feat: review feedback, and more changes in cli

backend/src/db/migrations/20250212191958_create-gateway.ts

@@ -52,6 +52,7 @@ export async function up(knex: Knex): Promise<void> {
       t.string("keyAlgorithm").notNullable();
       t.datetime("issuedAt").notNullable();
       t.datetime("expiration").notNullable();
+      t.datetime("heartbeat");
 
       t.binary("relayAddress").notNullable();
 

backend/src/db/schemas/gateways.ts

@@ -16,6 +16,7 @@ export const GatewaysSchema = z.object({
   keyAlgorithm: z.string(),
   issuedAt: z.date(),
   expiration: z.date(),
+  heartbeat: z.date().nullable().optional(),
   relayAddress: zodBuffer,
   orgGatewayRootCaId: z.string().uuid(),
   identityId: z.string().uuid(),

backend/src/ee/routes/v1/gateway-router.ts

@@ -13,7 +13,8 @@ const SanitizedGatewaySchema = GatewaysSchema.pick({
   createdAt: true,
   updatedAt: true,
   issuedAt: true,
-  serialNumber: true
+  serialNumber: true,
+  heartbeat: true
 });
 
 export const registerGatewayRouter = async (server: FastifyZodProvider) => {
@@ -76,6 +77,28 @@ export const registerGatewayRouter = async (server: FastifyZodProvider) => {
     }
   });
 
+  server.route({
+    method: "POST",
+    url: "/heartbeat",
+    config: {
+      rateLimit: writeLimit
+    },
+    schema: {
+      response: {
+        200: z.object({
+          message: z.string()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      await server.services.gateway.heartbeat({
+        orgPermission: req.permission
+      });
+      return { message: "Successfully registered heartbeat" };
+    }
+  });
+
   server.route({
     method: "GET",
     url: "/",

backend/src/ee/services/gateway/gateway-service.ts

@@ -8,6 +8,7 @@ import { ActionProjectType } from "@app/db/schemas";
 import { KeyStorePrefixes, PgSqlLock, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { pingGatewayAndVerify } from "@app/lib/gateway";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { getTurnCredentials } from "@app/lib/turn/credentials";
 import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
@@ -20,7 +21,7 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import { TLicenseServiceFactory } from "../license/license-service";
-import { OrgGatewayPermissionActions, OrgPermissionSubjects } from "../permission/org-permission";
+import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service";
 import { ProjectPermissionActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TGatewayDALFactory } from "./gateway-dal";
@@ -28,6 +29,7 @@ import {
   TExchangeAllocatedRelayAddressDTO,
   TGetGatewayByIdDTO,
   TGetProjectGatewayByIdDTO,
+  THeartBeatDTO,
   TListGatewaysDTO,
   TUpdateGatewayByIdDTO
 } from "./gateway-types";
@@ -77,7 +79,7 @@ export const gatewayServiceFactory = ({
       actorAuthMethod,
       orgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgGatewayPermissionActions.Create, OrgPermissionSubjects.Gateway);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionGatewayActions.Create, OrgPermissionSubjects.Gateway);
   };
 
   const getGatewayRelayDetails = async (actorId: string, actorOrgId: string, actorAuthMethod: ActorAuthMethod) => {
@@ -412,6 +414,61 @@ export const gatewayServiceFactory = ({
     };
   };
 
+  const heartbeat = async ({ orgPermission }: THeartBeatDTO) => {
+    await $validateOrgAccessToGateway(orgPermission.orgId, orgPermission.id, orgPermission.authMethod);
+    const orgGatewayConfig = await orgGatewayConfigDAL.findOne({ orgId: orgPermission.orgId });
+    if (!orgGatewayConfig) throw new NotFoundError({ message: `Identity with ID ${orgPermission.id} not found.` });
+
+    const [gateway] = await gatewayDAL.find({ identityId: orgPermission.id, orgGatewayRootCaId: orgGatewayConfig.id });
+    if (!gateway) throw new NotFoundError({ message: `Gateway with ID ${orgPermission.id} not found.` });
+
+    const { decryptor: orgKmsDecryptor } = await kmsService.createCipherPairWithDataKey({
+      type: KmsDataKey.Organization,
+      orgId: orgGatewayConfig.orgId
+    });
+
+    const rootCaCert = new x509.X509Certificate(
+      orgKmsDecryptor({
+        cipherTextBlob: orgGatewayConfig.encryptedRootCaCertificate
+      })
+    );
+    const gatewayCaCert = new x509.X509Certificate(
+      orgKmsDecryptor({
+        cipherTextBlob: orgGatewayConfig.encryptedGatewayCaCertificate
+      })
+    );
+    const clientCert = new x509.X509Certificate(
+      orgKmsDecryptor({
+        cipherTextBlob: orgGatewayConfig.encryptedClientCertificate
+      })
+    );
+
+    const privateKey = crypto
+      .createPrivateKey({
+        key: orgKmsDecryptor({ cipherTextBlob: orgGatewayConfig.encryptedClientPrivateKey }),
+        format: "der",
+        type: "pkcs8"
+      })
+      .export({ type: "pkcs8", format: "pem" });
+
+    const relayAddress = orgKmsDecryptor({ cipherTextBlob: gateway.relayAddress }).toString();
+    const [relayHost, relayPort] = relayAddress.split(":");
+
+    await pingGatewayAndVerify({
+      relayHost,
+      relayPort: Number(relayPort),
+      tlsOptions: {
+        key: privateKey,
+        ca: `${gatewayCaCert.toString("pem")}\n${rootCaCert.toString("pem")}`.trim(),
+        cert: clientCert.toString("pem")
+      },
+      identityId: orgPermission.id,
+      orgId: orgPermission.orgId
+    });
+
+    await gatewayDAL.updateById(gateway.id, { heartbeat: new Date() });
+  };
+
   const listGateways = async ({ orgPermission }: TListGatewaysDTO) => {
     const { permission } = await permissionService.getOrgPermission(
       orgPermission.type,
@@ -420,7 +477,7 @@ export const gatewayServiceFactory = ({
       orgPermission.authMethod,
       orgPermission.orgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgGatewayPermissionActions.Read, OrgPermissionSubjects.Gateway);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionGatewayActions.Read, OrgPermissionSubjects.Gateway);
     const orgGatewayConfig = await orgGatewayConfigDAL.findOne({ orgId: orgPermission.orgId });
     if (!orgGatewayConfig) return [];
 
@@ -438,7 +495,7 @@ export const gatewayServiceFactory = ({
       orgPermission.authMethod,
       orgPermission.orgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgGatewayPermissionActions.Read, OrgPermissionSubjects.Gateway);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionGatewayActions.Read, OrgPermissionSubjects.Gateway);
     const orgGatewayConfig = await orgGatewayConfigDAL.findOne({ orgId: orgPermission.orgId });
     if (!orgGatewayConfig) throw new NotFoundError({ message: `Gateway with ID ${id} not found.` });
 
@@ -455,7 +512,7 @@ export const gatewayServiceFactory = ({
       orgPermission.authMethod,
       orgPermission.orgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgGatewayPermissionActions.Delete, OrgPermissionSubjects.Gateway);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionGatewayActions.Edit, OrgPermissionSubjects.Gateway);
     const orgGatewayConfig = await orgGatewayConfigDAL.findOne({ orgId: orgPermission.orgId });
     if (!orgGatewayConfig) throw new NotFoundError({ message: `Gateway with ID ${id} not found.` });
 
@@ -472,7 +529,7 @@ export const gatewayServiceFactory = ({
       orgPermission.authMethod,
       orgPermission.orgId
     );
-    ForbiddenError.from(permission).throwUnlessCan(OrgGatewayPermissionActions.Delete, OrgPermissionSubjects.Gateway);
+    ForbiddenError.from(permission).throwUnlessCan(OrgPermissionGatewayActions.Delete, OrgPermissionSubjects.Gateway);
     const orgGatewayConfig = await orgGatewayConfigDAL.findOne({ orgId: orgPermission.orgId });
     if (!orgGatewayConfig) throw new NotFoundError({ message: `Gateway with ID ${id} not found.` });
 
@@ -553,6 +610,7 @@ export const gatewayServiceFactory = ({
     updateGatewayById,
     deleteGatewayById,
     getProjectGateways,
-    fnGetGatewayClientTls
+    fnGetGatewayClientTls,
+    heartbeat
   };
 };

backend/src/ee/services/gateway/gateway-types.ts

@@ -32,3 +32,7 @@ export type TGetProjectGatewayByIdDTO = {
   projectId: string;
   projectPermission: OrgServiceActor;
 };
+
+export type THeartBeatDTO = {
+  orgPermission: OrgServiceActor;
+};

backend/src/ee/services/permission/org-permission.ts

@@ -32,7 +32,7 @@ export enum OrgPermissionAdminConsoleAction {
   AccessAllProjects = "access-all-projects"
 }
 
-export enum OrgGatewayPermissionActions {
+export enum OrgPermissionGatewayActions {
   // is there a better word for this. This mean can an identity be a gateway
   Create = "create",
   Read = "read",
@@ -82,7 +82,7 @@ export type OrgPermissionSet =
   | [OrgPermissionActions, OrgPermissionSubjects.Kms]
   | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs]
   | [OrgPermissionActions, OrgPermissionSubjects.ProjectTemplates]
-  | [OrgGatewayPermissionActions, OrgPermissionSubjects.Gateway]
+  | [OrgPermissionGatewayActions, OrgPermissionSubjects.Gateway]
   | [
       OrgPermissionAppConnectionActions,
       (
@@ -190,6 +190,12 @@ export const OrgPermissionSchema = z.discriminatedUnion("subject", [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionKmipActions).describe(
       "Describe what action an entity can take."
     )
+  }),
+  z.object({
+    subject: z.literal(OrgPermissionSubjects.Gateway).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(OrgPermissionGatewayActions).describe(
+      "Describe what action an entity can take."
+    )
   })
 ]);
 
@@ -274,10 +280,10 @@ const buildAdminPermission = () => {
   can(OrgPermissionAppConnectionActions.Delete, OrgPermissionSubjects.AppConnections);
   can(OrgPermissionAppConnectionActions.Connect, OrgPermissionSubjects.AppConnections);
 
-  can(OrgGatewayPermissionActions.Read, OrgPermissionSubjects.Gateway);
-  can(OrgGatewayPermissionActions.Create, OrgPermissionSubjects.Gateway);
-  can(OrgGatewayPermissionActions.Edit, OrgPermissionSubjects.Gateway);
-  can(OrgGatewayPermissionActions.Delete, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Read, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Create, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Edit, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Delete, OrgPermissionSubjects.Gateway);
 
   can(OrgPermissionAdminConsoleAction.AccessAllProjects, OrgPermissionSubjects.AdminConsole);
 
@@ -315,8 +321,8 @@ const buildMemberPermission = () => {
   can(OrgPermissionActions.Read, OrgPermissionSubjects.AuditLogs);
 
   can(OrgPermissionAppConnectionActions.Connect, OrgPermissionSubjects.AppConnections);
-  can(OrgGatewayPermissionActions.Read, OrgPermissionSubjects.Gateway);
-  can(OrgGatewayPermissionActions.Create, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Read, OrgPermissionSubjects.Gateway);
+  can(OrgPermissionGatewayActions.Create, OrgPermissionSubjects.Gateway);
 
   return rules;
 };

backend/src/keystore/keystore.ts

@@ -37,7 +37,7 @@ export const KeyStorePrefixes = {
   IdentityAccessTokenStatusUpdate: (identityAccessTokenId: string) =>
     `identity-access-token-status:${identityAccessTokenId}`,
   ServiceTokenStatusUpdate: (serviceTokenId: string) => `service-token-status:${serviceTokenId}`,
-  GatewayIdentityCredential: (identityId: string) => `gateway-credentails:${identityId}`
+  GatewayIdentityCredential: (identityId: string) => `gateway-credentials:${identityId}`
 };
 
 export const KeyStoreTtls = {

backend/src/lib/gateway/index.ts

@@ -36,12 +36,12 @@ type TPingGatewayAndVerifyDTO = {
   relayHost: string;
   relayPort: number;
   tlsOptions: tls.TlsOptions;
-  maxRetries: number;
+  maxRetries?: number;
   identityId: string;
   orgId: string;
 };
 
-const pingGatewayAndVerifyIdentity = async ({
+export const pingGatewayAndVerify = async ({
   relayHost,
   relayPort,
   tlsOptions = {},
@@ -236,7 +236,7 @@ export const withGatewayProxy = async (
   } = options;
 
   // First, try to ping the gateway
-  await pingGatewayAndVerifyIdentity({
+  await pingGatewayAndVerify({
     relayHost,
     relayPort,
     tlsOptions,