awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

misc: moved external pki migration to latest along with column changes

Browse Source
This commit is contained in:
Sheen Capadngan
2025-05-21 19:07:20 +08:00
parent eb31318d39
commit 949615606f
1 changed files with 47 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

67
backend/src/db/migrations/20250512133213_add-external-ca-pki.ts → backend/src/db/migrations/20250521110635_add-external-ca-pki.ts
View File

@@ -1,5 +1,8 @@
import slugify from "@sindresorhus/slugify";
import { Knex } from "knex";
import { alphaNumericNanoId } from "@app/lib/nanoid";
import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
@@ -9,12 +12,12 @@ export async function up(knex: Knex): Promise<void> {
if (hasCATable && !hasInternalCATable) {
await knex.schema.createTableLike(TableName.InternalCertificateAuthority, TableName.CertificateAuthority, (t) => {
t.uuid("certificateAuthorityId").nullable();
t.uuid("caId").nullable();
});
// @ts-expect-error intentional: migration
await knex(TableName.InternalCertificateAuthority).insert(knex(TableName.CertificateAuthority).select("*"));
await knex(TableName.InternalCertificateAuthority).update("certificateAuthorityId", knex.ref("id"));
await knex(TableName.InternalCertificateAuthority).update("caId", knex.ref("id"));
await knex.schema.alterTable(TableName.InternalCertificateAuthority, (t) => {
t.dropColumn("projectId");
@@ -28,14 +31,31 @@ export async function up(knex: Knex): Promise<void> {
.onDelete("CASCADE")
.alter();
t.uuid("activeCaCertId").nullable().references("id").inTable(TableName.CertificateAuthorityCert).alter();
t.uuid("certificateAuthorityId")
.notNullable()
.references("id")
.inTable(TableName.CertificateAuthority)
.onDelete("CASCADE")
.alter();
t.uuid("caId").notNullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE").alter();
});
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
t.renameColumn("requireTemplateForIssuance", "enableDirectIssuance");
t.string("name").nullable();
});
// prefill name for existing internal CAs and flip enableDirectIssuance
const cas = await knex(TableName.CertificateAuthority).select("id", "friendlyName", "enableDirectIssuance");
await Promise.all(
cas.map((ca) => {
const slugifiedName = ca.friendlyName
? slugify(`${ca.friendlyName}-${alphaNumericNanoId(8)}`)
: slugify(alphaNumericNanoId(12));
return (
knex(TableName.CertificateAuthority)
.where({ id: ca.id })
// @ts-expect-error intentional: migration
.update({ name: slugifiedName, enableDirectIssuance: !ca.enableDirectIssuance })
);
})
);
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
t.dropColumn("parentCaId");
t.dropColumn("type");
@@ -54,7 +74,8 @@ export async function up(knex: Knex): Promise<void> {
t.dropColumn("notBefore");
t.dropColumn("notAfter");
t.dropColumn("activeCaCertId");
t.renameColumn("requireTemplateForIssuance", "disableDirectIssuance");
t.string("name").notNullable().alter();
t.unique(["name", "projectId"]);
});
}
@@ -62,22 +83,14 @@ export async function up(knex: Knex): Promise<void> {
await knex.schema.createTable(TableName.ExternalCertificateAuthority, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.string("type").notNullable();
t.string("name").notNullable();
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("appConnectionId").nullable();
t.foreign("appConnectionId").references("id").inTable(TableName.AppConnection);
t.uuid("dnsAppConnectionId").nullable();
t.foreign("dnsAppConnectionId").references("id").inTable(TableName.AppConnection);
t.uuid("certificateAuthorityId")
.notNullable()
.references("id")
.inTable(TableName.CertificateAuthority)
.onDelete("CASCADE");
t.uuid("caId").notNullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
t.binary("credentials");
t.json("configuration");
t.string("status").notNullable();
t.unique(["projectId", "name"]);
});
}
@@ -116,9 +129,23 @@ export async function down(knex: Knex): Promise<void> {
t.timestamp("notBefore").nullable();
t.timestamp("notAfter").nullable();
t.uuid("activeCaCertId").nullable().references("id").inTable(TableName.CertificateAuthorityCert);
t.renameColumn("disableDirectIssuance", "requireTemplateForIssuance");
t.renameColumn("enableDirectIssuance", "requireTemplateForIssuance");
t.dropColumn("name");
});
// flip requireTemplateForIssuance for existing internal CAs
const cas = await knex(TableName.CertificateAuthority).select("id", "requireTemplateForIssuance");
await Promise.all(
cas.map((ca) => {
return (
knex(TableName.CertificateAuthority)
.where({ id: ca.id })
// @ts-expect-error intentional: migration
.update({ requireTemplateForIssuance: !ca.requireTemplateForIssuance })
);
})
);
await knex.raw(`
UPDATE ${TableName.CertificateAuthority} ca
SET
@@ -140,7 +167,7 @@ export async function down(knex: Knex): Promise<void> {
"notAfter" = ica."notAfter",
"activeCaCertId" = ica."activeCaCertId"
FROM ${TableName.InternalCertificateAuthority} ica
WHERE ca.id = ica."certificateAuthorityId"
WHERE ca.id = ica."caId"
`);
await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {