extract enterprise code into dedicated crates

Cargo.toml

@@ -6,8 +6,8 @@ repository = "https://github.com/DefGuard/defguard"
 rust-version = "1.87.0"
 
 [workspace]
-members = ["crates/*", "tools/*"]
-default-members = ["crates/*"]
+members = ["crates/*", "enterprise/crates/*", "tools/*"]
+default-members = ["crates/*", "enterprise/crates/*"]
 resolver = "2"
 
 [workspace.dependencies]
@@ -17,6 +17,13 @@ defguard_setup = { path = "./crates/defguard_setup", version = "0.0.0" }
 defguard_common = { path = "./crates/defguard_common", version = "2.0.0" }
 defguard_static_ip = { path = "./crates/defguard_static_ip", version = "0.0.0" }
 defguard_core = { path = "./crates/defguard_core", version = "0.0.0" }
+defguard_enterprise_activity_log_stream = { path = "./enterprise/crates/defguard_enterprise_activity_log_stream", version = "0.0.0" }
+defguard_enterprise_db = { path = "./enterprise/crates/defguard_enterprise_db", version = "0.0.0" }
+defguard_enterprise_directory_sync = { path = "./enterprise/crates/defguard_enterprise_directory_sync", version = "0.0.0" }
+defguard_enterprise_firewall = { path = "./enterprise/crates/defguard_enterprise_firewall", version = "0.0.0" }
+defguard_enterprise_ldap = { path = "./enterprise/crates/defguard_enterprise_ldap", version = "0.0.0" }
+defguard_enterprise_license = { path = "./enterprise/crates/defguard_enterprise_license", version = "0.0.0" }
+defguard_enterprise_snat = { path = "./enterprise/crates/defguard_enterprise_snat", version = "0.0.0" }
 defguard_event_logger = { path = "./crates/defguard_event_logger", version = "0.0.0" }
 defguard_event_router = { path = "./crates/defguard_event_router", version = "0.0.0" }
 defguard_gateway_manager = { path = "./crates/defguard_gateway_manager", version = "0.0.0" }

crates/defguard/Cargo.toml

@@ -11,6 +11,8 @@ rust-version.workspace = true
 # internal crates
 defguard_common = { workspace = true }
 defguard_core = { workspace = true }
+defguard_enterprise_activity_log_stream = { workspace = true }
+defguard_enterprise_license = { workspace = true }
 defguard_event_router = { workspace = true }
 defguard_event_logger = { workspace = true }
 defguard_gateway_manager = { workspace = true }

crates/defguard/src/main.rs

@@ -17,17 +17,14 @@ use defguard_common::{
 use defguard_core::{
     auth::failed_login::FailedLoginMap,
     db::AppEvent,
-    enterprise::{
-        activity_log_stream::activity_log_stream_manager::run_activity_log_stream_manager,
-        license::{License, run_periodic_license_check, set_cached_license},
-        limits::update_counts,
-    },
     events::{ApiEvent, BidiStreamEvent},
     grpc::{GatewayEvent, WorkerState, run_grpc_server},
     init_dev_env, init_vpn_location, run_web_server,
     utility_thread::run_utility_thread,
     version::IncompatibleComponents,
 };
+use defguard_enterprise_activity_log_stream::activity_log_stream_manager::run_activity_log_stream_manager;
+use defguard_enterprise_license::{License, run_periodic_license_check, set_cached_license, update_counts};
 use defguard_event_logger::{message::EventLoggerMessage, run_event_logger};
 use defguard_event_router::{RouterReceiverSet, run_event_router};
 use defguard_gateway_manager::{GatewayManager, GatewayTxSet};

crates/defguard_core/Cargo.toml

@@ -10,6 +10,13 @@ rust-version.workspace = true
 [dependencies]
 # internal crates
 defguard_common = { workspace = true }
+defguard_enterprise_activity_log_stream = { workspace = true }
+defguard_enterprise_db = { workspace = true }
+defguard_enterprise_directory_sync = { workspace = true }
+defguard_enterprise_firewall = { workspace = true }
+defguard_enterprise_ldap = { workspace = true }
+defguard_enterprise_license = { workspace = true }
+defguard_enterprise_snat = { workspace = true }
 defguard_mail = { workspace = true }
 defguard_proto = { workspace = true }
 defguard_web_ui = { workspace = true }
@@ -96,6 +103,3 @@ reqwest = { version = "0.12", features = [
 ], default-features = false }
 serde_qs = "1.0"
 webauthn-authenticator-rs = { version = "0.5", features = ["softpasskey"] }
-
-[build-dependencies]
-tonic-prost-build.workspace = true

crates/defguard_core/src/auth/mod.rs

@@ -23,11 +23,9 @@ use defguard_common::db::{
 };
 use sqlx::PgPool;
 
-use crate::{
-    enterprise::{db::models::api_tokens::ApiToken, is_business_license_active},
-    error::WebError,
-    handlers::SESSION_COOKIE_NAME,
-};
+use crate::{error::WebError, handlers::SESSION_COOKIE_NAME};
+use defguard_enterprise_db::models::api_tokens::ApiToken;
+use defguard_enterprise_license::is_business_license_active;
 
 pub struct SessionExtractor(pub Session);
 

crates/defguard_core/src/db/models/activity_log/metadata.rs

@@ -1,26 +1,23 @@
 use chrono::NaiveDateTime;
 use defguard_common::db::{
-    Id,
     models::{
-        AuthenticationKey, AuthenticationKeyType, Device, MFAMethod, Settings, WebAuthn,
-        WireguardNetwork,
         group::Group,
         oauth2client::OAuth2Client,
         proxy::Proxy,
         settings::{LdapSyncStatus, OpenIdUsernameHandling, SmtpEncryption},
         user::User,
+        AuthenticationKey, AuthenticationKeyType, Device, MFAMethod, Settings, WebAuthn,
+        WireguardNetwork,
     },
+    Id,
 };
 
-use crate::{
-    db::WebHook,
-    enterprise::db::models::{
-        activity_log_stream::{ActivityLogStream, ActivityLogStreamType},
-        api_tokens::ApiToken,
-        openid_provider::{DirectorySyncTarget, DirectorySyncUserBehavior, OpenIdProvider},
-        snat::UserSnatBinding,
-    },
-    events::ClientMFAMethod,
+use crate::{db::WebHook, events::ClientMFAMethod};
+use defguard_enterprise_db::models::{
+    activity_log_stream::{ActivityLogStream, ActivityLogStreamType},
+    api_tokens::ApiToken,
+    openid_provider::{DirectorySyncTarget, DirectorySyncUserBehavior, OpenIdProvider},
+    snat::UserSnatBinding,
 };
 
 #[derive(Serialize)]

crates/defguard_core/src/enterprise/directory_sync_context.rs

@@ -0,0 +1,37 @@
+use tokio::sync::broadcast::Sender;
+
+use defguard_enterprise_directory_sync::{DirectorySyncContext, DirectorySyncError};
+
+use crate::{grpc::GatewayEvent, user_management};
+
+pub fn build_directory_sync_context(wg_tx: Sender<GatewayEvent>) -> DirectorySyncContext {
+    let disable_tx = wg_tx.clone();
+    let delete_tx = wg_tx.clone();
+    let sync_tx = wg_tx.clone();
+    DirectorySyncContext {
+        disable_user: Box::new(move |user, conn| {
+            let disable_tx = disable_tx.clone();
+            Box::pin(async move {
+                user_management::disable_user(user, conn, &disable_tx)
+                    .await
+                    .map_err(|err| DirectorySyncError::UserUpdateError(err.to_string()))
+            })
+        }),
+        delete_user_and_cleanup_devices: Box::new(move |user, conn| {
+            let delete_tx = delete_tx.clone();
+            Box::pin(async move {
+                user_management::delete_user_and_cleanup_devices(user, conn, &delete_tx)
+                    .await
+                    .map_err(|err| DirectorySyncError::UserUpdateError(err.to_string()))
+            })
+        }),
+        sync_allowed_user_devices: Box::new(move |user, conn| {
+            let sync_tx = sync_tx.clone();
+            Box::pin(async move {
+                user_management::sync_allowed_user_devices(user, conn, &sync_tx)
+                    .await
+                    .map_err(|err| DirectorySyncError::NetworkUpdateError(err.to_string()))
+            })
+        }),
+    }
+}

crates/defguard_core/src/enterprise/grpc/desktop_client_mfa.rs

@@ -4,16 +4,14 @@ use reqwest::Url;
 use tonic::Status;
 
 use crate::{
-    enterprise::{
-        handlers::openid_login::{extract_state_data, user_from_claims},
-        is_business_license_active,
-    },
+    enterprise::handlers::openid_login::{extract_state_data, user_from_claims},
     events::{BidiRequestContext, BidiStreamEvent, BidiStreamEventType, DesktopClientMfaEvent},
     grpc::{
         proxy::client_mfa::{ClientLoginSession, ClientMfaServer},
         utils::parse_client_ip_agent,
     },
 };
+use defguard_enterprise_license::is_business_license_active;
 
 impl ClientMfaServer {
     #[instrument(skip_all)]

crates/defguard_core/src/enterprise/grpc/polling.rs

@@ -6,7 +6,8 @@ use defguard_proto::proxy::{DeviceInfo, InstanceInfoRequest, InstanceInfoRespons
 use sqlx::PgPool;
 use tonic::Status;
 
-use crate::{enterprise::is_business_license_active, grpc::utils::build_device_config_response};
+use crate::grpc::utils::build_device_config_response;
+use defguard_enterprise_license::is_business_license_active;
 
 pub struct PollingServer {
     pool: PgPool,