Merge pull request #4685 from Infisical/ENG-3925

feat(pam): account credential rotation

backend/src/services/pam-account-rotation/pam-account-rotation-queue.ts

@@ -0,0 +1,61 @@
+import { TPamAccountServiceFactory } from "@app/ee/services/pam-account/pam-account-service";
+import { getConfig } from "@app/lib/config/env";
+import { logger } from "@app/lib/logger";
+import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+
+type TPamAccountRotationServiceFactoryDep = {
+  queueService: TQueueServiceFactory;
+  pamAccountService: Pick<TPamAccountServiceFactory, "rotateAllDueAccounts">;
+};
+
+export type TPamAccountRotationServiceFactory = ReturnType<typeof pamAccountRotationServiceFactory>;
+
+export const pamAccountRotationServiceFactory = ({
+  queueService,
+  pamAccountService
+}: TPamAccountRotationServiceFactoryDep) => {
+  const appCfg = getConfig();
+
+  const init = async () => {
+    if (appCfg.isSecondaryInstance) {
+      return;
+    }
+
+    await queueService.stopRepeatableJob(
+      QueueName.PamAccountRotation,
+      QueueJobs.PamAccountRotation,
+      { pattern: "0 * * * *", utc: true },
+      QueueName.PamAccountRotation // job id
+    );
+
+    await queueService.startPg<QueueName.PamAccountRotation>(
+      QueueJobs.PamAccountRotation,
+      async () => {
+        try {
+          logger.info(`${QueueName.PamAccountRotation}: pam account rotation task started`);
+          await pamAccountService.rotateAllDueAccounts();
+          logger.info(`${QueueName.PamAccountRotation}: pam account rotation task completed`);
+        } catch (error) {
+          logger.error(error, `${QueueName.PamAccountRotation}: pam account rotation failed`);
+          throw error;
+        }
+      },
+      {
+        batchSize: 1,
+        workerCount: 1,
+        pollingIntervalSeconds: 5 * 60
+      }
+    );
+
+    await queueService.schedulePg(
+      QueueJobs.PamAccountRotation,
+      "0 * * * *", // Schedule to run every hour
+      undefined,
+      { tz: "UTC" }
+    );
+  };
+
+  return {
+    init
+  };
+};