From c2f2a038add91d964a1f0b071c545fefb452e168 Mon Sep 17 00:00:00 2001 From: Tuan Dang Date: Sun, 6 Apr 2025 14:22:17 -0700 Subject: [PATCH] Add ssh project default cas --- backend/src/@types/knex.d.ts | 14 ++- .../migrations/20250405185753_ssh-mgmt-v2.ts | 22 ++++ .../access-approval-policies-approvers.ts | 11 +- .../db/schemas/access-approval-policies.ts | 8 +- .../access-approval-requests-reviewers.ts | 11 +- .../db/schemas/access-approval-requests.ts | 6 +- backend/src/db/schemas/api-keys.ts | 2 - backend/src/db/schemas/audit-log-streams.ts | 2 - backend/src/db/schemas/audit-logs.ts | 2 - backend/src/db/schemas/auth-token-sessions.ts | 2 - backend/src/db/schemas/auth-tokens.ts | 2 - backend/src/db/schemas/backup-private-key.ts | 2 - .../src/db/schemas/certificate-authorities.ts | 6 +- .../db/schemas/certificate-authority-certs.ts | 4 +- .../db/schemas/certificate-authority-crl.ts | 4 +- .../schemas/certificate-authority-secret.ts | 9 +- .../certificate-template-est-configs.ts | 9 +- .../src/db/schemas/certificate-templates.ts | 2 - backend/src/db/schemas/certificates.ts | 4 +- .../src/db/schemas/dynamic-secret-leases.ts | 2 - backend/src/db/schemas/dynamic-secrets.ts | 4 +- .../external-group-org-role-mappings.ts | 11 +- .../db/schemas/git-app-install-sessions.ts | 2 - backend/src/db/schemas/git-app-org.ts | 2 - .../schemas/group-project-membership-roles.ts | 11 +- .../db/schemas/group-project-memberships.ts | 6 +- backend/src/db/schemas/groups.ts | 2 - backend/src/db/schemas/identities.ts | 2 - .../src/db/schemas/identity-access-tokens.ts | 2 - backend/src/db/schemas/identity-aws-auths.ts | 2 - .../src/db/schemas/identity-azure-auths.ts | 2 - backend/src/db/schemas/identity-gcp-auths.ts | 2 - .../db/schemas/identity-kubernetes-auths.ts | 4 +- backend/src/db/schemas/identity-metadata.ts | 2 - .../db/schemas/identity-org-memberships.ts | 6 +- .../identity-project-additional-privilege.ts | 11 +- .../identity-project-membership-role.ts | 11 +- .../schemas/identity-project-memberships.ts | 11 +- .../src/db/schemas/identity-token-auths.ts | 2 - .../db/schemas/identity-ua-client-secrets.ts | 6 +- .../db/schemas/identity-universal-auths.ts | 6 +- backend/src/db/schemas/incident-contacts.ts | 2 - backend/src/db/schemas/index.ts | 1 + backend/src/db/schemas/integrations.ts | 4 +- .../db/schemas/kmip-client-certificates.ts | 6 +- backend/src/db/schemas/kmip-clients.ts | 2 - .../schemas/kmip-org-server-certificates.ts | 4 +- backend/src/db/schemas/kms-keys.ts | 2 - backend/src/db/schemas/kms-root-config.ts | 2 +- backend/src/db/schemas/ldap-configs.ts | 8 +- backend/src/db/schemas/ldap-group-maps.ts | 2 - backend/src/db/schemas/models.ts | 1 + backend/src/db/schemas/org-bots.ts | 2 - backend/src/db/schemas/org-memberships.ts | 4 +- backend/src/db/schemas/org-roles.ts | 2 - backend/src/db/schemas/organizations.ts | 2 +- backend/src/db/schemas/pki-alerts.ts | 2 - .../src/db/schemas/pki-collection-items.ts | 2 - backend/src/db/schemas/pki-collections.ts | 2 - backend/src/db/schemas/project-bots.ts | 2 - .../src/db/schemas/project-environments.ts | 2 - backend/src/db/schemas/project-gateways.ts | 2 - backend/src/db/schemas/project-keys.ts | 2 - backend/src/db/schemas/project-memberships.ts | 2 - backend/src/db/schemas/project-roles.ts | 2 - .../src/db/schemas/project-slack-configs.ts | 6 +- .../db/schemas/project-split-backfill-ids.ts | 6 +- backend/src/db/schemas/project-ssh-configs.ts | 21 ++++ backend/src/db/schemas/project-templates.ts | 2 - .../project-user-additional-privilege.ts | 11 +- .../schemas/project-user-membership-roles.ts | 11 +- backend/src/db/schemas/rate-limit.ts | 2 - backend/src/db/schemas/resource-metadata.ts | 2 - backend/src/db/schemas/scim-tokens.ts | 2 - .../secret-approval-policies-approvers.ts | 11 +- .../db/schemas/secret-approval-policies.ts | 8 +- .../secret-approval-request-secret-tags-v2.ts | 11 +- .../secret-approval-request-secret-tags.ts | 11 +- .../secret-approval-requests-reviewers.ts | 11 +- .../secret-approval-requests-secrets-v2.ts | 9 +- .../secret-approval-requests-secrets.ts | 15 ++- .../db/schemas/secret-approval-requests.ts | 8 +- .../src/db/schemas/secret-blind-indexes.ts | 6 +- .../src/db/schemas/secret-folder-versions.ts | 2 - backend/src/db/schemas/secret-folders.ts | 2 - backend/src/db/schemas/secret-imports.ts | 2 - .../src/db/schemas/secret-references-v2.ts | 2 - backend/src/db/schemas/secret-references.ts | 2 - .../db/schemas/secret-rotation-output-v2.ts | 6 +- .../src/db/schemas/secret-rotation-outputs.ts | 2 - .../db/schemas/secret-scanning-git-risks.ts | 6 +- backend/src/db/schemas/secret-sharing.ts | 4 +- .../src/db/schemas/secret-snapshot-folders.ts | 2 - .../db/schemas/secret-snapshot-secrets-v2.ts | 6 +- .../src/db/schemas/secret-snapshot-secrets.ts | 2 - backend/src/db/schemas/secret-snapshots.ts | 2 - backend/src/db/schemas/secret-syncs.ts | 2 - backend/src/db/schemas/secret-tag-junction.ts | 2 - backend/src/db/schemas/secret-tags.ts | 4 +- .../src/db/schemas/secret-v2-tag-junction.ts | 2 - .../db/schemas/secret-version-tag-junction.ts | 6 +- .../schemas/secret-version-v2-tag-junction.ts | 11 +- backend/src/db/schemas/secret-versions-v2.ts | 2 +- backend/src/db/schemas/secret-versions.ts | 8 +- backend/src/db/schemas/secrets-v2.ts | 2 +- backend/src/db/schemas/secrets.ts | 8 +- backend/src/db/schemas/service-tokens.ts | 2 - .../db/schemas/ssh-certificate-authorities.ts | 6 +- .../ssh-certificate-authority-secrets.ts | 9 +- .../db/schemas/ssh-certificate-templates.ts | 6 +- backend/src/db/schemas/ssh-certificates.ts | 2 - .../src/db/schemas/ssh-host-login-mappings.ts | 2 - backend/src/db/schemas/ssh-hosts.ts | 6 +- backend/src/db/schemas/trusted-ips.ts | 2 - backend/src/db/schemas/user-actions.ts | 2 - backend/src/db/schemas/user-aliases.ts | 2 - .../src/db/schemas/user-encryption-keys.ts | 2 - .../src/db/schemas/user-group-membership.ts | 2 - backend/src/db/schemas/users.ts | 2 - backend/src/db/schemas/webhooks.ts | 4 +- .../src/db/schemas/workflow-integrations.ts | 2 - .../v1/ssh-certificate-authority-router.ts | 6 +- .../ee/routes/v1/ssh-certificate-router.ts | 8 +- backend/src/ee/routes/v1/ssh-host-router.ts | 74 ++++++++++++ .../ee/services/audit-log/audit-log-types.ts | 3 +- .../ssh-certificate/ssh-certificate-types.ts | 7 ++ .../ee/services/ssh-host/ssh-host-service.ts | 5 + .../ssh/ssh-certificate-authority-fns.ts | 112 ++++++++++++++++-- .../ssh/ssh-certificate-authority-service.ts | 59 ++------- .../ssh/ssh-certificate-authority-types.ts | 24 +++- backend/src/lib/api-docs/constants.ts | 7 ++ backend/src/server/routes/index.ts | 4 + backend/src/services/project/project-fns.ts | 50 +++++++- .../src/services/project/project-service.ts | 23 +++- .../project/project-ssh-config-dal.ts | 11 ++ backend/src/services/project/project-types.ts | 13 ++ frontend/src/hooks/api/sshCa/constants.tsx | 39 ++++++ frontend/src/hooks/api/sshCa/types.ts | 13 +- .../OverviewPage/components/SshCaModal.tsx | 25 ++-- .../components/SshCaDetailsSection.tsx | 6 +- .../components/SshCertificateModal.tsx | 23 ++-- 141 files changed, 696 insertions(+), 400 deletions(-) create mode 100644 backend/src/db/schemas/project-ssh-configs.ts create mode 100644 backend/src/ee/services/ssh-certificate/ssh-certificate-types.ts create mode 100644 backend/src/services/project/project-ssh-config-dal.ts diff --git a/backend/src/@types/knex.d.ts b/backend/src/@types/knex.d.ts index 5ad27a605..277f6f074 100644 --- a/backend/src/@types/knex.d.ts +++ b/backend/src/@types/knex.d.ts @@ -226,6 +226,9 @@ import { TProjectSplitBackfillIds, TProjectSplitBackfillIdsInsert, TProjectSplitBackfillIdsUpdate, + TProjectSshConfigs, + TProjectSshConfigsInsert, + TProjectSshConfigsUpdate, TProjectsUpdate, TProjectTemplates, TProjectTemplatesInsert, @@ -356,12 +359,12 @@ import { TSshCertificateTemplates, TSshCertificateTemplatesInsert, TSshCertificateTemplatesUpdate, - TSshHosts, - TSshHostsInsert, - TSshHostsUpdate, TSshHostLoginMappings, TSshHostLoginMappingsInsert, TSshHostLoginMappingsUpdate, + TSshHosts, + TSshHostsInsert, + TSshHostsUpdate, TSuperAdmin, TSuperAdminInsert, TSuperAdminUpdate, @@ -560,6 +563,11 @@ declare module "knex/types/tables" { [TableName.SuperAdmin]: KnexOriginal.CompositeTableType; [TableName.ApiKey]: KnexOriginal.CompositeTableType; [TableName.Project]: KnexOriginal.CompositeTableType; + [TableName.ProjectSshConfig]: KnexOriginal.CompositeTableType< + TProjectSshConfigs, + TProjectSshConfigsInsert, + TProjectSshConfigsUpdate + >; [TableName.ProjectMembership]: KnexOriginal.CompositeTableType< TProjectMemberships, TProjectMembershipsInsert, diff --git a/backend/src/db/migrations/20250405185753_ssh-mgmt-v2.ts b/backend/src/db/migrations/20250405185753_ssh-mgmt-v2.ts index 14616da8d..9f49f9f91 100644 --- a/backend/src/db/migrations/20250405185753_ssh-mgmt-v2.ts +++ b/backend/src/db/migrations/20250405185753_ssh-mgmt-v2.ts @@ -13,6 +13,10 @@ export async function up(knex: Knex): Promise { t.string("hostname").notNullable(); t.string("userCertTtl").notNullable(); t.string("hostCertTtl").notNullable(); + t.uuid("userSshCaId").notNullable(); + t.foreign("userSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("CASCADE"); + t.uuid("hostSshCaId").notNullable(); + t.foreign("hostSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("CASCADE"); }); await createOnUpdateTrigger(knex, TableName.SshHost); } @@ -28,9 +32,27 @@ export async function up(knex: Knex): Promise { }); await createOnUpdateTrigger(knex, TableName.SshHostLoginMapping); } + + if (!(await knex.schema.hasTable(TableName.ProjectSshConfig))) { + // new table to store configuration for projects of type SSH (i.e. Infisical SSH) + await knex.schema.createTable(TableName.ProjectSshConfig, (t) => { + t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid()); + t.timestamps(true, true, true); + t.string("projectId").notNullable(); + t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE"); + t.uuid("defaultUserSshCaId"); + t.foreign("defaultUserSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("CASCADE"); + t.uuid("defaultHostSshCaId"); + t.foreign("defaultHostSshCaId").references("id").inTable(TableName.SshCertificateAuthority).onDelete("CASCADE"); + }); + await createOnUpdateTrigger(knex, TableName.ProjectSshConfig); + } } export async function down(knex: Knex): Promise { + await knex.schema.dropTableIfExists(TableName.ProjectSshConfig); + await dropOnUpdateTrigger(knex, TableName.ProjectSshConfig); + await knex.schema.dropTableIfExists(TableName.SshHostLoginMapping); await dropOnUpdateTrigger(knex, TableName.SshHostLoginMapping); diff --git a/backend/src/db/schemas/access-approval-policies-approvers.ts b/backend/src/db/schemas/access-approval-policies-approvers.ts index db61e60c5..1ecd80513 100644 --- a/backend/src/db/schemas/access-approval-policies-approvers.ts +++ b/backend/src/db/schemas/access-approval-policies-approvers.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AccessApprovalPoliciesApproversSchema = z.object({ @@ -19,5 +17,10 @@ export const AccessApprovalPoliciesApproversSchema = z.object({ }); export type TAccessApprovalPoliciesApprovers = z.infer; -export type TAccessApprovalPoliciesApproversInsert = Omit, TImmutableDBKeys>; -export type TAccessApprovalPoliciesApproversUpdate = Partial, TImmutableDBKeys>>; +export type TAccessApprovalPoliciesApproversInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TAccessApprovalPoliciesApproversUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/access-approval-policies.ts b/backend/src/db/schemas/access-approval-policies.ts index 9f207e2d4..19a98675f 100644 --- a/backend/src/db/schemas/access-approval-policies.ts +++ b/backend/src/db/schemas/access-approval-policies.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AccessApprovalPoliciesSchema = z.object({ @@ -17,11 +15,13 @@ export const AccessApprovalPoliciesSchema = z.object({ envId: z.string().uuid(), createdAt: z.date(), updatedAt: z.date(), - enforcementLevel: z.string().default('hard'), + enforcementLevel: z.string().default("hard"), deletedAt: z.date().nullable().optional(), allowedSelfApprovals: z.boolean().default(true) }); export type TAccessApprovalPolicies = z.infer; export type TAccessApprovalPoliciesInsert = Omit, TImmutableDBKeys>; -export type TAccessApprovalPoliciesUpdate = Partial, TImmutableDBKeys>>; +export type TAccessApprovalPoliciesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/access-approval-requests-reviewers.ts b/backend/src/db/schemas/access-approval-requests-reviewers.ts index cf87545c5..a209df206 100644 --- a/backend/src/db/schemas/access-approval-requests-reviewers.ts +++ b/backend/src/db/schemas/access-approval-requests-reviewers.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AccessApprovalRequestsReviewersSchema = z.object({ @@ -20,5 +18,10 @@ export const AccessApprovalRequestsReviewersSchema = z.object({ }); export type TAccessApprovalRequestsReviewers = z.infer; -export type TAccessApprovalRequestsReviewersInsert = Omit, TImmutableDBKeys>; -export type TAccessApprovalRequestsReviewersUpdate = Partial, TImmutableDBKeys>>; +export type TAccessApprovalRequestsReviewersInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TAccessApprovalRequestsReviewersUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/access-approval-requests.ts b/backend/src/db/schemas/access-approval-requests.ts index 12d8644bf..0b20202f5 100644 --- a/backend/src/db/schemas/access-approval-requests.ts +++ b/backend/src/db/schemas/access-approval-requests.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AccessApprovalRequestsSchema = z.object({ @@ -24,4 +22,6 @@ export const AccessApprovalRequestsSchema = z.object({ export type TAccessApprovalRequests = z.infer; export type TAccessApprovalRequestsInsert = Omit, TImmutableDBKeys>; -export type TAccessApprovalRequestsUpdate = Partial, TImmutableDBKeys>>; +export type TAccessApprovalRequestsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/api-keys.ts b/backend/src/db/schemas/api-keys.ts index 1db00d26a..cf836fd88 100644 --- a/backend/src/db/schemas/api-keys.ts +++ b/backend/src/db/schemas/api-keys.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ApiKeysSchema = z.object({ diff --git a/backend/src/db/schemas/audit-log-streams.ts b/backend/src/db/schemas/audit-log-streams.ts index 582401c07..901dd8d27 100644 --- a/backend/src/db/schemas/audit-log-streams.ts +++ b/backend/src/db/schemas/audit-log-streams.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AuditLogStreamsSchema = z.object({ diff --git a/backend/src/db/schemas/audit-logs.ts b/backend/src/db/schemas/audit-logs.ts index 4301d94fd..d1c239724 100644 --- a/backend/src/db/schemas/audit-logs.ts +++ b/backend/src/db/schemas/audit-logs.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AuditLogsSchema = z.object({ diff --git a/backend/src/db/schemas/auth-token-sessions.ts b/backend/src/db/schemas/auth-token-sessions.ts index 3f87f9832..3a9376c83 100644 --- a/backend/src/db/schemas/auth-token-sessions.ts +++ b/backend/src/db/schemas/auth-token-sessions.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AuthTokenSessionsSchema = z.object({ diff --git a/backend/src/db/schemas/auth-tokens.ts b/backend/src/db/schemas/auth-tokens.ts index 507cfb942..dd8563b85 100644 --- a/backend/src/db/schemas/auth-tokens.ts +++ b/backend/src/db/schemas/auth-tokens.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const AuthTokensSchema = z.object({ diff --git a/backend/src/db/schemas/backup-private-key.ts b/backend/src/db/schemas/backup-private-key.ts index 93a24315d..5a2148aa1 100644 --- a/backend/src/db/schemas/backup-private-key.ts +++ b/backend/src/db/schemas/backup-private-key.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const BackupPrivateKeySchema = z.object({ diff --git a/backend/src/db/schemas/certificate-authorities.ts b/backend/src/db/schemas/certificate-authorities.ts index 070405f61..ffe0f7c44 100644 --- a/backend/src/db/schemas/certificate-authorities.ts +++ b/backend/src/db/schemas/certificate-authorities.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const CertificateAuthoritiesSchema = z.object({ @@ -36,4 +34,6 @@ export const CertificateAuthoritiesSchema = z.object({ export type TCertificateAuthorities = z.infer; export type TCertificateAuthoritiesInsert = Omit, TImmutableDBKeys>; -export type TCertificateAuthoritiesUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateAuthoritiesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-authority-certs.ts b/backend/src/db/schemas/certificate-authority-certs.ts index b18fc4f20..7074ce409 100644 --- a/backend/src/db/schemas/certificate-authority-certs.ts +++ b/backend/src/db/schemas/certificate-authority-certs.ts @@ -22,4 +22,6 @@ export const CertificateAuthorityCertsSchema = z.object({ export type TCertificateAuthorityCerts = z.infer; export type TCertificateAuthorityCertsInsert = Omit, TImmutableDBKeys>; -export type TCertificateAuthorityCertsUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateAuthorityCertsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-authority-crl.ts b/backend/src/db/schemas/certificate-authority-crl.ts index b57e94435..3d63be5d8 100644 --- a/backend/src/db/schemas/certificate-authority-crl.ts +++ b/backend/src/db/schemas/certificate-authority-crl.ts @@ -20,4 +20,6 @@ export const CertificateAuthorityCrlSchema = z.object({ export type TCertificateAuthorityCrl = z.infer; export type TCertificateAuthorityCrlInsert = Omit, TImmutableDBKeys>; -export type TCertificateAuthorityCrlUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateAuthorityCrlUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-authority-secret.ts b/backend/src/db/schemas/certificate-authority-secret.ts index d3128d5bf..36ab1c506 100644 --- a/backend/src/db/schemas/certificate-authority-secret.ts +++ b/backend/src/db/schemas/certificate-authority-secret.ts @@ -18,5 +18,10 @@ export const CertificateAuthoritySecretSchema = z.object({ }); export type TCertificateAuthoritySecret = z.infer; -export type TCertificateAuthoritySecretInsert = Omit, TImmutableDBKeys>; -export type TCertificateAuthoritySecretUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateAuthoritySecretInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TCertificateAuthoritySecretUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-template-est-configs.ts b/backend/src/db/schemas/certificate-template-est-configs.ts index 8dc2ec8b9..262f22b06 100644 --- a/backend/src/db/schemas/certificate-template-est-configs.ts +++ b/backend/src/db/schemas/certificate-template-est-configs.ts @@ -21,5 +21,10 @@ export const CertificateTemplateEstConfigsSchema = z.object({ }); export type TCertificateTemplateEstConfigs = z.infer; -export type TCertificateTemplateEstConfigsInsert = Omit, TImmutableDBKeys>; -export type TCertificateTemplateEstConfigsUpdate = Partial, TImmutableDBKeys>>; +export type TCertificateTemplateEstConfigsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TCertificateTemplateEstConfigsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/certificate-templates.ts b/backend/src/db/schemas/certificate-templates.ts index 793315d05..c332d7cf7 100644 --- a/backend/src/db/schemas/certificate-templates.ts +++ b/backend/src/db/schemas/certificate-templates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const CertificateTemplatesSchema = z.object({ diff --git a/backend/src/db/schemas/certificates.ts b/backend/src/db/schemas/certificates.ts index 6f7f94ed0..bde35002f 100644 --- a/backend/src/db/schemas/certificates.ts +++ b/backend/src/db/schemas/certificates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const CertificatesSchema = z.object({ @@ -22,7 +20,7 @@ export const CertificatesSchema = z.object({ notAfter: z.date(), revokedAt: z.date().nullable().optional(), revocationReason: z.number().nullable().optional(), - altNames: z.string().default('').nullable().optional(), + altNames: z.string().default("").nullable().optional(), caCertId: z.string().uuid(), certificateTemplateId: z.string().uuid().nullable().optional(), keyUsages: z.string().array().nullable().optional(), diff --git a/backend/src/db/schemas/dynamic-secret-leases.ts b/backend/src/db/schemas/dynamic-secret-leases.ts index 31ccdb32b..8c16bcb55 100644 --- a/backend/src/db/schemas/dynamic-secret-leases.ts +++ b/backend/src/db/schemas/dynamic-secret-leases.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const DynamicSecretLeasesSchema = z.object({ diff --git a/backend/src/db/schemas/dynamic-secrets.ts b/backend/src/db/schemas/dynamic-secrets.ts index fac36af7f..913a6d475 100644 --- a/backend/src/db/schemas/dynamic-secrets.ts +++ b/backend/src/db/schemas/dynamic-secrets.ts @@ -19,8 +19,8 @@ export const DynamicSecretsSchema = z.object({ inputIV: z.string().nullable().optional(), inputCiphertext: z.string().nullable().optional(), inputTag: z.string().nullable().optional(), - algorithm: z.string().default('aes-256-gcm'), - keyEncoding: z.string().default('utf8'), + algorithm: z.string().default("aes-256-gcm"), + keyEncoding: z.string().default("utf8"), folderId: z.string().uuid(), status: z.string().nullable().optional(), statusDetails: z.string().nullable().optional(), diff --git a/backend/src/db/schemas/external-group-org-role-mappings.ts b/backend/src/db/schemas/external-group-org-role-mappings.ts index 6b38c6421..f7e6eab25 100644 --- a/backend/src/db/schemas/external-group-org-role-mappings.ts +++ b/backend/src/db/schemas/external-group-org-role-mappings.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ExternalGroupOrgRoleMappingsSchema = z.object({ @@ -20,5 +18,10 @@ export const ExternalGroupOrgRoleMappingsSchema = z.object({ }); export type TExternalGroupOrgRoleMappings = z.infer; -export type TExternalGroupOrgRoleMappingsInsert = Omit, TImmutableDBKeys>; -export type TExternalGroupOrgRoleMappingsUpdate = Partial, TImmutableDBKeys>>; +export type TExternalGroupOrgRoleMappingsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TExternalGroupOrgRoleMappingsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/git-app-install-sessions.ts b/backend/src/db/schemas/git-app-install-sessions.ts index 7100f1108..986ae9d8e 100644 --- a/backend/src/db/schemas/git-app-install-sessions.ts +++ b/backend/src/db/schemas/git-app-install-sessions.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const GitAppInstallSessionsSchema = z.object({ diff --git a/backend/src/db/schemas/git-app-org.ts b/backend/src/db/schemas/git-app-org.ts index ffc45eb80..627df6b4c 100644 --- a/backend/src/db/schemas/git-app-org.ts +++ b/backend/src/db/schemas/git-app-org.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const GitAppOrgSchema = z.object({ diff --git a/backend/src/db/schemas/group-project-membership-roles.ts b/backend/src/db/schemas/group-project-membership-roles.ts index b2c3f57f1..d837ca8e7 100644 --- a/backend/src/db/schemas/group-project-membership-roles.ts +++ b/backend/src/db/schemas/group-project-membership-roles.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const GroupProjectMembershipRolesSchema = z.object({ @@ -24,5 +22,10 @@ export const GroupProjectMembershipRolesSchema = z.object({ }); export type TGroupProjectMembershipRoles = z.infer; -export type TGroupProjectMembershipRolesInsert = Omit, TImmutableDBKeys>; -export type TGroupProjectMembershipRolesUpdate = Partial, TImmutableDBKeys>>; +export type TGroupProjectMembershipRolesInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TGroupProjectMembershipRolesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/group-project-memberships.ts b/backend/src/db/schemas/group-project-memberships.ts index cc5f0f2ff..7787a3574 100644 --- a/backend/src/db/schemas/group-project-memberships.ts +++ b/backend/src/db/schemas/group-project-memberships.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const GroupProjectMembershipsSchema = z.object({ @@ -19,4 +17,6 @@ export const GroupProjectMembershipsSchema = z.object({ export type TGroupProjectMemberships = z.infer; export type TGroupProjectMembershipsInsert = Omit, TImmutableDBKeys>; -export type TGroupProjectMembershipsUpdate = Partial, TImmutableDBKeys>>; +export type TGroupProjectMembershipsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/groups.ts b/backend/src/db/schemas/groups.ts index cf1bfbd6d..9733d253e 100644 --- a/backend/src/db/schemas/groups.ts +++ b/backend/src/db/schemas/groups.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const GroupsSchema = z.object({ diff --git a/backend/src/db/schemas/identities.ts b/backend/src/db/schemas/identities.ts index bf51f13ac..adf3a6ef2 100644 --- a/backend/src/db/schemas/identities.ts +++ b/backend/src/db/schemas/identities.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentitiesSchema = z.object({ diff --git a/backend/src/db/schemas/identity-access-tokens.ts b/backend/src/db/schemas/identity-access-tokens.ts index c6642903a..bbff1b88c 100644 --- a/backend/src/db/schemas/identity-access-tokens.ts +++ b/backend/src/db/schemas/identity-access-tokens.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityAccessTokensSchema = z.object({ diff --git a/backend/src/db/schemas/identity-aws-auths.ts b/backend/src/db/schemas/identity-aws-auths.ts index 98dfe745a..f4444b00f 100644 --- a/backend/src/db/schemas/identity-aws-auths.ts +++ b/backend/src/db/schemas/identity-aws-auths.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityAwsAuthsSchema = z.object({ diff --git a/backend/src/db/schemas/identity-azure-auths.ts b/backend/src/db/schemas/identity-azure-auths.ts index b595c6c0b..856f7b8f1 100644 --- a/backend/src/db/schemas/identity-azure-auths.ts +++ b/backend/src/db/schemas/identity-azure-auths.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityAzureAuthsSchema = z.object({ diff --git a/backend/src/db/schemas/identity-gcp-auths.ts b/backend/src/db/schemas/identity-gcp-auths.ts index 2ff644bdb..208058f60 100644 --- a/backend/src/db/schemas/identity-gcp-auths.ts +++ b/backend/src/db/schemas/identity-gcp-auths.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityGcpAuthsSchema = z.object({ diff --git a/backend/src/db/schemas/identity-kubernetes-auths.ts b/backend/src/db/schemas/identity-kubernetes-auths.ts index 57efbd2b5..448cec386 100644 --- a/backend/src/db/schemas/identity-kubernetes-auths.ts +++ b/backend/src/db/schemas/identity-kubernetes-auths.ts @@ -34,4 +34,6 @@ export const IdentityKubernetesAuthsSchema = z.object({ export type TIdentityKubernetesAuths = z.infer; export type TIdentityKubernetesAuthsInsert = Omit, TImmutableDBKeys>; -export type TIdentityKubernetesAuthsUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityKubernetesAuthsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-metadata.ts b/backend/src/db/schemas/identity-metadata.ts index 2584677be..de1cec104 100644 --- a/backend/src/db/schemas/identity-metadata.ts +++ b/backend/src/db/schemas/identity-metadata.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityMetadataSchema = z.object({ diff --git a/backend/src/db/schemas/identity-org-memberships.ts b/backend/src/db/schemas/identity-org-memberships.ts index 71c6c49dd..2f29c52e4 100644 --- a/backend/src/db/schemas/identity-org-memberships.ts +++ b/backend/src/db/schemas/identity-org-memberships.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityOrgMembershipsSchema = z.object({ @@ -21,4 +19,6 @@ export const IdentityOrgMembershipsSchema = z.object({ export type TIdentityOrgMemberships = z.infer; export type TIdentityOrgMembershipsInsert = Omit, TImmutableDBKeys>; -export type TIdentityOrgMembershipsUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityOrgMembershipsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-project-additional-privilege.ts b/backend/src/db/schemas/identity-project-additional-privilege.ts index 564fabfec..7a9dbe19e 100644 --- a/backend/src/db/schemas/identity-project-additional-privilege.ts +++ b/backend/src/db/schemas/identity-project-additional-privilege.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityProjectAdditionalPrivilegeSchema = z.object({ @@ -24,5 +22,10 @@ export const IdentityProjectAdditionalPrivilegeSchema = z.object({ }); export type TIdentityProjectAdditionalPrivilege = z.infer; -export type TIdentityProjectAdditionalPrivilegeInsert = Omit, TImmutableDBKeys>; -export type TIdentityProjectAdditionalPrivilegeUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityProjectAdditionalPrivilegeInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TIdentityProjectAdditionalPrivilegeUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-project-membership-role.ts b/backend/src/db/schemas/identity-project-membership-role.ts index 50ae2602e..90a0a3538 100644 --- a/backend/src/db/schemas/identity-project-membership-role.ts +++ b/backend/src/db/schemas/identity-project-membership-role.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityProjectMembershipRoleSchema = z.object({ @@ -24,5 +22,10 @@ export const IdentityProjectMembershipRoleSchema = z.object({ }); export type TIdentityProjectMembershipRole = z.infer; -export type TIdentityProjectMembershipRoleInsert = Omit, TImmutableDBKeys>; -export type TIdentityProjectMembershipRoleUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityProjectMembershipRoleInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TIdentityProjectMembershipRoleUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-project-memberships.ts b/backend/src/db/schemas/identity-project-memberships.ts index 26e2de10f..2f17c36d8 100644 --- a/backend/src/db/schemas/identity-project-memberships.ts +++ b/backend/src/db/schemas/identity-project-memberships.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityProjectMembershipsSchema = z.object({ @@ -18,5 +16,10 @@ export const IdentityProjectMembershipsSchema = z.object({ }); export type TIdentityProjectMemberships = z.infer; -export type TIdentityProjectMembershipsInsert = Omit, TImmutableDBKeys>; -export type TIdentityProjectMembershipsUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityProjectMembershipsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TIdentityProjectMembershipsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-token-auths.ts b/backend/src/db/schemas/identity-token-auths.ts index 2ff183ae7..0f3c8c9ff 100644 --- a/backend/src/db/schemas/identity-token-auths.ts +++ b/backend/src/db/schemas/identity-token-auths.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityTokenAuthsSchema = z.object({ diff --git a/backend/src/db/schemas/identity-ua-client-secrets.ts b/backend/src/db/schemas/identity-ua-client-secrets.ts index 61eb8e57a..bd549ca5b 100644 --- a/backend/src/db/schemas/identity-ua-client-secrets.ts +++ b/backend/src/db/schemas/identity-ua-client-secrets.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityUaClientSecretsSchema = z.object({ @@ -26,4 +24,6 @@ export const IdentityUaClientSecretsSchema = z.object({ export type TIdentityUaClientSecrets = z.infer; export type TIdentityUaClientSecretsInsert = Omit, TImmutableDBKeys>; -export type TIdentityUaClientSecretsUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityUaClientSecretsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/identity-universal-auths.ts b/backend/src/db/schemas/identity-universal-auths.ts index 5be5c675b..eeec2f666 100644 --- a/backend/src/db/schemas/identity-universal-auths.ts +++ b/backend/src/db/schemas/identity-universal-auths.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IdentityUniversalAuthsSchema = z.object({ @@ -24,4 +22,6 @@ export const IdentityUniversalAuthsSchema = z.object({ export type TIdentityUniversalAuths = z.infer; export type TIdentityUniversalAuthsInsert = Omit, TImmutableDBKeys>; -export type TIdentityUniversalAuthsUpdate = Partial, TImmutableDBKeys>>; +export type TIdentityUniversalAuthsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/incident-contacts.ts b/backend/src/db/schemas/incident-contacts.ts index b6d86d930..23c8503b0 100644 --- a/backend/src/db/schemas/incident-contacts.ts +++ b/backend/src/db/schemas/incident-contacts.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IncidentContactsSchema = z.object({ diff --git a/backend/src/db/schemas/index.ts b/backend/src/db/schemas/index.ts index 9de470da3..f2bd2dd93 100644 --- a/backend/src/db/schemas/index.ts +++ b/backend/src/db/schemas/index.ts @@ -73,6 +73,7 @@ export * from "./project-memberships"; export * from "./project-roles"; export * from "./project-slack-configs"; export * from "./project-split-backfill-ids"; +export * from "./project-ssh-configs"; export * from "./project-templates"; export * from "./project-user-additional-privilege"; export * from "./project-user-membership-roles"; diff --git a/backend/src/db/schemas/integrations.ts b/backend/src/db/schemas/integrations.ts index 975fe7a13..47cf9e627 100644 --- a/backend/src/db/schemas/integrations.ts +++ b/backend/src/db/schemas/integrations.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const IntegrationsSchema = z.object({ @@ -27,7 +25,7 @@ export const IntegrationsSchema = z.object({ metadata: z.unknown().nullable().optional(), integrationAuthId: z.string().uuid(), envId: z.string().uuid(), - secretPath: z.string().default('/'), + secretPath: z.string().default("/"), createdAt: z.date(), updatedAt: z.date(), lastUsed: z.date().nullable().optional(), diff --git a/backend/src/db/schemas/kmip-client-certificates.ts b/backend/src/db/schemas/kmip-client-certificates.ts index cf46358d1..a42d94a98 100644 --- a/backend/src/db/schemas/kmip-client-certificates.ts +++ b/backend/src/db/schemas/kmip-client-certificates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const KmipClientCertificatesSchema = z.object({ @@ -20,4 +18,6 @@ export const KmipClientCertificatesSchema = z.object({ export type TKmipClientCertificates = z.infer; export type TKmipClientCertificatesInsert = Omit, TImmutableDBKeys>; -export type TKmipClientCertificatesUpdate = Partial, TImmutableDBKeys>>; +export type TKmipClientCertificatesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/kmip-clients.ts b/backend/src/db/schemas/kmip-clients.ts index 5c9f27ca2..eb8f31bfb 100644 --- a/backend/src/db/schemas/kmip-clients.ts +++ b/backend/src/db/schemas/kmip-clients.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const KmipClientsSchema = z.object({ diff --git a/backend/src/db/schemas/kmip-org-server-certificates.ts b/backend/src/db/schemas/kmip-org-server-certificates.ts index 6abf849ed..66e5dcbd6 100644 --- a/backend/src/db/schemas/kmip-org-server-certificates.ts +++ b/backend/src/db/schemas/kmip-org-server-certificates.ts @@ -24,4 +24,6 @@ export const KmipOrgServerCertificatesSchema = z.object({ export type TKmipOrgServerCertificates = z.infer; export type TKmipOrgServerCertificatesInsert = Omit, TImmutableDBKeys>; -export type TKmipOrgServerCertificatesUpdate = Partial, TImmutableDBKeys>>; +export type TKmipOrgServerCertificatesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/kms-keys.ts b/backend/src/db/schemas/kms-keys.ts index 65e4f25eb..b56fab7bf 100644 --- a/backend/src/db/schemas/kms-keys.ts +++ b/backend/src/db/schemas/kms-keys.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const KmsKeysSchema = z.object({ diff --git a/backend/src/db/schemas/kms-root-config.ts b/backend/src/db/schemas/kms-root-config.ts index cd4552a1c..c9c1ebda5 100644 --- a/backend/src/db/schemas/kms-root-config.ts +++ b/backend/src/db/schemas/kms-root-config.ts @@ -12,7 +12,7 @@ import { TImmutableDBKeys } from "./models"; export const KmsRootConfigSchema = z.object({ id: z.string().uuid(), encryptedRootKey: zodBuffer, - encryptionStrategy: z.string().default('SOFTWARE').nullable().optional(), + encryptionStrategy: z.string().default("SOFTWARE").nullable().optional(), createdAt: z.date(), updatedAt: z.date() }); diff --git a/backend/src/db/schemas/ldap-configs.ts b/backend/src/db/schemas/ldap-configs.ts index 90fc5c288..778e7be6e 100644 --- a/backend/src/db/schemas/ldap-configs.ts +++ b/backend/src/db/schemas/ldap-configs.ts @@ -26,10 +26,10 @@ export const LdapConfigsSchema = z.object({ caCertTag: z.string().nullable().optional(), createdAt: z.date(), updatedAt: z.date(), - groupSearchBase: z.string().default(''), - groupSearchFilter: z.string().default(''), - searchFilter: z.string().default(''), - uniqueUserAttribute: z.string().default(''), + groupSearchBase: z.string().default(""), + groupSearchFilter: z.string().default(""), + searchFilter: z.string().default(""), + uniqueUserAttribute: z.string().default(""), encryptedLdapBindDN: zodBuffer, encryptedLdapBindPass: zodBuffer, encryptedLdapCaCertificate: zodBuffer.nullable().optional() diff --git a/backend/src/db/schemas/ldap-group-maps.ts b/backend/src/db/schemas/ldap-group-maps.ts index ad4c93383..d51d151b8 100644 --- a/backend/src/db/schemas/ldap-group-maps.ts +++ b/backend/src/db/schemas/ldap-group-maps.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const LdapGroupMapsSchema = z.object({ diff --git a/backend/src/db/schemas/models.ts b/backend/src/db/schemas/models.ts index 67055d331..6b56a60ae 100644 --- a/backend/src/db/schemas/models.ts +++ b/backend/src/db/schemas/models.ts @@ -40,6 +40,7 @@ export enum TableName { SuperAdmin = "super_admin", RateLimit = "rate_limit", ApiKey = "api_keys", + ProjectSshConfig = "project_ssh_configs", Project = "projects", ProjectBot = "project_bots", Environment = "project_environments", diff --git a/backend/src/db/schemas/org-bots.ts b/backend/src/db/schemas/org-bots.ts index 42d278c7e..77be907ec 100644 --- a/backend/src/db/schemas/org-bots.ts +++ b/backend/src/db/schemas/org-bots.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const OrgBotsSchema = z.object({ diff --git a/backend/src/db/schemas/org-memberships.ts b/backend/src/db/schemas/org-memberships.ts index d200c6fb2..e77b6e9c9 100644 --- a/backend/src/db/schemas/org-memberships.ts +++ b/backend/src/db/schemas/org-memberships.ts @@ -5,14 +5,12 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const OrgMembershipsSchema = z.object({ id: z.string().uuid(), role: z.string(), - status: z.string().default('invited'), + status: z.string().default("invited"), inviteEmail: z.string().nullable().optional(), createdAt: z.date(), updatedAt: z.date(), diff --git a/backend/src/db/schemas/org-roles.ts b/backend/src/db/schemas/org-roles.ts index 848ee104d..ca01c6574 100644 --- a/backend/src/db/schemas/org-roles.ts +++ b/backend/src/db/schemas/org-roles.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const OrgRolesSchema = z.object({ diff --git a/backend/src/db/schemas/organizations.ts b/backend/src/db/schemas/organizations.ts index b01a404e0..a18e258c7 100644 --- a/backend/src/db/schemas/organizations.ts +++ b/backend/src/db/schemas/organizations.ts @@ -20,7 +20,7 @@ export const OrganizationsSchema = z.object({ scimEnabled: z.boolean().default(false).nullable().optional(), kmsDefaultKeyId: z.string().uuid().nullable().optional(), kmsEncryptedDataKey: zodBuffer.nullable().optional(), - defaultMembershipRole: z.string().default('member'), + defaultMembershipRole: z.string().default("member"), enforceMfa: z.boolean().default(false), selectedMfaMethod: z.string().nullable().optional(), allowSecretSharingOutsideOrganization: z.boolean().default(true).nullable().optional(), diff --git a/backend/src/db/schemas/pki-alerts.ts b/backend/src/db/schemas/pki-alerts.ts index 325a17974..7bc9d2d7c 100644 --- a/backend/src/db/schemas/pki-alerts.ts +++ b/backend/src/db/schemas/pki-alerts.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const PkiAlertsSchema = z.object({ diff --git a/backend/src/db/schemas/pki-collection-items.ts b/backend/src/db/schemas/pki-collection-items.ts index 27a69ebb2..f04f5a1ee 100644 --- a/backend/src/db/schemas/pki-collection-items.ts +++ b/backend/src/db/schemas/pki-collection-items.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const PkiCollectionItemsSchema = z.object({ diff --git a/backend/src/db/schemas/pki-collections.ts b/backend/src/db/schemas/pki-collections.ts index f565d698f..0f9a5675f 100644 --- a/backend/src/db/schemas/pki-collections.ts +++ b/backend/src/db/schemas/pki-collections.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const PkiCollectionsSchema = z.object({ diff --git a/backend/src/db/schemas/project-bots.ts b/backend/src/db/schemas/project-bots.ts index ff58696f7..1fa59eb78 100644 --- a/backend/src/db/schemas/project-bots.ts +++ b/backend/src/db/schemas/project-bots.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectBotsSchema = z.object({ diff --git a/backend/src/db/schemas/project-environments.ts b/backend/src/db/schemas/project-environments.ts index 823fe67da..76556b7e9 100644 --- a/backend/src/db/schemas/project-environments.ts +++ b/backend/src/db/schemas/project-environments.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectEnvironmentsSchema = z.object({ diff --git a/backend/src/db/schemas/project-gateways.ts b/backend/src/db/schemas/project-gateways.ts index d86d067c5..f4b572661 100644 --- a/backend/src/db/schemas/project-gateways.ts +++ b/backend/src/db/schemas/project-gateways.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectGatewaysSchema = z.object({ diff --git a/backend/src/db/schemas/project-keys.ts b/backend/src/db/schemas/project-keys.ts index ce958f82e..924918b12 100644 --- a/backend/src/db/schemas/project-keys.ts +++ b/backend/src/db/schemas/project-keys.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectKeysSchema = z.object({ diff --git a/backend/src/db/schemas/project-memberships.ts b/backend/src/db/schemas/project-memberships.ts index 21e12029c..e522d6280 100644 --- a/backend/src/db/schemas/project-memberships.ts +++ b/backend/src/db/schemas/project-memberships.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectMembershipsSchema = z.object({ diff --git a/backend/src/db/schemas/project-roles.ts b/backend/src/db/schemas/project-roles.ts index 5f9fc0610..37eb58fcb 100644 --- a/backend/src/db/schemas/project-roles.ts +++ b/backend/src/db/schemas/project-roles.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectRolesSchema = z.object({ diff --git a/backend/src/db/schemas/project-slack-configs.ts b/backend/src/db/schemas/project-slack-configs.ts index 9ec1ee367..0a46e5aae 100644 --- a/backend/src/db/schemas/project-slack-configs.ts +++ b/backend/src/db/schemas/project-slack-configs.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectSlackConfigsSchema = z.object({ @@ -14,9 +12,9 @@ export const ProjectSlackConfigsSchema = z.object({ projectId: z.string(), slackIntegrationId: z.string().uuid(), isAccessRequestNotificationEnabled: z.boolean().default(false), - accessRequestChannels: z.string().default(''), + accessRequestChannels: z.string().default(""), isSecretRequestNotificationEnabled: z.boolean().default(false), - secretRequestChannels: z.string().default(''), + secretRequestChannels: z.string().default(""), createdAt: z.date(), updatedAt: z.date() }); diff --git a/backend/src/db/schemas/project-split-backfill-ids.ts b/backend/src/db/schemas/project-split-backfill-ids.ts index d674dd590..182d85049 100644 --- a/backend/src/db/schemas/project-split-backfill-ids.ts +++ b/backend/src/db/schemas/project-split-backfill-ids.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectSplitBackfillIdsSchema = z.object({ @@ -18,4 +16,6 @@ export const ProjectSplitBackfillIdsSchema = z.object({ export type TProjectSplitBackfillIds = z.infer; export type TProjectSplitBackfillIdsInsert = Omit, TImmutableDBKeys>; -export type TProjectSplitBackfillIdsUpdate = Partial, TImmutableDBKeys>>; +export type TProjectSplitBackfillIdsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/project-ssh-configs.ts b/backend/src/db/schemas/project-ssh-configs.ts new file mode 100644 index 000000000..d0be89ee3 --- /dev/null +++ b/backend/src/db/schemas/project-ssh-configs.ts @@ -0,0 +1,21 @@ +// Code generated by automation script, DO NOT EDIT. +// Automated by pulling database and generating zod schema +// To update. Just run npm run generate:schema +// Written by akhilmhdh. + +import { z } from "zod"; + +import { TImmutableDBKeys } from "./models"; + +export const ProjectSshConfigsSchema = z.object({ + id: z.string().uuid(), + createdAt: z.date(), + updatedAt: z.date(), + projectId: z.string(), + defaultUserSshCaId: z.string().uuid().nullable().optional(), + defaultHostSshCaId: z.string().uuid().nullable().optional() +}); + +export type TProjectSshConfigs = z.infer; +export type TProjectSshConfigsInsert = Omit, TImmutableDBKeys>; +export type TProjectSshConfigsUpdate = Partial, TImmutableDBKeys>>; diff --git a/backend/src/db/schemas/project-templates.ts b/backend/src/db/schemas/project-templates.ts index 981dc581e..68f37d256 100644 --- a/backend/src/db/schemas/project-templates.ts +++ b/backend/src/db/schemas/project-templates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectTemplatesSchema = z.object({ diff --git a/backend/src/db/schemas/project-user-additional-privilege.ts b/backend/src/db/schemas/project-user-additional-privilege.ts index 8eb581670..e657fc945 100644 --- a/backend/src/db/schemas/project-user-additional-privilege.ts +++ b/backend/src/db/schemas/project-user-additional-privilege.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectUserAdditionalPrivilegeSchema = z.object({ @@ -26,5 +24,10 @@ export const ProjectUserAdditionalPrivilegeSchema = z.object({ }); export type TProjectUserAdditionalPrivilege = z.infer; -export type TProjectUserAdditionalPrivilegeInsert = Omit, TImmutableDBKeys>; -export type TProjectUserAdditionalPrivilegeUpdate = Partial, TImmutableDBKeys>>; +export type TProjectUserAdditionalPrivilegeInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TProjectUserAdditionalPrivilegeUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/project-user-membership-roles.ts b/backend/src/db/schemas/project-user-membership-roles.ts index e0f40505a..bc7b67208 100644 --- a/backend/src/db/schemas/project-user-membership-roles.ts +++ b/backend/src/db/schemas/project-user-membership-roles.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ProjectUserMembershipRolesSchema = z.object({ @@ -24,5 +22,10 @@ export const ProjectUserMembershipRolesSchema = z.object({ }); export type TProjectUserMembershipRoles = z.infer; -export type TProjectUserMembershipRolesInsert = Omit, TImmutableDBKeys>; -export type TProjectUserMembershipRolesUpdate = Partial, TImmutableDBKeys>>; +export type TProjectUserMembershipRolesInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TProjectUserMembershipRolesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/rate-limit.ts b/backend/src/db/schemas/rate-limit.ts index 1cea9b556..233f6cdbc 100644 --- a/backend/src/db/schemas/rate-limit.ts +++ b/backend/src/db/schemas/rate-limit.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const RateLimitSchema = z.object({ diff --git a/backend/src/db/schemas/resource-metadata.ts b/backend/src/db/schemas/resource-metadata.ts index 748bdd0e6..f496b29db 100644 --- a/backend/src/db/schemas/resource-metadata.ts +++ b/backend/src/db/schemas/resource-metadata.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ResourceMetadataSchema = z.object({ diff --git a/backend/src/db/schemas/scim-tokens.ts b/backend/src/db/schemas/scim-tokens.ts index 3de5057d0..ab6e10d27 100644 --- a/backend/src/db/schemas/scim-tokens.ts +++ b/backend/src/db/schemas/scim-tokens.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ScimTokensSchema = z.object({ diff --git a/backend/src/db/schemas/secret-approval-policies-approvers.ts b/backend/src/db/schemas/secret-approval-policies-approvers.ts index 578da0df0..f9aebf019 100644 --- a/backend/src/db/schemas/secret-approval-policies-approvers.ts +++ b/backend/src/db/schemas/secret-approval-policies-approvers.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalPoliciesApproversSchema = z.object({ @@ -19,5 +17,10 @@ export const SecretApprovalPoliciesApproversSchema = z.object({ }); export type TSecretApprovalPoliciesApprovers = z.infer; -export type TSecretApprovalPoliciesApproversInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalPoliciesApproversUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalPoliciesApproversInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalPoliciesApproversUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-policies.ts b/backend/src/db/schemas/secret-approval-policies.ts index 72a0caaa2..8b9174456 100644 --- a/backend/src/db/schemas/secret-approval-policies.ts +++ b/backend/src/db/schemas/secret-approval-policies.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalPoliciesSchema = z.object({ @@ -17,11 +15,13 @@ export const SecretApprovalPoliciesSchema = z.object({ envId: z.string().uuid(), createdAt: z.date(), updatedAt: z.date(), - enforcementLevel: z.string().default('hard'), + enforcementLevel: z.string().default("hard"), deletedAt: z.date().nullable().optional(), allowedSelfApprovals: z.boolean().default(true) }); export type TSecretApprovalPolicies = z.infer; export type TSecretApprovalPoliciesInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalPoliciesUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalPoliciesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts b/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts index 713b5bb10..6ded05a5d 100644 --- a/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts +++ b/backend/src/db/schemas/secret-approval-request-secret-tags-v2.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalRequestSecretTagsV2Schema = z.object({ @@ -18,5 +16,10 @@ export const SecretApprovalRequestSecretTagsV2Schema = z.object({ }); export type TSecretApprovalRequestSecretTagsV2 = z.infer; -export type TSecretApprovalRequestSecretTagsV2Insert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestSecretTagsV2Update = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestSecretTagsV2Insert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestSecretTagsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-request-secret-tags.ts b/backend/src/db/schemas/secret-approval-request-secret-tags.ts index dfa840528..2851321e2 100644 --- a/backend/src/db/schemas/secret-approval-request-secret-tags.ts +++ b/backend/src/db/schemas/secret-approval-request-secret-tags.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalRequestSecretTagsSchema = z.object({ @@ -18,5 +16,10 @@ export const SecretApprovalRequestSecretTagsSchema = z.object({ }); export type TSecretApprovalRequestSecretTags = z.infer; -export type TSecretApprovalRequestSecretTagsInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestSecretTagsUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestSecretTagsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestSecretTagsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-requests-reviewers.ts b/backend/src/db/schemas/secret-approval-requests-reviewers.ts index 820f7ab4c..147646b8d 100644 --- a/backend/src/db/schemas/secret-approval-requests-reviewers.ts +++ b/backend/src/db/schemas/secret-approval-requests-reviewers.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalRequestsReviewersSchema = z.object({ @@ -20,5 +18,10 @@ export const SecretApprovalRequestsReviewersSchema = z.object({ }); export type TSecretApprovalRequestsReviewers = z.infer; -export type TSecretApprovalRequestsReviewersInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestsReviewersUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestsReviewersInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestsReviewersUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts b/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts index 1502b5d28..298985fed 100644 --- a/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts +++ b/backend/src/db/schemas/secret-approval-requests-secrets-v2.ts @@ -29,5 +29,10 @@ export const SecretApprovalRequestsSecretsV2Schema = z.object({ }); export type TSecretApprovalRequestsSecretsV2 = z.infer; -export type TSecretApprovalRequestsSecretsV2Insert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestsSecretsV2Update = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestsSecretsV2Insert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestsSecretsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-requests-secrets.ts b/backend/src/db/schemas/secret-approval-requests-secrets.ts index 5e82e2095..b795b47b4 100644 --- a/backend/src/db/schemas/secret-approval-requests-secrets.ts +++ b/backend/src/db/schemas/secret-approval-requests-secrets.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalRequestsSecretsSchema = z.object({ @@ -25,8 +23,8 @@ export const SecretApprovalRequestsSecretsSchema = z.object({ secretReminderNote: z.string().nullable().optional(), secretReminderRepeatDays: z.number().nullable().optional(), skipMultilineEncoding: z.boolean().default(false).nullable().optional(), - algorithm: z.string().default('aes-256-gcm'), - keyEncoding: z.string().default('utf8'), + algorithm: z.string().default("aes-256-gcm"), + keyEncoding: z.string().default("utf8"), metadata: z.unknown().nullable().optional(), createdAt: z.date(), updatedAt: z.date(), @@ -37,5 +35,10 @@ export const SecretApprovalRequestsSecretsSchema = z.object({ }); export type TSecretApprovalRequestsSecrets = z.infer; -export type TSecretApprovalRequestsSecretsInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestsSecretsUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestsSecretsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretApprovalRequestsSecretsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-approval-requests.ts b/backend/src/db/schemas/secret-approval-requests.ts index 78f91cfc8..218a0f922 100644 --- a/backend/src/db/schemas/secret-approval-requests.ts +++ b/backend/src/db/schemas/secret-approval-requests.ts @@ -5,15 +5,13 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretApprovalRequestsSchema = z.object({ id: z.string().uuid(), policyId: z.string().uuid(), hasMerged: z.boolean().default(false), - status: z.string().default('open'), + status: z.string().default("open"), conflicts: z.unknown().nullable().optional(), slug: z.string(), folderId: z.string().uuid(), @@ -27,4 +25,6 @@ export const SecretApprovalRequestsSchema = z.object({ export type TSecretApprovalRequests = z.infer; export type TSecretApprovalRequestsInsert = Omit, TImmutableDBKeys>; -export type TSecretApprovalRequestsUpdate = Partial, TImmutableDBKeys>>; +export type TSecretApprovalRequestsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-blind-indexes.ts b/backend/src/db/schemas/secret-blind-indexes.ts index 09c8f8b89..474e0aa54 100644 --- a/backend/src/db/schemas/secret-blind-indexes.ts +++ b/backend/src/db/schemas/secret-blind-indexes.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretBlindIndexesSchema = z.object({ @@ -14,8 +12,8 @@ export const SecretBlindIndexesSchema = z.object({ encryptedSaltCipherText: z.string(), saltIV: z.string(), saltTag: z.string(), - algorithm: z.string().default('aes-256-gcm'), - keyEncoding: z.string().default('utf8'), + algorithm: z.string().default("aes-256-gcm"), + keyEncoding: z.string().default("utf8"), projectId: z.string(), createdAt: z.date(), updatedAt: z.date() diff --git a/backend/src/db/schemas/secret-folder-versions.ts b/backend/src/db/schemas/secret-folder-versions.ts index e7348bb59..8bef6e83f 100644 --- a/backend/src/db/schemas/secret-folder-versions.ts +++ b/backend/src/db/schemas/secret-folder-versions.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretFolderVersionsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-folders.ts b/backend/src/db/schemas/secret-folders.ts index c0564eff1..09e2fe8c1 100644 --- a/backend/src/db/schemas/secret-folders.ts +++ b/backend/src/db/schemas/secret-folders.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretFoldersSchema = z.object({ diff --git a/backend/src/db/schemas/secret-imports.ts b/backend/src/db/schemas/secret-imports.ts index eaa82bea5..4bb1e669d 100644 --- a/backend/src/db/schemas/secret-imports.ts +++ b/backend/src/db/schemas/secret-imports.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretImportsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-references-v2.ts b/backend/src/db/schemas/secret-references-v2.ts index c4098ee5a..ed339e65c 100644 --- a/backend/src/db/schemas/secret-references-v2.ts +++ b/backend/src/db/schemas/secret-references-v2.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretReferencesV2Schema = z.object({ diff --git a/backend/src/db/schemas/secret-references.ts b/backend/src/db/schemas/secret-references.ts index 83e479498..b3e6a8629 100644 --- a/backend/src/db/schemas/secret-references.ts +++ b/backend/src/db/schemas/secret-references.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretReferencesSchema = z.object({ diff --git a/backend/src/db/schemas/secret-rotation-output-v2.ts b/backend/src/db/schemas/secret-rotation-output-v2.ts index 5be9d4646..28d45413a 100644 --- a/backend/src/db/schemas/secret-rotation-output-v2.ts +++ b/backend/src/db/schemas/secret-rotation-output-v2.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretRotationOutputV2Schema = z.object({ @@ -18,4 +16,6 @@ export const SecretRotationOutputV2Schema = z.object({ export type TSecretRotationOutputV2 = z.infer; export type TSecretRotationOutputV2Insert = Omit, TImmutableDBKeys>; -export type TSecretRotationOutputV2Update = Partial, TImmutableDBKeys>>; +export type TSecretRotationOutputV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-rotation-outputs.ts b/backend/src/db/schemas/secret-rotation-outputs.ts index dc4b49cdf..3ac5c2c9e 100644 --- a/backend/src/db/schemas/secret-rotation-outputs.ts +++ b/backend/src/db/schemas/secret-rotation-outputs.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretRotationOutputsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-scanning-git-risks.ts b/backend/src/db/schemas/secret-scanning-git-risks.ts index 677dc2e73..08ba690e4 100644 --- a/backend/src/db/schemas/secret-scanning-git-risks.ts +++ b/backend/src/db/schemas/secret-scanning-git-risks.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretScanningGitRisksSchema = z.object({ @@ -45,4 +43,6 @@ export const SecretScanningGitRisksSchema = z.object({ export type TSecretScanningGitRisks = z.infer; export type TSecretScanningGitRisksInsert = Omit, TImmutableDBKeys>; -export type TSecretScanningGitRisksUpdate = Partial, TImmutableDBKeys>>; +export type TSecretScanningGitRisksUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-sharing.ts b/backend/src/db/schemas/secret-sharing.ts index 22bdac3d5..24ea26677 100644 --- a/backend/src/db/schemas/secret-sharing.ts +++ b/backend/src/db/schemas/secret-sharing.ts @@ -21,13 +21,13 @@ export const SecretSharingSchema = z.object({ createdAt: z.date(), updatedAt: z.date(), expiresAfterViews: z.number().nullable().optional(), - accessType: z.string().default('anyone'), + accessType: z.string().default("anyone"), name: z.string().nullable().optional(), lastViewedAt: z.date().nullable().optional(), password: z.string().nullable().optional(), encryptedSecret: zodBuffer.nullable().optional(), identifier: z.string().nullable().optional(), - type: z.string().default('share') + type: z.string().default("share") }); export type TSecretSharing = z.infer; diff --git a/backend/src/db/schemas/secret-snapshot-folders.ts b/backend/src/db/schemas/secret-snapshot-folders.ts index 89d3e07a4..3e2853cbe 100644 --- a/backend/src/db/schemas/secret-snapshot-folders.ts +++ b/backend/src/db/schemas/secret-snapshot-folders.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretSnapshotFoldersSchema = z.object({ diff --git a/backend/src/db/schemas/secret-snapshot-secrets-v2.ts b/backend/src/db/schemas/secret-snapshot-secrets-v2.ts index 8dea884e4..d643f7f8c 100644 --- a/backend/src/db/schemas/secret-snapshot-secrets-v2.ts +++ b/backend/src/db/schemas/secret-snapshot-secrets-v2.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretSnapshotSecretsV2Schema = z.object({ @@ -20,4 +18,6 @@ export const SecretSnapshotSecretsV2Schema = z.object({ export type TSecretSnapshotSecretsV2 = z.infer; export type TSecretSnapshotSecretsV2Insert = Omit, TImmutableDBKeys>; -export type TSecretSnapshotSecretsV2Update = Partial, TImmutableDBKeys>>; +export type TSecretSnapshotSecretsV2Update = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-snapshot-secrets.ts b/backend/src/db/schemas/secret-snapshot-secrets.ts index 510a69e99..121c5d56e 100644 --- a/backend/src/db/schemas/secret-snapshot-secrets.ts +++ b/backend/src/db/schemas/secret-snapshot-secrets.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretSnapshotSecretsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-snapshots.ts b/backend/src/db/schemas/secret-snapshots.ts index 866bcd42f..7f070075f 100644 --- a/backend/src/db/schemas/secret-snapshots.ts +++ b/backend/src/db/schemas/secret-snapshots.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretSnapshotsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-syncs.ts b/backend/src/db/schemas/secret-syncs.ts index 488cd0f6c..0e0728e87 100644 --- a/backend/src/db/schemas/secret-syncs.ts +++ b/backend/src/db/schemas/secret-syncs.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretSyncsSchema = z.object({ diff --git a/backend/src/db/schemas/secret-tag-junction.ts b/backend/src/db/schemas/secret-tag-junction.ts index 52e98fd7d..d14384fab 100644 --- a/backend/src/db/schemas/secret-tag-junction.ts +++ b/backend/src/db/schemas/secret-tag-junction.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretTagJunctionSchema = z.object({ diff --git a/backend/src/db/schemas/secret-tags.ts b/backend/src/db/schemas/secret-tags.ts index 3828d0553..7ba7204a4 100644 --- a/backend/src/db/schemas/secret-tags.ts +++ b/backend/src/db/schemas/secret-tags.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretTagsSchema = z.object({ @@ -17,7 +15,7 @@ export const SecretTagsSchema = z.object({ updatedAt: z.date(), createdBy: z.string().uuid().nullable().optional(), projectId: z.string(), - createdByActorType: z.string().default('user') + createdByActorType: z.string().default("user") }); export type TSecretTags = z.infer; diff --git a/backend/src/db/schemas/secret-v2-tag-junction.ts b/backend/src/db/schemas/secret-v2-tag-junction.ts index 04ecd7526..982e11f50 100644 --- a/backend/src/db/schemas/secret-v2-tag-junction.ts +++ b/backend/src/db/schemas/secret-v2-tag-junction.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretV2TagJunctionSchema = z.object({ diff --git a/backend/src/db/schemas/secret-version-tag-junction.ts b/backend/src/db/schemas/secret-version-tag-junction.ts index a93e9f586..b36e28c72 100644 --- a/backend/src/db/schemas/secret-version-tag-junction.ts +++ b/backend/src/db/schemas/secret-version-tag-junction.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretVersionTagJunctionSchema = z.object({ @@ -17,4 +15,6 @@ export const SecretVersionTagJunctionSchema = z.object({ export type TSecretVersionTagJunction = z.infer; export type TSecretVersionTagJunctionInsert = Omit, TImmutableDBKeys>; -export type TSecretVersionTagJunctionUpdate = Partial, TImmutableDBKeys>>; +export type TSecretVersionTagJunctionUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-version-v2-tag-junction.ts b/backend/src/db/schemas/secret-version-v2-tag-junction.ts index 1706bf31b..4679116a0 100644 --- a/backend/src/db/schemas/secret-version-v2-tag-junction.ts +++ b/backend/src/db/schemas/secret-version-v2-tag-junction.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretVersionV2TagJunctionSchema = z.object({ @@ -16,5 +14,10 @@ export const SecretVersionV2TagJunctionSchema = z.object({ }); export type TSecretVersionV2TagJunction = z.infer; -export type TSecretVersionV2TagJunctionInsert = Omit, TImmutableDBKeys>; -export type TSecretVersionV2TagJunctionUpdate = Partial, TImmutableDBKeys>>; +export type TSecretVersionV2TagJunctionInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSecretVersionV2TagJunctionUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/secret-versions-v2.ts b/backend/src/db/schemas/secret-versions-v2.ts index 3ac217c81..593a46b06 100644 --- a/backend/src/db/schemas/secret-versions-v2.ts +++ b/backend/src/db/schemas/secret-versions-v2.ts @@ -12,7 +12,7 @@ import { TImmutableDBKeys } from "./models"; export const SecretVersionsV2Schema = z.object({ id: z.string().uuid(), version: z.number().default(1), - type: z.string().default('shared'), + type: z.string().default("shared"), key: z.string(), encryptedValue: zodBuffer.nullable().optional(), encryptedComment: zodBuffer.nullable().optional(), diff --git a/backend/src/db/schemas/secret-versions.ts b/backend/src/db/schemas/secret-versions.ts index cddecd67a..d60db9b75 100644 --- a/backend/src/db/schemas/secret-versions.ts +++ b/backend/src/db/schemas/secret-versions.ts @@ -5,14 +5,12 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretVersionsSchema = z.object({ id: z.string().uuid(), version: z.number().default(1), - type: z.string().default('shared'), + type: z.string().default("shared"), secretBlindIndex: z.string().nullable().optional(), secretKeyCiphertext: z.string(), secretKeyIV: z.string(), @@ -26,8 +24,8 @@ export const SecretVersionsSchema = z.object({ secretReminderNote: z.string().nullable().optional(), secretReminderRepeatDays: z.number().nullable().optional(), skipMultilineEncoding: z.boolean().default(false).nullable().optional(), - algorithm: z.string().default('aes-256-gcm'), - keyEncoding: z.string().default('utf8'), + algorithm: z.string().default("aes-256-gcm"), + keyEncoding: z.string().default("utf8"), metadata: z.unknown().nullable().optional(), envId: z.string().uuid().nullable().optional(), secretId: z.string().uuid(), diff --git a/backend/src/db/schemas/secrets-v2.ts b/backend/src/db/schemas/secrets-v2.ts index 5c74f704e..18fa3b476 100644 --- a/backend/src/db/schemas/secrets-v2.ts +++ b/backend/src/db/schemas/secrets-v2.ts @@ -12,7 +12,7 @@ import { TImmutableDBKeys } from "./models"; export const SecretsV2Schema = z.object({ id: z.string().uuid(), version: z.number().default(1), - type: z.string().default('shared'), + type: z.string().default("shared"), key: z.string(), encryptedValue: zodBuffer.nullable().optional(), encryptedComment: zodBuffer.nullable().optional(), diff --git a/backend/src/db/schemas/secrets.ts b/backend/src/db/schemas/secrets.ts index 874ffb73c..f261c40bb 100644 --- a/backend/src/db/schemas/secrets.ts +++ b/backend/src/db/schemas/secrets.ts @@ -5,14 +5,12 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SecretsSchema = z.object({ id: z.string().uuid(), version: z.number().default(1), - type: z.string().default('shared'), + type: z.string().default("shared"), secretBlindIndex: z.string().nullable().optional(), secretKeyCiphertext: z.string(), secretKeyIV: z.string(), @@ -26,8 +24,8 @@ export const SecretsSchema = z.object({ secretReminderNote: z.string().nullable().optional(), secretReminderRepeatDays: z.number().nullable().optional(), skipMultilineEncoding: z.boolean().default(false).nullable().optional(), - algorithm: z.string().default('aes-256-gcm'), - keyEncoding: z.string().default('utf8'), + algorithm: z.string().default("aes-256-gcm"), + keyEncoding: z.string().default("utf8"), metadata: z.unknown().nullable().optional(), userId: z.string().uuid().nullable().optional(), folderId: z.string().uuid(), diff --git a/backend/src/db/schemas/service-tokens.ts b/backend/src/db/schemas/service-tokens.ts index f7a74b695..720c8fd6f 100644 --- a/backend/src/db/schemas/service-tokens.ts +++ b/backend/src/db/schemas/service-tokens.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const ServiceTokensSchema = z.object({ diff --git a/backend/src/db/schemas/ssh-certificate-authorities.ts b/backend/src/db/schemas/ssh-certificate-authorities.ts index 3a273aaa8..75603406f 100644 --- a/backend/src/db/schemas/ssh-certificate-authorities.ts +++ b/backend/src/db/schemas/ssh-certificate-authorities.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SshCertificateAuthoritiesSchema = z.object({ @@ -22,4 +20,6 @@ export const SshCertificateAuthoritiesSchema = z.object({ export type TSshCertificateAuthorities = z.infer; export type TSshCertificateAuthoritiesInsert = Omit, TImmutableDBKeys>; -export type TSshCertificateAuthoritiesUpdate = Partial, TImmutableDBKeys>>; +export type TSshCertificateAuthoritiesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/ssh-certificate-authority-secrets.ts b/backend/src/db/schemas/ssh-certificate-authority-secrets.ts index 4c4f6320e..934c10ab2 100644 --- a/backend/src/db/schemas/ssh-certificate-authority-secrets.ts +++ b/backend/src/db/schemas/ssh-certificate-authority-secrets.ts @@ -18,5 +18,10 @@ export const SshCertificateAuthoritySecretsSchema = z.object({ }); export type TSshCertificateAuthoritySecrets = z.infer; -export type TSshCertificateAuthoritySecretsInsert = Omit, TImmutableDBKeys>; -export type TSshCertificateAuthoritySecretsUpdate = Partial, TImmutableDBKeys>>; +export type TSshCertificateAuthoritySecretsInsert = Omit< + z.input, + TImmutableDBKeys +>; +export type TSshCertificateAuthoritySecretsUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/ssh-certificate-templates.ts b/backend/src/db/schemas/ssh-certificate-templates.ts index 88846673c..6c16c3942 100644 --- a/backend/src/db/schemas/ssh-certificate-templates.ts +++ b/backend/src/db/schemas/ssh-certificate-templates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SshCertificateTemplatesSchema = z.object({ @@ -27,4 +25,6 @@ export const SshCertificateTemplatesSchema = z.object({ export type TSshCertificateTemplates = z.infer; export type TSshCertificateTemplatesInsert = Omit, TImmutableDBKeys>; -export type TSshCertificateTemplatesUpdate = Partial, TImmutableDBKeys>>; +export type TSshCertificateTemplatesUpdate = Partial< + Omit, TImmutableDBKeys> +>; diff --git a/backend/src/db/schemas/ssh-certificates.ts b/backend/src/db/schemas/ssh-certificates.ts index 2344359e5..351875bbb 100644 --- a/backend/src/db/schemas/ssh-certificates.ts +++ b/backend/src/db/schemas/ssh-certificates.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SshCertificatesSchema = z.object({ diff --git a/backend/src/db/schemas/ssh-host-login-mappings.ts b/backend/src/db/schemas/ssh-host-login-mappings.ts index 12f851a93..0353589d2 100644 --- a/backend/src/db/schemas/ssh-host-login-mappings.ts +++ b/backend/src/db/schemas/ssh-host-login-mappings.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SshHostLoginMappingsSchema = z.object({ diff --git a/backend/src/db/schemas/ssh-hosts.ts b/backend/src/db/schemas/ssh-hosts.ts index 3b21823c8..7577e065b 100644 --- a/backend/src/db/schemas/ssh-hosts.ts +++ b/backend/src/db/schemas/ssh-hosts.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const SshHostsSchema = z.object({ @@ -16,7 +14,9 @@ export const SshHostsSchema = z.object({ projectId: z.string(), hostname: z.string(), userCertTtl: z.string(), - hostCertTtl: z.string() + hostCertTtl: z.string(), + userSshCaId: z.string().uuid(), + hostSshCaId: z.string().uuid() }); export type TSshHosts = z.infer; diff --git a/backend/src/db/schemas/trusted-ips.ts b/backend/src/db/schemas/trusted-ips.ts index 80579504e..f9973a843 100644 --- a/backend/src/db/schemas/trusted-ips.ts +++ b/backend/src/db/schemas/trusted-ips.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const TrustedIpsSchema = z.object({ diff --git a/backend/src/db/schemas/user-actions.ts b/backend/src/db/schemas/user-actions.ts index 9937f36d6..89d269847 100644 --- a/backend/src/db/schemas/user-actions.ts +++ b/backend/src/db/schemas/user-actions.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const UserActionsSchema = z.object({ diff --git a/backend/src/db/schemas/user-aliases.ts b/backend/src/db/schemas/user-aliases.ts index 0fdd59892..14147abf8 100644 --- a/backend/src/db/schemas/user-aliases.ts +++ b/backend/src/db/schemas/user-aliases.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const UserAliasesSchema = z.object({ diff --git a/backend/src/db/schemas/user-encryption-keys.ts b/backend/src/db/schemas/user-encryption-keys.ts index 4911cdf53..fd9d21a9d 100644 --- a/backend/src/db/schemas/user-encryption-keys.ts +++ b/backend/src/db/schemas/user-encryption-keys.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const UserEncryptionKeysSchema = z.object({ diff --git a/backend/src/db/schemas/user-group-membership.ts b/backend/src/db/schemas/user-group-membership.ts index b23d8b15e..6b5fccd46 100644 --- a/backend/src/db/schemas/user-group-membership.ts +++ b/backend/src/db/schemas/user-group-membership.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const UserGroupMembershipSchema = z.object({ diff --git a/backend/src/db/schemas/users.ts b/backend/src/db/schemas/users.ts index d18722db7..1c1f579ea 100644 --- a/backend/src/db/schemas/users.ts +++ b/backend/src/db/schemas/users.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const UsersSchema = z.object({ diff --git a/backend/src/db/schemas/webhooks.ts b/backend/src/db/schemas/webhooks.ts index 1648b7041..60f031fff 100644 --- a/backend/src/db/schemas/webhooks.ts +++ b/backend/src/db/schemas/webhooks.ts @@ -11,7 +11,7 @@ import { TImmutableDBKeys } from "./models"; export const WebhooksSchema = z.object({ id: z.string().uuid(), - secretPath: z.string().default('/'), + secretPath: z.string().default("/"), url: z.string().nullable().optional(), lastStatus: z.string().nullable().optional(), lastRunErrorMessage: z.string().nullable().optional(), @@ -27,7 +27,7 @@ export const WebhooksSchema = z.object({ urlCipherText: z.string().nullable().optional(), urlIV: z.string().nullable().optional(), urlTag: z.string().nullable().optional(), - type: z.string().default('general').nullable().optional(), + type: z.string().default("general").nullable().optional(), encryptedPassKey: zodBuffer.nullable().optional(), encryptedUrl: zodBuffer }); diff --git a/backend/src/db/schemas/workflow-integrations.ts b/backend/src/db/schemas/workflow-integrations.ts index 060b6ac2f..ae1ae9a25 100644 --- a/backend/src/db/schemas/workflow-integrations.ts +++ b/backend/src/db/schemas/workflow-integrations.ts @@ -5,8 +5,6 @@ import { z } from "zod"; - - import { TImmutableDBKeys } from "./models"; export const WorkflowIntegrationsSchema = z.object({ diff --git a/backend/src/ee/routes/v1/ssh-certificate-authority-router.ts b/backend/src/ee/routes/v1/ssh-certificate-authority-router.ts index da9c2bd6a..783cb9b72 100644 --- a/backend/src/ee/routes/v1/ssh-certificate-authority-router.ts +++ b/backend/src/ee/routes/v1/ssh-certificate-authority-router.ts @@ -4,12 +4,12 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { normalizeSshPrivateKey } from "@app/ee/services/ssh/ssh-certificate-authority-fns"; import { sanitizedSshCa } from "@app/ee/services/ssh/ssh-certificate-authority-schema"; import { SshCaKeySource, SshCaStatus } from "@app/ee/services/ssh/ssh-certificate-authority-types"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { sanitizedSshCertificateTemplate } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-schema"; import { SSH_CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs"; import { readLimit, writeLimit } from "@app/server/config/rateLimiter"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; -import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types"; export const registerSshCaRouter = async (server: FastifyZodProvider) => { server.route({ @@ -26,8 +26,8 @@ export const registerSshCaRouter = async (server: FastifyZodProvider) => { projectId: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.CREATE.projectId), friendlyName: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.CREATE.friendlyName), keyAlgorithm: z - .nativeEnum(CertKeyAlgorithm) - .default(CertKeyAlgorithm.RSA_2048) + .nativeEnum(SshCertKeyAlgorithm) + .default(SshCertKeyAlgorithm.ED25519) .describe(SSH_CERTIFICATE_AUTHORITIES.CREATE.keyAlgorithm), publicKey: z.string().trim().optional().describe(SSH_CERTIFICATE_AUTHORITIES.CREATE.publicKey), privateKey: z diff --git a/backend/src/ee/routes/v1/ssh-certificate-router.ts b/backend/src/ee/routes/v1/ssh-certificate-router.ts index 249a96b50..eb0fc158a 100644 --- a/backend/src/ee/routes/v1/ssh-certificate-router.ts +++ b/backend/src/ee/routes/v1/ssh-certificate-router.ts @@ -2,13 +2,13 @@ import { z } from "zod"; import { EventType } from "@app/ee/services/audit-log/audit-log-types"; import { SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { SSH_CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs"; import { ms } from "@app/lib/ms"; import { writeLimit } from "@app/server/config/rateLimiter"; import { getTelemetryDistinctId } from "@app/server/lib/telemetry"; import { verifyAuth } from "@app/server/plugins/auth/verify-auth"; import { AuthMode } from "@app/services/auth/auth-type"; -import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types"; import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types"; export const registerSshCertRouter = async (server: FastifyZodProvider) => { @@ -108,8 +108,8 @@ export const registerSshCertRouter = async (server: FastifyZodProvider) => { .min(1) .describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.certificateTemplateId), keyAlgorithm: z - .nativeEnum(CertKeyAlgorithm) - .default(CertKeyAlgorithm.RSA_2048) + .nativeEnum(SshCertKeyAlgorithm) + .default(SshCertKeyAlgorithm.ED25519) .describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.keyAlgorithm), certType: z .nativeEnum(SshCertType) @@ -133,7 +133,7 @@ export const registerSshCertRouter = async (server: FastifyZodProvider) => { privateKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.privateKey), publicKey: z.string().describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.publicKey), keyAlgorithm: z - .nativeEnum(CertKeyAlgorithm) + .nativeEnum(SshCertKeyAlgorithm) .describe(SSH_CERTIFICATE_AUTHORITIES.ISSUE_SSH_CREDENTIALS.keyAlgorithm) }) } diff --git a/backend/src/ee/routes/v1/ssh-host-router.ts b/backend/src/ee/routes/v1/ssh-host-router.ts index 671b29619..15ec5d417 100644 --- a/backend/src/ee/routes/v1/ssh-host-router.ts +++ b/backend/src/ee/routes/v1/ssh-host-router.ts @@ -1,5 +1,6 @@ import { z } from "zod"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { sanitizedSshHost } from "@app/ee/services/ssh-host/ssh-host-schema"; import { isValidHostname } from "@app/ee/services/ssh-host/ssh-host-validators"; import { SSH_HOSTS } from "@app/lib/api-docs"; @@ -262,4 +263,77 @@ export const registerSshHostRouter = async (server: FastifyZodProvider) => { return host; } }); + + server.route({ + // TODO: consider just using the SSH issue creds endpoint + method: "POST", + url: "/:sshHostId/issue", + config: { + rateLimit: writeLimit + }, + onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]), + schema: { + description: "Issue SSH credentials (certificate + key)", + params: z.object({ + sshHostId: z.string().describe(SSH_HOSTS.DELETE.sshHostId) + }), + response: { + 200: z.object({ + serialNumber: z.string().describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.serialNumber), + signedKey: z.string().describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.signedKey), + privateKey: z.string().describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.privateKey), + publicKey: z.string().describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.publicKey), + keyAlgorithm: z.nativeEnum(SshCertKeyAlgorithm).describe(SSH_HOSTS.ISSUE_SSH_CREDENTIALS.keyAlgorithm) + }) + } + }, + handler: () => { + // const { serialNumber, signedPublicKey, privateKey, publicKey, certificateTemplate, ttl, keyId } = + // await server.services.sshCertificateAuthority.issueSshCreds({ + // actor: req.permission.type, + // actorId: req.permission.id, + // actorAuthMethod: req.permission.authMethod, + // actorOrgId: req.permission.orgId, + // ...req.body + // }); + // await server.services.auditLog.createAuditLog({ + // ...req.auditLogInfo, + // orgId: req.permission.orgId, + // event: { + // type: EventType.ISSUE_SSH_CREDS, + // metadata: { + // certificateTemplateId: certificateTemplate.id, + // keyAlgorithm: req.body.keyAlgorithm, + // certType: req.body.certType, + // principals: req.body.principals, + // ttl: String(ttl), + // keyId + // } + // } + // }); + // await server.services.telemetry.sendPostHogEvents({ + // event: PostHogEventTypes.IssueSshCreds, + // distinctId: getTelemetryDistinctId(req), + // properties: { + // certificateTemplateId: req.body.certificateTemplateId, + // principals: req.body.principals, + // ...req.auditLogInfo + // } + // }); + // return { + // serialNumber, + // signedKey: signedPublicKey, + // privateKey, + // publicKey, + // keyAlgorithm: req.body.keyAlgorithm + // }; + return { + serialNumber: "", + signedKey: "", + privateKey: "", + publicKey: "", + keyAlgorithm: SshCertKeyAlgorithm.ED25519 + }; + } + }); }; diff --git a/backend/src/ee/services/audit-log/audit-log-types.ts b/backend/src/ee/services/audit-log/audit-log-types.ts index 5e7df9444..53340e6e2 100644 --- a/backend/src/ee/services/audit-log/audit-log-types.ts +++ b/backend/src/ee/services/audit-log/audit-log-types.ts @@ -3,6 +3,7 @@ import { TUpdateProjectTemplateDTO } from "@app/ee/services/project-template/project-template-types"; import { SshCaStatus, SshCertType } from "@app/ee/services/ssh/ssh-certificate-authority-types"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { SshCertTemplateStatus } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-types"; import { SymmetricEncryption } from "@app/lib/crypto/cipher"; import { TProjectPermission } from "@app/lib/types"; @@ -1358,7 +1359,7 @@ interface IssueSshCreds { type: EventType.ISSUE_SSH_CREDS; metadata: { certificateTemplateId: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; certType: SshCertType; principals: string[]; ttl: string; diff --git a/backend/src/ee/services/ssh-certificate/ssh-certificate-types.ts b/backend/src/ee/services/ssh-certificate/ssh-certificate-types.ts new file mode 100644 index 000000000..14e2755ee --- /dev/null +++ b/backend/src/ee/services/ssh-certificate/ssh-certificate-types.ts @@ -0,0 +1,7 @@ +export enum SshCertKeyAlgorithm { + RSA_2048 = "RSA_2048", + RSA_4096 = "RSA_4096", + ECDSA_P256 = "EC_prime256v1", + ECDSA_P384 = "EC_secp384r1", + ED25519 = "ED25519" +} diff --git a/backend/src/ee/services/ssh-host/ssh-host-service.ts b/backend/src/ee/services/ssh-host/ssh-host-service.ts index 434479ced..c6f7b565b 100644 --- a/backend/src/ee/services/ssh-host/ssh-host-service.ts +++ b/backend/src/ee/services/ssh-host/ssh-host-service.ts @@ -29,6 +29,7 @@ export type TSshHostServiceFactory = ReturnType; */ export const sshHostServiceFactory = ({ + projectDAL sshHostDAL, sshHostLoginMappingDAL, permissionService @@ -70,6 +71,10 @@ export const sshHostServiceFactory = ({ }); } + // attach hosts? + + // create host ssh cas in default bound to default user ca and host ca + const host = await sshHostDAL.create( { projectId, diff --git a/backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts b/backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts index 98e219f4f..578e8b92b 100644 --- a/backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts +++ b/backend/src/ee/services/ssh/ssh-certificate-authority-fns.ts @@ -1,21 +1,29 @@ import { execFile } from "child_process"; import crypto from "crypto"; import { promises as fs } from "fs"; +import { Knex } from "knex"; import os from "os"; import path from "path"; import { promisify } from "util"; import { TSshCertificateTemplates } from "@app/db/schemas"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { BadRequestError } from "@app/lib/errors"; import { ms } from "@app/lib/ms"; import { CharacterType, characterValidator } from "@app/lib/validator/validate-string"; -import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types"; +import { KmsDataKey } from "@app/services/kms/kms-types"; import { isValidHostPattern, isValidUserPattern } from "../ssh-certificate-template/ssh-certificate-template-validators"; -import { SshCertType, TCreateSshCertDTO } from "./ssh-certificate-authority-types"; +import { + SshCaKeySource, + SshCaStatus, + SshCertType, + TCreateSshCaHelperDTO, + TCreateSshCertDTO +} from "./ssh-certificate-authority-types"; const execFileAsync = promisify(execFile); @@ -31,31 +39,35 @@ export const createSshCertSerialNumber = () => { * Return a pair of SSH CA keys based on the specified key algorithm [keyAlgorithm]. * We use this function because the key format generated by `ssh-keygen` is unique. */ -export const createSshKeyPair = async (keyAlgorithm: CertKeyAlgorithm) => { +export const createSshKeyPair = async (keyAlgorithm: SshCertKeyAlgorithm) => { const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "ssh-key-")); const privateKeyFile = path.join(tempDir, "id_key"); const publicKeyFile = `${privateKeyFile}.pub`; let keyType: string; - let keyBits: string; + let keyBits: string | null; switch (keyAlgorithm) { - case CertKeyAlgorithm.RSA_2048: + case SshCertKeyAlgorithm.RSA_2048: keyType = "rsa"; keyBits = "2048"; break; - case CertKeyAlgorithm.RSA_4096: + case SshCertKeyAlgorithm.RSA_4096: keyType = "rsa"; keyBits = "4096"; break; - case CertKeyAlgorithm.ECDSA_P256: + case SshCertKeyAlgorithm.ECDSA_P256: keyType = "ecdsa"; keyBits = "256"; break; - case CertKeyAlgorithm.ECDSA_P384: + case SshCertKeyAlgorithm.ECDSA_P384: keyType = "ecdsa"; keyBits = "384"; break; + case SshCertKeyAlgorithm.ED25519: + keyType = "ed25519"; + keyBits = null; + break; default: throw new BadRequestError({ message: "Failed to produce SSH CA key pair generation command due to unrecognized key algorithm" @@ -63,10 +75,16 @@ export const createSshKeyPair = async (keyAlgorithm: CertKeyAlgorithm) => { } try { + const args = ["-t", keyType]; + if (keyBits !== null) { + args.push("-b", keyBits); + } + args.push("-f", privateKeyFile, "-N", ""); + // Generate the SSH key pair // The "-N ''" sets an empty passphrase // The keys are created in the temporary directory - await execFileAsync("ssh-keygen", ["-t", keyType, "-b", keyBits, "-f", privateKeyFile, "-N", ""], { + await execFileAsync("ssh-keygen", args, { timeout: EXEC_TIMEOUT_MS }); @@ -322,17 +340,22 @@ const validateSshPublicKey = async (publicKey: string) => { } }; -export const getKeyAlgorithmFromFingerprintOutput = (output: string): CertKeyAlgorithm | undefined => { +export const getKeyAlgorithmFromFingerprintOutput = (output: string): SshCertKeyAlgorithm | undefined => { const parts = output.trim().split(" "); const bitsInt = parseInt(parts[0], 10); const keyTypeRaw = parts.at(-1)?.replace(/[()]/g, ""); // remove surrounding parentheses if (keyTypeRaw === "RSA") { - return bitsInt === 2048 ? CertKeyAlgorithm.RSA_2048 : CertKeyAlgorithm.RSA_4096; + return bitsInt === 2048 ? SshCertKeyAlgorithm.RSA_2048 : SshCertKeyAlgorithm.RSA_4096; } if (keyTypeRaw === "ECDSA") { - return bitsInt === 256 ? CertKeyAlgorithm.ECDSA_P256 : CertKeyAlgorithm.ECDSA_P384; + return bitsInt === 256 ? SshCertKeyAlgorithm.ECDSA_P256 : SshCertKeyAlgorithm.ECDSA_P384; + } + + if (keyTypeRaw === "ED25519") { + // TODO: test + return SshCertKeyAlgorithm.ED25519; } return undefined; @@ -473,3 +496,68 @@ export const createSshCert = async ({ await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {}); } }; + +export const createSshCaHelper = async ({ + projectId, + friendlyName, + keyAlgorithm: requestedKeyAlgorithm, + keySource, + externalPk, + externalSk, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService, + tx: outerTx +}: TCreateSshCaHelperDTO) => { + // Function to handle the actual creation logic + const processCreation = async (tx: Knex) => { + let publicKey: string; + let privateKey: string; + let keyAlgorithm: SshCertKeyAlgorithm = requestedKeyAlgorithm; + if (keySource === SshCaKeySource.INTERNAL) { + // generate SSH CA key pair internally + ({ publicKey, privateKey } = await createSshKeyPair(requestedKeyAlgorithm)); + } else { + // use external SSH CA key pair + if (!externalPk || !externalSk) { + throw new BadRequestError({ + message: "Public and private keys are required if generateSigningKey is false" + }); + } + publicKey = externalPk; + privateKey = externalSk; + keyAlgorithm = await validateExternalSshCaKeyPair(publicKey, privateKey); + } + const ca = await sshCertificateAuthorityDAL.create( + { + projectId, + friendlyName, + status: SshCaStatus.ACTIVE, + keyAlgorithm, + keySource + }, + tx + ); + const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey( + { + type: KmsDataKey.SecretManager, + projectId + }, + tx + ); + await sshCertificateAuthoritySecretDAL.create( + { + sshCaId: ca.id, + encryptedPrivateKey: secretManagerEncryptor({ plainText: Buffer.from(privateKey, "utf8") }).cipherTextBlob + }, + tx + ); + return { ...ca, publicKey }; + }; + + if (outerTx) { + return processCreation(outerTx); + } + + return sshCertificateAuthorityDAL.transaction(processCreation); +}; diff --git a/backend/src/ee/services/ssh/ssh-certificate-authority-service.ts b/backend/src/ee/services/ssh/ssh-certificate-authority-service.ts index 99d54f68a..56c6b1c76 100644 --- a/backend/src/ee/services/ssh/ssh-certificate-authority-service.ts +++ b/backend/src/ee/services/ssh/ssh-certificate-authority-service.ts @@ -7,14 +7,15 @@ import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-cer import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal"; import { TSshCertificateBodyDALFactory } from "@app/ee/services/ssh-certificate/ssh-certificate-body-dal"; import { TSshCertificateDALFactory } from "@app/ee/services/ssh-certificate/ssh-certificate-dal"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-dal"; import { BadRequestError, NotFoundError } from "@app/lib/errors"; -import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { KmsDataKey } from "@app/services/kms/kms-types"; import { SshCertTemplateStatus } from "../ssh-certificate-template/ssh-certificate-template-types"; import { + createSshCaHelper, createSshCert, createSshKeyPair, getSshPublicKey, @@ -89,52 +90,16 @@ export const sshCertificateAuthorityServiceFactory = ({ ProjectPermissionSub.SshCertificateAuthorities ); - const newCa = await sshCertificateAuthorityDAL.transaction(async (tx) => { - let publicKey: string; - let privateKey: string; - let keyAlgorithm: CertKeyAlgorithm = requestedKeyAlgorithm; - - if (keySource === SshCaKeySource.INTERNAL) { - // generate SSH CA key pair internally - ({ publicKey, privateKey } = await createSshKeyPair(requestedKeyAlgorithm)); - } else { - // use external SSH CA key pair - if (!externalPk || !externalSk) { - throw new BadRequestError({ - message: "Public and private keys are required if generateSigningKey is false" - }); - } - publicKey = externalPk; - privateKey = externalSk; - - keyAlgorithm = await validateExternalSshCaKeyPair(publicKey, privateKey); - } - - const ca = await sshCertificateAuthorityDAL.create( - { - projectId, - friendlyName, - status: SshCaStatus.ACTIVE, - keyAlgorithm, - keySource - }, - tx - ); - - const { encryptor: secretManagerEncryptor } = await kmsService.createCipherPairWithDataKey({ - type: KmsDataKey.SecretManager, - projectId - }); - - await sshCertificateAuthoritySecretDAL.create( - { - sshCaId: ca.id, - encryptedPrivateKey: secretManagerEncryptor({ plainText: Buffer.from(privateKey, "utf8") }).cipherTextBlob - }, - tx - ); - - return { ...ca, publicKey }; + const newCa = await createSshCaHelper({ + projectId, + friendlyName, + keyAlgorithm: requestedKeyAlgorithm, + keySource, + externalPk, + externalSk, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService }); return newCa; diff --git a/backend/src/ee/services/ssh/ssh-certificate-authority-types.ts b/backend/src/ee/services/ssh/ssh-certificate-authority-types.ts index d2dcb3807..36a29a714 100644 --- a/backend/src/ee/services/ssh/ssh-certificate-authority-types.ts +++ b/backend/src/ee/services/ssh/ssh-certificate-authority-types.ts @@ -1,6 +1,11 @@ +import { Knex } from "knex"; + import { TSshCertificateTemplates } from "@app/db/schemas"; +import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal"; +import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { TProjectPermission } from "@app/lib/types"; -import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; export enum SshCaStatus { ACTIVE = "active", @@ -19,12 +24,25 @@ export enum SshCertType { export type TCreateSshCaDTO = { friendlyName: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; publicKey?: string; privateKey?: string; keySource: SshCaKeySource; } & TProjectPermission; +export type TCreateSshCaHelperDTO = { + projectId: string; + friendlyName: string; + keyAlgorithm: SshCertKeyAlgorithm; + keySource: SshCaKeySource; + externalPk?: string; + externalSk?: string; + sshCertificateAuthorityDAL: Pick; + sshCertificateAuthoritySecretDAL: Pick; + kmsService: Pick; + tx?: Knex; +}; + export type TGetSshCaDTO = { caId: string; } & Omit; @@ -45,7 +63,7 @@ export type TDeleteSshCaDTO = { export type TIssueSshCredsDTO = { certificateTemplateId: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; certType: SshCertType; principals: string[]; ttl?: string; diff --git a/backend/src/lib/api-docs/constants.ts b/backend/src/lib/api-docs/constants.ts index 1b35b7ab1..dcb498539 100644 --- a/backend/src/lib/api-docs/constants.ts +++ b/backend/src/lib/api-docs/constants.ts @@ -1342,6 +1342,13 @@ export const SSH_HOSTS = { }, DELETE: { sshHostId: "The ID of the SSH host to delete." + }, + ISSUE_SSH_CREDENTIALS: { + keyAlgorithm: "The type of public key algorithm and size, in bits, of the key pair for the SSH host.", + serialNumber: "The serial number of the issued SSH certificate.", + signedKey: "The SSH certificate or signed SSH public key.", + privateKey: "The private key corresponding to the issued SSH certificate.", + publicKey: "The public key of the issued SSH certificate." } }; diff --git a/backend/src/server/routes/index.ts b/backend/src/server/routes/index.ts index 850081b27..cb6e28afa 100644 --- a/backend/src/server/routes/index.ts +++ b/backend/src/server/routes/index.ts @@ -184,6 +184,7 @@ import { pkiCollectionServiceFactory } from "@app/services/pki-collection/pki-co import { projectDALFactory } from "@app/services/project/project-dal"; import { projectQueueFactory } from "@app/services/project/project-queue"; import { projectServiceFactory } from "@app/services/project/project-service"; +import { projectSshConfigDALFactory } from "@app/services/project/project-ssh-config-dal"; import { projectBotDALFactory } from "@app/services/project-bot/project-bot-dal"; import { projectBotServiceFactory } from "@app/services/project-bot/project-bot-service"; import { projectEnvDALFactory } from "@app/services/project-env/project-env-dal"; @@ -292,6 +293,7 @@ export const registerRoutes = async ( const apiKeyDAL = apiKeyDALFactory(db); const projectDAL = projectDALFactory(db); + const projectSshConfigDAL = projectSshConfigDALFactory(db); const projectMembershipDAL = projectMembershipDALFactory(db); const projectUserAdditionalPrivilegeDAL = projectUserAdditionalPrivilegeDALFactory(db); const projectUserMembershipRoleDAL = projectUserMembershipRoleDALFactory(db); @@ -943,6 +945,7 @@ export const registerRoutes = async ( const projectService = projectServiceFactory({ permissionService, projectDAL, + projectSshConfigDAL, secretDAL, secretV2BridgeDAL, queueService, @@ -964,6 +967,7 @@ export const registerRoutes = async ( pkiAlertDAL, pkiCollectionDAL, sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, sshCertificateDAL, sshCertificateTemplateDAL, sshHostDAL, diff --git a/backend/src/services/project/project-fns.ts b/backend/src/services/project/project-fns.ts index 92d0dfc39..08652e348 100644 --- a/backend/src/services/project/project-fns.ts +++ b/backend/src/services/project/project-fns.ts @@ -1,12 +1,15 @@ import crypto from "crypto"; import { ProjectVersion, TProjects } from "@app/db/schemas"; +import { createSshCaHelper } from "@app/ee/services/ssh/ssh-certificate-authority-fns"; +import { SshCaKeySource } from "@app/ee/services/ssh/ssh-certificate-authority-types"; +import { SshCertKeyAlgorithm } from "@app/ee/services/ssh-certificate/ssh-certificate-types"; import { decryptAsymmetric, encryptAsymmetric } from "@app/lib/crypto"; import { NotFoundError } from "@app/lib/errors"; import { TKmsServiceFactory } from "@app/services/kms/kms-service"; import { TProjectDALFactory } from "@app/services/project/project-dal"; -import { AddUserToWsDTO } from "./project-types"; +import { AddUserToWsDTO, TBootstrapSshProjectDTO } from "./project-types"; export const assignWorkspaceKeysToMembers = ({ members, decryptKey, userPrivateKey }: AddUserToWsDTO) => { const plaintextProjectKey = decryptAsymmetric({ @@ -102,3 +105,48 @@ export const getProjectKmsCertificateKeyId = async ({ return keyId; }; + +/** + * Bootstraps an SSH project. + * - Creates a user and host SSH CA + * - Creates a project SSH config with the user and host SSH CA as defaults + */ +export const bootstrapSshProject = async ({ + projectId, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService, + projectSshConfigDAL, + tx +}: TBootstrapSshProjectDTO) => { + const userSshCa = await createSshCaHelper({ + projectId, + friendlyName: "User CA", + keyAlgorithm: SshCertKeyAlgorithm.ED25519, + keySource: SshCaKeySource.INTERNAL, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService, + tx + }); + + const hostSshCa = await createSshCaHelper({ + projectId, + friendlyName: "Host CA", + keyAlgorithm: SshCertKeyAlgorithm.ED25519, + keySource: SshCaKeySource.INTERNAL, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService, + tx + }); + + await projectSshConfigDAL.create( + { + projectId, + defaultHostSshCaId: hostSshCa.id, + defaultUserSshCaId: userSshCa.id + }, + tx + ); +}; diff --git a/backend/src/services/project/project-service.ts b/backend/src/services/project/project-service.ts index 0e39554f8..c6dac7f5f 100644 --- a/backend/src/services/project/project-service.ts +++ b/backend/src/services/project/project-service.ts @@ -20,6 +20,7 @@ import { import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service"; import { InfisicalProjectTemplate } from "@app/ee/services/project-template/project-template-types"; import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal"; +import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal"; import { TSshCertificateDALFactory } from "@app/ee/services/ssh-certificate/ssh-certificate-dal"; import { TSshCertificateTemplateDALFactory } from "@app/ee/services/ssh-certificate-template/ssh-certificate-template-dal"; import { TSshHostDALFactory } from "@app/ee/services/ssh-host/ssh-host-dal"; @@ -60,8 +61,9 @@ import { TProjectSlackConfigDALFactory } from "../slack/project-slack-config-dal import { TSlackIntegrationDALFactory } from "../slack/slack-integration-dal"; import { TUserDALFactory } from "../user/user-dal"; import { TProjectDALFactory } from "./project-dal"; -import { assignWorkspaceKeysToMembers, createProjectKey } from "./project-fns"; +import { assignWorkspaceKeysToMembers, bootstrapSshProject, createProjectKey } from "./project-fns"; import { TProjectQueueFactory } from "./project-queue"; +import { TProjectSshConfigDALFactory } from "./project-ssh-config-dal"; import { TCreateProjectDTO, TDeleteProjectDTO, @@ -95,8 +97,8 @@ export const DEFAULT_PROJECT_ENVS = [ ]; type TProjectServiceFactoryDep = { - // TODO: Pick projectDAL: TProjectDALFactory; + projectSshConfigDAL: Pick; projectQueue: TProjectQueueFactory; userDAL: TUserDALFactory; projectBotService: Pick; @@ -118,7 +120,8 @@ type TProjectServiceFactoryDep = { certificateTemplateDAL: Pick; pkiAlertDAL: Pick; pkiCollectionDAL: Pick; - sshCertificateAuthorityDAL: Pick; + sshCertificateAuthorityDAL: Pick; + sshCertificateAuthoritySecretDAL: Pick; sshCertificateDAL: Pick; sshCertificateTemplateDAL: Pick; sshHostDAL: Pick; @@ -139,6 +142,7 @@ type TProjectServiceFactoryDep = { | "getKmsById" | "getProjectSecretManagerKmsKeyId" | "deleteInternalKms" + | "createCipherPairWithDataKey" >; projectTemplateService: TProjectTemplateServiceFactory; }; @@ -147,6 +151,7 @@ export type TProjectServiceFactory = ReturnType; export const projectServiceFactory = ({ projectDAL, + projectSshConfigDAL, secretDAL, secretV2BridgeDAL, projectQueue, @@ -172,6 +177,7 @@ export const projectServiceFactory = ({ pkiCollectionDAL, pkiAlertDAL, sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, sshCertificateDAL, sshCertificateTemplateDAL, sshHostDAL, @@ -261,6 +267,17 @@ export const projectServiceFactory = ({ tx ); + if (type === ProjectType.SSH) { + await bootstrapSshProject({ + projectId: project.id, + sshCertificateAuthorityDAL, + sshCertificateAuthoritySecretDAL, + kmsService, + projectSshConfigDAL, + tx + }); + } + // set ghost user as admin of project const projectMembership = await projectMembershipDAL.create( { diff --git a/backend/src/services/project/project-ssh-config-dal.ts b/backend/src/services/project/project-ssh-config-dal.ts new file mode 100644 index 000000000..5085bd438 --- /dev/null +++ b/backend/src/services/project/project-ssh-config-dal.ts @@ -0,0 +1,11 @@ +import { TDbClient } from "@app/db"; +import { TableName } from "@app/db/schemas"; +import { ormify } from "@app/lib/knex"; + +export type TProjectSshConfigDALFactory = ReturnType; + +export const projectSshConfigDALFactory = (db: TDbClient) => { + const projectSshConfigOrm = ormify(db, TableName.ProjectSshConfig); + + return projectSshConfigOrm; +}; diff --git a/backend/src/services/project/project-types.ts b/backend/src/services/project/project-types.ts index b9dee98bc..906189be2 100644 --- a/backend/src/services/project/project-types.ts +++ b/backend/src/services/project/project-types.ts @@ -1,7 +1,11 @@ import { Knex } from "knex"; import { ProjectType, TProjectKeys } from "@app/db/schemas"; +import { TSshCertificateAuthorityDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-dal"; +import { TSshCertificateAuthoritySecretDALFactory } from "@app/ee/services/ssh/ssh-certificate-authority-secret-dal"; import { TProjectPermission } from "@app/lib/types"; +import { TKmsServiceFactory } from "@app/services/kms/kms-service"; +import { TProjectSshConfigDALFactory } from "@app/services/project/project-ssh-config-dal"; import { ActorAuthMethod, ActorType } from "../auth/auth-type"; @@ -159,3 +163,12 @@ export type TUpdateProjectSlackConfig = { isSecretRequestNotificationEnabled: boolean; secretRequestChannels: string; } & TProjectPermission; + +export type TBootstrapSshProjectDTO = { + projectId: string; + sshCertificateAuthorityDAL: Pick; + sshCertificateAuthoritySecretDAL: Pick; + projectSshConfigDAL: Pick; + kmsService: Pick; + tx?: Knex; +}; diff --git a/frontend/src/hooks/api/sshCa/constants.tsx b/frontend/src/hooks/api/sshCa/constants.tsx index 50b478952..05380a239 100644 --- a/frontend/src/hooks/api/sshCa/constants.tsx +++ b/frontend/src/hooks/api/sshCa/constants.tsx @@ -17,3 +17,42 @@ export enum SshCaKeySource { INTERNAL = "internal", EXTERNAL = "external" } + +export enum SshCertKeyAlgorithm { + RSA_2048 = "RSA_2048", + RSA_4096 = "RSA_4096", + ECDSA_P256 = "EC_prime256v1", + ECDSA_P384 = "EC_secp384r1", + ED25519 = "ED25519" +} + +export const sshCertKeyAlgorithmToNameMap: { [K in SshCertKeyAlgorithm]: string } = { + [SshCertKeyAlgorithm.RSA_2048]: "RSA 2048", + [SshCertKeyAlgorithm.RSA_4096]: "RSA 4096", + [SshCertKeyAlgorithm.ECDSA_P256]: "ECDSA P256", + [SshCertKeyAlgorithm.ECDSA_P384]: "ECDSA P384", + [SshCertKeyAlgorithm.ED25519]: "ED25519" +}; + +export const sshCertKeyAlgorithms = [ + { + label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.RSA_2048], + value: SshCertKeyAlgorithm.RSA_2048 + }, + { + label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.RSA_4096], + value: SshCertKeyAlgorithm.RSA_4096 + }, + { + label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ECDSA_P256], + value: SshCertKeyAlgorithm.ECDSA_P256 + }, + { + label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ECDSA_P384], + value: SshCertKeyAlgorithm.ECDSA_P384 + }, + { + label: sshCertKeyAlgorithmToNameMap[SshCertKeyAlgorithm.ED25519], + value: SshCertKeyAlgorithm.ED25519 + } +]; diff --git a/frontend/src/hooks/api/sshCa/types.ts b/frontend/src/hooks/api/sshCa/types.ts index 390d697d1..f14533290 100644 --- a/frontend/src/hooks/api/sshCa/types.ts +++ b/frontend/src/hooks/api/sshCa/types.ts @@ -1,5 +1,4 @@ -import { CertKeyAlgorithm } from "../certificates/enums"; -import { SshCaKeySource, SshCaStatus, SshCertType } from "./constants"; +import { SshCaKeySource, SshCaStatus, SshCertKeyAlgorithm, SshCertType } from "./constants"; export type TSshCertificate = { id: string; @@ -18,7 +17,7 @@ export type TSshCertificateAuthority = { projectId: string; status: SshCaStatus; friendlyName: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; keySource: SshCaKeySource; createdAt: string; updatedAt: string; @@ -30,13 +29,13 @@ export type TCreateSshCaDTO = projectId: string; friendlyName?: string; keySource: SshCaKeySource.INTERNAL; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; } | { projectId: string; friendlyName?: string; keySource: SshCaKeySource.EXTERNAL; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; publicKey: string; privateKey: string; }; @@ -69,7 +68,7 @@ export type TSignSshKeyResponse = { export type TIssueSshCredsDTO = { projectId: string; certificateTemplateId: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; certType: SshCertType; principals: string[]; ttl?: string; @@ -81,5 +80,5 @@ export type TIssueSshCredsResponse = { signedKey: string; privateKey: string; publicKey: string; - keyAlgorithm: CertKeyAlgorithm; + keyAlgorithm: SshCertKeyAlgorithm; }; diff --git a/frontend/src/pages/ssh/OverviewPage/components/SshCaModal.tsx b/frontend/src/pages/ssh/OverviewPage/components/SshCaModal.tsx index ed2563cff..184ca66d4 100644 --- a/frontend/src/pages/ssh/OverviewPage/components/SshCaModal.tsx +++ b/frontend/src/pages/ssh/OverviewPage/components/SshCaModal.tsx @@ -17,9 +17,11 @@ import { } from "@app/components/v2"; import { useWorkspace } from "@app/context"; import { useCreateSshCa, useGetSshCaById, useUpdateSshCa } from "@app/hooks/api"; -import { certKeyAlgorithms } from "@app/hooks/api/certificates/constants"; -import { CertKeyAlgorithm } from "@app/hooks/api/certificates/enums"; -import { SshCaKeySource } from "@app/hooks/api/sshCa/constants"; +import { + SshCaKeySource, + SshCertKeyAlgorithm, + sshCertKeyAlgorithms +} from "@app/hooks/api/sshCa/constants"; import { ProjectType } from "@app/hooks/api/workspace/types"; import { UsePopUpState } from "@app/hooks/usePopUp"; @@ -40,10 +42,11 @@ const schema = z publicKey: z.string().optional(), privateKey: z.string().optional(), keyAlgorithm: z.enum([ - CertKeyAlgorithm.RSA_2048, - CertKeyAlgorithm.RSA_4096, - CertKeyAlgorithm.ECDSA_P256, - CertKeyAlgorithm.ECDSA_P384 + SshCertKeyAlgorithm.RSA_2048, + SshCertKeyAlgorithm.RSA_4096, + SshCertKeyAlgorithm.ECDSA_P256, + SshCertKeyAlgorithm.ECDSA_P384, + SshCertKeyAlgorithm.ED25519 ]) }) .required(); @@ -69,7 +72,7 @@ export const SshCaModal = ({ popUp, handlePopUpToggle }: Props) => { resolver: zodResolver(schema), defaultValues: { friendlyName: "", - keyAlgorithm: CertKeyAlgorithm.RSA_2048, + keyAlgorithm: SshCertKeyAlgorithm.ED25519, keySource: SshCaKeySource.INTERNAL, publicKey: "", privateKey: "" @@ -89,7 +92,7 @@ export const SshCaModal = ({ popUp, handlePopUpToggle }: Props) => { } else { reset({ friendlyName: "", - keyAlgorithm: CertKeyAlgorithm.RSA_2048, + keyAlgorithm: SshCertKeyAlgorithm.ED25519, keySource: SshCaKeySource.INTERNAL, publicKey: "", privateKey: "" @@ -210,7 +213,7 @@ export const SshCaModal = ({ popUp, handlePopUpToggle }: Props) => { ( { className="w-full" isDisabled={Boolean(ca)} > - {certKeyAlgorithms.map(({ label, value }) => ( + {sshCertKeyAlgorithms.map(({ label, value }) => ( {label} diff --git a/frontend/src/pages/ssh/SshCaByIDPage/components/SshCaDetailsSection.tsx b/frontend/src/pages/ssh/SshCaByIDPage/components/SshCaDetailsSection.tsx index 9151ebec5..b2768dfe9 100644 --- a/frontend/src/pages/ssh/SshCaByIDPage/components/SshCaDetailsSection.tsx +++ b/frontend/src/pages/ssh/SshCaByIDPage/components/SshCaDetailsSection.tsx @@ -8,7 +8,7 @@ import { ProjectPermissionActions, ProjectPermissionSub } from "@app/context"; import { useTimedReset } from "@app/hooks"; import { useGetSshCaById } from "@app/hooks/api"; import { caStatusToNameMap } from "@app/hooks/api/ca/constants"; -import { certKeyAlgorithmToNameMap } from "@app/hooks/api/certificates/constants"; +import { sshCertKeyAlgorithmToNameMap } from "@app/hooks/api/sshCa/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; type Props = { @@ -93,7 +93,9 @@ export const SshCaDetailsSection = ({ caId, handlePopUpOpen }: Props) => {

Key Algorithm

-

{certKeyAlgorithmToNameMap[ca.keyAlgorithm]}

+

+ {sshCertKeyAlgorithmToNameMap[ca.keyAlgorithm]} +

Public Key

diff --git a/frontend/src/pages/ssh/SshCaByIDPage/components/SshCertificateModal.tsx b/frontend/src/pages/ssh/SshCaByIDPage/components/SshCertificateModal.tsx index b50e01acb..5c4673931 100644 --- a/frontend/src/pages/ssh/SshCaByIDPage/components/SshCertificateModal.tsx +++ b/frontend/src/pages/ssh/SshCaByIDPage/components/SshCertificateModal.tsx @@ -22,9 +22,11 @@ import { useListWorkspaceSshCertificateTemplates, useSignSshKey } from "@app/hooks/api"; -import { certKeyAlgorithms } from "@app/hooks/api/certificates/constants"; -import { CertKeyAlgorithm } from "@app/hooks/api/certificates/enums"; -import { SshCertType } from "@app/hooks/api/sshCa/constants"; +import { + SshCertKeyAlgorithm, + sshCertKeyAlgorithms, + SshCertType +} from "@app/hooks/api/sshCa/constants"; import { UsePopUpState } from "@app/hooks/usePopUp"; import { SshCertificateContent } from "./SshCertificateContent"; @@ -33,10 +35,11 @@ const schema = z.object({ templateId: z.string(), publicKey: z.string().optional(), keyAlgorithm: z.enum([ - CertKeyAlgorithm.RSA_2048, - CertKeyAlgorithm.RSA_4096, - CertKeyAlgorithm.ECDSA_P256, - CertKeyAlgorithm.ECDSA_P384 + SshCertKeyAlgorithm.RSA_2048, + SshCertKeyAlgorithm.RSA_4096, + SshCertKeyAlgorithm.ECDSA_P256, + SshCertKeyAlgorithm.ECDSA_P384, + SshCertKeyAlgorithm.ED25519 ]), certType: z.nativeEnum(SshCertType), principals: z.string(), @@ -95,7 +98,7 @@ export const SshCertificateModal = ({ popUp, handlePopUpToggle }: Props) => { } = useForm({ resolver: zodResolver(schema), defaultValues: { - keyAlgorithm: CertKeyAlgorithm.RSA_2048, + keyAlgorithm: SshCertKeyAlgorithm.ED25519, certType: SshCertType.USER } }); @@ -282,7 +285,7 @@ export const SshCertificateModal = ({ popUp, handlePopUpToggle }: Props) => { ( { onValueChange={(e) => onChange(e)} className="w-full" > - {certKeyAlgorithms.map(({ label, value }) => ( + {sshCertKeyAlgorithms.map(({ label, value }) => ( {label}