misc: added internal CA route

backend/src/db/migrations/20250512133213_add-external-ca-pki.ts

@@ -12,7 +12,12 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("certificateAuthorityId").nullable();
     });
 
-    await knex(TableName.InternalCertificateAuthority).insert(knex(TableName.CertificateAuthority).select("*"));
+    const caRows = await knex(TableName.CertificateAuthority).select("*");
+    if (caRows.length > 0) {
+      // @ts-expect-error intentional: migration
+      await knex(TableName.InternalCertificateAuthority).insert(caRows);
+    }
+
     await knex(TableName.InternalCertificateAuthority).update("certificateAuthorityId", knex.ref("id"));
 
     await knex.schema.alterTable(TableName.InternalCertificateAuthority, (t) => {
@@ -59,7 +64,20 @@ export async function up(knex: Knex): Promise<void> {
 
   if (!hasExternalCATable) {
     await knex.schema.createTable(TableName.ExternalCertificateAuthority, (t) => {
-      //
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("type").notNullable();
+      t.string("name").notNullable();
+      t.uuid("appConnectionId").nullable();
+      t.foreign("appConnectionId").references("id").inTable(TableName.AppConnection);
+      t.uuid("dnsAppConnectionId").nullable();
+      t.foreign("dnsAppConnectionId").references("id").inTable(TableName.AppConnection);
+      t.uuid("certificateAuthorityId")
+        .notNullable()
+        .references("id")
+        .inTable(TableName.CertificateAuthority)
+        .onDelete("CASCADE");
+      t.binary("credentials");
+      t.json("configuration");
     });
   }
 }
@@ -113,7 +131,7 @@ export async function down(knex: Knex): Promise<void> {
         "notAfter" = ica."notAfter",
         "activeCaCertId" = ica."activeCaCertId"
       FROM ${TableName.InternalCertificateAuthority} ica
-      WHERE ca.id = ica.id
+      WHERE ca.id = ica."certificateAuthorityId"
     `);
 
     await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {

backend/src/db/schemas/external-certificate-authorities.ts

@@ -0,0 +1,30 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ExternalCertificateAuthoritiesSchema = z.object({
+  id: z.string().uuid(),
+  type: z.string(),
+  name: z.string(),
+  appConnectionId: z.string().uuid().nullable().optional(),
+  dnsAppConnectionId: z.string().uuid().nullable().optional(),
+  certificateAuthorityId: z.string().uuid(),
+  credentials: zodBuffer.nullable().optional(),
+  configuration: z.unknown().nullable().optional()
+});
+
+export type TExternalCertificateAuthorities = z.infer<typeof ExternalCertificateAuthoritiesSchema>;
+export type TExternalCertificateAuthoritiesInsert = Omit<
+  z.input<typeof ExternalCertificateAuthoritiesSchema>,
+  TImmutableDBKeys
+>;
+export type TExternalCertificateAuthoritiesUpdate = Partial<
+  Omit<z.input<typeof ExternalCertificateAuthoritiesSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/index.ts

@@ -20,6 +20,7 @@ export * from "./certificate-templates";
 export * from "./certificates";
 export * from "./dynamic-secret-leases";
 export * from "./dynamic-secrets";
+export * from "./external-certificate-authorities";
 export * from "./external-group-org-role-mappings";
 export * from "./external-kms";
 export * from "./gateways";