feat: in-platform migration tooling for Vault policies + scaffolding

2026-10-17 23:00:14 +00:00 · 2025-10-14 03:43:24 +08:00
parent fc6e364c60
commit c7d9df419e
21 changed files with 1525 additions and 62 deletions
@@ -174,6 +174,7 @@ import { cmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { convertorServiceFactory } from "@app/services/convertor/convertor-service";
 import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-dal";
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
+import { externalMigrationConfigDALFactory } from "@app/services/external-migration/external-migration-config-dal";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
 import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
@@ -533,6 +534,8 @@ export const registerRoutes = async (
  const membershipRoleDAL = membershipRoleDALFactory(db);
  const roleDAL = roleDALFactory(db);

+  const externalMigrationConfigDAL = externalMigrationConfigDALFactory(db);
+
  const eventBusService = eventBusFactory(server.redis);
  const sseService = sseServiceFactory(eventBusService, server.redis);

@@ -1873,13 +1876,6 @@ export const registerRoutes = async (
    notificationService
  });

-  const migrationService = externalMigrationServiceFactory({
-    externalMigrationQueue,
-    userDAL,
-    permissionService,
-    gatewayService
-  });
-
  const externalGroupOrgRoleMappingService = externalGroupOrgRoleMappingServiceFactory({
    permissionService,
    licenseService,
@@ -2196,6 +2192,16 @@ export const registerRoutes = async (
    kmsService
  });

+  const migrationService = externalMigrationServiceFactory({
+    externalMigrationQueue,
+    userDAL,
+    permissionService,
+    gatewayService,
+    kmsService,
+    appConnectionService,
+    externalMigrationConfigDAL
+  });
+
  // setup the communication with license key server
  await licenseService.init();

@@ -113,4 +113,151 @@ export const registerExternalMigrationRouter = async (server: FastifyZodProvider
      return { enabled };
    }
  });
+
+  server.route({
+    method: "GET",
+    url: "/config",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      querystring: z.object({
+        platform: z.nativeEnum(ExternalMigrationProviders)
+      }),
+      response: {
+        200: z.object({
+          config: z
+            .object({
+              id: z.string(),
+              orgId: z.string(),
+              platform: z.string(),
+              connectionId: z.string().nullable().optional(),
+              createdAt: z.date(),
+              updatedAt: z.date()
+            })
+            .nullable()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const config = await server.services.migration.getExternalMigrationConfig({
+        platform: req.query.platform,
+        actor: req.permission
+      });
+
+      return { config };
+    }
+  });
+
+  server.route({
+    method: "PUT",
+    url: "/config",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      body: z.object({
+        connectionId: z.string().nullable(),
+        platform: z.nativeEnum(ExternalMigrationProviders)
+      }),
+      response: {
+        200: z.object({
+          config: z.object({
+            id: z.string(),
+            orgId: z.string(),
+            platform: z.string(),
+            connectionId: z.string().nullable().optional(),
+            createdAt: z.date(),
+            updatedAt: z.date()
+          })
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const config = await server.services.migration.configureExternalMigration({
+        ...req.body,
+        actor: req.permission
+      });
+      return { config };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/vault/namespaces",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      response: {
+        200: z.object({
+          namespaces: z.array(z.object({ id: z.string(), name: z.string() }))
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const namespaces = await server.services.migration.getVaultNamespaces({
+        actor: req.permission
+      });
+
+      return { namespaces };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/vault/policies",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      querystring: z.object({
+        namespace: z.string().optional()
+      }),
+      response: {
+        200: z.object({
+          policies: z.array(z.object({ name: z.string(), rules: z.string() }))
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const policies = await server.services.migration.getVaultPolicies({
+        actor: req.permission,
+        namespace: req.query.namespace
+      });
+
+      return { policies };
+    }
+  });
+
+  server.route({
+    method: "GET",
+    url: "/vault/mounts",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      querystring: z.object({
+        namespace: z.string().optional()
+      }),
+      response: {
+        200: z.object({
+          mounts: z.array(z.object({ path: z.string(), type: z.string(), version: z.string().nullish() }))
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const mounts = await server.services.migration.getVaultMounts({
+        actor: req.permission,
+        namespace: req.query.namespace
+      });
+
+      return { mounts };
+    }
+  });
 };