misc: moved prompt to tooltip

backend/package.json

@@ -131,7 +131,6 @@
     "@aws-sdk/client-elasticache": "^3.637.0",
     "@aws-sdk/client-iam": "^3.525.0",
     "@aws-sdk/client-kms": "^3.609.0",
-    "@aws-sdk/client-route-53": "^3.810.0",
     "@aws-sdk/client-secrets-manager": "^3.504.0",
     "@aws-sdk/client-sts": "^3.600.0",
     "@casl/ability": "^6.5.0",
@@ -175,7 +174,6 @@
     "@slack/oauth": "^3.0.2",
     "@slack/web-api": "^7.8.0",
     "@ucast/mongo2js": "^1.3.4",
-    "acme-client": "^5.4.0",
     "ajv": "^8.12.0",
     "argon2": "^0.31.2",
     "aws-sdk": "^2.1553.0",

backend/scripts/generate-schema-types.ts

@@ -84,11 +84,6 @@ const getZodDefaultValue = (type: unknown, value: string | number | boolean | Ob
   }
 };
 
-const bigIntegerColumns: Record<string, string[]> = {
-  "folder_commits": ["commitId"]
-};
-
-
 const main = async () => {
   const tables = (
     await db("information_schema.tables")
@@ -113,9 +108,6 @@ const main = async () => {
       const columnName = columnNames[colNum];
       const colInfo = columns[columnName];
       let ztype = getZodPrimitiveType(colInfo.type);
-      if (bigIntegerColumns[tableName]?.includes(columnName)) {
-        ztype = "z.coerce.bigint()";
-      }
       if (["zodBuffer"].includes(ztype)) {
         zodImportSet.add(ztype);
       }

backend/src/@types/fastify.d.ts

@@ -26,7 +26,6 @@ import { TLdapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-con
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { TPitServiceFactory } from "@app/ee/services/pit/pit-service";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { TProjectUserAdditionalPrivilegeServiceFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-service";
 import { TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-service";
@@ -54,12 +53,10 @@ import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
 import { TAuthTokenServiceFactory } from "@app/services/auth-token/auth-token-service";
 import { TCertificateServiceFactory } from "@app/services/certificate/certificate-service";
 import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
-import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
 import { TCertificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { TCmekServiceFactory } from "@app/services/cmek/cmek-service";
 import { TExternalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { TExternalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TGroupProjectServiceFactory } from "@app/services/group-project/group-project-service";
 import { THsmServiceFactory } from "@app/services/hsm/hsm-service";
 import { TIdentityServiceFactory } from "@app/services/identity/identity-service";
@@ -272,9 +269,6 @@ declare module "fastify" {
       microsoftTeams: TMicrosoftTeamsServiceFactory;
       assumePrivileges: TAssumePrivilegeServiceFactory;
       githubOrgSync: TGithubOrgSyncServiceFactory;
-      folderCommit: TFolderCommitServiceFactory;
-      pit: TPitServiceFactory;
-      internalCertificateAuthority: TInternalCertificateAuthorityServiceFactory;
     };
     // this is exclusive use for middlewares in which we need to inject data
     // everywhere else access using service layer

backend/src/@types/knex.d.ts

@@ -68,33 +68,12 @@ import {
   TDynamicSecrets,
   TDynamicSecretsInsert,
   TDynamicSecretsUpdate,
-  TExternalCertificateAuthorities,
-  TExternalCertificateAuthoritiesInsert,
-  TExternalCertificateAuthoritiesUpdate,
   TExternalGroupOrgRoleMappings,
   TExternalGroupOrgRoleMappingsInsert,
   TExternalGroupOrgRoleMappingsUpdate,
   TExternalKms,
   TExternalKmsInsert,
   TExternalKmsUpdate,
-  TFolderCheckpointResources,
-  TFolderCheckpointResourcesInsert,
-  TFolderCheckpointResourcesUpdate,
-  TFolderCheckpoints,
-  TFolderCheckpointsInsert,
-  TFolderCheckpointsUpdate,
-  TFolderCommitChanges,
-  TFolderCommitChangesInsert,
-  TFolderCommitChangesUpdate,
-  TFolderCommits,
-  TFolderCommitsInsert,
-  TFolderCommitsUpdate,
-  TFolderTreeCheckpointResources,
-  TFolderTreeCheckpointResourcesInsert,
-  TFolderTreeCheckpointResourcesUpdate,
-  TFolderTreeCheckpoints,
-  TFolderTreeCheckpointsInsert,
-  TFolderTreeCheckpointsUpdate,
   TGateways,
   TGatewaysInsert,
   TGatewaysUpdate,
@@ -176,9 +155,6 @@ import {
   TIntegrations,
   TIntegrationsInsert,
   TIntegrationsUpdate,
-  TInternalCertificateAuthorities,
-  TInternalCertificateAuthoritiesInsert,
-  TInternalCertificateAuthoritiesUpdate,
   TInternalKms,
   TInternalKmsInsert,
   TInternalKmsUpdate,
@@ -562,16 +538,6 @@ declare module "knex/types/tables" {
       TCertificateAuthorityCrlInsert,
       TCertificateAuthorityCrlUpdate
     >;
-    [TableName.InternalCertificateAuthority]: KnexOriginal.CompositeTableType<
-      TInternalCertificateAuthorities,
-      TInternalCertificateAuthoritiesInsert,
-      TInternalCertificateAuthoritiesUpdate
-    >;
-    [TableName.ExternalCertificateAuthority]: KnexOriginal.CompositeTableType<
-      TExternalCertificateAuthorities,
-      TExternalCertificateAuthoritiesInsert,
-      TExternalCertificateAuthoritiesUpdate
-    >;
     [TableName.Certificate]: KnexOriginal.CompositeTableType<TCertificates, TCertificatesInsert, TCertificatesUpdate>;
     [TableName.CertificateTemplate]: KnexOriginal.CompositeTableType<
       TCertificateTemplates,
@@ -1108,35 +1074,5 @@ declare module "knex/types/tables" {
       TGithubOrgSyncConfigsInsert,
       TGithubOrgSyncConfigsUpdate
     >;
-    [TableName.FolderCommit]: KnexOriginal.CompositeTableType<
-      TFolderCommits,
-      TFolderCommitsInsert,
-      TFolderCommitsUpdate
-    >;
-    [TableName.FolderCommitChanges]: KnexOriginal.CompositeTableType<
-      TFolderCommitChanges,
-      TFolderCommitChangesInsert,
-      TFolderCommitChangesUpdate
-    >;
-    [TableName.FolderCheckpoint]: KnexOriginal.CompositeTableType<
-      TFolderCheckpoints,
-      TFolderCheckpointsInsert,
-      TFolderCheckpointsUpdate
-    >;
-    [TableName.FolderCheckpointResources]: KnexOriginal.CompositeTableType<
-      TFolderCheckpointResources,
-      TFolderCheckpointResourcesInsert,
-      TFolderCheckpointResourcesUpdate
-    >;
-    [TableName.FolderTreeCheckpoint]: KnexOriginal.CompositeTableType<
-      TFolderTreeCheckpoints,
-      TFolderTreeCheckpointsInsert,
-      TFolderTreeCheckpointsUpdate
-    >;
-    [TableName.FolderTreeCheckpointResources]: KnexOriginal.CompositeTableType<
-      TFolderTreeCheckpointResources,
-      TFolderTreeCheckpointResourcesInsert,
-      TFolderTreeCheckpointResourcesUpdate
-    >;
   }
 }

backend/src/db/migrations/20250429203304_certificates-ca-relation-removal.ts

@@ -1,44 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.Certificate)) {
-    const hasProjectIdColumn = await knex.schema.hasColumn(TableName.Certificate, "projectId");
-    if (!hasProjectIdColumn) {
-      await knex.schema.alterTable(TableName.Certificate, (t) => {
-        t.string("projectId", 36).nullable();
-        t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
-      });
-
-      await knex.raw(`
-          UPDATE "${TableName.Certificate}" cert
-          SET "projectId" = ca."projectId"
-          FROM "${TableName.CertificateAuthority}" ca
-          WHERE cert."caId" = ca.id
-        `);
-
-      await knex.schema.alterTable(TableName.Certificate, (t) => {
-        t.string("projectId").notNullable().alter();
-      });
-    }
-
-    await knex.schema.alterTable(TableName.Certificate, (t) => {
-      t.uuid("caId").nullable().alter();
-      t.uuid("caCertId").nullable().alter();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasTable(TableName.Certificate)) {
-    if (await knex.schema.hasColumn(TableName.Certificate, "projectId")) {
-      await knex.schema.alterTable(TableName.Certificate, (t) => {
-        t.dropForeign("projectId");
-        t.dropColumn("projectId");
-      });
-    }
-  }
-
-  // Altering back to notNullable for caId and caCertId will fail
-}

backend/src/db/migrations/20250505194916_add-pit-revamp-tables.ts

@@ -1,166 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (!hasFolderCommitTable) {
-    await knex.schema.createTable(TableName.FolderCommit, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.bigIncrements("commitId");
-      t.jsonb("actorMetadata").notNullable();
-      t.string("actorType").notNullable();
-      t.string("message");
-      t.uuid("folderId").notNullable();
-      t.uuid("envId").notNullable();
-      t.foreign("envId").references("id").inTable(TableName.Environment).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderId");
-      t.index("envId");
-    });
-  }
-
-  const hasFolderCommitChangesTable = await knex.schema.hasTable(TableName.FolderCommitChanges);
-  if (!hasFolderCommitChangesTable) {
-    await knex.schema.createTable(TableName.FolderCommitChanges, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.string("changeType").notNullable();
-      t.boolean("isUpdate").notNullable().defaultTo(false);
-      t.uuid("secretVersionId");
-      t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE");
-      t.uuid("folderVersionId");
-      t.foreign("folderVersionId").references("id").inTable(TableName.SecretFolderVersion).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-      t.index("secretVersionId");
-      t.index("folderVersionId");
-    });
-  }
-
-  const hasFolderCheckpointTable = await knex.schema.hasTable(TableName.FolderCheckpoint);
-  if (!hasFolderCheckpointTable) {
-    await knex.schema.createTable(TableName.FolderCheckpoint, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-    });
-  }
-
-  const hasFolderCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderCheckpointResources);
-  if (!hasFolderCheckpointResourcesTable) {
-    await knex.schema.createTable(TableName.FolderCheckpointResources, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCheckpointId").notNullable();
-      t.foreign("folderCheckpointId").references("id").inTable(TableName.FolderCheckpoint).onDelete("CASCADE");
-      t.uuid("secretVersionId");
-      t.foreign("secretVersionId").references("id").inTable(TableName.SecretVersionV2).onDelete("CASCADE");
-      t.uuid("folderVersionId");
-      t.foreign("folderVersionId").references("id").inTable(TableName.SecretFolderVersion).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCheckpointId");
-      t.index("secretVersionId");
-      t.index("folderVersionId");
-    });
-  }
-
-  const hasFolderTreeCheckpointTable = await knex.schema.hasTable(TableName.FolderTreeCheckpoint);
-  if (!hasFolderTreeCheckpointTable) {
-    await knex.schema.createTable(TableName.FolderTreeCheckpoint, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderCommitId");
-    });
-  }
-
-  const hasFolderTreeCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderTreeCheckpointResources);
-  if (!hasFolderTreeCheckpointResourcesTable) {
-    await knex.schema.createTable(TableName.FolderTreeCheckpointResources, (t) => {
-      t.uuid("id").primary().defaultTo(knex.fn.uuid());
-      t.uuid("folderTreeCheckpointId").notNullable();
-      t.foreign("folderTreeCheckpointId").references("id").inTable(TableName.FolderTreeCheckpoint).onDelete("CASCADE");
-      t.uuid("folderId").notNullable();
-      t.uuid("folderCommitId").notNullable();
-      t.foreign("folderCommitId").references("id").inTable(TableName.FolderCommit).onDelete("CASCADE");
-      t.timestamps(true, true, true);
-
-      t.index("folderTreeCheckpointId");
-      t.index("folderId");
-      t.index("folderCommitId");
-    });
-  }
-
-  if (!hasFolderCommitTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCommit);
-  }
-
-  if (!hasFolderCommitChangesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCommitChanges);
-  }
-
-  if (!hasFolderCheckpointTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCheckpoint);
-  }
-
-  if (!hasFolderCheckpointResourcesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
-  }
-
-  if (!hasFolderTreeCheckpointTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
-  }
-
-  if (!hasFolderTreeCheckpointResourcesTable) {
-    await createOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasFolderCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderCheckpointResources);
-  const hasFolderTreeCheckpointResourcesTable = await knex.schema.hasTable(TableName.FolderTreeCheckpointResources);
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  const hasFolderCommitChangesTable = await knex.schema.hasTable(TableName.FolderCommitChanges);
-  const hasFolderTreeCheckpointTable = await knex.schema.hasTable(TableName.FolderTreeCheckpoint);
-  const hasFolderCheckpointTable = await knex.schema.hasTable(TableName.FolderCheckpoint);
-
-  if (hasFolderTreeCheckpointResourcesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpointResources);
-    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpointResources);
-  }
-
-  if (hasFolderCheckpointResourcesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCheckpointResources);
-    await knex.schema.dropTableIfExists(TableName.FolderCheckpointResources);
-  }
-
-  if (hasFolderTreeCheckpointTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderTreeCheckpoint);
-    await knex.schema.dropTableIfExists(TableName.FolderTreeCheckpoint);
-  }
-
-  if (hasFolderCheckpointTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCheckpoint);
-    await knex.schema.dropTableIfExists(TableName.FolderCheckpoint);
-  }
-
-  if (hasFolderCommitChangesTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCommitChanges);
-    await knex.schema.dropTableIfExists(TableName.FolderCommitChanges);
-  }
-
-  if (hasFolderCommitTable) {
-    await dropOnUpdateTrigger(knex, TableName.FolderCommit);
-    await knex.schema.dropTableIfExists(TableName.FolderCommit);
-  }
-}

backend/src/db/migrations/20250507185010_pit-projects-commits-initialization.ts

@@ -1,29 +0,0 @@
-import { Knex } from "knex";
-
-import { inMemoryKeyStore } from "@app/keystore/memory";
-
-import { ProjectType, TableName } from "../schemas";
-import { getMigrationEnvConfig } from "./utils/env-config";
-import { getMigrationPITServices } from "./utils/services";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (hasFolderCommitTable) {
-    const keyStore = inMemoryKeyStore();
-    const envConfig = getMigrationEnvConfig();
-    const { folderCommitService } = await getMigrationPITServices({ db: knex, keyStore, envConfig });
-    const projects = await knex(TableName.Project).where({ version: 3, type: ProjectType.SecretManager }).select("id");
-    for (const project of projects) {
-      // eslint-disable-next-line no-await-in-loop
-      await folderCommitService.initializeProject(project.id, knex);
-    }
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasFolderCommitTable = await knex.schema.hasTable(TableName.FolderCommit);
-  if (hasFolderCommitTable) {
-    // delete all existing entries
-    await knex(TableName.FolderCommit).del();
-  }
-}

backend/src/db/migrations/20250521110635_add-external-ca-pki.ts

@@ -1,205 +0,0 @@
-import slugify from "@sindresorhus/slugify";
-import { Knex } from "knex";
-
-import { alphaNumericNanoId } from "@app/lib/nanoid";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  const hasCATable = await knex.schema.hasTable(TableName.CertificateAuthority);
-  const hasExternalCATable = await knex.schema.hasTable(TableName.ExternalCertificateAuthority);
-  const hasInternalCATable = await knex.schema.hasTable(TableName.InternalCertificateAuthority);
-
-  if (hasCATable && !hasInternalCATable) {
-    await knex.schema.createTableLike(TableName.InternalCertificateAuthority, TableName.CertificateAuthority, (t) => {
-      t.uuid("caId").nullable();
-    });
-
-    // @ts-expect-error intentional: migration
-    await knex(TableName.InternalCertificateAuthority).insert(knex(TableName.CertificateAuthority).select("*"));
-    await knex(TableName.InternalCertificateAuthority).update("caId", knex.ref("id"));
-
-    await knex.schema.alterTable(TableName.InternalCertificateAuthority, (t) => {
-      t.dropColumn("projectId");
-      t.dropColumn("requireTemplateForIssuance");
-      t.dropColumn("createdAt");
-      t.dropColumn("updatedAt");
-      t.dropColumn("status");
-      t.uuid("parentCaId")
-        .nullable()
-        .references("id")
-        .inTable(TableName.CertificateAuthority)
-        .onDelete("CASCADE")
-        .alter();
-      t.uuid("activeCaCertId").nullable().references("id").inTable(TableName.CertificateAuthorityCert).alter();
-      t.uuid("caId").notNullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE").alter();
-    });
-
-    await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-      t.renameColumn("requireTemplateForIssuance", "enableDirectIssuance");
-      t.string("name").nullable();
-    });
-
-    // prefill name for existing internal CAs and flip enableDirectIssuance
-    const cas = await knex(TableName.CertificateAuthority).select("id", "friendlyName", "enableDirectIssuance");
-    await Promise.all(
-      cas.map((ca) => {
-        const slugifiedName = ca.friendlyName
-          ? slugify(`${ca.friendlyName.slice(0, 16)}-${alphaNumericNanoId(8)}`)
-          : slugify(alphaNumericNanoId(12));
-
-        return knex(TableName.CertificateAuthority)
-          .where({ id: ca.id })
-          .update({ name: slugifiedName, enableDirectIssuance: !ca.enableDirectIssuance });
-      })
-    );
-
-    await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-      t.dropColumn("parentCaId");
-      t.dropColumn("type");
-      t.dropColumn("friendlyName");
-      t.dropColumn("organization");
-      t.dropColumn("ou");
-      t.dropColumn("country");
-      t.dropColumn("province");
-      t.dropColumn("locality");
-      t.dropColumn("commonName");
-      t.dropColumn("dn");
-      t.dropColumn("serialNumber");
-      t.dropColumn("maxPathLength");
-      t.dropColumn("keyAlgorithm");
-      t.dropColumn("notBefore");
-      t.dropColumn("notAfter");
-      t.dropColumn("activeCaCertId");
-      t.boolean("enableDirectIssuance").notNullable().defaultTo(true).alter();
-      t.string("name").notNullable().alter();
-      t.unique(["name", "projectId"]);
-    });
-  }
-
-  if (!hasExternalCATable) {
-    await knex.schema.createTable(TableName.ExternalCertificateAuthority, (t) => {
-      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
-      t.string("type").notNullable();
-      t.uuid("appConnectionId").nullable();
-      t.foreign("appConnectionId").references("id").inTable(TableName.AppConnection);
-      t.uuid("dnsAppConnectionId").nullable();
-      t.foreign("dnsAppConnectionId").references("id").inTable(TableName.AppConnection);
-      t.uuid("caId").notNullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
-      t.binary("credentials");
-      t.json("configuration");
-    });
-  }
-
-  if (await knex.schema.hasTable(TableName.PkiSubscriber)) {
-    await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
-      t.string("ttl").nullable().alter();
-
-      t.boolean("enableAutoRenewal").notNullable().defaultTo(false);
-      t.integer("autoRenewalPeriodInDays");
-      t.datetime("lastAutoRenewAt");
-
-      t.string("lastOperationStatus");
-      t.text("lastOperationMessage");
-      t.dateTime("lastOperationAt");
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  const hasCATable = await knex.schema.hasTable(TableName.CertificateAuthority);
-  const hasExternalCATable = await knex.schema.hasTable(TableName.ExternalCertificateAuthority);
-  const hasInternalCATable = await knex.schema.hasTable(TableName.InternalCertificateAuthority);
-
-  if (hasCATable && hasInternalCATable) {
-    // First add all columns as nullable
-    await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-      t.uuid("parentCaId").nullable().references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
-      t.string("type").nullable();
-      t.string("friendlyName").nullable();
-      t.string("organization").nullable();
-      t.string("ou").nullable();
-      t.string("country").nullable();
-      t.string("province").nullable();
-      t.string("locality").nullable();
-      t.string("commonName").nullable();
-      t.string("dn").nullable();
-      t.string("serialNumber").nullable().unique();
-      t.integer("maxPathLength").nullable();
-      t.string("keyAlgorithm").nullable();
-      t.timestamp("notBefore").nullable();
-      t.timestamp("notAfter").nullable();
-      t.uuid("activeCaCertId").nullable().references("id").inTable(TableName.CertificateAuthorityCert);
-      t.renameColumn("enableDirectIssuance", "requireTemplateForIssuance");
-      t.dropColumn("name");
-    });
-
-    // flip requireTemplateForIssuance for existing internal CAs
-    const cas = await knex(TableName.CertificateAuthority).select("id", "requireTemplateForIssuance");
-    await Promise.all(
-      cas.map((ca) => {
-        return (
-          knex(TableName.CertificateAuthority)
-            .where({ id: ca.id })
-            // @ts-expect-error intentional: migration
-            .update({ requireTemplateForIssuance: !ca.requireTemplateForIssuance })
-        );
-      })
-    );
-
-    await knex.raw(`
-      UPDATE ${TableName.CertificateAuthority} ca
-      SET
-        type = ica.type,
-        "friendlyName" = ica."friendlyName",
-        organization = ica.organization,
-        ou = ica.ou,
-        country = ica.country,
-        province = ica.province,
-        locality = ica.locality,
-        "commonName" = ica."commonName",
-        dn = ica.dn,
-        "parentCaId" = ica."parentCaId",
-        "serialNumber" = ica."serialNumber",
-        "maxPathLength" = ica."maxPathLength",
-        "keyAlgorithm" = ica."keyAlgorithm",
-        "notBefore" = ica."notBefore",
-        "notAfter" = ica."notAfter",
-        "activeCaCertId" = ica."activeCaCertId"
-      FROM ${TableName.InternalCertificateAuthority} ica
-      WHERE ca.id = ica."caId"
-    `);
-
-    await knex.schema.alterTable(TableName.CertificateAuthority, (t) => {
-      t.string("type").notNullable().alter();
-      t.string("friendlyName").notNullable().alter();
-      t.string("organization").notNullable().alter();
-      t.string("ou").notNullable().alter();
-      t.string("country").notNullable().alter();
-      t.string("province").notNullable().alter();
-      t.string("locality").notNullable().alter();
-      t.string("commonName").notNullable().alter();
-      t.string("dn").notNullable().alter();
-      t.string("keyAlgorithm").notNullable().alter();
-      t.boolean("requireTemplateForIssuance").notNullable().defaultTo(false).alter();
-    });
-
-    await knex.schema.dropTable(TableName.InternalCertificateAuthority);
-  }
-
-  if (hasExternalCATable) {
-    await knex.schema.dropTable(TableName.ExternalCertificateAuthority);
-  }
-
-  if (await knex.schema.hasTable(TableName.PkiSubscriber)) {
-    await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
-      t.dropColumn("enableAutoRenewal");
-      t.dropColumn("autoRenewalPeriodInDays");
-      t.dropColumn("lastAutoRenewAt");
-
-      t.dropColumn("lastOperationStatus");
-      t.dropColumn("lastOperationMessage");
-      t.dropColumn("lastOperationAt");
-    });
-  }
-}

backend/src/db/migrations/20250528110936_add-folder-description-to-versioning.ts

@@ -1,19 +0,0 @@
-import { Knex } from "knex";
-
-import { TableName } from "../schemas";
-
-export async function up(knex: Knex): Promise<void> {
-  if (!(await knex.schema.hasColumn(TableName.SecretFolderVersion, "description"))) {
-    await knex.schema.alterTable(TableName.SecretFolderVersion, (t) => {
-      t.string("description").nullable();
-    });
-  }
-}
-
-export async function down(knex: Knex): Promise<void> {
-  if (await knex.schema.hasColumn(TableName.SecretFolderVersion, "description")) {
-    await knex.schema.alterTable(TableName.SecretFolderVersion, (t) => {
-      t.dropColumn("description");
-    });
-  }
-}

backend/src/db/migrations/utils/services.ts

@@ -3,27 +3,12 @@ import { Knex } from "knex";
 import { initializeHsmModule } from "@app/ee/services/hsm/hsm-fns";
 import { hsmServiceFactory } from "@app/ee/services/hsm/hsm-service";
 import { TKeyStoreFactory } from "@app/keystore/keystore";
-import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
-import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
-import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
-import { folderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import { folderCommitChangesDALFactory } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { folderTreeCheckpointDALFactory } from "@app/services/folder-tree-checkpoint/folder-tree-checkpoint-dal";
-import { folderTreeCheckpointResourcesDALFactory } from "@app/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal";
-import { identityDALFactory } from "@app/services/identity/identity-dal";
 import { internalKmsDALFactory } from "@app/services/kms/internal-kms-dal";
 import { kmskeyDALFactory } from "@app/services/kms/kms-key-dal";
 import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
 import { kmsServiceFactory } from "@app/services/kms/kms-service";
 import { orgDALFactory } from "@app/services/org/org-dal";
 import { projectDALFactory } from "@app/services/project/project-dal";
-import { resourceMetadataDALFactory } from "@app/services/resource-metadata/resource-metadata-dal";
-import { secretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { secretFolderVersionDALFactory } from "@app/services/secret-folder/secret-folder-version-dal";
-import { secretTagDALFactory } from "@app/services/secret-tag/secret-tag-dal";
-import { secretV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-v2-bridge-dal";
-import { secretVersionV2BridgeDALFactory } from "@app/services/secret-v2-bridge/secret-version-dal";
-import { userDALFactory } from "@app/services/user/user-dal";
 
 import { TMigrationEnvConfig } from "./env-config";
 
@@ -65,77 +50,3 @@ export const getMigrationEncryptionServices = async ({ envConfig, db, keyStore }
 
   return { kmsService };
 };
-
-export const getMigrationPITServices = async ({
-  db,
-  keyStore,
-  envConfig
-}: {
-  db: Knex;
-  keyStore: TKeyStoreFactory;
-  envConfig: TMigrationEnvConfig;
-}) => {
-  const projectDAL = projectDALFactory(db);
-  const folderCommitDAL = folderCommitDALFactory(db);
-  const folderCommitChangesDAL = folderCommitChangesDALFactory(db);
-  const folderCheckpointDAL = folderCheckpointDALFactory(db);
-  const folderTreeCheckpointDAL = folderTreeCheckpointDALFactory(db);
-  const userDAL = userDALFactory(db);
-  const identityDAL = identityDALFactory(db);
-  const folderDAL = secretFolderDALFactory(db);
-  const folderVersionDAL = secretFolderVersionDALFactory(db);
-  const secretVersionV2BridgeDAL = secretVersionV2BridgeDALFactory(db);
-  const folderCheckpointResourcesDAL = folderCheckpointResourcesDALFactory(db);
-  const secretV2BridgeDAL = secretV2BridgeDALFactory({ db, keyStore });
-  const folderTreeCheckpointResourcesDAL = folderTreeCheckpointResourcesDALFactory(db);
-  const secretTagDAL = secretTagDALFactory(db);
-
-  const orgDAL = orgDALFactory(db);
-  const kmsRootConfigDAL = kmsRootConfigDALFactory(db);
-  const kmsDAL = kmskeyDALFactory(db);
-  const internalKmsDAL = internalKmsDALFactory(db);
-  const resourceMetadataDAL = resourceMetadataDALFactory(db);
-
-  const hsmModule = initializeHsmModule(envConfig);
-  hsmModule.initialize();
-
-  const hsmService = hsmServiceFactory({
-    hsmModule: hsmModule.getModule(),
-    envConfig
-  });
-
-  const kmsService = kmsServiceFactory({
-    kmsRootConfigDAL,
-    keyStore,
-    kmsDAL,
-    internalKmsDAL,
-    orgDAL,
-    projectDAL,
-    hsmService,
-    envConfig
-  });
-
-  await hsmService.startService();
-  await kmsService.startService();
-
-  const folderCommitService = folderCommitServiceFactory({
-    folderCommitDAL,
-    folderCommitChangesDAL,
-    folderCheckpointDAL,
-    folderTreeCheckpointDAL,
-    userDAL,
-    identityDAL,
-    folderDAL,
-    folderVersionDAL,
-    secretVersionV2BridgeDAL,
-    projectDAL,
-    folderCheckpointResourcesDAL,
-    secretV2BridgeDAL,
-    folderTreeCheckpointResourcesDAL,
-    kmsService,
-    secretTagDAL,
-    resourceMetadataDAL
-  });
-
-  return { folderCommitService };
-};

backend/src/db/schemas/certificate-authorities.ts

@@ -11,10 +11,25 @@ export const CertificateAuthoritiesSchema = z.object({
   id: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
+  parentCaId: z.string().uuid().nullable().optional(),
   projectId: z.string(),
-  enableDirectIssuance: z.boolean().default(true),
+  type: z.string(),
   status: z.string(),
-  name: z.string()
+  friendlyName: z.string(),
+  organization: z.string(),
+  ou: z.string(),
+  country: z.string(),
+  province: z.string(),
+  locality: z.string(),
+  commonName: z.string(),
+  dn: z.string(),
+  serialNumber: z.string().nullable().optional(),
+  maxPathLength: z.number().nullable().optional(),
+  keyAlgorithm: z.string(),
+  notBefore: z.date().nullable().optional(),
+  notAfter: z.date().nullable().optional(),
+  activeCaCertId: z.string().uuid().nullable().optional(),
+  requireTemplateForIssuance: z.boolean().default(false)
 });
 
 export type TCertificateAuthorities = z.infer<typeof CertificateAuthoritiesSchema>;

backend/src/db/schemas/certificates.ts

@@ -11,7 +11,7 @@ export const CertificatesSchema = z.object({
   id: z.string().uuid(),
   createdAt: z.date(),
   updatedAt: z.date(),
-  caId: z.string().uuid().nullable().optional(),
+  caId: z.string().uuid(),
   status: z.string(),
   serialNumber: z.string(),
   friendlyName: z.string(),
@@ -21,12 +21,11 @@ export const CertificatesSchema = z.object({
   revokedAt: z.date().nullable().optional(),
   revocationReason: z.number().nullable().optional(),
   altNames: z.string().nullable().optional(),
-  caCertId: z.string().uuid().nullable().optional(),
+  caCertId: z.string().uuid(),
   certificateTemplateId: z.string().uuid().nullable().optional(),
   keyUsages: z.string().array().nullable().optional(),
   extendedKeyUsages: z.string().array().nullable().optional(),
-  pkiSubscriberId: z.string().uuid().nullable().optional(),
-  projectId: z.string()
+  pkiSubscriberId: z.string().uuid().nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;

backend/src/db/schemas/external-certificate-authorities.ts

@@ -1,29 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { zodBuffer } from "@app/lib/zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const ExternalCertificateAuthoritiesSchema = z.object({
-  id: z.string().uuid(),
-  type: z.string(),
-  appConnectionId: z.string().uuid().nullable().optional(),
-  dnsAppConnectionId: z.string().uuid().nullable().optional(),
-  caId: z.string().uuid(),
-  credentials: zodBuffer.nullable().optional(),
-  configuration: z.unknown().nullable().optional()
-});
-
-export type TExternalCertificateAuthorities = z.infer<typeof ExternalCertificateAuthoritiesSchema>;
-export type TExternalCertificateAuthoritiesInsert = Omit<
-  z.input<typeof ExternalCertificateAuthoritiesSchema>,
-  TImmutableDBKeys
->;
-export type TExternalCertificateAuthoritiesUpdate = Partial<
-  Omit<z.input<typeof ExternalCertificateAuthoritiesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/folder-checkpoint-resources.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCheckpointResourcesSchema = z.object({
-  id: z.string().uuid(),
-  folderCheckpointId: z.string().uuid(),
-  secretVersionId: z.string().uuid().nullable().optional(),
-  folderVersionId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCheckpointResources = z.infer<typeof FolderCheckpointResourcesSchema>;
-export type TFolderCheckpointResourcesInsert = Omit<z.input<typeof FolderCheckpointResourcesSchema>, TImmutableDBKeys>;
-export type TFolderCheckpointResourcesUpdate = Partial<
-  Omit<z.input<typeof FolderCheckpointResourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/folder-checkpoints.ts

@@ -1,19 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCheckpointsSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCheckpoints = z.infer<typeof FolderCheckpointsSchema>;
-export type TFolderCheckpointsInsert = Omit<z.input<typeof FolderCheckpointsSchema>, TImmutableDBKeys>;
-export type TFolderCheckpointsUpdate = Partial<Omit<z.input<typeof FolderCheckpointsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-commit-changes.ts

@@ -1,23 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCommitChangesSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  changeType: z.string(),
-  isUpdate: z.boolean().default(false),
-  secretVersionId: z.string().uuid().nullable().optional(),
-  folderVersionId: z.string().uuid().nullable().optional(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCommitChanges = z.infer<typeof FolderCommitChangesSchema>;
-export type TFolderCommitChangesInsert = Omit<z.input<typeof FolderCommitChangesSchema>, TImmutableDBKeys>;
-export type TFolderCommitChangesUpdate = Partial<Omit<z.input<typeof FolderCommitChangesSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-commits.ts

@@ -1,24 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderCommitsSchema = z.object({
-  id: z.string().uuid(),
-  commitId: z.coerce.bigint(),
-  actorMetadata: z.unknown(),
-  actorType: z.string(),
-  message: z.string().nullable().optional(),
-  folderId: z.string().uuid(),
-  envId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderCommits = z.infer<typeof FolderCommitsSchema>;
-export type TFolderCommitsInsert = Omit<z.input<typeof FolderCommitsSchema>, TImmutableDBKeys>;
-export type TFolderCommitsUpdate = Partial<Omit<z.input<typeof FolderCommitsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/folder-tree-checkpoint-resources.ts

@@ -1,26 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderTreeCheckpointResourcesSchema = z.object({
-  id: z.string().uuid(),
-  folderTreeCheckpointId: z.string().uuid(),
-  folderId: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderTreeCheckpointResources = z.infer<typeof FolderTreeCheckpointResourcesSchema>;
-export type TFolderTreeCheckpointResourcesInsert = Omit<
-  z.input<typeof FolderTreeCheckpointResourcesSchema>,
-  TImmutableDBKeys
->;
-export type TFolderTreeCheckpointResourcesUpdate = Partial<
-  Omit<z.input<typeof FolderTreeCheckpointResourcesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/folder-tree-checkpoints.ts

@@ -1,19 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const FolderTreeCheckpointsSchema = z.object({
-  id: z.string().uuid(),
-  folderCommitId: z.string().uuid(),
-  createdAt: z.date(),
-  updatedAt: z.date()
-});
-
-export type TFolderTreeCheckpoints = z.infer<typeof FolderTreeCheckpointsSchema>;
-export type TFolderTreeCheckpointsInsert = Omit<z.input<typeof FolderTreeCheckpointsSchema>, TImmutableDBKeys>;
-export type TFolderTreeCheckpointsUpdate = Partial<Omit<z.input<typeof FolderTreeCheckpointsSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/index.ts

@@ -20,15 +20,8 @@ export * from "./certificate-templates";
 export * from "./certificates";
 export * from "./dynamic-secret-leases";
 export * from "./dynamic-secrets";
-export * from "./external-certificate-authorities";
 export * from "./external-group-org-role-mappings";
 export * from "./external-kms";
-export * from "./folder-checkpoint-resources";
-export * from "./folder-checkpoints";
-export * from "./folder-commit-changes";
-export * from "./folder-commits";
-export * from "./folder-tree-checkpoint-resources";
-export * from "./folder-tree-checkpoints";
 export * from "./gateways";
 export * from "./git-app-install-sessions";
 export * from "./git-app-org";
@@ -56,7 +49,6 @@ export * from "./identity-universal-auths";
 export * from "./incident-contacts";
 export * from "./integration-auths";
 export * from "./integrations";
-export * from "./internal-certificate-authorities";
 export * from "./internal-kms";
 export * from "./kmip-client-certificates";
 export * from "./kmip-clients";

backend/src/db/schemas/internal-certificate-authorities.ts

@@ -1,38 +0,0 @@
-// Code generated by automation script, DO NOT EDIT.
-// Automated by pulling database and generating zod schema
-// To update. Just run npm run generate:schema
-// Written by akhilmhdh.
-
-import { z } from "zod";
-
-import { TImmutableDBKeys } from "./models";
-
-export const InternalCertificateAuthoritiesSchema = z.object({
-  id: z.string().uuid(),
-  parentCaId: z.string().uuid().nullable().optional(),
-  type: z.string(),
-  friendlyName: z.string(),
-  organization: z.string(),
-  ou: z.string(),
-  country: z.string(),
-  province: z.string(),
-  locality: z.string(),
-  commonName: z.string(),
-  dn: z.string(),
-  serialNumber: z.string().nullable().optional(),
-  maxPathLength: z.number().nullable().optional(),
-  keyAlgorithm: z.string(),
-  notBefore: z.date().nullable().optional(),
-  notAfter: z.date().nullable().optional(),
-  activeCaCertId: z.string().uuid().nullable().optional(),
-  caId: z.string().uuid()
-});
-
-export type TInternalCertificateAuthorities = z.infer<typeof InternalCertificateAuthoritiesSchema>;
-export type TInternalCertificateAuthoritiesInsert = Omit<
-  z.input<typeof InternalCertificateAuthoritiesSchema>,
-  TImmutableDBKeys
->;
-export type TInternalCertificateAuthoritiesUpdate = Partial<
-  Omit<z.input<typeof InternalCertificateAuthoritiesSchema>, TImmutableDBKeys>
->;

backend/src/db/schemas/models.ts

@@ -13,8 +13,6 @@ export enum TableName {
   SshCertificate = "ssh_certificates",
   SshCertificateBody = "ssh_certificate_bodies",
   CertificateAuthority = "certificate_authorities",
-  ExternalCertificateAuthority = "external_certificate_authorities",
-  InternalCertificateAuthority = "internal_certificate_authorities",
   CertificateTemplateEstConfig = "certificate_template_est_configs",
   CertificateAuthorityCert = "certificate_authority_certs",
   CertificateAuthoritySecret = "certificate_authority_secret",
@@ -157,16 +155,10 @@ export enum TableName {
   MicrosoftTeamsIntegrations = "microsoft_teams_integrations",
   ProjectMicrosoftTeamsConfigs = "project_microsoft_teams_configs",
   SecretReminderRecipients = "secret_reminder_recipients",
-  GithubOrgSyncConfig = "github_org_sync_configs",
-  FolderCommit = "folder_commits",
-  FolderCommitChanges = "folder_commit_changes",
-  FolderCheckpoint = "folder_checkpoints",
-  FolderCheckpointResources = "folder_checkpoint_resources",
-  FolderTreeCheckpoint = "folder_tree_checkpoints",
-  FolderTreeCheckpointResources = "folder_tree_checkpoint_resources"
+  GithubOrgSyncConfig = "github_org_sync_configs"
 }
 
-export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";
+export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt";
 
 export const UserDeviceSchema = z
   .object({

backend/src/db/schemas/pki-subscribers.ts

@@ -16,16 +16,10 @@ export const PkiSubscribersSchema = z.object({
   name: z.string(),
   commonName: z.string(),
   subjectAlternativeNames: z.string().array(),
-  ttl: z.string().nullable().optional(),
+  ttl: z.string(),
   keyUsages: z.string().array(),
   extendedKeyUsages: z.string().array(),
-  status: z.string(),
-  enableAutoRenewal: z.boolean().default(false),
-  autoRenewalPeriodInDays: z.number().nullable().optional(),
-  lastAutoRenewAt: z.date().nullable().optional(),
-  lastOperationStatus: z.string().nullable().optional(),
-  lastOperationMessage: z.string().nullable().optional(),
-  lastOperationAt: z.date().nullable().optional()
+  status: z.string()
 });
 
 export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

backend/src/db/schemas/secret-folder-versions.ts

@@ -14,8 +14,7 @@ export const SecretFolderVersionsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   envId: z.string().uuid(),
-  folderId: z.string().uuid(),
-  description: z.string().nullable().optional()
+  folderId: z.string().uuid()
 });
 
 export type TSecretFolderVersions = z.infer<typeof SecretFolderVersionsSchema>;

backend/src/ee/routes/v1/access-approval-request-router.ts

@@ -154,8 +154,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
         requestId: z.string().trim()
       }),
       body: z.object({
-        status: z.enum([ApprovalStatus.APPROVED, ApprovalStatus.REJECTED]),
-        bypassReason: z.string().min(10).max(1000).optional()
+        status: z.enum([ApprovalStatus.APPROVED, ApprovalStatus.REJECTED])
       }),
       response: {
         200: z.object({
@@ -171,8 +170,7 @@ export const registerAccessApprovalRequestRouter = async (server: FastifyZodProv
         actorOrgId: req.permission.orgId,
         actorAuthMethod: req.permission.authMethod,
         requestId: req.params.requestId,
-        status: req.body.status,
-        bypassReason: req.body.bypassReason
+        status: req.body.status
       });
 
       return { review };

backend/src/ee/routes/v1/index.ts

@@ -18,7 +18,6 @@ import { registerLdapRouter } from "./ldap-router";
 import { registerLicenseRouter } from "./license-router";
 import { registerOidcRouter } from "./oidc-router";
 import { registerOrgRoleRouter } from "./org-role-router";
-import { registerPITRouter } from "./pit-router";
 import { registerProjectRoleRouter } from "./project-role-router";
 import { registerProjectRouter } from "./project-router";
 import { registerRateLimitRouter } from "./rate-limit-router";
@@ -54,7 +53,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
     { prefix: "/workspace" }
   );
   await server.register(registerSnapshotRouter, { prefix: "/secret-snapshot" });
-  await server.register(registerPITRouter, { prefix: "/pit" });
   await server.register(registerSecretApprovalPolicyRouter, { prefix: "/secret-approvals" });
   await server.register(registerSecretApprovalRequestRouter, {
     prefix: "/secret-approval-requests"

backend/src/ee/routes/v1/pit-router.ts

@@ -1,416 +0,0 @@
-/* eslint-disable @typescript-eslint/no-base-to-string */
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { removeTrailingSlash } from "@app/lib/fn";
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { booleanSchema } from "@app/server/routes/sanitizedSchemas";
-import { AuthMode } from "@app/services/auth/auth-type";
-import { commitChangesResponseSchema, resourceChangeSchema } from "@app/services/folder-commit/folder-commit-schemas";
-
-const commitHistoryItemSchema = z.object({
-  id: z.string(),
-  folderId: z.string(),
-  actorType: z.string(),
-  actorMetadata: z.unknown().optional(),
-  message: z.string().optional().nullable(),
-  commitId: z.string(),
-  createdAt: z.string().or(z.date()),
-  envId: z.string()
-});
-
-const folderStateSchema = z.array(
-  z.object({
-    type: z.string(),
-    id: z.string(),
-    versionId: z.string(),
-    secretKey: z.string().optional(),
-    secretVersion: z.number().optional(),
-    folderName: z.string().optional(),
-    folderVersion: z.number().optional()
-  })
-);
-
-export const registerPITRouter = async (server: FastifyZodProvider) => {
-  // Get commits count for a folder
-  server.route({
-    method: "GET",
-    url: "/commits/count",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        environment: z.string().trim(),
-        path: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          count: z.number(),
-          folderId: z.string()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitsCount({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        environment: req.query.environment,
-        path: req.query.path
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMIT_COUNT,
-          metadata: {
-            environment: req.query.environment,
-            path: req.query.path,
-            commitCount: result.count.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Get all commits for a folder
-  server.route({
-    method: "GET",
-    url: "/commits",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      querystring: z.object({
-        environment: z.string().trim(),
-        path: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim(),
-        offset: z.coerce.number().min(0).default(0),
-        limit: z.coerce.number().min(1).max(100).default(20),
-        search: z.string().trim().optional(),
-        sort: z.enum(["asc", "desc"]).default("desc")
-      }),
-      response: {
-        200: z.object({
-          commits: commitHistoryItemSchema.array(),
-          total: z.number(),
-          hasMore: z.boolean()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitsForFolder({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        environment: req.query.environment,
-        path: req.query.path,
-        offset: req.query.offset,
-        limit: req.query.limit,
-        search: req.query.search,
-        sort: req.query.sort
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMITS,
-          metadata: {
-            environment: req.query.environment,
-            path: req.query.path,
-            commitCount: result.commits.length.toString(),
-            offset: req.query.offset.toString(),
-            limit: req.query.limit.toString(),
-            search: req.query.search,
-            sort: req.query.sort
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Get commit changes for a specific commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId/changes",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: commitChangesResponseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getCommitChanges({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_PROJECT_PIT_COMMIT_CHANGES,
-          metadata: {
-            commitId: req.params.commitId,
-            changesCount: (result.changes.changes?.length || 0).toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Retrieve rollback changes for a commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId/compare",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        folderId: z.string().trim(),
-        environment: z.string().trim(),
-        deepRollback: booleanSchema.default(false),
-        secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.array(
-          z.object({
-            folderId: z.string(),
-            folderName: z.string(),
-            folderPath: z.string().optional(),
-            changes: z.array(resourceChangeSchema)
-          })
-        )
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.compareCommitChanges({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId,
-        folderId: req.query.folderId,
-        environment: req.query.environment,
-        deepRollback: req.query.deepRollback,
-        secretPath: req.query.secretPath
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.PIT_COMPARE_FOLDER_STATES,
-          metadata: {
-            targetCommitId: req.params.commitId,
-            folderId: req.query.folderId,
-            deepRollback: req.query.deepRollback,
-            diffsCount: result.length.toString(),
-            environment: req.query.environment,
-            folderPath: req.query.secretPath
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Rollback to a previous commit
-  server.route({
-    method: "POST",
-    url: "/commits/:commitId/rollback",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      body: z.object({
-        folderId: z.string().trim(),
-        deepRollback: z.boolean().default(false),
-        message: z.string().max(256).trim().optional(),
-        environment: z.string().trim(),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          success: z.boolean(),
-          secretChangesCount: z.number().optional(),
-          folderChangesCount: z.number().optional(),
-          totalChanges: z.number().optional()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.rollbackToCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.body.projectId,
-        commitId: req.params.commitId,
-        folderId: req.body.folderId,
-        deepRollback: req.body.deepRollback,
-        message: req.body.message,
-        environment: req.body.environment
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.body.projectId,
-        event: {
-          type: EventType.PIT_ROLLBACK_COMMIT,
-          metadata: {
-            targetCommitId: req.params.commitId,
-            environment: req.body.environment,
-            folderId: req.body.folderId,
-            deepRollback: req.body.deepRollback,
-            message: req.body.message || "Rollback to previous commit",
-            totalChanges: result.totalChanges?.toString() || "0"
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Revert commit
-  server.route({
-    method: "POST",
-    url: "/commits/:commitId/revert",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      body: z.object({
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: z.object({
-          success: z.boolean(),
-          message: z.string(),
-          originalCommitId: z.string(),
-          revertCommitId: z.string().optional(),
-          changesReverted: z.number().optional()
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.revertCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.body.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.body.projectId,
-        event: {
-          type: EventType.PIT_REVERT_COMMIT,
-          metadata: {
-            commitId: req.params.commitId,
-            revertCommitId: result.revertCommitId,
-            changesReverted: result.changesReverted?.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-
-  // Folder state at commit
-  server.route({
-    method: "GET",
-    url: "/commits/:commitId",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        commitId: z.string().trim()
-      }),
-      querystring: z.object({
-        folderId: z.string().trim(),
-        projectId: z.string().trim()
-      }),
-      response: {
-        200: folderStateSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const result = await server.services.pit.getFolderStateAtCommit({
-        actor: req.permission?.type,
-        actorId: req.permission?.id,
-        actorOrgId: req.permission?.orgId,
-        actorAuthMethod: req.permission?.authMethod,
-        projectId: req.query.projectId,
-        commitId: req.params.commitId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.PIT_GET_FOLDER_STATE,
-          metadata: {
-            commitId: req.params.commitId,
-            folderId: req.query.folderId,
-            resourceCount: result.length.toString()
-          }
-        }
-      });
-
-      return result;
-    }
-  });
-};

backend/src/ee/services/access-approval-request/access-approval-request-service.ts

@@ -6,7 +6,6 @@ import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
-import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
@@ -23,7 +22,6 @@ import { TAccessApprovalPolicyApproverDALFactory } from "../access-approval-poli
 import { TAccessApprovalPolicyDALFactory } from "../access-approval-policy/access-approval-policy-dal";
 import { TGroupDALFactory } from "../group/group-dal";
 import { TPermissionServiceFactory } from "../permission/permission-service";
-import { ProjectPermissionApprovalActions, ProjectPermissionSub } from "../permission/project-permission";
 import { TProjectUserAdditionalPrivilegeDALFactory } from "../project-user-additional-privilege/project-user-additional-privilege-dal";
 import { ProjectUserAdditionalPrivilegeTemporaryMode } from "../project-user-additional-privilege/project-user-additional-privilege-types";
 import { TAccessApprovalRequestDALFactory } from "./access-approval-request-dal";
@@ -325,22 +323,26 @@ export const accessApprovalRequestServiceFactory = ({
     status,
     actorId,
     actorAuthMethod,
-    actorOrgId,
-    bypassReason
+    actorOrgId
   }: TReviewAccessRequestDTO) => {
     const accessApprovalRequest = await accessApprovalRequestDAL.findById(requestId);
     if (!accessApprovalRequest) {
       throw new NotFoundError({ message: `Secret approval request with ID '${requestId}' not found` });
     }
 
-    const { policy, environment } = accessApprovalRequest;
+    const { policy } = accessApprovalRequest;
     if (policy.deletedAt) {
       throw new BadRequestError({
         message: "The policy associated with this access request has been deleted."
       });
     }
+    if (!policy.allowedSelfApprovals && actorId === accessApprovalRequest.requestedByUserId) {
+      throw new BadRequestError({
+        message: "Failed to review access approval request. Users are not authorized to review their own request."
+      });
+    }
 
-    const { membership, hasRole, permission } = await permissionService.getProjectPermission({
+    const { membership, hasRole } = await permissionService.getProjectPermission({
       actor,
       actorId,
       projectId: accessApprovalRequest.projectId,
@@ -353,20 +355,6 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not a member of this project" });
     }
 
-    const isSelfApproval = actorId === accessApprovalRequest.requestedByUserId;
-    const isSoftEnforcement = policy.enforcementLevel === EnforcementLevel.Soft;
-    const canBypassApproval = permission.can(
-      ProjectPermissionApprovalActions.AllowAccessBypass,
-      ProjectPermissionSub.SecretApproval
-    );
-    const cannotBypassUnderSoftEnforcement = !(isSoftEnforcement && canBypassApproval);
-
-    if (!policy.allowedSelfApprovals && isSelfApproval && cannotBypassUnderSoftEnforcement) {
-      throw new BadRequestError({
-        message: "Failed to review access approval request. Users are not authorized to review their own request."
-      });
-    }
-
     if (
       !hasRole(ProjectMembershipRole.Admin) &&
       accessApprovalRequest.requestedByUserId !== actorId && // The request wasn't made by the current user
@@ -375,49 +363,21 @@ export const accessApprovalRequestServiceFactory = ({
       throw new ForbiddenRequestError({ message: "You are not authorized to approve this request" });
     }
 
-    const project = await projectDAL.findById(accessApprovalRequest.projectId);
-    if (!project) {
-      throw new NotFoundError({ message: "The project associated with this access request was not found." });
-    }
-
     const existingReviews = await accessApprovalRequestReviewerDAL.find({ requestId: accessApprovalRequest.id });
     if (existingReviews.some((review) => review.status === ApprovalStatus.REJECTED)) {
       throw new BadRequestError({ message: "The request has already been rejected by another reviewer" });
     }
 
     const reviewStatus = await accessApprovalRequestReviewerDAL.transaction(async (tx) => {
-      const isBreakGlassApprovalAttempt =
-        policy.enforcementLevel === EnforcementLevel.Soft &&
-        actorId === accessApprovalRequest.requestedByUserId &&
-        status === ApprovalStatus.APPROVED;
-
-      let reviewForThisActorProcessing: {
-        id: string;
-        requestId: string;
-        reviewerUserId: string;
-        status: string;
-        createdAt: Date;
-        updatedAt: Date;
-      };
-
-      const existingReviewByActorInTx = await accessApprovalRequestReviewerDAL.findOne(
+      const review = await accessApprovalRequestReviewerDAL.findOne(
         {
           requestId: accessApprovalRequest.id,
           reviewerUserId: actorId
         },
         tx
       );
-
-      // Check if review exists for actor
-      if (existingReviewByActorInTx) {
-        // Check if breakglass re-approval
-        if (isBreakGlassApprovalAttempt && existingReviewByActorInTx.status === ApprovalStatus.APPROVED) {
-          reviewForThisActorProcessing = existingReviewByActorInTx;
-        } else {
-          throw new BadRequestError({ message: "You have already reviewed this request" });
-        }
-      } else {
-        reviewForThisActorProcessing = await accessApprovalRequestReviewerDAL.create(
+      if (!review) {
+        const newReview = await accessApprovalRequestReviewerDAL.create(
           {
             status,
             requestId: accessApprovalRequest.id,
@@ -425,26 +385,19 @@ export const accessApprovalRequestServiceFactory = ({
           },
           tx
         );
-      }
 
-      const otherReviews = existingReviews.filter((er) => er.reviewerUserId !== actorId);
-      const allUniqueReviews = [...otherReviews, reviewForThisActorProcessing];
+        const allReviews = [...existingReviews, newReview];
 
-      const approvedReviews = allUniqueReviews.filter((r) => r.status === ApprovalStatus.APPROVED);
-      const meetsStandardApprovalThreshold = approvedReviews.length >= policy.approvals;
+        const approvedReviews = allReviews.filter((r) => r.status === ApprovalStatus.APPROVED);
 
-      if (
-        reviewForThisActorProcessing.status === ApprovalStatus.APPROVED &&
-        (meetsStandardApprovalThreshold || isBreakGlassApprovalAttempt)
-      ) {
-        const currentRequestState = await accessApprovalRequestDAL.findById(accessApprovalRequest.id, tx);
-        let privilegeIdToSet = currentRequestState?.privilegeId || null;
-
-        if (!privilegeIdToSet) {
+        // approvals is the required number of approvals. If the number of approved reviews is equal to the number of required approvals, then the request is approved.
+        if (approvedReviews.length === policy.approvals) {
           if (accessApprovalRequest.isTemporary && !accessApprovalRequest.temporaryRange) {
             throw new BadRequestError({ message: "Temporary range is required for temporary access" });
           }
 
+          let privilegeId: string | null = null;
+
           if (!accessApprovalRequest.isTemporary && !accessApprovalRequest.temporaryRange) {
             // Permanent access
             const privilege = await additionalPrivilegeDAL.create(
@@ -456,7 +409,7 @@ export const accessApprovalRequestServiceFactory = ({
               },
               tx
             );
-            privilegeIdToSet = privilege.id;
+            privilegeId = privilege.id;
           } else {
             // Temporary access
             const relativeTempAllocatedTimeInMs = ms(accessApprovalRequest.temporaryRange!);
@@ -468,57 +421,23 @@ export const accessApprovalRequestServiceFactory = ({
                 projectId: accessApprovalRequest.projectId,
                 slug: `requested-privilege-${slugify(alphaNumericNanoId(12))}`,
                 permissions: JSON.stringify(accessApprovalRequest.permissions),
-                isTemporary: true, // Explicitly set to true for the privilege
+                isTemporary: true,
                 temporaryMode: ProjectUserAdditionalPrivilegeTemporaryMode.Relative,
                 temporaryRange: accessApprovalRequest.temporaryRange!,
                 temporaryAccessStartTime: startTime,
-                temporaryAccessEndTime: new Date(startTime.getTime() + relativeTempAllocatedTimeInMs)
+                temporaryAccessEndTime: new Date(new Date(startTime).getTime() + relativeTempAllocatedTimeInMs)
               },
               tx
             );
-            privilegeIdToSet = privilege.id;
+            privilegeId = privilege.id;
           }
-          await accessApprovalRequestDAL.updateById(accessApprovalRequest.id, { privilegeId: privilegeIdToSet }, tx);
+
+          await accessApprovalRequestDAL.updateById(accessApprovalRequest.id, { privilegeId }, tx);
         }
+
+        return newReview;
       }
-
-      // Send notification if this was a breakglass approval
-      if (isBreakGlassApprovalAttempt) {
-        const cfg = getConfig();
-        const actingUser = await userDAL.findById(actorId, tx);
-
-        if (actingUser) {
-          const policyApproverUserIds = policy.approvers
-            .map((ap) => ap.userId)
-            .filter((id): id is string => typeof id === "string");
-
-          if (policyApproverUserIds.length > 0) {
-            const approverUsersForEmail = await userDAL.find({ $in: { id: policyApproverUserIds } }, { tx });
-            const recipientEmails = approverUsersForEmail
-              .map((appUser) => appUser.email)
-              .filter((email): email is string => !!email);
-
-            if (recipientEmails.length > 0) {
-              await smtpService.sendMail({
-                recipients: recipientEmails,
-                subjectLine: "Infisical Secret Access Policy Bypassed",
-                substitutions: {
-                  projectName: project.name,
-                  requesterFullName: `${actingUser.firstName} ${actingUser.lastName}`,
-                  requesterEmail: actingUser.email,
-                  bypassReason: bypassReason || "No reason provided",
-                  secretPath: policy.secretPath || "/",
-                  environment,
-                  approvalUrl: `${cfg.SITE_URL}/secret-manager/${project.id}/approval`,
-                  requestType: "access"
-                },
-                template: SmtpTemplates.AccessSecretRequestBypassed
-              });
-            }
-          }
-        }
-      }
-      return reviewForThisActorProcessing;
+      throw new BadRequestError({ message: "You have already reviewed this request" });
     });
 
     return reviewStatus;

backend/src/ee/services/access-approval-request/access-approval-request-types.ts

@@ -17,8 +17,6 @@ export type TGetAccessRequestCountDTO = {
 export type TReviewAccessRequestDTO = {
   requestId: string;
   status: ApprovalStatus;
-  envName?: string;
-  bypassReason?: string;
 } & Omit<TProjectPermission, "projectId">;
 
 export type TCreateAccessApprovalRequestDTO = {

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -21,7 +21,7 @@ import { AppConnection } from "@app/services/app-connection/app-connection-enums
 import { TCreateAppConnectionDTO, TUpdateAppConnectionDTO } from "@app/services/app-connection/app-connection-types";
 import { ActorType } from "@app/services/auth/auth-type";
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
-import { CaStatus } from "@app/services/certificate-authority/certificate-authority-enums";
+import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
 import { TAllowedFields } from "@app/services/identity-ldap-auth/identity-ldap-auth-types";
 import { PkiItemType } from "@app/services/pki-collection/pki-collection-types";
@@ -232,7 +232,6 @@ export enum EventType {
   REMOVE_HOST_FROM_SSH_HOST_GROUP = "remove-host-from-ssh-host-group",
   CREATE_CA = "create-certificate-authority",
   GET_CA = "get-certificate-authority",
-  GET_CAS = "get-certificate-authorities",
   UPDATE_CA = "update-certificate-authority",
   DELETE_CA = "delete-certificate-authority",
   RENEW_CA = "renew-certificate-authority",
@@ -243,7 +242,6 @@ export enum EventType {
   IMPORT_CA_CERT = "import-certificate-authority-cert",
   GET_CA_CRLS = "get-certificate-authority-crls",
   ISSUE_CERT = "issue-cert",
-  IMPORT_CERT = "import-cert",
   SIGN_CERT = "sign-cert",
   GET_CA_CERTIFICATE_TEMPLATES = "get-ca-certificate-templates",
   GET_CERT = "get-cert",
@@ -269,9 +267,7 @@ export enum EventType {
   GET_PKI_SUBSCRIBER = "get-pki-subscriber",
   ISSUE_PKI_SUBSCRIBER_CERT = "issue-pki-subscriber-cert",
   SIGN_PKI_SUBSCRIBER_CERT = "sign-pki-subscriber-cert",
-  AUTOMATED_RENEW_SUBSCRIBER_CERT = "automated-renew-subscriber-cert",
   LIST_PKI_SUBSCRIBER_CERTS = "list-pki-subscriber-certs",
-  GET_SUBSCRIBER_ACTIVE_CERT_BUNDLE = "get-subscriber-active-cert-bundle",
   CREATE_KMS = "create-kms",
   UPDATE_KMS = "update-kms",
   DELETE_KMS = "delete-kms",
@@ -381,14 +377,6 @@ export enum EventType {
   PROJECT_ASSUME_PRIVILEGE_SESSION_START = "project-assume-privileges-session-start",
   PROJECT_ASSUME_PRIVILEGE_SESSION_END = "project-assume-privileges-session-end",
 
-  GET_PROJECT_PIT_COMMITS = "get-project-pit-commits",
-  GET_PROJECT_PIT_COMMIT_CHANGES = "get-project-pit-commit-changes",
-  GET_PROJECT_PIT_COMMIT_COUNT = "get-project-pit-commit-count",
-  PIT_ROLLBACK_COMMIT = "pit-rollback-commit",
-  PIT_REVERT_COMMIT = "pit-revert-commit",
-  PIT_GET_FOLDER_STATE = "pit-get-folder-state",
-  PIT_COMPARE_FOLDER_STATES = "pit-compare-folder-states",
-
   UPDATE_ORG = "update-org",
 
   CREATE_PROJECT = "create-project",
@@ -1790,8 +1778,7 @@ interface CreateCa {
   type: EventType.CREATE_CA;
   metadata: {
     caId: string;
-    name: string;
-    dn?: string;
+    dn: string;
   };
 }
 
@@ -1799,15 +1786,7 @@ interface GetCa {
   type: EventType.GET_CA;
   metadata: {
     caId: string;
-    name: string;
-    dn?: string;
-  };
-}
-
-interface GetCAs {
-  type: EventType.GET_CAS;
-  metadata: {
-    caIds: string[];
+    dn: string;
   };
 }
 
@@ -1815,8 +1794,7 @@ interface UpdateCa {
   type: EventType.UPDATE_CA;
   metadata: {
     caId: string;
-    name: string;
-    dn?: string;
+    dn: string;
     status: CaStatus;
   };
 }
@@ -1825,8 +1803,7 @@ interface DeleteCa {
   type: EventType.DELETE_CA;
   metadata: {
     caId: string;
-    name: string;
-    dn?: string;
+    dn: string;
   };
 }
 
@@ -1896,15 +1873,6 @@ interface IssueCert {
   };
 }
 
-interface ImportCert {
-  type: EventType.IMPORT_CERT;
-  metadata: {
-    certId: string;
-    cn: string;
-    serialNumber: string;
-  };
-}
-
 interface SignCert {
   type: EventType.SIGN_CERT;
   metadata: {
@@ -2072,7 +2040,7 @@ interface CreatePkiSubscriber {
     caId?: string;
     name: string;
     commonName: string;
-    ttl?: string;
+    ttl: string;
     subjectAlternativeNames: string[];
     keyUsages: CertKeyUsage[];
     extendedKeyUsages: CertExtendedKeyUsage[];
@@ -2114,15 +2082,7 @@ interface IssuePkiSubscriberCert {
   metadata: {
     subscriberId: string;
     name: string;
-    serialNumber?: string;
-  };
-}
-
-interface AutomatedRenewPkiSubscriberCert {
-  type: EventType.AUTOMATED_RENEW_SUBSCRIBER_CERT;
-  metadata: {
-    subscriberId: string;
-    name: string;
+    serialNumber: string;
   };
 }
 
@@ -2144,16 +2104,6 @@ interface ListPkiSubscriberCerts {
   };
 }
 
-interface GetSubscriberActiveCertBundle {
-  type: EventType.GET_SUBSCRIBER_ACTIVE_CERT_BUNDLE;
-  metadata: {
-    subscriberId: string;
-    name: string;
-    certId: string;
-    serialNumber: string;
-  };
-}
-
 interface CreateKmsEvent {
   type: EventType.CREATE_KMS;
   metadata: {
@@ -2961,78 +2911,6 @@ interface MicrosoftTeamsWorkflowIntegrationUpdateEvent {
   };
 }
 
-interface GetProjectPitCommitsEvent {
-  type: EventType.GET_PROJECT_PIT_COMMITS;
-  metadata: {
-    commitCount: string;
-    environment: string;
-    path: string;
-    offset: string;
-    limit: string;
-    search?: string;
-    sort: string;
-  };
-}
-
-interface GetProjectPitCommitChangesEvent {
-  type: EventType.GET_PROJECT_PIT_COMMIT_CHANGES;
-  metadata: {
-    changesCount: string;
-    commitId: string;
-  };
-}
-
-interface GetProjectPitCommitCountEvent {
-  type: EventType.GET_PROJECT_PIT_COMMIT_COUNT;
-  metadata: {
-    environment: string;
-    path: string;
-    commitCount: string;
-  };
-}
-
-interface PitRollbackCommitEvent {
-  type: EventType.PIT_ROLLBACK_COMMIT;
-  metadata: {
-    targetCommitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    message: string;
-    totalChanges: string;
-    environment: string;
-  };
-}
-
-interface PitRevertCommitEvent {
-  type: EventType.PIT_REVERT_COMMIT;
-  metadata: {
-    commitId: string;
-    revertCommitId?: string;
-    changesReverted?: string;
-  };
-}
-
-interface PitGetFolderStateEvent {
-  type: EventType.PIT_GET_FOLDER_STATE;
-  metadata: {
-    commitId: string;
-    folderId: string;
-    resourceCount: string;
-  };
-}
-
-interface PitCompareFolderStatesEvent {
-  type: EventType.PIT_COMPARE_FOLDER_STATES;
-  metadata: {
-    targetCommitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    diffsCount: string;
-    environment: string;
-    folderPath: string;
-  };
-}
-
 interface OrgUpdateEvent {
   type: EventType.UPDATE_ORG;
   metadata: {
@@ -3210,7 +3088,6 @@ export type Event =
   | IssueSshHostHostCert
   | CreateCa
   | GetCa
-  | GetCAs
   | UpdateCa
   | DeleteCa
   | RenewCa
@@ -3221,7 +3098,6 @@ export type Event =
   | ImportCaCert
   | GetCaCrls
   | IssueCert
-  | ImportCert
   | SignCert
   | GetCaCertificateTemplates
   | GetCert
@@ -3247,9 +3123,7 @@ export type Event =
   | GetPkiSubscriber
   | IssuePkiSubscriberCert
   | SignPkiSubscriberCert
-  | AutomatedRenewPkiSubscriberCert
   | ListPkiSubscriberCerts
-  | GetSubscriberActiveCertBundle
   | CreateKmsEvent
   | UpdateKmsEvent
   | DeleteKmsEvent
@@ -3356,13 +3230,6 @@ export type Event =
   | MicrosoftTeamsWorkflowIntegrationGetEvent
   | MicrosoftTeamsWorkflowIntegrationListEvent
   | MicrosoftTeamsWorkflowIntegrationUpdateEvent
-  | GetProjectPitCommitsEvent
-  | GetProjectPitCommitChangesEvent
-  | PitRollbackCommitEvent
-  | GetProjectPitCommitCountEvent
-  | PitRevertCommitEvent
-  | PitCompareFolderStatesEvent
-  | PitGetFolderStateEvent
   | OrgUpdateEvent
   | ProjectCreateEvent
   | ProjectUpdateEvent

backend/src/ee/services/certificate-authority-crl/certificate-authority-crl-service.ts

@@ -7,7 +7,6 @@ import { TPermissionServiceFactory } from "@app/ee/services/permission/permissio
 import { ProjectPermissionActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
 import { NotFoundError } from "@app/lib/errors";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
-import { expandInternalCa } from "@app/services/certificate-authority/certificate-authority-fns";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
@@ -15,7 +14,7 @@ import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns
 import { TGetCaCrlsDTO, TGetCrlById } from "./certificate-authority-crl-types";
 
 type TCertificateAuthorityCrlServiceFactoryDep = {
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "find" | "findById">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
@@ -38,8 +37,7 @@ export const certificateAuthorityCrlServiceFactory = ({
     const caCrl = await certificateAuthorityCrlDAL.findById(crlId);
     if (!caCrl) throw new NotFoundError({ message: `CRL with ID '${crlId}' not found` });
 
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caCrl.caId);
-    if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caCrl.caId}' not found` });
+    const ca = await certificateAuthorityDAL.findById(caCrl.caId);
 
     const keyId = await getProjectKmsCertificateKeyId({
       projectId: ca.projectId,
@@ -56,7 +54,7 @@ export const certificateAuthorityCrlServiceFactory = ({
     const crl = new x509.X509Crl(decryptedCrl);
 
     return {
-      ca: expandInternalCa(ca),
+      ca,
       caCrl,
       crl: crl.rawData
     };
@@ -66,8 +64,8 @@ export const certificateAuthorityCrlServiceFactory = ({
    * Returns a list of CRL ids for CA with id [caId]
    */
   const getCaCrls = async ({ caId, actorId, actorAuthMethod, actor, actorOrgId }: TGetCaCrlsDTO) => {
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
-    if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -110,7 +108,7 @@ export const certificateAuthorityCrlServiceFactory = ({
     );
 
     return {
-      ca: expandInternalCa(ca),
+      ca,
       crls: decryptedCrls
     };
   };

backend/src/ee/services/certificate-est/certificate-est-service.ts

@@ -6,7 +6,7 @@ import { isCertChainValid } from "@app/services/certificate/certificate-fns";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { getCaCertChain, getCaCertChains } from "@app/services/certificate-authority/certificate-authority-fns";
-import { TInternalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
+import { TCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
 import { TCertificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
 import { TCertificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
@@ -16,10 +16,10 @@ import { TLicenseServiceFactory } from "../license/license-service";
 import { convertRawCertsToPkcs7 } from "./certificate-est-fns";
 
 type TCertificateEstServiceFactoryDep = {
-  internalCertificateAuthorityService: Pick<TInternalCertificateAuthorityServiceFactory, "signCertFromCa">;
+  certificateAuthorityService: Pick<TCertificateAuthorityServiceFactory, "signCertFromCa">;
   certificateTemplateService: Pick<TCertificateTemplateServiceFactory, "getEstConfiguration">;
   certificateTemplateDAL: Pick<TCertificateTemplateDALFactory, "findById">;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find" | "findById">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
@@ -29,7 +29,7 @@ type TCertificateEstServiceFactoryDep = {
 export type TCertificateEstServiceFactory = ReturnType<typeof certificateEstServiceFactory>;
 
 export const certificateEstServiceFactory = ({
-  internalCertificateAuthorityService,
+  certificateAuthorityService,
   certificateTemplateService,
   certificateTemplateDAL,
   certificateAuthorityCertDAL,
@@ -127,7 +127,7 @@ export const certificateEstServiceFactory = ({
       });
     }
 
-    const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
+    const { certificate } = await certificateAuthorityService.signCertFromCa({
       isInternal: true,
       certificateTemplateId,
       csr
@@ -188,7 +188,7 @@ export const certificateEstServiceFactory = ({
       }
     }
 
-    const { certificate } = await internalCertificateAuthorityService.signCertFromCa({
+    const { certificate } = await certificateAuthorityService.signCertFromCa({
       isInternal: true,
       certificateTemplateId,
       csr
@@ -227,15 +227,15 @@ export const certificateEstServiceFactory = ({
       });
     }
 
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(certTemplate.caId);
-    if (!ca?.internalCa?.id) {
+    const ca = await certificateAuthorityDAL.findById(certTemplate.caId);
+    if (!ca) {
       throw new NotFoundError({
-        message: `Internal Certificate Authority with ID '${certTemplate.caId}' not found`
+        message: `Certificate Authority with ID '${certTemplate.caId}' not found`
       });
     }
 
     const { caCert, caCertChain } = await getCaCertChain({
-      caCertId: ca.internalCa.activeCaCertId as string,
+      caCertId: ca.activeCaCertId as string,
       certificateAuthorityDAL,
       certificateAuthorityCertDAL,
       projectDAL,

backend/src/ee/services/license/license-service.ts

@@ -192,11 +192,6 @@ export const licenseServiceFactory = ({
         const workspacesUsed = await projectDAL.countOfOrgProjects(orgId);
         currentPlan.workspacesUsed = workspacesUsed;
 
-        const membersUsed = await licenseDAL.countOfOrgMembers(orgId);
-        currentPlan.membersUsed = membersUsed;
-        const identityUsed = await licenseDAL.countOrgUsersAndIdentities(orgId);
-        currentPlan.identitiesUsed = identityUsed;
-
         await keyStore.setItemWithExpiry(
           FEATURE_CACHE_KEY(org.id),
           LICENSE_SERVER_CLOUD_PLAN_TTL,

backend/src/ee/services/permission/default-roles.ts

@@ -5,7 +5,6 @@ import {
   ProjectPermissionApprovalActions,
   ProjectPermissionCertificateActions,
   ProjectPermissionCmekActions,
-  ProjectPermissionCommitsActions,
   ProjectPermissionDynamicSecretActions,
   ProjectPermissionGroupActions,
   ProjectPermissionIdentityActions,
@@ -62,8 +61,7 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionApprovalActions.Edit,
       ProjectPermissionApprovalActions.Create,
       ProjectPermissionApprovalActions.Delete,
-      ProjectPermissionApprovalActions.AllowChangeBypass,
-      ProjectPermissionApprovalActions.AllowAccessBypass
+      ProjectPermissionApprovalActions.AllowChangeBypass
     ],
     ProjectPermissionSub.SecretApproval
   );
@@ -79,11 +77,6 @@ const buildAdminPermissionRules = () => {
     ProjectPermissionSub.Certificates
   );
 
-  can(
-    [ProjectPermissionCommitsActions.Read, ProjectPermissionCommitsActions.PerformRollback],
-    ProjectPermissionSub.Commits
-  );
-
   can(
     [
       ProjectPermissionSshHostActions.Edit,
@@ -261,11 +254,6 @@ const buildMemberPermissionRules = () => {
     ProjectPermissionSub.SecretImports
   );
 
-  can(
-    [ProjectPermissionCommitsActions.Read, ProjectPermissionCommitsActions.PerformRollback],
-    ProjectPermissionSub.Commits
-  );
-
   can([ProjectPermissionApprovalActions.Read], ProjectPermissionSub.SecretApproval);
   can([ProjectPermissionSecretRotationActions.Read], ProjectPermissionSub.SecretRotation);
 
@@ -435,7 +423,6 @@ const buildViewerPermissionRules = () => {
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificates);
   can(ProjectPermissionActions.Read, ProjectPermissionSub.SshCertificateTemplates);
   can(ProjectPermissionSecretSyncActions.Read, ProjectPermissionSub.SecretSyncs);
-  can(ProjectPermissionCommitsActions.Read, ProjectPermissionSub.Commits);
 
   return rules;
 };

backend/src/ee/services/permission/project-permission.ts

@@ -17,11 +17,6 @@ export enum ProjectPermissionActions {
   Delete = "delete"
 }
 
-export enum ProjectPermissionCommitsActions {
-  Read = "read",
-  PerformRollback = "perform-rollback"
-}
-
 export enum ProjectPermissionCertificateActions {
   Read = "read",
   Create = "create",
@@ -44,8 +39,7 @@ export enum ProjectPermissionApprovalActions {
   Create = "create",
   Edit = "edit",
   Delete = "delete",
-  AllowChangeBypass = "allow-change-bypass",
-  AllowAccessBypass = "allow-access-bypass"
+  AllowChangeBypass = "allow-change-bypass"
 }
 
 export enum ProjectPermissionCmekActions {
@@ -157,7 +151,6 @@ export enum ProjectPermissionSub {
   SecretRollback = "secret-rollback",
   SecretApproval = "secret-approval",
   SecretRotation = "secret-rotation",
-  Commits = "commits",
   Identity = "identity",
   CertificateAuthorities = "certificate-authorities",
   Certificates = "certificates",
@@ -296,8 +289,7 @@ export type ProjectPermissionSet =
   | [ProjectPermissionActions.Edit, ProjectPermissionSub.Project]
   | [ProjectPermissionActions.Read, ProjectPermissionSub.SecretRollback]
   | [ProjectPermissionActions.Create, ProjectPermissionSub.SecretRollback]
-  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms]
-  | [ProjectPermissionCommitsActions, ProjectPermissionSub.Commits];
+  | [ProjectPermissionActions.Edit, ProjectPermissionSub.Kms];
 
 const SECRET_PATH_MISSING_SLASH_ERR_MSG = "Invalid Secret Path; it must start with a '/'";
 const SECRET_PATH_PERMISSION_OPERATOR_SCHEMA = z.union([
@@ -618,12 +610,6 @@ const GeneralPermissionSchema = [
     action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionKmipActions).describe(
       "Describe what action an entity can take."
     )
-  }),
-  z.object({
-    subject: z.literal(ProjectPermissionSub.Commits).describe("The entity this permission pertains to."),
-    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionCommitsActions).describe(
-      "Describe what action an entity can take."
-    )
   })
 ];
 

backend/src/ee/services/pit/pit-service.ts

@@ -1,485 +0,0 @@
-/* eslint-disable no-await-in-loop */
-import { ForbiddenError } from "@casl/ability";
-
-import { ActionProjectType } from "@app/db/schemas";
-import { ProjectPermissionCommitsActions, ProjectPermissionSub } from "@app/ee/services/permission/project-permission";
-import { NotFoundError } from "@app/lib/errors";
-import { logger } from "@app/lib/logger";
-import { ActorAuthMethod, ActorType } from "@app/services/auth/auth-type";
-import { ResourceType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import {
-  isFolderCommitChange,
-  isSecretCommitChange
-} from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { TProjectEnvDALFactory } from "@app/services/project-env/project-env-dal";
-import { TSecretServiceFactory } from "@app/services/secret/secret-service";
-import { TSecretFolderDALFactory } from "@app/services/secret-folder/secret-folder-dal";
-import { TSecretFolderServiceFactory } from "@app/services/secret-folder/secret-folder-service";
-
-import { TPermissionServiceFactory } from "../permission/permission-service";
-
-type TPitServiceFactoryDep = {
-  folderCommitService: TFolderCommitServiceFactory;
-  secretService: Pick<TSecretServiceFactory, "getSecretVersionsV2ByIds" | "getChangeVersions">;
-  folderService: Pick<TSecretFolderServiceFactory, "getFolderById" | "getFolderVersions">;
-  permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
-  folderDAL: Pick<TSecretFolderDALFactory, "findSecretPathByFolderIds">;
-  projectEnvDAL: Pick<TProjectEnvDALFactory, "findOne">;
-};
-
-export type TPitServiceFactory = ReturnType<typeof pitServiceFactory>;
-
-export const pitServiceFactory = ({
-  folderCommitService,
-  secretService,
-  folderService,
-  permissionService,
-  folderDAL,
-  projectEnvDAL
-}: TPitServiceFactoryDep) => {
-  const getCommitsCount = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    environment,
-    path
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    environment: string;
-    path: string;
-  }) => {
-    const result = await folderCommitService.getCommitsCount({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      environment,
-      path
-    });
-
-    return result;
-  };
-
-  const getCommitsForFolder = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    environment,
-    path,
-    offset,
-    limit,
-    search,
-    sort
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    environment: string;
-    path: string;
-    offset: number;
-    limit: number;
-    search?: string;
-    sort: "asc" | "desc";
-  }) => {
-    const result = await folderCommitService.getCommitsForFolder({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      environment,
-      path,
-      offset,
-      limit,
-      search,
-      sort
-    });
-
-    return {
-      commits: result.commits.map((commit) => ({
-        ...commit,
-        commitId: commit.commitId.toString()
-      })),
-      total: result.total,
-      hasMore: result.hasMore
-    };
-  };
-
-  const getCommitChanges = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const changes = await folderCommitService.getCommitChanges({
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId,
-      commitId
-    });
-
-    const [folderWithPath] = await folderDAL.findSecretPathByFolderIds(projectId, [changes.folderId]);
-
-    for (const change of changes.changes) {
-      if (isSecretCommitChange(change)) {
-        change.versions = await secretService.getChangeVersions(
-          {
-            secretVersion: change.secretVersion,
-            secretId: change.secretId,
-            id: change.id,
-            isUpdate: change.isUpdate,
-            changeType: change.changeType
-          },
-          (Number.parseInt(change.secretVersion, 10) - 1).toString(),
-          actorId,
-          actor,
-          actorOrgId,
-          actorAuthMethod,
-          changes.envId,
-          projectId,
-          folderWithPath?.path || ""
-        );
-      } else if (isFolderCommitChange(change)) {
-        change.versions = await folderService.getFolderVersions(
-          change,
-          (Number.parseInt(change.folderVersion, 10) - 1).toString(),
-          change.folderChangeId
-        );
-      }
-    }
-
-    return {
-      changes: {
-        ...changes,
-        commitId: changes.commitId.toString()
-      }
-    };
-  };
-
-  const compareCommitChanges = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId,
-    folderId,
-    environment,
-    deepRollback,
-    secretPath
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-    folderId: string;
-    environment: string;
-    deepRollback: boolean;
-    secretPath: string;
-  }) => {
-    const latestCommit = await folderCommitService.getLatestCommit({
-      folderId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    const targetCommit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    const env = await projectEnvDAL.findOne({
-      projectId,
-      slug: environment
-    });
-
-    if (!latestCommit) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    let diffs;
-    if (deepRollback) {
-      diffs = await folderCommitService.deepCompareFolder({
-        targetCommitId: targetCommit.id,
-        envId: env.id,
-        projectId
-      });
-    } else {
-      const folderData = await folderService.getFolderById({
-        actor,
-        actorId,
-        actorOrgId,
-        actorAuthMethod,
-        id: folderId
-      });
-
-      diffs = [
-        {
-          folderId: folderData.id,
-          folderName: folderData.name,
-          folderPath: secretPath,
-          changes: await folderCommitService.compareFolderStates({
-            targetCommitId: commitId,
-            currentCommitId: latestCommit.id
-          })
-        }
-      ];
-    }
-
-    for (const diff of diffs) {
-      for (const change of diff.changes) {
-        // Use discriminated union type checking
-        if (change.type === ResourceType.SECRET) {
-          // TypeScript now knows this is a SecretChange
-          if (change.secretKey && change.secretVersion && change.secretId) {
-            change.versions = await secretService.getChangeVersions(
-              {
-                secretVersion: change.secretVersion,
-                secretId: change.secretId,
-                id: change.id,
-                isUpdate: change.isUpdate,
-                changeType: change.changeType
-              },
-              change.fromVersion || "1",
-              actorId,
-              actor,
-              actorOrgId,
-              actorAuthMethod,
-              env.id,
-              projectId,
-              diff.folderPath || ""
-            );
-          }
-        } else if (change.type === ResourceType.FOLDER) {
-          // TypeScript now knows this is a FolderChange
-          if (change.folderVersion) {
-            change.versions = await folderService.getFolderVersions(change, change.fromVersion || "1", change.id);
-          }
-        }
-      }
-    }
-
-    return diffs;
-  };
-
-  const rollbackToCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId,
-    folderId,
-    deepRollback,
-    message,
-    environment
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-    folderId: string;
-    deepRollback: boolean;
-    message?: string;
-    environment: string;
-  }) => {
-    const { permission: userPermission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.SecretManager
-    });
-
-    ForbiddenError.from(userPermission).throwUnlessCan(
-      ProjectPermissionCommitsActions.PerformRollback,
-      ProjectPermissionSub.Commits
-    );
-
-    const latestCommit = await folderCommitService.getLatestCommit({
-      folderId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    if (!latestCommit) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    logger.info(`PIT - Attempting to rollback folder ${folderId} from commit ${latestCommit.id} to commit ${commitId}`);
-
-    const targetCommit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorAuthMethod,
-      actorOrgId,
-      projectId
-    });
-
-    const env = await projectEnvDAL.findOne({
-      projectId,
-      slug: environment
-    });
-
-    if (!targetCommit || targetCommit.folderId !== folderId || targetCommit.envId !== env.id) {
-      throw new NotFoundError({ message: "Target commit not found" });
-    }
-
-    if (!latestCommit || latestCommit.envId !== env.id) {
-      throw new NotFoundError({ message: "Latest commit not found" });
-    }
-
-    if (deepRollback) {
-      await folderCommitService.deepRollbackFolder(commitId, env.id, actorId, actor, projectId, message);
-      return { success: true };
-    }
-
-    const diff = await folderCommitService.compareFolderStates({
-      currentCommitId: latestCommit.id,
-      targetCommitId: commitId
-    });
-
-    const response = await folderCommitService.applyFolderStateDifferences({
-      differences: diff,
-      actorInfo: {
-        actorType: actor,
-        actorId,
-        message: message || "Rollback to previous commit"
-      },
-      folderId,
-      projectId,
-      reconstructNewFolders: deepRollback
-    });
-
-    return {
-      success: true,
-      secretChangesCount: response.secretChangesCount,
-      folderChangesCount: response.folderChangesCount,
-      totalChanges: response.totalChanges
-    };
-  };
-
-  const revertCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const response = await folderCommitService.revertCommitChanges({
-      commitId,
-      actor,
-      actorId,
-      actorAuthMethod,
-      actorOrgId,
-      projectId
-    });
-
-    return response;
-  };
-
-  const getFolderStateAtCommit = async ({
-    actor,
-    actorId,
-    actorOrgId,
-    actorAuthMethod,
-    projectId,
-    commitId
-  }: {
-    actor: ActorType;
-    actorId: string;
-    actorOrgId: string;
-    actorAuthMethod: ActorAuthMethod;
-    projectId: string;
-    commitId: string;
-  }) => {
-    const commit = await folderCommitService.getCommitById({
-      commitId,
-      actor,
-      actorId,
-      actorOrgId,
-      actorAuthMethod,
-      projectId
-    });
-
-    if (!commit) {
-      throw new NotFoundError({ message: `Commit with ID ${commitId} not found` });
-    }
-
-    const response = await folderCommitService.reconstructFolderState(commitId);
-
-    return response.map((item) => {
-      if (item.type === ResourceType.SECRET) {
-        return {
-          ...item,
-          secretVersion: Number(item.secretVersion)
-        };
-      }
-
-      if (item.type === ResourceType.FOLDER) {
-        return {
-          ...item,
-          folderVersion: Number(item.folderVersion)
-        };
-      }
-
-      return item;
-    });
-  };
-
-  return {
-    getCommitsCount,
-    getCommitsForFolder,
-    getCommitChanges,
-    compareCommitChanges,
-    rollbackToCommit,
-    revertCommit,
-    getFolderStateAtCommit
-  };
-};

backend/src/ee/services/secret-approval-request/secret-approval-request-service.ts

@@ -20,7 +20,6 @@ import { EnforcementLevel } from "@app/lib/types";
 import { triggerWorkflowIntegrationNotification } from "@app/lib/workflow-integrations/trigger-notification";
 import { TriggerFeature } from "@app/lib/workflow-integrations/types";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TMicrosoftTeamsServiceFactory } from "@app/services/microsoft-teams/microsoft-teams-service";
@@ -135,7 +134,6 @@ type TSecretApprovalRequestServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   projectMicrosoftTeamsConfigDAL: Pick<TProjectMicrosoftTeamsConfigDALFactory, "getIntegrationDetailsByProject">;
   microsoftTeamsService: Pick<TMicrosoftTeamsServiceFactory, "sendNotification">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretApprovalRequestServiceFactory = ReturnType<typeof secretApprovalRequestServiceFactory>;
@@ -167,8 +165,7 @@ export const secretApprovalRequestServiceFactory = ({
   projectSlackConfigDAL,
   resourceMetadataDAL,
   projectMicrosoftTeamsConfigDAL,
-  microsoftTeamsService,
-  folderCommitService
+  microsoftTeamsService
 }: TSecretApprovalRequestServiceFactoryDep) => {
   const requestCount = async ({ projectId, actor, actorId, actorOrgId, actorAuthMethod }: TApprovalRequestCountDTO) => {
     if (actor === ActorType.SERVICE) throw new BadRequestError({ message: "Cannot use service token" });
@@ -609,10 +606,6 @@ export const secretApprovalRequestServiceFactory = ({
           ? await fnSecretV2BridgeBulkInsert({
               tx,
               folderId,
-              actor: {
-                actorId,
-                type: actor
-              },
               orgId: actorOrgId,
               inputSecrets: secretCreationCommits.map((el) => ({
                 tagIds: el?.tags.map(({ id }) => id),
@@ -635,18 +628,13 @@ export const secretApprovalRequestServiceFactory = ({
               secretDAL: secretV2BridgeDAL,
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretTagDAL,
-              secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              folderCommitService
+              secretVersionTagDAL: secretVersionTagV2BridgeDAL
             })
           : [];
         const updatedSecrets = secretUpdationCommits.length
           ? await fnSecretV2BridgeBulkUpdate({
               folderId,
               orgId: actorOrgId,
-              actor: {
-                actorId,
-                type: actor
-              },
               tx,
               inputSecrets: secretUpdationCommits.map((el) => {
                 const encryptedValue =
@@ -680,8 +668,7 @@ export const secretApprovalRequestServiceFactory = ({
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretTagDAL,
               secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              resourceMetadataDAL,
-              folderCommitService
+              resourceMetadataDAL
             })
           : [];
         const deletedSecret = secretDeletionCommits.length
@@ -689,13 +676,10 @@ export const secretApprovalRequestServiceFactory = ({
               projectId,
               folderId,
               tx,
-              actorId,
-              actorType: actor,
+              actorId: "",
               secretDAL: secretV2BridgeDAL,
               secretQueueService,
-              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared })),
-              folderCommitService,
-              secretVersionDAL: secretVersionV2BridgeDAL
+              inputSecrets: secretDeletionCommits.map(({ key }) => ({ secretKey: key, type: SecretType.Shared }))
             })
           : [];
         const updatedSecretApproval = await secretApprovalRequestDAL.updateById(

backend/src/ee/services/secret-replication/secret-replication-service.ts

@@ -10,7 +10,6 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -88,7 +87,6 @@ type TSecretReplicationServiceFactoryDep = {
 
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretReplicationServiceFactory = ReturnType<typeof secretReplicationServiceFactory>;
@@ -134,7 +132,6 @@ export const secretReplicationServiceFactory = ({
   secretVersionV2BridgeDAL,
   secretV2BridgeDAL,
   kmsService,
-  folderCommitService,
   resourceMetadataDAL
 }: TSecretReplicationServiceFactoryDep) => {
   const $getReplicatedSecrets = (
@@ -422,7 +419,7 @@ export const secretReplicationServiceFactory = ({
                     return {
                       op: operation,
                       requestId: approvalRequestDoc.id,
-                      metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                      metadata: doc.metadata,
                       secretMetadata: JSON.stringify(doc.secretMetadata),
                       key: doc.key,
                       encryptedValue: doc.encryptedValue,
@@ -449,12 +446,11 @@ export const secretReplicationServiceFactory = ({
                     tx,
                     secretTagDAL,
                     resourceMetadataDAL,
-                    folderCommitService,
                     secretVersionTagDAL: secretVersionV2TagBridgeDAL,
                     inputSecrets: locallyCreatedSecrets.map((doc) => {
                       return {
                         type: doc.type,
-                        metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                        metadata: doc.metadata,
                         key: doc.key,
                         encryptedValue: doc.encryptedValue,
                         encryptedComment: doc.encryptedComment,
@@ -470,7 +466,6 @@ export const secretReplicationServiceFactory = ({
                     orgId,
                     folderId: destinationReplicationFolderId,
                     secretVersionDAL: secretVersionV2BridgeDAL,
-                    folderCommitService,
                     secretDAL: secretV2BridgeDAL,
                     tx,
                     resourceMetadataDAL,
@@ -484,7 +479,7 @@ export const secretReplicationServiceFactory = ({
                         },
                         data: {
                           type: doc.type,
-                          metadata: doc.metadata ? JSON.stringify(doc.metadata) : [],
+                          metadata: doc.metadata,
                           key: doc.key,
                           encryptedValue: doc.encryptedValue as Buffer,
                           encryptedComment: doc.encryptedComment,

backend/src/ee/services/secret-rotation-v2/secret-rotation-v2-service.ts

@@ -63,7 +63,6 @@ import { TAppConnectionDALFactory } from "@app/services/app-connection/app-conne
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
 import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
 import { ActorType } from "@app/services/auth/auth-type";
-import { TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -99,7 +98,7 @@ export type TSecretRotationV2ServiceFactoryDep = {
     TSecretV2BridgeDALFactory,
     "bulkUpdate" | "insertMany" | "deleteMany" | "upsertSecretReferences" | "find" | "invalidateSecretCacheByProjectId"
   >;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany">;
   secretVersionTagV2BridgeDAL: Pick<TSecretVersionV2TagDALFactory, "insertMany">;
   resourceMetadataDAL: Pick<TResourceMetadataDALFactory, "insertMany" | "delete">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecretV2" | "deleteTagsToSecretV2" | "find">;
@@ -107,7 +106,6 @@ export type TSecretRotationV2ServiceFactoryDep = {
   snapshotService: Pick<TSecretSnapshotServiceFactory, "performSnapshot">;
   queueService: Pick<TQueueServiceFactory, "queuePg">;
   appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update" | "updateById">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretRotationV2ServiceFactory = ReturnType<typeof secretRotationV2ServiceFactory>;
@@ -146,7 +144,6 @@ export const secretRotationV2ServiceFactory = ({
   snapshotService,
   keyStore,
   queueService,
-  folderCommitService,
   appConnectionDAL
 }: TSecretRotationV2ServiceFactoryDep) => {
   const $queueSendSecretRotationStatusNotification = async (secretRotation: TSecretRotationV2Raw) => {
@@ -540,12 +537,7 @@ export const secretRotationV2ServiceFactory = ({
             secretVersionDAL: secretVersionV2BridgeDAL,
             secretVersionTagDAL: secretVersionTagV2BridgeDAL,
             secretTagDAL,
-            folderCommitService,
-            resourceMetadataDAL,
-            actor: {
-              type: actor.type,
-              actorId: actor.id
-            }
+            resourceMetadataDAL
           });
 
           await secretRotationV2DAL.insertSecretMappings(
@@ -681,12 +673,7 @@ export const secretRotationV2ServiceFactory = ({
             secretVersionDAL: secretVersionV2BridgeDAL,
             secretVersionTagDAL: secretVersionTagV2BridgeDAL,
             secretTagDAL,
-            folderCommitService,
-            resourceMetadataDAL,
-            actor: {
-              type: actor.type,
-              actorId: actor.id
-            }
+            resourceMetadataDAL
           });
 
           secretsMappingUpdated = true;
@@ -804,9 +791,6 @@ export const secretRotationV2ServiceFactory = ({
             projectId,
             folderId,
             actorId: actor.id, // not actually used since rotated secrets are shared
-            actorType: actor.type,
-            folderCommitService,
-            secretVersionDAL: secretVersionV2BridgeDAL,
             tx
           });
         }
@@ -950,10 +934,6 @@ export const secretRotationV2ServiceFactory = ({
               secretDAL: secretV2BridgeDAL,
               secretVersionDAL: secretVersionV2BridgeDAL,
               secretVersionTagDAL: secretVersionTagV2BridgeDAL,
-              folderCommitService,
-              actor: {
-                type: ActorType.PLATFORM
-              },
               secretTagDAL,
               resourceMetadataDAL
             });

backend/src/ee/services/secret-rotation/secret-rotation-queue/secret-rotation-queue.ts

@@ -14,7 +14,6 @@ import { logger } from "@app/lib/logger";
 import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { ActorType } from "@app/services/auth/auth-type";
-import { CommitType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -54,7 +53,6 @@ type TSecretRotationQueueFactoryDep = {
   secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionMany">;
   telemetryService: Pick<TTelemetryServiceFactory, "sendPostHogEvents">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 // These error should stop the repeatable job and ask user to reconfigure rotation
@@ -79,7 +77,6 @@ export const secretRotationQueueFactory = ({
   telemetryService,
   secretV2BridgeDAL,
   secretVersionV2BridgeDAL,
-  folderCommitService,
   kmsService
 }: TSecretRotationQueueFactoryDep) => {
   const addToQueue = async (rotationId: string, interval: number) => {
@@ -333,7 +330,7 @@ export const secretRotationQueueFactory = ({
             })),
             tx
           );
-          const secretVersions = await secretVersionV2BridgeDAL.insertMany(
+          await secretVersionV2BridgeDAL.insertMany(
             updatedSecrets.map(({ id, updatedAt, createdAt, ...el }) => ({
               ...el,
               actorType: ActorType.PLATFORM,
@@ -341,22 +338,6 @@ export const secretRotationQueueFactory = ({
             })),
             tx
           );
-
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: ActorType.PLATFORM
-              },
-              message: "Changed by Secret rotation",
-              folderId: secretVersions[0].folderId,
-              changes: secretVersions.map((sv) => ({
-                type: CommitType.ADD,
-                isUpdate: true,
-                secretVersionId: sv.id
-              }))
-            },
-            tx
-          );
         });
 
         await secretV2BridgeDAL.invalidateSecretCacheByProjectId(secretRotation.projectId);

backend/src/ee/services/secret-snapshot/secret-snapshot-service.ts

@@ -8,7 +8,6 @@ import { InternalServerError, NotFoundError } from "@app/lib/errors";
 import { groupBy } from "@app/lib/fn";
 import { logger } from "@app/lib/logger";
 import { ActorType } from "@app/services/auth/auth-type";
-import { CommitType, TFolderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { KmsDataKey } from "@app/services/kms/kms-types";
 import { TProjectBotServiceFactory } from "@app/services/project-bot/project-bot-service";
@@ -52,8 +51,8 @@ type TSecretSnapshotServiceFactoryDep = {
   snapshotSecretV2BridgeDAL: TSnapshotSecretV2DALFactory;
   snapshotFolderDAL: TSnapshotFolderDALFactory;
   secretVersionDAL: Pick<TSecretVersionDALFactory, "insertMany" | "findLatestVersionByFolderId">;
-  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionByFolderId" | "findOne">;
-  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestVersionByFolderId" | "insertMany" | "findOne">;
+  secretVersionV2BridgeDAL: Pick<TSecretVersionV2DALFactory, "insertMany" | "findLatestVersionByFolderId">;
+  folderVersionDAL: Pick<TSecretFolderVersionDALFactory, "findLatestVersionByFolderId" | "insertMany">;
   secretDAL: Pick<TSecretDALFactory, "delete" | "insertMany">;
   secretV2BridgeDAL: Pick<TSecretV2BridgeDALFactory, "delete" | "insertMany">;
   secretTagDAL: Pick<TSecretTagDALFactory, "saveTagsToSecret" | "saveTagsToSecretV2">;
@@ -64,7 +63,6 @@ type TSecretSnapshotServiceFactoryDep = {
   licenseService: Pick<TLicenseServiceFactory, "isValidLicense">;
   kmsService: Pick<TKmsServiceFactory, "createCipherPairWithDataKey">;
   projectBotService: Pick<TProjectBotServiceFactory, "getBotKey">;
-  folderCommitService: Pick<TFolderCommitServiceFactory, "createCommit">;
 };
 
 export type TSecretSnapshotServiceFactory = ReturnType<typeof secretSnapshotServiceFactory>;
@@ -86,8 +84,7 @@ export const secretSnapshotServiceFactory = ({
   snapshotSecretV2BridgeDAL,
   secretVersionV2TagBridgeDAL,
   kmsService,
-  projectBotService,
-  folderCommitService
+  projectBotService
 }: TSecretSnapshotServiceFactoryDep) => {
   const projectSecretSnapshotCount = async ({
     environment,
@@ -406,18 +403,6 @@ export const secretSnapshotServiceFactory = ({
           .filter((el) => el.isRotatedSecret)
           .map((el) => el.secretId);
 
-        const deletedSecretsChanges = new Map(); // secretId -> version info
-        const deletedFoldersChanges = new Map(); // folderId -> version info
-        const addedSecretsChanges = new Map(); // secretId -> version info
-        const addedFoldersChanges = new Map(); // folderId -> version info
-        const commitChanges: {
-          type: string;
-          secretVersionId?: string;
-          folderVersionId?: string;
-          isUpdate?: boolean;
-          folderId?: string;
-        }[] = [];
-
         // this will remove all secrets in current folder except rotated secrets which we ignore
         const deletedTopLevelSecs = await secretV2BridgeDAL.delete(
           {
@@ -439,35 +424,7 @@ export const secretSnapshotServiceFactory = ({
           },
           tx
         );
-
-        await Promise.all(
-          deletedTopLevelSecs.map(async (sec) => {
-            const version = await secretVersionV2BridgeDAL.findOne({ secretId: sec.id, version: sec.version }, tx);
-            deletedSecretsChanges.set(sec.id, {
-              id: sec.id,
-              version: sec.version,
-              // Store the version ID if available from the snapshot
-              versionId: version?.id
-            });
-          })
-        );
-
         const deletedTopLevelSecsGroupById = groupBy(deletedTopLevelSecs, (item) => item.id);
-
-        const deletedFoldersData = await folderDAL.delete({ parentId: snapshot.folderId, isReserved: false }, tx);
-
-        await Promise.all(
-          deletedFoldersData.map(async (folder) => {
-            const version = await folderVersionDAL.findOne({ folderId: folder.id, version: folder.version }, tx);
-            deletedFoldersChanges.set(folder.id, {
-              id: folder.id,
-              version: folder.version,
-              // Store the version ID if available
-              versionId: version?.id
-            });
-          })
-        );
-
         // this will remove all secrets and folders on child
         // due to sql foreign key and link list connection removing the folders removes everything below too
         const deletedFolders = await folderDAL.delete({ parentId: snapshot.folderId, isReserved: false }, tx);
@@ -532,21 +489,14 @@ export const secretSnapshotServiceFactory = ({
         });
         await secretTagDAL.saveTagsToSecretV2(secretTagsToBeInsert, tx);
         const folderVersions = await folderVersionDAL.insertMany(
-          folders.map(({ version, name, id, envId, description }) => ({
+          folders.map(({ version, name, id, envId }) => ({
             name,
             version,
             folderId: id,
-            envId,
-            description
+            envId
           })),
           tx
         );
-
-        // Track added folders
-        folderVersions.forEach((fv) => {
-          addedFoldersChanges.set(fv.folderId, fv);
-        });
-
         const userActorId = actor === ActorType.USER ? actorId : undefined;
         const identityActorId = actor !== ActorType.USER ? actorId : undefined;
         const actorType = actor || ActorType.PLATFORM;
@@ -561,11 +511,6 @@ export const secretSnapshotServiceFactory = ({
           })),
           tx
         );
-
-        secretVersions.forEach((sv) => {
-          addedSecretsChanges.set(sv.secretId, sv);
-        });
-
         await secretVersionV2TagBridgeDAL.insertMany(
           secretVersions.flatMap(({ secretId, id }) =>
             secretVerTagToBeInsert?.[secretId]?.length
@@ -577,70 +522,6 @@ export const secretSnapshotServiceFactory = ({
           ),
           tx
         );
-
-        // Compute commit changes
-        // Handle secrets
-        deletedSecretsChanges.forEach((deletedInfo, secretId) => {
-          const addedSecret = addedSecretsChanges.get(secretId);
-          if (addedSecret) {
-            // Secret was deleted and re-added - this is an update only if versions are different
-            if (deletedInfo.versionId !== addedSecret.id) {
-              commitChanges.push({
-                type: CommitType.ADD, // In the commit system, updates are tracked as "add" with isUpdate=true
-                secretVersionId: addedSecret.id,
-                isUpdate: true
-              });
-            }
-            // Remove from addedSecrets since we've handled it
-            addedSecretsChanges.delete(secretId);
-          } else if (deletedInfo.versionId) {
-            // Secret was only deleted
-            commitChanges.push({
-              type: CommitType.DELETE,
-              secretVersionId: deletedInfo.versionId
-            });
-          }
-        });
-        // Add remaining new secrets (not updates)
-        addedSecretsChanges.forEach((addedSecret) => {
-          commitChanges.push({
-            type: CommitType.ADD,
-            secretVersionId: addedSecret.id
-          });
-        });
-
-        // Handle folders
-        deletedFoldersChanges.forEach((deletedInfo, folderId) => {
-          const addedFolder = addedFoldersChanges.get(folderId);
-          if (addedFolder) {
-            // Folder was deleted and re-added - this is an update only if versions are different
-            if (deletedInfo.versionId !== addedFolder.id) {
-              commitChanges.push({
-                type: CommitType.ADD,
-                folderVersionId: addedFolder.id,
-                isUpdate: true
-              });
-            }
-            // Remove from addedFolders since we've handled it
-            addedFoldersChanges.delete(folderId);
-          } else if (deletedInfo.versionId) {
-            // Folder was only deleted
-            commitChanges.push({
-              type: CommitType.DELETE,
-              folderVersionId: deletedInfo.versionId,
-              folderId: deletedInfo.id
-            });
-          }
-        });
-
-        // Add remaining new folders (not updates)
-        addedFoldersChanges.forEach((addedFolder) => {
-          commitChanges.push({
-            type: CommitType.ADD,
-            folderVersionId: addedFolder.id
-          });
-        });
-
         const newSnapshot = await snapshotDAL.create(
           {
             folderId: snapshot.folderId,
@@ -669,22 +550,6 @@ export const secretSnapshotServiceFactory = ({
             })),
           tx
         );
-        if (commitChanges.length > 0) {
-          await folderCommitService.createCommit(
-            {
-              actor: {
-                type: actorType,
-                metadata: {
-                  id: userActorId || identityActorId
-                }
-              },
-              message: "Rollback to snapshot",
-              folderId: snapshot.folderId,
-              changes: commitChanges
-            },
-            tx
-          );
-        }
 
         return { ...newSnapshot, snapshotSecrets, snapshotFolders };
       });
@@ -744,12 +609,11 @@ export const secretSnapshotServiceFactory = ({
       });
       await secretTagDAL.saveTagsToSecret(secretTagsToBeInsert, tx);
       const folderVersions = await folderVersionDAL.insertMany(
-        folders.map(({ version, name, id, envId, description }) => ({
+        folders.map(({ version, name, id, envId }) => ({
           name,
           version,
           folderId: id,
-          envId,
-          description
+          envId
         })),
         tx
       );

backend/src/keystore/keystore.ts

@@ -27,7 +27,6 @@ export const KeyStorePrefixes = {
   KmsOrgDataKeyCreation: "kms-org-data-key-creation-lock",
   WaitUntilReadyKmsOrgKeyCreation: "wait-until-ready-kms-org-key-creation-",
   WaitUntilReadyKmsOrgDataKeyCreation: "wait-until-ready-kms-org-data-key-creation-",
-  FolderTreeCheckpoint: (envId: string) => `folder-tree-checkpoint-${envId}`,
 
   WaitUntilReadyProjectEnvironmentOperation: (projectId: string) =>
     `wait-until-ready-project-environments-operation-${projectId}`,
@@ -38,8 +37,6 @@ export const KeyStorePrefixes = {
     `sync-integration-last-run-${projectId}-${environmentSlug}-${secretPath}` as const,
   SecretSyncLock: (syncId: string) => `secret-sync-mutex-${syncId}` as const,
   SecretRotationLock: (rotationId: string) => `secret-rotation-v2-mutex-${rotationId}` as const,
-  CaOrderCertificateForSubscriberLock: (subscriberId: string) =>
-    `ca-order-certificate-for-subscriber-lock-${subscriberId}` as const,
   SecretSyncLastRunTimestamp: (syncId: string) => `secret-sync-last-run-${syncId}` as const,
   IdentityAccessTokenStatusUpdate: (identityAccessTokenId: string) =>
     `identity-access-token-status:${identityAccessTokenId}`,

backend/src/lib/api-docs/constants.ts

@@ -5,8 +5,6 @@ import {
 } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-maps";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-import { CERTIFICATE_AUTHORITIES_TYPE_MAP } from "@app/services/certificate-authority/certificate-authority-maps";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 import { SECRET_SYNC_CONNECTION_MAP, SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
 
@@ -1709,19 +1707,6 @@ export const CERTIFICATES = {
     certificateChain: "The certificate chain of the certificate.",
     serialNumberRes: "The serial number of the certificate.",
     privateKey: "The private key of the certificate."
-  },
-  IMPORT: {
-    projectSlug: "Slug of the project to import the certificate into.",
-    certificatePem: "The PEM-encoded leaf certificate.",
-    privateKeyPem: "The PEM-encoded private key corresponding to the certificate.",
-    chainPem: "The PEM-encoded chain of intermediate certificates.",
-    friendlyName: "A friendly name for the certificate.",
-    pkiCollectionId: "The ID of the PKI collection to add the certificate to.",
-
-    certificate: "The issued certificate.",
-    certificateChain: "The certificate chain of the issued certificate.",
-    privateKey: "The private key of the issued certificate.",
-    serialNumber: "The serial number of the issued certificate."
   }
 };
 
@@ -1793,14 +1778,6 @@ export const PKI_SUBSCRIBERS = {
     subscriberName: "The name of the PKI subscriber to get.",
     projectId: "The ID of the project to get the PKI subscriber for."
   },
-  GET_LATEST_CERT_BUNDLE: {
-    subscriberName: "The name of the PKI subscriber to get the active certificate bundle for.",
-    projectId: "The ID of the project to get the active certificate bundle for.",
-    certificate: "The active certificate for the subscriber.",
-    certificateChain: "The certificate chain of the active certificate for the subscriber.",
-    privateKey: "The private key of the active certificate for the subscriber.",
-    serialNumber: "The serial number of the active certificate for the subscriber."
-  },
   CREATE: {
     projectId: "The ID of the project to create the PKI subscriber in.",
     caId: "The ID of the CA that will issue certificates for the PKI subscriber.",
@@ -1811,9 +1788,7 @@ export const PKI_SUBSCRIBERS = {
     subjectAlternativeNames:
       "A list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
     keyUsages: "The key usage extension to be used on certificates issued for this subscriber.",
-    extendedKeyUsages: "The extended key usage extension to be used on certificates issued for this subscriber.",
-    enableAutoRenewal: "Whether or not to enable auto renewal for the PKI subscriber.",
-    autoRenewalPeriodInDays: "The period in days to auto renew the PKI subscriber's certificates."
+    extendedKeyUsages: "The extended key usage extension to be used on certificates issued for this subscriber."
   },
   UPDATE: {
     projectId: "The ID of the project to update the PKI subscriber in.",
@@ -1827,9 +1802,7 @@ export const PKI_SUBSCRIBERS = {
       "A comma-delimited list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
     keyUsages: "The key usage extension to be used on certificates issued for this subscriber to update to.",
     extendedKeyUsages:
-      "The extended key usage extension to be used on certificates issued for this subscriber to update to.",
-    enableAutoRenewal: "Whether or not to enable auto renewal for the PKI subscriber.",
-    autoRenewalPeriodInDays: "The period in days to auto renew the PKI subscriber's certificates."
+      "The extended key usage extension to be used on certificates issued for this subscriber to update to."
   },
   DELETE: {
     subscriberName: "The name of the PKI subscriber to delete.",
@@ -2018,47 +1991,6 @@ export const ProjectTemplates = {
   }
 };
 
-export const CertificateAuthorities = {
-  CREATE: (type: CaType) => ({
-    name: `The name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to create. Must be slug-friendly.`,
-    projectId: `The ID of the project to create the Certificate Authority in.`,
-    enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
-    status: `The status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
-  }),
-  UPDATE: (type: CaType) => ({
-    caId: `The ID of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority to update.`,
-    projectId: `The ID of the project to update the Certificate Authority in.`,
-    name: `The updated name of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority. Must be slug-friendly.`,
-    enableDirectIssuance: `Whether or not to enable direct issuance of certificates for the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`,
-    status: `The updated status of the ${CERTIFICATE_AUTHORITIES_TYPE_MAP[type]} Certificate Authority.`
-  }),
-  CONFIGURATIONS: {
-    ACME: {
-      dnsAppConnectionId: `The ID of the App Connection to use for creating and managing DNS TXT records required for ACME domain validation. This connection must have permissions to create and delete TXT records in your DNS provider (e.g., Route53) for the ACME challenge process.`,
-      directoryUrl: `The directory URL for the ACME Certificate Authority.`,
-      accountEmail: `The email address for the ACME Certificate Authority.`,
-      provider: `The DNS provider for the ACME Certificate Authority.`,
-      hostedZoneId: `The hosted zone ID for the ACME Certificate Authority.`
-    },
-    INTERNAL: {
-      type: "The type of CA to create.",
-      friendlyName: "A friendly name for the CA.",
-      organization: "The organization (O) for the CA.",
-      ou: "The organization unit (OU) for the CA.",
-      country: "The country name (C) for the CA.",
-      province: "The state of province name for the CA.",
-      locality: "The locality name for the CA.",
-      commonName: "The common name (CN) for the CA.",
-      notBefore: "The date and time when the CA becomes valid in YYYY-MM-DDTHH:mm:ss.sssZ format.",
-      notAfter: "The date and time when the CA expires in YYYY-MM-DDTHH:mm:ss.sssZ format.",
-      maxPathLength:
-        "The maximum number of intermediate CAs that may follow this CA in the certificate / CA chain. A maxPathLength of -1 implies no path limit on the chain.",
-      keyAlgorithm:
-        "The type of public key algorithm and size, in bits, of the key pair for the CA; when you create an intermediate CA, you must use a key algorithm supported by the parent CA."
-    }
-  }
-};
-
 export const AppConnections = {
   GET_BY_ID: (app: AppConnection) => ({
     connectionId: `The ID of the ${APP_CONNECTION_NAME_MAP[app]} Connection to retrieve.`
@@ -2152,10 +2084,6 @@ export const AppConnections = {
       region: "The region identifier in Oracle Cloud Infrastructure where the vault is located.",
       fingerprint: "The fingerprint of the public key uploaded to the user's API keys.",
       privateKey: "The private key content in PEM format used to sign API requests."
-    },
-    ONEPASS: {
-      instanceUrl: "The URL of the 1Password Connect Server instance to authenticate with.",
-      apiToken: "The API token used to access the 1Password Connect Server."
     }
   }
 };
@@ -2309,9 +2237,6 @@ export const SecretSyncs = {
       compartmentOcid: "The OCID (Oracle Cloud Identifier) of the compartment where the vault is located.",
       vaultOcid: "The OCID (Oracle Cloud Identifier) of the vault to sync secrets to.",
       keyOcid: "The OCID (Oracle Cloud Identifier) of the encryption key to use when creating secrets in the vault."
-    },
-    ONEPASS: {
-      vaultId: "The ID of the 1Password vault to sync secrets to."
     }
   }
 };

backend/src/lib/config/env.ts

@@ -232,10 +232,6 @@ const envSchema = z
     DATADOG_SERVICE: zpStr(z.string().optional().default("infisical-core")),
     DATADOG_HOSTNAME: zpStr(z.string().optional()),
 
-    // PIT
-    PIT_CHECKPOINT_WINDOW: zpStr(z.string().optional().default("1")),
-    PIT_TREE_CHECKPOINT_WINDOW: zpStr(z.string().optional().default("30")),
-
     /* CORS ----------------------------------------------------------------------------- */
 
     CORS_ALLOWED_ORIGINS: zpStr(

backend/src/queue/queue-service.ts

@@ -14,7 +14,6 @@ import {
 } from "@app/ee/services/secret-scanning/secret-scanning-queue/secret-scanning-queue-types";
 import { getConfig } from "@app/lib/config/env";
 import { logger } from "@app/lib/logger";
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
 import {
   TFailedIntegrationSyncEmailsPayload,
   TIntegrationSyncPayload,
@@ -37,7 +36,6 @@ export enum QueueName {
   AuditLogPrune = "audit-log-prune",
   DailyResourceCleanUp = "daily-resource-cleanup",
   DailyExpiringPkiItemAlert = "daily-expiring-pki-item-alert",
-  PkiSubscriber = "pki-subscriber",
   TelemetryInstanceStats = "telemtry-self-hosted-stats",
   IntegrationSync = "sync-integrations",
   SecretWebhook = "secret-webhook",
@@ -46,7 +44,6 @@ export enum QueueName {
   UpgradeProjectToGhost = "upgrade-project-to-ghost",
   DynamicSecretRevocation = "dynamic-secret-revocation",
   CaCrlRotation = "ca-crl-rotation",
-  CaLifecycle = "ca-lifecycle", // parent queue to ca-order-certificate-for-subscriber
   SecretReplication = "secret-replication",
   SecretSync = "secret-sync", // parent queue to push integration sync, webhook, and secret replication
   ProjectV3Migration = "project-v3-migration",
@@ -54,7 +51,6 @@ export enum QueueName {
   ImportSecretsFromExternalSource = "import-secrets-from-external-source",
   AppConnectionSecretSync = "app-connection-secret-sync",
   SecretRotationV2 = "secret-rotation-v2",
-  FolderTreeCheckpoint = "folder-tree-checkpoint",
   InvalidateCache = "invalidate-cache"
 }
 
@@ -88,10 +84,7 @@ export enum QueueJobs {
   SecretRotationV2QueueRotations = "secret-rotation-v2-queue-rotations",
   SecretRotationV2RotateSecrets = "secret-rotation-v2-rotate-secrets",
   SecretRotationV2SendNotification = "secret-rotation-v2-send-notification",
-  CreateFolderTreeCheckpoint = "create-folder-tree-checkpoint",
-  InvalidateCache = "invalidate-cache",
-  CaOrderCertificateForSubscriber = "ca-order-certificate-for-subscriber",
-  PkiSubscriberDailyAutoRenewal = "pki-subscriber-daily-auto-renewal"
+  InvalidateCache = "invalidate-cache"
 }
 
 export type TQueueJobTypes = {
@@ -201,12 +194,6 @@ export type TQueueJobTypes = {
     name: QueueJobs.ProjectV3Migration;
     payload: { projectId: string };
   };
-  [QueueName.FolderTreeCheckpoint]: {
-    name: QueueJobs.CreateFolderTreeCheckpoint;
-    payload: {
-      envId: string;
-    };
-  };
   [QueueName.ImportSecretsFromExternalSource]: {
     name: QueueJobs.ImportSecretsFromExternalSource;
     payload: {
@@ -258,17 +245,6 @@ export type TQueueJobTypes = {
       };
     };
   };
-  [QueueName.CaLifecycle]: {
-    name: QueueJobs.CaOrderCertificateForSubscriber;
-    payload: {
-      subscriberId: string;
-      caType: CaType;
-    };
-  };
-  [QueueName.PkiSubscriber]: {
-    name: QueueJobs.PkiSubscriberDailyAutoRenewal;
-    payload: undefined;
-  };
 };
 
 export type TQueueServiceFactory = ReturnType<typeof queueServiceFactory>;

backend/src/server/routes/index.ts

@@ -57,7 +57,6 @@ import { oidcConfigDALFactory } from "@app/ee/services/oidc/oidc-config-dal";
 import { oidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { permissionDALFactory } from "@app/ee/services/permission/permission-dal";
 import { permissionServiceFactory } from "@app/ee/services/permission/permission-service";
-import { pitServiceFactory } from "@app/ee/services/pit/pit-service";
 import { projectTemplateDALFactory } from "@app/ee/services/project-template/project-template-dal";
 import { projectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-service";
 import { projectUserAdditionalPrivilegeDALFactory } from "@app/ee/services/project-user-additional-privilege/project-user-additional-privilege-dal";
@@ -133,10 +132,6 @@ import { certificateAuthorityDALFactory } from "@app/services/certificate-author
 import { certificateAuthorityQueueFactory } from "@app/services/certificate-authority/certificate-authority-queue";
 import { certificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { certificateAuthorityServiceFactory } from "@app/services/certificate-authority/certificate-authority-service";
-import { externalCertificateAuthorityDALFactory } from "@app/services/certificate-authority/external-certificate-authority-dal";
-import { internalCertificateAuthorityDALFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-dal";
-import { InternalCertificateAuthorityFns } from "@app/services/certificate-authority/internal/internal-certificate-authority-fns";
-import { internalCertificateAuthorityServiceFactory } from "@app/services/certificate-authority/internal/internal-certificate-authority-service";
 import { certificateTemplateDALFactory } from "@app/services/certificate-template/certificate-template-dal";
 import { certificateTemplateEstConfigDALFactory } from "@app/services/certificate-template/certificate-template-est-config-dal";
 import { certificateTemplateServiceFactory } from "@app/services/certificate-template/certificate-template-service";
@@ -145,14 +140,6 @@ import { externalGroupOrgRoleMappingDALFactory } from "@app/services/external-gr
 import { externalGroupOrgRoleMappingServiceFactory } from "@app/services/external-group-org-role-mapping/external-group-org-role-mapping-service";
 import { externalMigrationQueueFactory } from "@app/services/external-migration/external-migration-queue";
 import { externalMigrationServiceFactory } from "@app/services/external-migration/external-migration-service";
-import { folderCheckpointDALFactory } from "@app/services/folder-checkpoint/folder-checkpoint-dal";
-import { folderCheckpointResourcesDALFactory } from "@app/services/folder-checkpoint-resources/folder-checkpoint-resources-dal";
-import { folderCommitDALFactory } from "@app/services/folder-commit/folder-commit-dal";
-import { folderCommitQueueServiceFactory } from "@app/services/folder-commit/folder-commit-queue";
-import { folderCommitServiceFactory } from "@app/services/folder-commit/folder-commit-service";
-import { folderCommitChangesDALFactory } from "@app/services/folder-commit-changes/folder-commit-changes-dal";
-import { folderTreeCheckpointDALFactory } from "@app/services/folder-tree-checkpoint/folder-tree-checkpoint-dal";
-import { folderTreeCheckpointResourcesDALFactory } from "@app/services/folder-tree-checkpoint-resources/folder-tree-checkpoint-resources-dal";
 import { groupProjectDALFactory } from "@app/services/group-project/group-project-dal";
 import { groupProjectMembershipRoleDALFactory } from "@app/services/group-project/group-project-membership-role-dal";
 import { groupProjectServiceFactory } from "@app/services/group-project/group-project-service";
@@ -212,7 +199,6 @@ import { pkiCollectionDALFactory } from "@app/services/pki-collection/pki-collec
 import { pkiCollectionItemDALFactory } from "@app/services/pki-collection/pki-collection-item-dal";
 import { pkiCollectionServiceFactory } from "@app/services/pki-collection/pki-collection-service";
 import { pkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
-import { pkiSubscriberQueueServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-queue";
 import { pkiSubscriberServiceFactory } from "@app/services/pki-subscriber/pki-subscriber-service";
 import { projectDALFactory } from "@app/services/project/project-dal";
 import { projectQueueFactory } from "@app/services/project/project-queue";
@@ -573,41 +559,6 @@ export const registerRoutes = async (
     projectRoleDAL,
     permissionService
   });
-
-  const folderCommitChangesDAL = folderCommitChangesDALFactory(db);
-  const folderCheckpointDAL = folderCheckpointDALFactory(db);
-  const folderCheckpointResourcesDAL = folderCheckpointResourcesDALFactory(db);
-  const folderTreeCheckpointDAL = folderTreeCheckpointDALFactory(db);
-  const folderCommitDAL = folderCommitDALFactory(db);
-  const folderTreeCheckpointResourcesDAL = folderTreeCheckpointResourcesDALFactory(db);
-  const folderCommitQueueService = folderCommitQueueServiceFactory({
-    queueService,
-    folderTreeCheckpointDAL,
-    keyStore,
-    folderTreeCheckpointResourcesDAL,
-    folderCommitDAL,
-    folderDAL
-  });
-  const folderCommitService = folderCommitServiceFactory({
-    folderCommitDAL,
-    folderCommitChangesDAL,
-    folderCheckpointDAL,
-    folderTreeCheckpointDAL,
-    userDAL,
-    identityDAL,
-    folderDAL,
-    folderVersionDAL,
-    secretVersionV2BridgeDAL,
-    projectDAL,
-    folderCheckpointResourcesDAL,
-    secretV2BridgeDAL,
-    folderTreeCheckpointResourcesDAL,
-    folderCommitQueueService,
-    permissionService,
-    kmsService,
-    secretTagDAL,
-    resourceMetadataDAL
-  });
   const scimService = scimServiceFactory({
     licenseService,
     scimDAL,
@@ -866,8 +817,6 @@ export const registerRoutes = async (
   });
 
   const certificateAuthorityDAL = certificateAuthorityDALFactory(db);
-  const internalCertificateAuthorityDAL = internalCertificateAuthorityDALFactory(db);
-  const externalCertificateAuthorityDAL = externalCertificateAuthorityDALFactory(db);
   const certificateAuthorityCertDAL = certificateAuthorityCertDALFactory(db);
   const certificateAuthoritySecretDAL = certificateAuthoritySecretDALFactory(db);
   const certificateAuthorityCrlDAL = certificateAuthorityCrlDALFactory(db);
@@ -893,9 +842,17 @@ export const registerRoutes = async (
     certificateAuthoritySecretDAL,
     projectDAL,
     kmsService,
-    permissionService,
-    pkiCollectionDAL,
-    pkiCollectionItemDAL
+    permissionService
+  });
+
+  const certificateAuthorityQueue = certificateAuthorityQueueFactory({
+    certificateAuthorityCrlDAL,
+    certificateAuthorityDAL,
+    certificateAuthoritySecretDAL,
+    certificateDAL,
+    projectDAL,
+    kmsService,
+    queueService
   });
 
   const sshCertificateAuthorityService = sshCertificateAuthorityServiceFactory({
@@ -944,6 +901,23 @@ export const registerRoutes = async (
     groupDAL
   });
 
+  const certificateAuthorityService = certificateAuthorityServiceFactory({
+    certificateAuthorityDAL,
+    certificateAuthorityCertDAL,
+    certificateAuthoritySecretDAL,
+    certificateAuthorityCrlDAL,
+    certificateTemplateDAL,
+    certificateAuthorityQueue,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    pkiCollectionDAL,
+    pkiCollectionItemDAL,
+    projectDAL,
+    kmsService,
+    permissionService
+  });
+
   const certificateAuthorityCrlService = certificateAuthorityCrlServiceFactory({
     certificateAuthorityDAL,
     certificateAuthorityCrlDAL,
@@ -963,6 +937,17 @@ export const registerRoutes = async (
     licenseService
   });
 
+  const certificateEstService = certificateEstServiceFactory({
+    certificateAuthorityService,
+    certificateTemplateService,
+    certificateTemplateDAL,
+    certificateAuthorityCertDAL,
+    certificateAuthorityDAL,
+    projectDAL,
+    kmsService,
+    licenseService
+  });
+
   const pkiAlertService = pkiAlertServiceFactory({
     pkiAlertDAL,
     pkiCollectionDAL,
@@ -980,6 +965,20 @@ export const registerRoutes = async (
     projectDAL
   });
 
+  const pkiSubscriberService = pkiSubscriberServiceFactory({
+    pkiSubscriberDAL,
+    certificateAuthorityDAL,
+    certificateAuthorityCertDAL,
+    certificateAuthoritySecretDAL,
+    certificateAuthorityCrlDAL,
+    certificateDAL,
+    certificateBodyDAL,
+    certificateSecretDAL,
+    projectDAL,
+    kmsService,
+    permissionService
+  });
+
   const projectTemplateService = projectTemplateServiceFactory({
     licenseService,
     permissionService,
@@ -1008,7 +1007,6 @@ export const registerRoutes = async (
     projectMembershipDAL,
     projectBotDAL,
     secretDAL,
-    folderCommitService,
     secretBlindIndexDAL,
     secretVersionDAL,
     secretTagDAL,
@@ -1056,7 +1054,6 @@ export const registerRoutes = async (
     secretReminderRecipientsDAL,
     orgService,
     resourceMetadataDAL,
-    folderCommitService,
     secretSyncQueue
   });
 
@@ -1133,7 +1130,6 @@ export const registerRoutes = async (
     snapshotDAL,
     snapshotFolderDAL,
     snapshotSecretDAL,
-    folderCommitService,
     secretVersionDAL,
     folderVersionDAL,
     secretTagDAL,
@@ -1160,8 +1156,7 @@ export const registerRoutes = async (
     folderVersionDAL,
     projectEnvDAL,
     snapshotService,
-    projectDAL,
-    folderCommitService
+    projectDAL
   });
 
   const secretImportService = secretImportServiceFactory({
@@ -1186,7 +1181,6 @@ export const registerRoutes = async (
   const secretV2BridgeService = secretV2BridgeServiceFactory({
     folderDAL,
     secretVersionDAL: secretVersionV2BridgeDAL,
-    folderCommitService,
     secretQueueService,
     secretDAL: secretV2BridgeDAL,
     permissionService,
@@ -1230,8 +1224,7 @@ export const registerRoutes = async (
     projectSlackConfigDAL,
     resourceMetadataDAL,
     projectMicrosoftTeamsConfigDAL,
-    microsoftTeamsService,
-    folderCommitService
+    microsoftTeamsService
   });
 
   const secretService = secretServiceFactory({
@@ -1316,8 +1309,7 @@ export const registerRoutes = async (
     secretV2BridgeDAL,
     secretVersionV2TagBridgeDAL: secretVersionTagV2BridgeDAL,
     secretVersionV2BridgeDAL,
-    resourceMetadataDAL,
-    folderCommitService
+    resourceMetadataDAL
   });
 
   const secretRotationQueue = secretRotationQueueFactory({
@@ -1329,7 +1321,6 @@ export const registerRoutes = async (
     projectBotService,
     secretVersionV2BridgeDAL,
     secretV2BridgeDAL,
-    folderCommitService,
     kmsService
   });
 
@@ -1481,15 +1472,6 @@ export const registerRoutes = async (
     permissionService
   });
 
-  const pitService = pitServiceFactory({
-    folderCommitService,
-    secretService,
-    folderService,
-    permissionService,
-    folderDAL,
-    projectEnvDAL
-  });
-
   const identityOidcAuthService = identityOidcAuthServiceFactory({
     identityOidcAuthDAL,
     identityOrgMembershipDAL,
@@ -1631,9 +1613,7 @@ export const registerRoutes = async (
     secretDAL: secretV2BridgeDAL,
     queueService,
     secretV2BridgeService,
-    resourceMetadataDAL,
-    folderCommitService,
-    folderVersionDAL
+    resourceMetadataDAL
   });
 
   const migrationService = externalMigrationServiceFactory({
@@ -1668,52 +1648,6 @@ export const registerRoutes = async (
     licenseService
   });
 
-  const certificateAuthorityQueue = certificateAuthorityQueueFactory({
-    certificateAuthorityCrlDAL,
-    certificateAuthorityDAL,
-    certificateAuthoritySecretDAL,
-    certificateDAL,
-    projectDAL,
-    kmsService,
-    queueService,
-    pkiSubscriberDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    externalCertificateAuthorityDAL,
-    keyStore,
-    appConnectionDAL,
-    appConnectionService
-  });
-
-  const internalCertificateAuthorityService = internalCertificateAuthorityServiceFactory({
-    certificateAuthorityDAL,
-    certificateAuthorityCertDAL,
-    certificateAuthoritySecretDAL,
-    certificateAuthorityCrlDAL,
-    certificateTemplateDAL,
-    certificateAuthorityQueue,
-    certificateDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    pkiCollectionDAL,
-    pkiCollectionItemDAL,
-    projectDAL,
-    internalCertificateAuthorityDAL,
-    kmsService,
-    permissionService
-  });
-
-  const certificateEstService = certificateEstServiceFactory({
-    internalCertificateAuthorityService,
-    certificateTemplateService,
-    certificateTemplateDAL,
-    certificateAuthorityCertDAL,
-    certificateAuthorityDAL,
-    projectDAL,
-    kmsService,
-    licenseService
-  });
-
   const kmipService = kmipServiceFactory({
     kmipClientDAL,
     permissionService,
@@ -1743,7 +1677,6 @@ export const registerRoutes = async (
     auditLogService,
     secretV2BridgeDAL,
     secretTagDAL,
-    folderCommitService,
     secretVersionTagV2BridgeDAL,
     secretVersionV2BridgeDAL,
     keyStore,
@@ -1754,59 +1687,6 @@ export const registerRoutes = async (
     appConnectionDAL
   });
 
-  const certificateAuthorityService = certificateAuthorityServiceFactory({
-    certificateAuthorityDAL,
-    projectDAL,
-    permissionService,
-    appConnectionDAL,
-    appConnectionService,
-    externalCertificateAuthorityDAL,
-    internalCertificateAuthorityService,
-    certificateDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    kmsService,
-    pkiSubscriberDAL
-  });
-
-  const internalCaFns = InternalCertificateAuthorityFns({
-    certificateAuthorityDAL,
-    certificateAuthorityCertDAL,
-    certificateAuthoritySecretDAL,
-    certificateAuthorityCrlDAL,
-    certificateDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    projectDAL,
-    kmsService
-  });
-
-  const pkiSubscriberQueue = pkiSubscriberQueueServiceFactory({
-    queueService,
-    pkiSubscriberDAL,
-    certificateAuthorityDAL,
-    certificateAuthorityQueue,
-    certificateDAL,
-    auditLogService,
-    internalCaFns
-  });
-
-  const pkiSubscriberService = pkiSubscriberServiceFactory({
-    pkiSubscriberDAL,
-    certificateAuthorityDAL,
-    certificateAuthorityCertDAL,
-    certificateAuthoritySecretDAL,
-    certificateAuthorityCrlDAL,
-    certificateDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    projectDAL,
-    kmsService,
-    permissionService,
-    certificateAuthorityQueue,
-    internalCaFns
-  });
-
   await secretRotationV2QueueServiceFactory({
     secretRotationV2Service,
     secretRotationV2DAL,
@@ -1827,7 +1707,6 @@ export const registerRoutes = async (
   await telemetryQueue.startTelemetryCheck();
   await dailyResourceCleanUp.startCleanUp();
   await dailyExpiringPkiItemAlert.startSendingAlerts();
-  await pkiSubscriberQueue.startDailyAutoRenewalJob();
   await kmsService.startService();
   await microsoftTeamsService.start();
 
@@ -1893,11 +1772,9 @@ export const registerRoutes = async (
     sshHost: sshHostService,
     sshHostGroup: sshHostGroupService,
     certificateAuthority: certificateAuthorityService,
-    internalCertificateAuthority: internalCertificateAuthorityService,
     certificateTemplate: certificateTemplateService,
     certificateAuthorityCrl: certificateAuthorityCrlService,
     certificateEst: certificateEstService,
-    pit: pitService,
     pkiAlert: pkiAlertService,
     pkiCollection: pkiCollectionService,
     pkiSubscriber: pkiSubscriberService,
@@ -1930,8 +1807,7 @@ export const registerRoutes = async (
     secretRotationV2: secretRotationV2Service,
     microsoftTeams: microsoftTeamsService,
     assumePrivileges: assumePrivilegeService,
-    githubOrgSync: githubOrgSyncConfigService,
-    folderCommit: folderCommitService
+    githubOrgSync: githubOrgSyncConfigService
   });
 
   const cronJobs: CronJob[] = [];

backend/src/server/routes/sanitizedSchemas.ts

@@ -1,11 +1,9 @@
 import { z } from "zod";
 
 import {
-  CertificateAuthoritiesSchema,
   DynamicSecretsSchema,
   IdentityProjectAdditionalPrivilegeSchema,
   IntegrationAuthsSchema,
-  InternalCertificateAuthoritiesSchema,
   ProjectRolesSchema,
   ProjectsSchema,
   SecretApprovalPoliciesSchema,
@@ -274,15 +272,3 @@ export const SanitizedTagSchema = SecretTagsSchema.pick({
 }).extend({
   name: z.string()
 });
-
-export const InternalCertificateAuthorityResponseSchema = CertificateAuthoritiesSchema.merge(
-  InternalCertificateAuthoritiesSchema.omit({
-    caId: true,
-    notAfter: true,
-    notBefore: true
-  })
-).extend({
-  requireTemplateForIssuance: z.boolean().optional(),
-  notAfter: z.string().optional(),
-  notBefore: z.string().optional()
-});

backend/src/server/routes/v1/app-connection-routers/1password-connection-router.ts

@@ -1,60 +0,0 @@
-import z from "zod";
-
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import {
-  CreateOnePassConnectionSchema,
-  SanitizedOnePassConnectionSchema,
-  UpdateOnePassConnectionSchema
-} from "@app/services/app-connection/1password";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import { AuthMode } from "@app/services/auth/auth-type";
-
-import { registerAppConnectionEndpoints } from "./app-connection-endpoints";
-
-export const registerOnePassConnectionRouter = async (server: FastifyZodProvider) => {
-  registerAppConnectionEndpoints({
-    app: AppConnection.OnePass,
-    server,
-    sanitizedResponseSchema: SanitizedOnePassConnectionSchema,
-    createSchema: CreateOnePassConnectionSchema,
-    updateSchema: UpdateOnePassConnectionSchema
-  });
-
-  // The following endpoints are for internal Infisical App use only and not part of the public API
-  server.route({
-    method: "GET",
-    url: `/:connectionId/vaults`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      params: z.object({
-        connectionId: z.string().uuid()
-      }),
-      response: {
-        200: z
-          .object({
-            id: z.string(),
-            name: z.string(),
-            type: z.string(),
-            items: z.number(),
-
-            attributeVersion: z.number(),
-            contentVersion: z.number(),
-
-            // Corresponds to ISO8601 date string
-            createdAt: z.string(),
-            updatedAt: z.string()
-          })
-          .array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT]),
-    handler: async (req) => {
-      const { connectionId } = req.params;
-      const vaults = await server.services.appConnection.onepass.listVaults(connectionId, req.permission);
-      return vaults;
-    }
-  });
-};

backend/src/server/routes/v1/app-connection-routers/app-connection-router.ts

@@ -5,10 +5,6 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags } from "@app/lib/api-docs";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import {
-  OnePassConnectionListItemSchema,
-  SanitizedOnePassConnectionSchema
-} from "@app/services/app-connection/1password";
 import { Auth0ConnectionListItemSchema, SanitizedAuth0ConnectionSchema } from "@app/services/app-connection/auth0";
 import { AwsConnectionListItemSchema, SanitizedAwsConnectionSchema } from "@app/services/app-connection/aws";
 import {
@@ -82,8 +78,7 @@ const SanitizedAppConnectionSchema = z.union([
   ...SanitizedWindmillConnectionSchema.options,
   ...SanitizedLdapConnectionSchema.options,
   ...SanitizedTeamCityConnectionSchema.options,
-  ...SanitizedOCIConnectionSchema.options,
-  ...SanitizedOnePassConnectionSchema.options
+  ...SanitizedOCIConnectionSchema.options
 ]);
 
 const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
@@ -105,8 +100,7 @@ const AppConnectionOptionsSchema = z.discriminatedUnion("app", [
   WindmillConnectionListItemSchema,
   LdapConnectionListItemSchema,
   TeamCityConnectionListItemSchema,
-  OCIConnectionListItemSchema,
-  OnePassConnectionListItemSchema
+  OCIConnectionListItemSchema
 ]);
 
 export const registerAppConnectionRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v1/app-connection-routers/index.ts

@@ -1,7 +1,6 @@
 import { registerOCIConnectionRouter } from "@app/ee/routes/v1/app-connection-routers/oci-connection-router";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 
-import { registerOnePassConnectionRouter } from "./1password-connection-router";
 import { registerAuth0ConnectionRouter } from "./auth0-connection-router";
 import { registerAwsConnectionRouter } from "./aws-connection-router";
 import { registerAzureAppConfigurationConnectionRouter } from "./azure-app-configuration-connection-router";
@@ -43,6 +42,5 @@ export const APP_CONNECTION_REGISTER_ROUTER_MAP: Record<AppConnection, (server:
     [AppConnection.HCVault]: registerHCVaultConnectionRouter,
     [AppConnection.LDAP]: registerLdapConnectionRouter,
     [AppConnection.TeamCity]: registerTeamCityConnectionRouter,
-    [AppConnection.OCI]: registerOCIConnectionRouter,
-    [AppConnection.OnePass]: registerOnePassConnectionRouter
+    [AppConnection.OCI]: registerOCIConnectionRouter
   };

backend/src/server/routes/v1/certificate-authority-router.ts

@@ -1,7 +1,7 @@
 /* eslint-disable @typescript-eslint/no-floating-promises */
 import { z } from "zod";
 
-import { CertificateTemplatesSchema } from "@app/db/schemas";
+import { CertificateAuthoritiesSchema, CertificateTemplatesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, CERTIFICATE_AUTHORITIES } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
@@ -10,19 +10,13 @@ import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
-import {
-  CaRenewalType,
-  CaStatus,
-  InternalCaType
-} from "@app/services/certificate-authority/certificate-authority-enums";
+import { CaRenewalType, CaStatus, CaType } from "@app/services/certificate-authority/certificate-authority-types";
 import {
   validateAltNamesField,
   validateCaDateField
 } from "@app/services/certificate-authority/certificate-authority-validators";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
-import { InternalCertificateAuthorityResponseSchema } from "../sanitizedSchemas";
-
 export const registerCaRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "POST",
@@ -38,7 +32,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       body: z
         .object({
           projectSlug: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.projectSlug),
-          type: z.nativeEnum(InternalCaType).describe(CERTIFICATE_AUTHORITIES.CREATE.type),
+          type: z.nativeEnum(CaType).describe(CERTIFICATE_AUTHORITIES.CREATE.type),
           friendlyName: z.string().optional().describe(CERTIFICATE_AUTHORITIES.CREATE.friendlyName),
           commonName: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.commonName),
           organization: z.string().trim().describe(CERTIFICATE_AUTHORITIES.CREATE.organization),
@@ -74,18 +68,16 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         ),
       response: {
         200: z.object({
-          ca: InternalCertificateAuthorityResponseSchema
+          ca: CertificateAuthoritiesSchema
         })
       }
     },
     handler: async (req) => {
-      const ca = await server.services.internalCertificateAuthority.createCa({
+      const ca = await server.services.certificateAuthority.createCa({
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
-        isInternal: false,
         actorOrgId: req.permission.orgId,
-        enableDirectIssuance: !req.body.requireTemplateForIssuance,
         ...req.body
       });
 
@@ -95,7 +87,6 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         event: {
           type: EventType.CREATE_CA,
           metadata: {
-            name: ca.name,
             caId: ca.id,
             dn: ca.dn
           }
@@ -124,12 +115,12 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          ca: InternalCertificateAuthorityResponseSchema
+          ca: CertificateAuthoritiesSchema
         })
       }
     },
     handler: async (req) => {
-      const ca = await server.services.internalCertificateAuthority.getCaById({
+      const ca = await server.services.certificateAuthority.getCaById({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -144,7 +135,6 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
           type: EventType.GET_CA,
           metadata: {
             caId: ca.id,
-            name: ca.name,
             dn: ca.dn
           }
         }
@@ -177,7 +167,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, res) => {
-      const caCert = await server.services.internalCertificateAuthority.getCaCertById(req.params);
+      const caCert = await server.services.certificateAuthority.getCaCertById(req.params);
 
       res.header("Content-Type", "application/pkix-cert");
 
@@ -208,19 +198,17 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          ca: InternalCertificateAuthorityResponseSchema
+          ca: CertificateAuthoritiesSchema
         })
       }
     },
     handler: async (req) => {
-      const ca = await server.services.internalCertificateAuthority.updateCaById({
+      const ca = await server.services.certificateAuthority.updateCaById({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
-        isInternal: false,
         actorAuthMethod: req.permission.authMethod,
         actorOrgId: req.permission.orgId,
-        enableDirectIssuance: !req.body.requireTemplateForIssuance,
         ...req.body
       });
 
@@ -232,7 +220,6 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
           metadata: {
             caId: ca.id,
             dn: ca.dn,
-            name: ca.name,
             status: ca.status as CaStatus
           }
         }
@@ -260,12 +247,12 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          ca: InternalCertificateAuthorityResponseSchema
+          ca: CertificateAuthoritiesSchema
         })
       }
     },
     handler: async (req) => {
-      const ca = await server.services.internalCertificateAuthority.deleteCaById({
+      const ca = await server.services.certificateAuthority.deleteCaById({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -279,7 +266,6 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
         event: {
           type: EventType.DELETE_CA,
           metadata: {
-            name: ca.name,
             caId: ca.id,
             dn: ca.dn
           }
@@ -313,7 +299,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { ca, csr } = await server.services.internalCertificateAuthority.getCaCsr({
+      const { ca, csr } = await server.services.certificateAuthority.getCaCsr({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -367,7 +353,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, serialNumber, ca } =
-        await server.services.internalCertificateAuthority.renewCaCert({
+        await server.services.certificateAuthority.renewCaCert({
           caId: req.params.caId,
           actor: req.permission.type,
           actorId: req.permission.id,
@@ -422,7 +408,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { caCerts, ca } = await server.services.internalCertificateAuthority.getCaCerts({
+      const { caCerts, ca } = await server.services.certificateAuthority.getCaCerts({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -469,14 +455,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { certificate, certificateChain, serialNumber, ca } =
-        await server.services.internalCertificateAuthority.getCaCert({
-          caId: req.params.caId,
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId
-        });
+      const { certificate, certificateChain, serialNumber, ca } = await server.services.certificateAuthority.getCaCert({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
@@ -532,7 +517,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, serialNumber, ca } =
-        await server.services.internalCertificateAuthority.signIntermediate({
+        await server.services.certificateAuthority.signIntermediate({
           caId: req.params.caId,
           actor: req.permission.type,
           actorId: req.permission.id,
@@ -589,7 +574,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { ca } = await server.services.internalCertificateAuthority.importCertToCa({
+      const { ca } = await server.services.certificateAuthority.importCertToCa({
         caId: req.params.caId,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -668,7 +653,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber, ca } =
-        await server.services.internalCertificateAuthority.issueCertFromCa({
+        await server.services.certificateAuthority.issueCertFromCa({
           caId: req.params.caId,
           actor: req.permission.type,
           actorId: req.permission.id,
@@ -761,7 +746,7 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, serialNumber, ca, commonName } =
-        await server.services.internalCertificateAuthority.signCertFromCa({
+        await server.services.certificateAuthority.signCertFromCa({
           isInternal: false,
           caId: req.params.caId,
           actor: req.permission.type,
@@ -824,15 +809,13 @@ export const registerCaRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { certificateTemplates, ca } = await server.services.internalCertificateAuthority.getCaCertificateTemplates(
-        {
-          caId: req.params.caId,
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId
-        }
-      );
+      const { certificateTemplates, ca } = await server.services.certificateAuthority.getCaCertificateTemplates({
+        caId: req.params.caId,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId
+      });
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,

backend/src/server/routes/v1/certificate-authority-routers/acme-certificate-authority-router.ts

@@ -1,18 +0,0 @@
-import {
-  AcmeCertificateAuthoritySchema,
-  CreateAcmeCertificateAuthoritySchema,
-  UpdateAcmeCertificateAuthoritySchema
-} from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-
-import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
-
-export const registerAcmeCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
-  registerCertificateAuthorityEndpoints({
-    caType: CaType.ACME,
-    server,
-    responseSchema: AcmeCertificateAuthoritySchema,
-    createSchema: CreateAcmeCertificateAuthoritySchema,
-    updateSchema: UpdateAcmeCertificateAuthoritySchema
-  });
-};

backend/src/server/routes/v1/certificate-authority-routers/certificate-authority-endpoints.ts

@@ -1,258 +0,0 @@
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { ApiDocsTags } from "@app/lib/api-docs";
-import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-import { CaStatus, CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-import {
-  TCertificateAuthority,
-  TCertificateAuthorityInput
-} from "@app/services/certificate-authority/certificate-authority-types";
-
-export const registerCertificateAuthorityEndpoints = <
-  T extends TCertificateAuthority,
-  I extends TCertificateAuthorityInput
->({
-  server,
-  caType,
-  createSchema,
-  updateSchema,
-  responseSchema
-}: {
-  caType: CaType;
-  server: FastifyZodProvider;
-  createSchema: z.ZodType<{
-    name: string;
-    projectId: string;
-    status: CaStatus;
-    configuration: I["configuration"];
-    enableDirectIssuance: boolean;
-  }>;
-  updateSchema: z.ZodType<{
-    projectId: string;
-    name?: string;
-    status?: CaStatus;
-    configuration?: I["configuration"];
-    enableDirectIssuance?: boolean;
-  }>;
-  responseSchema: z.ZodTypeAny;
-}) => {
-  server.route({
-    method: "GET",
-    url: `/`,
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      querystring: z.object({
-        projectId: z.string().trim().min(1, "Project ID required")
-      }),
-      response: {
-        200: responseSchema.array()
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const {
-        query: { projectId }
-      } = req;
-
-      const certificateAuthorities = (await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
-        { projectId, type: caType },
-        req.permission
-      )) as T[];
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId,
-        event: {
-          type: EventType.GET_CAS,
-          metadata: {
-            caIds: certificateAuthorities.map((ca) => ca.id)
-          }
-        }
-      });
-
-      return certificateAuthorities;
-    }
-  });
-
-  server.route({
-    method: "GET",
-    url: "/:caName",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      params: z.object({
-        caName: z.string()
-      }),
-      querystring: z.object({
-        projectId: z.string().uuid()
-      }),
-      response: {
-        200: responseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { caName } = req.params;
-      const { projectId } = req.query;
-
-      const certificateAuthority =
-        (await server.services.certificateAuthority.findCertificateAuthorityByNameAndProjectId(
-          { caName, type: caType, projectId },
-          req.permission
-        )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: certificateAuthority.projectId,
-        event: {
-          type: EventType.GET_CA,
-          metadata: {
-            caId: certificateAuthority.id,
-            name: certificateAuthority.name
-          }
-        }
-      });
-
-      return certificateAuthority;
-    }
-  });
-
-  server.route({
-    method: "POST",
-    url: "/",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      body: createSchema,
-      response: {
-        200: responseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const certificateAuthority = (await server.services.certificateAuthority.createCertificateAuthority(
-        { ...req.body, type: caType },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: certificateAuthority.projectId,
-        event: {
-          type: EventType.CREATE_CA,
-          metadata: {
-            name: certificateAuthority.name,
-            caId: certificateAuthority.id
-          }
-        }
-      });
-
-      return certificateAuthority;
-    }
-  });
-
-  server.route({
-    method: "PATCH",
-    url: "/:caName",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      params: z.object({
-        caName: z.string()
-      }),
-      body: updateSchema,
-      response: {
-        200: responseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { caName } = req.params;
-
-      const certificateAuthority = (await server.services.certificateAuthority.updateCertificateAuthority(
-        {
-          ...req.body,
-          type: caType,
-          caName
-        },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: certificateAuthority.projectId,
-        event: {
-          type: EventType.UPDATE_CA,
-          metadata: {
-            name: certificateAuthority.name,
-            caId: certificateAuthority.id,
-            status: certificateAuthority.status
-          }
-        }
-      });
-
-      return certificateAuthority;
-    }
-  });
-
-  server.route({
-    method: "DELETE",
-    url: "/:caName",
-    config: {
-      rateLimit: writeLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      params: z.object({
-        caName: z.string()
-      }),
-      body: z.object({
-        projectId: z.string().uuid()
-      }),
-      response: {
-        200: responseSchema
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req) => {
-      const { caName } = req.params;
-      const { projectId } = req.body;
-
-      const certificateAuthority = (await server.services.certificateAuthority.deleteCertificateAuthority(
-        { caName, type: caType, projectId },
-        req.permission
-      )) as T;
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: certificateAuthority.projectId,
-        event: {
-          type: EventType.DELETE_CA,
-          metadata: {
-            name: certificateAuthority.name,
-            caId: certificateAuthority.id
-          }
-        }
-      });
-
-      return certificateAuthority;
-    }
-  });
-};

backend/src/server/routes/v1/certificate-authority-routers/index.ts

@@ -1,12 +0,0 @@
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-
-import { registerAcmeCertificateAuthorityRouter } from "./acme-certificate-authority-router";
-import { registerInternalCertificateAuthorityRouter } from "./internal-certificate-authority-router";
-
-export * from "./internal-certificate-authority-router";
-
-export const CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP: Record<CaType, (server: FastifyZodProvider) => Promise<void>> =
-  {
-    [CaType.INTERNAL]: registerInternalCertificateAuthorityRouter,
-    [CaType.ACME]: registerAcmeCertificateAuthorityRouter
-  };

backend/src/server/routes/v1/certificate-authority-routers/internal-certificate-authority-router.ts

@@ -1,18 +0,0 @@
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-import {
-  CreateInternalCertificateAuthoritySchema,
-  InternalCertificateAuthoritySchema,
-  UpdateInternalCertificateAuthoritySchema
-} from "@app/services/certificate-authority/internal/internal-certificate-authority-schemas";
-
-import { registerCertificateAuthorityEndpoints } from "./certificate-authority-endpoints";
-
-export const registerInternalCertificateAuthorityRouter = async (server: FastifyZodProvider) => {
-  registerCertificateAuthorityEndpoints({
-    caType: CaType.INTERNAL,
-    server,
-    responseSchema: InternalCertificateAuthoritySchema,
-    createSchema: CreateInternalCertificateAuthoritySchema,
-    updateSchema: UpdateInternalCertificateAuthoritySchema
-  });
-};

backend/src/server/routes/v1/certificate-router.ts

@@ -39,7 +39,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { cert } = await server.services.certificate.getCert({
+      const { cert, ca } = await server.services.certificate.getCert({
         serialNumber: req.params.serialNumber,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -49,7 +49,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        projectId: cert.projectId,
+        projectId: ca.projectId,
         event: {
           type: EventType.GET_CERT,
           metadata: {
@@ -86,7 +86,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, reply) => {
-      const { cert, certPrivateKey } = await server.services.certificate.getCertPrivateKey({
+      const { ca, cert, certPrivateKey } = await server.services.certificate.getCertPrivateKey({
         serialNumber: req.params.serialNumber,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -96,7 +96,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        projectId: cert.projectId,
+        projectId: ca.projectId,
         event: {
           type: EventType.GET_CERT_PRIVATE_KEY,
           metadata: {
@@ -138,7 +138,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, reply) => {
-      const { certificate, certificateChain, serialNumber, cert, privateKey } =
+      const { certificate, certificateChain, serialNumber, cert, ca, privateKey } =
         await server.services.certificate.getCertBundle({
           serialNumber: req.params.serialNumber,
           actor: req.permission.type,
@@ -149,7 +149,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        projectId: cert.projectId,
+        projectId: ca.projectId,
         event: {
           type: EventType.GET_CERT_BUNDLE,
           metadata: {
@@ -242,7 +242,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber, ca } =
-        await server.services.internalCertificateAuthority.issueCertFromCa({
+        await server.services.certificateAuthority.issueCertFromCa({
           actor: req.permission.type,
           actorId: req.permission.id,
           actorAuthMethod: req.permission.authMethod,
@@ -284,68 +284,6 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
     }
   });
 
-  server.route({
-    method: "POST",
-    url: "/import-certificate",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificates],
-      description: "Import certificate",
-      body: z.object({
-        projectSlug: z.string().trim().min(1).describe(CERTIFICATES.IMPORT.projectSlug),
-
-        certificatePem: z.string().trim().min(1).describe(CERTIFICATES.IMPORT.certificatePem),
-        privateKeyPem: z.string().trim().min(1).describe(CERTIFICATES.IMPORT.privateKeyPem),
-        chainPem: z.string().trim().min(1).describe(CERTIFICATES.IMPORT.chainPem),
-
-        friendlyName: z.string().trim().optional().describe(CERTIFICATES.IMPORT.friendlyName),
-        pkiCollectionId: z.string().trim().optional().describe(CERTIFICATES.IMPORT.pkiCollectionId)
-      }),
-      response: {
-        200: z.object({
-          certificate: z.string().trim().describe(CERTIFICATES.IMPORT.certificate),
-          certificateChain: z.string().trim().describe(CERTIFICATES.IMPORT.certificateChain),
-          privateKey: z.string().trim().describe(CERTIFICATES.IMPORT.privateKey),
-          serialNumber: z.string().trim().describe(CERTIFICATES.IMPORT.serialNumber)
-        })
-      }
-    },
-    handler: async (req) => {
-      const { certificate, certificateChain, privateKey, serialNumber, cert } =
-        await server.services.certificate.importCert({
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId,
-          ...req.body
-        });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: cert.projectId,
-        event: {
-          type: EventType.IMPORT_CERT,
-          metadata: {
-            certId: cert.id,
-            cn: cert.commonName,
-            serialNumber
-          }
-        }
-      });
-
-      return {
-        certificate,
-        certificateChain,
-        privateKey,
-        serialNumber
-      };
-    }
-  });
-
   server.route({
     method: "POST",
     url: "/sign-certificate",
@@ -417,7 +355,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
     },
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, serialNumber, ca, commonName } =
-        await server.services.internalCertificateAuthority.signCertFromCa({
+        await server.services.certificateAuthority.signCertFromCa({
           isInternal: false,
           actor: req.permission.type,
           actorId: req.permission.id,
@@ -536,7 +474,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { deletedCert } = await server.services.certificate.deleteCert({
+      const { deletedCert, ca } = await server.services.certificate.deleteCert({
         serialNumber: req.params.serialNumber,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -546,7 +484,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        projectId: deletedCert.projectId,
+        projectId: ca.projectId,
         event: {
           type: EventType.DELETE_CERT,
           metadata: {
@@ -586,7 +524,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req) => {
-      const { certificate, certificateChain, serialNumber, cert } = await server.services.certificate.getCertBody({
+      const { certificate, certificateChain, serialNumber, cert, ca } = await server.services.certificate.getCertBody({
         serialNumber: req.params.serialNumber,
         actor: req.permission.type,
         actorId: req.permission.id,
@@ -596,7 +534,7 @@ export const registerCertRouter = async (server: FastifyZodProvider) => {
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        projectId: cert.projectId,
+        projectId: ca.projectId,
         event: {
           type: EventType.GET_CERT_BODY,
           metadata: {

backend/src/server/routes/v1/index.ts

@@ -10,7 +10,6 @@ import { registerAdminRouter } from "./admin-router";
 import { registerAuthRoutes } from "./auth-router";
 import { registerProjectBotRouter } from "./bot-router";
 import { registerCaRouter } from "./certificate-authority-router";
-import { CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP } from "./certificate-authority-routers";
 import { registerCertRouter } from "./certificate-router";
 import { registerCertificateTemplateRouter } from "./certificate-template-router";
 import { registerExternalGroupOrgRoleMappingRouter } from "./external-group-org-role-mapping-router";
@@ -105,16 +104,6 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
   await server.register(
     async (pkiRouter) => {
       await pkiRouter.register(registerCaRouter, { prefix: "/ca" });
-      await pkiRouter.register(
-        async (caRouter) => {
-          for await (const [caType, router] of Object.entries(CERTIFICATE_AUTHORITY_REGISTER_ROUTER_MAP)) {
-            await caRouter.register(router, { prefix: `/${caType}` });
-          }
-        },
-        {
-          prefix: "/ca"
-        }
-      );
       await pkiRouter.register(registerCertRouter, { prefix: "/certificates" });
       await pkiRouter.register(registerCertificateTemplateRouter, { prefix: "/certificate-templates" });
       await pkiRouter.register(registerPkiAlertRouter, { prefix: "/alerts" });

backend/src/server/routes/v1/pki-subscriber-router.ts

@@ -5,7 +5,6 @@ import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, PKI_SUBSCRIBERS } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
-import { addNoCacheHeaders } from "@app/server/lib/caching";
 import { slugSchema } from "@app/server/lib/schemas";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -91,8 +90,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
         ttl: z
           .string()
           .trim()
-          .refine((val) => !val || ms(val) > 0, "TTL must be a positive number")
-          .optional()
+          .refine((val) => ms(val) > 0, "TTL must be a positive number")
           .describe(PKI_SUBSCRIBERS.CREATE.ttl),
         subjectAlternativeNames: validateAltNameField
           .array()
@@ -110,9 +108,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
           .array()
           .default([])
           .transform((arr) => Array.from(new Set(arr)))
-          .describe(PKI_SUBSCRIBERS.CREATE.extendedKeyUsages),
-        enableAutoRenewal: z.boolean().optional().describe(PKI_SUBSCRIBERS.CREATE.enableAutoRenewal),
-        autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.CREATE.autoRenewalPeriodInDays)
+          .describe(PKI_SUBSCRIBERS.CREATE.extendedKeyUsages)
       }),
       response: {
         200: sanitizedPkiSubscriber
@@ -138,7 +134,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
             caId: subscriber.caId ?? undefined,
             name: subscriber.name,
             commonName: subscriber.commonName,
-            ttl: subscriber.ttl ?? undefined,
+            ttl: subscriber.ttl,
             subjectAlternativeNames: subscriber.subjectAlternativeNames,
             keyUsages: subscriber.keyUsages as CertKeyUsage[],
             extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[]
@@ -183,7 +179,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
         ttl: z
           .string()
           .trim()
-          .refine((val) => !val || ms(val) > 0, "TTL must be a positive number")
+          .refine((val) => ms(val) > 0, "TTL must be a positive number")
           .optional()
           .describe(PKI_SUBSCRIBERS.UPDATE.ttl),
         keyUsages: z
@@ -197,9 +193,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
           .array()
           .transform((arr) => Array.from(new Set(arr)))
           .optional()
-          .describe(PKI_SUBSCRIBERS.UPDATE.extendedKeyUsages),
-        enableAutoRenewal: z.boolean().optional().describe(PKI_SUBSCRIBERS.UPDATE.enableAutoRenewal),
-        autoRenewalPeriodInDays: z.number().min(1).optional().describe(PKI_SUBSCRIBERS.UPDATE.autoRenewalPeriodInDays)
+          .describe(PKI_SUBSCRIBERS.UPDATE.extendedKeyUsages)
       }),
       response: {
         200: sanitizedPkiSubscriber
@@ -225,7 +219,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
             caId: subscriber.caId ?? undefined,
             name: subscriber.name,
             commonName: subscriber.commonName,
-            ttl: subscriber.ttl ?? undefined,
+            ttl: subscriber.ttl,
             subjectAlternativeNames: subscriber.subjectAlternativeNames,
             keyUsages: subscriber.keyUsages as CertKeyUsage[],
             extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[]
@@ -284,67 +278,6 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     }
   });
 
-  server.route({
-    method: "POST",
-    url: "/:subscriberName/order-certificate",
-    config: {
-      rateLimit: writeLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiSubscribers],
-      description: "Order certificate",
-      params: z.object({
-        subscriberName: z.string().describe(PKI_SUBSCRIBERS.ISSUE_CERT.subscriberName)
-      }),
-      body: z.object({
-        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.ISSUE_CERT.projectId)
-      }),
-      response: {
-        200: z.object({
-          message: z.string().trim()
-        })
-      }
-    },
-    handler: async (req) => {
-      const subscriber = await server.services.pkiSubscriber.orderSubscriberCert({
-        subscriberName: req.params.subscriberName,
-        projectId: req.body.projectId,
-        actor: req.permission.type,
-        actorId: req.permission.id,
-        actorAuthMethod: req.permission.authMethod,
-        actorOrgId: req.permission.orgId
-      });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: subscriber.projectId,
-        event: {
-          type: EventType.ISSUE_PKI_SUBSCRIBER_CERT,
-          metadata: {
-            subscriberId: subscriber.id,
-            name: subscriber.name
-          }
-        }
-      });
-
-      await server.services.telemetry.sendPostHogEvents({
-        event: PostHogEventTypes.IssueCert,
-        distinctId: getTelemetryDistinctId(req),
-        properties: {
-          subscriberId: subscriber.id,
-          commonName: subscriber.commonName,
-          ...req.auditLogInfo
-        }
-      });
-
-      return {
-        message: "Successfully placed order for certificate"
-      };
-    }
-  });
-
   server.route({
     method: "POST",
     url: "/:subscriberName/issue-certificate",
@@ -487,72 +420,6 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     }
   });
 
-  server.route({
-    method: "GET",
-    url: "/:subscriberName/latest-certificate-bundle",
-    config: {
-      rateLimit: readLimit
-    },
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiSubscribers],
-      description: "Get latest certificate bundle of a subscriber",
-      params: z.object({
-        subscriberName: z.string().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.subscriberName)
-      }),
-      querystring: z.object({
-        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.projectId)
-      }),
-      response: {
-        200: z.object({
-          certificate: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.certificate),
-          certificateChain: z
-            .string()
-            .trim()
-            .nullable()
-            .describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.certificateChain),
-          privateKey: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.privateKey),
-          serialNumber: z.string().trim().describe(PKI_SUBSCRIBERS.GET_LATEST_CERT_BUNDLE.serialNumber)
-        })
-      }
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    handler: async (req, reply) => {
-      const { certificate, certificateChain, serialNumber, cert, privateKey, subscriber } =
-        await server.services.pkiSubscriber.getSubscriberActiveCertBundle({
-          subscriberName: req.params.subscriberName,
-          actor: req.permission.type,
-          actorId: req.permission.id,
-          actorAuthMethod: req.permission.authMethod,
-          actorOrgId: req.permission.orgId,
-          ...req.query
-        });
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: cert.projectId,
-        event: {
-          type: EventType.GET_SUBSCRIBER_ACTIVE_CERT_BUNDLE,
-          metadata: {
-            subscriberId: subscriber.id,
-            name: subscriber.name,
-            certId: cert.id,
-            serialNumber: cert.serialNumber
-          }
-        }
-      });
-
-      addNoCacheHeaders(reply);
-
-      return {
-        certificate,
-        certificateChain,
-        serialNumber,
-        privateKey
-      };
-    }
-  });
-
   server.route({
     method: "GET",
     url: "/:subscriberName/certificates",

backend/src/server/routes/v1/secret-sync-routers/1password-sync-router.ts

@@ -1,17 +0,0 @@
-import {
-  CreateOnePassSyncSchema,
-  OnePassSyncSchema,
-  UpdateOnePassSyncSchema
-} from "@app/services/secret-sync/1password";
-import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
-
-import { registerSyncSecretsEndpoints } from "./secret-sync-endpoints";
-
-export const registerOnePassSyncRouter = async (server: FastifyZodProvider) =>
-  registerSyncSecretsEndpoints({
-    destination: SecretSync.OnePass,
-    server,
-    responseSchema: OnePassSyncSchema,
-    createSchema: CreateOnePassSyncSchema,
-    updateSchema: UpdateOnePassSyncSchema
-  });

backend/src/server/routes/v1/secret-sync-routers/index.ts

@@ -1,7 +1,6 @@
-import { registerOCIVaultSyncRouter } from "@app/ee/routes/v1/secret-sync-routers/oci-vault-sync-router";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
-import { registerOnePassSyncRouter } from "./1password-sync-router";
+import { registerOCIVaultSyncRouter } from "../../../../ee/routes/v1/secret-sync-routers/oci-vault-sync-router";
 import { registerAwsParameterStoreSyncRouter } from "./aws-parameter-store-sync-router";
 import { registerAwsSecretsManagerSyncRouter } from "./aws-secrets-manager-sync-router";
 import { registerAzureAppConfigurationSyncRouter } from "./azure-app-configuration-sync-router";
@@ -34,6 +33,5 @@ export const SECRET_SYNC_REGISTER_ROUTER_MAP: Record<SecretSync, (server: Fastif
   [SecretSync.Windmill]: registerWindmillSyncRouter,
   [SecretSync.HCVault]: registerHCVaultSyncRouter,
   [SecretSync.TeamCity]: registerTeamCitySyncRouter,
-  [SecretSync.OCIVault]: registerOCIVaultSyncRouter,
-  [SecretSync.OnePass]: registerOnePassSyncRouter
+  [SecretSync.OCIVault]: registerOCIVaultSyncRouter
 };

backend/src/server/routes/v1/secret-sync-routers/secret-sync-router.ts

@@ -6,7 +6,6 @@ import { ApiDocsTags, SecretSyncs } from "@app/lib/api-docs";
 import { readLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { OnePassSyncListItemSchema, OnePassSyncSchema } from "@app/services/secret-sync/1password";
 import {
   AwsParameterStoreSyncListItemSchema,
   AwsParameterStoreSyncSchema
@@ -46,8 +45,7 @@ const SecretSyncSchema = z.discriminatedUnion("destination", [
   WindmillSyncSchema,
   HCVaultSyncSchema,
   TeamCitySyncSchema,
-  OCIVaultSyncSchema,
-  OnePassSyncSchema
+  OCIVaultSyncSchema
 ]);
 
 const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
@@ -65,8 +63,7 @@ const SecretSyncOptionsSchema = z.discriminatedUnion("destination", [
   WindmillSyncListItemSchema,
   HCVaultSyncListItemSchema,
   TeamCitySyncListItemSchema,
-  OCIVaultSyncListItemSchema,
-  OnePassSyncListItemSchema
+  OCIVaultSyncListItemSchema
 ]);
 
 export const registerSecretSyncRouter = async (server: FastifyZodProvider) => {

backend/src/server/routes/v2/certificate-authority-router.ts

@@ -1,71 +0,0 @@
-import { z } from "zod";
-
-import { EventType } from "@app/ee/services/audit-log/audit-log-types";
-import { ApiDocsTags } from "@app/lib/api-docs";
-import { readLimit } from "@app/server/config/rateLimiter";
-import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
-import { AuthMode } from "@app/services/auth/auth-type";
-import { AcmeCertificateAuthoritySchema } from "@app/services/certificate-authority/acme/acme-certificate-authority-schemas";
-import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
-import { InternalCertificateAuthoritySchema } from "@app/services/certificate-authority/internal/internal-certificate-authority-schemas";
-
-const CertificateAuthoritySchema = z.discriminatedUnion("type", [
-  InternalCertificateAuthoritySchema,
-  AcmeCertificateAuthoritySchema
-]);
-
-export const registerCaRouter = async (server: FastifyZodProvider) => {
-  server.route({
-    method: "GET",
-    url: "/",
-    config: {
-      rateLimit: readLimit
-    },
-    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
-    schema: {
-      hide: false,
-      tags: [ApiDocsTags.PkiCertificateAuthorities],
-      description: "Get Certificate Authorities",
-      querystring: z.object({
-        projectId: z.string()
-      }),
-      response: {
-        200: z.object({
-          certificateAuthorities: CertificateAuthoritySchema.array()
-        })
-      }
-    },
-    handler: async (req) => {
-      const internalCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
-        {
-          projectId: req.query.projectId,
-          type: CaType.INTERNAL
-        },
-        req.permission
-      );
-
-      const acmeCas = await server.services.certificateAuthority.listCertificateAuthoritiesByProjectId(
-        {
-          projectId: req.query.projectId,
-          type: CaType.ACME
-        },
-        req.permission
-      );
-
-      await server.services.auditLog.createAuditLog({
-        ...req.auditLogInfo,
-        projectId: req.query.projectId,
-        event: {
-          type: EventType.GET_CAS,
-          metadata: {
-            caIds: [...(internalCas ?? []).map((ca) => ca.id), ...(acmeCas ?? []).map((ca) => ca.id)]
-          }
-        }
-      });
-
-      return {
-        certificateAuthorities: [...(internalCas ?? []), ...(acmeCas ?? [])]
-      };
-    }
-  });
-};

backend/src/server/routes/v2/index.ts

@@ -1,4 +1,3 @@
-import { registerCaRouter } from "./certificate-authority-router";
 import { registerGroupProjectRouter } from "./group-project-router";
 import { registerIdentityOrgRouter } from "./identity-org-router";
 import { registerIdentityProjectRouter } from "./identity-project-router";
@@ -15,7 +14,6 @@ export const registerV2Routes = async (server: FastifyZodProvider) => {
   await server.register(registerUserRouter, { prefix: "/users" });
   await server.register(registerServiceTokenRouter, { prefix: "/service-token" });
   await server.register(registerPasswordRouter, { prefix: "/password" });
-  await server.register(registerCaRouter, { prefix: "/pki/ca" });
   await server.register(
     async (orgRouter) => {
       await orgRouter.register(registerOrgRouter);

backend/src/server/routes/v2/project-router.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import {
+  CertificateAuthoritiesSchema,
   CertificatesSchema,
   PkiAlertsSchema,
   PkiCollectionsSchema,
@@ -21,13 +22,13 @@ import { slugSchema } from "@app/server/lib/schemas";
 import { getTelemetryDistinctId } from "@app/server/lib/telemetry";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
-import { CaStatus } from "@app/services/certificate-authority/certificate-authority-enums";
+import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { sanitizedCertificateTemplate } from "@app/services/certificate-template/certificate-template-schema";
 import { sanitizedPkiSubscriber } from "@app/services/pki-subscriber/pki-subscriber-schema";
 import { ProjectFilterType } from "@app/services/project/project-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
-import { InternalCertificateAuthorityResponseSchema, SanitizedProjectSchema } from "../sanitizedSchemas";
+import { SanitizedProjectSchema } from "../sanitizedSchemas";
 
 const projectWithEnv = SanitizedProjectSchema.extend({
   _id: z.string(),
@@ -384,7 +385,7 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       }),
       response: {
         200: z.object({
-          cas: z.array(InternalCertificateAuthorityResponseSchema)
+          cas: z.array(CertificateAuthoritiesSchema)
         })
       }
     },

backend/src/services/app-connection/1password/1password-connection-enums.ts

@@ -1,3 +0,0 @@
-export enum OnePassConnectionMethod {
-  ApiToken = "api-token"
-}

backend/src/services/app-connection/1password/1password-connection-fns.ts

@@ -1,66 +0,0 @@
-import { AxiosError } from "axios";
-
-import { request } from "@app/lib/config/request";
-import { BadRequestError } from "@app/lib/errors";
-import { removeTrailingSlash } from "@app/lib/fn";
-import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-
-import { OnePassConnectionMethod } from "./1password-connection-enums";
-import { TOnePassConnection, TOnePassConnectionConfig, TOnePassVault } from "./1password-connection-types";
-
-export const getOnePassInstanceUrl = async (config: TOnePassConnectionConfig) => {
-  const instanceUrl = removeTrailingSlash(config.credentials.instanceUrl);
-
-  await blockLocalAndPrivateIpAddresses(instanceUrl);
-
-  return instanceUrl;
-};
-
-export const getOnePassConnectionListItem = () => {
-  return {
-    name: "1Password" as const,
-    app: AppConnection.OnePass as const,
-    methods: Object.values(OnePassConnectionMethod) as [OnePassConnectionMethod.ApiToken]
-  };
-};
-
-export const validateOnePassConnectionCredentials = async (config: TOnePassConnectionConfig) => {
-  const instanceUrl = await getOnePassInstanceUrl(config);
-
-  const { apiToken } = config.credentials;
-
-  try {
-    await request.get(`${instanceUrl}/v1/vaults`, {
-      headers: {
-        Authorization: `Bearer ${apiToken}`,
-        Accept: "application/json"
-      }
-    });
-  } catch (error: unknown) {
-    if (error instanceof AxiosError) {
-      throw new BadRequestError({
-        message: `Failed to validate credentials: ${error.message || "Unknown error"}`
-      });
-    }
-    throw new BadRequestError({
-      message: "Unable to validate connection: verify credentials"
-    });
-  }
-
-  return config.credentials;
-};
-
-export const listOnePassVaults = async (appConnection: TOnePassConnection) => {
-  const instanceUrl = await getOnePassInstanceUrl(appConnection);
-  const { apiToken } = appConnection.credentials;
-
-  const resp = await request.get<TOnePassVault[]>(`${instanceUrl}/v1/vaults`, {
-    headers: {
-      Authorization: `Bearer ${apiToken}`,
-      Accept: "application/json"
-    }
-  });
-
-  return resp.data;
-};

backend/src/services/app-connection/1password/1password-connection-schemas.ts

@@ -1,64 +0,0 @@
-import z from "zod";
-
-import { AppConnections } from "@app/lib/api-docs";
-import { AppConnection } from "@app/services/app-connection/app-connection-enums";
-import {
-  BaseAppConnectionSchema,
-  GenericCreateAppConnectionFieldsSchema,
-  GenericUpdateAppConnectionFieldsSchema
-} from "@app/services/app-connection/app-connection-schemas";
-
-import { OnePassConnectionMethod } from "./1password-connection-enums";
-
-export const OnePassConnectionAccessTokenCredentialsSchema = z.object({
-  apiToken: z.string().trim().min(1, "API Token required").describe(AppConnections.CREDENTIALS.ONEPASS.apiToken),
-  instanceUrl: z
-    .string()
-    .trim()
-    .url("Invalid Connect Server instance URL")
-    .min(1, "Instance URL required")
-    .describe(AppConnections.CREDENTIALS.ONEPASS.instanceUrl)
-});
-
-const BaseOnePassConnectionSchema = BaseAppConnectionSchema.extend({ app: z.literal(AppConnection.OnePass) });
-
-export const OnePassConnectionSchema = BaseOnePassConnectionSchema.extend({
-  method: z.literal(OnePassConnectionMethod.ApiToken),
-  credentials: OnePassConnectionAccessTokenCredentialsSchema
-});
-
-export const SanitizedOnePassConnectionSchema = z.discriminatedUnion("method", [
-  BaseOnePassConnectionSchema.extend({
-    method: z.literal(OnePassConnectionMethod.ApiToken),
-    credentials: OnePassConnectionAccessTokenCredentialsSchema.pick({
-      instanceUrl: true
-    })
-  })
-]);
-
-export const ValidateOnePassConnectionCredentialsSchema = z.discriminatedUnion("method", [
-  z.object({
-    method: z.literal(OnePassConnectionMethod.ApiToken).describe(AppConnections.CREATE(AppConnection.OnePass).method),
-    credentials: OnePassConnectionAccessTokenCredentialsSchema.describe(
-      AppConnections.CREATE(AppConnection.OnePass).credentials
-    )
-  })
-]);
-
-export const CreateOnePassConnectionSchema = ValidateOnePassConnectionCredentialsSchema.and(
-  GenericCreateAppConnectionFieldsSchema(AppConnection.OnePass)
-);
-
-export const UpdateOnePassConnectionSchema = z
-  .object({
-    credentials: OnePassConnectionAccessTokenCredentialsSchema.optional().describe(
-      AppConnections.UPDATE(AppConnection.OnePass).credentials
-    )
-  })
-  .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.OnePass));
-
-export const OnePassConnectionListItemSchema = z.object({
-  name: z.literal("1Password"),
-  app: z.literal(AppConnection.OnePass),
-  methods: z.nativeEnum(OnePassConnectionMethod).array()
-});

backend/src/services/app-connection/1password/1password-connection-service.ts

@@ -1,30 +0,0 @@
-import { logger } from "@app/lib/logger";
-import { OrgServiceActor } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import { listOnePassVaults } from "./1password-connection-fns";
-import { TOnePassConnection } from "./1password-connection-types";
-
-type TGetAppConnectionFunc = (
-  app: AppConnection,
-  connectionId: string,
-  actor: OrgServiceActor
-) => Promise<TOnePassConnection>;
-
-export const onePassConnectionService = (getAppConnection: TGetAppConnectionFunc) => {
-  const listVaults = async (connectionId: string, actor: OrgServiceActor) => {
-    const appConnection = await getAppConnection(AppConnection.OnePass, connectionId, actor);
-
-    try {
-      const vaults = await listOnePassVaults(appConnection);
-      return vaults;
-    } catch (error) {
-      logger.error(error, "Failed to establish connection with 1Password");
-      return [];
-    }
-  };
-
-  return {
-    listVaults
-  };
-};

backend/src/services/app-connection/1password/1password-connection-types.ts

@@ -1,35 +0,0 @@
-import z from "zod";
-
-import { DiscriminativePick } from "@app/lib/types";
-
-import { AppConnection } from "../app-connection-enums";
-import {
-  CreateOnePassConnectionSchema,
-  OnePassConnectionSchema,
-  ValidateOnePassConnectionCredentialsSchema
-} from "./1password-connection-schemas";
-
-export type TOnePassConnection = z.infer<typeof OnePassConnectionSchema>;
-
-export type TOnePassConnectionInput = z.infer<typeof CreateOnePassConnectionSchema> & {
-  app: AppConnection.OnePass;
-};
-
-export type TValidateOnePassConnectionCredentialsSchema = typeof ValidateOnePassConnectionCredentialsSchema;
-
-export type TOnePassConnectionConfig = DiscriminativePick<TOnePassConnectionInput, "method" | "app" | "credentials"> & {
-  orgId: string;
-};
-
-export type TOnePassVault = {
-  id: string;
-  name: string;
-  type: string;
-  items: number;
-
-  attributeVersion: number;
-  contentVersion: number;
-
-  createdAt: string;
-  updatedAt: string;
-};

backend/src/services/app-connection/1password/index.ts

@@ -1,4 +0,0 @@
-export * from "./1password-connection-enums";
-export * from "./1password-connection-fns";
-export * from "./1password-connection-schemas";
-export * from "./1password-connection-types";

backend/src/services/app-connection/app-connection-enums.ts

@@ -17,8 +17,7 @@ export enum AppConnection {
   HCVault = "hashicorp-vault",
   LDAP = "ldap",
   TeamCity = "teamcity",
-  OCI = "oci",
-  OnePass = "1password"
+  OCI = "oci"
 }
 
 export enum AWSRegion {

backend/src/services/app-connection/app-connection-fns.ts

@@ -1,9 +1,4 @@
 import { TAppConnections } from "@app/db/schemas/app-connections";
-import {
-  getOCIConnectionListItem,
-  OCIConnectionMethod,
-  validateOCIConnectionCredentials
-} from "@app/ee/services/app-connections/oci";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { generateHash } from "@app/lib/crypto/encryption";
 import { BadRequestError } from "@app/lib/errors";
@@ -15,10 +10,10 @@ import {
 import { KmsDataKey } from "@app/services/kms/kms-types";
 
 import {
-  getOnePassConnectionListItem,
-  OnePassConnectionMethod,
-  validateOnePassConnectionCredentials
-} from "./1password";
+  getOCIConnectionListItem,
+  OCIConnectionMethod,
+  validateOCIConnectionCredentials
+} from "../../ee/services/app-connections/oci";
 import { AppConnection, AppConnectionPlanType } from "./app-connection-enums";
 import { TAppConnectionServiceFactoryDep } from "./app-connection-service";
 import {
@@ -103,8 +98,7 @@ export const listAppConnectionOptions = () => {
     getHCVaultConnectionListItem(),
     getLdapConnectionListItem(),
     getTeamCityConnectionListItem(),
-    getOCIConnectionListItem(),
-    getOnePassConnectionListItem()
+    getOCIConnectionListItem()
   ].sort((a, b) => a.name.localeCompare(b.name));
 };
 
@@ -174,8 +168,7 @@ export const validateAppConnectionCredentials = async (
     [AppConnection.HCVault]: validateHCVaultConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.LDAP]: validateLdapConnectionCredentials as TAppConnectionCredentialsValidator,
     [AppConnection.TeamCity]: validateTeamCityConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.OCI]: validateOCIConnectionCredentials as TAppConnectionCredentialsValidator,
-    [AppConnection.OnePass]: validateOnePassConnectionCredentials as TAppConnectionCredentialsValidator
+    [AppConnection.OCI]: validateOCIConnectionCredentials as TAppConnectionCredentialsValidator
   };
 
   return VALIDATE_APP_CONNECTION_CREDENTIALS_MAP[appConnection.app](appConnection);
@@ -204,7 +197,6 @@ export const getAppConnectionMethodName = (method: TAppConnection["method"]) =>
     case HumanitecConnectionMethod.ApiToken:
     case TerraformCloudConnectionMethod.ApiToken:
     case VercelConnectionMethod.ApiToken:
-    case OnePassConnectionMethod.ApiToken:
       return "API Token";
     case PostgresConnectionMethod.UsernameAndPassword:
     case MsSqlConnectionMethod.UsernameAndPassword:
@@ -268,8 +260,7 @@ export const TRANSITION_CONNECTION_CREDENTIALS_TO_PLATFORM: Record<
   [AppConnection.HCVault]: platformManagedCredentialsNotSupported,
   [AppConnection.LDAP]: platformManagedCredentialsNotSupported, // we could support this in the future
   [AppConnection.TeamCity]: platformManagedCredentialsNotSupported,
-  [AppConnection.OCI]: platformManagedCredentialsNotSupported,
-  [AppConnection.OnePass]: platformManagedCredentialsNotSupported
+  [AppConnection.OCI]: platformManagedCredentialsNotSupported
 };
 
 export const enterpriseAppCheck = async (

backend/src/services/app-connection/app-connection-maps.ts

@@ -19,8 +19,7 @@ export const APP_CONNECTION_NAME_MAP: Record<AppConnection, string> = {
   [AppConnection.HCVault]: "Hashicorp Vault",
   [AppConnection.LDAP]: "LDAP",
   [AppConnection.TeamCity]: "TeamCity",
-  [AppConnection.OCI]: "OCI",
-  [AppConnection.OnePass]: "1Password"
+  [AppConnection.OCI]: "OCI"
 };
 
 export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanType> = {
@@ -42,6 +41,5 @@ export const APP_CONNECTION_PLAN_MAP: Record<AppConnection, AppConnectionPlanTyp
   [AppConnection.HCVault]: AppConnectionPlanType.Regular,
   [AppConnection.LDAP]: AppConnectionPlanType.Regular,
   [AppConnection.TeamCity]: AppConnectionPlanType.Regular,
-  [AppConnection.OCI]: AppConnectionPlanType.Enterprise,
-  [AppConnection.OnePass]: AppConnectionPlanType.Regular
+  [AppConnection.OCI]: AppConnectionPlanType.Enterprise
 };

backend/src/services/app-connection/app-connection-service.ts

@@ -1,7 +1,5 @@
 import { ForbiddenError, subject } from "@casl/ability";
 
-import { ValidateOCIConnectionCredentialsSchema } from "@app/ee/services/app-connections/oci";
-import { ociConnectionService } from "@app/ee/services/app-connections/oci/oci-connection-service";
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { OrgPermissionAppConnectionActions, OrgPermissionSubjects } from "@app/ee/services/permission/org-permission";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
@@ -21,8 +19,8 @@ import {
 import { auth0ConnectionService } from "@app/services/app-connection/auth0/auth0-connection-service";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 
-import { ValidateOnePassConnectionCredentialsSchema } from "./1password";
-import { onePassConnectionService } from "./1password/1password-connection-service";
+import { ValidateOCIConnectionCredentialsSchema } from "../../ee/services/app-connections/oci";
+import { ociConnectionService } from "../../ee/services/app-connections/oci/oci-connection-service";
 import { TAppConnectionDALFactory } from "./app-connection-dal";
 import { AppConnection } from "./app-connection-enums";
 import { APP_CONNECTION_NAME_MAP } from "./app-connection-maps";
@@ -93,8 +91,7 @@ const VALIDATE_APP_CONNECTION_CREDENTIALS_MAP: Record<AppConnection, TValidateAp
   [AppConnection.HCVault]: ValidateHCVaultConnectionCredentialsSchema,
   [AppConnection.LDAP]: ValidateLdapConnectionCredentialsSchema,
   [AppConnection.TeamCity]: ValidateTeamCityConnectionCredentialsSchema,
-  [AppConnection.OCI]: ValidateOCIConnectionCredentialsSchema,
-  [AppConnection.OnePass]: ValidateOnePassConnectionCredentialsSchema
+  [AppConnection.OCI]: ValidateOCIConnectionCredentialsSchema
 };
 
 export const appConnectionServiceFactory = ({
@@ -496,7 +493,6 @@ export const appConnectionServiceFactory = ({
     hcvault: hcVaultConnectionService(connectAppConnectionById),
     windmill: windmillConnectionService(connectAppConnectionById),
     teamcity: teamcityConnectionService(connectAppConnectionById),
-    oci: ociConnectionService(connectAppConnectionById, licenseService),
-    onepass: onePassConnectionService(connectAppConnectionById)
+    oci: ociConnectionService(connectAppConnectionById, licenseService)
   };
 };

backend/src/services/app-connection/app-connection-types.ts

@@ -1,19 +1,13 @@
-import {
-  TOCIConnection,
-  TOCIConnectionConfig,
-  TOCIConnectionInput,
-  TValidateOCIConnectionCredentialsSchema
-} from "@app/ee/services/app-connections/oci";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { TSqlConnectionConfig } from "@app/services/app-connection/shared/sql/sql-connection-types";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
 
 import {
-  TOnePassConnection,
-  TOnePassConnectionConfig,
-  TOnePassConnectionInput,
-  TValidateOnePassConnectionCredentialsSchema
-} from "./1password";
+  TOCIConnection,
+  TOCIConnectionConfig,
+  TOCIConnectionInput,
+  TValidateOCIConnectionCredentialsSchema
+} from "../../ee/services/app-connections/oci";
 import { AWSRegion } from "./app-connection-enums";
 import {
   TAuth0Connection,
@@ -138,7 +132,6 @@ export type TAppConnection = { id: string } & (
   | TLdapConnection
   | TTeamCityConnection
   | TOCIConnection
-  | TOnePassConnection
 );
 
 export type TAppConnectionRaw = NonNullable<Awaited<ReturnType<TAppConnectionDALFactory["findById"]>>>;
@@ -165,7 +158,6 @@ export type TAppConnectionInput = { id: string } & (
   | TLdapConnectionInput
   | TTeamCityConnectionInput
   | TOCIConnectionInput
-  | TOnePassConnectionInput
 );
 
 export type TSqlConnectionInput = TPostgresConnectionInput | TMsSqlConnectionInput;
@@ -197,8 +189,7 @@ export type TAppConnectionConfig =
   | THCVaultConnectionConfig
   | TLdapConnectionConfig
   | TTeamCityConnectionConfig
-  | TOCIConnectionConfig
-  | TOnePassConnectionConfig;
+  | TOCIConnectionConfig;
 
 export type TValidateAppConnectionCredentialsSchema =
   | TValidateAwsConnectionCredentialsSchema
@@ -219,8 +210,7 @@ export type TValidateAppConnectionCredentialsSchema =
   | TValidateHCVaultConnectionCredentialsSchema
   | TValidateLdapConnectionCredentialsSchema
   | TValidateTeamCityConnectionCredentialsSchema
-  | TValidateOCIConnectionCredentialsSchema
-  | TValidateOnePassConnectionCredentialsSchema;
+  | TValidateOCIConnectionCredentialsSchema;
 
 export type TListAwsConnectionKmsKeys = {
   connectionId: string;

backend/src/services/certificate-authority/acme/acme-certificate-authority-enums.ts

@@ -1,3 +0,0 @@
-export enum AcmeDnsProvider {
-  Route53 = "route53"
-}

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -1,521 +0,0 @@
-import { ChangeResourceRecordSetsCommand, Route53Client } from "@aws-sdk/client-route-53";
-import * as x509 from "@peculiar/x509";
-import acme from "acme-client";
-import { KeyObject } from "crypto";
-
-import { TableName } from "@app/db/schemas";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
-import { OrgServiceActor } from "@app/lib/types";
-import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
-import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
-import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
-import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
-import { TAppConnectionServiceFactory } from "@app/services/app-connection/app-connection-service";
-import { getAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-fns";
-import { TAwsConnection, TAwsConnectionConfig } from "@app/services/app-connection/aws/aws-connection-types";
-import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
-import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
-import {
-  CertExtendedKeyUsage,
-  CertKeyAlgorithm,
-  CertKeyUsage,
-  CertStatus
-} from "@app/services/certificate/certificate-types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TPkiSubscriberDALFactory } from "@app/services/pki-subscriber/pki-subscriber-dal";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
-
-import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
-import { CaStatus, CaType } from "../certificate-authority-enums";
-import { keyAlgorithmToAlgCfg } from "../certificate-authority-fns";
-import { TExternalCertificateAuthorityDALFactory } from "../external-certificate-authority-dal";
-import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
-import { AcmeCertificateAuthorityCredentialsSchema } from "./acme-certificate-authority-schemas";
-import {
-  TAcmeCertificateAuthority,
-  TCreateAcmeCertificateAuthorityDTO,
-  TUpdateAcmeCertificateAuthorityDTO
-} from "./acme-certificate-authority-types";
-
-type TAcmeCertificateAuthorityFnsDeps = {
-  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
-  appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
-  certificateAuthorityDAL: Pick<
-    TCertificateAuthorityDALFactory,
-    "create" | "transaction" | "findByIdWithAssociatedCa" | "updateById" | "findWithAssociatedCa"
-  >;
-  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
-  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
-  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
-  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
-  kmsService: Pick<
-    TKmsServiceFactory,
-    "encryptWithKmsKey" | "generateKmsKey" | "createCipherPairWithDataKey" | "decryptWithKmsKey"
-  >;
-  pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById">;
-  projectDAL: Pick<TProjectDALFactory, "findById" | "findOne" | "updateById" | "transaction">;
-};
-
-type DBConfigurationColumn = {
-  dnsProvider: string;
-  directoryUrl: string;
-  accountEmail: string;
-  hostedZoneId: string;
-};
-
-export const castDbEntryToAcmeCertificateAuthority = (
-  ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
-): TAcmeCertificateAuthority & { credentials: unknown } => {
-  if (!ca.externalCa?.id) {
-    throw new BadRequestError({ message: "Malformed ACME certificate authority" });
-  }
-
-  const dbConfigurationCol = ca.externalCa.configuration as DBConfigurationColumn;
-
-  return {
-    id: ca.id,
-    type: CaType.ACME,
-    enableDirectIssuance: ca.enableDirectIssuance,
-    name: ca.name,
-    projectId: ca.projectId,
-    credentials: ca.externalCa.credentials,
-    configuration: {
-      dnsAppConnectionId: ca.externalCa.dnsAppConnectionId as string,
-      dnsProviderConfig: {
-        provider: dbConfigurationCol.dnsProvider as AcmeDnsProvider,
-        hostedZoneId: dbConfigurationCol.hostedZoneId
-      },
-      directoryUrl: dbConfigurationCol.directoryUrl,
-      accountEmail: dbConfigurationCol.accountEmail
-    },
-    status: ca.status as CaStatus
-  };
-};
-
-export const route53InsertTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    credentials: config.credentials!,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Set ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "UPSERT",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
-
-export const route53DeleteTxtRecord = async (
-  connection: TAwsConnectionConfig,
-  hostedZoneId: string,
-  domain: string,
-  value: string
-) => {
-  const config = await getAwsConnectionConfig(connection, AWSRegion.US_WEST_1); // REGION is irrelevant because Route53 is global
-  const route53Client = new Route53Client({
-    credentials: config.credentials!,
-    region: config.region
-  });
-
-  const command = new ChangeResourceRecordSetsCommand({
-    HostedZoneId: hostedZoneId,
-    ChangeBatch: {
-      Comment: "Delete ACME challenge TXT record",
-      Changes: [
-        {
-          Action: "DELETE",
-          ResourceRecordSet: {
-            Name: domain,
-            Type: "TXT",
-            TTL: 30,
-            ResourceRecords: [{ Value: value }]
-          }
-        }
-      ]
-    }
-  });
-
-  await route53Client.send(command);
-};
-
-export const AcmeCertificateAuthorityFns = ({
-  appConnectionDAL,
-  appConnectionService,
-  certificateAuthorityDAL,
-  externalCertificateAuthorityDAL,
-  certificateDAL,
-  certificateBodyDAL,
-  certificateSecretDAL,
-  kmsService,
-  projectDAL,
-  pkiSubscriberDAL
-}: TAcmeCertificateAuthorityFnsDeps) => {
-  const createCertificateAuthority = async ({
-    name,
-    projectId,
-    configuration,
-    enableDirectIssuance,
-    actor,
-    status
-  }: {
-    status: CaStatus;
-    name: string;
-    projectId: string;
-    configuration: TCreateAcmeCertificateAuthorityDTO["configuration"];
-    enableDirectIssuance: boolean;
-    actor: OrgServiceActor;
-  }) => {
-    const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
-    const appConnection = await appConnectionDAL.findById(dnsAppConnectionId);
-
-    if (!appConnection) {
-      throw new NotFoundError({ message: `App connection with ID '${dnsAppConnectionId}' not found` });
-    }
-
-    if (dnsProviderConfig.provider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
-      throw new BadRequestError({
-        message: `App connection with ID '${dnsAppConnectionId}' is not an AWS connection`
-      });
-    }
-
-    // validates permission to connect
-    await appConnectionService.connectAppConnectionById(appConnection.app as AppConnection, dnsAppConnectionId, actor);
-
-    const caEntity = await certificateAuthorityDAL.transaction(async (tx) => {
-      try {
-        const ca = await certificateAuthorityDAL.create(
-          {
-            projectId,
-            enableDirectIssuance,
-            name,
-            status
-          },
-          tx
-        );
-
-        await externalCertificateAuthorityDAL.create(
-          {
-            caId: ca.id,
-            dnsAppConnectionId,
-            type: CaType.ACME,
-            configuration: {
-              directoryUrl,
-              accountEmail,
-              dnsProvider: dnsProviderConfig.provider,
-              hostedZoneId: dnsProviderConfig.hostedZoneId
-            }
-          },
-          tx
-        );
-
-        return await certificateAuthorityDAL.findByIdWithAssociatedCa(ca.id, tx);
-      } catch (error) {
-        // @ts-expect-error We're expecting a database error
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-        if (error?.error?.code === "23505") {
-          throw new BadRequestError({
-            message: "Certificate authority with the same name already exists in your project"
-          });
-        }
-        throw error;
-      }
-    });
-
-    if (!caEntity.externalCa?.id) {
-      throw new BadRequestError({ message: "Failed to create external certificate authority" });
-    }
-
-    return castDbEntryToAcmeCertificateAuthority(caEntity);
-  };
-
-  const updateCertificateAuthority = async ({
-    id,
-    status,
-    configuration,
-    enableDirectIssuance,
-    actor,
-    name
-  }: {
-    id: string;
-    status?: CaStatus;
-    configuration: TUpdateAcmeCertificateAuthorityDTO["configuration"];
-    enableDirectIssuance?: boolean;
-    actor: OrgServiceActor;
-    name?: string;
-  }) => {
-    const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
-      if (configuration) {
-        const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
-        const appConnection = await appConnectionDAL.findById(dnsAppConnectionId);
-
-        if (!appConnection) {
-          throw new NotFoundError({ message: `App connection with ID '${dnsAppConnectionId}' not found` });
-        }
-
-        if (dnsProviderConfig.provider === AcmeDnsProvider.Route53 && appConnection.app !== AppConnection.AWS) {
-          throw new BadRequestError({
-            message: `App connection with ID '${dnsAppConnectionId}' is not an AWS connection`
-          });
-        }
-
-        // validates permission to connect
-        await appConnectionService.connectAppConnectionById(
-          appConnection.app as AppConnection,
-          dnsAppConnectionId,
-          actor
-        );
-
-        await externalCertificateAuthorityDAL.update(
-          {
-            caId: id,
-            type: CaType.ACME
-          },
-          {
-            dnsAppConnectionId,
-            configuration: {
-              directoryUrl,
-              accountEmail,
-              dnsProvider: dnsProviderConfig.provider,
-              hostedZoneId: dnsProviderConfig.hostedZoneId
-            }
-          },
-          tx
-        );
-      }
-
-      if (name || status || enableDirectIssuance) {
-        await certificateAuthorityDAL.updateById(
-          id,
-          {
-            name,
-            status,
-            enableDirectIssuance
-          },
-          tx
-        );
-      }
-
-      return certificateAuthorityDAL.findByIdWithAssociatedCa(id, tx);
-    });
-
-    if (!updatedCa.externalCa?.id) {
-      throw new BadRequestError({ message: "Failed to update external certificate authority" });
-    }
-
-    return castDbEntryToAcmeCertificateAuthority(updatedCa);
-  };
-
-  const listCertificateAuthorities = async ({ projectId }: { projectId: string }) => {
-    const cas = await certificateAuthorityDAL.findWithAssociatedCa({
-      [`${TableName.CertificateAuthority}.projectId` as "projectId"]: projectId,
-      [`${TableName.ExternalCertificateAuthority}.type` as "type"]: CaType.ACME
-    });
-
-    return cas.map(castDbEntryToAcmeCertificateAuthority);
-  };
-
-  const orderSubscriberCertificate = async (subscriberId: string) => {
-    const subscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!subscriber.caId) {
-      throw new BadRequestError({ message: "Subscriber does not have a CA" });
-    }
-
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(subscriber.caId);
-    if (!ca.externalCa || ca.externalCa.type !== CaType.ACME) {
-      throw new BadRequestError({ message: "CA is not an ACME CA" });
-    }
-
-    const acmeCa = castDbEntryToAcmeCertificateAuthority(ca);
-    if (acmeCa.status !== CaStatus.ACTIVE) {
-      throw new BadRequestError({ message: "CA is disabled" });
-    }
-
-    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
-      projectId: ca.projectId,
-      projectDAL,
-      kmsService
-    });
-
-    const kmsEncryptor = await kmsService.encryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-
-    const kmsDecryptor = await kmsService.decryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-
-    let accountKey: Buffer | undefined;
-    if (acmeCa.credentials) {
-      const decryptedCredentials = await kmsDecryptor({
-        cipherTextBlob: acmeCa.credentials as Buffer
-      });
-
-      const parsedCredentials = await AcmeCertificateAuthorityCredentialsSchema.parseAsync(
-        JSON.parse(decryptedCredentials.toString("utf8"))
-      );
-
-      accountKey = Buffer.from(parsedCredentials.accountKey, "base64");
-    }
-    if (!accountKey) {
-      accountKey = await acme.crypto.createPrivateRsaKey();
-      const newCredentials = {
-        accountKey: accountKey.toString("base64")
-      };
-      const { cipherTextBlob: encryptedNewCredentials } = await kmsEncryptor({
-        plainText: Buffer.from(JSON.stringify(newCredentials))
-      });
-      await externalCertificateAuthorityDAL.update(
-        {
-          caId: acmeCa.id
-        },
-        {
-          credentials: encryptedNewCredentials
-        }
-      );
-    }
-
-    await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
-
-    const acmeClient = new acme.Client({
-      directoryUrl: acmeCa.configuration.directoryUrl,
-      accountKey
-    });
-
-    const alg = keyAlgorithmToAlgCfg(CertKeyAlgorithm.RSA_2048);
-    const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
-    const skLeafObj = KeyObject.from(leafKeys.privateKey);
-    const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
-
-    const [, certificateCsr] = await acme.crypto.createCsr(
-      {
-        altNames: subscriber.subjectAlternativeNames,
-        commonName: subscriber.commonName
-      },
-      skLeaf
-    );
-
-    const appConnection = await appConnectionDAL.findById(acmeCa.configuration.dnsAppConnectionId);
-    const connection = await decryptAppConnection(appConnection, kmsService);
-
-    const pem = await acmeClient.auto({
-      csr: certificateCsr,
-      email: acmeCa.configuration.accountEmail,
-      challengePriority: ["dns-01"],
-      termsOfServiceAgreed: true,
-
-      challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-        if (challenge.type !== "dns-01") {
-          throw new Error("Unsupported challenge type");
-        }
-
-        const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-        const recordValue = `"${keyAuthorization}"`; // must be double quoted
-
-        if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
-          await route53InsertTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
-        }
-      },
-      challengeRemoveFn: async (authz, challenge, keyAuthorization) => {
-        const recordName = `_acme-challenge.${authz.identifier.value}`; // e.g., "_acme-challenge.example.com"
-        const recordValue = `"${keyAuthorization}"`; // must be double quoted
-
-        if (acmeCa.configuration.dnsProviderConfig.provider === AcmeDnsProvider.Route53) {
-          await route53DeleteTxtRecord(
-            connection as TAwsConnection,
-            acmeCa.configuration.dnsProviderConfig.hostedZoneId,
-            recordName,
-            recordValue
-          );
-        }
-      }
-    });
-
-    const [leafCert, parentCert] = acme.crypto.splitPemChain(pem);
-    const certObj = new x509.X509Certificate(leafCert);
-
-    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
-      plainText: Buffer.from(new Uint8Array(certObj.rawData))
-    });
-
-    const certificateChainPem = parentCert.trim();
-
-    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
-      plainText: Buffer.from(certificateChainPem)
-    });
-
-    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
-      plainText: Buffer.from(skLeaf)
-    });
-
-    await certificateDAL.transaction(async (tx) => {
-      const cert = await certificateDAL.create(
-        {
-          caId: ca.id,
-          pkiSubscriberId: subscriber.id,
-          status: CertStatus.ACTIVE,
-          friendlyName: subscriber.commonName,
-          commonName: subscriber.commonName,
-          altNames: subscriber.subjectAlternativeNames.join(","),
-          serialNumber: certObj.serialNumber,
-          notBefore: certObj.notBefore,
-          notAfter: certObj.notAfter,
-          keyUsages: subscriber.keyUsages as CertKeyUsage[],
-          extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[],
-          projectId: ca.projectId
-        },
-        tx
-      );
-
-      await certificateBodyDAL.create(
-        {
-          certId: cert.id,
-          encryptedCertificate,
-          encryptedCertificateChain
-        },
-        tx
-      );
-
-      await certificateSecretDAL.create(
-        {
-          certId: cert.id,
-          encryptedPrivateKey
-        },
-        tx
-      );
-    });
-  };
-
-  return {
-    createCertificateAuthority,
-    updateCertificateAuthority,
-    listCertificateAuthorities,
-    orderSubscriberCertificate
-  };
-};

backend/src/services/certificate-authority/acme/acme-certificate-authority-schemas.ts

@@ -1,39 +0,0 @@
-import { z } from "zod";
-
-import { CertificateAuthorities } from "@app/lib/api-docs/constants";
-
-import { CaType } from "../certificate-authority-enums";
-import {
-  BaseCertificateAuthoritySchema,
-  GenericCreateCertificateAuthorityFieldsSchema,
-  GenericUpdateCertificateAuthorityFieldsSchema
-} from "../certificate-authority-schemas";
-import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
-
-export const AcmeCertificateAuthorityConfigurationSchema = z.object({
-  dnsAppConnectionId: z.string().uuid().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
-  // soon, differentiate via the provider property
-  dnsProviderConfig: z.object({
-    provider: z.nativeEnum(AcmeDnsProvider).describe(CertificateAuthorities.CONFIGURATIONS.ACME.provider),
-    hostedZoneId: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.hostedZoneId)
-  }),
-  directoryUrl: z.string().url().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
-  accountEmail: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.accountEmail)
-});
-
-export const AcmeCertificateAuthorityCredentialsSchema = z.object({
-  accountKey: z.string()
-});
-
-export const AcmeCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
-  type: z.literal(CaType.ACME),
-  configuration: AcmeCertificateAuthorityConfigurationSchema
-});
-
-export const CreateAcmeCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(CaType.ACME).extend({
-  configuration: AcmeCertificateAuthorityConfigurationSchema
-});
-
-export const UpdateAcmeCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(CaType.ACME).extend({
-  configuration: AcmeCertificateAuthorityConfigurationSchema.optional()
-});

backend/src/services/certificate-authority/acme/acme-certificate-authority-types.ts

@@ -1,15 +0,0 @@
-import { z } from "zod";
-
-import {
-  AcmeCertificateAuthoritySchema,
-  CreateAcmeCertificateAuthoritySchema,
-  UpdateAcmeCertificateAuthoritySchema
-} from "./acme-certificate-authority-schemas";
-
-export type TAcmeCertificateAuthority = z.infer<typeof AcmeCertificateAuthoritySchema>;
-
-export type TAcmeCertificateAuthorityInput = z.infer<typeof CreateAcmeCertificateAuthoritySchema>;
-
-export type TCreateAcmeCertificateAuthorityDTO = z.infer<typeof CreateAcmeCertificateAuthoritySchema>;
-
-export type TUpdateAcmeCertificateAuthorityDTO = z.infer<typeof UpdateAcmeCertificateAuthoritySchema>;

backend/src/services/certificate-authority/certificate-authority-dal.ts

@@ -1,188 +1,13 @@
-import { Knex } from "knex";
-
 import { TDbClient } from "@app/db";
-import { CertificateAuthoritiesSchema, TableName, TCertificateAuthorities } from "@app/db/schemas";
+import { TableName } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
-import { buildFindFilter, ormify, selectAllTableCols, TFindOpt } from "@app/lib/knex";
+import { ormify } from "@app/lib/knex";
 
 export type TCertificateAuthorityDALFactory = ReturnType<typeof certificateAuthorityDALFactory>;
 
-export type TCertificateAuthorityWithAssociatedCa = Awaited<
-  ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>
->;
-
 export const certificateAuthorityDALFactory = (db: TDbClient) => {
   const caOrm = ormify(db, TableName.CertificateAuthority);
 
-  const findByNameAndProjectIdWithAssociatedCa = async (caName: string, projectId: string, tx?: Knex) => {
-    const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
-      .leftJoin(
-        TableName.InternalCertificateAuthority,
-        `${TableName.CertificateAuthority}.id`,
-        `${TableName.InternalCertificateAuthority}.caId`
-      )
-      .leftJoin(
-        TableName.ExternalCertificateAuthority,
-        `${TableName.CertificateAuthority}.id`,
-        `${TableName.ExternalCertificateAuthority}.caId`
-      )
-      .where(`${TableName.CertificateAuthority}.name`, caName)
-      .where(`${TableName.CertificateAuthority}.projectId`, projectId)
-      .select(selectAllTableCols(TableName.CertificateAuthority))
-      .select(
-        db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
-        db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
-        db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
-        db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
-        db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
-        db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
-        db.ref("country").withSchema(TableName.InternalCertificateAuthority).as("internalCountry"),
-        db.ref("province").withSchema(TableName.InternalCertificateAuthority).as("internalProvince"),
-        db.ref("locality").withSchema(TableName.InternalCertificateAuthority).as("internalLocality"),
-        db.ref("commonName").withSchema(TableName.InternalCertificateAuthority).as("internalCommonName"),
-        db.ref("dn").withSchema(TableName.InternalCertificateAuthority).as("internalDn"),
-        db.ref("serialNumber").withSchema(TableName.InternalCertificateAuthority).as("internalSerialNumber"),
-        db.ref("maxPathLength").withSchema(TableName.InternalCertificateAuthority).as("internalMaxPathLength"),
-        db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
-        db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
-        db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
-        db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
-      )
-      .select(
-        db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
-        db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
-        db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
-        db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
-        db
-          .ref("dnsAppConnectionId")
-          .withSchema(TableName.ExternalCertificateAuthority)
-          .as("externalDnsAppConnectionId"),
-        db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
-      )
-      .first();
-
-    const data = {
-      ...CertificateAuthoritiesSchema.parse(result),
-      internalCa: result
-        ? {
-            id: result.internalCaId,
-            parentCaId: result.internalParentCaId,
-            type: result.internalType,
-            friendlyName: result.internalFriendlyName,
-            organization: result.internalOrganization,
-            ou: result.internalOu,
-            country: result.internalCountry,
-            province: result.internalProvince,
-            locality: result.internalLocality,
-            commonName: result.internalCommonName,
-            dn: result.internalDn,
-            serialNumber: result.internalSerialNumber,
-            maxPathLength: result.internalMaxPathLength,
-            keyAlgorithm: result.internalKeyAlgorithm,
-            notBefore: result.internalNotBefore?.toISOString(),
-            notAfter: result.internalNotAfter?.toISOString(),
-            activeCaCertId: result.internalActiveCaCertId
-          }
-        : undefined,
-      externalCa: result
-        ? {
-            id: result.externalCaId,
-            type: result.externalType,
-            configuration: result.externalConfiguration,
-            dnsAppConnectionId: result.externalDnsAppConnectionId,
-            appConnectionId: result.externalAppConnectionId,
-            credentials: result.externalCredentials
-          }
-        : undefined
-    };
-
-    return data;
-  };
-
-  const findByIdWithAssociatedCa = async (caId: string, tx?: Knex) => {
-    const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
-      .leftJoin(
-        TableName.InternalCertificateAuthority,
-        `${TableName.CertificateAuthority}.id`,
-        `${TableName.InternalCertificateAuthority}.caId`
-      )
-      .leftJoin(
-        TableName.ExternalCertificateAuthority,
-        `${TableName.CertificateAuthority}.id`,
-        `${TableName.ExternalCertificateAuthority}.caId`
-      )
-      .where(`${TableName.CertificateAuthority}.id`, caId)
-      .select(selectAllTableCols(TableName.CertificateAuthority))
-      .select(
-        db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
-        db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
-        db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
-        db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
-        db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
-        db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
-        db.ref("country").withSchema(TableName.InternalCertificateAuthority).as("internalCountry"),
-        db.ref("province").withSchema(TableName.InternalCertificateAuthority).as("internalProvince"),
-        db.ref("locality").withSchema(TableName.InternalCertificateAuthority).as("internalLocality"),
-        db.ref("commonName").withSchema(TableName.InternalCertificateAuthority).as("internalCommonName"),
-        db.ref("dn").withSchema(TableName.InternalCertificateAuthority).as("internalDn"),
-        db.ref("serialNumber").withSchema(TableName.InternalCertificateAuthority).as("internalSerialNumber"),
-        db.ref("maxPathLength").withSchema(TableName.InternalCertificateAuthority).as("internalMaxPathLength"),
-        db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
-        db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
-        db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
-        db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
-      )
-      .select(
-        db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
-        db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
-        db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
-        db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
-        db
-          .ref("dnsAppConnectionId")
-          .withSchema(TableName.ExternalCertificateAuthority)
-          .as("externalDnsAppConnectionId"),
-        db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
-      )
-      .first();
-
-    const data = {
-      ...CertificateAuthoritiesSchema.parse(result),
-      internalCa: result
-        ? {
-            id: result.internalCaId,
-            parentCaId: result.internalParentCaId,
-            type: result.internalType,
-            friendlyName: result.internalFriendlyName,
-            organization: result.internalOrganization,
-            ou: result.internalOu,
-            country: result.internalCountry,
-            province: result.internalProvince,
-            locality: result.internalLocality,
-            commonName: result.internalCommonName,
-            dn: result.internalDn,
-            serialNumber: result.internalSerialNumber,
-            maxPathLength: result.internalMaxPathLength,
-            keyAlgorithm: result.internalKeyAlgorithm,
-            notBefore: result.internalNotBefore?.toISOString(),
-            notAfter: result.internalNotAfter?.toISOString(),
-            activeCaCertId: result.internalActiveCaCertId
-          }
-        : undefined,
-      externalCa: result
-        ? {
-            id: result.externalCaId,
-            type: result.externalType,
-            configuration: result.externalConfiguration,
-            dnsAppConnectionId: result.externalDnsAppConnectionId,
-            appConnectionId: result.externalAppConnectionId,
-            credentials: result.externalCredentials
-          }
-        : undefined
-    };
-
-    return data;
-  };
-
   // note: not used
   const buildCertificateChain = async (caId: string) => {
     try {
@@ -217,113 +42,8 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
     }
   };
 
-  const findWithAssociatedCa = async (
-    filter: Parameters<(typeof caOrm)["find"]>[0] & { dn?: string; type?: string },
-    { offset, limit, sort = [["createdAt", "desc"]] }: TFindOpt<TCertificateAuthorities> = {},
-    tx?: Knex
-  ) => {
-    try {
-      const query = (tx || db.replicaNode())(TableName.CertificateAuthority)
-        .leftJoin(
-          TableName.InternalCertificateAuthority,
-          `${TableName.CertificateAuthority}.id`,
-          `${TableName.InternalCertificateAuthority}.caId`
-        )
-        .leftJoin(
-          TableName.ExternalCertificateAuthority,
-          `${TableName.CertificateAuthority}.id`,
-          `${TableName.ExternalCertificateAuthority}.caId`
-        )
-        // eslint-disable-next-line @typescript-eslint/no-misused-promises
-        .where(buildFindFilter(filter))
-        .select(selectAllTableCols(TableName.CertificateAuthority))
-        .select(
-          db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
-          db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
-          db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
-          db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
-          db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
-          db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
-          db.ref("country").withSchema(TableName.InternalCertificateAuthority).as("internalCountry"),
-          db.ref("province").withSchema(TableName.InternalCertificateAuthority).as("internalProvince"),
-          db.ref("locality").withSchema(TableName.InternalCertificateAuthority).as("internalLocality"),
-          db.ref("commonName").withSchema(TableName.InternalCertificateAuthority).as("internalCommonName"),
-          db.ref("dn").withSchema(TableName.InternalCertificateAuthority).as("internalDn"),
-          db.ref("serialNumber").withSchema(TableName.InternalCertificateAuthority).as("internalSerialNumber"),
-          db.ref("maxPathLength").withSchema(TableName.InternalCertificateAuthority).as("internalMaxPathLength"),
-          db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
-          db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
-          db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
-          db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
-        )
-        .select(
-          db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
-          db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
-          db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
-          db
-            .ref("dnsAppConnectionId")
-            .withSchema(TableName.ExternalCertificateAuthority)
-            .as("externalDnsAppConnectionId"),
-          db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
-          db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
-        );
-
-      if (limit) void query.limit(limit);
-      if (offset) void query.offset(offset);
-      if (sort) {
-        void query.orderBy(
-          sort.map(([column, order, nulls]) => ({
-            column,
-            order,
-            nulls
-          }))
-        );
-      }
-
-      return (await query).map((ca) => ({
-        ...CertificateAuthoritiesSchema.parse(ca),
-        internalCa: ca
-          ? {
-              id: ca.internalCaId,
-              parentCaId: ca.internalParentCaId,
-              type: ca.internalType,
-              friendlyName: ca.internalFriendlyName,
-              organization: ca.internalOrganization,
-              ou: ca.internalOu,
-              country: ca.internalCountry,
-              province: ca.internalProvince,
-              locality: ca.internalLocality,
-              commonName: ca.internalCommonName,
-              dn: ca.internalDn,
-              serialNumber: ca.internalSerialNumber,
-              maxPathLength: ca.internalMaxPathLength,
-              keyAlgorithm: ca.internalKeyAlgorithm,
-              notBefore: ca.internalNotBefore?.toISOString(),
-              notAfter: ca.internalNotAfter?.toISOString(),
-              activeCaCertId: ca.internalActiveCaCertId
-            }
-          : undefined,
-        externalCa: ca
-          ? {
-              id: ca.externalCaId,
-              type: ca.externalType,
-              configuration: ca.externalConfiguration,
-              dnsAppConnectionId: ca.externalDnsAppConnectionId,
-              appConnectionId: ca.externalAppConnectionId,
-              credentials: ca.externalCredentials
-            }
-          : undefined
-      }));
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find - Certificate Authority" });
-    }
-  };
-
   return {
     ...caOrm,
-    findWithAssociatedCa,
-    buildCertificateChain,
-    findByIdWithAssociatedCa,
-    findByNameAndProjectIdWithAssociatedCa
+    buildCertificateChain
   };
 };

backend/src/services/certificate-authority/certificate-authority-enums.ts

@@ -1,19 +0,0 @@
-export enum CaType {
-  INTERNAL = "internal",
-  ACME = "acme"
-}
-
-export enum InternalCaType {
-  ROOT = "root",
-  INTERMEDIATE = "intermediate"
-}
-
-export enum CaStatus {
-  ACTIVE = "active",
-  DISABLED = "disabled",
-  PENDING_CERTIFICATE = "pending-certificate"
-}
-
-export enum CaRenewalType {
-  EXISTING = "existing"
-}

backend/src/services/certificate-authority/certificate-authority-fns.ts

@@ -5,14 +5,13 @@ import { NotFoundError } from "@app/lib/errors";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
 import { CertKeyAlgorithm, CertStatus } from "../certificate/certificate-types";
-import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
 import {
   TDNParts,
   TGetCaCertChainDTO,
   TGetCaCertChainsDTO,
   TGetCaCredentialsDTO,
   TRebuildCaCrlDTO
-} from "./internal/internal-certificate-authority-types";
+} from "./certificate-authority-types";
 
 /* eslint-disable no-bitwise */
 export const createSerialNumber = () => {
@@ -113,8 +112,8 @@ export const getCaCredentials = async ({
   projectDAL,
   kmsService
 }: TGetCaCredentialsDTO) => {
-  const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
-  if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
+  const ca = await certificateAuthorityDAL.findById(caId);
+  if (!ca) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
 
   const caSecret = await certificateAuthoritySecretDAL.findOne({ caId });
   if (!caSecret) throw new NotFoundError({ message: `CA secret for CA with ID '${caId}' not found` });
@@ -132,7 +131,7 @@ export const getCaCredentials = async ({
     cipherTextBlob: caSecret.encryptedPrivateKey
   });
 
-  const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+  const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm);
   const skObj = crypto.createPrivateKey({ key: decryptedPrivateKey, format: "der", type: "pkcs8" });
   const caPrivateKey = await crypto.subtle.importKey(
     "pkcs8",
@@ -256,12 +255,12 @@ export const rebuildCaCrl = async ({
   certificateDAL,
   kmsService
 }: TRebuildCaCrlDTO) => {
-  const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
-  if (!ca?.internalCa?.id) throw new NotFoundError({ message: `Internal CA with ID '${caId}' not found` });
+  const ca = await certificateAuthorityDAL.findById(caId);
+  if (!ca) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
 
   const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id });
 
-  const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+  const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm);
 
   const keyId = await getProjectKmsCertificateKeyId({
     projectId: ca.projectId,
@@ -288,7 +287,7 @@ export const rebuildCaCrl = async ({
   });
 
   const crl = await x509.X509CrlGenerator.create({
-    issuer: ca.internalCa.dn,
+    issuer: ca.dn,
     thisUpdate: new Date(),
     nextUpdate: new Date("2025/12/12"),
     entries: revokedCerts.map((revokedCert) => {
@@ -319,16 +318,3 @@ export const rebuildCaCrl = async ({
     }
   );
 };
-
-export const expandInternalCa = (
-  ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
-) => {
-  if (!ca.internalCa) {
-    throw new Error("Internal CA must be defined");
-  }
-  return {
-    ...ca.internalCa,
-    ...ca,
-    requireTemplateForIssuance: !ca.enableDirectIssuance
-  } as const;
-};

backend/src/services/certificate-authority/certificate-authority-maps.ts

@@ -1,6 +0,0 @@
-import { CaType } from "./certificate-authority-enums";
-
-export const CERTIFICATE_AUTHORITIES_TYPE_MAP: Record<CaType, string> = {
-  [CaType.INTERNAL]: "Internal",
-  [CaType.ACME]: "ACME"
-};

backend/src/services/certificate-authority/certificate-authority-queue.ts

@@ -1,10 +1,9 @@
 import * as x509 from "@peculiar/x509";
 import crypto from "crypto";
 
-import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
 import { getConfig } from "@app/lib/config/env";
 import { daysToMillisecond, secondsToMillis } from "@app/lib/dates";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -14,43 +13,21 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
 import { TCertificateAuthorityCrlDALFactory } from "../../ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-import { TAppConnectionDALFactory } from "../app-connection/app-connection-dal";
-import { TAppConnectionServiceFactory } from "../app-connection/app-connection-service";
-import { TCertificateBodyDALFactory } from "../certificate/certificate-body-dal";
-import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-dal";
-import { TPkiSubscriberDALFactory } from "../pki-subscriber/pki-subscriber-dal";
-import { SubscriberOperationStatus } from "../pki-subscriber/pki-subscriber-types";
-import { AcmeCertificateAuthorityFns } from "./acme/acme-certificate-authority-fns";
 import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
-import { CaType } from "./certificate-authority-enums";
 import { keyAlgorithmToAlgCfg } from "./certificate-authority-fns";
 import { TCertificateAuthoritySecretDALFactory } from "./certificate-authority-secret-dal";
-import { TExternalCertificateAuthorityDALFactory } from "./external-certificate-authority-dal";
-import {
-  TOrderCertificateForSubscriberDTO,
-  TRotateCaCrlTriggerDTO
-} from "./internal/internal-certificate-authority-types";
+import { TRotateCaCrlTriggerDTO } from "./certificate-authority-types";
 
 type TCertificateAuthorityQueueFactoryDep = {
+  // TODO: Pick
   certificateAuthorityDAL: TCertificateAuthorityDALFactory;
-  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById" | "update">;
-  appConnectionService: Pick<TAppConnectionServiceFactory, "connectAppConnectionById">;
-  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
-  keyStore: Pick<TKeyStoreFactory, "acquireLock" | "setItemWithExpiry" | "getItem">;
   certificateAuthorityCrlDAL: TCertificateAuthorityCrlDALFactory;
   certificateAuthoritySecretDAL: TCertificateAuthoritySecretDALFactory;
   certificateDAL: TCertificateDALFactory;
   projectDAL: Pick<TProjectDALFactory, "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction">;
-  kmsService: Pick<
-    TKmsServiceFactory,
-    "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey" | "createCipherPairWithDataKey"
-  >;
-  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
-  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
+  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey">;
   queueService: TQueueServiceFactory;
-  pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById" | "updateById">;
 };
-
 export type TCertificateAuthorityQueueFactory = ReturnType<typeof certificateAuthorityQueueFactory>;
 
 export const certificateAuthorityQueueFactory = ({
@@ -60,28 +37,8 @@ export const certificateAuthorityQueueFactory = ({
   certificateDAL,
   projectDAL,
   kmsService,
-  queueService,
-  keyStore,
-  appConnectionDAL,
-  appConnectionService,
-  externalCertificateAuthorityDAL,
-  certificateBodyDAL,
-  certificateSecretDAL,
-  pkiSubscriberDAL
+  queueService
 }: TCertificateAuthorityQueueFactoryDep) => {
-  const acmeFns = AcmeCertificateAuthorityFns({
-    appConnectionDAL,
-    appConnectionService,
-    certificateAuthorityDAL,
-    externalCertificateAuthorityDAL,
-    certificateDAL,
-    certificateBodyDAL,
-    certificateSecretDAL,
-    kmsService,
-    pkiSubscriberDAL,
-    projectDAL
-  });
-
   // TODO 1: auto-periodic rotation
   // TODO 2: manual rotation
 
@@ -114,76 +71,16 @@ export const certificateAuthorityQueueFactory = ({
     );
   };
 
-  const orderCertificateForSubscriber = async ({ subscriberId, caType }: TOrderCertificateForSubscriberDTO) => {
-    const entry = await keyStore.getItem(KeyStorePrefixes.CaOrderCertificateForSubscriberLock(subscriberId));
-    if (entry) {
-      throw new BadRequestError({ message: `Certificate order already in progress for subscriber ${subscriberId}` });
-    }
-
-    await queueService.queue(
-      QueueName.CaLifecycle,
-      QueueJobs.CaOrderCertificateForSubscriber,
-      {
-        subscriberId,
-        caType
-      },
-      {
-        attempts: 1,
-        removeOnComplete: true,
-        removeOnFail: true
-      }
-    );
-  };
-
-  queueService.start(QueueName.CaLifecycle, async (job) => {
-    if (job.name === QueueJobs.CaOrderCertificateForSubscriber) {
-      const { subscriberId, caType } = job.data;
-      let lock: Awaited<ReturnType<typeof keyStore.acquireLock>>;
-
-      try {
-        lock = await keyStore.acquireLock(
-          [KeyStorePrefixes.CaOrderCertificateForSubscriberLock(subscriberId)],
-          5 * 60 * 1000
-        );
-      } catch (e) {
-        logger.info(`CaOrderCertificate Failed to acquire lock [subscriberId=${subscriberId}] [job=${job.name}]`);
-        return;
-      }
-
-      try {
-        if (caType === CaType.ACME) {
-          await acmeFns.orderSubscriberCertificate(subscriberId);
-          await pkiSubscriberDAL.updateById(subscriberId, {
-            lastOperationStatus: SubscriberOperationStatus.SUCCESS,
-            lastOperationMessage: "Certificate ordered successfully",
-            lastOperationAt: new Date()
-          });
-        }
-      } catch (e: unknown) {
-        if (e instanceof Error) {
-          await pkiSubscriberDAL.updateById(subscriberId, {
-            lastOperationStatus: SubscriberOperationStatus.FAILED,
-            lastOperationMessage: e.message,
-            lastOperationAt: new Date()
-          });
-        }
-        logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);
-      } finally {
-        await lock.release();
-      }
-    }
-  });
-
   queueService.start(QueueName.CaCrlRotation, async (job) => {
     const { caId } = job.data;
     logger.info(`secretReminderQueue.process: [secretDocument=${caId}]`);
 
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
-    if (!ca.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
+    const ca = await certificateAuthorityDAL.findById(caId);
+    if (!ca) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
 
     const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id });
 
-    const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
+    const alg = keyAlgorithmToAlgCfg(ca.keyAlgorithm as CertKeyAlgorithm);
 
     const keyId = await getProjectKmsCertificateKeyId({
       projectId: ca.projectId,
@@ -209,7 +106,7 @@ export const certificateAuthorityQueueFactory = ({
     });
 
     const crl = await x509.X509CrlGenerator.create({
-      issuer: ca.internalCa.dn,
+      issuer: ca.dn,
       thisUpdate: new Date(),
       nextUpdate: new Date("2025/12/12"), // TODO: depends on configured rebuild interval
       entries: revokedCerts.map((revokedCert) => {
@@ -218,7 +115,7 @@ export const certificateAuthorityQueueFactory = ({
           revocationDate: new Date(revokedCert.revokedAt as Date),
           reason: revokedCert.revocationReason as number,
           invalidity: new Date("2022/01/01"),
-          issuer: ca.internalCa?.dn
+          issuer: ca.dn
         };
       }),
       signingAlgorithm: alg,
@@ -247,7 +144,6 @@ export const certificateAuthorityQueueFactory = ({
   });
 
   return {
-    setCaCrlRotationInterval,
-    orderCertificateForSubscriber
+    setCaCrlRotationInterval
   };
 };

backend/src/services/certificate-authority/certificate-authority-schemas.ts

@@ -1,32 +0,0 @@
-import z from "zod";
-
-import { CertificateAuthoritiesSchema } from "@app/db/schemas";
-import { CertificateAuthorities } from "@app/lib/api-docs/constants";
-import { slugSchema } from "@app/server/lib/schemas";
-
-import { CaStatus, CaType } from "./certificate-authority-enums";
-
-export const BaseCertificateAuthoritySchema = CertificateAuthoritiesSchema.pick({
-  projectId: true,
-  enableDirectIssuance: true,
-  name: true,
-  id: true
-}).extend({
-  status: z.nativeEnum(CaStatus)
-});
-
-export const GenericCreateCertificateAuthorityFieldsSchema = (type: CaType) =>
-  z.object({
-    name: slugSchema({ field: "name" }).describe(CertificateAuthorities.CREATE(type).name),
-    projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.CREATE(type).projectId),
-    enableDirectIssuance: z.boolean().describe(CertificateAuthorities.CREATE(type).enableDirectIssuance),
-    status: z.nativeEnum(CaStatus).describe(CertificateAuthorities.CREATE(type).status)
-  });
-
-export const GenericUpdateCertificateAuthorityFieldsSchema = (type: CaType) =>
-  z.object({
-    name: slugSchema({ field: "name" }).optional().describe(CertificateAuthorities.UPDATE(type).name),
-    projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.UPDATE(type).projectId),
-    enableDirectIssuance: z.boolean().optional().describe(CertificateAuthorities.UPDATE(type).enableDirectIssuance),
-    status: z.nativeEnum(CaStatus).optional().describe(CertificateAuthorities.UPDATE(type).status)
-  });

backend/src/services/certificate-authority/certificate-authority-types.ts

@@ -1,18 +1,186 @@
-import { TAcmeCertificateAuthority, TAcmeCertificateAuthorityInput } from "./acme/acme-certificate-authority-types";
-import { CaType } from "./certificate-authority-enums";
-import {
-  TInternalCertificateAuthority,
-  TInternalCertificateAuthorityInput
-} from "./internal/internal-certificate-authority-types";
+import { TProjectPermission } from "@app/lib/types";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TKmsServiceFactory } from "@app/services/kms/kms-service";
+import { TProjectDALFactory } from "@app/services/project/project-dal";
 
-export type TCertificateAuthority = TInternalCertificateAuthority | TAcmeCertificateAuthority;
+import { TCertificateAuthorityCrlDALFactory } from "../../ee/services/certificate-authority-crl/certificate-authority-crl-dal";
+import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "../certificate/certificate-types";
+import { TCertificateAuthorityCertDALFactory } from "./certificate-authority-cert-dal";
+import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
+import { TCertificateAuthoritySecretDALFactory } from "./certificate-authority-secret-dal";
 
-export type TCertificateAuthorityInput = TInternalCertificateAuthorityInput | TAcmeCertificateAuthorityInput;
+export enum CaType {
+  ROOT = "root",
+  INTERMEDIATE = "intermediate"
+}
 
-export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id">;
+export enum CaStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled",
+  PENDING_CERTIFICATE = "pending-certificate"
+}
 
-export type TUpdateCertificateAuthorityDTO = Partial<Omit<TCreateCertificateAuthorityDTO, "projectId">> & {
+export enum CaRenewalType {
+  EXISTING = "existing"
+}
+
+export type TCreateCaDTO = {
+  projectSlug: string;
   type: CaType;
-  caName: string;
-  projectId: string;
+  friendlyName?: string;
+  commonName: string;
+  organization: string;
+  ou: string;
+  country: string;
+  province: string;
+  locality: string;
+  notBefore?: string;
+  notAfter?: string;
+  maxPathLength: number;
+  keyAlgorithm: CertKeyAlgorithm;
+  requireTemplateForIssuance: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TUpdateCaDTO = {
+  caId: string;
+  status?: CaStatus;
+  requireTemplateForIssuance?: boolean;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDeleteCaDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCsrDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TRenewCaCertDTO = {
+  caId: string;
+  notAfter: string;
+  type: CaRenewalType;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCertsDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TGetCaCertDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TSignIntermediateDTO = {
+  caId: string;
+  csr: string;
+  notBefore?: string;
+  notAfter: string;
+  maxPathLength: number;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TImportCertToCaDTO = {
+  caId: string;
+  certificate: string;
+  certificateChain: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TIssueCertFromCaDTO = {
+  caId?: string;
+  certificateTemplateId?: string;
+  pkiCollectionId?: string;
+  friendlyName?: string;
+  commonName: string;
+  altNames: string;
+  ttl: string;
+  notBefore?: string;
+  notAfter?: string;
+  keyUsages?: CertKeyUsage[];
+  extendedKeyUsages?: CertExtendedKeyUsage[];
+} & Omit<TProjectPermission, "projectId">;
+
+export type TSignCertFromCaDTO =
+  | {
+      isInternal: true;
+      caId?: string;
+      csr: string;
+      certificateTemplateId?: string;
+      pkiCollectionId?: string;
+      friendlyName?: string;
+      commonName?: string;
+      altNames?: string;
+      ttl?: string;
+      notBefore?: string;
+      notAfter?: string;
+      keyUsages?: CertKeyUsage[];
+      extendedKeyUsages?: CertExtendedKeyUsage[];
+    }
+  | ({
+      isInternal: false;
+      caId?: string;
+      csr: string;
+      certificateTemplateId?: string;
+      pkiCollectionId?: string;
+      friendlyName?: string;
+      commonName?: string;
+      altNames: string;
+      ttl: string;
+      notBefore?: string;
+      notAfter?: string;
+      keyUsages?: CertKeyUsage[];
+      extendedKeyUsages?: CertExtendedKeyUsage[];
+    } & Omit<TProjectPermission, "projectId">);
+
+export type TGetCaCertificateTemplatesDTO = {
+  caId: string;
+} & Omit<TProjectPermission, "projectId">;
+
+export type TDNParts = {
+  commonName?: string;
+  organization?: string;
+  ou?: string;
+  country?: string;
+  province?: string;
+  locality?: string;
+};
+
+export type TGetCaCredentialsDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TGetCaCertChainsDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TGetCaCertChainDTO = {
+  caCertId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+};
+
+export type TRebuildCaCrlDTO = {
+  caId: string;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
+  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "update">;
+  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  certificateDAL: Pick<TCertificateDALFactory, "find">;
+  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "decryptWithKmsKey" | "encryptWithKmsKey">;
+};
+
+export type TRotateCaCrlTriggerDTO = {
+  caId: string;
+  rotationIntervalDays: number;
 };

backend/src/services/certificate-authority/certificate-authority-validators.ts

@@ -15,7 +15,7 @@ export const validateAltNameField = z
   .trim()
   .refine(
     (name) => {
-      return isFQDN(name, { allow_wildcard: true }) || z.string().email().safeParse(name).success || isValidIp(name);
+      return isFQDN(name) || z.string().email().safeParse(name).success || isValidIp(name);
     },
     {
       message: "SAN must be a valid hostname, email address, or IP address"

backend/src/services/certificate-authority/external-certificate-authority-dal.ts

@@ -1,13 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TExternalCertificateAuthorityDALFactory = ReturnType<typeof externalCertificateAuthorityDALFactory>;
-
-export const externalCertificateAuthorityDALFactory = (db: TDbClient) => {
-  const caOrm = ormify(db, TableName.ExternalCertificateAuthority);
-
-  return {
-    ...caOrm
-  };
-};

backend/src/services/certificate-authority/internal/internal-certificate-authority-dal.ts

@@ -1,13 +0,0 @@
-import { TDbClient } from "@app/db";
-import { TableName } from "@app/db/schemas";
-import { ormify } from "@app/lib/knex";
-
-export type TInternalCertificateAuthorityDALFactory = ReturnType<typeof internalCertificateAuthorityDALFactory>;
-
-export const internalCertificateAuthorityDALFactory = (db: TDbClient) => {
-  const caOrm = ormify(db, TableName.InternalCertificateAuthority);
-
-  return {
-    ...caOrm
-  };
-};

backend/src/services/certificate-authority/internal/internal-certificate-authority-fns.ts

@@ -1,263 +0,0 @@
-import * as x509 from "@peculiar/x509";
-import { KeyObject } from "crypto";
-import { z } from "zod";
-
-import { TPkiSubscribers } from "@app/db/schemas";
-import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-import { getConfig } from "@app/lib/config/env";
-import { BadRequestError } from "@app/lib/errors";
-import { ms } from "@app/lib/ms";
-import { isFQDN } from "@app/lib/validator/validate-url";
-import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
-import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
-import {
-  CertExtendedKeyUsage,
-  CertKeyAlgorithm,
-  CertKeyUsage,
-  CertStatus
-} from "@app/services/certificate/certificate-types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
-
-import { TCertificateAuthorityCertDALFactory } from "../certificate-authority-cert-dal";
-import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
-import { CaStatus } from "../certificate-authority-enums";
-import {
-  createSerialNumber,
-  getCaCertChain,
-  getCaCredentials,
-  keyAlgorithmToAlgCfg
-} from "../certificate-authority-fns";
-import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority-secret-dal";
-
-type TInternalCertificateAuthorityFnsDeps = {
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa" | "findById">;
-  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
-  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
-  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "findOne">;
-  projectDAL: Pick<TProjectDALFactory, "findById" | "transaction" | "findOne" | "updateById">;
-  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "encryptWithKmsKey" | "generateKmsKey">;
-  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
-  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
-  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
-};
-
-export const InternalCertificateAuthorityFns = ({
-  certificateAuthorityDAL,
-  certificateAuthorityCertDAL,
-  projectDAL,
-  kmsService,
-  certificateAuthoritySecretDAL,
-  certificateAuthorityCrlDAL,
-  certificateDAL,
-  certificateBodyDAL,
-  certificateSecretDAL
-}: TInternalCertificateAuthorityFnsDeps) => {
-  const issueCertificate = async (
-    subscriber: TPkiSubscribers,
-    ca: Awaited<ReturnType<TCertificateAuthorityDALFactory["findByIdWithAssociatedCa"]>>
-  ) => {
-    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
-    if (!ca.internalCa?.activeCaCertId)
-      throw new BadRequestError({ message: "CA does not have a certificate installed" });
-
-    const caCert = await certificateAuthorityCertDAL.findById(ca.internalCa.activeCaCertId);
-
-    const certificateManagerKmsId = await getProjectKmsCertificateKeyId({
-      projectId: ca.projectId,
-      projectDAL,
-      kmsService
-    });
-
-    const kmsDecryptor = await kmsService.decryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-
-    const decryptedCaCert = await kmsDecryptor({
-      cipherTextBlob: caCert.encryptedCertificate
-    });
-
-    const caCertObj = new x509.X509Certificate(decryptedCaCert);
-    const notBeforeDate = new Date();
-    const notAfterDate = new Date(new Date().getTime() + ms(subscriber.ttl ?? "0"));
-    const caCertNotBeforeDate = new Date(caCertObj.notBefore);
-    const caCertNotAfterDate = new Date(caCertObj.notAfter);
-
-    // check not before constraint
-    if (notBeforeDate < caCertNotBeforeDate) {
-      throw new BadRequestError({ message: "notBefore date is before CA certificate's notBefore date" });
-    }
-
-    // check not after constraint
-    if (notAfterDate > caCertNotAfterDate) {
-      throw new BadRequestError({ message: "notAfter date is after CA certificate's notAfter date" });
-    }
-
-    const alg = keyAlgorithmToAlgCfg(ca.internalCa.keyAlgorithm as CertKeyAlgorithm);
-    const leafKeys = await crypto.subtle.generateKey(alg, true, ["sign", "verify"]);
-
-    const csrObj = await x509.Pkcs10CertificateRequestGenerator.create({
-      name: `CN=${subscriber.commonName}`,
-      keys: leafKeys,
-      signingAlgorithm: alg,
-      extensions: [
-        // eslint-disable-next-line no-bitwise
-        new x509.KeyUsagesExtension(x509.KeyUsageFlags.digitalSignature | x509.KeyUsageFlags.keyEncipherment)
-      ],
-      attributes: [new x509.ChallengePasswordAttribute("password")]
-    });
-
-    const { caPrivateKey, caSecret } = await getCaCredentials({
-      caId: ca.id,
-      certificateAuthorityDAL,
-      certificateAuthoritySecretDAL,
-      projectDAL,
-      kmsService
-    });
-
-    const caCrl = await certificateAuthorityCrlDAL.findOne({ caSecretId: caSecret.id });
-    const appCfg = getConfig();
-
-    const distributionPointUrl = `${appCfg.SITE_URL}/api/v1/pki/crl/${caCrl.id}/der`;
-    const caIssuerUrl = `${appCfg.SITE_URL}/api/v1/pki/ca/${ca.id}/certificates/${caCert.id}/der`;
-
-    const extensions: x509.Extension[] = [
-      new x509.BasicConstraintsExtension(false),
-      new x509.CRLDistributionPointsExtension([distributionPointUrl]),
-      await x509.AuthorityKeyIdentifierExtension.create(caCertObj, false),
-      await x509.SubjectKeyIdentifierExtension.create(csrObj.publicKey),
-      new x509.AuthorityInfoAccessExtension({
-        caIssuers: new x509.GeneralName("url", caIssuerUrl)
-      }),
-      new x509.CertificatePolicyExtension(["2.5.29.32.0"]) // anyPolicy
-    ];
-
-    const selectedKeyUsages = subscriber.keyUsages as CertKeyUsage[];
-    // eslint-disable-next-line no-bitwise
-    const keyUsagesBitValue = selectedKeyUsages.reduce((accum, keyUsage) => accum | x509.KeyUsageFlags[keyUsage], 0);
-    if (keyUsagesBitValue) {
-      extensions.push(new x509.KeyUsagesExtension(keyUsagesBitValue, true));
-    }
-
-    if (subscriber.extendedKeyUsages.length) {
-      const extendedKeyUsagesExtension = new x509.ExtendedKeyUsageExtension(
-        subscriber.extendedKeyUsages.map((eku) => x509.ExtendedKeyUsage[eku as CertExtendedKeyUsage]),
-        true
-      );
-      extensions.push(extendedKeyUsagesExtension);
-    }
-
-    let altNamesArray: { type: "email" | "dns"; value: string }[] = [];
-
-    if (subscriber.subjectAlternativeNames?.length) {
-      altNamesArray = subscriber.subjectAlternativeNames.map((altName) => {
-        if (z.string().email().safeParse(altName).success) {
-          return { type: "email", value: altName };
-        }
-
-        if (isFQDN(altName, { allow_wildcard: true })) {
-          return { type: "dns", value: altName };
-        }
-
-        throw new BadRequestError({ message: `Invalid SAN entry: ${altName}` });
-      });
-
-      const altNamesExtension = new x509.SubjectAlternativeNameExtension(altNamesArray, false);
-      extensions.push(altNamesExtension);
-    }
-
-    const serialNumber = createSerialNumber();
-    const leafCert = await x509.X509CertificateGenerator.create({
-      serialNumber,
-      subject: csrObj.subject,
-      issuer: caCertObj.subject,
-      notBefore: notBeforeDate,
-      notAfter: notAfterDate,
-      signingKey: caPrivateKey,
-      publicKey: csrObj.publicKey,
-      signingAlgorithm: alg,
-      extensions
-    });
-
-    const skLeafObj = KeyObject.from(leafKeys.privateKey);
-    const skLeaf = skLeafObj.export({ format: "pem", type: "pkcs8" }) as string;
-
-    const kmsEncryptor = await kmsService.encryptWithKmsKey({
-      kmsId: certificateManagerKmsId
-    });
-    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
-      plainText: Buffer.from(new Uint8Array(leafCert.rawData))
-    });
-    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
-      plainText: Buffer.from(skLeaf)
-    });
-
-    const { caCert: issuingCaCertificate, caCertChain } = await getCaCertChain({
-      caCertId: caCert.id,
-      certificateAuthorityDAL,
-      certificateAuthorityCertDAL,
-      projectDAL,
-      kmsService
-    });
-
-    const certificateChainPem = `${issuingCaCertificate}\n${caCertChain}`.trim();
-
-    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
-      plainText: Buffer.from(certificateChainPem)
-    });
-
-    await certificateDAL.transaction(async (tx) => {
-      const cert = await certificateDAL.create(
-        {
-          caId: ca.id,
-          caCertId: caCert.id,
-          pkiSubscriberId: subscriber.id,
-          status: CertStatus.ACTIVE,
-          friendlyName: subscriber.commonName,
-          commonName: subscriber.commonName,
-          altNames: subscriber.subjectAlternativeNames.join(","),
-          serialNumber,
-          notBefore: notBeforeDate,
-          notAfter: notAfterDate,
-          keyUsages: selectedKeyUsages,
-          extendedKeyUsages: subscriber.extendedKeyUsages as CertExtendedKeyUsage[],
-          projectId: ca.projectId
-        },
-        tx
-      );
-
-      await certificateBodyDAL.create(
-        {
-          certId: cert.id,
-          encryptedCertificate,
-          encryptedCertificateChain
-        },
-        tx
-      );
-
-      await certificateSecretDAL.create(
-        {
-          certId: cert.id,
-          encryptedPrivateKey
-        },
-        tx
-      );
-    });
-
-    return {
-      certificate: leafCert.toString("pem"),
-      certificateChain: certificateChainPem,
-      issuingCaCertificate,
-      privateKey: skLeaf,
-      serialNumber,
-      ca,
-      subscriber
-    };
-  };
-
-  return {
-    issueCertificate
-  };
-};

backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts

@@ -1,62 +0,0 @@
-import { z } from "zod";
-
-import { CertificateAuthorities } from "@app/lib/api-docs/constants";
-import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
-
-import { CaType, InternalCaType } from "../certificate-authority-enums";
-import {
-  BaseCertificateAuthoritySchema,
-  GenericCreateCertificateAuthorityFieldsSchema,
-  GenericUpdateCertificateAuthorityFieldsSchema
-} from "../certificate-authority-schemas";
-import { validateCaDateField } from "../certificate-authority-validators";
-
-const InternalCertificateAuthorityConfigurationSchema = z
-  .object({
-    type: z.nativeEnum(InternalCaType).describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.type),
-    friendlyName: z.string().optional().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.friendlyName),
-    commonName: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.commonName),
-    organization: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.organization),
-    ou: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.ou),
-    country: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.country),
-    province: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.province),
-    locality: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.locality),
-    notBefore: validateCaDateField.optional().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.notBefore),
-    notAfter: validateCaDateField.optional().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.notAfter),
-    maxPathLength: z.number().min(-1).nullish().describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.maxPathLength),
-    keyAlgorithm: z.nativeEnum(CertKeyAlgorithm).describe(CertificateAuthorities.CONFIGURATIONS.INTERNAL.keyAlgorithm),
-    dn: z.string().trim().nullish(),
-    parentCaId: z.string().uuid().nullish(),
-    serialNumber: z.string().trim().nullish(),
-    activeCaCertId: z.string().uuid().nullish()
-  })
-  .refine(
-    (data) => {
-      // Check that at least one of the specified fields is non-empty
-      return [data.commonName, data.organization, data.ou, data.country, data.province, data.locality].some(
-        (field) => field !== ""
-      );
-    },
-    {
-      message:
-        "At least one of the fields commonName, organization, ou, country, province, or locality must be non-empty",
-      path: []
-    }
-  );
-
-export const InternalCertificateAuthoritySchema = BaseCertificateAuthoritySchema.extend({
-  type: z.literal(CaType.INTERNAL),
-  configuration: InternalCertificateAuthorityConfigurationSchema
-});
-
-export const CreateInternalCertificateAuthoritySchema = GenericCreateCertificateAuthorityFieldsSchema(
-  CaType.INTERNAL
-).extend({
-  configuration: InternalCertificateAuthorityConfigurationSchema
-});
-
-export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(
-  CaType.INTERNAL
-).extend({
-  configuration: InternalCertificateAuthorityConfigurationSchema.optional()
-});

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -1,223 +0,0 @@
-import { z } from "zod";
-
-import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
-import { TProjectPermission } from "@app/lib/types";
-import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
-import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
-import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TProjectDALFactory } from "@app/services/project/project-dal";
-
-import { TCertificateAuthorityCertDALFactory } from "../certificate-authority-cert-dal";
-import { TCertificateAuthorityDALFactory } from "../certificate-authority-dal";
-import { CaRenewalType, CaStatus, CaType, InternalCaType } from "../certificate-authority-enums";
-import { TCertificateAuthoritySecretDALFactory } from "../certificate-authority-secret-dal";
-import {
-  CreateInternalCertificateAuthoritySchema,
-  InternalCertificateAuthoritySchema,
-  UpdateInternalCertificateAuthoritySchema
-} from "./internal-certificate-authority-schemas";
-
-export type TInternalCertificateAuthority = z.infer<typeof InternalCertificateAuthoritySchema>;
-
-export type TInternalCertificateAuthorityInput = z.infer<typeof CreateInternalCertificateAuthoritySchema>;
-
-export type TCreateInternalCertificateAuthorityDTO = z.infer<typeof CreateInternalCertificateAuthoritySchema>;
-
-export type TUpdateInternalCertificateAuthorityDTO = z.infer<typeof UpdateInternalCertificateAuthoritySchema>;
-
-export type TCreateCaDTO =
-  | {
-      isInternal: true;
-      projectId: string;
-      type: InternalCaType;
-      friendlyName?: string;
-      name?: string;
-      commonName: string;
-      organization: string;
-      ou: string;
-      country: string;
-      province: string;
-      locality: string;
-      notBefore?: string;
-      notAfter?: string;
-      maxPathLength?: number | null;
-      keyAlgorithm: CertKeyAlgorithm;
-      enableDirectIssuance: boolean;
-    }
-  | ({
-      isInternal: false;
-      projectSlug: string;
-      type: InternalCaType;
-      friendlyName?: string;
-      name?: string;
-      commonName: string;
-      organization: string;
-      ou: string;
-      country: string;
-      province: string;
-      locality: string;
-      notBefore?: string;
-      notAfter?: string;
-      maxPathLength?: number | null;
-      keyAlgorithm: CertKeyAlgorithm;
-      enableDirectIssuance: boolean;
-    } & Omit<TProjectPermission, "projectId">);
-
-export type TGetCaDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TUpdateCaDTO =
-  | {
-      isInternal: true;
-      caId: string;
-      name?: string;
-      status?: CaStatus;
-      enableDirectIssuance?: boolean;
-    }
-  | ({
-      isInternal: false;
-      caId: string;
-      name?: string;
-      status?: CaStatus;
-      enableDirectIssuance?: boolean;
-    } & Omit<TProjectPermission, "projectId">);
-
-export type TDeleteCaDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TGetCaCsrDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TRenewCaCertDTO = {
-  caId: string;
-  notAfter: string;
-  type: CaRenewalType;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TGetCaCertsDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TGetCaCertDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TSignIntermediateDTO = {
-  caId: string;
-  csr: string;
-  notBefore?: string;
-  notAfter: string;
-  maxPathLength: number;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TImportCertToCaDTO = {
-  caId: string;
-  certificate: string;
-  certificateChain: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TIssueCertFromCaDTO = {
-  caId?: string;
-  certificateTemplateId?: string;
-  pkiCollectionId?: string;
-  friendlyName?: string;
-  commonName: string;
-  altNames: string;
-  ttl: string;
-  notBefore?: string;
-  notAfter?: string;
-  keyUsages?: CertKeyUsage[];
-  extendedKeyUsages?: CertExtendedKeyUsage[];
-} & Omit<TProjectPermission, "projectId">;
-
-export type TSignCertFromCaDTO =
-  | {
-      isInternal: true;
-      caId?: string;
-      csr: string;
-      certificateTemplateId?: string;
-      pkiCollectionId?: string;
-      friendlyName?: string;
-      commonName?: string;
-      altNames?: string;
-      ttl?: string;
-      notBefore?: string;
-      notAfter?: string;
-      keyUsages?: CertKeyUsage[];
-      extendedKeyUsages?: CertExtendedKeyUsage[];
-    }
-  | ({
-      isInternal: false;
-      caId?: string;
-      csr: string;
-      certificateTemplateId?: string;
-      pkiCollectionId?: string;
-      friendlyName?: string;
-      commonName?: string;
-      altNames: string;
-      ttl: string;
-      notBefore?: string;
-      notAfter?: string;
-      keyUsages?: CertKeyUsage[];
-      extendedKeyUsages?: CertExtendedKeyUsage[];
-    } & Omit<TProjectPermission, "projectId">);
-
-export type TGetCaCertificateTemplatesDTO = {
-  caId: string;
-} & Omit<TProjectPermission, "projectId">;
-
-export type TDNParts = {
-  commonName?: string;
-  organization?: string;
-  ou?: string;
-  country?: string;
-  province?: string;
-  locality?: string;
-};
-
-export type TGetCaCredentialsDTO = {
-  caId: string;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
-  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
-  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
-};
-
-export type TGetCaCertChainsDTO = {
-  caId: string;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
-  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "find">;
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
-  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
-};
-
-export type TGetCaCertChainDTO = {
-  caCertId: string;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
-  certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
-  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
-};
-
-export type TRebuildCaCrlDTO = {
-  caId: string;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
-  certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "update">;
-  certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
-  certificateDAL: Pick<TCertificateDALFactory, "find">;
-  kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "decryptWithKmsKey" | "encryptWithKmsKey">;
-};
-
-export type TRotateCaCrlTriggerDTO = {
-  caId: string;
-  rotationIntervalDays: number;
-};
-
-export type TOrderCertificateForSubscriberDTO = {
-  subscriberId: string;
-  caType: CaType;
-};

backend/src/services/certificate-template/certificate-template-dal.ts

@@ -19,15 +19,10 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
           `${TableName.CertificateAuthority}.id`,
           `${TableName.CertificateTemplate}.caId`
         )
-        .join(
-          TableName.InternalCertificateAuthority,
-          `${TableName.InternalCertificateAuthority}.caId`,
-          `${TableName.CertificateAuthority}.id`
-        )
         .where(`${TableName.CertificateAuthority}.projectId`, "=", projectId)
         .select(selectAllTableCols(TableName.CertificateTemplate))
         .select(
-          db.ref("friendlyName").as("caName").withSchema(TableName.InternalCertificateAuthority),
+          db.ref("friendlyName").as("caName").withSchema(TableName.CertificateAuthority),
           db.ref("projectId").withSchema(TableName.CertificateAuthority)
         );
 
@@ -46,16 +41,11 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
           `${TableName.CertificateTemplate}.caId`
         )
         .join(TableName.Project, `${TableName.Project}.id`, `${TableName.CertificateAuthority}.projectId`)
-        .join(
-          TableName.InternalCertificateAuthority,
-          `${TableName.InternalCertificateAuthority}.caId`,
-          `${TableName.CertificateAuthority}.id`
-        )
         .where(`${TableName.CertificateTemplate}.id`, "=", id)
         .select(selectAllTableCols(TableName.CertificateTemplate))
         .select(
           db.ref("projectId").withSchema(TableName.CertificateAuthority),
-          db.ref("friendlyName").as("caName").withSchema(TableName.InternalCertificateAuthority),
+          db.ref("friendlyName").as("caName").withSchema(TableName.CertificateAuthority),
           db.ref("orgId").withSchema(TableName.Project)
         )
         .first();

backend/src/services/certificate/certificate-dal.ts

@@ -3,28 +3,11 @@ import { TableName } from "@app/db/schemas";
 import { DatabaseError } from "@app/lib/errors";
 import { ormify } from "@app/lib/knex";
 
-import { CertStatus } from "./certificate-types";
-
 export type TCertificateDALFactory = ReturnType<typeof certificateDALFactory>;
 
 export const certificateDALFactory = (db: TDbClient) => {
   const certificateOrm = ormify(db, TableName.Certificate);
 
-  const findLatestActiveCertForSubscriber = async ({ subscriberId }: { subscriberId: string }) => {
-    try {
-      const cert = await db
-        .replicaNode()(TableName.Certificate)
-        .where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
-        .where("notAfter", ">", new Date())
-        .orderBy("notBefore", "desc")
-        .first();
-
-      return cert;
-    } catch (error) {
-      throw new DatabaseError({ error, name: "Find latest active certificate for subscriber" });
-    }
-  };
-
   const countCertificatesInProject = async ({
     projectId,
     friendlyName,
@@ -82,7 +65,6 @@ export const certificateDALFactory = (db: TDbClient) => {
   return {
     ...certificateOrm,
     countCertificatesInProject,
-    countCertificatesForPkiSubscriber,
-    findLatestActiveCertForSubscriber
+    countCertificatesForPkiSubscriber
   };
 };

backend/src/services/certificate/certificate-fns.ts

@@ -1,12 +1,11 @@
 import crypto from "node:crypto";
 
 import * as x509 from "@peculiar/x509";
-import RE2 from "re2";
 
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 
 import { getProjectKmsCertificateKeyId } from "../project/project-fns";
-import { CrlReason, TGetCertificateCredentialsDTO } from "./certificate-types";
+import { CrlReason, TBuildCertificateChainDTO, TGetCertificateCredentialsDTO } from "./certificate-types";
 
 export const revocationReasonToCrlCode = (crlReason: CrlReason) => {
   switch (crlReason) {
@@ -53,12 +52,6 @@ export const constructPemChainFromCerts = (certificates: x509.X509Certificate[])
     .join("\n")
     .trim();
 
-export const splitPemChain = (pemText: string) => {
-  const re2Pattern = new RE2("-----BEGIN CERTIFICATE-----[^-]+-----END CERTIFICATE-----", "g");
-
-  return re2Pattern.match(pemText) || [];
-};
-
 /**
  * Return the public and private key of certificate
  * Note: credentials are returned as PEM strings
@@ -102,3 +95,29 @@ export const getCertificateCredentials = async ({
     throw new BadRequestError({ message: `Failed to process private key for certificate with ID '${certId}'` });
   }
 };
+
+// If the certificate was generated after ~05/01/25 it will have a encryptedCertificateChain attached to it's body
+// Otherwise we'll fallback to manually building the chain
+export const buildCertificateChain = async ({
+  caCert,
+  caCertChain,
+  encryptedCertificateChain,
+  kmsService,
+  kmsId
+}: TBuildCertificateChainDTO) => {
+  if (!encryptedCertificateChain && !caCert) {
+    return null;
+  }
+
+  let certificateChain = `${caCert}\n${caCertChain}`.trim();
+
+  if (encryptedCertificateChain) {
+    const kmsDecryptor = await kmsService.decryptWithKmsKey({ kmsId });
+    const decryptedCertChain = await kmsDecryptor({
+      cipherTextBlob: encryptedCertificateChain
+    });
+    certificateChain = decryptedCertChain.toString();
+  }
+
+  return certificateChain;
+};

backend/src/services/certificate/certificate-service.ts

@@ -1,57 +1,45 @@
 import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
-import { createPrivateKey, createPublicKey, sign, verify } from "crypto";
 
-import { ActionProjectType, ProjectType } from "@app/db/schemas";
+import { ActionProjectType } from "@app/db/schemas";
 import { TCertificateAuthorityCrlDALFactory } from "@app/ee/services/certificate-authority-crl/certificate-authority-crl-dal";
 import { TPermissionServiceFactory } from "@app/ee/services/permission/permission-service";
 import {
   ProjectPermissionCertificateActions,
   ProjectPermissionSub
 } from "@app/ee/services/permission/project-permission";
-import { BadRequestError, NotFoundError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
 import { TCertificateAuthorityCertDALFactory } from "@app/services/certificate-authority/certificate-authority-cert-dal";
 import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
 import { TCertificateAuthoritySecretDALFactory } from "@app/services/certificate-authority/certificate-authority-secret-dal";
 import { TKmsServiceFactory } from "@app/services/kms/kms-service";
-import { TPkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
-import { TPkiCollectionItemDALFactory } from "@app/services/pki-collection/pki-collection-item-dal";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
-import { expandInternalCa, getCaCertChain, rebuildCaCrl } from "../certificate-authority/certificate-authority-fns";
-import { getCertificateCredentials, revocationReasonToCrlCode, splitPemChain } from "./certificate-fns";
+import { getCaCertChain, rebuildCaCrl } from "../certificate-authority/certificate-authority-fns";
+import { buildCertificateChain, getCertificateCredentials, revocationReasonToCrlCode } from "./certificate-fns";
 import { TCertificateSecretDALFactory } from "./certificate-secret-dal";
 import {
-  CertExtendedKeyUsage,
-  CertExtendedKeyUsageOIDToName,
-  CertKeyUsage,
   CertStatus,
   TDeleteCertDTO,
   TGetCertBodyDTO,
   TGetCertBundleDTO,
   TGetCertDTO,
   TGetCertPrivateKeyDTO,
-  TImportCertDTO,
   TRevokeCertDTO
 } from "./certificate-types";
 
 type TCertificateServiceFactoryDep = {
-  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "deleteById" | "update" | "find" | "transaction" | "create">;
-  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne" | "create">;
-  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne" | "create">;
-  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById" | "findByIdWithAssociatedCa">;
+  certificateDAL: Pick<TCertificateDALFactory, "findOne" | "deleteById" | "update" | "find">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne">;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
   certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "update">;
   certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
-  pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "findById">;
-  pkiCollectionItemDAL: Pick<TPkiCollectionItemDALFactory, "create">;
-  projectDAL: Pick<
-    TProjectDALFactory,
-    "findProjectBySlug" | "findOne" | "updateById" | "findById" | "transaction" | "getProjectFromSplitId"
-  >;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "findById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "generateKmsKey" | "encryptWithKmsKey" | "decryptWithKmsKey">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
@@ -66,8 +54,6 @@ export const certificateServiceFactory = ({
   certificateAuthorityCertDAL,
   certificateAuthorityCrlDAL,
   certificateAuthoritySecretDAL,
-  pkiCollectionDAL,
-  pkiCollectionItemDAL,
   projectDAL,
   kmsService,
   permissionService
@@ -77,11 +63,12 @@ export const certificateServiceFactory = ({
    */
   const getCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.CertificateManager
@@ -93,7 +80,8 @@ export const certificateServiceFactory = ({
     );
 
     return {
-      cert
+      cert,
+      ca
     };
   };
 
@@ -108,11 +96,12 @@ export const certificateServiceFactory = ({
     actorOrgId
   }: TGetCertPrivateKeyDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.CertificateManager
@@ -125,13 +114,14 @@ export const certificateServiceFactory = ({
 
     const { certPrivateKey } = await getCertificateCredentials({
       certId: cert.id,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       certificateSecretDAL,
       projectDAL,
       kmsService
     });
 
     return {
+      ca,
       cert,
       certPrivateKey
     };
@@ -142,11 +132,12 @@ export const certificateServiceFactory = ({
    */
   const deleteCert = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TDeleteCertDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.CertificateManager
@@ -160,7 +151,8 @@ export const certificateServiceFactory = ({
     const deletedCert = await certificateDAL.deleteById(cert.id);
 
     return {
-      deletedCert
+      deletedCert,
+      ca
     };
   };
 
@@ -178,20 +170,7 @@ export const certificateServiceFactory = ({
     actorOrgId
   }: TRevokeCertDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
-
-    if (!cert.caId) {
-      throw new BadRequestError({
-        message: "Cannot revoke imported certificates"
-      });
-    }
-
-    const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(cert.caId);
-
-    if (ca.externalCa?.id) {
-      throw new BadRequestError({
-        message: "Cannot revoke external certificates"
-      });
-    }
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -232,7 +211,7 @@ export const certificateServiceFactory = ({
       kmsService
     });
 
-    return { revokedAt, cert, ca: expandInternalCa(ca) };
+    return { revokedAt, cert, ca };
   };
 
   /**
@@ -241,11 +220,12 @@ export const certificateServiceFactory = ({
    */
   const getCertBody = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertBodyDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.CertificateManager
@@ -259,7 +239,7 @@ export const certificateServiceFactory = ({
     const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
 
     const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       projectDAL,
       kmsService
     });
@@ -273,259 +253,28 @@ export const certificateServiceFactory = ({
 
     const certObj = new x509.X509Certificate(decryptedCert);
 
-    let certificateChain = null;
+    const { caCert, caCertChain } = await getCaCertChain({
+      caCertId: cert.caCertId,
+      certificateAuthorityDAL,
+      certificateAuthorityCertDAL,
+      projectDAL,
+      kmsService
+    });
 
-    // On newer certs the certBody.encryptedCertificateChain column will always exist.
-    // Older certs will have a caCertId which will be used as a fallback mechanism for structuring the chain.
-    if (certBody.encryptedCertificateChain) {
-      const decryptedCertChain = await kmsDecryptor({
-        cipherTextBlob: certBody.encryptedCertificateChain
-      });
-      certificateChain = decryptedCertChain.toString();
-    } else if (cert.caCertId) {
-      const { caCert, caCertChain } = await getCaCertChain({
-        caCertId: cert.caCertId,
-        certificateAuthorityDAL,
-        certificateAuthorityCertDAL,
-        projectDAL,
-        kmsService
-      });
-
-      certificateChain = `${caCert}\n${caCertChain}`.trim();
-    }
+    const certificateChain = await buildCertificateChain({
+      caCert,
+      caCertChain,
+      kmsId: certificateManagerKeyId,
+      kmsService,
+      encryptedCertificateChain: certBody.encryptedCertificateChain || undefined
+    });
 
     return {
       certificate: certObj.toString("pem"),
       certificateChain,
       serialNumber: certObj.serialNumber,
-      cert
-    };
-  };
-
-  /**
-   * Import certificate
-   */
-  const importCert = async ({
-    projectSlug,
-    pkiCollectionId,
-    actorId,
-    actorAuthMethod,
-    actor,
-    actorOrgId,
-    friendlyName,
-    certificatePem,
-    chainPem,
-    privateKeyPem
-  }: TImportCertDTO) => {
-    const collectionId = pkiCollectionId;
-
-    const project = await projectDAL.findProjectBySlug(projectSlug, actorOrgId);
-    if (!project) throw new NotFoundError({ message: `Project with slug '${projectSlug}' not found` });
-    let projectId = project.id;
-
-    const certManagerProjectFromSplit = await projectDAL.getProjectFromSplitId(
-      projectId,
-      ProjectType.CertificateManager
-    );
-    if (certManagerProjectFromSplit) {
-      projectId = certManagerProjectFromSplit.id;
-    }
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.CertificateManager
-    });
-
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionCertificateActions.Create,
-      ProjectPermissionSub.Certificates
-    );
-
-    // Check PKI collection
-    if (collectionId) {
-      const pkiCollection = await pkiCollectionDAL.findById(collectionId);
-      if (!pkiCollection) throw new NotFoundError({ message: "PKI collection not found" });
-      if (pkiCollection.projectId !== projectId) throw new BadRequestError({ message: "Invalid PKI collection" });
-    }
-
-    const leafCert = new x509.X509Certificate(certificatePem);
-
-    // Verify the certificate chain
-    const chainCerts = splitPemChain(chainPem).map((pem) => new x509.X509Certificate(pem));
-
-    // Remove leaf cert from the chain if it's present
-    if (chainCerts[0].equal(leafCert)) {
-      chainCerts.splice(0, 1);
-    }
-
-    if (chainCerts.length === 0) {
-      throw new BadRequestError({
-        message: "Certificate chain must contain at least one issuer certificate"
-      });
-    }
-
-    // Verify leaf certificate is signed by the first certificate in the chain
-    const isLeafVerified = await leafCert.verify({ publicKey: chainCerts[0].publicKey }).catch(() => false);
-    if (!isLeafVerified) {
-      throw new BadRequestError({ message: "Leaf certificate verification against chain failed" });
-    }
-
-    // Verify the entire chain of trust
-    const verificationPromises = chainCerts.slice(0, -1).map(async (currentCert, index) => {
-      const issuerCert = chainCerts[index + 1];
-      return currentCert.verify({ publicKey: issuerCert.publicKey }).catch(() => false);
-    });
-
-    const verificationResults = await Promise.all(verificationPromises);
-
-    if (verificationResults.some((result) => !result)) {
-      throw new BadRequestError({
-        message: "Certificate chain verification failed: broken trust chain"
-      });
-    }
-
-    // Verify private key matches the certificate
-    let privateKey;
-    try {
-      privateKey = createPrivateKey(privateKeyPem);
-    } catch (err) {
-      throw new BadRequestError({ message: "Invalid private key format" });
-    }
-
-    try {
-      const message = Buffer.from(Buffer.alloc(32));
-      const publicKey = createPublicKey(certificatePem);
-      const signature = sign(null, message, privateKey);
-      const isValid = verify(null, message, publicKey, signature);
-
-      if (!isValid) {
-        throw new BadRequestError({ message: "Private key does not match certificate" });
-      }
-    } catch (err) {
-      if (err instanceof BadRequestError) {
-        throw err;
-      }
-      throw new BadRequestError({ message: "Error verifying private key against certificate" });
-    }
-
-    // Get certificate attributes
-    const commonName = Array.from(leafCert.subjectName.getField("CN")?.values() || [])[0] || "";
-
-    let altNames: undefined | string;
-    const sanExtension = leafCert.extensions.find((ext) => ext.type === "2.5.29.17");
-    if (sanExtension) {
-      const sanNames = new x509.GeneralNames(sanExtension.value);
-      altNames = sanNames.items.map((name) => name.value).join(", ");
-    }
-
-    const { serialNumber, notBefore, notAfter } = leafCert;
-
-    // Encrypt certificate for storage
-    const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
-      projectId,
-      projectDAL,
-      kmsService
-    });
-    const kmsEncryptor = await kmsService.encryptWithKmsKey({
-      kmsId: certificateManagerKeyId
-    });
-
-    const { cipherTextBlob: encryptedCertificate } = await kmsEncryptor({
-      plainText: Buffer.from(certificatePem)
-    });
-
-    const { cipherTextBlob: encryptedPrivateKey } = await kmsEncryptor({
-      plainText: Buffer.from(privateKeyPem)
-    });
-
-    // Extract Key Usage
-    const keyUsagesExt = leafCert.getExtension("2.5.29.15") as x509.KeyUsagesExtension;
-
-    let keyUsages: CertKeyUsage[] = [];
-    if (keyUsagesExt) {
-      keyUsages = Object.values(CertKeyUsage).filter(
-        // eslint-disable-next-line no-bitwise
-        (keyUsage) => (x509.KeyUsageFlags[keyUsage] & keyUsagesExt.usages) !== 0
-      );
-    }
-
-    // Extract Extended Key Usage
-    const extKeyUsageExt = leafCert.getExtension("2.5.29.37") as x509.ExtendedKeyUsageExtension;
-    let extendedKeyUsages: CertExtendedKeyUsage[] = [];
-    if (extKeyUsageExt) {
-      extendedKeyUsages = extKeyUsageExt.usages.map((ekuOid) => CertExtendedKeyUsageOIDToName[ekuOid as string]);
-    }
-
-    const { cipherTextBlob: encryptedCertificateChain } = await kmsEncryptor({
-      plainText: Buffer.from(chainPem)
-    });
-
-    const cert = await certificateDAL.transaction(async (tx) => {
-      try {
-        const txCert = await certificateDAL.create(
-          {
-            status: CertStatus.ACTIVE,
-            friendlyName: friendlyName || commonName,
-            commonName,
-            altNames,
-            serialNumber,
-            notBefore,
-            notAfter,
-            projectId,
-            keyUsages,
-            extendedKeyUsages
-          },
-          tx
-        );
-
-        await certificateBodyDAL.create(
-          {
-            certId: txCert.id,
-            encryptedCertificate,
-            encryptedCertificateChain
-          },
-          tx
-        );
-
-        await certificateSecretDAL.create(
-          {
-            certId: txCert.id,
-            encryptedPrivateKey
-          },
-          tx
-        );
-
-        if (collectionId) {
-          await pkiCollectionItemDAL.create(
-            {
-              pkiCollectionId: collectionId,
-              certId: txCert.id
-            },
-            tx
-          );
-        }
-
-        return txCert;
-      } catch (error) {
-        // @ts-expect-error We're expecting a database error
-        // eslint-disable-next-line @typescript-eslint/no-unsafe-member-access
-        if (error?.error?.code === "23505") {
-          throw new BadRequestError({ message: "Certificate serial already exists in your project" });
-        }
-        throw error;
-      }
-    });
-
-    return {
-      certificate: certificatePem,
-      certificateChain: chainPem,
-      privateKey: privateKeyPem,
-      serialNumber,
-      cert
+      cert,
+      ca
     };
   };
 
@@ -535,11 +284,12 @@ export const certificateServiceFactory = ({
    */
   const getCertBundle = async ({ serialNumber, actorId, actorAuthMethod, actor, actorOrgId }: TGetCertBundleDTO) => {
     const cert = await certificateDAL.findOne({ serialNumber });
+    const ca = await certificateAuthorityDAL.findById(cert.caId);
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       actorAuthMethod,
       actorOrgId,
       actionProjectType: ActionProjectType.CertificateManager
@@ -557,7 +307,7 @@ export const certificateServiceFactory = ({
     const certBody = await certificateBodyDAL.findOne({ certId: cert.id });
 
     const certificateManagerKeyId = await getProjectKmsCertificateKeyId({
-      projectId: cert.projectId,
+      projectId: ca.projectId,
       projectDAL,
       kmsService
     });
@@ -572,32 +322,27 @@ export const certificateServiceFactory = ({
     const certObj = new x509.X509Certificate(decryptedCert);
     const certificate = certObj.toString("pem");
 
-    let certificateChain = null;
+    const { caCert, caCertChain } = await getCaCertChain({
+      caCertId: cert.caCertId,
+      certificateAuthorityDAL,
+      certificateAuthorityCertDAL,
+      projectDAL,
+      kmsService
+    });
 
-    // On newer certs the certBody.encryptedCertificateChain column will always exist.
-    // Older certs will have a caCertId which will be used as a fallback mechanism for structuring the chain.
-    if (certBody.encryptedCertificateChain) {
-      const decryptedCertChain = await kmsDecryptor({
-        cipherTextBlob: certBody.encryptedCertificateChain
-      });
-      certificateChain = decryptedCertChain.toString();
-    } else if (cert.caCertId) {
-      const { caCert, caCertChain } = await getCaCertChain({
-        caCertId: cert.caCertId,
-        certificateAuthorityDAL,
-        certificateAuthorityCertDAL,
-        projectDAL,
-        kmsService
-      });
-
-      certificateChain = `${caCert}\n${caCertChain}`.trim();
-    }
+    const certificateChain = await buildCertificateChain({
+      caCert,
+      caCertChain,
+      kmsId: certificateManagerKeyId,
+      kmsService,
+      encryptedCertificateChain: certBody.encryptedCertificateChain || undefined
+    });
 
     let privateKey: string | null = null;
     try {
       const { certPrivateKey } = await getCertificateCredentials({
         certId: cert.id,
-        projectId: cert.projectId,
+        projectId: ca.projectId,
         certificateSecretDAL,
         projectDAL,
         kmsService
@@ -615,7 +360,8 @@ export const certificateServiceFactory = ({
       certificateChain,
       privateKey,
       serialNumber,
-      cert
+      cert,
+      ca
     };
   };
 
@@ -625,7 +371,6 @@ export const certificateServiceFactory = ({
     deleteCert,
     revokeCert,
     getCertBody,
-    importCert,
     getCertBundle
   };
 };

backend/src/services/certificate/certificate-types.ts

@@ -78,17 +78,6 @@ export type TGetCertBodyDTO = {
   serialNumber: string;
 } & Omit<TProjectPermission, "projectId">;
 
-export type TImportCertDTO = {
-  projectSlug: string;
-
-  friendlyName?: string;
-  pkiCollectionId?: string;
-
-  certificatePem: string;
-  privateKeyPem: string;
-  chainPem: string;
-} & Omit<TProjectPermission, "projectId">;
-
 export type TGetCertPrivateKeyDTO = {
   serialNumber: string;
 } & Omit<TProjectPermission, "projectId">;
@@ -104,3 +93,11 @@ export type TGetCertificateCredentialsDTO = {
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
   kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
 };
+
+export type TBuildCertificateChainDTO = {
+  caCert?: string;
+  caCertChain?: string;
+  encryptedCertificateChain?: Buffer;
+  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey">;
+  kmsId: string;
+};