From 3e8b6bf3e7760c8322eee594999ef89459ec630c Mon Sep 17 00:00:00 2001
From: Fang-Pen Lin <hello@fangpenlin.com>
Date: Thu, 23 Oct 2025 11:57:28 -0700
Subject: [PATCH] Move pwd rotation stuff to the new sql conn obj

---
 .../shared/sql/sql-resource-factory.ts        | 38 +++++++++++--------
 1 file changed, 22 insertions(+), 16 deletions(-)

diff --git a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
index 6cb65854a..55a2c0fb0 100644
--- a/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
+++ b/backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts
@@ -33,6 +33,15 @@ export interface SqlResourceConnection {
    */
   validate: (connectOnly: boolean) => Promise<void>;
 
+  /**
+   * Rotate password and return the new credentials.
+   *
+   * @param currentCredentials the current credentials to rotate
+   *
+   * @returns Promise to be resolved with the new credentials
+   */
+  rotateCredentials: (currentCredentials: TSqlAccountCredentials) => Promise<TSqlAccountCredentials>;
+
   /**
    * Close the connection.
    *
@@ -103,6 +112,11 @@ const makeSqlConnection = (
             });
           }
         },
+        rotateCredentials: async (currentCredentials) => {
+          const newPassword = alphaNumericNanoId(32);
+          await client.raw(`ALTER USER ?? WITH PASSWORD ?'`, [currentCredentials.username, newPassword]);
+          return { username: currentCredentials.username, password: newPassword };
+        },
         close: () => client.destroy()
       };
     }
@@ -148,6 +162,12 @@ const makeSqlConnection = (
             await client?.end();
           }
         },
+        rotateCredentials: async (currentCredentials) => {
+          // TODO: the pwd rotation for MySQL is not supported yet
+          throw new BadRequestError({
+            message: "Unsupported operation"
+          });
+        },
         close: async () => {}
       };
     }
@@ -269,9 +289,7 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
     currentCredentials
   ) => {
     try {
-      const newPassword = alphaNumericNanoId(32);
-
-      await executeWithGateway(
+      return await executeWithGateway(
         {
           connectionDetails,
           gatewayId,
@@ -280,20 +298,8 @@ export const sqlResourceFactory: TPamResourceFactory<TSqlResourceConnectionDetai
           password: rotationAccountCredentials.password
         },
         gatewayV2Service,
-        async (client) => {
-          switch (resourceType) {
-            case PamResource.Postgres:
-              await client.raw(`ALTER USER ?? WITH PASSWORD '${newPassword}'`, [currentCredentials.username]);
-              break;
-            default:
-              throw new BadRequestError({
-                message: `Password rotation for ${resourceType as PamResource} is not supported.`
-              });
-          }
-        }
+        (client) => client.rotateCredentials(currentCredentials)
       );
-
-      return { username: currentCredentials.username, password: newPassword };
     } catch (error) {
       if (error instanceof BadRequestError) {
         if (error.message === `password authentication failed for user "${rotationAccountCredentials.username}"`) {