Move ssh back to project level

backend/src/services/org/org-service.ts

@@ -24,9 +24,6 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
 import { TSamlConfigDALFactory } from "@app/ee/services/saml-config/saml-config-dal";
-import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
-import { TSshCertificateDALFactory } from "@app/ee/services/ssh-certificate/ssh-certificate-dal";
-import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-dal";
 import { getConfig } from "@app/lib/config/env";
 import { generateAsymmetricKeyPair } from "@app/lib/crypto";
 import { generateSymmetricKey, infisicalSymmetricDecrypt, infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
@@ -65,9 +62,6 @@ import {
   TGetOrgGroupsDTO,
   TGetOrgMembershipDTO,
   TInviteUserToOrgDTO,
-  TListOrgSshCasDTO,
-  TListOrgSshCertificatesDTO,
-  TListOrgSshCertificateTemplatesDTO,
   TListProjectMembershipsByOrgMembershipIdDTO,
   TUpdateOrgDTO,
   TUpdateOrgMembershipDTO,
@@ -104,9 +98,6 @@ type TOrgServiceFactoryDep = {
   projectBotDAL: Pick<TProjectBotDALFactory, "findOne" | "updateById">;
   projectUserMembershipRoleDAL: Pick<TProjectUserMembershipRoleDALFactory, "insertMany" | "create">;
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  sshCertificateAuthorityDAL: Pick<TSshCertificateAuthorityDALFactory, "find">;
-  sshCertificateDAL: Pick<TSshCertificateDALFactory, "find" | "countSshCertificatesInOrg">;
-  sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find">;
 };
 
 export type TOrgServiceFactory = ReturnType<typeof orgServiceFactory>;
@@ -134,9 +125,6 @@ export const orgServiceFactory = ({
   projectBotDAL,
   projectUserMembershipRoleDAL,
   identityMetadataDAL,
-  sshCertificateAuthorityDAL,
-  sshCertificateDAL,
-  sshCertificateTemplateDAL,
   projectBotService
 }: TOrgServiceFactoryDep) => {
   /*
@@ -1139,91 +1127,6 @@ export const orgServiceFactory = ({
     return incidentContact;
   };
 
-  /**
-   * Return list of SSH CAs for organization
-   */
-  const listOrgSshCas = async ({ actorId, actorOrgId, actorAuthMethod, actor, orgId }: TListOrgSshCasDTO) => {
-    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Read,
-      OrgPermissionSubjects.SshCertificateAuthorities
-    );
-
-    const cas = await sshCertificateAuthorityDAL.find(
-      {
-        orgId
-      },
-      { sort: [["updatedAt", "desc"]] }
-    );
-
-    return cas;
-  };
-
-  /**
-   * Return list of SSH certificates for organization
-   */
-  const listOrgSshCertificates = async ({
-    limit = 25,
-    offset = 0,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    actor,
-    orgId
-  }: TListOrgSshCertificatesDTO) => {
-    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-
-    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.SshCertificates);
-
-    const cas = await sshCertificateAuthorityDAL.find({
-      orgId
-    });
-
-    const certificates = await sshCertificateDAL.find(
-      {
-        $in: {
-          sshCaId: cas.map((ca) => ca.id)
-        }
-      },
-      { offset, limit, sort: [["updatedAt", "desc"]] }
-    );
-
-    const count = await sshCertificateDAL.countSshCertificatesInOrg(orgId);
-
-    return { certificates, totalCount: count };
-  };
-
-  /**
-   * Return list of SSH certificate templates for organization
-   */
-  const listOrgSshCertificateTemplates = async ({
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    actor,
-    orgId
-  }: TListOrgSshCertificateTemplatesDTO) => {
-    const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId);
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionActions.Read,
-      OrgPermissionSubjects.SshCertificateTemplates
-    );
-
-    const cas = await sshCertificateAuthorityDAL.find({
-      orgId
-    });
-
-    const certificateTemplates = await sshCertificateTemplateDAL.find({
-      $in: {
-        sshCaId: cas.map((ca) => ca.id)
-      }
-    });
-
-    return { certificateTemplates };
-  };
-
   return {
     findOrganizationById,
     findAllOrgMembers,
@@ -1245,9 +1148,6 @@ export const orgServiceFactory = ({
     deleteIncidentContact,
     getOrgGroups,
     listProjectMembershipsByOrgMembershipId,
-    findOrgBySlug,
-    listOrgSshCas,
-    listOrgSshCertificates,
-    listOrgSshCertificateTemplates
+    findOrgBySlug
   };
 };

backend/src/services/org/org-types.ts

@@ -75,13 +75,6 @@ export type TListProjectMembershipsByOrgMembershipIdDTO = {
   orgMembershipId: string;
 } & TOrgPermission;
 
-export type TListOrgSshCasDTO = TOrgPermission;
-export type TListOrgSshCertificateTemplatesDTO = TOrgPermission;
-export type TListOrgSshCertificatesDTO = {
-  offset: number;
-  limit: number;
-} & TOrgPermission;
-
 export enum OrgAuthMethod {
   OIDC = "oidc",
   SAML = "saml"

backend/src/services/project/project-service.ts

@@ -8,6 +8,9 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { InfisicalProjectTemplate } from "@app/ee/services/project-template/project-template-types";
+import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal";
+import { TSshCertificateDALFactory } from "@app/ee/services/ssh-certificate/ssh-certificate-dal";
+import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-dal";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
 import { isAtLeastAsPrivileged } from "@app/lib/casl";
 import { infisicalSymmetricEncypt } from "@app/lib/crypto/encryption";
@@ -53,6 +56,9 @@ import {
   TListProjectCertificateTemplatesDTO,
   TListProjectCertsDTO,
   TListProjectsDTO,
+  TListProjectSshCasDTO,
+  TListProjectSshCertificatesDTO,
+  TListProjectSshCertificateTemplatesDTO,
   TLoadProjectKmsBackupDTO,
   TToggleProjectAutoCapitalizationDTO,
   TUpdateAuditLogsRetentionDTO,
@@ -90,6 +96,9 @@ type TProjectServiceFactoryDep = {
   certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "getCertTemplatesByProjectId">;
   pkiAlertDAL: Pick<TPkiAlertDALFactory, "find">;
   pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "find">;
+  sshCertificateAuthorityDAL: Pick<TSshCertificateAuthorityDALFactory, "find">;
+  sshCertificateDAL: Pick<TSshCertificateDALFactory, "find" | "countSshCertificatesInProject">;
+  sshCertificateTemplateDAL: Pick<TSshCertificateTemplateDALFactory, "find">;
   permissionService: TPermissionServiceFactory;
   orgService: Pick<TOrgServiceFactory, "addGhostUser">;
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
@@ -133,6 +142,9 @@ export const projectServiceFactory = ({
   certificateTemplateDAL,
   pkiCollectionDAL,
   pkiAlertDAL,
+  sshCertificateAuthorityDAL,
+  sshCertificateDAL,
+  sshCertificateTemplateDAL,
   keyStore,
   kmsService,
   projectBotDAL,
@@ -859,6 +871,115 @@ export const projectServiceFactory = ({
     };
   };
 
+  /**
+   * Return list of SSH CAs for project
+   */
+  const listProjectSshCas = async ({
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    actor,
+    projectId
+  }: TListProjectSshCasDTO) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.SshCertificateAuthorities
+    );
+
+    const cas = await sshCertificateAuthorityDAL.find(
+      {
+        projectId
+      },
+      { sort: [["updatedAt", "desc"]] }
+    );
+
+    return cas;
+  };
+
+  /**
+   * Return list of SSH certificates for organization
+   */
+  const listProjectSshCertificates = async ({
+    limit = 25,
+    offset = 0,
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    actor,
+    projectId
+  }: TListProjectSshCertificatesDTO) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
+
+    const cas = await sshCertificateAuthorityDAL.find({
+      projectId
+    });
+
+    const certificates = await sshCertificateDAL.find(
+      {
+        $in: {
+          sshCaId: cas.map((ca) => ca.id)
+        }
+      },
+      { offset, limit, sort: [["updatedAt", "desc"]] }
+    );
+
+    const count = await sshCertificateDAL.countSshCertificatesInProject(projectId);
+
+    return { certificates, totalCount: count };
+  };
+
+  /**
+   * Return list of SSH certificate templates for organization
+   */
+  const listProjectSshCertificateTemplates = async ({
+    actorId,
+    actorOrgId,
+    actorAuthMethod,
+    actor,
+    projectId
+  }: TListProjectSshCertificateTemplatesDTO) => {
+    const { permission } = await permissionService.getProjectPermission(
+      actor,
+      actorId,
+      projectId,
+      actorAuthMethod,
+      actorOrgId
+    );
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionActions.Read,
+      ProjectPermissionSub.SshCertificateTemplates
+    );
+
+    const cas = await sshCertificateAuthorityDAL.find({
+      projectId
+    });
+
+    const certificateTemplates = await sshCertificateTemplateDAL.find({
+      $in: {
+        sshCaId: cas.map((ca) => ca.id)
+      }
+    });
+
+    return { certificateTemplates };
+  };
+
   const updateProjectKmsKey = async ({
     projectId,
     kms,
@@ -1092,6 +1213,9 @@ export const projectServiceFactory = ({
     listProjectAlerts,
     listProjectPkiCollections,
     listProjectCertificateTemplates,
+    listProjectSshCas,
+    listProjectSshCertificates,
+    listProjectSshCertificateTemplates,
     updateVersionLimit,
     updateAuditLogsRetention,
     updateProjectKmsKey,

backend/src/services/project/project-types.ts

@@ -130,6 +130,13 @@ export type TGetProjectKmsKey = TProjectPermission;
 
 export type TListProjectCertificateTemplatesDTO = TProjectPermission;
 
+export type TListProjectSshCasDTO = TProjectPermission;
+export type TListProjectSshCertificateTemplatesDTO = TProjectPermission;
+export type TListProjectSshCertificatesDTO = {
+  offset: number;
+  limit: number;
+} & TProjectPermission;
+
 export type TGetProjectSlackConfig = TProjectPermission;
 
 export type TUpdateProjectSlackConfig = {