pam: allow account credentials to be fetched more than once

[x032205]

pam: allow account credentials to be fetched more than once

Creates new audit log type for specifically accessing credentials

[maidul98]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[greptile-apps]

Greptile Summary

• Allows PAM session credentials to be fetched multiple times instead of only once, removing the previous restriction
• Introduces new PAM_SESSION_CREDENTIALS_GET audit event to track each credential access separately from session start
• Maintains PAM_SESSION_START audit log only for the initial credential fetch when session transitions to Active status

Confidence Score: 5/5

• This PR is safe to merge with no security concerns.
• The implementation correctly addresses the previous audit logging issue by separating credential fetches from session starts. The logic is sound: credentials can be fetched multiple times (tracked by PAM_SESSION_CREDENTIALS_GET), but PAM_SESSION_START only fires once when the session transitions from Starting to Active. All changes are well-structured, maintain security boundaries, and improve audit trail accuracy.
• No files require special attention.

Important Files Changed

Filename	Overview
backend/src/ee/services/pam-account/pam-account-service.ts	Removes the check preventing multiple credential fetches and adds sessionStarted flag to control audit logging.
backend/src/ee/routes/v1/pam-session-router.ts	Updates audit logging to emit PAM_SESSION_CREDENTIALS_GET for all fetches, and conditionally emits PAM_SESSION_START only on first fetch.

[greptile-apps]

Additional Comments (1)

1. backend/src/ee/services/pam-account/pam-account-service.ts, line 667-669 (link)

   logic: The security check for expired sessions doesn't consider sessions in Active state. With repeated credential fetches now allowed, there's no verification that the session hasn't been administratively terminated (Terminated status) or ended by user (Ended status) between the initial fetch and subsequent fetches.

   Attack scenario: If an admin terminates a session or user ends it, the gateway can still repeatedly fetch credentials using the old sessionId, as only endedAt and expiresAt are checked, not the status field.

   Check the session status explicitly:

_{1 file reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}

[x032205]

@greptile review this

[greptile-apps]

_{5 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile
React with 👍 or 👎 to share your feedback on this new summary format}