misc: initial integration with local and pam proxy

backend/src/ee/routes/v1/pam-account-router.ts

@@ -67,11 +67,9 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
       body: z.object({
         duration: z
           .string()
-          .nullable()
           .optional()
           .transform((val, ctx) => {
             if (val === undefined) return undefined;
-            if (!val || val === "permanent") return null;
             const parsedMs = ms(val);
 
             if (typeof parsedMs !== "number" || parsedMs <= 0) {
@@ -88,8 +86,12 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => {
         200: z.object({
           sessionId: z.string(),
           resourceType: z.nativeEnum(PamResource),
-          relayCertificate: z.string(),
-          gatewayCertificate: z.string(),
+          relayClientCertificate: z.string(),
+          relayClientPrivateKey: z.string(),
+          relayServerCertificateChain: z.string(),
+          gatewayClientCertificate: z.string(),
+          gatewayClientPrivateKey: z.string(),
+          gatewayServerCertificateChain: z.string(),
           relayHost: z.string()
         })
       }

backend/src/ee/routes/v2/gateway-router.ts

@@ -1,6 +1,7 @@
 import z from "zod";
 
 import { GatewaysV2Schema } from "@app/db/schemas";
+import { zodBuffer } from "@app/lib/zod";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -130,4 +131,25 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
       return gateway;
     }
   });
+
+  server.route({
+    method: "GET",
+    url: "/pam-session-key",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      response: {
+        200: zodBuffer
+      }
+    },
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const pamSessionKey = await server.services.gatewayV2.getPamSessionKey({
+        orgPermission: req.permission
+      });
+
+      return pamSessionKey;
+    }
+  });
 };