Add permissioning to SSH, add publicKey return for SSH CA, polish

backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-dal.ts

@@ -34,5 +34,30 @@ export const sshCertificateTemplateDALFactory = (db: TDbClient) => {
     }
   };
 
-  return { ...sshCertificateTemplateOrm, getById };
+  const getByName = async (name: string, orgId: string, tx?: Knex) => {
+    try {
+      const certTemplate = await (tx || db.replicaNode())(TableName.SshCertificateTemplate)
+        .join(
+          TableName.SshCertificateAuthority,
+          `${TableName.SshCertificateAuthority}.id`,
+          `${TableName.SshCertificateTemplate}.sshCaId`
+        )
+        .join(TableName.Organization, `${TableName.Organization}.id`, `${TableName.SshCertificateAuthority}.orgId`)
+        .where(`${TableName.SshCertificateTemplate}.name`, "=", name)
+        .where(`${TableName.Organization}.id`, "=", orgId)
+        .select(selectAllTableCols(TableName.SshCertificateTemplate))
+        .select(
+          db.ref("orgId").withSchema(TableName.SshCertificateAuthority),
+          db.ref("friendlyName").as("caName").withSchema(TableName.SshCertificateAuthority),
+          db.ref("status").as("caStatus").withSchema(TableName.SshCertificateAuthority)
+        )
+        .first();
+
+      return certTemplate;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Get SSH certificate template by name" });
+    }
+  };
+
+  return { ...sshCertificateTemplateOrm, getById, getByName };
 };

backend/src/ee/services/ssh-certificate-template/ssh-certificate-template-service.ts

@@ -1,7 +1,10 @@
 import { ForbiddenError } from "@casl/ability";
 import ms from "ms";
 
-import { OrgPermissionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
+import {
+  OrgPermissionSshCertificateTemplateActions,
+  OrgPermissionSubjects
+} from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
@@ -58,10 +61,17 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Create,
+      OrgPermissionSshCertificateTemplateActions.Create,
       OrgPermissionSubjects.SshCertificateTemplates
     );
 
+    const existingTemplate = await sshCertificateTemplateDAL.getByName(name, ca.orgId);
+    if (existingTemplate) {
+      throw new BadRequestError({
+        message: `SSH certificate template with name ${name} already exists`
+      });
+    }
+
     if (ms(ttl) > ms(maxTTL)) {
       throw new BadRequestError({
         message: "TTL cannot be greater than max TTL"
@@ -114,10 +124,19 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Edit,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Edit,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
+    if (name) {
+      const existingTemplate = await sshCertificateTemplateDAL.getByName(name, actorOrgId);
+      if (existingTemplate) {
+        throw new BadRequestError({
+          message: `SSH certificate template with name ${name} already exists`
+        });
+      }
+    }
+
     if (ms(ttl || certTemplate.ttl) > ms(maxTTL || certTemplate.maxTTL)) {
       throw new BadRequestError({
         message: "TTL cannot be greater than max TTL"
@@ -164,8 +183,8 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Delete,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Delete,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
     await sshCertificateTemplateDAL.deleteById(certificateTemplate.id);
@@ -190,8 +209,8 @@ export const sshCertificateTemplateServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Read,
-      OrgPermissionSubjects.SshCertificateAuthorities
+      OrgPermissionSshCertificateTemplateActions.Read,
+      OrgPermissionSubjects.SshCertificateTemplates
     );
 
     return certTemplate;