From fc395bf661001d158796121b8de8b84af240fb74 Mon Sep 17 00:00:00 2001 From: x032205 Date: Tue, 4 Nov 2025 21:29:05 -0500 Subject: [PATCH 1/4] pam: return metadata for pam access requests --- .../pam-account-routers/pam-account-router.ts | 3 ++- .../pam-account/pam-account-service.ts | 27 ++++++++++++++++++- 2 files changed, 28 insertions(+), 2 deletions(-) diff --git a/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts b/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts index d2e0183ff..286e0896f 100644 --- a/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts +++ b/backend/src/ee/routes/v1/pam-account-routers/pam-account-router.ts @@ -92,7 +92,8 @@ export const registerPamAccountRouter = async (server: FastifyZodProvider) => { gatewayClientCertificate: z.string(), gatewayClientPrivateKey: z.string(), gatewayServerCertificateChain: z.string(), - relayHost: z.string() + relayHost: z.string(), + metadata: z.record(z.string(), z.string()).optional() }) } }, diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts index 00b84943f..0316ecebf 100644 --- a/backend/src/ee/services/pam-account/pam-account-service.ts +++ b/backend/src/ee/services/pam-account/pam-account-service.ts @@ -480,6 +480,30 @@ export const pamAccountServiceFactory = ({ throw new NotFoundError({ message: `Gateway connection details for gateway '${gatewayId}' not found.` }); } + let metadata; + + switch (resourceType) { + case PamResource.Postgres: + case PamResource.MySQL: { + const connectionCredentials = await decryptResourceConnectionDetails({ + encryptedConnectionDetails: resource.encryptedConnectionDetails, + kmsService, + projectId: account.projectId + }); + + const credentials = await decryptAccountCredentials({ + encryptedCredentials: account.encryptedCredentials, + kmsService, + projectId: account.projectId + }); + + metadata = { + username: credentials.username, + database: connectionCredentials.database + }; + } + } + return { sessionId: session.id, resourceType, @@ -491,7 +515,8 @@ export const pamAccountServiceFactory = ({ gatewayServerCertificateChain: gatewayConnectionDetails.gateway.serverCertificateChain, relayHost: gatewayConnectionDetails.relayHost, projectId: account.projectId, - account + account, + metadata }; }; From 43c936e633d025e00b114cc28725151007d74cc4 Mon Sep 17 00:00:00 2001 From: x032205 Date: Tue, 4 Nov 2025 21:57:02 -0500 Subject: [PATCH 2/4] added default case to switch --- .../pam-account/pam-account-service.ts | 36 ++++++++++--------- 1 file changed, 20 insertions(+), 16 deletions(-) diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts index 0316ecebf..7d766a532 100644 --- a/backend/src/ee/services/pam-account/pam-account-service.ts +++ b/backend/src/ee/services/pam-account/pam-account-service.ts @@ -484,24 +484,28 @@ export const pamAccountServiceFactory = ({ switch (resourceType) { case PamResource.Postgres: - case PamResource.MySQL: { - const connectionCredentials = await decryptResourceConnectionDetails({ - encryptedConnectionDetails: resource.encryptedConnectionDetails, - kmsService, - projectId: account.projectId - }); + case PamResource.MySQL: + { + const connectionCredentials = await decryptResourceConnectionDetails({ + encryptedConnectionDetails: resource.encryptedConnectionDetails, + kmsService, + projectId: account.projectId + }); - const credentials = await decryptAccountCredentials({ - encryptedCredentials: account.encryptedCredentials, - kmsService, - projectId: account.projectId - }); + const credentials = await decryptAccountCredentials({ + encryptedCredentials: account.encryptedCredentials, + kmsService, + projectId: account.projectId + }); - metadata = { - username: credentials.username, - database: connectionCredentials.database - }; - } + metadata = { + username: credentials.username, + database: connectionCredentials.database + }; + } + break; + default: + break; } return { From 3463d0d03c38b1f19a28b4b5638cf7e303a0a15f Mon Sep 17 00:00:00 2001 From: x032205 Date: Tue, 4 Nov 2025 23:03:42 -0500 Subject: [PATCH 3/4] add account info to metadata --- .../src/ee/services/pam-account/pam-account-service.ts | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts index 7d766a532..41a049deb 100644 --- a/backend/src/ee/services/pam-account/pam-account-service.ts +++ b/backend/src/ee/services/pam-account/pam-account-service.ts @@ -498,9 +498,17 @@ export const pamAccountServiceFactory = ({ projectId: account.projectId }); + const accountPath = await getFullPamFolderPath({ + pamFolderDAL, + folderId: account.folderId, + projectId: resource.projectId + }); + metadata = { username: credentials.username, - database: connectionCredentials.database + database: connectionCredentials.database, + accountName: account.name, + accountPath }; } break; From b54cdba82d53d9fac1de7afb8f9fc050b07e4bbc Mon Sep 17 00:00:00 2001 From: x032205 Date: Tue, 4 Nov 2025 23:18:40 -0500 Subject: [PATCH 4/4] fix issue --- backend/src/ee/services/pam-account/pam-account-service.ts | 6 ------ 1 file changed, 6 deletions(-) diff --git a/backend/src/ee/services/pam-account/pam-account-service.ts b/backend/src/ee/services/pam-account/pam-account-service.ts index 41a049deb..2f66d28d7 100644 --- a/backend/src/ee/services/pam-account/pam-account-service.ts +++ b/backend/src/ee/services/pam-account/pam-account-service.ts @@ -498,12 +498,6 @@ export const pamAccountServiceFactory = ({ projectId: account.projectId }); - const accountPath = await getFullPamFolderPath({ - pamFolderDAL, - folderId: account.folderId, - projectId: resource.projectId - }); - metadata = { username: credentials.username, database: connectionCredentials.database,