Improvements to cert-syncs

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-constants.ts

@@ -0,0 +1,52 @@
+import RE2 from "re2";
+
+import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { PkiSync } from "@app/services/pki-sync/pki-sync-enums";
+
+/**
+ * Azure Key Vault naming constraints for certificates
+ */
+export const AZURE_KEY_VAULT_CERTIFICATE_NAMING = {
+  /**
+   * Regular expression pattern for valid Azure Key Vault certificate names
+   * Must contain only alphanumeric characters and hyphens (a-z, A-Z, 0-9, -)
+   * Must be 1-127 characters long
+   */
+  NAME_PATTERN: new RE2("^[a-zA-Z0-9-]{1,127}$"),
+
+  /**
+   * String of characters that are forbidden in Azure Key Vault certificate names
+   */
+  FORBIDDEN_CHARACTERS: "!@#$%^&*()+=[]{}|\\:;\"'<>,.?/~` _",
+
+  /**
+   * Maximum length for certificate names in Azure Key Vault
+   */
+  MAX_NAME_LENGTH: 127,
+
+  /**
+   * Minimum length for certificate names in Azure Key Vault
+   */
+  MIN_NAME_LENGTH: 1,
+
+  /**
+   * String representation of the allowed character pattern (for UI display)
+   */
+  ALLOWED_CHARACTER_PATTERN: "^[a-zA-Z0-9-]{1,127}$"
+} as const;
+
+/**
+ * Azure Key Vault PKI Sync list option configuration
+ */
+export const AZURE_KEY_VAULT_PKI_SYNC_LIST_OPTION = {
+  name: "Azure Key Vault" as const,
+  connection: AppConnection.AzureKeyVault,
+  destination: PkiSync.AzureKeyVault,
+  canImportCertificates: false,
+  canRemoveCertificates: true,
+  defaultCertificateNameSchema: "Infisical-PKI-Sync-{{certificateId}}",
+  forbiddenCharacters: AZURE_KEY_VAULT_CERTIFICATE_NAMING.FORBIDDEN_CHARACTERS,
+  allowedCharacterPattern: AZURE_KEY_VAULT_CERTIFICATE_NAMING.ALLOWED_CHARACTER_PATTERN,
+  maxCertificateNameLength: AZURE_KEY_VAULT_CERTIFICATE_NAMING.MAX_NAME_LENGTH,
+  minCertificateNameLength: AZURE_KEY_VAULT_CERTIFICATE_NAMING.MIN_NAME_LENGTH
+} as const;

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-fns.ts

@@ -5,14 +5,12 @@ import * as crypto from "crypto";
 import { request } from "@app/lib/config/request";
 import { logger } from "@app/lib/logger";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { getAzureConnectionAccessToken } from "@app/services/app-connection/azure-key-vault";
 import { createConnectionQueue, RateLimitConfig } from "@app/services/connection-queue";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { matchesCertificateNameSchema } from "@app/services/pki-sync/pki-sync-fns";
 import { TCertificateMap } from "@app/services/pki-sync/pki-sync-types";
 
-import { PkiSync } from "../pki-sync-enums";
 import { PkiSyncError } from "../pki-sync-errors";
 import { TPkiSyncWithCredentials } from "../pki-sync-types";
 import { GetAzureKeyVaultCertificate, TAzureKeyVaultPkiSyncConfig } from "./azure-key-vault-pki-sync-types";
@@ -45,19 +43,6 @@ const isInfisicalManagedCertificate = (certificateName: string, pkiSync: TPkiSyn
   return certificateName.startsWith("Infisical-PKI-Sync-");
 };
 
-export const AZURE_KEY_VAULT_PKI_SYNC_LIST_OPTION = {
-  name: "Azure Key Vault" as const,
-  connection: AppConnection.AzureKeyVault,
-  destination: PkiSync.AzureKeyVault,
-  canImportCertificates: false,
-  canRemoveCertificates: true,
-  defaultCertificateNameSchema: "Infisical-PKI-Sync-{{certificateId}}",
-  forbiddenCharacters: "!@#$%^&*()+=[]{}|\\:;\"'<>,.?/~` _",
-  allowedCharacterPattern: "^[a-zA-Z0-9-]{1,127}$",
-  maxCertificateNameLength: 127,
-  minCertificateNameLength: 1
-};
-
 type TAzureKeyVaultPkiSyncFactoryDeps = {
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "updateById">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;

backend/src/services/pki-sync/azure-key-vault/azure-key-vault-pki-sync-schemas.ts

@@ -5,6 +5,8 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 import { PkiSync } from "@app/services/pki-sync/pki-sync-enums";
 import { PkiSyncSchema } from "@app/services/pki-sync/pki-sync-schemas";
 
+import { AZURE_KEY_VAULT_CERTIFICATE_NAMING } from "./azure-key-vault-pki-sync-constants";
+
 export const AzureKeyVaultPkiSyncConfigSchema = z.object({
   vaultBaseUrl: z.string().url()
 });
@@ -22,12 +24,12 @@ const AzureKeyVaultPkiSyncOptionsSchema = z.object({
         const testName = schema
           .replace(new RE2("\\{\\{certificateId\\}\\}", "g"), "")
           .replace(new RE2("\\{\\{environment\\}\\}", "g"), "");
-        const azureNamePattern = new RE2("^[a-zA-Z0-9-]{1,127}$");
 
-        const forbiddenChars = "!@#$%^&*()+=[]{}|\\:;\"'<>,.?/~` _";
-        const hasForbiddenChars = forbiddenChars.split("").some((char) => testName.includes(char));
+        const hasForbiddenChars = AZURE_KEY_VAULT_CERTIFICATE_NAMING.FORBIDDEN_CHARACTERS.split("").some((char) =>
+          testName.includes(char)
+        );
 
-        return azureNamePattern.test(testName) && !hasForbiddenChars;
+        return AZURE_KEY_VAULT_CERTIFICATE_NAMING.NAME_PATTERN.test(testName) && !hasForbiddenChars;
       },
       {
         message:

backend/src/services/pki-sync/azure-key-vault/index.ts

@@ -1,3 +1,4 @@
+export * from "./azure-key-vault-pki-sync-constants";
 export * from "./azure-key-vault-pki-sync-fns";
 export * from "./azure-key-vault-pki-sync-schemas";
 export * from "./azure-key-vault-pki-sync-types";