make resource rotation account credentials write-only

backend/src/ee/services/pam-resource/pam-resource-service.ts

@@ -10,7 +10,7 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
 import { TGatewayV2ServiceFactory } from "../gateway-v2/gateway-v2-service";
 import { TLicenseServiceFactory } from "../license/license-service";
-import { encryptAccountCredentials } from "../pam-account/pam-account-fns";
+import { decryptAccountCredentials, encryptAccountCredentials } from "../pam-account/pam-account-fns";
 import { TPamResourceDALFactory } from "./pam-resource-dal";
 import { PamResource } from "./pam-resource-enums";
 import { PAM_RESOURCE_FACTORY_MAP } from "./pam-resource-factory";
@@ -192,8 +192,19 @@ export const pamResourceServiceFactory = ({
           gatewayV2Service
         );
 
-        const validatedRotationAccountCredentials =
-          await factory.validateAccountCredentials(rotationAccountCredentials);
+        // Logic to prevent overwriting unedited censored values
+        const finalCredentials = { ...rotationAccountCredentials };
+        if (resource.encryptedRotationAccountCredentials && rotationAccountCredentials.password === "******") {
+          const decryptedCredentials = await decryptAccountCredentials({
+            encryptedCredentials: resource.encryptedRotationAccountCredentials,
+            projectId: resource.projectId,
+            kmsService
+          });
+
+          finalCredentials.password = decryptedCredentials.password;
+        }
+
+        const validatedRotationAccountCredentials = await factory.validateAccountCredentials(finalCredentials);
 
         updateDoc.encryptedRotationAccountCredentials = await encryptAccountCredentials({
           credentials: validatedRotationAccountCredentials,

backend/src/ee/services/pam-resource/postgres/postgres-resource-schemas.ts

@@ -26,6 +26,15 @@ export const PostgresResourceSchema = BasePostgresResourceSchema.extend({
   rotationAccountCredentials: PostgresAccountCredentialsSchema.nullable().optional()
 });
 
+export const SanitizedPostgresResourceSchema = BasePostgresResourceSchema.extend({
+  connectionDetails: PostgresResourceConnectionDetailsSchema,
+  rotationAccountCredentials: PostgresAccountCredentialsSchema.pick({
+    username: true
+  })
+    .nullable()
+    .optional()
+});
+
 export const PostgresResourceListItemSchema = z.object({
   name: z.literal("PostgreSQL"),
   resource: z.literal(PamResource.Postgres)