misc: add kmip metadata field

backend/src/db/migrations/20251010111410_add-kmip-metadata.ts

@@ -0,0 +1,19 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasColumn(TableName.KmsKey, "kmipMetadata"))) {
+    await knex.schema.alterTable(TableName.KmsKey, (t) => {
+      t.jsonb("kmipMetadata");
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.KmsKey, "kmipMetadata")) {
+    await knex.schema.alterTable(TableName.KmsKey, (t) => {
+      t.dropColumn("kmipMetadata");
+    });
+  }
+}

backend/src/db/schemas/kms-keys.ts

@@ -17,7 +17,8 @@ export const KmsKeysSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   projectId: z.string().nullable().optional(),
-  keyUsage: z.string().default("encrypt-decrypt")
+  keyUsage: z.string().default("encrypt-decrypt"),
+  kmipMetadata: z.unknown().nullable().optional()
 });
 
 export type TKmsKeys = z.infer<typeof KmsKeysSchema>;

backend/src/ee/routes/v1/kmip-spec-router.ts

@@ -128,7 +128,8 @@ export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
         200: z.object({
           id: z.string(),
           value: z.string(),
-          algorithm: z.string()
+          algorithm: z.string(),
+          kmipMetadata: z.record(z.any()).optional()
         })
       }
     },
@@ -433,7 +434,8 @@ export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
       body: z.object({
         key: z.string(),
         name: z.string(),
-        algorithm: z.nativeEnum(SymmetricKeyAlgorithm)
+        algorithm: z.nativeEnum(SymmetricKeyAlgorithm),
+        kmipMetadata: z.record(z.any()).optional()
       }),
       response: {
         200: z.object({

backend/src/ee/services/kmip/kmip-operation-service.ts

@@ -183,7 +183,8 @@ export const kmipOperationServiceFactory = ({
       algorithm: completeKeyDetails.internalKms.encryptionAlgorithm,
       isActive: !key.isDisabled,
       createdAt: key.createdAt,
-      updatedAt: key.updatedAt
+      updatedAt: key.updatedAt,
+      kmipMetadata: key.kmipMetadata as Record<string, unknown>
     };
   };
 
@@ -373,7 +374,8 @@ export const kmipOperationServiceFactory = ({
     actor,
     actorId,
     actorAuthMethod,
-    actorOrgId
+    actorOrgId,
+    kmipMetadata
   }: TKmipRegisterDTO) => {
     const { permission } = await permissionService.getOrgPermission(
       actor,
@@ -405,7 +407,8 @@ export const kmipOperationServiceFactory = ({
       isReserved: false,
       projectId,
       keyUsage: KmsKeyUsage.ENCRYPT_DECRYPT,
-      orgId: project.orgId
+      orgId: project.orgId,
+      kmipMetadata
     });
 
     return kmsKey;

backend/src/ee/services/kmip/kmip-types.ts

@@ -78,6 +78,7 @@ export type TKmipRegisterDTO = {
   name: string;
   key: string;
   algorithm: SymmetricKeyAlgorithm;
+  kmipMetadata?: Record<string, unknown>;
 } & KmipOperationBaseDTO;
 
 export type TSetupOrgKmipDTO = {

backend/src/services/kms/kms-service.ts

@@ -392,7 +392,7 @@ export const kmsServiceFactory = ({
   };
 
   const importKeyMaterial = async (
-    { key, algorithm, name, isReserved, projectId, orgId, keyUsage }: TImportKeyMaterialDTO,
+    { key, algorithm, name, isReserved, projectId, orgId, keyUsage, kmipMetadata }: TImportKeyMaterialDTO,
     tx?: Knex
   ) => {
     // daniel: currently we only support imports for encrypt/decrypt keys
@@ -416,7 +416,8 @@ export const kmsServiceFactory = ({
           keyUsage: KmsKeyUsage.ENCRYPT_DECRYPT,
           orgId,
           isReserved,
-          projectId
+          projectId,
+          kmipMetadata
         },
         db
       );

backend/src/services/kms/kms-types.ts

@@ -99,4 +99,5 @@ export type TImportKeyMaterialDTO = {
   projectId: string;
   orgId: string;
   keyUsage: KmsKeyUsage;
+  kmipMetadata?: Record<string, unknown>;
 };