feat(pam): windows discovery base

backend/src/@types/fastify.d.ts

@@ -29,6 +29,7 @@ import { TLdapConfigServiceFactory } from "@app/ee/services/ldap-config/ldap-con
 import { TLicenseServiceFactory } from "@app/ee/services/license/license-service";
 import { TOidcConfigServiceFactory } from "@app/ee/services/oidc/oidc-config-service";
 import { TPamAccountServiceFactory } from "@app/ee/services/pam-account/pam-account-service";
+import { TPamDiscoverySourceServiceFactory } from "@app/ee/services/pam-discovery/pam-discovery-source-service";
 import { TPamFolderServiceFactory } from "@app/ee/services/pam-folder/pam-folder-service";
 import { TPamResourceServiceFactory } from "@app/ee/services/pam-resource/pam-resource-service";
 import { TPamSessionServiceFactory } from "@app/ee/services/pam-session/pam-session-service";
@@ -368,6 +369,7 @@ declare module "fastify" {
       pamAccount: TPamAccountServiceFactory;
       pamSession: TPamSessionServiceFactory;
       pamWebAccess: TPamWebAccessServiceFactory;
+      pamDiscoverySource: TPamDiscoverySourceServiceFactory;
       mfaSession: TMfaSessionServiceFactory;
       upgradePath: TUpgradePathService;
 

backend/src/@types/knex.d.ts

@@ -646,7 +646,37 @@ import {
   TMicrosoftTeamsIntegrationsInsert,
   TMicrosoftTeamsIntegrationsUpdate
 } from "@app/db/schemas/microsoft-teams-integrations";
+import {
+  TPamAccountDependencies,
+  TPamAccountDependenciesInsert,
+  TPamAccountDependenciesUpdate
+} from "@app/db/schemas/pam-account-dependencies";
 import { TPamAccounts, TPamAccountsInsert, TPamAccountsUpdate } from "@app/db/schemas/pam-accounts";
+import {
+  TPamDiscoverySourceAccounts,
+  TPamDiscoverySourceAccountsInsert,
+  TPamDiscoverySourceAccountsUpdate
+} from "@app/db/schemas/pam-discovery-source-accounts";
+import {
+  TPamDiscoverySourceDependencies,
+  TPamDiscoverySourceDependenciesInsert,
+  TPamDiscoverySourceDependenciesUpdate
+} from "@app/db/schemas/pam-discovery-source-dependencies";
+import {
+  TPamDiscoverySourceResources,
+  TPamDiscoverySourceResourcesInsert,
+  TPamDiscoverySourceResourcesUpdate
+} from "@app/db/schemas/pam-discovery-source-resources";
+import {
+  TPamDiscoverySourceRuns,
+  TPamDiscoverySourceRunsInsert,
+  TPamDiscoverySourceRunsUpdate
+} from "@app/db/schemas/pam-discovery-source-runs";
+import {
+  TPamDiscoverySources,
+  TPamDiscoverySourcesInsert,
+  TPamDiscoverySourcesUpdate
+} from "@app/db/schemas/pam-discovery-sources";
 import { TPamFolders, TPamFoldersInsert, TPamFoldersUpdate } from "@app/db/schemas/pam-folders";
 import { TPamResources, TPamResourcesInsert, TPamResourcesUpdate } from "@app/db/schemas/pam-resources";
 import { TPamSessions, TPamSessionsInsert, TPamSessionsUpdate } from "@app/db/schemas/pam-sessions";
@@ -1498,6 +1528,36 @@ declare module "knex/types/tables" {
     [TableName.PamResource]: KnexOriginal.CompositeTableType<TPamResources, TPamResourcesInsert, TPamResourcesUpdate>;
     [TableName.PamAccount]: KnexOriginal.CompositeTableType<TPamAccounts, TPamAccountsInsert, TPamAccountsUpdate>;
     [TableName.PamSession]: KnexOriginal.CompositeTableType<TPamSessions, TPamSessionsInsert, TPamSessionsUpdate>;
+    [TableName.PamDiscoverySource]: KnexOriginal.CompositeTableType<
+      TPamDiscoverySources,
+      TPamDiscoverySourcesInsert,
+      TPamDiscoverySourcesUpdate
+    >;
+    [TableName.PamDiscoverySourceRun]: KnexOriginal.CompositeTableType<
+      TPamDiscoverySourceRuns,
+      TPamDiscoverySourceRunsInsert,
+      TPamDiscoverySourceRunsUpdate
+    >;
+    [TableName.PamDiscoverySourceResource]: KnexOriginal.CompositeTableType<
+      TPamDiscoverySourceResources,
+      TPamDiscoverySourceResourcesInsert,
+      TPamDiscoverySourceResourcesUpdate
+    >;
+    [TableName.PamDiscoverySourceAccount]: KnexOriginal.CompositeTableType<
+      TPamDiscoverySourceAccounts,
+      TPamDiscoverySourceAccountsInsert,
+      TPamDiscoverySourceAccountsUpdate
+    >;
+    [TableName.PamDiscoverySourceDependency]: KnexOriginal.CompositeTableType<
+      TPamDiscoverySourceDependencies,
+      TPamDiscoverySourceDependenciesInsert,
+      TPamDiscoverySourceDependenciesUpdate
+    >;
+    [TableName.PamAccountDependency]: KnexOriginal.CompositeTableType<
+      TPamAccountDependencies,
+      TPamAccountDependenciesInsert,
+      TPamAccountDependenciesUpdate
+    >;
 
     [TableName.Membership]: KnexOriginal.CompositeTableType<TMemberships, TMembershipsInsert, TMembershipsUpdate>;
     [TableName.MembershipRole]: KnexOriginal.CompositeTableType<

backend/src/db/migrations/20260219070359_pam-discovery.ts

@@ -0,0 +1,199 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+import { createOnUpdateTrigger, dropOnUpdateTrigger } from "../utils";
+
+export async function up(knex: Knex): Promise<void> {
+  // PAM Discovery Sources
+  if (!(await knex.schema.hasTable(TableName.PamDiscoverySource))) {
+    await knex.schema.createTable(TableName.PamDiscoverySource, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.string("projectId").notNullable();
+      t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
+
+      t.string("name").notNullable();
+      t.unique(["projectId", "name"], { indexName: "uidx_pam_discovery_source_project_name" });
+
+      t.string("discoveryType").notNullable();
+
+      t.uuid("gatewayId").notNullable();
+      t.foreign("gatewayId").references("id").inTable(TableName.GatewayV2).onDelete("RESTRICT");
+      t.index("gatewayId");
+
+      t.binary("encryptedDiscoveryCredentials").notNullable();
+      t.jsonb("discoveryConfiguration").notNullable();
+
+      t.string("schedule").notNullable().defaultTo("manual");
+      t.datetime("lastRunAt").nullable();
+
+      t.string("status").notNullable().defaultTo("active");
+
+      t.timestamps(true, true, true);
+    });
+  }
+
+  // PAM Discovery Runs
+  if (!(await knex.schema.hasTable(TableName.PamDiscoverySourceRun))) {
+    await knex.schema.createTable(TableName.PamDiscoverySourceRun, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("discoverySourceId").notNullable();
+      t.foreign("discoverySourceId").references("id").inTable(TableName.PamDiscoverySource).onDelete("CASCADE");
+      t.index("discoverySourceId");
+
+      t.string("status").notNullable();
+      t.string("triggeredBy").notNullable();
+
+      t.integer("resourcesDiscoveredCount").defaultTo(0);
+      t.integer("accountsDiscoveredCount").defaultTo(0);
+      t.integer("dependenciesDiscoveredCount").defaultTo(0);
+      t.integer("newResourcesCount").defaultTo(0);
+      t.integer("staleResourcesCount").defaultTo(0);
+      t.integer("newAccountsCount").defaultTo(0);
+      t.integer("staleAccountsCount").defaultTo(0);
+      t.integer("newDependenciesCount").defaultTo(0);
+      t.integer("staleDependenciesCount").defaultTo(0);
+
+      t.jsonb("progress").notNullable();
+      t.text("errorMessage").nullable();
+
+      t.datetime("startedAt").nullable();
+      t.datetime("completedAt").nullable();
+
+      t.timestamps(true, true, true);
+    });
+  }
+
+  // PAM Account Dependencies
+  if (!(await knex.schema.hasTable(TableName.PamAccountDependency))) {
+    await knex.schema.createTable(TableName.PamAccountDependency, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("accountId").notNullable();
+      t.foreign("accountId").references("id").inTable(TableName.PamAccount).onDelete("CASCADE");
+      t.index("accountId");
+
+      t.uuid("resourceId").notNullable();
+      t.foreign("resourceId").references("id").inTable(TableName.PamResource).onDelete("CASCADE");
+      t.index("resourceId");
+
+      t.string("dependencyType").notNullable();
+      t.string("name").notNullable();
+      t.string("displayName").nullable();
+
+      t.string("state").nullable();
+      t.jsonb("data").notNullable();
+
+      t.string("source").notNullable(); // "discovery" or "manual"
+      t.boolean("isEnabled").defaultTo(false);
+
+      t.unique(["accountId", "resourceId", "dependencyType", "name"], {
+        indexName: "uidx_pam_account_dependency"
+      });
+
+      t.timestamps(true, true, true);
+    });
+  }
+
+  // PAM Discovery Source Resources (junction)
+  if (!(await knex.schema.hasTable(TableName.PamDiscoverySourceResource))) {
+    await knex.schema.createTable(TableName.PamDiscoverySourceResource, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("discoverySourceId").notNullable();
+      t.foreign("discoverySourceId").references("id").inTable(TableName.PamDiscoverySource).onDelete("CASCADE");
+      t.index("discoverySourceId");
+
+      t.uuid("resourceId").notNullable();
+      t.foreign("resourceId").references("id").inTable(TableName.PamResource).onDelete("CASCADE");
+      t.index("resourceId");
+
+      t.datetime("lastDiscoveredAt").notNullable();
+
+      t.uuid("lastDiscoveredRunId").nullable();
+      t.foreign("lastDiscoveredRunId").references("id").inTable(TableName.PamDiscoverySourceRun).onDelete("SET NULL");
+
+      t.boolean("isStale").defaultTo(false);
+
+      t.timestamp("createdAt", { useTz: true }).defaultTo(knex.fn.now());
+
+      t.unique(["discoverySourceId", "resourceId"], {
+        indexName: "uidx_pam_discovery_source_resource"
+      });
+    });
+  }
+
+  // PAM Discovery Source Accounts (junction)
+  if (!(await knex.schema.hasTable(TableName.PamDiscoverySourceAccount))) {
+    await knex.schema.createTable(TableName.PamDiscoverySourceAccount, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("discoverySourceId").notNullable();
+      t.foreign("discoverySourceId").references("id").inTable(TableName.PamDiscoverySource).onDelete("CASCADE");
+      t.index("discoverySourceId");
+
+      t.uuid("accountId").notNullable();
+      t.foreign("accountId").references("id").inTable(TableName.PamAccount).onDelete("CASCADE");
+      t.index("accountId");
+
+      t.datetime("lastDiscoveredAt").notNullable();
+
+      t.uuid("lastDiscoveredRunId").nullable();
+      t.foreign("lastDiscoveredRunId").references("id").inTable(TableName.PamDiscoverySourceRun).onDelete("SET NULL");
+
+      t.boolean("isStale").defaultTo(false);
+
+      t.timestamp("createdAt", { useTz: true }).defaultTo(knex.fn.now());
+
+      t.unique(["discoverySourceId", "accountId"], {
+        indexName: "uidx_pam_discovery_source_account"
+      });
+    });
+  }
+
+  // PAM Discovery Source Dependencies (junction)
+  if (!(await knex.schema.hasTable(TableName.PamDiscoverySourceDependency))) {
+    await knex.schema.createTable(TableName.PamDiscoverySourceDependency, (t) => {
+      t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
+
+      t.uuid("discoverySourceId").notNullable();
+      t.foreign("discoverySourceId").references("id").inTable(TableName.PamDiscoverySource).onDelete("CASCADE");
+      t.index("discoverySourceId");
+
+      t.uuid("dependencyId").notNullable();
+      t.foreign("dependencyId").references("id").inTable(TableName.PamAccountDependency).onDelete("CASCADE");
+      t.index("dependencyId");
+
+      t.datetime("lastSeenAt").notNullable();
+
+      t.uuid("lastSeenRunId").nullable();
+      t.foreign("lastSeenRunId").references("id").inTable(TableName.PamDiscoverySourceRun).onDelete("SET NULL");
+
+      t.boolean("isStale").defaultTo(false);
+
+      t.timestamp("createdAt", { useTz: true }).defaultTo(knex.fn.now());
+
+      t.unique(["discoverySourceId", "dependencyId"], {
+        indexName: "uidx_pam_discovery_source_dependency"
+      });
+    });
+  }
+
+  await createOnUpdateTrigger(knex, TableName.PamDiscoverySource);
+  await createOnUpdateTrigger(knex, TableName.PamDiscoverySourceRun);
+  await createOnUpdateTrigger(knex, TableName.PamAccountDependency);
+}
+
+export async function down(knex: Knex): Promise<void> {
+  await knex.schema.dropTableIfExists(TableName.PamDiscoverySourceDependency);
+  await knex.schema.dropTableIfExists(TableName.PamDiscoverySourceAccount);
+  await knex.schema.dropTableIfExists(TableName.PamDiscoverySourceResource);
+  await knex.schema.dropTableIfExists(TableName.PamAccountDependency);
+  await knex.schema.dropTableIfExists(TableName.PamDiscoverySourceRun);
+  await knex.schema.dropTableIfExists(TableName.PamDiscoverySource);
+
+  await dropOnUpdateTrigger(knex, TableName.PamAccountDependency);
+  await dropOnUpdateTrigger(knex, TableName.PamDiscoverySourceRun);
+  await dropOnUpdateTrigger(knex, TableName.PamDiscoverySource);
+}

backend/src/db/migrations/20260305073334_pam-discovery-fingerprint.ts

@@ -0,0 +1,35 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  const hasResourceCol = await knex.schema.hasColumn(TableName.PamResource, "discoveryFingerprint");
+  if (!hasResourceCol) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.string("discoveryFingerprint").nullable();
+    });
+  }
+
+  const hasAccountCol = await knex.schema.hasColumn(TableName.PamAccount, "discoveryFingerprint");
+  if (!hasAccountCol) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.string("discoveryFingerprint").nullable();
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  const hasResourceCol = await knex.schema.hasColumn(TableName.PamResource, "discoveryFingerprint");
+  if (hasResourceCol) {
+    await knex.schema.alterTable(TableName.PamResource, (t) => {
+      t.dropColumn("discoveryFingerprint");
+    });
+  }
+
+  const hasAccountCol = await knex.schema.hasColumn(TableName.PamAccount, "discoveryFingerprint");
+  if (hasAccountCol) {
+    await knex.schema.alterTable(TableName.PamAccount, (t) => {
+      t.dropColumn("discoveryFingerprint");
+    });
+  }
+}

backend/src/db/schemas/index.ts

@@ -105,7 +105,13 @@ export * from "./org-relay-config";
 export * from "./org-roles";
 export * from "./organization-assets";
 export * from "./organizations";
+export * from "./pam-account-dependencies";
 export * from "./pam-accounts";
+export * from "./pam-discovery-source-accounts";
+export * from "./pam-discovery-source-dependencies";
+export * from "./pam-discovery-source-resources";
+export * from "./pam-discovery-source-runs";
+export * from "./pam-discovery-sources";
 export * from "./pam-folders";
 export * from "./pam-resources";
 export * from "./pam-sessions";

backend/src/db/schemas/models.ts

@@ -223,6 +223,12 @@ export enum TableName {
   PamResource = "pam_resources",
   PamAccount = "pam_accounts",
   PamSession = "pam_sessions",
+  PamDiscoverySource = "pam_discovery_sources",
+  PamDiscoverySourceRun = "pam_discovery_source_runs",
+  PamDiscoverySourceResource = "pam_discovery_source_resources",
+  PamDiscoverySourceAccount = "pam_discovery_source_accounts",
+  PamDiscoverySourceDependency = "pam_discovery_source_dependencies",
+  PamAccountDependency = "pam_account_dependencies",
 
   VaultExternalMigrationConfig = "vault_external_migration_configs",
 

backend/src/db/schemas/pam-account-dependencies.ts

@@ -0,0 +1,29 @@
+// Code generated by automation script, DO NOT EDIT.
+// Automated by pulling database and generating zod schema
+// To update. Just run npm run generate:schema
+// Written by akhilmhdh.
+
+import { z } from "zod";
+
+import { TImmutableDBKeys } from "./models";
+
+export const PamAccountDependenciesSchema = z.object({
+  id: z.string().uuid(),
+  accountId: z.string().uuid(),
+  resourceId: z.string().uuid(),
+  dependencyType: z.string(),
+  name: z.string(),
+  displayName: z.string().nullable().optional(),
+  state: z.string().nullable().optional(),
+  data: z.unknown(),
+  source: z.string(),
+  isEnabled: z.boolean().default(false).nullable().optional(),
+  createdAt: z.date(),
+  updatedAt: z.date()
+});
+
+export type TPamAccountDependencies = z.infer<typeof PamAccountDependenciesSchema>;
+export type TPamAccountDependenciesInsert = Omit<z.input<typeof PamAccountDependenciesSchema>, TImmutableDBKeys>;
+export type TPamAccountDependenciesUpdate = Partial<
+  Omit<z.input<typeof PamAccountDependenciesSchema>, TImmutableDBKeys>
+>;

backend/src/db/schemas/pam-accounts.ts

@@ -25,7 +25,8 @@ export const PamAccountsSchema = z.object({
   rotationStatus: z.string().nullable().optional(),
   encryptedLastRotationMessage: zodBuffer.nullable().optional(),
   requireMfa: z.boolean().default(false).nullable().optional(),
-  internalMetadata: z.unknown().nullable().optional()
+  internalMetadata: z.unknown().nullable().optional(),
+  discoveryFingerprint: z.string().nullable().optional()
 });
 
 export type TPamAccounts = z.infer<typeof PamAccountsSchema>;