feat: subject alternative name policy enforcement

backend/src/services/certificate-template/certificate-template-fns.ts

@@ -1,5 +1,6 @@
 import ms from "ms";
 
+import { TCertificateTemplates } from "@app/db/schemas";
 import { BadRequestError } from "@app/lib/errors";
 
 export const validateCertificateDetailsAgainstTemplate = (
@@ -7,11 +8,9 @@ export const validateCertificateDetailsAgainstTemplate = (
     commonName: string;
     notBeforeDate: Date;
     notAfterDate: Date;
+    altNames: string[];
   },
-  template: {
-    commonName: string;
-    ttl: string;
-  }
+  template: TCertificateTemplates
 ) => {
   const commonNameRegex = new RegExp(template.commonName);
   if (!commonNameRegex.test(cert.commonName)) {
@@ -25,4 +24,13 @@ export const validateCertificateDetailsAgainstTemplate = (
       message: "Invalid validity date based on template policy"
     });
   }
+
+  const subjectAlternativeNameRegex = new RegExp(template.subjectAlternativeName);
+  cert.altNames.forEach((altName) => {
+    if (!subjectAlternativeNameRegex.test(altName)) {
+      throw new BadRequestError({
+        message: "Invalid subject alternative name based on template policy"
+      });
+    }
+  });
 };

backend/src/services/certificate-template/certificate-template-service.ts

@@ -30,6 +30,7 @@ export const certificateTemplateServiceFactory = ({
     caId,
     name,
     commonName,
+    subjectAlternativeName,
     ttl,
     actorId,
     actorAuthMethod,
@@ -59,6 +60,7 @@ export const certificateTemplateServiceFactory = ({
       caId,
       name,
       commonName,
+      subjectAlternativeName,
       ttl
     });
 
@@ -70,6 +72,7 @@ export const certificateTemplateServiceFactory = ({
     caId,
     name,
     commonName,
+    subjectAlternativeName,
     ttl,
     actorId,
     actorAuthMethod,
@@ -108,6 +111,7 @@ export const certificateTemplateServiceFactory = ({
     const updatedCertTemplate = await certificateTemplateDAL.updateById(certTemplate.id, {
       caId,
       commonName,
+      subjectAlternativeName,
       name,
       ttl
     });

backend/src/services/certificate-template/certificate-template-types.ts

@@ -4,6 +4,7 @@ export type TCreateCertTemplateDTO = {
   caId: string;
   name: string;
   commonName: string;
+  subjectAlternativeName: string;
   ttl: string;
 } & Omit<TProjectPermission, "projectId">;
 
@@ -12,6 +13,7 @@ export type TUpdateCertTemplateDTO = {
   caId?: string;
   name?: string;
   commonName?: string;
+  subjectAlternativeName?: string;
   ttl?: string;
 } & Omit<TProjectPermission, "projectId">;