Move ssh back to project level

backend/src/db/migrations/20241130015511_ssh-mgmt.ts

@@ -8,8 +8,8 @@ export async function up(knex: Knex): Promise<void> {
     await knex.schema.createTable(TableName.SshCertificateAuthority, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
       t.timestamps(true, true, true);
-      t.uuid("orgId").notNullable();
-      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
       t.string("status").notNullable(); // active / disabled
       t.string("friendlyName").notNullable();
       t.string("keyAlgorithm").notNullable();
@@ -60,7 +60,6 @@ export async function up(knex: Knex): Promise<void> {
         .onDelete("SET NULL");
       t.string("serialNumber").notNullable().unique();
       t.string("certType").notNullable(); // user or host
-      t.text("publicKey").notNullable(); // public key in OpenSSH format
       t.specificType("principals", "text[]").notNullable();
       t.string("keyId").notNullable();
       t.datetime("notBefore").notNullable();
@@ -68,9 +67,24 @@ export async function up(knex: Knex): Promise<void> {
     });
     await createOnUpdateTrigger(knex, TableName.SshCertificate);
   }
+
+  if (!(await knex.schema.hasTable(TableName.SshCertificateBody))) {
+    await knex.schema.createTable(TableName.SshCertificateBody, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.timestamps(true, true, true);
+      t.uuid("sshCertId").notNullable().unique();
+      t.foreign("sshCertId").references("id").inTable(TableName.SshCertificate).onDelete("CASCADE");
+      t.binary("encryptedCertificate").notNullable();
+    });
+
+    await createOnUpdateTrigger(knex, TableName.SshCertificateBody);
+  }
 }
 
 export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.SshCertificateBody);
+  await dropOnUpdateTrigger(knex, TableName.SshCertificateBody);
+
   await knex.schema.dropTableIfExists(TableName.SshCertificate);
   await dropOnUpdateTrigger(knex, TableName.SshCertificate);
 

backend/src/db/schemas/index.ts

@@ -107,6 +107,7 @@ export * from "./service-tokens";
 export * from "./slack-integrations";
 export * from "./ssh-certificate-authorities";
 export * from "./ssh-certificate-authority-secrets";
+export * from "./ssh-certificate-bodies";
 export * from "./ssh-certificate-templates";
 export * from "./ssh-certificates";
 export * from "./super-admin";

backend/src/db/schemas/models.ts

@@ -6,6 +6,7 @@ export enum TableName {
   SshCertificateAuthoritySecret = "ssh_certificate_authority_secrets",
   SshCertificateTemplate = "ssh_certificate_templates",
   SshCertificate = "ssh_certificates",
+  SshCertificateBody = "ssh_certificate_bodies",
   CertificateAuthority = "certificate_authorities",
   CertificateTemplateEstConfig = "certificate_template_est_configs",
   CertificateAuthorityCert = "certificate_authority_certs",

backend/src/db/schemas/ssh-certificate-authorities.ts

@@ -11,7 +11,7 @@ export const SshCertificateAuthoritiesSchema = z.object({
   id: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  orgId: z.string().uuid(),
+  projectId: z.string(),
   status: z.string(),
   friendlyName: z.string(),
   keyAlgorithm: z.string()

backend/src/db/schemas/ssh-certificate-bodies.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const SshCertificateBodiesSchema = z.object({
+  id: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date(),
+  sshCertId: z.string().uuid(),
+  encryptedCertificate: zodBuffer
+});
+
+export type TSshCertificateBodies = z.infer<typeof SshCertificateBodiesSchema>;
+export type TSshCertificateBodiesInsert = Omit<z.input<typeof SshCertificateBodiesSchema>, TImmutableDBKeys>;
+export type TSshCertificateBodiesUpdate = Partial<Omit<z.input<typeof SshCertificateBodiesSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/ssh-certificates.ts

@@ -15,7 +15,6 @@ export const SshCertificatesSchema = z.object({
   sshCertificateTemplateId: z.string().uuid().nullable().optional(),
   serialNumber: z.string(),
   certType: z.string(),
-  publicKey: z.string(),
   principals: z.string().array(),
   keyId: z.string(),
   notBefore: z.date(),