misc: added internal CA route

backend/src/services/certificate-authority/internal/internal-certificate-authority-dal.ts

@@ -0,0 +1,13 @@
+import { TDbClient } from "@app/db";
+import { TableName } from "@app/db/schemas";
+import { ormify } from "@app/lib/knex";
+
+export type TInternalCertificateAuthorityDALFactory = ReturnType<typeof internalCertificateAuthorityDALFactory>;
+
+export const internalCertificateAuthorityDALFactory = (db: TDbClient) => {
+  const caOrm = ormify(db, TableName.InternalCertificateAuthority);
+
+  return {
+    ...caOrm
+  };
+};

backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts

@@ -0,0 +1,58 @@
+import { z } from "zod";
+
+import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
+
+import { CaType, InternalCaType } from "../certificate-authority-enums";
+import {
+  BaseCertificateAuthoritySchema,
+  GenericCreateCertificateAuthorityFieldsSchema,
+  GenericUpdateCertificateAuthorityFieldsSchema
+} from "../certificate-authority-schemas";
+import { validateCaDateField } from "../certificate-authority-validators";
+
+const InternalCertificateAuthorityConfigurationSchema = z
+  .object({
+    type: z.nativeEnum(InternalCaType),
+    friendlyName: z.string().optional(),
+    commonName: z.string().trim(),
+    organization: z.string().trim(),
+    ou: z.string().trim(),
+    country: z.string().trim(),
+    province: z.string().trim(),
+    locality: z.string().trim(),
+    // format: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Date#date_time_string_format
+    notBefore: validateCaDateField.optional(),
+    notAfter: validateCaDateField.optional(),
+    maxPathLength: z.number().min(-1),
+    keyAlgorithm: z.nativeEnum(CertKeyAlgorithm)
+  })
+  .refine(
+    (data) => {
+      // Check that at least one of the specified fields is non-empty
+      return [data.commonName, data.organization, data.ou, data.country, data.province, data.locality].some(
+        (field) => field !== ""
+      );
+    },
+    {
+      message:
+        "At least one of the fields commonName, organization, ou, country, province, or locality must be non-empty",
+      path: []
+    }
+  );
+
+export const InternalCertificateAuthoritySchema = BaseCertificateAuthoritySchema(CaType.INTERNAL).extend({
+  type: z.literal(CaType.INTERNAL),
+  configuration: InternalCertificateAuthorityConfigurationSchema
+});
+
+export const CreateInternalCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
+  CaType.INTERNAL
+).extend({
+  configuration: InternalCertificateAuthorityConfigurationSchema
+});
+
+export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
+  CaType.INTERNAL
+).extend({
+  configuration: InternalCertificateAuthorityConfigurationSchema.optional()
+});

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -0,0 +1,209 @@
+import { z } from "zod";
+
+import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
+import { TProjectPermission } from "@app/lib/types";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
+
+import { TCertificateAuthorityCertDALFactory } from "../certificate-authority-cert-dal";
+import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
+import { CaRenewalType, CaStatus, InternalCaType } from "../certificate-authority-enums";
+import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority-secret-dal";
+import {
+  CreateInternalCertificateAuthoritySchema,
+  InternalCertificateAuthoritySchema
+} from "./internal-certificate-authority-schemas";
+
+export type TInternalCertificateAuthority = z.infer<typeof InternalCertificateAuthoritySchema>;
+
+export type TInternalCertificateAuthorityInput = z.infer<typeof CreateInternalCertificateAuthoritySchema>;
+
+export type TCreateCaDTO =
+  | {
+      isInternal: true;
+      projectId: string;
+      type: InternalCaType;
+      friendlyName?: string;
+      commonName: string;
+      organization: string;
+      ou: string;
+      country: string;
+      province: string;
+      locality: string;
+      notBefore?: string;
+      notAfter?: string;
+      maxPathLength: number;
+      keyAlgorithm: CertKeyAlgorithm;
+      requireTemplateForIssuance: boolean;
+    }
+  | ({
+      isInternal: false;
+      projectSlug: string;
+      type: InternalCaType;
+      friendlyName?: string;
+      commonName: string;
+      organization: string;
+      ou: string;
+      country: string;
+      province: string;
+      locality: string;
+      notBefore?: string;
+      notAfter?: string;
+      maxPathLength: number;
+      keyAlgorithm: CertKeyAlgorithm;
+      requireTemplateForIssuance: boolean;
+    } & Omit<TProjectPermission, "projectId">);
+
+export type TGetCaDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TUpdateCaDTO =
+  | {
+      isInternal: true;
+      caId: string;
+      status?: CaStatus;
+      requireTemplateForIssuance?: boolean;
+    }
+  | ({
+      isInternal: false;
+      caId: string;
+      status?: CaStatus;
+      requireTemplateForIssuance?: boolean;
+    } & Omit<TProjectPermission, "projectId">);
+
+export type TDeleteCaDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCsrDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TRenewCaCertDTO = {
+  caId: string;
+  notAfter: string;
+  type: CaRenewalType;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCertsDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCertDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TSignIntermediateDTO = {
+  caId: string;
+  csr: string;
+  notBefore?: string;
+  notAfter: string;
+  maxPathLength: number;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TImportCertToCaDTO = {
+  caId: string;
+  certificate: string;
+  certificateChain: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TIssueCertFromCaDTO = {
+  caId?: string;
+  certificateTemplateId?: string;
+  pkiCollectionId?: string;
+  friendlyName?: string;
+  commonName: string;
+  altNames: string;
+  ttl: string;
+  notBefore?: string;
+  notAfter?: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+} & Omit<TProjectPermission, "projectId">;
+
+export type TSignCertFromCaDTO =
+  | {
+      isInternal: true;
+      caId?: string;
+      csr: string;
+      certificateTemplateId?: string;
+      pkiCollectionId?: string;
+      friendlyName?: string;
+      commonName?: string;
+      altNames?: string;
+      ttl?: string;
+      notBefore?: string;
+      notAfter?: string;
+      keyUsages?: CertKeyUsage[];
+      extendedKeyUsages?: CertExtendedKeyUsage[];
+    }
+  | ({
+      isInternal: false;
+      caId?: string;
+      csr: string;
+      certificateTemplateId?: string;
+      pkiCollectionId?: string;
+      friendlyName?: string;
+      commonName?: string;
+      altNames: string;
+      ttl: string;
+      notBefore?: string;
+      notAfter?: string;
+      keyUsages?: CertKeyUsage[];
+      extendedKeyUsages?: CertExtendedKeyUsage[];
+    } & Omit<TProjectPermission, "projectId">);
+
+export type TGetCaCertificateTemplatesDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDNParts = {
+  commonName?: string;
+  organization?: string;
+  ou?: string;
+  country?: string;
+  province?: string;
+  locality?: string;
+};
+
+export type TGetCaCredentialsDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TGetCaCertChainsDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TGetCaCertChainDTO = {
+  caCertId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TRebuildCaCrlDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "update">;
+  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  certificateDAL: Pick<TCertificateDALFactory, "find">;
+  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "decryptWithKmsKey" | "encryptWithKmsKey">;
+};
+
+export type TRotateCaCrlTriggerDTO = {
+  caId: string;
+  rotationIntervalDays: number;
+};