misc: initial instance KMIP PKI setup

backend/src/db/migrations/20250203141127_add-kmip.ts

@@ -1,6 +1,7 @@
 import { Knex } from "knex";
 
 import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
 
 export async function up(knex: Knex): Promise<void> {
   const hasKmipClientTable = await knex.schema.hasTable(TableName.KmipClient);
@@ -14,6 +15,55 @@ export async function up(knex: Knex): Promise<void> {
       t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
     });
   }
+
+  const hasKmipInstanceConfigTable = await knex.schema.hasTable(TableName.KmipInstanceConfig);
+  if (!hasKmipInstanceConfigTable) {
+    await knex.schema.createTable(TableName.KmipInstanceConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("caKeyAlgorithm").notNullable();
+
+      t.datetime("rootCaIssuedAt").notNullable();
+      t.datetime("rootCaExpiration").notNullable();
+      t.string("rootCaSerialNumber").notNullable();
+      t.binary("encryptedRootCaCertificate").notNullable();
+      t.binary("encryptedRootCaPrivateKey").notNullable();
+
+      t.datetime("serverIntermediateCaIssuedAt").notNullable();
+      t.datetime("serverIntermediateCaExpiration").notNullable();
+      t.string("serverIntermediateCaSerialNumber");
+      t.binary("encryptedServerIntermediateCaCertificate").notNullable();
+      t.binary("encryptedServerIntermediateCaChain").notNullable();
+      t.binary("encryptedServerIntermediateCaPrivateKey").notNullable();
+
+      t.datetime("clientIntermediateCaIssuedAt").notNullable();
+      t.datetime("clientIntermediateCaExpiration").notNullable();
+      t.string("clientIntermediateCaSerialNumber").notNullable();
+      t.binary("encryptedClientIntermediateCaCertificate").notNullable();
+      t.binary("encryptedClientIntermediateCaChain").notNullable();
+      t.binary("encryptedClientIntermediateCaPrivateKey").notNullable();
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.KmipInstanceConfig);
+  }
+
+  const hasKmipInstanceServerCertTable = await knex.schema.hasTable(TableName.KmipInstanceServerCertificates);
+  if (!hasKmipInstanceServerCertTable) {
+    await knex.schema.createTable(TableName.KmipInstanceServerCertificates, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+      t.string("commonName").notNullable();
+      t.string("altNames").notNullable();
+      t.string("serialNumber").notNullable();
+      t.string("keyAlgorithm").notNullable();
+      t.datetime("issuedAt").notNullable();
+      t.datetime("expiration").notNullable();
+      t.binary("encryptedCertificate").notNullable();
+      t.binary("encryptedChain").notNullable();
+      t.binary("encryptedPrivateKey").notNullable();
+    });
+  }
 }
 
 export async function down(knex: Knex): Promise<void> {
@@ -21,4 +71,15 @@ export async function down(knex: Knex): Promise<void> {
   if (hasKmipClientTable) {
     await knex.schema.dropTable(TableName.KmipClient);
   }
+
+  const hasKmipInstanceConfigTable = await knex.schema.hasTable(TableName.KmipInstanceConfig);
+  if (hasKmipInstanceConfigTable) {
+    await knex.schema.dropTable(TableName.KmipInstanceConfig);
+    await dropOnUpdateTrigger(knex, TableName.KmipInstanceConfig);
+  }
+
+  const hasKmipInstanceServerCertTable = await knex.schema.hasTable(TableName.KmipInstanceServerCertificates);
+  if (hasKmipInstanceServerCertTable) {
+    await knex.schema.dropTable(TableName.KmipInstanceServerCertificates);
+  }
 }

backend/src/db/schemas/index.ts

@@ -46,6 +46,8 @@ export * from "./integration-auths";
 export * from "./integrations";
 export * from "./internal-kms";
 export * from "./kmip-clients";
+export * from "./kmip-instance-configs";
+export * from "./kmip-instance-server-certificates";
 export * from "./kms-key-versions";
 export * from "./kms-keys";
 export * from "./kms-root-config";

backend/src/db/schemas/kmip-instance-configs.ts

@@ -0,0 +1,38 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const KmipInstanceConfigsSchema = z.object({
+  id: z.string().uuid(),
+  caKeyAlgorithm: z.string(),
+  rootCaIssuedAt: z.date(),
+  rootCaExpiration: z.date(),
+  rootCaSerialNumber: z.string(),
+  encryptedRootCaCertificate: zodBuffer,
+  encryptedRootCaPrivateKey: zodBuffer,
+  serverIntermediateCaIssuedAt: z.date(),
+  serverIntermediateCaExpiration: z.date(),
+  serverIntermediateCaSerialNumber: z.string().nullable().optional(),
+  encryptedServerIntermediateCaCertificate: zodBuffer,
+  encryptedServerIntermediateCaChain: zodBuffer,
+  encryptedServerIntermediateCaPrivateKey: zodBuffer,
+  clientIntermediateCaIssuedAt: z.date(),
+  clientIntermediateCaExpiration: z.date(),
+  clientIntermediateCaSerialNumber: z.string(),
+  encryptedClientIntermediateCaCertificate: zodBuffer,
+  encryptedClientIntermediateCaChain: zodBuffer,
+  encryptedClientIntermediateCaPrivateKey: zodBuffer,
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TKmipInstanceConfigs = z.infer<typeof KmipInstanceConfigsSchema>;
+export type TKmipInstanceConfigsInsert = Omit<z.input<typeof KmipInstanceConfigsSchema>, TImmutableDBKeys>;
+export type TKmipInstanceConfigsUpdate = Partial<Omit<z.input<typeof KmipInstanceConfigsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/kmip-instance-server-certificates.ts

@@ -0,0 +1,32 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const KmipInstanceServerCertificatesSchema = z.object({
+  id: z.string().uuid(),
+  commonName: z.string(),
+  altNames: z.string(),
+  serialNumber: z.string(),
+  keyAlgorithm: z.string(),
+  issuedAt: z.date(),
+  expiration: z.date(),
+  encryptedCertificate: zodBuffer,
+  encryptedChain: zodBuffer,
+  encryptedPrivateKey: zodBuffer
+});
+
+export type TKmipInstanceServerCertificates = z.infer<typeof KmipInstanceServerCertificatesSchema>;
+export type TKmipInstanceServerCertificatesInsert = Omit<
+  z.input<typeof KmipInstanceServerCertificatesSchema>,
+  TImmutableDBKeys
+>;
+export type TKmipInstanceServerCertificatesUpdate = Partial<
+  Omit<z.input<typeof KmipInstanceServerCertificatesSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/models.ts

@@ -133,7 +133,9 @@ export enum TableName {
   ProjectSlackConfigs = "project_slack_configs",
   AppConnection = "app_connections",
   SecretSync = "secret_syncs",
-  KmipClient = "kmip_clients"
+  KmipClient = "kmip_clients",
+  KmipInstanceConfig = "kmip_instance_configs",
+  KmipInstanceServerCertificates = "kmip_instance_server_certificates"
 }
 
 export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";