Add Certificate Syncs

backend/src/services/pki-subscriber/pki-subscriber-service.ts

@@ -1,3 +1,4 @@
+/* eslint-disable no-await-in-loop */
 /* eslint-disable no-bitwise */
 import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
@@ -12,6 +13,7 @@ import {
 } from "@app/ee/services/permission/project-permission";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { logger } from "@app/lib/logger";
 import { ms } from "@app/lib/ms";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -36,6 +38,8 @@ import {
 import { TCertificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TPkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
+import { TPkiSyncDALFactory } from "@app/services/pki-sync/pki-sync-dal";
+import { TPkiSyncQueueFactory } from "@app/services/pki-sync/pki-sync-queue";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
@@ -79,6 +83,8 @@ type TPkiSubscriberServiceFactoryDep = {
   kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "decryptWithKmsKey" | "encryptWithKmsKey">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   internalCaFns: ReturnType<typeof InternalCertificateAuthorityFns>;
+  pkiSyncDAL: Pick<TPkiSyncDALFactory, "find">;
+  pkiSyncQueue: Pick<TPkiSyncQueueFactory, "queuePkiSyncSyncCertificatesById">;
 };
 
 export type TPkiSubscriberServiceFactory = ReturnType<typeof pkiSubscriberServiceFactory>;
@@ -96,8 +102,32 @@ export const pkiSubscriberServiceFactory = ({
   kmsService,
   permissionService,
   certificateAuthorityQueue,
-  internalCaFns
+  internalCaFns,
+  pkiSyncDAL,
+  pkiSyncQueue
 }: TPkiSubscriberServiceFactoryDep) => {
+  /**
+   * Trigger auto sync for PKI syncs connected to a PKI subscriber when certificates are issued
+   */
+  const triggerAutoSyncForSubscriber = async (subscriberId: string) => {
+    try {
+      // Find all PKI syncs that are connected to this subscriber and have auto sync enabled
+      const pkiSyncs = await pkiSyncDAL.find({
+        subscriberId,
+        isAutoSyncEnabled: true
+      });
+
+      // Queue sync jobs for each auto sync enabled PKI sync
+      for (const pkiSync of pkiSyncs) {
+        await pkiSyncQueue.queuePkiSyncSyncCertificatesById({ syncId: pkiSync.id });
+      }
+    } catch (error) {
+      // Don't throw error to avoid breaking the main certificate operation
+      // Just log the auto sync failure
+      logger.error(error, `Failed to trigger auto sync for subscriber ${subscriberId}:`);
+    }
+  };
+
   const createSubscriber = async ({
     name,
     commonName,
@@ -413,7 +443,12 @@ export const pkiSubscriberServiceFactory = ({
 
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(subscriber.caId);
     if (ca.internalCa?.id) {
-      return internalCaFns.issueCertificate(subscriber, ca);
+      const result = await internalCaFns.issueCertificate(subscriber, ca);
+
+      // Trigger auto sync for PKI syncs connected to this subscriber after certificate issuance
+      await triggerAutoSyncForSubscriber(subscriber.id);
+
+      return result;
     }
 
     throw new BadRequestError({ message: "CA does not support immediate issuance of certificates" });
@@ -671,6 +706,9 @@ export const pkiSubscriberServiceFactory = ({
       return cert;
     });
 
+    // Trigger auto sync for PKI syncs connected to this subscriber after certificate signing
+    await triggerAutoSyncForSubscriber(subscriber.id);
+
     return {
       certificate: leafCert.toString("pem"),
       certificateChain: `${issuingCaCertificate}\n${caCertChain}`.trim(),