refactor(dgw): move the agent tunnel store into gateway-db

The agent_tunnel_* tables are created by gateway-db's migrations, so the code reading them now lives next to them as gateway_db::agent_tunnel. The agent-tunnel-libsql crate is removed.

Author: irvingoujAtDevolution

Cargo.lock

@@ -9,10 +9,14 @@ publish = false
 workspace = true
 
 [dependencies]
+agent-tunnel.path = "../agent-tunnel"
 anyhow = "1"
+async-trait = "0.1"
 camino = "1.1"
-libsql = { version = "0.9", default-features = false, features = ["core"] }
+libsql = { version = "0.9", default-features = false, features = ["core", "serde"] }
+tokio = { version = "1.52", features = ["sync"] }
 tracing = "0.1"
+uuid = "1.23"
 
 [dev-dependencies]
 tempfile = "3.24"

crates/agent-tunnel-libsql/Cargo.toml

@@ -1,3 +1,5 @@
+//! The agent tunnel's tables: accepted Agents, enrollment attempts and the CA they belong to.
+
 use agent_tunnel::authorization::{
     AcceptedAgent, AgentAuthorizationStore, EnrollmentAttempt, EnrollmentConflict, EnrollmentOutcome, SpkiSha256,
 };
@@ -15,7 +17,7 @@ pub struct LibSqlAgentAuthorizationStore {
 }
 
 impl LibSqlAgentAuthorizationStore {
-    /// Opens the store on a `gateway.db` connection of its own, from `GatewayDb::connect` in the `gateway-db` crate.
+    /// Opens the store on a `gateway.db` connection of its own, from [`GatewayDb::connect`](crate::GatewayDb::connect).
     ///
     /// The connection must already have up-to-date `agent_tunnel_*` tables; opening checks them and fails if they
     /// don't match. The stored Agents only make sense with the CA that signed their certificates, so the first open
@@ -490,7 +492,7 @@ mod tests {
     use super::*;
 
     async fn connect(path: &str) -> anyhow::Result<Connection> {
-        gateway_db::GatewayDb::open_path(path).await?.connect().await
+        crate::GatewayDb::open_path(path).await?.connect().await
     }
 
     async fn open_store(path: &str, ca_spki_sha256: SpkiSha256) -> anyhow::Result<LibSqlAgentAuthorizationStore> {
@@ -826,7 +828,7 @@ mod tests {
             .expect("record 2026.3 schema version");
         drop(legacy);
 
-        let conn = gateway_db::GatewayDb::open(&data_dir)
+        let conn = crate::GatewayDb::open(&data_dir)
             .await
             .expect("open gateway database")
             .connect()

crates/gateway-db/Cargo.toml

@@ -1,12 +1,15 @@
 //! Gateway's own database, `gateway.db`.
 //!
 //! When a feature needs to remember a little data, it keeps it here in tables named after the feature
-//! (`agent_tunnel_*`, ...), so we don't end up with one database file per feature. The job queue is the
-//! exception: it tunes its database for queue work, so it keeps its own file.
+//! (`agent_tunnel_*`, ...), with the code reading them in a module of the same name, so we don't end up with one
+//! database file per feature. Queues are the exception: the job queue and the traffic audit tune their databases
+//! for queue work, so they keep their own files.
 
 #[macro_use]
 extern crate tracing;
 
+pub mod agent_tunnel;
+
 use anyhow::{Context as _, bail};
 use camino::{Utf8Path, Utf8PathBuf};
 use libsql::{Connection, Database, TransactionBehavior, params};

crates/agent-tunnel-libsql/src/lib.rs crates/gateway-db/src/agent_tunnel.rscrates/agent-tunnel-libsql/src/lib.rs renamed to crates/gateway-db/src/agent_tunnel.rs

@@ -36,7 +36,6 @@ network-monitor.path = "../crates/network-monitor"
 sysevent.path = "../crates/sysevent"
 sysevent-codes.path = "../crates/sysevent-codes"
 agent-tunnel = { path = "../crates/agent-tunnel" }
-agent-tunnel-libsql = { path = "../crates/agent-tunnel-libsql" }
 gateway-db.path = "../crates/gateway-db"
 ironrdp-pdu = { version = "0.9", features = ["std"] }
 ironrdp-core = { version = "0.2", features = ["std"] }

crates/gateway-db/src/lib.rs

@@ -288,7 +288,7 @@ async fn spawn_tasks(conf_handle: ConfHandle) -> anyhow::Result<Tasks> {
             .connect()
             .await
             .context("failed to connect the agent tunnel to the gateway database")?;
-        let agents_have_ca = agent_tunnel_libsql::LibSqlAgentAuthorizationStore::bound_ca(&agent_tunnel_conn)
+        let agents_have_ca = gateway_db::agent_tunnel::LibSqlAgentAuthorizationStore::bound_ca(&agent_tunnel_conn)
             .await
             .context("failed to read the agent tunnel CA identity")?
             .is_some();
@@ -302,7 +302,7 @@ async fn spawn_tasks(conf_handle: ConfHandle) -> anyhow::Result<Tasks> {
             .ca_spki_sha256()
             .context("failed to identify agent tunnel CA")?;
         let authorization_store =
-            agent_tunnel_libsql::LibSqlAgentAuthorizationStore::open(agent_tunnel_conn, ca_spki_sha256)
+            gateway_db::agent_tunnel::LibSqlAgentAuthorizationStore::open(agent_tunnel_conn, ca_spki_sha256)
                 .await
                 .context("failed to initialize Agent authorization database")?;
         let authorization_store: agent_tunnel::authorization::DynAgentAuthorizationStore =

devolutions-gateway/Cargo.toml

@@ -33,7 +33,6 @@ tokio-tungstenite = { version = "0.29", features = ["rustls-tls-native-roots"] }
 [dev-dependencies]
 agent-sysevent-codes.path = "../crates/agent-sysevent-codes"
 agent-tunnel = { path = "../crates/agent-tunnel", features = ["test-utils"] }
-agent-tunnel-libsql = { path = "../crates/agent-tunnel-libsql" }
 agent-tunnel-proto = { path = "../crates/agent-tunnel-proto", features = ["serde"] }
 base64 = "0.23"
 camino = "1"

devolutions-gateway/src/service.rs

@@ -181,7 +181,7 @@ pub(super) async fn bind_test_listener() -> TestListener {
         .connect()
         .await
         .expect("connect to test gateway database");
-    let authorization_store = agent_tunnel_libsql::LibSqlAgentAuthorizationStore::open(gateway_db, ca_spki_sha256)
+    let authorization_store = gateway_db::agent_tunnel::LibSqlAgentAuthorizationStore::open(gateway_db, ca_spki_sha256)
         .await
         .expect("open test Agent authorization store");
     let listen_addr: SocketAddr = "127.0.0.1:0".parse().expect("parse listener address");