✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Greptile Summary

This PR replaces the manual KMIP PKI setup flow (dedicated API endpoints + org settings UI) with lazy, automatic initialization that occurs on first use (client certificate creation or server registration). The new $getOrgKmipCAs internal function uses a PostgreSQL advisory lock with double-check locking to safely handle concurrent initialization.

• Removes POST /api/v1/kmip and GET /api/v1/kmip endpoints — breaking API change for any external consumers using these endpoints directly
• Removes the setup permission action from OrgPermissionKmipActions — existing custom roles with this action configured may behave unexpectedly
• Adds OrgKmipInit advisory lock for safe concurrent initialization of the KMIP PKI hierarchy
• Deletes the KMIP organization settings tab from the frontend and updates documentation
• registerServer calls $getOrgKmipCAs redundantly (once directly, once via generateOrgKmipServerCertificate), causing double DB lookups and KMS operations per request
• Orphaned SETUP_KMIP and GET_KMIP event types remain in audit log type definitions (both backend and frontend) with no active code paths using them
• docs/internals/permissions/organization-permissions.mdx still references the removed setup action for the kmip subject

Confidence Score: 3/5

• Functional change is sound but has a breaking API removal and minor inefficiencies that should be addressed.
• The core lazy-init pattern with advisory locks is well-implemented and race-condition safe. However, the removal of two public API endpoints (POST/GET /api/v1/kmip) and the setup permission action are breaking changes that could affect Terraform/Crossplane or API users. The redundant $getOrgKmipCAs double-call in the registerServer path is an inefficiency, and there are a few documentation and cleanup items missed.
• Pay close attention to backend/src/ee/services/kmip/kmip-service.ts (redundant calls, missing license guard in init) and backend/src/ee/routes/v1/kmip-router.ts (breaking API removal).

Important Files Changed

_{Last reviewed commit: 004e310}