Improve external configs schema

backend/src/server/routes/v1/certificate-profiles-router.ts

@@ -8,6 +8,7 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CertStatus } from "@app/services/certificate/certificate-types";
+import { ExternalConfigUnionSchema } from "@app/services/certificate-profile/certificate-profile-external-config-schemas";
 import { EnrollmentType, IssuerType } from "@app/services/certificate-profile/certificate-profile-types";
 
 export const registerCertificateProfilesRouter = async (server: FastifyZodProvider) => {
@@ -47,7 +48,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
             })
             .optional(),
           acmeConfig: z.object({}).optional(),
-          externalConfigs: z.record(z.unknown()).nullable().optional()
+          externalConfigs: ExternalConfigUnionSchema
         })
         .refine(
           (data) => {
@@ -151,7 +152,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           })
         })
       }
@@ -247,7 +248,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
                 directoryUrl: z.string()
               })
               .optional(),
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           }).array(),
           totalCount: z.number()
         })
@@ -293,7 +294,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           }).extend({
             certificateAuthority: z
               .object({
@@ -328,7 +329,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
                 renewBeforeDays: z.number().optional()
               })
               .optional(),
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           })
         })
       }
@@ -377,7 +378,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           })
         })
       }
@@ -433,7 +434,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
               renewBeforeDays: z.number().min(1).max(30).optional()
             })
             .optional(),
-          externalConfigs: z.record(z.unknown()).nullable().optional()
+          externalConfigs: ExternalConfigUnionSchema
         })
         .refine(
           (data) => {
@@ -456,7 +457,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           })
         })
       }
@@ -503,7 +504,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       response: {
         200: z.object({
           certificateProfile: PkiCertificateProfilesSchema.extend({
-            externalConfigs: z.record(z.unknown()).nullable().optional()
+            externalConfigs: ExternalConfigUnionSchema
           })
         })
       }

backend/src/services/certificate-profile/certificate-profile-external-config-schemas.ts

@@ -0,0 +1,50 @@
+import { z } from "zod";
+
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+
+/**
+ * External configuration schema for Azure AD CS Certificate Authority
+ */
+export const AzureAdCsExternalConfigSchema = z.object({
+  template: z
+    .string()
+    .min(1, "Template name is required for Azure AD CS")
+    .describe("Certificate template name for Azure AD CS")
+});
+
+/**
+ * External configuration schema for ACME Certificate Authority
+ */
+export const AcmeExternalConfigSchema = z.object({});
+
+/**
+ * Map of CA types to their corresponding external configuration schemas
+ */
+export const ExternalConfigSchemaMap = {
+  [CaType.AZURE_AD_CS]: AzureAdCsExternalConfigSchema,
+  [CaType.ACME]: AcmeExternalConfigSchema,
+  [CaType.INTERNAL]: z.object({}).optional() // Internal CAs don't use external configs
+} as const;
+
+export const createExternalConfigSchema = (caType?: CaType | null) => {
+  if (!caType || caType === CaType.INTERNAL) {
+    return z.object({}).nullable().optional();
+  }
+
+  const schema = ExternalConfigSchemaMap[caType];
+  if (!schema) {
+    return z.object({}).nullable().optional();
+  }
+
+  return schema.nullable().optional();
+};
+
+/**
+ * Union type of all possible external configuration schemas
+ */
+export const ExternalConfigUnionSchema = z
+  .union([AzureAdCsExternalConfigSchema, AcmeExternalConfigSchema, z.object({})])
+  .nullable()
+  .optional();
+
+export type TExternalConfig = z.infer<typeof ExternalConfigUnionSchema>;