addressed reviews

2026-10-19 14:33:52 +00:00 · 2025-10-02 18:46:14 -04:00
parent 1678fba06e
commit e77c024af5
37 changed files with 1011 additions and 856 deletions
@@ -1,43 +0,0 @@
-import { Knex } from "knex";
-
-import { TDbClient } from "@app/db";
-import { TableName, TPamAccounts } from "@app/db/schemas";
-import { buildFindFilter, ormify, prependTableNameToFindFilter, selectAllTableCols } from "@app/lib/knex";
-
-export type TPamAccountDALFactory = ReturnType<typeof pamAccountDALFactory>;
-
-type PamAccountFindFilter = Parameters<typeof buildFindFilter<TPamAccounts>>[0];
-
-export const pamAccountDALFactory = (db: TDbClient) => {
-  const orm = ormify(db, TableName.PamAccount);
-
-  const findWithResourceDetails = async (filter: PamAccountFindFilter, tx?: Knex) => {
-    const query = (tx || db.replicaNode())(TableName.PamAccount)
-      .leftJoin(TableName.PamResource, `${TableName.PamAccount}.resourceId`, `${TableName.PamResource}.id`)
-      .select(selectAllTableCols(TableName.PamAccount))
-      .select(
-        // resource
-        db.ref("name").withSchema(TableName.PamResource).as("resourceName"),
-        db.ref("resourceType").withSchema(TableName.PamResource)
-      );
-
-    if (filter) {
-      /* eslint-disable @typescript-eslint/no-misused-promises */
-      void query.where(buildFindFilter(prependTableNameToFindFilter(TableName.PamAccount, filter)));
-    }
-
-    const accounts = await query;
-
-    return accounts.map(({ resourceId, resourceName, resourceType, ...account }) => ({
-      ...account,
-      resourceId,
-      resource: {
-        id: resourceId,
-        name: resourceName,
-        resourceType
-      }
-    }));
-  };
-
-  return { ...orm, findWithResourceDetails };
-};
@@ -2,7 +2,7 @@ import { TPamResources } from "@app/db/schemas";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";

-import { TPamAccountCredentials, TPamResource, TPamResourceConnectionDetails } from "./pam-resource-types";
+import { TPamResource, TPamResourceConnectionDetails } from "./pam-resource-types";
 import { getPostgresResourceListItem } from "./postgres/postgres-resource-fns";

 export const listResourceOptions = () => {
@@ -11,17 +11,17 @@ export const listResourceOptions = () => {

 // Resource
 export const encryptResourceConnectionDetails = async ({
-  orgId,
+  projectId,
  connectionDetails,
  kmsService
 }: {
-  orgId: string;
+  projectId: string;
  connectionDetails: TPamResourceConnectionDetails;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 }) => {
  const { encryptor } = await kmsService.createCipherPairWithDataKey({
-    type: KmsDataKey.Organization,
-    orgId
+    type: KmsDataKey.SecretManager,
+    projectId
  });

  const { cipherTextBlob: encryptedConnectionDetailsBlob } = encryptor({
@@ -32,17 +32,17 @@ export const encryptResourceConnectionDetails = async ({
 };

 export const decryptResourceConnectionDetails = async ({
-  orgId,
+  projectId,
  encryptedConnectionDetails,
  kmsService
 }: {
-  orgId: string;
+  projectId: string;
  encryptedConnectionDetails: Buffer;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
 }) => {
  const { decryptor } = await kmsService.createCipherPairWithDataKey({
-    type: KmsDataKey.Organization,
-    orgId
+    type: KmsDataKey.SecretManager,
+    projectId
  });

  const decryptedPlainTextBlob = decryptor({
@@ -54,73 +54,15 @@ export const decryptResourceConnectionDetails = async ({

 export const decryptResource = async (
  resource: TPamResources,
-  orgId: string,
+  projectId: string,
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
 ) => {
  return {
    ...resource,
    connectionDetails: await decryptResourceConnectionDetails({
      encryptedConnectionDetails: resource.encryptedConnectionDetails,
-      orgId,
+      projectId,
      kmsService
    })
  } as TPamResource;
 };
-
-// Account
-export const encryptAccountCredentials = async ({
-  orgId,
-  credentials,
-  kmsService
-}: {
-  orgId: string;
-  credentials: TPamAccountCredentials;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-}) => {
-  const { encryptor } = await kmsService.createCipherPairWithDataKey({
-    type: KmsDataKey.Organization,
-    orgId
-  });
-
-  const { cipherTextBlob: encryptedCredentialsBlob } = encryptor({
-    plainText: Buffer.from(JSON.stringify(credentials))
-  });
-
-  return encryptedCredentialsBlob;
-};
-
-export const decryptAccountCredentials = async ({
-  orgId,
-  encryptedCredentials,
-  kmsService
-}: {
-  orgId: string;
-  encryptedCredentials: Buffer;
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-}) => {
-  const { decryptor } = await kmsService.createCipherPairWithDataKey({
-    type: KmsDataKey.Organization,
-    orgId
-  });
-
-  const decryptedPlainTextBlob = decryptor({
-    cipherTextBlob: encryptedCredentials
-  });
-
-  return JSON.parse(decryptedPlainTextBlob.toString()) as TPamAccountCredentials;
-};
-
-export const decryptAccount = async <T extends { encryptedCredentials: Buffer }>(
-  account: T,
-  orgId: string,
-  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">
-): Promise<T & { credentials: TPamAccountCredentials }> => {
-  return {
-    ...account,
-    credentials: await decryptAccountCredentials({
-      encryptedCredentials: account.encryptedCredentials,
-      orgId,
-      kmsService
-    })
-  } as T & { credentials: TPamAccountCredentials };
-};
@@ -34,12 +34,13 @@ export const BasePamAccountSchemaWithResource = BasePamAccountSchema.extend({
 });

 export const BaseCreatePamAccountSchema = z.object({
+  resourceId: z.string().uuid(),
  folderId: z.string().uuid().optional(),
  name: slugSchema({ field: "name" }),
-  description: z.string().max(512).optional()
+  description: z.string().max(512).nullable().optional()
 });

 export const BaseUpdatePamAccountSchema = z.object({
  name: slugSchema({ field: "name" }).optional(),
-  description: z.string().max(512).optional()
+  description: z.string().max(512).nullable().optional()
 });
@@ -1,54 +1,23 @@
-import { ForbiddenError, subject } from "@casl/ability";
+import { ForbiddenError } from "@casl/ability";

-import { ActionProjectType, TPamAccounts, TPamResources } from "@app/db/schemas";
+import { ActionProjectType, TPamResources } from "@app/db/schemas";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service-types";
-import {
-  ProjectPermissionActions,
-  ProjectPermissionPamAccountActions,
-  ProjectPermissionSub
-} from "@app/ee/services/permission/project-permission";
-import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
+import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
+import { DatabaseErrorCode } from "@app/lib/error-codes";
+import { BadRequestError, DatabaseError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
-import { ActorType } from "@app/services/auth/auth-type";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-import { TUserDALFactory } from "@app/services/user/user-dal";

 import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
 import { TLicenseServiceFactory } from "../license/license-service";
-import { TPamFolderDALFactory } from "../pam-folder/pam-folder-dal";
-import { getFullPamFolderPath } from "../pam-folder/pam-folder-fns";
-import { TPamSessionDALFactory } from "../pam-session/pam-session-dal";
-import { PamSessionStatus } from "../pam-session/pam-session-enums";
-import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
-import { TPamAccountDALFactory } from "./pam-account-dal";
 import { TPamResourceDALFactory } from "./pam-resource-dal";
 import { PamResource } from "./pam-resource-enums";
 import { PAM_RESOURCE_FACTORY_MAP } from "./pam-resource-factory";
-import {
-  decryptAccount,
-  decryptAccountCredentials,
-  decryptResource,
-  decryptResourceConnectionDetails,
-  encryptAccountCredentials,
-  encryptResourceConnectionDetails,
-  listResourceOptions
-} from "./pam-resource-fns";
-import {
-  TAccessAccountDTO,
-  TCreateAccountDTO,
-  TCreateResourceDTO,
-  TPamAccountCredentials,
-  TUpdateAccountDTO,
-  TUpdateResourceDTO
-} from "./pam-resource-types";
+import { decryptResource, encryptResourceConnectionDetails, listResourceOptions } from "./pam-resource-fns";
+import { TCreateResourceDTO, TUpdateResourceDTO } from "./pam-resource-types";

 type TPamResourceServiceFactoryDep = {
  pamResourceDAL: TPamResourceDALFactory;
-  pamSessionDAL: TPamSessionDALFactory;
-  pamAccountDAL: TPamAccountDALFactory;
-  pamFolderDAL: TPamFolderDALFactory;
-  projectDAL: TProjectDALFactory;
  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission" | "getOrgPermission">;
  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
  kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
@@ -56,18 +25,12 @@ type TPamResourceServiceFactoryDep = {
    TGatewayV2ServiceFactory,
    "getPAMConnectionDetails" | "getPlatformConnectionDetailsByGatewayId"
  >;
-  userDAL: TUserDALFactory;
 };

 export type TPamResourceServiceFactory = ReturnType<typeof pamResourceServiceFactory>;

 export const pamResourceServiceFactory = ({
  pamResourceDAL,
-  pamSessionDAL,
-  pamAccountDAL,
-  pamFolderDAL,
-  projectDAL,
-  userDAL,
  permissionService,
  licenseService,
  kmsService,
@@ -94,7 +57,7 @@ export const pamResourceServiceFactory = ({
      });
    }

-    return decryptResource(resource, actor.orgId, kmsService);
+    return decryptResource(resource, resource.projectId, kmsService);
  };

  const create = async (
@@ -129,7 +92,7 @@ export const pamResourceServiceFactory = ({

    const encryptedConnectionDetails = await encryptResourceConnectionDetails({
      connectionDetails: validatedConnectionDetails,
-      orgId: actor.orgId,
+      projectId,
      kmsService
    });

@@ -141,7 +104,7 @@ export const pamResourceServiceFactory = ({
      projectId
    });

-    return decryptResource(resource, actor.orgId, kmsService);
+    return decryptResource(resource, projectId, kmsService);
  };

  const updateById = async ({ connectionDetails, resourceId, name }: TUpdateResourceDTO, actor: OrgServiceActor) => {
@@ -182,7 +145,7 @@ export const pamResourceServiceFactory = ({
      const validatedConnectionDetails = await factory.validateConnection();
      const encryptedConnectionDetails = await encryptResourceConnectionDetails({
        connectionDetails: validatedConnectionDetails,
-        orgId: actor.orgId,
+        projectId: resource.projectId,
        kmsService
      });
      updateDoc.encryptedConnectionDetails = encryptedConnectionDetails;
@@ -190,12 +153,12 @@ export const pamResourceServiceFactory = ({

    // If nothing was updated, return the fetched resource
    if (Object.keys(updateDoc).length === 0) {
-      return decryptResource(resource, actor.orgId, kmsService);
+      return decryptResource(resource, resource.projectId, kmsService);
    }

    const updatedResource = await pamResourceDAL.updateById(resourceId, updateDoc);

-    return decryptResource(updatedResource, actor.orgId, kmsService);
+    return decryptResource(updatedResource, resource.projectId, kmsService);
  };

  const deleteById = async (id: string, actor: OrgServiceActor) => {
@@ -213,9 +176,20 @@ export const pamResourceServiceFactory = ({

    ForbiddenError.from(permission).throwUnlessCan(ProjectPermissionActions.Delete, ProjectPermissionSub.PamResources);

-    const deletedResource = await pamResourceDAL.deleteById(id);
-
-    return decryptResource(deletedResource, actor.orgId, kmsService);
+    try {
+      const deletedResource = await pamResourceDAL.deleteById(id);
+      return await decryptResource(deletedResource, resource.projectId, kmsService);
+    } catch (err) {
+      if (
+        err instanceof DatabaseError &&
+        (err.error as { code: string })?.code === DatabaseErrorCode.ForeignKeyViolation
+      ) {
+        throw new BadRequestError({
+          message: "Failed to delete resource because it is attached to active PAM accounts"
+        });
+      }
+      throw err;
+    }
  };

  const list = async (projectId: string, actor: OrgServiceActor) => {
@@ -233,440 +207,7 @@ export const pamResourceServiceFactory = ({
    const resources = await pamResourceDAL.find({ projectId });

    return {
-      resources: await Promise.all(resources.map((resource) => decryptResource(resource, actor.orgId, kmsService)))
-    };
-  };
-
-  // Accounts
-  const createAccount = async (
-    { credentials, resourceId, name, description, folderId }: TCreateAccountDTO,
-    actor: OrgServiceActor
-  ) => {
-    const orgLicensePlan = await licenseService.getPlan(actor.orgId);
-    if (!orgLicensePlan.pam) {
-      throw new BadRequestError({
-        message: "PAM operation failed due to organization plan restrictions."
-      });
-    }
-
-    const resource = await pamResourceDAL.findById(resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${resourceId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId: resource.projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const accountPath = await getFullPamFolderPath({
-      pamFolderDAL,
-      folderId,
-      projectId: resource.projectId
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPamAccountActions.Create,
-      subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
-        accountName: name,
-        accountPath
-      })
-    );
-
-    const connectionDetails = await decryptResourceConnectionDetails({
-      orgId: actor.orgId,
-      encryptedConnectionDetails: resource.encryptedConnectionDetails,
-      kmsService
-    });
-
-    const factory = PAM_RESOURCE_FACTORY_MAP[resource.resourceType as PamResource](
-      resource.resourceType as PamResource,
-      connectionDetails,
-      resource.gatewayId,
-      gatewayV2Service
-    );
-    const validatedCredentials = await factory.validateAccountCredentials(credentials);
-
-    const encryptedCredentials = await encryptAccountCredentials({
-      credentials: validatedCredentials,
-      orgId: actor.orgId,
-      kmsService
-    });
-
-    const account = await pamAccountDAL.create({
-      projectId: resource.projectId,
-      resourceId: resource.id,
-      encryptedCredentials,
-      name,
-      description,
-      folderId
-    });
-
-    return {
-      ...(await decryptAccount(account, actor.orgId, kmsService)),
-      resource: { id: resource.id, name: resource.name, resourceType: resource.resourceType }
-    };
-  };
-
-  const updateAccountById = async (
-    { accountId, credentials, description, name }: TUpdateAccountDTO,
-    actor: OrgServiceActor
-  ) => {
-    const orgLicensePlan = await licenseService.getPlan(actor.orgId);
-    if (!orgLicensePlan.pam) {
-      throw new BadRequestError({
-        message: "PAM operation failed due to organization plan restrictions."
-      });
-    }
-
-    const account = await pamAccountDAL.findById(accountId);
-    if (!account) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
-
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId: account.projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const accountPath = await getFullPamFolderPath({
-      pamFolderDAL,
-      folderId: account.folderId,
-      projectId: account.projectId
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPamAccountActions.Edit,
-      subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
-        accountName: account.name,
-        accountPath
-      })
-    );
-
-    const updateDoc: Partial<TPamAccounts> = {};
-
-    if (name !== undefined) {
-      updateDoc.name = name;
-    }
-
-    if (description !== undefined) {
-      updateDoc.description = description;
-    }
-
-    if (credentials !== undefined) {
-      const connectionDetails = await decryptResourceConnectionDetails({
-        orgId: actor.orgId,
-        encryptedConnectionDetails: resource.encryptedConnectionDetails,
-        kmsService
-      });
-
-      const factory = PAM_RESOURCE_FACTORY_MAP[resource.resourceType as PamResource](
-        resource.resourceType as PamResource,
-        connectionDetails,
-        resource.gatewayId,
-        gatewayV2Service
-      );
-
-      // Logic to prevent overwriting unedited censored values
-      const finalCredentials = { ...credentials };
-      if (credentials.password === "******") {
-        const decryptedCredentials = await decryptAccountCredentials({
-          encryptedCredentials: account.encryptedCredentials,
-          orgId: actor.orgId,
-          kmsService
-        });
-
-        finalCredentials.password = decryptedCredentials.password;
-      }
-
-      const validatedCredentials = await factory.validateAccountCredentials(finalCredentials);
-      const encryptedCredentials = await encryptAccountCredentials({
-        credentials: validatedCredentials,
-        orgId: actor.orgId,
-        kmsService
-      });
-      updateDoc.encryptedCredentials = encryptedCredentials;
-    }
-
-    // If nothing was updated, return the fetched account
-    if (Object.keys(updateDoc).length === 0) {
-      return decryptAccount(account, actor.orgId, kmsService);
-    }
-
-    const updatedAccount = await pamAccountDAL.updateById(accountId, updateDoc);
-
-    return {
-      ...(await decryptAccount(updatedAccount, actor.orgId, kmsService)),
-      resource: { id: resource.id, name: resource.name, resourceType: resource.resourceType }
-    };
-  };
-
-  const deleteAccountById = async (id: string, actor: OrgServiceActor) => {
-    const account = await pamAccountDAL.findById(id);
-    if (!account) throw new NotFoundError({ message: `Account with ID '${id}' not found` });
-
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId: account.projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const accountPath = await getFullPamFolderPath({
-      pamFolderDAL,
-      folderId: account.folderId,
-      projectId: account.projectId
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPamAccountActions.Delete,
-      subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
-        accountName: account.name,
-        accountPath
-      })
-    );
-
-    const deletedAccount = await pamAccountDAL.deleteById(id);
-
-    return {
-      ...(await decryptAccount(deletedAccount, actor.orgId, kmsService)),
-      resource: { id: resource.id, name: resource.name, resourceType: resource.resourceType }
-    };
-  };
-
-  const listAccounts = async (projectId: string, actor: OrgServiceActor) => {
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const accountsWithResourceDetails = await pamAccountDAL.findWithResourceDetails({ projectId });
-
-    const canReadFolders = permission.can(ProjectPermissionActions.Read, ProjectPermissionSub.PamFolders);
-
-    const folders = canReadFolders ? await pamFolderDAL.find({ projectId }) : [];
-
-    const decryptedAndPermittedAccounts: Array<
-      TPamAccounts & {
-        resource: Pick<TPamResources, "id" | "name" | "resourceType">;
-        credentials: TPamAccountCredentials;
-      }
-    > = [];
-
-    for await (const account of accountsWithResourceDetails) {
-      const accountPath = await getFullPamFolderPath({
-        pamFolderDAL,
-        folderId: account.folderId,
-        projectId: account.projectId
-      });
-
-      // Check permission for each individual account
-      if (
-        permission.can(
-          ProjectPermissionPamAccountActions.Read,
-          subject(ProjectPermissionSub.PamAccounts, {
-            resourceName: account.resource.name,
-            accountName: account.name,
-            accountPath
-          })
-        )
-      ) {
-        // Decrypt the account only if the user has permission to read it
-        const decryptedAccount = await decryptAccount(account, actor.orgId, kmsService);
-        decryptedAndPermittedAccounts.push({
-          ...decryptedAccount,
-          resource: {
-            id: account.resource.id,
-            name: account.resource.name,
-            resourceType: account.resource.resourceType
-          }
-        });
-      }
-    }
-
-    return {
-      accounts: decryptedAndPermittedAccounts,
-      folders
-    };
-  };
-
-  const accessAccount = async (
-    { accountId, actorEmail, actorIp, actorName, actorUserAgent, duration }: TAccessAccountDTO,
-    actor: OrgServiceActor
-  ) => {
-    const orgLicensePlan = await licenseService.getPlan(actor.orgId);
-    if (!orgLicensePlan.pam) {
-      throw new BadRequestError({
-        message: "PAM operation failed due to organization plan restrictions."
-      });
-    }
-
-    const account = await pamAccountDAL.findById(accountId);
-    if (!account) throw new NotFoundError({ message: `Account with ID '${accountId}' not found` });
-
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor: actor.type,
-      actorAuthMethod: actor.authMethod,
-      actorId: actor.id,
-      actorOrgId: actor.orgId,
-      projectId: account.projectId,
-      actionProjectType: ActionProjectType.PAM
-    });
-
-    const accountPath = await getFullPamFolderPath({
-      pamFolderDAL,
-      folderId: account.folderId,
-      projectId: account.projectId
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPamAccountActions.Access,
-      subject(ProjectPermissionSub.PamAccounts, {
-        resourceName: resource.name,
-        accountName: account.name,
-        accountPath
-      })
-    );
-
-    const session = await pamSessionDAL.create({
-      accountName: account.name,
-      actorEmail,
-      actorIp,
-      actorName,
-      actorUserAgent,
-      projectId: account.projectId,
-      resourceName: resource.name,
-      resourceType: resource.resourceType,
-      status: PamSessionStatus.Starting,
-      accountId: account.id,
-      userId: actor.id,
-      expiresAt: duration ? new Date(Date.now() + duration) : null
-    });
-
-    const { connectionDetails, gatewayId, resourceType } = await decryptResource(resource, actor.orgId, kmsService);
-
-    const user = await userDAL.findById(actor.id);
-
-    const gatewayConnectionDetails = await gatewayV2Service.getPAMConnectionDetails({
-      gatewayId,
-      duration,
-      sessionId: session.id,
-      resourceType: resource.resourceType as PamResource,
-      host: connectionDetails.host,
-      port: connectionDetails.port,
-      actorMetadata: {
-        id: actor.id,
-        type: actor.type,
-        name: user.email ?? ""
-      }
-    });
-
-    if (!gatewayConnectionDetails) {
-      throw new NotFoundError({ message: `Gateway connection details for gateway '${gatewayId}' not found.` });
-    }
-
-    return {
-      sessionId: session.id,
-      resourceType,
-      relayClientCertificate: gatewayConnectionDetails.relay.clientCertificate,
-      relayClientPrivateKey: gatewayConnectionDetails.relay.clientPrivateKey,
-      relayServerCertificateChain: gatewayConnectionDetails.relay.serverCertificateChain,
-      gatewayClientCertificate: gatewayConnectionDetails.gateway.clientCertificate,
-      gatewayClientPrivateKey: gatewayConnectionDetails.gateway.clientPrivateKey,
-      gatewayServerCertificateChain: gatewayConnectionDetails.gateway.serverCertificateChain,
-      relayHost: gatewayConnectionDetails.relayHost,
-      projectId: account.projectId
-    };
-  };
-
-  const getSessionCredentials = async (sessionId: string, actor: OrgServiceActor) => {
-    const orgLicensePlan = await licenseService.getPlan(actor.orgId);
-    if (!orgLicensePlan.pam) {
-      throw new BadRequestError({
-        message: "PAM operation failed due to organization plan restrictions."
-      });
-    }
-
-    // To be hit by gateways only
-    if (actor.type !== ActorType.IDENTITY) {
-      throw new ForbiddenRequestError({ message: "Only gateways can perform this action" });
-    }
-
-    const session = await pamSessionDAL.findById(sessionId);
-    if (!session) throw new NotFoundError({ message: `Session with ID '${sessionId}' not found` });
-
-    const project = await projectDAL.findById(session.projectId);
-    if (!project) throw new NotFoundError({ message: `Project with ID '${session.projectId}' not found` });
-
-    const { permission } = await permissionService.getOrgPermission(
-      actor.type,
-      actor.id,
-      project.orgId,
-      actor.authMethod,
-      actor.orgId
-    );
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      OrgPermissionGatewayActions.CreateGateways,
-      OrgPermissionSubjects.Gateway
-    );
-
-    if (!session.accountId) throw new NotFoundError({ message: "Session is missing accountId column" });
-
-    // Verify that the session has not ended
-    if (session.endedAt || (session.expiresAt && session.expiresAt < new Date())) {
-      throw new BadRequestError({ message: "Session has ended or expired" });
-    }
-
-    // Verify that the session has not already had credentials fetched
-    if (session.status !== PamSessionStatus.Starting) {
-      throw new BadRequestError({ message: "Session has already been started" });
-    }
-
-    const account = await pamAccountDAL.findById(session.accountId);
-    if (!account) throw new NotFoundError({ message: `Account with ID '${session.accountId}' not found` });
-
-    const resource = await pamResourceDAL.findById(account.resourceId);
-    if (!resource) throw new NotFoundError({ message: `Resource with ID '${account.resourceId}' not found` });
-
-    const decryptedAccount = await decryptAccount(account, actor.orgId, kmsService);
-
-    const decryptedResource = await decryptResource(resource, actor.orgId, kmsService);
-
-    // Mark session as started
-    await pamSessionDAL.updateById(sessionId, {
-      status: PamSessionStatus.Active,
-      startedAt: new Date()
-    });
-
-    return {
-      credentials: {
-        ...decryptedResource.connectionDetails,
-        ...decryptedAccount.credentials
-      },
-      projectId: project.id
+      resources: await Promise.all(resources.map((resource) => decryptResource(resource, projectId, kmsService)))
    };
  };

@@ -676,12 +217,6 @@ export const pamResourceServiceFactory = ({
    updateById,
    deleteById,
    list,
-    listResourceOptions,
-    createAccount,
-    updateAccountById,
-    deleteAccountById,
-    listAccounts,
-    accessAccount,
-    getSessionCredentials
+    listResourceOptions
  };
 };
@@ -25,22 +25,6 @@ export type TUpdateResourceDTO = Partial<Omit<TCreateResourceDTO, "resourceType"
  resourceId: string;
 };

-// Account DTOs
-export type TCreateAccountDTO = Pick<TPamAccount, "name" | "description" | "credentials" | "folderId" | "resourceId">;
-
-export type TUpdateAccountDTO = Partial<Omit<TCreateAccountDTO, "folderId" | "resourceId">> & {
-  accountId: string;
-};
-
-export type TAccessAccountDTO = {
-  accountId: string;
-  actorEmail: string;
-  actorIp: string;
-  actorName: string;
-  actorUserAgent: string;
-  duration?: number;
-};
-
 // Resource factory
 export type TPamResourceFactoryValidateConnection<T extends TPamResourceConnectionDetails> = () => Promise<T>;
 export type TPamResourceFactoryValidateAccountCredentials<C extends TPamAccountCredentials> = (