Skip to content

feat: removed secret rotation v1 #6105

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
akhilmhdh merged 3 commits into from
Apr 21, 2026
Merged

feat: removed secret rotation v1 #6105

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d6d62fa
feat: removed secret rotation v1
akhilmhdh Apr 21, 2026
83b480a
feat: claude review addressed
akhilmhdh Apr 21, 2026
8526e65
feat: reverted db change
akhilmhdh Apr 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 0 additions & 2 deletions backend/src/@types/fastify.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ import { TSamlConfigServiceFactory } from "@app/ee/services/saml-config/saml-con
import { TScimServiceFactory } from "@app/ee/services/scim/scim-types";
import { TSecretApprovalPolicyServiceFactory } from "@app/ee/services/secret-approval-policy/secret-approval-policy-service";
import { TSecretApprovalRequestServiceFactory } from "@app/ee/services/secret-approval-request/secret-approval-request-service";
import { TSecretRotationServiceFactory } from "@app/ee/services/secret-rotation/secret-rotation-service";
import { TSecretRotationV2ServiceFactory } from "@app/ee/services/secret-rotation-v2/secret-rotation-v2-service";
import { TSecretScanningServiceFactory } from "@app/ee/services/secret-scanning/secret-scanning-service";
import { TSecretScanningV2ServiceFactory } from "@app/ee/services/secret-scanning-v2/secret-scanning-v2-service";
Expand Down Expand Up @@ -305,7 +304,6 @@ declare module "fastify" {
accessApprovalRequest: TAccessApprovalRequestServiceFactory;
secretApprovalPolicy: TSecretApprovalPolicyServiceFactory;
secretApprovalRequest: TSecretApprovalRequestServiceFactory;
secretRotation: TSecretRotationServiceFactory;
snapshot: TSecretSnapshotServiceFactory;
saml: TSamlConfigServiceFactory;
scim: TScimServiceFactory;
Expand Down
24 changes: 0 additions & 24 deletions backend/src/@types/knex.d.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -500,15 +500,6 @@ import {
TSecretReferencesV2,
TSecretReferencesV2Insert,
TSecretReferencesV2Update,
TSecretRotationOutputs,
TSecretRotationOutputsInsert,
TSecretRotationOutputsUpdate,
TSecretRotationOutputV2,
TSecretRotationOutputV2Insert,
TSecretRotationOutputV2Update,
TSecretRotations,
TSecretRotationsInsert,
TSecretRotationsUpdate,
TSecretRotationsV2,
TSecretRotationsV2Insert,
TSecretRotationsV2Update,
Expand Down Expand Up @@ -1282,16 +1273,6 @@ declare module "knex/types/tables" {
TSecretApprovalPoliciesEnvironmentsInsert,
TSecretApprovalPoliciesEnvironmentsUpdate
>;
[TableName.SecretRotation]: KnexOriginal.CompositeTableType<
TSecretRotations,
TSecretRotationsInsert,
TSecretRotationsUpdate
>;
[TableName.SecretRotationOutput]: KnexOriginal.CompositeTableType<
TSecretRotationOutputs,
TSecretRotationOutputsInsert,
TSecretRotationOutputsUpdate
>;
[TableName.Snapshot]: KnexOriginal.CompositeTableType<
TSecretSnapshots,
TSecretSnapshotsInsert,
Expand Down Expand Up @@ -1392,11 +1373,6 @@ declare module "knex/types/tables" {
TSecretApprovalRequestSecretTagsV2Insert,
TSecretApprovalRequestSecretTagsV2Update
>;
[TableName.SecretRotationOutputV2]: KnexOriginal.CompositeTableType<
TSecretRotationOutputV2,
TSecretRotationOutputV2Insert,
TSecretRotationOutputV2Update
>;
// KMS service
[TableName.KmsServerRootConfig]: KnexOriginal.CompositeTableType<
TKmsRootConfig,
Expand Down
18 changes: 9 additions & 9 deletions backend/src/db/migrations/20240102152111_secret-rotation.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ import { TableName } from "../schemas";
import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";

export async function up(knex: Knex): Promise<void> {
if (!(await knex.schema.hasTable(TableName.SecretRotation))) {
await knex.schema.createTable(TableName.SecretRotation, (t) => {
if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1))) {
await knex.schema.createTable(TableName.DeprecatedSecretRotationV1, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.string("provider").notNullable();
t.string("secretPath").notNullable();
Expand All @@ -23,22 +23,22 @@ export async function up(knex: Knex): Promise<void> {
t.timestamps(true, true, true);
});
}
await createOnUpdateTrigger(knex, TableName.SecretRotation);
await createOnUpdateTrigger(knex, TableName.DeprecatedSecretRotationV1);

if (!(await knex.schema.hasTable(TableName.SecretRotationOutput))) {
await knex.schema.createTable(TableName.SecretRotationOutput, (t) => {
if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationOutput))) {
await knex.schema.createTable(TableName.DeprecatedSecretRotationOutput, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.string("key").notNullable();
t.uuid("secretId").notNullable();
t.foreign("secretId").references("id").inTable(TableName.Secret).onDelete("CASCADE");
t.uuid("rotationId").notNullable();
t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
t.foreign("rotationId").references("id").inTable(TableName.DeprecatedSecretRotationV1).onDelete("CASCADE");
});
}
}

export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.SecretRotationOutput);
await knex.schema.dropTableIfExists(TableName.SecretRotation);
await dropOnUpdateTrigger(knex, TableName.SecretRotation);
await dropOnUpdateTrigger(knex, TableName.DeprecatedSecretRotationV1);
await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationOutput);
await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationV1);
}
Comment thread
varonix0 marked this conversation as resolved.
8 changes: 4 additions & 4 deletions backend/src/db/migrations/20240730181850_secret-v2.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -134,14 +134,14 @@ export async function up(knex: Knex): Promise<void> {
});
}

if (!(await knex.schema.hasTable(TableName.SecretRotationOutputV2))) {
await knex.schema.createTable(TableName.SecretRotationOutputV2, (t) => {
if (!(await knex.schema.hasTable(TableName.DeprecatedSecretRotationOutputV2))) {
await knex.schema.createTable(TableName.DeprecatedSecretRotationOutputV2, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.string("key").notNullable();
t.uuid("secretId").notNullable();
t.foreign("secretId").references("id").inTable(TableName.SecretV2).onDelete("CASCADE");
t.uuid("rotationId").notNullable();
t.foreign("rotationId").references("id").inTable(TableName.SecretRotation).onDelete("CASCADE");
t.foreign("rotationId").references("id").inTable(TableName.DeprecatedSecretRotationV1).onDelete("CASCADE");
});
}
}
Expand All @@ -154,7 +154,7 @@ export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.SecretV2JnTag);
await knex.schema.dropTableIfExists(TableName.SecretReferenceV2);

await knex.schema.dropTableIfExists(TableName.SecretRotationOutputV2);
await knex.schema.dropTableIfExists(TableName.DeprecatedSecretRotationOutputV2);

await dropOnUpdateTrigger(knex, TableName.SecretVersionV2);
await knex.schema.dropTableIfExists(TableName.SecretVersionV2Tag);
Expand Down
29 changes: 17 additions & 12 deletions backend/src/db/migrations/20250210101841_secret-rotation-to-kms.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ import { Knex } from "knex";

import { inMemoryKeyStore } from "@app/keystore/memory";
import { crypto } from "@app/lib/crypto/cryptography";
import { selectAllTableCols } from "@app/lib/knex";
import { initLogger } from "@app/lib/logger";
import { kmsRootConfigDALFactory } from "@app/services/kms/kms-root-config-dal";
import { KmsDataKey } from "@app/services/kms/kms-types";
Expand All @@ -15,11 +14,14 @@ import { getMigrationEncryptionServices, getMigrationHsmService } from "./utils/

const BATCH_SIZE = 500;
export async function up(knex: Knex): Promise<void> {
const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
const hasEncryptedRotationData = await knex.schema.hasColumn(
TableName.DeprecatedSecretRotationV1,
"encryptedRotationData"
);

const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
const hasRotationTable = await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1);
if (hasRotationTable) {
await knex.schema.alterTable(TableName.SecretRotation, (t) => {
await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
if (!hasEncryptedRotationData) t.binary("encryptedRotationData");
});
}
Expand All @@ -36,9 +38,9 @@ export async function up(knex: Knex): Promise<void> {
const projectEncryptionRingBuffer =
createCircularCache<Awaited<ReturnType<(typeof kmsService)["createCipherPairWithDataKey"]>>>(25);

const secretRotations = await knex(TableName.SecretRotation)
.join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.SecretRotation}.envId`)
.select(selectAllTableCols(TableName.SecretRotation))
const secretRotations = await knex(TableName.DeprecatedSecretRotationV1)
.join(TableName.Environment, `${TableName.Environment}.id`, `${TableName.DeprecatedSecretRotationV1}.envId`)
.select(`${TableName.DeprecatedSecretRotationV1}.*`)
.select(knex.ref("projectId").withSchema(TableName.Environment))
.orderBy(`${TableName.Environment}.projectId` as "projectId");

Expand Down Expand Up @@ -88,25 +90,28 @@ export async function up(knex: Knex): Promise<void> {

for (let i = 0; i < updatedRotationData.length; i += BATCH_SIZE) {
// eslint-disable-next-line no-await-in-loop
await knex(TableName.SecretRotation)
await knex(TableName.DeprecatedSecretRotationV1)
.insert(updatedRotationData.slice(i, i + BATCH_SIZE))
.onConflict("id")
.merge();
}

if (hasRotationTable) {
await knex.schema.alterTable(TableName.SecretRotation, (t) => {
await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
if (!hasEncryptedRotationData) t.binary("encryptedRotationData").notNullable().alter();
});
}
}

export async function down(knex: Knex): Promise<void> {
const hasEncryptedRotationData = await knex.schema.hasColumn(TableName.SecretRotation, "encryptedRotationData");
const hasEncryptedRotationData = await knex.schema.hasColumn(
TableName.DeprecatedSecretRotationV1,
"encryptedRotationData"
);

const hasRotationTable = await knex.schema.hasTable(TableName.SecretRotation);
const hasRotationTable = await knex.schema.hasTable(TableName.DeprecatedSecretRotationV1);
if (hasRotationTable) {
await knex.schema.alterTable(TableName.SecretRotation, (t) => {
await knex.schema.alterTable(TableName.DeprecatedSecretRotationV1, (t) => {
if (hasEncryptedRotationData) t.dropColumn("encryptedRotationData");
});
}
Expand Down
3 changes: 0 additions & 3 deletions backend/src/db/schemas/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,10 +196,7 @@ export * from "./secret-folders";
export * from "./secret-imports";
export * from "./secret-references";
export * from "./secret-references-v2";
export * from "./secret-rotation-output-v2";
export * from "./secret-rotation-outputs";
export * from "./secret-rotation-v2-secret-mappings";
export * from "./secret-rotations";
export * from "./secret-rotations-v2";
export * from "./secret-scanning-configs";
export * from "./secret-scanning-data-sources";
Expand Down
12 changes: 6 additions & 6 deletions backend/src/db/schemas/models.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,8 +131,6 @@ export enum TableName {
SecretApprovalRequestSecret = "secret_approval_requests_secrets",
SecretApprovalRequestSecretTag = "secret_approval_request_secret_tags",
SecretApprovalPolicyEnvironment = "secret_approval_policies_environments",
SecretRotation = "secret_rotations",
SecretRotationOutput = "secret_rotation_outputs",
SamlConfig = "saml_configs",
LdapConfig = "ldap_configs",
OidcConfig = "oidc_configs",
Expand Down Expand Up @@ -163,7 +161,6 @@ export enum TableName {
JnSecretTag = "secret_tag_junction",
SecretVersionTag = "secret_version_tag_junction",
SecretVersionV2Tag = "secret_version_v2_tag_junction",
SecretRotationOutputV2 = "secret_rotation_output_v2",
// KMS Service
KmsServerRootConfig = "kms_root_config",
KmsKey = "kms_keys",
Expand Down Expand Up @@ -288,11 +285,14 @@ export enum TableName {
PkiSigners = "pki_signers",
PkiSigningOperations = "pki_signing_operations",

CaSigningConfig = "ca_signing_configs",
SecretValidationRule = "secret_validation_rules",

// Deprecated - Not used anymore now that Redis is persistent
DeprecatedDurableQueueJobs = "queue_jobs",

CaSigningConfig = "ca_signing_configs",
SecretValidationRule = "secret_validation_rules"
DeprecatedSecretRotationV1 = "secret_rotations",
DeprecatedSecretRotationOutput = "secret_rotation_outputs",
DeprecatedSecretRotationOutputV2 = "secret_rotation_output_v2"
}

export type TImmutableDBKeys = "id" | "createdAt" | "updatedAt" | "commitId";
Expand Down
6 changes: 0 additions & 6 deletions backend/src/ee/routes/v1/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,8 +55,6 @@ import { registerRelayRouter } from "./relay-router";
import { registerSamlRouter } from "./saml-router";
import { registerScimRouter } from "./scim-router";
import { registerSecretApprovalRequestRouter } from "./secret-approval-request-router";
import { registerSecretRotationProviderRouter } from "./secret-rotation-provider-router";
import { registerSecretRotationRouter } from "./secret-rotation-router";
import { registerSecretRouter } from "./secret-router";
import { registerSecretScanningRouter } from "./secret-scanning-router";
import { registerSecretVersionRouter } from "./secret-version-router";
Expand Down Expand Up @@ -102,9 +100,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
await server.register(registerSecretApprovalRequestRouter, {
prefix: "/secret-approval-requests"
});
await server.register(registerSecretRotationProviderRouter, {
prefix: "/secret-rotation-providers"
});

await server.register(registerAccessApprovalPolicyRouter, { prefix: "/access-approvals/policies" });
await server.register(registerAccessApprovalRequestRouter, { prefix: "/access-approvals/requests" });
Expand Down Expand Up @@ -157,7 +152,6 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
await server.register(registerScimRouter, { prefix: "/scim" });
await server.register(registerLdapRouter, { prefix: "/ldap" });
await server.register(registerSecretScanningRouter, { prefix: "/secret-scanning" });
await server.register(registerSecretRotationRouter, { prefix: "/secret-rotations" });
await server.register(registerSecretRouter, { prefix: "/secrets" });
await server.register(registerSecretVersionRouter, { prefix: "/secret" });
await server.register(registerGroupRouter, { prefix: "/groups" });
Expand Down
45 changes: 0 additions & 45 deletions backend/src/ee/routes/v1/secret-rotation-provider-router.ts
View file
Open in desktop

This file was deleted.

Loading
Loading