@@ -528,6 +528,61 @@ opsRouter.get('/contract/diagnostics/auth-status', (_req: Request, res: Response
528528 return ok ( res , { adminAuthConfigured : true } )
529529} )
530530
531+ // ================================
532+ // CREDENTIAL ROTATION ROUTES
533+ // ================================
534+
535+ opsRouter . get ( '/credentials/status' , requireAdmin , async ( _req : Request , res : Response ) => {
536+ try {
537+ const { credentialManager } = await import ( '../config/credentialManager.js' )
538+ const dbCreds = credentialManager . getDbCredentialsSync ( )
539+ const redisCreds = await credentialManager . getRedisCredentials ( )
540+ const status = {
541+ database : {
542+ configured : Boolean ( dbCreds . user || dbCreds . connectionString ) ,
543+ source : dbCreds . source ,
544+ lastRefreshed : dbCreds . lastRefreshed . toISOString ( )
545+ } ,
546+ redis : {
547+ configured : Boolean ( redisCreds . url ) ,
548+ source : redisCreds . source ,
549+ lastRefreshed : redisCreds . lastRefreshed . toISOString ( ) ,
550+ urlRedacted : redisCreds . url . replace ( / : \/ \/ [ ^ @ ] * @ / , '://***@' )
551+ } ,
552+ timestamp : new Date ( ) . toISOString ( )
553+ }
554+ return ok ( res , status )
555+ } catch ( error ) {
556+ logger . error ( '[OPS] Failed to check credential status' , { error : getErrorObject ( error ) } )
557+ return fail ( res , 500 , 'INTERNAL_ERROR' , getErrorMessage ( error ) )
558+ }
559+ } )
560+
561+ opsRouter . post ( '/credentials/refresh' , requireAdmin , async ( _req : Request , res : Response ) => {
562+ try {
563+ const { refreshDbPool } = await import ( '../db/client.js' )
564+ const { refreshRedisCredentials } = await import ( '../queue/connection.js' )
565+ const dbPool = await refreshDbPool ( )
566+ const redisUrl = await refreshRedisCredentials ( )
567+ const status = {
568+ database : {
569+ refreshed : true ,
570+ poolMax : dbPool . options . max
571+ } ,
572+ redis : {
573+ refreshed : true ,
574+ urlRedacted : redisUrl . replace ( / : \/ \/ [ ^ @ ] * @ / , '://***@' )
575+ } ,
576+ timestamp : new Date ( ) . toISOString ( )
577+ }
578+ logger . info ( '[OPS] Manual credential rotation refresh triggered' , status )
579+ return ok ( res , status )
580+ } catch ( error ) {
581+ logger . error ( '[OPS] Failed to refresh credentials' , { error : getErrorObject ( error ) } )
582+ return fail ( res , 500 , 'INTERNAL_ERROR' , getErrorMessage ( error ) )
583+ }
584+ } )
585+
531586// ================================
532587// RISK MANAGEMENT ROUTES
533588// ================================
0 commit comments