feat: move vault ssh signing into a plugin (C5)

src/backend/tests/database/routes/host-compat-routes.test.ts

@@ -1,5 +1,5 @@
 /**
- * The OPKSSH and Step CA redirect URIs identity providers were registered with before
+ * The OPKSSH, Step CA and Vault redirect URIs identity providers were registered with before
  * 2.9 must keep reaching the plugin's callback, query intact.
  */
 
@@ -62,3 +62,29 @@ describe("the old Step CA callback", () => {
     );
   });
 });
+
+describe("the old Vault callback", () => {
+  it("forwards to the plugin's callback with the query", async () => {
+    const { registerVaultCompatRoutes } =
+      await import("../../../database/routes/host-compat-routes.js");
+    const router = express.Router();
+    registerVaultCompatRoutes(router);
+    const app = express();
+    app.use("/vault", router);
+    const vaultServer = http.createServer(app);
+    await new Promise<void>((resolve) => vaultServer.listen(0, resolve));
+    const port = (vaultServer.address() as AddressInfo).port;
+    try {
+      const response = await fetch(
+        `http://127.0.0.1:${port}/vault/oidc/callback?code=abc&state=xyz`,
+        { redirect: "manual" },
+      );
+      expect(response.status).toBe(307);
+      expect(response.headers.get("location")).toBe(
+        "/plugin-api/vault/oidc/callback?code=abc&state=xyz",
+      );
+    } finally {
+      await new Promise<void>((resolve) => vaultServer.close(() => resolve()));
+    }
+  });
+});

src/backend/tests/database/routes/sync.test.ts

@@ -33,7 +33,6 @@ describe("isValidEntityType", () => {
       "hosts",
       "sshCredentials",
       "sshFolders",
-      "vaultProfiles",
       "userPreferences",
     ]) {
       expect(isValidEntityType(type)).toBe(true);