misc: addressed comments

backend/src/ee/routes/v1/index.ts

@@ -9,8 +9,8 @@ import { registerDynamicSecretRouter } from "./dynamic-secret-router";
 import { registerExternalKmsRouter } from "./external-kms-router";
 import { registerGroupRouter } from "./group-router";
 import { registerIdentityProjectAdditionalPrivilegeRouter } from "./identity-project-additional-privilege-router";
-import { registerKmipOperationRouter } from "./kmip-operation-router";
 import { registerKmipRouter } from "./kmip-router";
+import { registerKmipSpecRouter } from "./kmip-spec-router";
 import { registerLdapRouter } from "./ldap-router";
 import { registerLicenseRouter } from "./license-router";
 import { registerOidcRouter } from "./oidc-router";
@@ -112,6 +112,12 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   });
 
   await server.register(registerProjectTemplateRouter, { prefix: "/project-templates" });
-  await server.register(registerKmipRouter, { prefix: "/kmip" });
-  await server.register(registerKmipOperationRouter, { prefix: "/kmip-operations" });
+
+  await server.register(
+    async (kmipRouter) => {
+      await kmipRouter.register(registerKmipRouter);
+      await kmipRouter.register(registerKmipSpecRouter, { prefix: "/spec" });
+    },
+    { prefix: "/kmip" }
+  );
 };

backend/src/ee/routes/v1/kmip-spec-router.ts

@@ -8,7 +8,7 @@ import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { ActorType, AuthMode } from "@app/services/auth/auth-type";
 
-export const registerKmipOperationRouter = async (server: FastifyZodProvider) => {
+export const registerKmipSpecRouter = async (server: FastifyZodProvider) => {
   server.decorateRequest("kmipUser", null);
 
   server.addHook("onRequest", async (req) => {

backend/src/ee/services/kmip/kmip-client-certificate-dal.ts

@@ -7,7 +7,5 @@ export type TKmipClientCertificateDALFactory = ReturnType<typeof kmipClientCerti
 export const kmipClientCertificateDALFactory = (db: TDbClient) => {
   const kmipClientCertOrm = ormify(db, TableName.KmipClientCertificates);
 
-  return {
-    ...kmipClientCertOrm
-  };
+  return kmipClientCertOrm;
 };

backend/src/ee/services/kmip/kmip-org-config-dal.ts

@@ -6,7 +6,6 @@ export type TKmipOrgConfigDALFactory = ReturnType<typeof kmipOrgConfigDALFactory
 
 export const kmipOrgConfigDALFactory = (db: TDbClient) => {
   const kmipOrgConfigOrm = ormify(db, TableName.KmipOrgConfig);
-  return {
-    ...kmipOrgConfigOrm
-  };
+
+  return kmipOrgConfigOrm;
 };

backend/src/ee/services/kmip/kmip-org-server-certificate-dal.ts

@@ -7,7 +7,5 @@ export type TKmipOrgServerCertificateDALFactory = ReturnType<typeof kmipOrgServe
 export const kmipOrgServerCertificateDALFactory = (db: TDbClient) => {
   const kmipOrgServerCertificateOrm = ormify(db, TableName.KmipOrgServerCertificates);
 
-  return {
-    ...kmipOrgServerCertificateOrm
-  };
+  return kmipOrgServerCertificateOrm;
 };

backend/src/ee/services/kmip/kmip-service.ts

@@ -5,13 +5,13 @@ import ms from "ms";
 
 import { ActionProjectType } from "@app/db/schemas";
 import { BadRequestError, InternalServerError, NotFoundError } from "@app/lib/errors";
-import { isValidIp } from "@app/lib/ip";
+import { isValidHostname, isValidIp } from "@app/lib/ip";
+import { constructPemChainFromCerts } from "@app/services/certificate/certificate-fns";
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
 import {
   createSerialNumber,
   keyAlgorithmToAlgCfg
 } from "@app/services/certificate-authority/certificate-authority-fns";
-import { hostnameRegex } from "@app/services/certificate-authority/certificate-authority-validators";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
@@ -363,7 +363,7 @@ export const kmipServiceFactory = ({
       serialNumber,
       privateKey: skLeafObj.export({ format: "pem", type: "pkcs8" }) as string,
       certificate: leafCert.toString("pem"),
-      certificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
+      certificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
       projectId: kmipClient.projectId
     };
   };
@@ -553,8 +553,8 @@ export const kmipServiceFactory = ({
     });
 
     return {
-      serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
-      clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim()
+      serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
+      clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert])
     };
   };
 
@@ -587,8 +587,8 @@ export const kmipServiceFactory = ({
 
     return {
       id: kmipConfig.id,
-      serverCertificateChain: `${serverIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
-      clientCertificateChain: `${clientIntermediateCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim()
+      serverCertificateChain: constructPemChainFromCerts([serverIntermediateCaCert, rootCaCert]),
+      clientCertificateChain: constructPemChainFromCerts([clientIntermediateCaCert, rootCaCert])
     };
   };
 
@@ -665,15 +665,13 @@ export const kmipServiceFactory = ({
       .split(",")
       .map((name) => name.trim())
       .map((altName) => {
-        // check if the altName is a valid hostname
-        if (hostnameRegex.test(altName)) {
+        if (isValidHostname(altName)) {
           return {
             type: "dns",
             value: altName
           };
         }
 
-        // check if the altName is a valid IP
         if (isValidIp(altName)) {
           return {
             type: "ip",

backend/src/lib/ip/index.ts

@@ -107,6 +107,12 @@ export const isValidIp = (ip: string) => {
   return net.isIPv4(ip) || net.isIPv6(ip);
 };
 
+export const isValidHostname = (name: string) => {
+  const hostnameRegex = /^(?!:\/\/)(\*\.)?([a-zA-Z0-9-_]{1,63}\.?)+(?!:\/\/)([a-zA-Z]{2,63})$/;
+
+  return hostnameRegex.test(name);
+};
+
 export type TIp = {
   ipAddress: string;
   type: IPType;

backend/src/services/certificate/certificate-fns.ts

@@ -40,3 +40,9 @@ export const isCertChainValid = async (certificates: x509.X509Certificate[]) =>
   // chain.build() implicitly verifies the chain
   return chainItems.length === certificates.length;
 };
+
+export const constructPemChainFromCerts = (certificates: x509.X509Certificate[]) =>
+  certificates
+    .map((cert) => cert.toString("pem"))
+    .join("\n")
+    .trim();

backend/src/services/kms/kms-key-dal.ts

@@ -104,7 +104,6 @@ export const kmskeyDALFactory = (db: TDbClient) => {
         .join(TableName.InternalKms, `${TableName.KmsKey}.id`, `${TableName.InternalKms}.kmsKeyId`)
         .select(selectAllTableCols(TableName.KmsKey))
         .select(
-          db.ref("encryptedKey").withSchema(TableName.InternalKms).as("internalKmsEncryptedKey"),
           db.ref("encryptionAlgorithm").withSchema(TableName.InternalKms).as("internalKmsEncryptionAlgorithm"),
           db.ref("version").withSchema(TableName.InternalKms).as("internalKmsVersion")
         );
@@ -112,7 +111,6 @@ export const kmskeyDALFactory = (db: TDbClient) => {
       return result.map((entry) => ({
         ...KmsKeysSchema.parse(entry),
         isActive: !entry.isDisabled,
-        encryptedKey: entry.internalKmsEncryptedKey,
         algorithm: entry.internalKmsEncryptionAlgorithm,
         version: entry.internalKmsVersion
       }));