misc: migrated KMIP PKI to be scoped at the org level

backend/src/server/routes/index.ts

@@ -37,9 +37,9 @@ import { identityProjectAdditionalPrivilegeServiceFactory } from "@app/ee/servic
 import { identityProjectAdditionalPrivilegeV2ServiceFactory } from "@app/ee/services/identity-project-additional-privilege-v2/identity-project-additional-privilege-v2-service";
 import { kmipClientCertificateDALFactory } from "@app/ee/services/kmip/kmip-client-certificate-dal";
 import { kmipClientDALFactory } from "@app/ee/services/kmip/kmip-client-dal";
-import { kmipInstanceConfigDALFactory } from "@app/ee/services/kmip/kmip-instance-config-dal";
-import { kmipInstanceServerCertificateDALFactory } from "@app/ee/services/kmip/kmip-instance-server-certificate-dal";
 import { kmipOperationServiceFactory } from "@app/ee/services/kmip/kmip-operation-service";
+import { kmipOrgConfigDALFactory } from "@app/ee/services/kmip/kmip-org-config-dal";
+import { kmipOrgServerCertificateDALFactory } from "@app/ee/services/kmip/kmip-org-server-certificate-dal";
 import { kmipServiceFactory } from "@app/ee/services/kmip/kmip-service";
 import { ldapConfigDALFactory } from "@app/ee/services/ldap-config/ldap-config-dal";
 import { ldapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-config-service";
@@ -388,8 +388,8 @@ export const registerRoutes = async (
   const resourceMetadataDAL = resourceMetadataDALFactory(db);
   const kmipClientDAL = kmipClientDALFactory(db);
   const kmipClientCertificateDAL = kmipClientCertificateDALFactory(db);
-  const kmipInstanceConfigDAL = kmipInstanceConfigDALFactory(db);
-  const kmipInstanceServerCertificateDAL = kmipInstanceServerCertificateDALFactory(db);
+  const kmipOrgConfigDAL = kmipOrgConfigDALFactory(db);
+  const kmipOrgServerCertificateDAL = kmipOrgServerCertificateDALFactory(db);
 
   const permissionService = permissionServiceFactory({
     permissionDAL,
@@ -630,9 +630,7 @@ export const registerRoutes = async (
     orgService,
     keyStore,
     licenseService,
-    kmsService,
-    kmipInstanceConfigDAL,
-    kmipInstanceServerCertificateDAL
+    kmsService
   });
 
   const orgAdminService = orgAdminServiceFactory({
@@ -1434,9 +1432,9 @@ export const registerRoutes = async (
     kmipClientDAL,
     permissionService,
     kmipClientCertificateDAL,
-    kmipInstanceConfigDAL,
+    kmipOrgConfigDAL,
     kmsService,
-    kmipInstanceServerCertificateDAL
+    kmipOrgServerCertificateDAL
   });
 
   const kmipOperationService = kmipOperationServiceFactory({

backend/src/server/routes/v1/admin-router.ts

@@ -1,4 +1,3 @@
-import ms from "ms";
 import { z } from "zod";
 
 import { OrganizationsSchema, SuperAdminSchema, UsersSchema } from "@app/db/schemas";
@@ -8,8 +7,6 @@ import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifySuperAdmin } from "@app/server/plugins/auth/superAdmin";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
-import { validateAltNamesField } from "@app/services/certificate-authority/certificate-authority-validators";
 import { RootKeyEncryptionStrategy } from "@app/services/kms/kms-types";
 import { getServerCfg } from "@app/services/super-admin/super-admin-service";
 import { LoginMethod } from "@app/services/super-admin/super-admin-types";
@@ -319,91 +316,4 @@ export const registerAdminRouter = async (server: FastifyZodProvider) => {
       };
     }
   });
-
-  server.route({
-    method: "POST",
-    url: "/kmip",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      body: z.object({
-        caKeyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
-      }),
-      response: {
-        200: z.object({
-          serverCertificateChain: z.string(),
-          clientCertificateChain: z.string()
-        })
-      }
-    },
-    onRequest: (req, res, done) => {
-      verifyAuth([AuthMode.JWT])(req, res, () => {
-        verifySuperAdmin(req, res, done);
-      });
-    },
-    handler: async (req) => {
-      return server.services.superAdmin.setupInstanceKmip({
-        ...req.body
-      });
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/kmip",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      response: {
-        200: z.object({
-          serverCertificateChain: z.string(),
-          clientCertificateChain: z.string()
-        })
-      }
-    },
-    onRequest: (req, res, done) => {
-      verifyAuth([AuthMode.JWT])(req, res, () => {
-        verifySuperAdmin(req, res, done);
-      });
-    },
-    handler: async () => {
-      return server.services.superAdmin.getInstanceKmip();
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/kmip/server-certificates",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      body: z.object({
-        commonName: z.string().trim().min(1),
-        altNames: validateAltNamesField,
-        keyAlgorithm: z.nativeEnum(CertKeyAlgorithm),
-        ttl: z.string().refine((val) => ms(val) > 0, "TTL must be a positive number")
-      }),
-      response: {
-        200: z.object({
-          serialNumber: z.string(),
-          certificateChain: z.string(),
-          certificate: z.string(),
-          privateKey: z.string()
-        })
-      }
-    },
-    onRequest: (req, res, done) => {
-      verifyAuth([AuthMode.JWT])(req, res, () => {
-        verifySuperAdmin(req, res, done);
-      });
-    },
-    handler: async (req) => {
-      return server.services.superAdmin.generateInstanceKmipServerCertificate({
-        ...req.body
-      });
-    }
-  });
 };