feat(secret-manager): secrets brokering (proxied services + agent proxy CA)

DESIGN.md

@@ -88,7 +88,8 @@ The `mineshaft-*` scale (50–900) is the underlying neutral ramp; see
 
 Reserved for resource types in the secret management product:
 `--color-folder`, `--color-secret`, `--color-dynamic-secret`,
-`--color-import`, `--color-secret-rotation`, `--color-override`.
+`--color-import`, `--color-secret-rotation`, `--color-override`,
+`--color-proxied-service`.
 Do not repurpose these for generic UI.
 
 ### Tint pattern

backend/src/@types/fastify.d.ts

@@ -5,6 +5,7 @@ import { Cluster, Redis } from "ioredis";
 import { TUsers } from "@app/db/schemas";
 import { TAccessApprovalPolicyServiceFactory } from "@app/ee/services/access-approval-policy/access-approval-policy-types";
 import { TAccessApprovalRequestServiceFactory } from "@app/ee/services/access-approval-request/access-approval-request-types";
+import { TAgentProxyCaServiceFactory } from "@app/ee/services/agent-proxy-ca/agent-proxy-ca-service";
 import { TAiMcpActivityLogServiceFactory } from "@app/ee/services/ai-mcp-activity-log/ai-mcp-activity-log-service";
 import { TAiMcpEndpointServiceFactory } from "@app/ee/services/ai-mcp-endpoint/ai-mcp-endpoint-service";
 import { TAiMcpServerServiceFactory } from "@app/ee/services/ai-mcp-server/ai-mcp-server-service";
@@ -56,6 +57,7 @@ import { TPkiScepServiceFactory } from "@app/ee/services/pki-scep/pki-scep-servi
 import { TProjectEventsService } from "@app/ee/services/project-events/project-events-service";
 import { TProjectEventsSSEService } from "@app/ee/services/project-events/project-events-sse-service";
 import { TProjectTemplateServiceFactory } from "@app/ee/services/project-template/project-template-types";
+import { TProxiedServiceServiceFactory } from "@app/ee/services/proxied-service/proxied-service-service";
 import { RateLimitConfiguration, TRateLimitServiceFactory } from "@app/ee/services/rate-limit/rate-limit-types";
 import { TRelayServiceFactory } from "@app/ee/services/relay/relay-service";
 import { TResourceAuthMethodServiceFactory } from "@app/ee/services/resource-auth-method/resource-auth-method-service";
@@ -418,6 +420,8 @@ declare module "fastify" {
       gitHubApp: TGitHubAppServiceFactory;
       honeyTokenConfig: THoneyTokenConfigServiceFactory;
       honeyToken: THoneyTokenServiceFactory;
+      proxiedService: TProxiedServiceServiceFactory;
+      agentProxyCa: TAgentProxyCaServiceFactory;
       folderCommit: TFolderCommitServiceFactory;
       pit: TPitServiceFactory;
       secretScanningV2: TSecretScanningV2ServiceFactory;

backend/src/@types/knex.d.ts

@@ -326,6 +326,9 @@ import {
   TOidcConfigs,
   TOidcConfigsInsert,
   TOidcConfigsUpdate,
+  TOrgAgentProxyConfig,
+  TOrgAgentProxyConfigInsert,
+  TOrgAgentProxyConfigUpdate,
   TOrganizationAssets,
   TOrganizationAssetsInsert,
   TOrganizationAssetsUpdate,
@@ -485,6 +488,12 @@ import {
   TProjectTemplateUserMemberships,
   TProjectTemplateUserMembershipsInsert,
   TProjectTemplateUserMembershipsUpdate,
+  TProxiedServiceCredentials,
+  TProxiedServiceCredentialsInsert,
+  TProxiedServiceCredentialsUpdate,
+  TProxiedServices,
+  TProxiedServicesInsert,
+  TProxiedServicesUpdate,
   TRateLimit,
   TRateLimitInsert,
   TRateLimitUpdate,
@@ -1573,6 +1582,21 @@ declare module "knex/types/tables" {
       TOrgGatewayConfigInsert,
       TOrgGatewayConfigUpdate
     >;
+    [TableName.OrgAgentProxyConfig]: KnexOriginal.CompositeTableType<
+      TOrgAgentProxyConfig,
+      TOrgAgentProxyConfigInsert,
+      TOrgAgentProxyConfigUpdate
+    >;
+    [TableName.ProxiedService]: KnexOriginal.CompositeTableType<
+      TProxiedServices,
+      TProxiedServicesInsert,
+      TProxiedServicesUpdate
+    >;
+    [TableName.ProxiedServiceCredential]: KnexOriginal.CompositeTableType<
+      TProxiedServiceCredentials,
+      TProxiedServiceCredentialsInsert,
+      TProxiedServiceCredentialsUpdate
+    >;
     [TableName.SecretRotationV2]: KnexOriginal.CompositeTableType<
       TSecretRotationsV2,
       TSecretRotationsV2Insert,

backend/src/db/migrations/20260710162607_create-proxied-services.ts

@@ -0,0 +1,87 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  if (!(await knex.schema.hasTable(TableName.OrgAgentProxyConfig))) {
+    await knex.schema.createTable(TableName.OrgAgentProxyConfig, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("rootCaKeyAlgorithm").notNullable();
+      t.datetime("rootCaIssuedAt").notNullable();
+      t.datetime("rootCaExpiration").notNullable();
+      t.string("rootCaSerialNumber").notNullable();
+      t.binary("encryptedRootCaCertificate").notNullable();
+      t.binary("encryptedRootCaPrivateKey").notNullable();
+
+      t.uuid("orgId").notNullable();
+      t.foreign("orgId").references("id").inTable(TableName.Organization).onDelete("CASCADE");
+      t.unique("orgId");
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.OrgAgentProxyConfig);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.ProxiedService))) {
+    await knex.schema.createTable(TableName.ProxiedService, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("name").notNullable();
+      t.string("hostPattern").notNullable();
+      t.boolean("isEnabled").notNullable().defaultTo(true);
+
+      t.uuid("folderId").notNullable();
+      t.foreign("folderId").references("id").inTable(TableName.SecretFolder).onDelete("CASCADE");
+
+      // project is derived via folder -> environment -> project chain; no projectId column
+      t.unique(["folderId", "name"]);
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.ProxiedService);
+  }
+
+  if (!(await knex.schema.hasTable(TableName.ProxiedServiceCredential))) {
+    await knex.schema.createTable(TableName.ProxiedServiceCredential, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("serviceId").notNullable();
+      t.foreign("serviceId").references("id").inTable(TableName.ProxiedService).onDelete("CASCADE");
+      t.index("serviceId");
+
+      // Reference to a secret by key name only. Location is implicitly the parent
+      // service's folder in V1, so no folder/env/path columns are stored here.
+      t.string("secretKey").notNullable();
+      t.string("role").notNullable(); // "header-rewrite" | "credential-substitution"
+
+      // Header rewriting fields (nullable)
+      t.string("headerName");
+      t.string("headerPrefix");
+      t.string("headerPurpose"); // basic auth: "username" | "password"
+
+      // Credential substitution fields (nullable)
+      t.string("placeholderKey");
+      t.string("placeholderValue");
+      t.specificType("substitutionSurfaces", "text[]"); // subset of header|path|query|body
+
+      t.timestamps(true, true, true);
+    });
+
+    await createOnUpdateTrigger(knex, TableName.ProxiedServiceCredential);
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.ProxiedServiceCredential);
+  await dropOnUpdateTrigger(knex, TableName.ProxiedServiceCredential);
+
+  await knex.schema.dropTableIfExists(TableName.ProxiedService);
+  await dropOnUpdateTrigger(knex, TableName.ProxiedService);
+
+  await knex.schema.dropTableIfExists(TableName.OrgAgentProxyConfig);
+  await dropOnUpdateTrigger(knex, TableName.OrgAgentProxyConfig);
+}

backend/src/db/schemas/index.ts

@@ -119,6 +119,7 @@ export * from "./microsoft-teams-integrations";
 export * from "./models";
 export * from "./oauth-clients";
 export * from "./oidc-configs";
+export * from "./org-agent-proxy-config";
 export * from "./org-bots";
 export * from "./org-gateway-config";
 export * from "./org-gateway-config-v2";
@@ -194,6 +195,8 @@ export * from "./project-templates";
 export * from "./project-user-additional-privilege";
 export * from "./project-user-membership-roles";
 export * from "./projects";
+export * from "./proxied-service-credentials";
+export * from "./proxied-services";
 export * from "./rate-limit";
 export * from "./relays";
 export * from "./resource-auth-methods";

backend/src/db/schemas/models.ts

@@ -319,6 +319,11 @@ export enum TableName {
   // Audit Reports (exportable compliance reports)
   AuditReport = "audit_reports",
 
+  // Secrets Brokering (Agent Proxy)
+  OrgAgentProxyConfig = "org_agent_proxy_config",
+  ProxiedService = "proxied_services",
+  ProxiedServiceCredential = "proxied_service_credentials",
+
   // Deprecated - Not used anymore now that Redis is persistent
   DeprecatedDurableQueueJobs = "queue_jobs",
   DeprecatedSecretRotationV1 = "secret_rotations",
@@ -366,7 +371,10 @@ export enum ProjectMembershipRole {
   // ssh
   SshHostBootstrapper = "ssh-host-bootstrapper",
   // kms
-  KmsCryptographicOperator = "cryptographic-operator"
+  KmsCryptographicOperator = "cryptographic-operator",
+  // secrets brokering (agent proxy)
+  Agent = "agent",
+  AgentProxy = "agent-proxy"
 }
 
 export enum ResourceMembershipRole {

backend/src/db/schemas/org-agent-proxy-config.ts

@@ -0,0 +1,27 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { zodBuffer } from "@app/lib/zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const OrgAgentProxyConfigSchema = z.object({
+  id: z.string().uuid(),
+  rootCaKeyAlgorithm: z.string(),
+  rootCaIssuedAt: z.date(),
+  rootCaExpiration: z.date(),
+  rootCaSerialNumber: z.string(),
+  encryptedRootCaCertificate: zodBuffer,
+  encryptedRootCaPrivateKey: zodBuffer,
+  orgId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TOrgAgentProxyConfig = z.infer<typeof OrgAgentProxyConfigSchema>;
+export type TOrgAgentProxyConfigInsert = Omit<z.input<typeof OrgAgentProxyConfigSchema>, TImmutableDBKeys>;
+export type TOrgAgentProxyConfigUpdate = Partial<Omit<z.input<typeof OrgAgentProxyConfigSchema>, TImmutableDBKeys>>;

backend/src/db/schemas/proxied-service-credentials.ts

@@ -0,0 +1,29 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProxiedServiceCredentialsSchema = z.object({
+  id: z.string().uuid(),
+  serviceId: z.string().uuid(),
+  secretKey: z.string(),
+  role: z.string(),
+  headerName: z.string().nullable().optional(),
+  headerPrefix: z.string().nullable().optional(),
+  headerPurpose: z.string().nullable().optional(),
+  placeholderKey: z.string().nullable().optional(),
+  placeholderValue: z.string().nullable().optional(),
+  substitutionSurfaces: z.string().array().nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TProxiedServiceCredentials = z.infer<typeof ProxiedServiceCredentialsSchema>;
+export type TProxiedServiceCredentialsInsert = Omit<z.input<typeof ProxiedServiceCredentialsSchema>, TImmutableDBKeys>;
+export type TProxiedServiceCredentialsUpdate = Partial<
+  Omit<z.input<typeof ProxiedServiceCredentialsSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/proxied-services.ts

@@ -0,0 +1,22 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const ProxiedServicesSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string(),
+  hostPattern: z.string(),
+  isEnabled: z.boolean().default(true),
+  folderId: z.string().uuid(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TProxiedServices = z.infer<typeof ProxiedServicesSchema>;
+export type TProxiedServicesInsert = Omit<z.input<typeof ProxiedServicesSchema>, TImmutableDBKeys>;
+export type TProxiedServicesUpdate = Partial<Omit<z.input<typeof ProxiedServicesSchema>, TImmutableDBKeys>>;

backend/src/ee/routes/v1/agent-proxy-ca-router.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+
+import { EventType } from "@app/ee/services/audit-log/audit-log-types";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
+import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
+import { AuthMode } from "@app/services/auth/auth-type";
+import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
+
+export const registerAgentProxyCaRouter = async (server: FastifyZodProvider) => {
+  server.route({
+    method: "GET",
+    url: "/",
+    config: { rateLimit: readLimit },
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      response: {
+        200: z.object({
+          certificate: z.string(),
+          keyAlgorithm: z.nativeEnum(CertKeyAlgorithm),
+          issuedAt: z.date(),
+          expiration: z.date(),
+          serialNumber: z.string()
+        })
+      }
+    },
+    handler: async (req) => {
+      return server.services.agentProxyCa.getRootCa(req.permission);
+    }
+  });
+
+  server.route({
+    method: "POST",
+    url: "/sign",
+    config: { rateLimit: writeLimit },
+    onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
+    schema: {
+      body: z.object({
+        publicKey: z.string().trim().min(1)
+      }),
+      response: {
+        200: z.object({
+          certificate: z.string(),
+          issuedAt: z.date(),
+          expiration: z.date(),
+          serialNumber: z.string()
+        })
+      }
+    },
+    handler: async (req) => {
+      const intermediateCa = await server.services.agentProxyCa.signIntermediate(req.permission, req.body.publicKey);
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        orgId: req.permission.orgId,
+        event: {
+          type: EventType.SIGN_AGENT_PROXY_INTERMEDIATE_CA,
+          metadata: {
+            serialNumber: intermediateCa.serialNumber,
+            expiration: intermediateCa.expiration.toISOString()
+          }
+        }
+      });
+      return intermediateCa;
+    }
+  });
+};

backend/src/ee/routes/v1/index.ts

@@ -4,6 +4,7 @@ import { injectCertManagerProjectId } from "@app/server/plugins/inject-cert-mana
 
 import { registerAccessApprovalPolicyRouter } from "./access-approval-policy-router";
 import { registerAccessApprovalRequestRouter } from "./access-approval-request-router";
+import { registerAgentProxyCaRouter } from "./agent-proxy-ca-router";
 import { registerAiMcpActivityLogRouter } from "./ai-mcp-activity-log-router";
 import { registerAiMcpEndpointRouter } from "./ai-mcp-endpoint-router";
 import { registerAiMcpServerRouter } from "./ai-mcp-server-router";
@@ -42,6 +43,7 @@ import { registerPkiDiscoveryRouter } from "./pki-discovery-router";
 import { registerPkiInstallationRouter } from "./pki-installation-router";
 import { registerProjectRoleRouter } from "./project-role-router";
 import { registerProjectRouter } from "./project-router";
+import { registerProxiedServiceRouter } from "./proxied-service-router";
 import { registerRateLimitRouter } from "./rate-limit-router";
 import { registerRelayRouter } from "./relay-router";
 import { registerSamlRouter } from "./saml-router";
@@ -113,6 +115,9 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   await server.register(registerGithubOrgSyncRouter, { prefix: "/github-org-sync-config" });
   await server.register(registerHoneyTokenRouter, { prefix: "/honey-tokens" });
 
+  await server.register(registerProxiedServiceRouter, { prefix: "/proxied-services" });
+  await server.register(registerAgentProxyCaRouter, { prefix: "/organization/agent-proxy-ca" });
+
   await server.register(registerInsightsRouter, { prefix: "/insights" });
 
   await server.register(