misc: updated est configuration to be binded to certificate template

backend/src/server/routes/est/certificate-est-router.ts

@@ -39,13 +39,13 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
     }
 
     const urlFragments = req.url.split("/");
-    const certificateAuthorityId = urlFragments.slice(-2)[0];
-    const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
+    const certificateTemplateId = urlFragments.slice(-2)[0];
+    const estConfig = await server.services.certificateTemplate.getEstConfiguration({
       isInternal: true,
-      caId: certificateAuthorityId
+      certificateTemplateId
     });
 
-    if (!caEstConfig.isEnabled) {
+    if (!estConfig.isEnabled) {
       throw new BadRequestError({
         message: "EST enrollment is disabled"
       });
@@ -68,7 +68,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
       .trim();
 
     // validate SSL client cert against configured CA
-    const chainCerts = caEstConfig.caChain
+    const chainCerts = estConfig.caChain
       .match(/-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g)
       ?.map((cert) => {
         const processedBody = cert
@@ -122,7 +122,7 @@ export const registerCertificateEstRouter = async (server: FastifyZodProvider) =
       });
     }
 
-    const isPasswordValid = await bcrypt.compare(password, caEstConfig.hashedPassphrase);
+    const isPasswordValid = await bcrypt.compare(password, estConfig.hashedPassphrase);
     if (!isPasswordValid) {
       throw new UnauthorizedError({
         message: "Invalid credentials"

backend/src/server/routes/index.ts

@@ -86,11 +86,11 @@ import { certificateDALFactory } from "@app/services/certificate/certificate-dal
 import { certificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { certificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { certificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
-import { certificateAuthorityEstConfigDALFactory } from "@app/services/certificate-authority/certificate-authority-est-config-dal";
 import { certificateAuthorityQueueFactory } from "@app/services/certificate-authority/certificate-authority-queue";
 import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { certificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
+import { certificateTemplateEstConfigDALFactory } from "@app/services/certificate-template/certificate-template-est-config-dal";
 import { certificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
@@ -591,8 +591,8 @@ export const registerRoutes = async (
   const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
   const certificateAuthoritySecretDAL = certificateAuthoritySecretDALFactory(db);
   const certificateAuthorityCrlDAL = certificateAuthorityCrlDALFactory(db);
-  const certificateAuthorityEstConfigDAL = certificateAuthorityEstConfigDALFactory(db);
   const certificateTemplateDAL = certificateTemplateDALFactory(db);
+  const certificateTemplateEstConfigDAL = certificateTemplateEstConfigDALFactory(db);
 
   const certificateDAL = certificateDALFactory(db);
   const certificateBodyDAL = certificateBodyDALFactory(db);
@@ -636,8 +636,7 @@ export const registerRoutes = async (
     pkiCollectionItemDAL,
     projectDAL,
     kmsService,
-    permissionService,
-    certificateAuthorityEstConfigDAL
+    permissionService
   });
 
   const certificateAuthorityCrlService = certificateAuthorityCrlServiceFactory({
@@ -651,8 +650,11 @@ export const registerRoutes = async (
 
   const certificateTemplateService = certificateTemplateServiceFactory({
     certificateTemplateDAL,
+    certificateTemplateEstConfigDAL,
     certificateAuthorityDAL,
-    permissionService
+    permissionService,
+    kmsService,
+    projectDAL
   });
 
   const pkiAlertService = pkiAlertServiceFactory({

backend/src/server/routes/v1/certificate-authority-router.ts

@@ -2,7 +2,6 @@ import ms from "ms";
 import { z } from "zod";
 
 import { CertificateAuthoritiesSchema } from "@app/db/schemas";
-import { CertificateAuthorityEstConfigsSchema } from "@app/db/schemas/certificate-authority-est-configs";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -700,129 +699,4 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       };
     }
   });
-
-  server.route({
-    method: "POST",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Create CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      body: z.object({
-        caChain: z.string().trim().min(1),
-        passphrase: z.string().min(1),
-        isEnabled: z.boolean().default(true)
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          })
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.createCaEstConfiguration({
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Update CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      body: z.object({
-        caChain: z.string().trim().min(1).optional(),
-        passphrase: z.string().min(1).optional(),
-        isEnabled: z.boolean().optional()
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          })
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.updateCaEstConfiguration({
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId,
-        ...req.body
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:caId/est-config",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      description: "Get CA EST configuration",
-      params: z.object({
-        caId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          caEstConfig: CertificateAuthorityEstConfigsSchema.pick({
-            caId: true,
-            isEnabled: true
-          }).merge(
-            z.object({
-              caChain: z.string()
-            })
-          )
-        })
-      }
-    },
-    handler: async (req) => {
-      const caEstConfig = await server.services.certificateAuthority.getCaEstConfiguration({
-        isInternal: false,
-        caId: req.params.caId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      return {
-        caEstConfig
-      };
-    }
-  });
 };

backend/src/server/routes/v1/certificate-template-router.ts

@@ -1,6 +1,7 @@
 import ms from "ms";
 import { z } from "zod";
 
+import { CertificateTemplateEstConfigsSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { CERTIFICATE_TEMPLATES } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -9,6 +10,12 @@ import { AuthMode } from "@app/services/auth/auth-type";
 import { sanitizedCertificateTemplate } from "@app/services/certificate-template/certificate-template-schema";
 import { validateTemplateRegexField } from "@app/services/certificate-template/certificate-template-validators";
 
+const sanitizedEstConfig = CertificateTemplateEstConfigsSchema.pick({
+  id: true,
+  certificateTemplateId: true,
+  isEnabled: true
+});
+
 export const registerCertificateTemplateRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
@@ -202,4 +209,106 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
       return certificateTemplate;
     }
   });
+
+  server.route({
+    method: "POST",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Create Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      body: z.object({
+        caChain: z.string().trim().min(1),
+        passphrase: z.string().min(1),
+        isEnabled: z.boolean().default(true)
+      }),
+      response: {
+        200: sanitizedEstConfig
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.createEstConfiguration({
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return estConfig;
+    }
+  });
+
+  server.route({
+    method: "PATCH",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: writeLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Update Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      body: z.object({
+        caChain: z.string().trim().min(1).optional(),
+        passphrase: z.string().min(1).optional(),
+        isEnabled: z.boolean().optional()
+      }),
+      response: {
+        200: sanitizedEstConfig
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.updateEstConfiguration({
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.body
+      });
+
+      return estConfig;
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/:certificateTemplateId/est-config",
+    config: {
+      rateLimit: readLimit
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      description: "Get Certificate Template EST configuration",
+      params: z.object({
+        certificateTemplateId: z.string().trim()
+      }),
+      response: {
+        200: sanitizedEstConfig.extend({
+          caChain: z.string()
+        })
+      }
+    },
+    handler: async (req) => {
+      const estConfig = await server.services.certificateTemplate.getEstConfiguration({
+        isInternal: false,
+        certificateTemplateId: req.params.certificateTemplateId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
+
+      return estConfig;
+    }
+  });
 };