refactor(dgw): split provisioning into credentials and connection options

Separate `provision-credentials` and `provision-connection-options` preflight
operations, backed by two independent JTI-keyed stores. The credentials store
keeps the encryption boundary; the connection-options store holds plaintext
routing metadata with no crypto dependency. The two halves are provisioned,
expire and are replaced independently — a caller that wants both sends two
operations in one batched preflight request. `ProvisioningStore::get` assembles
a combined view for RDP credential injection: credentials required, connection
options optional.

This lets connection options serve future protocols that do not use credential
injection, instead of being welded to a mandatory-credentials operation.

Register TargetConnectionOptions in the OpenAPI schema list and regenerate
gateway-api.yaml.

Author: irvingoujAtDevolution

devolutions-gateway/openapi/gateway-api.yaml

@@ -7,7 +7,7 @@ info:
     email: infos@devolutions.net
   license:
     name: MIT/Apache-2.0
-  version: 2026.1.2
+  version: 2026.2.4
 paths:
   /jet/config:
     patch:
@@ -1803,15 +1803,15 @@ components:
           description: |-
             Minimum persistence duration in seconds for the data provisioned via this operation.
 
-            Optional parameter for "provision-token" and "provision-credentials" kinds.
+            Optional parameter for "provision-token", "provision-credentials" and "provision-connection-options" kinds.
           nullable: true
           minimum: 0
         token:
           type: string
           description: |-
             The token to be stored on the proxy-side.
 
-            Required for "provision-token" and "provision-credentials" kinds.
+            Required for "provision-token", "provision-credentials" and "provision-connection-options" kinds.
           nullable: true
     PreflightOperationKind:
       type: string
@@ -1822,6 +1822,7 @@ components:
       - get-recording-storage-health
       - provision-token
       - provision-credentials
+      - provision-connection-options
       - resolve-host
     PreflightOutput:
       type: object

devolutions-gateway/src/api/preflight.rs

@@ -22,6 +22,7 @@ const OP_GET_RUNNING_SESSION_COUNT: &str = "get-running-session-count";
 const OP_GET_RECORDING_STORAGE_HEALTH: &str = "get-recording-storage-health";
 const OP_PROVISION_TOKEN: &str = "provision-token";
 const OP_PROVISION_CREDENTIALS: &str = "provision-credentials";
+const OP_PROVISION_CONNECTION_OPTIONS: &str = "provision-connection-options";
 const OP_RESOLVE_HOST: &str = "resolve-host";
 
 const DEFAULT_TTL: Duration = Duration::minutes(15);
@@ -46,7 +47,13 @@ struct ProvisionCredentialsParams {
     token: String,
     #[serde(flatten)]
     credentials: crate::credential::CleartextAppCredentials,
-    connection_options: Option<crate::target_connection_options::TargetConnectionOptions>,
+    time_to_live: Option<u32>,
+}
+
+#[derive(Debug, Deserialize)]
+struct ProvisionConnectionOptionsParams {
+    token: String,
+    connection_options: crate::target_connection_options::TargetConnectionOptions,
     time_to_live: Option<u32>,
 }
 
@@ -330,7 +337,6 @@ async fn handle_operation(
             let ProvisionCredentialsParams {
                 token,
                 credentials,
-                connection_options,
                 time_to_live,
             } = from_params(operation.params).map_err(PreflightError::invalid_params)?;
             let time_to_live = validate_time_to_live(time_to_live)?;
@@ -351,7 +357,7 @@ async fn handle_operation(
                 })?;
 
             let replaced = provisioning
-                .insert(token_data, credentials, connection_options, time_to_live)
+                .insert_credentials(token_data, credentials, time_to_live)
                 .inspect_err(|error| warn!(%operation.id, error = format!("{error:#}"), "Failed to insert credentials"))
                 .map_err(|_| {
                     PreflightError::new(
@@ -365,7 +371,39 @@ async fn handle_operation(
                     operation_id: operation.id,
                     kind: PreflightOutputKind::Alert {
                         status: PreflightAlertStatus::Info,
-                        message: "an existing provisioning entry was replaced".to_owned(),
+                        message: "existing provisioned credentials were replaced".to_owned(),
+                    },
+                });
+            }
+
+            outputs.push(PreflightOutput {
+                operation_id: operation.id,
+                kind: PreflightOutputKind::Ack,
+            });
+        }
+        OP_PROVISION_CONNECTION_OPTIONS => {
+            let ProvisionConnectionOptionsParams {
+                token,
+                connection_options,
+                time_to_live,
+            } = from_params(operation.params).map_err(PreflightError::invalid_params)?;
+            let time_to_live = validate_time_to_live(time_to_live)?;
+
+            // Connection options are generic routing metadata, not credential-injection state, so
+            // they only need a JTI to key by — not the full credential-injection token shape that
+            // provision-credentials requires.
+            let jti = crate::token::extract_jti(&token).map_err(|error| {
+                PreflightError::new(PreflightAlertStatus::InvalidParams, format!("invalid token: {error:#}"))
+            })?;
+
+            let replaced = provisioning.insert_connection_options(jti, connection_options, time_to_live);
+
+            if replaced {
+                outputs.push(PreflightOutput {
+                    operation_id: operation.id,
+                    kind: PreflightOutputKind::Alert {
+                        status: PreflightAlertStatus::Info,
+                        message: "existing provisioned connection options were replaced".to_owned(),
                     },
                 });
             }

devolutions-gateway/src/credential_injection.rs

@@ -168,7 +168,6 @@ impl CredentialInjection {
             credentials,
             connection_options,
             target_hostname,
-            expires_at: _,
         } = provisioned_connection;
 
         let uses_kerberos = if kerberos_enabled {
@@ -548,16 +547,11 @@ mod tests {
         .expect("credentials encrypt")
     }
 
-    fn provisioned(
-        target_username: &str,
-        krb_kdc: Option<TargetAddr>,
-        time_to_live: time::Duration,
-    ) -> ProvisionedConnection {
+    fn provisioned(target_username: &str, krb_kdc: Option<TargetAddr>) -> ProvisionedConnection {
         ProvisionedConnection {
             credentials: app_credentials("proxy@example.invalid", target_username),
             connection_options: krb_kdc.map(|kdc| TargetConnectionOptions::new(Some(kdc)).expect("connection options")),
             target_hostname: "target.example".to_owned(),
-            expires_at: time::OffsetDateTime::now_utc() + time_to_live,
         }
     }
 
@@ -604,11 +598,7 @@ mod tests {
         let kdc = target_kdc();
         let injection = CredentialInjection::from_provisioned(
             Uuid::new_v4(),
-            provisioned(
-                "administrator@example.invalid",
-                Some(kdc.clone()),
-                time::Duration::minutes(5),
-            ),
+            provisioned("administrator@example.invalid", Some(kdc.clone())),
             "target.example",
             true,
         )
@@ -624,7 +614,7 @@ mod tests {
     fn from_provisioned_hard_errors_when_kerberos_target_has_no_kdc() {
         let error = CredentialInjection::from_provisioned(
             Uuid::new_v4(),
-            provisioned("administrator@example.invalid", None, time::Duration::minutes(5)),
+            provisioned("administrator@example.invalid", None),
             "target.example",
             true,
         )
@@ -637,7 +627,7 @@ mod tests {
     fn from_provisioned_selects_ntlm_for_domainless_target() {
         let injection = CredentialInjection::from_provisioned(
             Uuid::new_v4(),
-            provisioned("Administrator", None, time::Duration::minutes(5)),
+            provisioned("Administrator", None),
             "target.example",
             true,
         )
@@ -649,11 +639,7 @@ mod tests {
     fn from_provisioned_selects_ntlm_when_kerberos_disabled() {
         let injection = CredentialInjection::from_provisioned(
             Uuid::new_v4(),
-            provisioned(
-                "administrator@example.invalid",
-                Some(target_kdc()),
-                time::Duration::minutes(5),
-            ),
+            provisioned("administrator@example.invalid", Some(target_kdc())),
             "target.example",
             false,
         )
@@ -665,7 +651,7 @@ mod tests {
     fn from_provisioned_rejects_target_hostname_mismatch() {
         let error = CredentialInjection::from_provisioned(
             Uuid::new_v4(),
-            provisioned("Administrator", None, time::Duration::minutes(5)),
+            provisioned("Administrator", None),
             "other.example",
             true,
         )

devolutions-gateway/src/openapi.rs

@@ -68,6 +68,7 @@ use crate::config::dto::{DataEncoding, PubKeyFormat, Subscriber};
         PreflightOperationKind,
         AppCredential,
         AppCredentialKind,
+        TargetConnectionOptions,
         PreflightOutput,
         PreflightOutputKind,
         PreflightAlertStatus,
@@ -372,7 +373,7 @@ struct PreflightOperation {
     kind: PreflightOperationKind,
     /// The token to be stored on the proxy-side.
     ///
-    /// Required for "provision-token" and "provision-credentials" kinds.
+    /// Required for "provision-token", "provision-credentials" and "provision-connection-options" kinds.
     token: Option<String>,
     /// The credential to use to authorize the client at the proxy-level.
     ///
@@ -384,15 +385,15 @@ struct PreflightOperation {
     target_credential: Option<AppCredential>,
     /// Options used by the Gateway when connecting to the target.
     ///
-    /// Optional for "provision-credentials" kind.
+    /// Required for "provision-connection-options" kind.
     connection_options: Option<TargetConnectionOptions>,
     /// The hostname to perform DNS resolution on.
     ///
     /// Required for "resolve-host" kind.
     host_to_resolve: Option<String>,
     /// Minimum persistence duration in seconds for the data provisioned via this operation.
     ///
-    /// Optional parameter for "provision-token" and "provision-credentials" kinds.
+    /// Optional parameter for "provision-token", "provision-credentials" and "provision-connection-options" kinds.
     time_to_live: Option<u32>,
 }
 
@@ -419,6 +420,8 @@ enum PreflightOperationKind {
     ProvisionToken,
     #[serde(rename = "provision-credentials")]
     ProvisionCredentials,
+    #[serde(rename = "provision-connection-options")]
+    ProvisionConnectionOptions,
     #[serde(rename = "resolve-host")]
     ResolveHost,
 }