Merge branch 'main' of https://github.com/Infisical/infisical into feat/adds-GETtokenAuthTokenById-api-endpoint

backend/src/ee/routes/v1/index.ts

@@ -1,5 +1,4 @@
 import { registerProjectTemplateRouter } from "@app/ee/routes/v1/project-template-router";
-import { getConfig } from "@app/lib/config/env";
 
 import { registerAccessApprovalPolicyRouter } from "./access-approval-policy-router";
 import { registerAccessApprovalRequestRouter } from "./access-approval-request-router";
@@ -109,10 +108,7 @@ export const registerV1EERoutes = async (server: FastifyZodProvider) => {
   await server.register(
     async (pkiRouter) => {
       await pkiRouter.register(registerCaCrlRouter, { prefix: "/crl" });
-      // Notice: current this feature is still in development and is not yet ready for production.
-      if (getConfig().isAcmeFeatureEnabled === true) {
-        await pkiRouter.register(registerPkiAcmeRouter, { prefix: "/acme" });
-      }
+      await pkiRouter.register(registerPkiAcmeRouter, { prefix: "/acme" });
     },
     { prefix: "/pki" }
   );

backend/src/ee/routes/v1/pit-router.ts

@@ -435,14 +435,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
         projectId: z.string().trim(),
         environment: z.string().trim(),
         secretPath: z.string().trim().default("/").transform(removeTrailingSlash),
-        message: z
-          .string()
-          .trim()
-          .min(1)
-          .max(255)
-          .refine((message) => message.trim() !== "", {
-            message: "Commit message cannot be empty"
-          }),
+        message: z.string().trim().max(255).optional(),
         changes: z.object({
           secrets: z.object({
             create: z
@@ -546,7 +539,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
         projectId: req.body.projectId,
         environment: req.body.environment,
         secretPath: req.body.secretPath,
-        message: req.body.message,
+        message: req.body.message || "",
         changes: {
           secrets: req.body.changes.secrets,
           folders: req.body.changes.folders
@@ -564,7 +557,7 @@ export const registerPITRouter = async (server: FastifyZodProvider) => {
             projectId: req.body.projectId,
             environment: req.body.environment,
             secretPath: req.body.secretPath,
-            message: req.body.message
+            message: req.body.message || ""
           }
         }
       });

backend/src/ee/routes/v1/pki-acme-router.ts

@@ -2,7 +2,6 @@
 import { FastifyReply, FastifyRequest } from "fastify";
 import { z } from "zod";
 
-import { AcmeMalformedError } from "@app/ee/services/pki-acme/pki-acme-errors";
 import {
   AcmeOrderResourceSchema,
   CreateAcmeAccountResponseSchema,
@@ -257,12 +256,9 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, res) => {
-      const { profileId, accountId, payload } = await validateExistingAccount({
+      const { profileId, accountId } = await validateExistingAccount({
         req
       });
-      if (payload !== "") {
-        throw new AcmeMalformedError({ detail: "Payload should be empty" });
-      }
       return sendAcmeResponse(
         res,
         profileId,
@@ -369,12 +365,9 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, res) => {
-      const { profileId, accountId, payload } = await validateExistingAccount({
+      const { profileId, accountId } = await validateExistingAccount({
         req
       });
-      if (payload !== "") {
-        throw new AcmeMalformedError({ detail: "Payload should be empty" });
-      }
       res.type("application/pem-certificate-chain");
       return sendAcmeResponse(
         res,
@@ -405,10 +398,7 @@ export const registerPkiAcmeRouter = async (server: FastifyZodProvider) => {
       }
     },
     handler: async (req, res) => {
-      const { profileId, accountId, payload } = await validateExistingAccount({ req });
-      if (payload !== "") {
-        throw new AcmeMalformedError({ detail: "Payload should be empty" });
-      }
+      const { profileId, accountId } = await validateExistingAccount({ req });
       return sendAcmeResponse(
         res,
         profileId,

backend/src/ee/routes/v1/sub-org-router.ts

@@ -42,7 +42,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT]),
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { organization } = await server.services.subOrganization.createSubOrg({
         name: req.body.name,
@@ -95,7 +95,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT]),
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { organizations } = await server.services.subOrganization.listSubOrgs({
         permissionActor: req.permission,
@@ -137,7 +137,7 @@ export const registerSubOrgRouter = async (server: FastifyZodProvider) => {
         })
       }
     },
-    onRequest: verifyAuth([AuthMode.JWT]),
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const { organization } = await server.services.subOrganization.updateSubOrg({
         subOrgId: req.params.subOrgId,

backend/src/ee/services/app-connections/chef/chef-connection-schemas.ts

@@ -2,6 +2,7 @@ import z from "zod";
 
 import { AppConnections } from "@app/lib/api-docs";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
 import {
   BaseAppConnectionSchema,
   GenericCreateAppConnectionFieldsSchema,
@@ -48,7 +49,7 @@ export const SanitizedChefConnectionSchema = z.discriminatedUnion("method", [
   BaseChefConnectionSchema.extend({
     method: z.literal(ChefConnectionMethod.UserKey),
     credentials: ChefConnectionUserKeyCredentialsSchema.pick({ serverUrl: true, orgName: true, userName: true })
-  })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.Chef]} (User Key)` }))
 ]);
 
 export const ValidateChefConnectionCredentialsSchema = z.discriminatedUnion("method", [
@@ -70,8 +71,10 @@ export const UpdateChefConnectionSchema = z
   })
   .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.Chef));
 
-export const ChefConnectionListItemSchema = z.object({
-  name: z.literal("Chef"),
-  app: z.literal(AppConnection.Chef),
-  methods: z.nativeEnum(ChefConnectionMethod).array()
-});
+export const ChefConnectionListItemSchema = z
+  .object({
+    name: z.literal("Chef"),
+    app: z.literal(AppConnection.Chef),
+    methods: z.nativeEnum(ChefConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.Chef] }));

backend/src/ee/services/app-connections/oci/oci-connection-schemas.ts

@@ -2,6 +2,7 @@ import z from "zod";
 
 import { AppConnections } from "@app/lib/api-docs";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
 import {
   BaseAppConnectionSchema,
   GenericCreateAppConnectionFieldsSchema,
@@ -34,7 +35,7 @@ export const SanitizedOCIConnectionSchema = z.discriminatedUnion("method", [
       region: true,
       fingerprint: true
     })
-  })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.OCI]} (Access Key)` }))
 ]);
 
 export const ValidateOCIConnectionCredentialsSchema = z.discriminatedUnion("method", [
@@ -58,8 +59,10 @@ export const UpdateOCIConnectionSchema = z
   })
   .and(GenericUpdateAppConnectionFieldsSchema(AppConnection.OCI));
 
-export const OCIConnectionListItemSchema = z.object({
-  name: z.literal("OCI"),
-  app: z.literal(AppConnection.OCI),
-  methods: z.nativeEnum(OCIConnectionMethod).array()
-});
+export const OCIConnectionListItemSchema = z
+  .object({
+    name: z.literal("OCI"),
+    app: z.literal(AppConnection.OCI),
+    methods: z.nativeEnum(OCIConnectionMethod).array()
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.OCI] }));

backend/src/ee/services/app-connections/oracledb/oracledb-connection-schemas.ts

@@ -2,6 +2,7 @@ import z from "zod";
 
 import { AppConnections } from "@app/lib/api-docs";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
+import { APP_CONNECTION_NAME_MAP } from "@app/services/app-connection/app-connection-maps";
 import {
   BaseAppConnectionSchema,
   GenericCreateAppConnectionFieldsSchema,
@@ -32,7 +33,7 @@ export const SanitizedOracleDBConnectionSchema = z.discriminatedUnion("method",
       sslRejectUnauthorized: true,
       sslCertificate: true
     })
-  })
+  }).describe(JSON.stringify({ title: `${APP_CONNECTION_NAME_MAP[AppConnection.OracleDB]} (Username and Password)` }))
 ]);
 
 export const ValidateOracleDBConnectionCredentialsSchema = z.discriminatedUnion("method", [
@@ -64,9 +65,11 @@ export const UpdateOracleDBConnectionSchema = z
     })
   );
 
-export const OracleDBConnectionListItemSchema = z.object({
-  name: z.literal("OracleDB"),
-  app: z.literal(AppConnection.OracleDB),
-  methods: z.nativeEnum(OracleDBConnectionMethod).array(),
-  supportsPlatformManagement: z.literal(true)
-});
+export const OracleDBConnectionListItemSchema = z
+  .object({
+    name: z.literal("OracleDB"),
+    app: z.literal(AppConnection.OracleDB),
+    methods: z.nativeEnum(OracleDBConnectionMethod).array(),
+    supportsPlatformManagement: z.literal(true)
+  })
+  .describe(JSON.stringify({ title: APP_CONNECTION_NAME_MAP[AppConnection.OracleDB] }));

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -159,9 +159,22 @@ export enum EventType {
   DELETE_TRUSTED_IP = "delete-trusted-ip",
   CREATE_SERVICE_TOKEN = "create-service-token", // v2
   DELETE_SERVICE_TOKEN = "delete-service-token", // v2
+
+  CREATE_SUB_ORGANIZATION = "create-sub-organization",
+  UPDATE_SUB_ORGANIZATION = "update-sub-organization",
+
   CREATE_IDENTITY = "create-identity",
   UPDATE_IDENTITY = "update-identity",
   DELETE_IDENTITY = "delete-identity",
+
+  CREATE_IDENTITY_ORG_MEMBERSHIP = "create-identity-org-membership",
+  UPDATE_IDENTITY_ORG_MEMBERSHIP = "update-identity-org-membership",
+  DELETE_IDENTITY_ORG_MEMBERSHIP = "delete-identity-org-membership",
+
+  CREATE_IDENTITY_PROJECT_MEMBERSHIP = "create-identity-project-membership",
+  UPDATE_IDENTITY_PROJECT_MEMBERSHIP = "update-identity-project-membership",
+  DELETE_IDENTITY_PROJECT_MEMBERSHIP = "delete-identity-project-membership",
+
   MACHINE_IDENTITY_AUTH_TEMPLATE_CREATE = "machine-identity-auth-template-create",
   MACHINE_IDENTITY_AUTH_TEMPLATE_UPDATE = "machine-identity-auth-template-update",
   MACHINE_IDENTITY_AUTH_TEMPLATE_DELETE = "machine-identity-auth-template-delete",
@@ -175,9 +188,6 @@ export enum EventType {
   GET_TOKENS_IDENTITY_TOKEN_AUTH = "get-tokens-identity-token-auth",
   GET_TOKEN_IDENTITY_TOKEN_AUTH = "get-token-identity-token-auth",
 
-  CREATE_SUB_ORGANIZATION = "create-sub-organization",
-  UPDATE_SUB_ORGANIZATION = "update-sub-organization",
-
   ADD_IDENTITY_TOKEN_AUTH = "add-identity-token-auth",
   UPDATE_IDENTITY_TOKEN_AUTH = "update-identity-token-auth",
   GET_IDENTITY_TOKEN_AUTH = "get-identity-token-auth",
@@ -324,6 +334,7 @@ export enum EventType {
   GET_CERT_BODY = "get-cert-body",
   GET_CERT_PRIVATE_KEY = "get-cert-private-key",
   GET_CERT_BUNDLE = "get-cert-bundle",
+  EXPORT_CERT_PKCS12 = "export-cert-pkcs12",
   CREATE_PKI_ALERT = "create-pki-alert",
   GET_PKI_ALERT = "get-pki-alert",
   UPDATE_PKI_ALERT = "update-pki-alert",
@@ -355,6 +366,8 @@ export enum EventType {
   LOAD_PROJECT_KMS_BACKUP = "load-project-kms-backup",
   ORG_ADMIN_ACCESS_PROJECT = "org-admin-accessed-project",
   ORG_ADMIN_BYPASS_SSO = "org-admin-bypassed-sso",
+  USER_LOGIN = "user-login",
+  SELECT_ORGANIZATION = "select-organization",
   CREATE_CERTIFICATE_TEMPLATE = "create-certificate-template",
   UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template",
   DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template",
@@ -560,6 +573,7 @@ interface UserActorMetadata {
   email?: string | null;
   username: string;
   permission?: Record<string, unknown>;
+  authMethod?: string;
 }
 
 interface ServiceActorMetadata {
@@ -891,6 +905,7 @@ interface CreateIdentityEvent {
     identityId: string;
     name: string;
     hasDeleteProtection: boolean;
+    metadata?: { key: string; value: string }[];
   };
 }
 
@@ -900,6 +915,7 @@ interface UpdateIdentityEvent {
     identityId: string;
     name?: string;
     hasDeleteProtection?: boolean;
+    metadata?: { key: string; value: string }[];
   };
 }
 
@@ -1509,6 +1525,52 @@ interface ClearIdentityLdapAuthLockoutsEvent {
   };
 }
 
+interface CreateIdentityOrgMembershipEvent {
+  type: EventType.CREATE_IDENTITY_ORG_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+    roles: unknown;
+  };
+}
+
+interface UpdateIdentityOrgMembershipEvent {
+  type: EventType.UPDATE_IDENTITY_ORG_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+    roles?: unknown;
+  };
+}
+
+interface DeleteIdentityOrgMembershipEvent {
+  type: EventType.DELETE_IDENTITY_ORG_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+  };
+}
+
+interface CreateIdentityProjectMembershipEvent {
+  type: EventType.CREATE_IDENTITY_PROJECT_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+    roles: unknown;
+  };
+}
+
+interface UpdateIdentityProjectMembershipEvent {
+  type: EventType.UPDATE_IDENTITY_PROJECT_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+    roles?: unknown;
+  };
+}
+
+interface DeleteIdentityProjectMembershipEvent {
+  type: EventType.DELETE_IDENTITY_PROJECT_MEMBERSHIP;
+  metadata: {
+    identityId: string;
+  };
+}
+
 interface LoginIdentityOidcAuthEvent {
   type: EventType.LOGIN_IDENTITY_OIDC_AUTH;
   metadata: {
@@ -2324,6 +2386,14 @@ interface GetCertBundle {
     serialNumber: string;
   };
 }
+interface GetCertPkcs12 {
+  type: EventType.EXPORT_CERT_PKCS12;
+  metadata: {
+    certId: string;
+    cn: string;
+    serialNumber: string;
+  };
+}
 
 interface CreatePkiAlert {
   type: EventType.CREATE_PKI_ALERT;
@@ -2599,6 +2669,22 @@ interface OrgAdminBypassSSOEvent {
   metadata: Record<string, string>; // no metadata yet
 }
 
+interface UserLoginEvent {
+  type: EventType.USER_LOGIN;
+  metadata: {
+    organizationId?: string;
+    authProvider?: string;
+  };
+}
+
+interface SelectOrganizationEvent {
+  type: EventType.SELECT_ORGANIZATION;
+  metadata: {
+    organizationId: string;
+    organizationName: string;
+  };
+}
+
 interface CreateCertificateTemplateEstConfig {
   type: EventType.CREATE_CERTIFICATE_TEMPLATE_EST_CONFIG;
   metadata: {
@@ -4198,6 +4284,12 @@ export type Event =
   | GetIdentityLdapAuthEvent
   | RevokeIdentityLdapAuthEvent
   | ClearIdentityLdapAuthLockoutsEvent
+  | CreateIdentityOrgMembershipEvent
+  | UpdateIdentityOrgMembershipEvent
+  | DeleteIdentityOrgMembershipEvent
+  | CreateIdentityProjectMembershipEvent
+  | UpdateIdentityProjectMembershipEvent
+  | DeleteIdentityProjectMembershipEvent
   | CreateEnvironmentEvent
   | GetEnvironmentEvent
   | UpdateEnvironmentEvent
@@ -4262,6 +4354,7 @@ export type Event =
   | GetCertBody
   | GetCertPrivateKey
   | GetCertBundle
+  | GetCertPkcs12
   | CreatePkiAlert
   | GetPkiAlert
   | UpdatePkiAlert
@@ -4471,4 +4564,6 @@ export type Event =
   | UpdateCertificateRenewalConfigEvent
   | DisableCertificateRenewalConfigEvent
   | AutomatedRenewCertificate
-  | AutomatedRenewCertificateFailed;
+  | AutomatedRenewCertificateFailed
+  | UserLoginEvent
+  | SelectOrganizationEvent;

backend/src/ee/services/license/license-fns.ts

@@ -56,6 +56,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
     secretsLimit: 40
   },
   pkiEst: false,
+  pkiAcme: false,
   enforceMfa: false,
   projectTemplates: false,
   kmip: false,

backend/src/ee/services/license/license-types.ts

@@ -78,6 +78,7 @@ export type TFeatureSet = {
     secretsLimit: number;
   };
   pkiEst: boolean;
+  pkiAcme: false;
   enforceMfa: boolean;
   projectTemplates: false;
   kmip: false;

backend/src/ee/services/pam-resource/shared/sql/sql-resource-factory.ts

@@ -104,8 +104,7 @@ const makeSqlConnection = (
               //          (like being able to do an auth handshake regardless pass or not)
               if (
                 connectOnly &&
-                (error.message === `password authentication failed for user "${TEST_CONNECTION_USERNAME}"` ||
-                  error.message.includes("no pg_hba.conf entry for host"))
+                error.message === `password authentication failed for user "${TEST_CONNECTION_USERNAME}"`
               ) {
                 return;
               }

backend/src/ee/services/permission/default-roles.ts

@@ -171,7 +171,11 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionIdentityActions.Delete,
       ProjectPermissionIdentityActions.Read,
       ProjectPermissionIdentityActions.GrantPrivileges,
-      ProjectPermissionIdentityActions.AssumePrivileges
+      ProjectPermissionIdentityActions.AssumePrivileges,
+      ProjectPermissionIdentityActions.GetToken,
+      ProjectPermissionIdentityActions.CreateToken,
+      ProjectPermissionIdentityActions.DeleteToken,
+      ProjectPermissionIdentityActions.RevokeAuth
     ],
     ProjectPermissionSub.Identity
   );

backend/src/ee/services/permission/permission-dal.ts

@@ -204,9 +204,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
               .on(`${TableName.IdentityMetadata}.userId`, db.raw("?", [actorId]))
               .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
           } else if (actorType === ActorType.IDENTITY) {
-            void queryBuilder
-              .on(`${TableName.IdentityMetadata}.identityId`, db.raw("?", [actorId]))
-              .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
+            void queryBuilder.on(`${TableName.IdentityMetadata}.identityId`, db.raw("?", [actorId]));
           }
         })
         .where(`${TableName.Membership}.scopeOrgId`, scopeData.orgId)
@@ -667,9 +665,7 @@ export const permissionDALFactory = (db: TDbClient): TPermissionDALFactory => {
         })
         .join(TableName.Identity, `${TableName.Identity}.id`, `${TableName.Membership}.actorIdentityId`)
         .leftJoin(TableName.IdentityMetadata, (queryBuilder) => {
-          void queryBuilder
-            .on(`${TableName.Membership}.actorIdentityId`, `${TableName.IdentityMetadata}.identityId`)
-            .andOn(`${TableName.Membership}.scopeOrgId`, `${TableName.IdentityMetadata}.orgId`);
+          void queryBuilder.on(`${TableName.Membership}.actorIdentityId`, `${TableName.IdentityMetadata}.identityId`);
         })
         .where(`${TableName.Membership}.scopeOrgId`, orgId)
         .whereNotNull(`${TableName.Membership}.actorIdentityId`)

backend/src/ee/services/permission/permission-service.ts

@@ -196,7 +196,7 @@ export const permissionServiceFactory = ({
     }
 
     if (orgId !== actorOrgId) {
-      throw new ForbiddenRequestError({ name: "You are not logged into this organization" });
+      throw new ForbiddenRequestError({ name: "You are not allowed to access organization resource" });
     }
 
     const permissionData = await permissionDAL.getPermission({
@@ -344,7 +344,7 @@ export const permissionServiceFactory = ({
     });
 
     if (projectDetails.orgId !== actorOrgId) {
-      throw new ForbiddenRequestError({ name: "You are not logged into this organization" });
+      throw new ForbiddenRequestError({ name: "This project does not belong to your selected organization." });
     }
 
     if (actionProjectType !== ActionProjectType.Any && actionProjectType !== projectDetails.type) {
@@ -362,7 +362,7 @@ export const permissionServiceFactory = ({
       actorId,
       actorType: actor
     });
-    if (!permissionData?.length) throw new ForbiddenRequestError({ name: "You are not member of this organization" });
+    if (!permissionData?.length) throw new ForbiddenRequestError({ name: "You are not member of this project" });
 
     const permissionFromRoles = permissionData.flatMap((membership) => {
       const activeRoles = membership?.roles

backend/src/ee/services/permission/project-permission.ts

@@ -65,7 +65,11 @@ export enum ProjectPermissionIdentityActions {
   Edit = "edit",
   Delete = "delete",
   GrantPrivileges = "grant-privileges",
-  AssumePrivileges = "assume-privileges"
+  AssumePrivileges = "assume-privileges",
+  RevokeAuth = "revoke-auth",
+  CreateToken = "create-token",
+  GetToken = "get-token",
+  DeleteToken = "delete-token"
 }
 
 export enum ProjectPermissionMemberActions {

backend/src/ee/services/pki-acme/pki-acme-challenge-service.ts

@@ -76,7 +76,9 @@ export const pkiAcmeChallengeServiceFactory = ({
         //         challenge validation at the same time, it should be fine.
         const challengeResponse = await fetch(challengeUrl, { signal: AbortSignal.timeout(timeoutMs) });
         if (challengeResponse.status !== 200) {
-          throw new BadRequestError({ message: "ACME challenge response is not 200" });
+          throw new AcmeIncorrectResponseError({
+            message: `ACME challenge response is not 200: ${challengeResponse.status}`
+          });
         }
         const challengeResponseBody = await challengeResponse.text();
         const thumbprint = challenge.auth.account.publicKeyThumbprint;
@@ -107,6 +109,7 @@ export const pkiAcmeChallengeServiceFactory = ({
             if (fetchError.code === "ENOTFOUND" || fetchError.message.includes("ENOTFOUND")) {
               return new AcmeDnsFailureError({ message: "Hostname could not be resolved (DNS failure)" });
             }
+            logger.error(exp, "Unknown error validating ACME challenge response");
             return new AcmeServerInternalError({ message: "Unknown error validating ACME challenge response" });
           }
         } else if (exp instanceof DOMException) {

backend/src/ee/services/pki-acme/pki-acme-errors.ts

@@ -35,7 +35,7 @@ export enum AcmeErrorType {
 
 export interface IAcmeError {
   type: AcmeErrorType;
-  detail: string;
+  message: string;
   status: number;
   subproblems?: Array<{ type: string; detail: string; identifier?: { type: string; value: string } }>;
 }
@@ -43,7 +43,7 @@ export interface IAcmeError {
 export class AcmeError extends Error implements IAcmeError {
   type: AcmeErrorType;
 
-  detail: string;
+  message: string;
 
   status: number;
 
@@ -53,22 +53,20 @@ export class AcmeError extends Error implements IAcmeError {
 
   constructor({
     type,
-    detail,
+    message,
     status,
     subproblems,
-    error,
-    message
+    error
   }: {
     type: AcmeErrorType;
-    detail: string;
+    message: string;
     status: number;
     subproblems?: Array<{ type: string; detail: string; identifier?: { type: string; value: string } }>;
     error?: unknown;
-    message?: string;
   }) {
-    super(message || detail);
+    super(message);
     this.type = type;
-    this.detail = detail;
+    this.message = message;
     this.status = status;
     this.subproblems = subproblems;
     this.error = error;
@@ -78,7 +76,7 @@ export class AcmeError extends Error implements IAcmeError {
   toAcmeResponse(): IAcmeError {
     return {
       type: this.type,
-      detail: this.detail,
+      message: this.message,
       status: this.status,
       subproblems: this.subproblems
     };
@@ -90,20 +88,17 @@ export class AcmeError extends Error implements IAcmeError {
  */
 export class AcmeMalformedError extends AcmeError {
   constructor({
-    detail = "The request message was malformed",
-    error,
-    message
+    message = "The request message was malformed",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.Malformed,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeMalformedError";
   }
@@ -114,20 +109,17 @@ export class AcmeMalformedError extends AcmeError {
  */
 export class AcmeUnauthorizedError extends AcmeError {
   constructor({
-    detail = "The client lacks sufficient authorization",
-    error,
-    message
+    message = "The client lacks sufficient authorization",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.Unauthorized,
-      detail,
+      message,
       status: 403,
-      error,
-      message
+      error
     });
     this.name = "AcmeUnauthorizedError";
   }
@@ -139,20 +131,17 @@ export class AcmeUnauthorizedError extends AcmeError {
  */
 export class AcmeAccountDoesNotExistError extends AcmeError {
   constructor({
-    detail = "The request specified an account that does not exist",
-    error,
-    message
+    message = "The request specified an account that does not exist",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.AccountDoesNotExist,
-      detail,
-      status: 400,
-      error,
-      message
+      message,
+      status: 404,
+      error
     });
     this.name = "AcmeAccountDoesNotExistError";
   }
@@ -163,20 +152,17 @@ export class AcmeAccountDoesNotExistError extends AcmeError {
  */
 export class AcmeBadNonceError extends AcmeError {
   constructor({
-    detail = "The client sent an unacceptable anti-replay nonce",
-    error,
-    message
+    message = "The client sent an unacceptable anti-replay nonce",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadNonce,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadNonceError";
   }
@@ -187,20 +173,17 @@ export class AcmeBadNonceError extends AcmeError {
  */
 export class AcmeBadSignatureAlgorithmError extends AcmeError {
   constructor({
-    detail = "The signature algorithm is invalid",
-    error,
-    message
+    message = "The signature algorithm is invalid",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadSignatureAlgorithm,
-      detail,
+      message,
       status: 401,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadSignatureAlgorithmError";
   }
@@ -211,20 +194,17 @@ export class AcmeBadSignatureAlgorithmError extends AcmeError {
  */
 export class AcmeBadPublicKeyError extends AcmeError {
   constructor({
-    detail = "The public key is not acceptable",
-    error,
-    message
+    message = "The public key is not acceptable",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadPublicKey,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadPublicKeyError";
   }
@@ -235,20 +215,17 @@ export class AcmeBadPublicKeyError extends AcmeError {
  */
 export class AcmeBadCsrError extends AcmeError {
   constructor({
-    detail = "The CSR is unacceptable",
-    error,
-    message
+    message = "The CSR is unacceptable",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadCsr,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadCsrError";
   }
@@ -260,20 +237,17 @@ export class AcmeBadCsrError extends AcmeError {
  */
 export class AcmeBadRevocationReasonError extends AcmeError {
   constructor({
-    detail = "The revocation reason provided is not allowed",
-    error,
-    message
+    message = "The revocation reason provided is not allowed",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadRevocationReason,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadRevocationReasonError";
   }
@@ -284,20 +258,17 @@ export class AcmeBadRevocationReasonError extends AcmeError {
  */
 export class AcmeRateLimitedError extends AcmeError {
   constructor({
-    detail = "The client has exceeded a rate limit",
-    error,
-    message
+    message = "The client has exceeded a rate limit",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.RateLimited,
-      detail,
+      message,
       status: 429,
-      error,
-      message
+      error
     });
     this.name = "AcmeRateLimitedError";
   }
@@ -309,23 +280,20 @@ export class AcmeRateLimitedError extends AcmeError {
  */
 export class AcmeRejectedIdentifierError extends AcmeError {
   constructor({
-    detail = "The server will not issue certificates for the identifier",
+    message = "The server will not issue certificates for the identifier",
     subproblems,
-    error,
-    message
+    error
   }: {
-    detail?: string;
+    message?: string;
     subproblems?: Array<{ type: string; detail: string; identifier?: { type: string; value: string } }>;
     error?: unknown;
-    message?: string;
   } = {}) {
     super({
       type: AcmeErrorType.RejectedIdentifier,
-      detail,
+      message,
       status: 400,
       subproblems,
-      error,
-      message
+      error
     });
     this.name = "AcmeRejectedIdentifierError";
   }
@@ -336,20 +304,17 @@ export class AcmeRejectedIdentifierError extends AcmeError {
  */
 export class AcmeServerInternalError extends AcmeError {
   constructor({
-    detail = "An internal error occurred",
-    error,
-    message
+    message = "An internal error occurred",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.ServerInternal,
-      detail,
+      message,
       status: 500,
-      error,
-      message
+      error
     });
     this.name = "AcmeServerInternalError";
   }
@@ -360,20 +325,17 @@ export class AcmeServerInternalError extends AcmeError {
  */
 export class AcmeUnsupportedContactError extends AcmeError {
   constructor({
-    detail = "A contact URL is of an unsupported type",
-    error,
-    message
+    message = "A contact URL is of an unsupported type",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.UnsupportedContact,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeUnsupportedContactError";
   }
@@ -385,20 +347,17 @@ export class AcmeUnsupportedContactError extends AcmeError {
  */
 export class AcmeUnsupportedIdentifierError extends AcmeError {
   constructor({
-    detail = "An identifier is of an unsupported type",
-    error,
-    message
+    message = "An identifier is of an unsupported type",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.UnsupportedIdentifier,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeUnsupportedIdentifierError";
   }
@@ -412,22 +371,19 @@ export class AcmeUserActionRequiredError extends AcmeError {
   instance?: string;
 
   constructor({
-    detail = "Visit the instance URL and take actions specified there",
+    message = "Visit the instance URL and take actions specified there",
     instance,
-    error,
-    message
+    error
   }: {
-    detail?: string;
+    message?: string;
     instance?: string;
     error?: unknown;
-    message?: string;
   } = {}) {
     super({
       type: AcmeErrorType.UserActionRequired,
-      detail,
+      message,
       status: 403,
-      error,
-      message
+      error
     });
     this.instance = instance;
     this.name = "AcmeUserActionRequiredError";
@@ -446,20 +402,17 @@ export class AcmeUserActionRequiredError extends AcmeError {
  */
 export class AcmeIncorrectResponseError extends AcmeError {
   constructor({
-    detail = "The response is incorrect",
-    error,
-    message
+    message = "The response is incorrect",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.IncorrectResponse,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeIncorrectResponseError";
   }
@@ -470,20 +423,17 @@ export class AcmeIncorrectResponseError extends AcmeError {
  */
 export class AcmeConnectionError extends AcmeError {
   constructor({
-    detail = "A connection error occurred",
-    error,
-    message
+    message = "A connection error occurred",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.Connection,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeConnectionError";
   }
@@ -491,20 +441,17 @@ export class AcmeConnectionError extends AcmeError {
 
 export class AcmeDnsFailureError extends AcmeError {
   constructor({
-    detail = "Hostname could not be resolved (DNS failure)",
-    error,
-    message
+    message = "Hostname could not be resolved (DNS failure)",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.DNS,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeDnsFailureError";
   }
@@ -512,20 +459,17 @@ export class AcmeDnsFailureError extends AcmeError {
 
 export class AcmeOrderNotReadyError extends AcmeError {
   constructor({
-    detail = "The order is not ready",
-    error,
-    message
+    message = "The order is not ready",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.OrderNotReady,
-      detail,
-      status: 403,
-      error,
-      message
+      message,
+      status: 400,
+      error
     });
     this.name = "AcmeOrderNotReadyError";
   }
@@ -533,20 +477,17 @@ export class AcmeOrderNotReadyError extends AcmeError {
 
 export class AcmeBadCSRError extends AcmeError {
   constructor({
-    detail = "The CSR is unacceptable",
-    error,
-    message
+    message = "The CSR is unacceptable",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.BadCsr,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeBadCSRError";
   }
@@ -554,20 +495,17 @@ export class AcmeBadCSRError extends AcmeError {
 
 export class AcmeExternalAccountRequiredError extends AcmeError {
   constructor({
-    detail = "External account binding is required",
-    error,
-    message
+    message = "External account binding is required",
+    error
   }: {
-    detail?: string;
-    error?: unknown;
     message?: string;
+    error?: unknown;
   } = {}) {
     super({
       type: AcmeErrorType.ExternalAccountRequired,
-      detail,
+      message,
       status: 400,
-      error,
-      message
+      error
     });
     this.name = "AcmeExternalAccountRequiredError";
   }

backend/src/ee/services/pki-acme/pki-acme-fns.ts

@@ -1,8 +1,9 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 import { getConfig } from "@app/lib/config/env";
 
-import { AcmeMalformedError } from "./pki-acme-errors";
+import { AcmeAccountDoesNotExistError } from "./pki-acme-errors";
 
 export const buildUrl = (profileId: string, path: string): string => {
   const appCfg = getConfig();
@@ -13,7 +14,14 @@ export const buildUrl = (profileId: string, path: string): string => {
 export const extractAccountIdFromKid = (kid: string, profileId: string): string => {
   const kidPrefix = buildUrl(profileId, "/accounts/");
   if (!kid.startsWith(kidPrefix)) {
-    throw new AcmeMalformedError({ detail: "KID must start with the profile account URL" });
+    throw new AcmeAccountDoesNotExistError({ message: "KID must start with the profile account URL" });
   }
   return z.string().uuid().parse(kid.slice(kidPrefix.length));
 };
+
+export const validateDnsIdentifier = (identifier: string): boolean => {
+  // DNS label pattern: 1-63 chars, alphanumeric or hyphen, but not starting or ending with hyphen
+  const labelPattern = new RE2(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/);
+  const labels = identifier.split(".");
+  return labels.every((label) => label.length >= 1 && label.length <= 63 && labelPattern.test(label));
+};

backend/src/ee/services/pki-acme/pki-acme-schemas.ts

@@ -1,4 +1,3 @@
-import RE2 from "re2";
 import { z } from "zod";
 
 export enum AcmeIdentifierType {
@@ -88,13 +87,8 @@ export const CreateAcmeAccountResponseSchema = z.object({
 export const CreateAcmeOrderBodySchema = z.object({
   identifiers: z.array(
     z.object({
-      type: z.enum(Object.values(AcmeIdentifierType) as [string, ...string[]]),
-      value: z.string().refine((val) => {
-        // DNS label pattern: 1-63 chars, alphanumeric or hyphen, but not starting or ending with hyphen
-        const labelPattern = new RE2(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/);
-        const labels = val.split(".");
-        return labels.every((label) => label.length >= 1 && label.length <= 63 && labelPattern.test(label));
-      }, "Invalid DNS identifier")
+      type: z.string(),
+      value: z.string()
     })
   ),
   notBefore: z.string().optional(),

backend/src/ee/services/pki-acme/pki-acme-service.ts

@@ -12,12 +12,26 @@ import { z, ZodError } from "zod";
 import { TPkiAcmeAccounts } from "@app/db/schemas/pki-acme-accounts";
 import { TPkiAcmeAuths } from "@app/db/schemas/pki-acme-auths";
 import { KeyStorePrefixes, TKeyStoreFactory } from "@app/keystore/keystore";
+import { getConfig } from "@app/lib/config/env";
 import { crypto } from "@app/lib/crypto/cryptography";
-import { BadRequestError, NotFoundError, UnauthorizedError } from "@app/lib/errors";
+import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { isPrivateIp } from "@app/lib/ip/ipRange";
 import { logger } from "@app/lib/logger";
+import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { ActorType } from "@app/services/auth/auth-type";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
+import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
+import { TCertificateSecretDALFactory } from "@app/services/certificate/certificate-secret-dal";
+import {
+  CertExtendedKeyUsage,
+  CertKeyUsage,
+  CertSubjectAlternativeNameType
+} from "@app/services/certificate/certificate-types";
+import { orderCertificate } from "@app/services/certificate-authority/acme/acme-certificate-authority-fns";
+import { TCertificateAuthorityDALFactory } from "@app/services/certificate-authority/certificate-authority-dal";
+import { CaType } from "@app/services/certificate-authority/certificate-authority-enums";
+import { TExternalCertificateAuthorityDALFactory } from "@app/services/certificate-authority/external-certificate-authority-dal";
+import { extractCertificateRequestFromCSR } from "@app/services/certificate-common/certificate-csr-utils";
 import { TCertificateProfileDALFactory } from "@app/services/certificate-profile/certificate-profile-dal";
 import {
   EnrollmentType,
@@ -28,6 +42,7 @@ import { TKmsServiceFactory } from "@app/services/kms/kms-service";
 import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
+import { TLicenseServiceFactory } from "../license/license-service";
 import { TPkiAcmeAccountDALFactory } from "./pki-acme-account-dal";
 import { TPkiAcmeAuthDALFactory } from "./pki-acme-auth-dal";
 import { TPkiAcmeChallengeDALFactory } from "./pki-acme-challenge-dal";
@@ -44,7 +59,7 @@ import {
   AcmeUnauthorizedError,
   AcmeUnsupportedIdentifierError
 } from "./pki-acme-errors";
-import { buildUrl, extractAccountIdFromKid } from "./pki-acme-fns";
+import { buildUrl, extractAccountIdFromKid, validateDnsIdentifier } from "./pki-acme-fns";
 import { TPkiAcmeOrderAuthDALFactory } from "./pki-acme-order-auth-dal";
 import { TPkiAcmeOrderDALFactory } from "./pki-acme-order-dal";
 import {
@@ -77,9 +92,14 @@ import {
 } from "./pki-acme-types";
 
 type TPkiAcmeServiceFactoryDep = {
-  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction">;
+  projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction" | "findById">;
+  appConnectionDAL: Pick<TAppConnectionDALFactory, "findById">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
+  externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "update">;
   certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithOwnerOrgId" | "findByIdWithConfigs">;
-  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne">;
+  certificateBodyDAL: Pick<TCertificateBodyDALFactory, "findOne" | "create">;
+  certificateSecretDAL: Pick<TCertificateSecretDALFactory, "findOne" | "create">;
   acmeAccountDAL: Pick<
     TPkiAcmeAccountDALFactory,
     "findByProjectIdAndAccountId" | "findByProfileIdAndPublicKeyThumbprintAndAlg" | "create"
@@ -100,15 +120,24 @@ type TPkiAcmeServiceFactoryDep = {
     "create" | "transaction" | "updateById" | "findByAccountAuthAndChallengeId" | "findByIdForChallengeValidation"
   >;
   keyStore: Pick<TKeyStoreFactory, "getItem" | "setItemWithExpiry" | "deleteItem">;
-  kmsService: Pick<TKmsServiceFactory, "decryptWithKmsKey" | "generateKmsKey">;
+  kmsService: Pick<
+    TKmsServiceFactory,
+    "decryptWithKmsKey" | "generateKmsKey" | "encryptWithKmsKey" | "createCipherPairWithDataKey"
+  >;
+  licenseService: Pick<TLicenseServiceFactory, "getPlan">;
   certificateV3Service: Pick<TCertificateV3ServiceFactory, "signCertificateFromProfile">;
   acmeChallengeService: TPkiAcmeChallengeServiceFactory;
 };
 
 export const pkiAcmeServiceFactory = ({
   projectDAL,
+  appConnectionDAL,
+  certificateDAL,
+  certificateAuthorityDAL,
+  externalCertificateAuthorityDAL,
   certificateProfileDAL,
   certificateBodyDAL,
+  certificateSecretDAL,
   acmeAccountDAL,
   acmeOrderDAL,
   acmeAuthDAL,
@@ -116,6 +145,7 @@ export const pkiAcmeServiceFactory = ({
   acmeChallengeDAL,
   keyStore,
   kmsService,
+  licenseService,
   certificateV3Service,
   acmeChallengeService
 }: TPkiAcmeServiceFactoryDep): TPkiAcmeServiceFactory => {
@@ -127,6 +157,12 @@ export const pkiAcmeServiceFactory = ({
     if (profile.enrollmentType !== EnrollmentType.ACME) {
       throw new NotFoundError({ message: "Certificate profile is not configured for ACME enrollment" });
     }
+    const orgLicensePlan = await licenseService.getPlan(profile.project!.orgId);
+    if (!orgLicensePlan.pkiAcme) {
+      throw new AcmeUnauthorizedError({
+        message: "Failed to validate ACME profile: Plan restriction. Upgrade plan to continue"
+      });
+    }
     return profile;
   };
 
@@ -148,7 +184,7 @@ export const pkiAcmeServiceFactory = ({
     try {
       result = await flattenedVerify(rawJwsPayload, async (protectedHeader: JWSHeaderParameters | undefined) => {
         if (protectedHeader === undefined) {
-          throw new AcmeMalformedError({ detail: "Protected header is required" });
+          throw new AcmeMalformedError({ message: "Protected header is required" });
         }
         const jwk = await getJWK(protectedHeader);
         const key = await importJWK(jwk, protectedHeader.alg);
@@ -159,28 +195,35 @@ export const pkiAcmeServiceFactory = ({
         throw error;
       }
       if (error instanceof ZodError) {
-        throw new AcmeMalformedError({ detail: `Invalid JWS payload: ${error.message}` });
+        throw new AcmeMalformedError({ message: `Invalid JWS payload: ${error.message}` });
       }
       if (error instanceof errors.JWSSignatureVerificationFailed) {
-        throw new AcmeBadPublicKeyError({ detail: "Invalid JWS payload" });
+        throw new AcmeBadPublicKeyError({ message: "Invalid JWS payload" });
       }
       logger.error(error, "Unexpected error while verifying JWS payload");
-      throw new AcmeServerInternalError({ detail: "Failed to verify JWS payload" });
+      throw new AcmeMalformedError({ message: "Failed to verify JWS payload" });
     }
     const { protectedHeader: rawProtectedHeader, payload: rawPayload } = result;
     try {
       const protectedHeader = ProtectedHeaderSchema.parse(rawProtectedHeader);
+      const parsedUrl = (() => {
+        try {
+          return new URL(protectedHeader.url);
+        } catch (error) {
+          throw new AcmeMalformedError({ message: "Invalid URL in the protected header" });
+        }
+      })();
       // Validate the URL
-      if (new URL(protectedHeader.url).href !== url.href) {
-        throw new AcmeUnauthorizedError({ detail: "URL mismatch in the protected header" });
+      if (parsedUrl.href !== url.href) {
+        throw new AcmeMalformedError({ message: "URL mismatch in the protected header" });
       }
       // Consume the nonce
       if (!protectedHeader.nonce) {
-        throw new AcmeMalformedError({ detail: "Nonce is required in the protected header" });
+        throw new AcmeMalformedError({ message: "Nonce is required in the protected header" });
       }
       const deleted = await keyStore.deleteItem(KeyStorePrefixes.PkiAcmeNonce(protectedHeader.nonce));
       if (deleted !== 1) {
-        throw new AcmeBadNonceError({ detail: "Invalid nonce" });
+        throw new AcmeBadNonceError({ message: "Invalid nonce" });
       }
 
       // Parse the payload
@@ -196,10 +239,10 @@ export const pkiAcmeServiceFactory = ({
         throw error;
       }
       if (error instanceof ZodError) {
-        throw new AcmeMalformedError({ detail: `Invalid JWS payload: ${error.message}` });
+        throw new AcmeMalformedError({ message: `Invalid JWS payload: ${error.message}` });
       }
       logger.error(error, "Unexpected error while parsing JWS payload");
-      throw new AcmeServerInternalError({ detail: "Failed to verify JWS payload" });
+      throw new AcmeMalformedError({ message: "Failed to verify JWS payload" });
     }
   };
 
@@ -215,7 +258,7 @@ export const pkiAcmeServiceFactory = ({
       rawJwsPayload,
       getJWK: async (protectedHeader) => {
         if (!protectedHeader.jwk) {
-          throw new AcmeMalformedError({ detail: "JWK is required in the protected header" });
+          throw new AcmeMalformedError({ message: "JWK is required in the protected header" });
         }
         return protectedHeader.jwk as unknown as JsonWebKey;
       },
@@ -246,18 +289,18 @@ export const pkiAcmeServiceFactory = ({
       rawJwsPayload,
       getJWK: async (protectedHeader) => {
         if (!protectedHeader.kid) {
-          throw new AcmeMalformedError({ detail: "KID is required in the protected header" });
+          throw new AcmeMalformedError({ message: "KID is required in the protected header" });
         }
         const accountId = extractAccountIdFromKid(protectedHeader.kid, profileId);
         if (expectedAccountId && accountId !== expectedAccountId) {
-          throw new NotFoundError({ message: "ACME resource not found" });
+          throw new AcmeAccountDoesNotExistError({ message: "ACME resource not found" });
         }
         const account = await acmeAccountDAL.findByProjectIdAndAccountId(profile.id, accountId);
         if (!account) {
           throw new AcmeAccountDoesNotExistError({ message: "ACME account not found" });
         }
         if (account.alg !== protectedHeader.alg) {
-          throw new AcmeMalformedError({ detail: "ACME account algorithm mismatch" });
+          throw new AcmeMalformedError({ message: "ACME account algorithm mismatch" });
         }
         return account.publicKey as JsonWebKey;
       },
@@ -344,7 +387,7 @@ export const pkiAcmeServiceFactory = ({
   }): Promise<TAcmeResponse<TCreateAcmeAccountResponse>> => {
     const profile = await validateAcmeProfile(profileId);
     if (!externalAccountBinding) {
-      throw new AcmeExternalAccountRequiredError({ detail: "External account binding is required" });
+      throw new AcmeExternalAccountRequiredError({ message: "External account binding is required" });
     }
 
     const publicKeyThumbprint = await calculateJwkThumbprint(jwk, "sha256");
@@ -363,26 +406,28 @@ export const pkiAcmeServiceFactory = ({
         return { eabPayload: result.payload, eabProtectedHeader: result.protectedHeader };
       } catch (error) {
         if (error instanceof errors.JWSSignatureVerificationFailed) {
-          throw new AcmeMalformedError({ detail: "Invalid external account binding JWS signature" });
+          throw new AcmeExternalAccountRequiredError({ message: "Invalid external account binding JWS signature" });
         }
         logger.error(error, "Unexpected error while verifying EAB JWS signature");
-        throw new AcmeServerInternalError({ detail: "Failed to verify EAB JWS signature" });
+        throw new AcmeServerInternalError({ message: "Failed to verify EAB JWS signature" });
       }
     })();
 
     const { alg: eabAlg, kid: eabKid } = eabProtectedHeader!;
     if (!["HS256", "HS384", "HS512"].includes(eabAlg!)) {
-      throw new AcmeMalformedError({ detail: "Invalid algorithm for external account binding JWS payload" });
+      throw new AcmeExternalAccountRequiredError({
+        message: "Invalid algorithm for external account binding JWS payload"
+      });
     }
     // Make sure the KID in the EAB payload matches the profile ID
     if (eabKid !== profile.id) {
-      throw new UnauthorizedError({ message: "External account binding KID mismatch" });
+      throw new AcmeExternalAccountRequiredError({ message: "External account binding KID mismatch" });
     }
 
     // Make sure the URL matches the expected URL
     const url = eabProtectedHeader!.url!;
     if (url !== buildUrl(profile.id, "/new-account")) {
-      throw new UnauthorizedError({ message: "External account binding URL mismatch" });
+      throw new AcmeExternalAccountRequiredError({ message: "External account binding URL mismatch" });
     }
 
     // Make sure the JWK in the EAB payload matches the one provided in the outer JWS payload
@@ -481,6 +526,21 @@ export const pkiAcmeServiceFactory = ({
     // TODO: check the identifiers and see if are they even allowed for this profile.
     //       if not, we may be able to reject it early with an unsupportedIdentifier error.
 
+    // TODO: ideally, we should return an error with subproblems if we have multiple unsupported identifiers
+    if (payload.identifiers.some((identifier) => identifier.type !== AcmeIdentifierType.DNS)) {
+      throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
+    }
+    if (
+      payload.identifiers.some(
+        (identifier) =>
+          !validateDnsIdentifier(identifier.value) ||
+          isPrivateIp(identifier.value) ||
+          (!getConfig().isDevelopmentMode && identifier.value.toLowerCase() === "localhost")
+      )
+    ) {
+      throw new AcmeUnsupportedIdentifierError({ message: "Invalid DNS identifier" });
+    }
+
     const order = await acmeOrderDAL.transaction(async (tx) => {
       const account = (await acmeAccountDAL.findByProjectIdAndAccountId(profileId, accountId))!;
       const createdOrder = await acmeOrderDAL.create(
@@ -497,10 +557,10 @@ export const pkiAcmeServiceFactory = ({
       const authorizations: TPkiAcmeAuths[] = await Promise.all(
         payload.identifiers.map(async (identifier) => {
           if (identifier.type !== AcmeIdentifierType.DNS) {
-            throw new AcmeUnsupportedIdentifierError({ detail: "Only DNS identifiers are supported" });
+            throw new AcmeUnsupportedIdentifierError({ message: "Only DNS identifiers are supported" });
           }
           if (isPrivateIp(identifier.value)) {
-            throw new AcmeUnsupportedIdentifierError({ detail: "Private IP addresses are not allowed" });
+            throw new AcmeUnsupportedIdentifierError({ message: "Private IP addresses are not allowed" });
           }
           const auth = await acmeAuthDAL.create(
             {
@@ -588,6 +648,7 @@ export const pkiAcmeServiceFactory = ({
     orderId: string;
     payload: TFinalizeAcmeOrderPayload;
   }): Promise<TAcmeResponse<TAcmeOrderResource>> => {
+    const profile = (await certificateProfileDAL.findByIdWithConfigs(profileId))!;
     let order = await acmeOrderDAL.findByAccountAndOrderIdWithAuthorizations(accountId, orderId);
     if (!order) {
       throw new NotFoundError({ message: "ACME order not found" });
@@ -603,28 +664,100 @@ export const pkiAcmeServiceFactory = ({
         if (finalizingOrder.expiresAt < new Date()) {
           throw new AcmeOrderNotReadyError({ message: "ACME order has expired" });
         }
+
         const { csr } = payload;
+
+        // Check and validate the CSR
+        const certificateRequest = extractCertificateRequestFromCSR(csr);
+        if (!certificateRequest.commonName) {
+          throw new AcmeBadCSRError({ message: "Invalid CSR: Common name is required" });
+        }
+        if (
+          certificateRequest.subjectAlternativeNames?.some(
+            (san) => san.type !== CertSubjectAlternativeNameType.DNS_NAME
+          )
+        ) {
+          throw new AcmeBadCSRError({ message: "Invalid CSR: Only DNS subject alternative names are supported" });
+        }
+        const orderWithAuthorizations = (await acmeOrderDAL.findByAccountAndOrderIdWithAuthorizations(
+          accountId,
+          orderId,
+          tx
+        ))!;
+        const csrIdentifierValues = new Set(
+          (certificateRequest.subjectAlternativeNames ?? [])
+            .map((san) => san.value.toLowerCase())
+            .concat([certificateRequest.commonName.toLowerCase()])
+        );
+        if (
+          csrIdentifierValues.size !== orderWithAuthorizations.authorizations.length ||
+          !orderWithAuthorizations.authorizations.every((auth) =>
+            csrIdentifierValues.has(auth.identifierValue.toLowerCase())
+          )
+        ) {
+          throw new AcmeBadCSRError({ message: "Invalid CSR: Common name + SANs mismatch with order identifiers" });
+        }
+
+        const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
+        if (!ca) {
+          throw new NotFoundError({ message: "Certificate Authority not found" });
+        }
+        const caType = (ca.externalCa?.type as CaType) ?? CaType.INTERNAL;
         let errorToReturn: Error | undefined;
         try {
-          const { certificateId } = await certificateV3Service.signCertificateFromProfile({
-            actor: ActorType.ACME_ACCOUNT,
-            actorId: accountId,
-            actorAuthMethod: null,
-            actorOrgId,
-            profileId,
-            csr,
-            notBefore: finalizingOrder.notBefore ? new Date(finalizingOrder.notBefore) : undefined,
-            notAfter: finalizingOrder.notAfter ? new Date(finalizingOrder.notAfter) : undefined,
-            validity: !finalizingOrder.notAfter
-              ? {
-                  // TODO: read config from the profile to get the expiration time instead
-                  ttl: (24 * 60 * 60 * 1000).toString()
-                }
-              : // ttl is not used if notAfter is provided
-                ({ ttl: "0" } as const),
-            enrollmentType: EnrollmentType.ACME
-          });
-          // TODO: associate the certificate with the order
+          const { certificateId } = await (async () => {
+            if (caType === CaType.INTERNAL) {
+              const result = await certificateV3Service.signCertificateFromProfile({
+                actor: ActorType.ACME_ACCOUNT,
+                actorId: accountId,
+                actorAuthMethod: null,
+                actorOrgId,
+                profileId,
+                csr,
+                notBefore: finalizingOrder.notBefore ? new Date(finalizingOrder.notBefore) : undefined,
+                notAfter: finalizingOrder.notAfter ? new Date(finalizingOrder.notAfter) : undefined,
+                validity: !finalizingOrder.notAfter
+                  ? {
+                      // 47 days, the default TTL comes with Let's Encrypt
+                      // TODO: read config from the profile to get the expiration time instead
+                      ttl: `${47}d`
+                    }
+                  : // ttl is not used if notAfter is provided
+                    ({ ttl: "0d" } as const),
+                enrollmentType: EnrollmentType.ACME
+              });
+              return { certificateId: result.certificateId };
+            }
+            const { certificateAuthority } = (await certificateProfileDAL.findByIdWithConfigs(profileId, tx))!;
+            const csrObj = new x509.Pkcs10CertificateRequest(csr);
+            const csrPem = csrObj.toString("pem");
+            // TODO: for internal CA, we rely on the internal certificate authority service to check CSR against the template
+            //       we should check the CSR against the template here
+            // TODO: this is pretty slow, and we are holding the transaction open for a long time,
+            //       we should queue the certificate issuance to a background job instead
+            const cert = await orderCertificate(
+              {
+                caId: certificateAuthority!.id,
+                commonName: certificateRequest.commonName!,
+                altNames: certificateRequest.subjectAlternativeNames?.map((san) => san.value),
+                csr: Buffer.from(csrPem),
+                // TODO: not 100% sure what are these columns for, but let's put the values for common website SSL certs for now
+                keyUsages: [CertKeyUsage.DIGITAL_SIGNATURE, CertKeyUsage.KEY_ENCIPHERMENT, CertKeyUsage.KEY_AGREEMENT],
+                extendedKeyUsages: [CertExtendedKeyUsage.SERVER_AUTH]
+              },
+              {
+                appConnectionDAL,
+                certificateAuthorityDAL,
+                externalCertificateAuthorityDAL,
+                certificateDAL,
+                certificateBodyDAL,
+                certificateSecretDAL,
+                kmsService,
+                projectDAL
+              }
+            );
+            return { certificateId: cert.id };
+          })();
           await acmeOrderDAL.updateById(
             orderId,
             {
@@ -647,9 +780,9 @@ export const pkiAcmeServiceFactory = ({
           logger.error(exp, "Failed to sign certificate");
           // TODO: audit log the error
           if (exp instanceof BadRequestError) {
-            errorToReturn = new AcmeBadCSRError({ detail: `Invalid CSR: ${exp.message}` });
+            errorToReturn = new AcmeBadCSRError({ message: `Invalid CSR: ${exp.message}` });
           } else {
-            errorToReturn = new AcmeServerInternalError({ detail: "Failed to sign certificate with internal error" });
+            errorToReturn = new AcmeServerInternalError({ message: "Failed to sign certificate with internal error" });
           }
         }
         return {

backend/src/ee/services/secret-rotation-v2/ldap-password/ldap-password-rotation-fns.ts

@@ -10,7 +10,7 @@ import {
 import { logger } from "@app/lib/logger";
 import { DistinguishedNameRegex } from "@app/lib/regex";
 import { encryptAppConnectionCredentials } from "@app/services/app-connection/app-connection-fns";
-import { getLdapConnectionClient, LdapProvider, TLdapConnection } from "@app/services/app-connection/ldap";
+import { executeWithPotentialGateway, LdapProvider, TLdapConnection } from "@app/services/app-connection/ldap";
 
 import { generatePassword } from "../shared/utils";
 import {
@@ -71,17 +71,18 @@ export const ldapPasswordRotationFactory: TRotationFactory<
   TLdapPasswordRotationWithConnection,
   TLdapPasswordRotationGeneratedCredentials,
   TLdapPasswordRotationInput["temporaryParameters"]
-> = (secretRotation, appConnectionDAL, kmsService) => {
+> = (secretRotation, appConnectionDAL, kmsService, gatewayService, gatewayV2Service) => {
   const { connection, parameters, secretsMapping, activeIndex } = secretRotation;
 
   const { dn, passwordRequirements } = parameters;
 
   const $verifyCredentials = async (credentials: Pick<TLdapConnection["credentials"], "dn" | "password">) => {
     try {
-      const client = await getLdapConnectionClient({ ...connection.credentials, ...credentials });
-
-      client.unbind();
-      client.destroy();
+      await executeWithPotentialGateway(
+        { ...connection, credentials: { ...connection.credentials, ...credentials } },
+        gatewayV2Service,
+        async () => {}
+      );
     } catch (error) {
       throw new Error(`Failed to verify credentials - ${(error as Error).message}`);
     }
@@ -92,17 +93,7 @@ export const ldapPasswordRotationFactory: TRotationFactory<
 
     if (!credentials.url.startsWith("ldaps")) throw new Error("Password Rotation requires an LDAPS connection");
 
-    const client = await getLdapConnectionClient(
-      currentPassword
-        ? {
-            ...credentials,
-            password: currentPassword,
-            dn
-          }
-        : credentials
-    );
     const isConnectionRotation = credentials.dn === dn;
-
     const password = generatePassword(passwordRequirements);
 
     let changes: ldap.Change[] | ldap.Change;
@@ -147,22 +138,32 @@ export const ldapPasswordRotationFactory: TRotationFactory<
         throw new Error(`Unhandled provider: ${credentials.provider as LdapProvider}`);
     }
 
-    try {
-      const userDn = await getDN(dn, client);
-      await new Promise((resolve, reject) => {
-        client.modify(userDn, changes, (err) => {
-          if (err) {
-            logger.error(err, "LDAP Password Rotation Failed");
-            reject(new Error(`Provider Modify Error: ${err.message}`));
-          } else {
-            resolve(true);
-          }
+    await executeWithPotentialGateway(
+      {
+        ...connection,
+        credentials: currentPassword
+          ? {
+              ...credentials,
+              password: currentPassword,
+              dn
+            }
+          : credentials
+      },
+      gatewayV2Service,
+      async (client) => {
+        const userDn = await getDN(dn, client);
+        await new Promise<void>((resolve, reject) => {
+          client.modify(userDn, changes, (err) => {
+            if (err) {
+              logger.error(err, "LDAP Password Rotation Failed");
+              reject(new Error(`Provider Modify Error: ${err.message}`));
+            } else {
+              resolve();
+            }
+          });
         });
-      });
-    } finally {
-      client.unbind();
-      client.destroy();
-    }
+      }
+    );
 
     await $verifyCredentials({ dn, password });
 

backend/src/ee/services/secret-sync/chef/chef-sync-schemas.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { SecretSyncs } from "@app/lib/api-docs";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
 import {
   BaseSecretSyncSchema,
   GenericCreateSecretSyncFieldsSchema,
@@ -25,10 +26,12 @@ const ChefSyncDestinationConfigSchema = z.object({
 
 const ChefSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
 
-export const ChefSyncSchema = BaseSecretSyncSchema(SecretSync.Chef, ChefSyncOptionsConfig).extend({
-  destination: z.literal(SecretSync.Chef),
-  destinationConfig: ChefSyncDestinationConfigSchema
-});
+export const ChefSyncSchema = BaseSecretSyncSchema(SecretSync.Chef, ChefSyncOptionsConfig)
+  .extend({
+    destination: z.literal(SecretSync.Chef),
+    destinationConfig: ChefSyncDestinationConfigSchema
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.Chef] }));
 
 export const CreateChefSyncSchema = GenericCreateSecretSyncFieldsSchema(SecretSync.Chef, ChefSyncOptionsConfig).extend({
   destinationConfig: ChefSyncDestinationConfigSchema
@@ -38,10 +41,12 @@ export const UpdateChefSyncSchema = GenericUpdateSecretSyncFieldsSchema(SecretSy
   destinationConfig: ChefSyncDestinationConfigSchema.optional()
 });
 
-export const ChefSyncListItemSchema = z.object({
-  name: z.literal("Chef"),
-  connection: z.literal(AppConnection.Chef),
-  destination: z.literal(SecretSync.Chef),
-  canImportSecrets: z.literal(true),
-  enterprise: z.boolean()
-});
+export const ChefSyncListItemSchema = z
+  .object({
+    name: z.literal("Chef"),
+    connection: z.literal(AppConnection.Chef),
+    destination: z.literal(SecretSync.Chef),
+    canImportSecrets: z.literal(true),
+    enterprise: z.boolean()
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.Chef] }));

backend/src/ee/services/secret-sync/oci-vault/oci-vault-sync-schemas.ts

@@ -4,6 +4,7 @@ import { z } from "zod";
 import { SecretSyncs } from "@app/lib/api-docs";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { SecretSync } from "@app/services/secret-sync/secret-sync-enums";
+import { SECRET_SYNC_NAME_MAP } from "@app/services/secret-sync/secret-sync-maps";
 import {
   BaseSecretSyncSchema,
   GenericCreateSecretSyncFieldsSchema,
@@ -43,10 +44,12 @@ const OCIVaultSyncDestinationConfigSchema = z.object({
 
 const OCIVaultSyncOptionsConfig: TSyncOptionsConfig = { canImportSecrets: true };
 
-export const OCIVaultSyncSchema = BaseSecretSyncSchema(SecretSync.OCIVault, OCIVaultSyncOptionsConfig).extend({
-  destination: z.literal(SecretSync.OCIVault),
-  destinationConfig: OCIVaultSyncDestinationConfigSchema
-});
+export const OCIVaultSyncSchema = BaseSecretSyncSchema(SecretSync.OCIVault, OCIVaultSyncOptionsConfig)
+  .extend({
+    destination: z.literal(SecretSync.OCIVault),
+    destinationConfig: OCIVaultSyncDestinationConfigSchema
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.OCIVault] }));
 
 export const CreateOCIVaultSyncSchema = GenericCreateSecretSyncFieldsSchema(
   SecretSync.OCIVault,
@@ -62,10 +65,12 @@ export const UpdateOCIVaultSyncSchema = GenericUpdateSecretSyncFieldsSchema(
   destinationConfig: OCIVaultSyncDestinationConfigSchema.optional()
 });
 
-export const OCIVaultSyncListItemSchema = z.object({
-  name: z.literal("OCI Vault"),
-  connection: z.literal(AppConnection.OCI),
-  destination: z.literal(SecretSync.OCIVault),
-  canImportSecrets: z.literal(true),
-  enterprise: z.boolean()
-});
+export const OCIVaultSyncListItemSchema = z
+  .object({
+    name: z.literal("OCI Vault"),
+    connection: z.literal(AppConnection.OCI),
+    destination: z.literal(SecretSync.OCIVault),
+    canImportSecrets: z.literal(true),
+    enterprise: z.boolean()
+  })
+  .describe(JSON.stringify({ title: SECRET_SYNC_NAME_MAP[SecretSync.OCIVault] }));