feat: add gateway registration and org-proxy initialization

backend/src/ee/routes/v1/proxy-router.ts

@@ -1,24 +1,69 @@
 import { z } from "zod";
 
+import { getConfig } from "@app/lib/config/env";
+import { UnauthorizedError } from "@app/lib/errors";
 import { writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
 
 export const registerProxyRouter = async (server: FastifyZodProvider) => {
+  const appCfg = getConfig();
+
   server.route({
     method: "POST",
-    url: "/",
+    url: "/register-instance-proxy",
     config: {
       rateLimit: writeLimit
     },
     schema: {
       body: z.object({
-        ip: z.string()
+        ip: z.string(),
+        name: z.string()
       }),
       response: {
         200: z.any()
       }
     },
+    onRequest: (req, _, next) => {
+      const authHeader = req.headers.authorization;
+
+      if (appCfg.PROXY_AUTH_SECRET && authHeader === `Bearer ${appCfg.PROXY_AUTH_SECRET}`) {
+        return next();
+      }
+
+      throw new UnauthorizedError({
+        message: "Invalid proxy auth secret"
+      });
+    },
     handler: async (req) => {
-      return server.services.proxy.registerProxy(req.body);
+      return server.services.proxy.registerProxy({
+        ...req.body
+      });
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/register-org-proxy",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      body: z.object({
+        ip: z.string(),
+        name: z.string()
+      }),
+      response: {
+        200: z.any()
+      }
+    },
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      return server.services.proxy.registerProxy({
+        ...req.body,
+        identityId: req.permission.id,
+        orgId: req.permission.orgId
+      });
     }
   });
 };

backend/src/ee/routes/v2/gateway-router.ts

@@ -0,0 +1,29 @@
+import z from "zod";
+
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+
+export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "POST",
+    url: "/",
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      body: z.object({
+        proxyName: z.string()
+      }),
+      response: {
+        200: z.any()
+      }
+    },
+    handler: async (req) => {
+      const gateway = await server.services.gatewayV2.registerGateway({
+        orgId: req.permission.orgId,
+        proxyName: req.body.proxyName,
+        actorId: req.permission.id
+      });
+
+      return gateway;
+    }
+  });
+};

backend/src/ee/routes/v2/index.ts

@@ -9,6 +9,7 @@ import {
 
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
 import { registerProjectRoleRouter } from "./project-role-router";
+import { registerGatewayV2Router } from "./gateway-router";
 
 export const registerV2EERoutes = async (server: FastifyZodProvider) => {
   // org role starts with organization
@@ -23,6 +24,8 @@ export const registerV2EERoutes = async (server: FastifyZodProvider) => {
     prefix: "/identity-project-additional-privilege"
   });
 
+  await server.register(registerGatewayV2Router, { prefix: "/gateways" });
+
   await server.register(
     async (secretRotationV2Router) => {
       // register generic secret rotation endpoints