awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-14 17:40:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: migrated KMIP PKI to be scoped at the org level

Browse Source
This commit is contained in:
Sheen Capadngan
2025-02-17 15:54:02 +08:00
parent af652f7e52
commit 603b740bbe
33 changed files with 835 additions and 645 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/db/migrations/20250203141127_add-kmip.ts
+20 -14
View File
@@ -16,11 +16,15 @@ export async function up(knex: Knex): Promise<void> {
});
}
const hasKmipInstanceConfigTable = await knex.schema.hasTable(TableName.KmipInstanceConfig);
if (!hasKmipInstanceConfigTable) {
await knex.schema.createTable(TableName.KmipInstanceConfig, (t) => {
const hasKmipOrgPkiConfig = await knex.schema.hasTable(TableName.KmipOrgConfig);
if (!hasKmipOrgPkiConfig) {
await knex.schema.createTable(TableName.KmipOrgConfig, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.uuid("orgId").notNullable();
t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
t.unique("orgId");
t.string("caKeyAlgorithm").notNullable();
t.datetime("rootCaIssuedAt").notNullable();
@@ -46,13 +50,15 @@ export async function up(knex: Knex): Promise<void> {
t.timestamps(true, true, true);
});
await createOnUpdateTrigger(knex, TableName.KmipInstanceConfig);
await createOnUpdateTrigger(knex, TableName.KmipOrgConfig);
}
const hasKmipInstanceServerCertTable = await knex.schema.hasTable(TableName.KmipInstanceServerCertificates);
if (!hasKmipInstanceServerCertTable) {
await knex.schema.createTable(TableName.KmipInstanceServerCertificates, (t) => {
const hasKmipOrgServerCertTable = await knex.schema.hasTable(TableName.KmipOrgServerCertificates);
if (!hasKmipOrgServerCertTable) {
await knex.schema.createTable(TableName.KmipOrgServerCertificates, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.uuid("orgId").notNullable();
t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
t.string("commonName").notNullable();
t.string("altNames").notNullable();
t.string("serialNumber").notNullable();
@@ -79,15 +85,15 @@ export async function up(knex: Knex): Promise<void> {
}
export async function down(knex: Knex): Promise<void> {
const hasKmipInstanceConfigTable = await knex.schema.hasTable(TableName.KmipInstanceConfig);
if (hasKmipInstanceConfigTable) {
await knex.schema.dropTable(TableName.KmipInstanceConfig);
await dropOnUpdateTrigger(knex, TableName.KmipInstanceConfig);
const hasKmipOrgPkiConfig = await knex.schema.hasTable(TableName.KmipOrgConfig);
if (hasKmipOrgPkiConfig) {
await knex.schema.dropTable(TableName.KmipOrgConfig);
await dropOnUpdateTrigger(knex, TableName.KmipOrgConfig);
}
const hasKmipInstanceServerCertTable = await knex.schema.hasTable(TableName.KmipInstanceServerCertificates);
if (hasKmipInstanceServerCertTable) {
await knex.schema.dropTable(TableName.KmipInstanceServerCertificates);
const hasKmipOrgServerCertTable = await knex.schema.hasTable(TableName.KmipOrgServerCertificates);
if (hasKmipOrgServerCertTable) {
await knex.schema.dropTable(TableName.KmipOrgServerCertificates);
}
const hasKmipClientCertTable = await knex.schema.hasTable(TableName.KmipClientCertificates);
backend/src/db/schemas/index.ts
+2 -2
View File
@@ -47,8 +47,8 @@ export * from "./integrations";
export * from "./internal-kms";
export * from "./kmip-client-certificates";
export * from "./kmip-clients";
export * from "./kmip-instance-configs";
export * from "./kmip-instance-server-certificates";
export * from "./kmip-org-configs";
export * from "./kmip-org-server-certificates";
export * from "./kms-key-versions";
export * from "./kms-keys";
export * from "./kms-root-config";
backend/src/db/schemas/kmip-instance-configs.ts → backend/src/db/schemas/kmip-org-configs.ts
+5 -4
View File
@@ -9,8 +9,9 @@ import { zodBuffer } from "@app/lib/zod";
import { TImmutableDBKeys } from "./models";
export const KmipInstanceConfigsSchema = z.object({
export const KmipOrgConfigsSchema = z.object({
id: z.string().uuid(),
orgId: z.string().uuid(),
caKeyAlgorithm: z.string(),
rootCaIssuedAt: z.date(),
rootCaExpiration: z.date(),
@@ -33,6 +34,6 @@ export const KmipInstanceConfigsSchema = z.object({
updatedAt: z.date()
});
export type TKmipInstanceConfigs = z.infer<typeof KmipInstanceConfigsSchema>;
export type TKmipInstanceConfigsInsert = Omit<z.input<typeof KmipInstanceConfigsSchema>, TImmutableDBKeys>;
export type TKmipInstanceConfigsUpdate = Partial<Omit<z.input<typeof KmipInstanceConfigsSchema>, TImmutableDBKeys>>;
export type TKmipOrgConfigs = z.infer<typeof KmipOrgConfigsSchema>;
export type TKmipOrgConfigsInsert = Omit<z.input<typeof KmipOrgConfigsSchema>, TImmutableDBKeys>;
export type TKmipOrgConfigsUpdate = Partial<Omit<z.input<typeof KmipOrgConfigsSchema>, TImmutableDBKeys>>;
backend/src/db/schemas/kmip-instance-server-certificates.ts → backend/src/db/schemas/kmip-org-server-certificates.ts
+6 -8
View File
@@ -9,8 +9,9 @@ import { zodBuffer } from "@app/lib/zod";
import { TImmutableDBKeys } from "./models";
export const KmipInstanceServerCertificatesSchema = z.object({
export const KmipOrgServerCertificatesSchema = z.object({
id: z.string().uuid(),
orgId: z.string().uuid(),
commonName: z.string(),
altNames: z.string(),
serialNumber: z.string(),
@@ -21,11 +22,8 @@ export const KmipInstanceServerCertificatesSchema = z.object({
encryptedChain: zodBuffer
});
export type TKmipInstanceServerCertificates = z.infer<typeof KmipInstanceServerCertificatesSchema>;
export type TKmipInstanceServerCertificatesInsert = Omit<
z.input<typeof KmipInstanceServerCertificatesSchema>,
TImmutableDBKeys
>;
export type TKmipInstanceServerCertificatesUpdate = Partial<
Omit<z.input<typeof KmipInstanceServerCertificatesSchema>, TImmutableDBKeys>
export type TKmipOrgServerCertificates = z.infer<typeof KmipOrgServerCertificatesSchema>;
export type TKmipOrgServerCertificatesInsert = Omit<z.input<typeof KmipOrgServerCertificatesSchema>, TImmutableDBKeys>;
export type TKmipOrgServerCertificatesUpdate = Partial<
Omit<z.input<typeof KmipOrgServerCertificatesSchema>, TImmutableDBKeys>
>;
backend/src/db/schemas/models.ts
+2 -2
View File
@@ -134,8 +134,8 @@ export enum TableName {
AppConnection = "app_connections",
SecretSync = "secret_syncs",
KmipClient = "kmip_clients",
KmipInstanceConfig = "kmip_instance_configs",
KmipInstanceServerCertificates = "kmip_instance_server_certificates",
KmipOrgConfig = "kmip_org_configs",
KmipOrgServerCertificates = "kmip_org_server_certificates",
KmipClientCertificates = "kmip_client_certificates"
}