Change SSH WIP

server/private/routers/ssh/signSshKey.ts

@@ -21,7 +21,7 @@ import {
     roles,
     roundTripMessageTracker,
     siteResources,
-    sites,
+    siteNetworks,
     userOrgs
 } from "@server/db";
 import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
@@ -62,11 +62,11 @@ const bodySchema = z
 
 export type SignSshKeyResponse = {
     certificate: string;
-    messageId: number;
+    messageIds: number[];
     sshUsername: string;
     sshHost: string;
     resourceId: number;
-    siteId: number;
+    siteIds: number[];
     keyId: string;
     validPrincipals: string[];
     validAfter: string;
@@ -250,10 +250,7 @@ export async function signSshKey(
                 .update(userOrgs)
                 .set({ pamUsername: usernameToUse })
                 .where(
-                    and(
+                    and(eq(userOrgs.orgId, orgId), eq(userOrgs.userId, userId))
-                        eq(userOrgs.orgId, orgId),
-                        eq(userOrgs.userId, userId)
-                    )
                 );
         } else {
             usernameToUse = userOrg.pamUsername;
@@ -374,21 +371,12 @@ export async function signSshKey(
         const homedir = roleRow?.sshCreateHomeDir ?? null;
         const sudoMode = roleRow?.sshSudoMode ?? "none";
 
-        // get the site
+        const sites = await db
-        const [newt] = await db
+            .select({ siteId: siteNetworks.siteId })
-            .select()
+            .from(siteNetworks)
-            .from(newts)
+            .where(eq(siteNetworks.networkId, resource.networkId!));
-            .where(eq(newts.siteId, resource.siteId))
-            .limit(1);
 
-        if (!newt) {
+        const siteIds = sites.map((site) => site.siteId);
-            return next(
-                createHttpError(
-                    HttpCode.INTERNAL_SERVER_ERROR,
-                    "Site associated with resource not found"
-                )
-            );
-        }
 
         // Sign the public key
         const now = BigInt(Math.floor(Date.now() / 1000));
@@ -402,6 +390,24 @@ export async function signSshKey(
             validBefore: now + validFor
         });
 
+        const messageIds: number[] = [];
+        for (const siteId of siteIds) {
+            // get the site
+            const [newt] = await db
+                .select()
+                .from(newts)
+                .where(eq(newts.siteId, siteId))
+                .limit(1);
+
+            if (!newt) {
+                return next(
+                    createHttpError(
+                        HttpCode.INTERNAL_SERVER_ERROR,
+                        "Site associated with resource not found"
+                    )
+                );
+            }
+
             const [message] = await db
                 .insert(roundTripMessageTracker)
                 .values({
@@ -420,6 +426,8 @@ export async function signSshKey(
                 );
             }
 
+            messageIds.push(message.messageId);
+
             await sendToClient(newt.newtId, {
                 type: `newt/pam/connection`,
                 data: {
@@ -439,6 +447,7 @@ export async function signSshKey(
                     }
                 }
             });
+        }
 
         const expiresIn = Number(validFor); // seconds
 
@@ -459,18 +468,20 @@ export async function signSshKey(
             metadata: JSON.stringify({
                 resourceId: resource.siteResourceId,
                 resource: resource.name,
-                siteId: resource.siteId,
+                siteIds: siteIds
             })
         });
 
+        // TODO: WE NEED TO MAKE SURE THE MESSAGEIDS ARE BACKWARD COMPATABILE AND THE SITEIDS TOO AND UPDATE THE CLI TO HANDLE THE MESSAGE IDS
+
         return response<SignSshKeyResponse>(res, {
             data: {
                 certificate: cert.certificate,
-                messageId: message.messageId,
+                messageIds: messageIds,
                 sshUsername: usernameToUse,
                 sshHost: sshHost,
                 resourceId: resource.siteResourceId,
-                siteId: resource.siteId,
+                siteIds: siteIds,
                 keyId: cert.keyId,
                 validPrincipals: cert.validPrincipals,
                 validAfter: cert.validAfter.toISOString(),