feat(pam): account credential rotation

backend/src/db/migrations/20251015042917_pam-account-rotation.ts

@@ -0,0 +1,43 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (
+    !(await knex.schema.hasColumn(TableName.PamAccount, "rotationEnabled")) &&
+    !(await knex.schema.hasColumn(TableName.PamAccount, "rotationIntervalSeconds")) &&
+    !(await knex.schema.hasColumn(TableName.PamAccount, "lastRotatedAt"))
+  ) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.boolean("rotationEnabled").notNullable().defaultTo(false);
+      t.integer("rotationIntervalSeconds").notNullable().defaultTo(2592000);
+      t.timestamp("lastRotatedAt").nullable();
+    });
+  }
+
+  if (!(await knex.schema.hasColumn(TableName.PamResource, "encryptedRotationAccountCredentials"))) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.binary("encryptedRotationAccountCredentials").nullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasColumn(TableName.PamResource, "encryptedRotationAccountCredentials")) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.dropColumn("encryptedRotationAccountCredentials");
+    });
+  }
+
+  if (
+    (await knex.schema.hasColumn(TableName.PamAccount, "rotationEnabled")) &&
+    (await knex.schema.hasColumn(TableName.PamAccount, "rotationIntervalSeconds")) &&
+    (await knex.schema.hasColumn(TableName.PamAccount, "lastRotatedAt"))
+  ) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.dropColumn("lastRotatedAt");
+      t.dropColumn("rotationIntervalSeconds");
+      t.dropColumn("rotationEnabled");
+    });
+  }
+}

backend/src/db/schemas/pam-accounts.ts

@@ -18,7 +18,10 @@ export const PamAccountsSchema = z.object({
   description: z.string().nullable().optional(),
   encryptedCredentials: zodBuffer,
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  rotationEnabled: z.boolean().default(false),
+  rotationIntervalSeconds: z.number().default(2592000),
+  lastRotatedAt: z.date().nullable().optional()
 });
 
 export type TPamAccounts = z.infer<typeof PamAccountsSchema>;

backend/src/db/schemas/pam-resources.ts

@@ -17,7 +17,9 @@ export const PamResourcesSchema = z.object({
   resourceType: z.string(),
   encryptedConnectionDetails: zodBuffer,
   createdAt: z.date(),
-  updatedAt: z.date()
+  updatedAt: z.date(),
+  encryptedRotationAccountDetails: zodBuffer.nullable().optional(),
+  encryptedRotationAccountCredentials: zodBuffer.nullable().optional()
 });
 
 export type TPamResources = z.infer<typeof PamResourcesSchema>;