  def provider_name(nil), do: "None"
-
-  def provider_name(provider_type) do
-    Livebook.Config.zta_metadata(provider_type).name
-  end
 end
--- a/lib/livebook_web/components/app_components.ex
+++ b/lib/livebook_web/components/app_components.ex
@ -1,8 +1,6 @@
 defmodule LivebookWeb.AppComponents do
  use LivebookWeb, :html

-  alias Livebook.Hubs
-
  @doc """
  Renders page placeholder on unauthenticated dead render.
  """
@ -133,62 +131,27 @@ defmodule LivebookWeb.AppComponents do
      </div>
    </div>

-    <%= if Hubs.Provider.type(@hub) == "team" do %>
-      <div class="flex flex-col">
-        <div class="grid grid-cols-1 md:grid-cols-2 gap-3">
-          <.select_field
-            label="Zero Trust Authentication provider"
-            field={@form[:zta_provider]}
-            help={
-              ~S'''
-              Enable this option to generate
-              Livebook Dockerfiles with proxy
-              authentication for deployed
-              notebooks
-              '''
-            }
-            prompt="None"
-            options={zta_options()}
-            disabled={@disabled}
-          />
-
-          <.text_field
-            :if={zta_metadata = zta_metadata(@form[:zta_provider].value)}
-            field={@form[:zta_key]}
-            type={Map.get(zta_metadata, :input, "text")}
-            label={zta_metadata.value}
-            placeholder={Map.get(zta_metadata, :placeholder, "")}
-            phx-debounce
-            disabled={@disabled}
-          />
-        </div>
-
-        <div :if={zta_metadata = zta_metadata(@form[:zta_provider].value)} class="text-sm mt-1">
-          See the
-          <a
-            class="text-blue-800 hover:text-blue-600"
-            href={"https://hexdocs.pm/livebook/#{zta_metadata.type}.html"}
-          >
-            Authentication with <%= zta_metadata.name %> docs
-          </a>
-          for more information.
-        </div>
+    <%= if Livebook.Hubs.Provider.type(@hub) == "team" and to_string(@form[:mode].value) == "online" do %>
+      <div class="flex flex-col gap-2">
+        <.checkbox_field
+          field={@form[:zta_provider]}
+          label="Authenticate via Livebook Teams"
+          help={
+            ~S'''
+            When enabled, apps deployed in
+            this deployment group will use
+            Livebook Teams for authentication.
+            '''
+          }
+          checked_value="livebook_teams"
+          unchecked_value=""
+          small
+        />
      </div>
    <% end %>
    """
  end

-  @zta_options for provider <- Livebook.Config.identity_providers(),
-                   do: {provider.name, provider.type}
-
-  defp zta_options(), do: @zta_options
-
-  defp zta_metadata(nil), do: nil
-
-  defp zta_metadata(provider) do
-    Livebook.Config.zta_metadata(provider)
-  end
-
  @doc """
  Lists all docker tag options.
  """
--- a/lib/livebook_web/live/hub/teams/deployment_group_component.ex
+++ b/lib/livebook_web/live/hub/teams/deployment_group_component.ex
@ -84,7 +84,7 @@ defmodule LivebookWeb.Hub.Teams.DeploymentGroupComponent do
          </.labeled_text>
          <.labeled_text class="grow mt-6 lg:border-l border-gray-200 lg:pl-4" label="Authentication">
            <span class="text-lg font-normal">
-              <%= Livebook.ZTA.provider_name(@deployment_group.zta_provider) %>
+              <%= provider_name(@deployment_group.zta_provider) %>
            </span>
          </.labeled_text>
        </div>
@ -187,4 +187,7 @@ defmodule LivebookWeb.Hub.Teams.DeploymentGroupComponent do
    </div>
    """
  end
+
+  defp provider_name(:livebook_teams), do: "Livebook Teams"
+  defp provider_name(_), do: "None"
 end
--- a/lib/livebook_web/live/hub/teams/deployment_group_form_component.ex
+++ b/lib/livebook_web/live/hub/teams/deployment_group_form_component.ex
@ -180,9 +180,6 @@ defmodule LivebookWeb.Hub.Teams.DeploymentGroupFormComponent do

      {:transport_error, message} ->
        {:noreply, assign(socket, error_message: message)}
-
-      {:error, message} ->
-        {:noreply, assign(socket, error_message: message)}
    end
  end

--- a/proto/lib/livebook_proto/agent.pb.ex
+++ b/proto/lib/livebook_proto/agent.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.Agent do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
--- a/proto/lib/livebook_proto/agent_connected.pb.ex
+++ b/proto/lib/livebook_proto/agent_connected.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AgentConnected do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 2, type: :string
  field :public_key, 3, type: :string, json_name: "publicKey"
--- a/proto/lib/livebook_proto/agent_joined.pb.ex
+++ b/proto/lib/livebook_proto/agent_joined.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AgentJoined do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :agent, 1, type: LivebookProto.Agent
 end
--- a/proto/lib/livebook_proto/agent_key.pb.ex
+++ b/proto/lib/livebook_proto/agent_key.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AgentKey do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :key, 2, type: :string
--- a/proto/lib/livebook_proto/agent_left.pb.ex
+++ b/proto/lib/livebook_proto/agent_left.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AgentLeft do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
 end
--- a/proto/lib/livebook_proto/app_deployment.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeployment do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :title, 2, type: :string
--- a/proto/lib/livebook_proto/app_deployment_started.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment_started.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeploymentStarted do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :app_deployment, 1, type: LivebookProto.AppDeployment, json_name: "appDeployment"
 end
--- a/proto/lib/livebook_proto/app_deployment_status.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment_status.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeploymentStatus do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :deployment_group_id, 2, type: :string, json_name: "deploymentGroupId"
--- a/proto/lib/livebook_proto/app_deployment_status_report.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment_status_report.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeploymentStatusReport do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :app_deployment_statuses, 1,
    repeated: true,
--- a/proto/lib/livebook_proto/app_deployment_status_type.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment_status_type.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeploymentStatusType do
-  use Protobuf, enum: true, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, enum: true, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :preparing, 0
  field :available, 1
--- a/proto/lib/livebook_proto/app_deployment_stopped.pb.ex
+++ b/proto/lib/livebook_proto/app_deployment_stopped.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.AppDeploymentStopped do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
 end
--- a/proto/lib/livebook_proto/deployment_group.pb.ex
+++ b/proto/lib/livebook_proto/deployment_group.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.DeploymentGroup do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
@ -7,7 +7,7 @@ defmodule LivebookProto.DeploymentGroup do
  field :secrets, 4, repeated: true, type: LivebookProto.DeploymentGroupSecret
  field :clustering, 5, type: :string
  field :zta_provider, 6, type: :string, json_name: "ztaProvider"
-  field :zta_key, 7, type: :string, json_name: "ztaKey"
+  field :zta_key, 7, type: :string, json_name: "ztaKey", deprecated: true
  field :agent_keys, 8, repeated: true, type: LivebookProto.AgentKey, json_name: "agentKeys"
  field :url, 9, type: :string
 end
--- a/proto/lib/livebook_proto/deployment_group_created.pb.ex
+++ b/proto/lib/livebook_proto/deployment_group_created.pb.ex
@ -1,12 +1,12 @@
 defmodule LivebookProto.DeploymentGroupCreated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
  field :mode, 3, type: :string
  field :clustering, 5, type: :string
  field :zta_provider, 6, type: :string, json_name: "ztaProvider"
-  field :zta_key, 7, type: :string, json_name: "ztaKey"
+  field :zta_key, 7, type: :string, json_name: "ztaKey", deprecated: true
  field :agent_keys, 8, repeated: true, type: LivebookProto.AgentKey, json_name: "agentKeys"
  field :url, 9, type: :string
 end
--- a/proto/lib/livebook_proto/deployment_group_deleted.pb.ex
+++ b/proto/lib/livebook_proto/deployment_group_deleted.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.DeploymentGroupDeleted do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
 end
--- a/proto/lib/livebook_proto/deployment_group_secret.pb.ex
+++ b/proto/lib/livebook_proto/deployment_group_secret.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.DeploymentGroupSecret do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
  field :value, 2, type: :string
--- a/proto/lib/livebook_proto/deployment_group_updated.pb.ex
+++ b/proto/lib/livebook_proto/deployment_group_updated.pb.ex
@ -1,12 +1,12 @@
 defmodule LivebookProto.DeploymentGroupUpdated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
  field :secrets, 3, repeated: true, type: LivebookProto.DeploymentGroupSecret
  field :clustering, 4, type: :string
  field :zta_provider, 5, type: :string, json_name: "ztaProvider"
-  field :zta_key, 6, type: :string, json_name: "ztaKey"
+  field :zta_key, 6, type: :string, json_name: "ztaKey", deprecated: true
  field :agent_keys, 7, repeated: true, type: LivebookProto.AgentKey, json_name: "agentKeys"
  field :url, 8, type: :string
 end
--- a/proto/lib/livebook_proto/error.pb.ex
+++ b/proto/lib/livebook_proto/error.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.Error do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :details, 1, type: :string
 end
--- a/proto/lib/livebook_proto/event.pb.ex
+++ b/proto/lib/livebook_proto/event.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.Event do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  oneof :type, 0

--- a/proto/lib/livebook_proto/file_system.pb.ex
+++ b/proto/lib/livebook_proto/file_system.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.FileSystem do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
--- a/proto/lib/livebook_proto/file_system_created.pb.ex
+++ b/proto/lib/livebook_proto/file_system_created.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.FileSystemCreated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
--- a/proto/lib/livebook_proto/file_system_deleted.pb.ex
+++ b/proto/lib/livebook_proto/file_system_deleted.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.FileSystemDeleted do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
 end
--- a/proto/lib/livebook_proto/file_system_updated.pb.ex
+++ b/proto/lib/livebook_proto/file_system_updated.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.FileSystemUpdated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
  field :name, 2, type: :string
--- a/proto/lib/livebook_proto/secret.pb.ex
+++ b/proto/lib/livebook_proto/secret.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.Secret do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
  field :value, 2, type: :string
--- a/proto/lib/livebook_proto/secret_created.pb.ex
+++ b/proto/lib/livebook_proto/secret_created.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.SecretCreated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
  field :value, 2, type: :string
--- a/proto/lib/livebook_proto/secret_deleted.pb.ex
+++ b/proto/lib/livebook_proto/secret_deleted.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.SecretDeleted do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
 end
--- a/proto/lib/livebook_proto/secret_updated.pb.ex
+++ b/proto/lib/livebook_proto/secret_updated.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.SecretUpdated do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
  field :value, 2, type: :string
--- a/proto/lib/livebook_proto/user_connected.pb.ex
+++ b/proto/lib/livebook_proto/user_connected.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.UserConnected do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :name, 1, type: :string
  field :secrets, 2, repeated: true, type: LivebookProto.Secret
--- a/proto/lib/livebook_proto/user_deleted.pb.ex
+++ b/proto/lib/livebook_proto/user_deleted.pb.ex
@ -1,5 +1,5 @@
 defmodule LivebookProto.UserDeleted do
-  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.12.0"
+  use Protobuf, syntax: :proto3, protoc_gen_elixir_version: "0.13.0"

  field :id, 1, type: :string
 end
--- a/proto/messages.proto
+++ b/proto/messages.proto
@ -61,7 +61,7 @@ message DeploymentGroup {
  repeated DeploymentGroupSecret secrets = 4;
  string clustering = 5;
  string zta_provider = 6;
-  string zta_key = 7;
+  string zta_key = 7 [deprecated = true];
  repeated AgentKey agent_keys = 8;
  string url = 9;
 }
@ -72,7 +72,7 @@ message DeploymentGroupCreated {
  string mode = 3;
  string clustering = 5;
  string zta_provider = 6;
-  string zta_key = 7;
+  string zta_key = 7 [deprecated = true];
  repeated AgentKey agent_keys = 8;
  string url = 9;
 }
@ -83,7 +83,7 @@ message DeploymentGroupUpdated {
  repeated DeploymentGroupSecret secrets = 3;
  string clustering = 4;
  string zta_provider = 5;
-  string zta_key = 6;
+  string zta_key = 6 [deprecated = true];
  repeated AgentKey agent_keys = 7;
  string url = 8;
 }
--- a/test/livebook/hubs/dockerfile_test.exs
+++ b/test/livebook/hubs/dockerfile_test.exs
@ -140,16 +140,6 @@ defmodule Livebook.Hubs.DockerfileTest do
      assert dockerfile =~ "ENV LIVEBOOK_TEAMS_FS"
    end

-    test "deploying with ZTA in teams hub" do
-      config = dockerfile_config(%{zta_provider: :cloudflare, zta_key: "cloudflare_key"})
-      hub = team_hub()
-      file = Livebook.FileSystem.File.local(p("/notebook.livemd"))
-
-      dockerfile = Dockerfile.airgapped_dockerfile(config, hub, [], [], file, [], %{})
-
-      assert dockerfile =~ ~S/ENV LIVEBOOK_IDENTITY_PROVIDER "cloudflare:cloudflare_key"/
-    end
-
    test "deploying a directory in teams hub" do
      config = dockerfile_config(%{deploy_all: true})
      hub = team_hub()
@ -232,16 +222,6 @@ defmodule Livebook.Hubs.DockerfileTest do
             ]
    end

-    test "deploying with zta" do
-      config = dockerfile_config(%{zta_provider: :cloudflare, zta_key: "cloudflare_key"})
-      hub = team_hub()
-      agent_key = Livebook.Factory.build(:agent_key)
-
-      %{env: env} = Dockerfile.online_docker_info(config, hub, agent_key)
-
-      assert {"LIVEBOOK_IDENTITY_PROVIDER", "cloudflare:cloudflare_key"} in env
-    end
-
    test "deploying with different base image" do
      config = dockerfile_config(%{docker_tag: "#{@version}-cuda12"})
      hub = team_hub()
@ -372,15 +352,15 @@ defmodule Livebook.Hubs.DockerfileTest do
      assert [warning] = Dockerfile.airgapped_warnings(config, hub, [], [], app_settings, [], %{})
      assert warning =~ "This app has no password configuration"

-      config = %{config | zta_provider: :cloudflare, zta_key: "key"}
+      config = %{config | zta_provider: :livebook_teams}

      assert [] = Dockerfile.airgapped_warnings(config, hub, [], [], app_settings, [], %{})
    end

    test "warns when no clustering is configured" do
-      config = dockerfile_config(%{})
+      config = dockerfile_config()
      hub = team_hub()
-      app_settings = Livebook.Notebook.AppSettings.new()
+      app_settings = %{Livebook.Notebook.AppSettings.new() | access_type: :private}

      assert [warning] = Dockerfile.airgapped_warnings(config, hub, [], [], app_settings, [], %{})
      assert warning =~ "Clustering has not been configured for this deployment"
--- a/test/livebook_teams/hubs/team_client_test.exs
+++ b/test/livebook_teams/hubs/team_client_test.exs
@ -184,6 +184,7 @@ defmodule Livebook.Hubs.TeamClientTest do
          id: to_string(deployment_group.id),
          name: deployment_group.name,
          mode: to_string(deployment_group.mode),
+          zta_provider: to_string(deployment_group.zta_provider),
          secrets: [],
          agent_keys: []
        }
@ -470,6 +471,7 @@ defmodule Livebook.Hubs.TeamClientTest do
          id: to_string(deployment_group.id),
          name: deployment_group.name,
          mode: to_string(deployment_group.mode),
+          zta_provider: to_string(deployment_group.zta_provider),
          agent_keys: [livebook_proto_agent_key],
          secrets: []
        }
@ -563,6 +565,7 @@ defmodule Livebook.Hubs.TeamClientTest do
          id: to_string(deployment_group.id),
          name: deployment_group.name,
          mode: to_string(deployment_group.mode),
+          zta_provider: to_string(deployment_group.zta_provider),
          secrets: [livebook_proto_deployment_group_secret]
        }

--- a/test/livebook_teams/teams_test.exs
+++ b/test/livebook_teams/teams_test.exs
@ -169,7 +169,6 @@ defmodule Livebook.TeamsTest do
  describe "create_deployment_group/2" do
    test "creates a new deployment group when the data is valid", %{user: user, node: node} do
      team = connect_to_teams(user, node)
-
      attrs = params_for(:deployment_group, name: "DEPLOYMENT_GROUP_#{team.id}", mode: :online)

      assert {:ok, deployment_group} = Teams.create_deployment_group(team, attrs)
@ -183,6 +182,27 @@ defmodule Livebook.TeamsTest do
      assert "has already been taken" in errors_on(changeset).name
    end

+    test "creates a new deployment group with Livebook Teams authentication",
+         %{user: user, node: node} do
+      team = connect_to_teams(user, node)
+
+      attrs =
+        params_for(:deployment_group,
+          name: "DEPLOYMENT_GROUP_#{team.id}",
+          mode: :online,
+          zta_provider: :livebook_teams
+        )
+
+      assert {:ok, deployment_group} = Teams.create_deployment_group(team, attrs)
+
+      %{id: id, name: name, mode: mode, zta_provider: zta_provider} = deployment_group
+
+      assert zta_provider == :livebook_teams
+
+      assert_receive {:deployment_group_created,
+                      %{id: ^id, name: ^name, mode: ^mode, zta_provider: ^zta_provider}}
+    end
+
    test "returns changeset errors when the name is invalid", %{user: user, node: node} do
      team = connect_to_teams(user, node)
      attrs = params_for(:deployment_group, name: "")
--- a/test/livebook_teams/web/hub/deployment_group_test.exs
+++ b/test/livebook_teams/web/hub/deployment_group_test.exs
@ -30,6 +30,7 @@ defmodule LivebookWeb.Integration.Hub.DeploymentGroupTest do
        name: deployment_group.name,
        value: deployment_group.mode,
        hub_id: deployment_group.hub_id,
+        zta_provider: :livebook_teams,
        url: url
      }
    }