Complete preliminary docs for pki subscribers

backend/src/db/migrations/20250504145538_pki-v2.ts

@@ -18,13 +18,29 @@ export async function up(knex: Knex): Promise<void> {
       t.string("ttl").notNullable();
       t.specificType("keyUsages", "text[]").notNullable();
       t.specificType("extendedKeyUsages", "text[]").notNullable();
+      t.string("status").notNullable(); // active / disabled
       t.unique(["projectId", "name"]);
     });
     await createOnUpdateTrigger(knex, TableName.PkiSubscriber);
   }
+
+  const hasSubscriberCol = await knex.schema.hasColumn(TableName.Certificate, "pkiSubscriberId");
+  if (!hasSubscriberCol) {
+    await knex.schema.alterTable(TableName.Certificate, (t) => {
+      t.uuid("pkiSubscriberId").nullable();
+      t.foreign("pkiSubscriberId").references("id").inTable(TableName.PkiSubscriber).onDelete("SET NULL");
+    });
+  }
 }
 
 export async function down(knex: Knex): Promise<void> {
+  const hasSubscriberCol = await knex.schema.hasColumn(TableName.Certificate, "pkiSubscriberId");
+  if (hasSubscriberCol) {
+    await knex.schema.alterTable(TableName.Certificate, (t) => {
+      t.dropColumn("pkiSubscriberId");
+    });
+  }
+
   await knex.schema.dropTableIfExists(TableName.PkiSubscriber);
   await dropOnUpdateTrigger(knex, TableName.PkiSubscriber);
 }

backend/src/db/schemas/certificates.ts

@@ -24,7 +24,8 @@ export const CertificatesSchema = z.object({
   caCertId: z.string().uuid(),
   certificateTemplateId: z.string().uuid().nullable().optional(),
   keyUsages: z.string().array().nullable().optional(),
-  extendedKeyUsages: z.string().array().nullable().optional()
+  extendedKeyUsages: z.string().array().nullable().optional(),
+  pkiSubscriberId: z.string().uuid().nullable().optional()
 });
 
 export type TCertificates = z.infer<typeof CertificatesSchema>;

backend/src/db/schemas/pki-subscribers.ts

@@ -18,7 +18,8 @@ export const PkiSubscribersSchema = z.object({
   subjectAlternativeNames: z.string().array(),
   ttl: z.string(),
   keyUsages: z.string().array(),
-  extendedKeyUsages: z.string().array()
+  extendedKeyUsages: z.string().array(),
+  status: z.string()
 });
 
 export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

backend/src/ee/services/audit-log/audit-log-types.ts

@@ -19,8 +19,7 @@ import { TProjectPermission } from "@app/lib/types";
 import { AppConnection } from "@app/services/app-connection/app-connection-enums";
 import { TCreateAppConnectionDTO, TUpdateAppConnectionDTO } from "@app/services/app-connection/app-connection-types";
 import { ActorType } from "@app/services/auth/auth-type";
-import { CertKeyAlgorithm } from "@app/services/certificate/certificate-types";
-import { CertExtendedKeyUsage, CertKeyUsage } from "@app/services/certificate/certificate-types";
+import { CertExtendedKeyUsage, CertKeyAlgorithm, CertKeyUsage } from "@app/services/certificate/certificate-types";
 import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { TIdentityTrustedIp } from "@app/services/identity/identity-types";
 import { PkiItemType } from "@app/services/pki-collection/pki-collection-types";
@@ -244,6 +243,7 @@ export enum EventType {
   GET_PKI_SUBSCRIBER = "get-pki-subscriber",
   ISSUE_PKI_SUBSCRIBER_CERT = "issue-pki-subscriber-cert",
   SIGN_PKI_SUBSCRIBER_CERT = "sign-pki-subscriber-cert",
+  LIST_PKI_SUBSCRIBER_CERTS = "list-pki-subscriber-certs",
   CREATE_KMS = "create-kms",
   UPDATE_KMS = "update-kms",
   DELETE_KMS = "delete-kms",
@@ -1938,6 +1938,7 @@ interface DeletePkiSubscriber {
   type: EventType.DELETE_PKI_SUBSCRIBER;
   metadata: {
     pkiSubscriberId: string;
+    name: string;
   };
 }
 
@@ -1945,6 +1946,7 @@ interface GetPkiSubscriber {
   type: EventType.GET_PKI_SUBSCRIBER;
   metadata: {
     pkiSubscriberId: string;
+    name: string;
   };
 }
 
@@ -1952,6 +1954,7 @@ interface IssuePkiSubscriberCert {
   type: EventType.ISSUE_PKI_SUBSCRIBER_CERT;
   metadata: {
     subscriberId: string;
+    name: string;
     serialNumber: string;
   };
 }
@@ -1960,10 +1963,20 @@ interface SignPkiSubscriberCert {
   type: EventType.SIGN_PKI_SUBSCRIBER_CERT;
   metadata: {
     subscriberId: string;
+    name: string;
     serialNumber: string;
   };
 }
 
+interface ListPkiSubscriberCerts {
+  type: EventType.LIST_PKI_SUBSCRIBER_CERTS;
+  metadata: {
+    subscriberId: string;
+    name: string;
+    projectId: string;
+  };
+}
+
 interface CreateKmsEvent {
   type: EventType.CREATE_KMS;
   metadata: {
@@ -2928,6 +2941,7 @@ export type Event =
   | GetPkiSubscriber
   | IssuePkiSubscriberCert
   | SignPkiSubscriberCert
+  | ListPkiSubscriberCerts
   | CreateKmsEvent
   | UpdateKmsEvent
   | DeleteKmsEvent

backend/src/ee/services/license/license-fns.ts

@@ -54,7 +54,7 @@ export const getDefaultOnPremFeatures = (): TFeatureSet => ({
   projectTemplates: false,
   kmip: false,
   gateway: false,
-  sshHostGroups: true
+  sshHostGroups: false
 });
 
 export const setupLicenseRequestWithStore = (baseURL: string, refreshUrl: string, licenseKey: string) => {

backend/src/ee/services/permission/project-permission.ts

@@ -93,7 +93,7 @@ export enum ProjectPermissionPkiSubscriberActions {
   Edit = "edit",
   Delete = "delete",
   IssueCert = "issue-cert",
-  SignCert = "sign-cert"
+  ListCerts = "list-certs"
 }
 
 export enum ProjectPermissionSecretSyncActions {
@@ -200,6 +200,11 @@ export type SshHostSubjectFields = {
   hostname: string;
 };
 
+export type PkiSubscriberSubjectFields = {
+  name: string;
+  // (dangtony98): consider adding [commonName] as a subject field in the future
+};
+
 export type ProjectPermissionSet =
   | [
       ProjectPermissionSecretActions,
@@ -259,7 +264,13 @@ export type ProjectPermissionSet =
       ProjectPermissionSshHostActions,
       ProjectPermissionSub.SshHosts | (ForcedSubject<ProjectPermissionSub.SshHosts> & SshHostSubjectFields)
     ]
-  | [ProjectPermissionPkiSubscriberActions, ProjectPermissionSub.PkiSubscribers] // (dangtony98): TODO: update
+  | [
+      ProjectPermissionPkiSubscriberActions,
+      (
+        | ProjectPermissionSub.PkiSubscribers
+        | (ForcedSubject<ProjectPermissionSub.PkiSubscribers> & PkiSubscriberSubjectFields)
+      )
+    ]
   | [ProjectPermissionActions, ProjectPermissionSub.SshHostGroups]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiAlerts]
   | [ProjectPermissionActions, ProjectPermissionSub.PkiCollections]
@@ -410,6 +421,21 @@ const SshHostConditionSchema = z
   })
   .partial();
 
+const PkiSubscriberConditionSchema = z
+  .object({
+    name: z.union([
+      z.string(),
+      z
+        .object({
+          [PermissionConditionOperators.$EQ]: PermissionConditionSchema[PermissionConditionOperators.$EQ],
+          [PermissionConditionOperators.$GLOB]: PermissionConditionSchema[PermissionConditionOperators.$GLOB],
+          [PermissionConditionOperators.$IN]: PermissionConditionSchema[PermissionConditionOperators.$IN]
+        })
+        .partial()
+    ])
+  })
+  .partial();
+
 const GeneralPermissionSchema = [
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretApproval).describe("The entity this permission pertains to."),
@@ -674,6 +700,16 @@ export const ProjectPermissionV2Schema = z.discriminatedUnion("subject", [
       "When specified, only matching conditions will be allowed to access given resource."
     ).optional()
   }),
+  z.object({
+    subject: z.literal(ProjectPermissionSub.PkiSubscribers).describe("The entity this permission pertains to."),
+    action: CASL_ACTION_SCHEMA_NATIVE_ENUM(ProjectPermissionPkiSubscriberActions).describe(
+      "Describe what action an entity can take."
+    ),
+    inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
+    conditions: PkiSubscriberConditionSchema.describe(
+      "When specified, only matching conditions will be allowed to access given resource."
+    ).optional()
+  }),
   z.object({
     subject: z.literal(ProjectPermissionSub.SecretRotation).describe("The entity this permission pertains to."),
     inverted: z.boolean().optional().describe("Whether rule allows or forbids."),
@@ -754,7 +790,8 @@ const buildAdminPermissionRules = () => {
       ProjectPermissionPkiSubscriberActions.Create,
       ProjectPermissionPkiSubscriberActions.Edit,
       ProjectPermissionPkiSubscriberActions.Delete,
-      ProjectPermissionPkiSubscriberActions.IssueCert
+      ProjectPermissionPkiSubscriberActions.IssueCert,
+      ProjectPermissionPkiSubscriberActions.ListCerts
     ],
     ProjectPermissionSub.PkiSubscribers
   );

backend/src/ee/services/ssh-host-group/ssh-host-group-service.ts

@@ -179,7 +179,7 @@ export const sshHostGroupServiceFactory = ({
       });
 
     const updatedSshHostGroup = await sshHostGroupDAL.transaction(async (tx) => {
-      if (name) {
+      if (name && name !== sshHostGroup.name) {
         // (dangtony98): room to optimize check to ensure that
         // the SSH host group name is unique across the whole org
         const project = await projectDAL.findById(sshHostGroup.projectId, tx);
@@ -214,6 +214,7 @@ export const sshHostGroupServiceFactory = ({
           tx
         );
       }
+
       if (loginMappings) {
         await sshHostLoginUserDAL.delete({ sshHostGroupId: sshHostGroup.id }, tx);
         if (loginMappings.length) {

backend/src/ee/services/ssh-host/ssh-host-schema.ts

@@ -16,6 +16,8 @@ export const sanitizedSshHost = SshHostsSchema.pick({
 export const loginMappingSchema = z.object({
   loginUser: z.string().trim(),
   allowedPrincipals: z.object({
-    usernames: z.array(z.string().trim()).transform((usernames) => Array.from(new Set(usernames)))
+    usernames: z
+      .array(z.string().trim())
+      .transform((usernames) => Array.from(new Set(usernames.filter((username) => username !== ""))))
   })
 });

backend/src/lib/api-docs/constants.ts

@@ -1693,13 +1693,15 @@ export const ALERTS = {
 
 export const PKI_SUBSCRIBERS = {
   GET: {
-    subscriberId: "The ID of the PKI subscriber to get."
+    subscriberName: "The name of the PKI subscriber to get.",
+    projectId: "The ID of the project to get the PKI subscriber for."
   },
   CREATE: {
     projectId: "The ID of the project to create the PKI subscriber in.",
     caId: "The ID of the CA that will issue certificates for the PKI subscriber.",
     name: "The name of the PKI subscriber.",
     commonName: "The common name (CN) to be used on certificates issued for this subscriber.",
+    status: "The status of the PKI subscriber. This can be one of active or disabled.",
     ttl: "The time to live for the certificates issued for this subscriber such as 1m, 1h, 1d, 1y, ...",
     subjectAlternativeNames:
       "A list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
@@ -1707,10 +1709,12 @@ export const PKI_SUBSCRIBERS = {
     extendedKeyUsages: "The extended key usage extension to be used on certificates issued for this subscriber."
   },
   UPDATE: {
-    subscriberId: "The ID of the PKI subscriber to update.",
+    projectId: "The ID of the project to update the PKI subscriber in.",
+    subscriberName: "The name of the PKI subscriber to update.",
     caId: "The ID of the CA that will issue certificates for the PKI subscriber to update to.",
     name: "The name of the PKI subscriber to update to.",
     commonName: "The common name (CN) to be used on certificates issued for this subscriber to update to.",
+    status: "The status of the PKI subscriber to update to. This can be one of active or disabled.",
     ttl: "The time to live for the certificates issued for this subscriber such as 1m, 1h, 1d, 1y, ...",
     subjectAlternativeNames:
       "A comma-delimited list of Subject Alternative Names (SANs) to be used on certificates issued for this subscriber; these can be host names or email addresses.",
@@ -1719,15 +1723,23 @@ export const PKI_SUBSCRIBERS = {
       "The extended key usage extension to be used on certificates issued for this subscriber to update to."
   },
   DELETE: {
-    subscriberId: "The ID of the PKI subscriber to delete."
+    subscriberName: "The name of the PKI subscriber to delete.",
+    projectId: "The ID of the project of the PKI subscriber to delete."
   },
   ISSUE_CERT: {
-    subscriberId: "The ID of the PKI subscriber to issue the certificate for.",
+    subscriberName: "The name of the PKI subscriber to issue the certificate for.",
+    projectId: "The ID of the project of the PKI subscriber to issue the certificate for.",
     certificate: "The issued certificate.",
     issuingCaCertificate: "The certificate of the issuing CA.",
     certificateChain: "The certificate chain of the issued certificate.",
     privateKey: "The private key of the issued certificate.",
     serialNumber: "The serial number of the issued certificate."
+  },
+  LIST_CERTS: {
+    subscriberName: "The name of the PKI subscriber to list the certificates for.",
+    projectId: "The ID of the project of the PKI subscriber to list the certificates for.",
+    offset: "The offset to start from.",
+    limit: "The number of certificates to return."
   }
 };
 

backend/src/server/routes/v1/pki-subscriber-router.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 
+import { CertificatesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags, PKI_SUBSCRIBERS } from "@app/lib/api-docs";
 import { ms } from "@app/lib/ms";
@@ -11,12 +12,13 @@ import { AuthMode } from "@app/services/auth/auth-type";
 import { CertExtendedKeyUsage, CertKeyUsage } from "@app/services/certificate/certificate-types";
 import { validateAltNameField } from "@app/services/certificate-authority/certificate-authority-validators";
 import { sanitizedPkiSubscriber } from "@app/services/pki-subscriber/pki-subscriber-schema";
+import { PkiSubscriberStatus } from "@app/services/pki-subscriber/pki-subscriber-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
 export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) => {
   server.route({
     method: "GET",
-    url: "/:subscriberId",
+    url: "/:subscriberName",
     config: {
       rateLimit: readLimit
     },
@@ -25,7 +27,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       tags: [ApiDocsTags.PkiSubscribers],
       description: "Get PKI Subscriber",
       params: z.object({
-        subscriberId: z.string().describe(PKI_SUBSCRIBERS.GET.subscriberId)
+        subscriberName: z.string().describe(PKI_SUBSCRIBERS.GET.subscriberName)
+      }),
+      querystring: z.object({
+        projectId: z.string().describe(PKI_SUBSCRIBERS.GET.projectId)
       }),
       response: {
         200: sanitizedPkiSubscriber
@@ -33,8 +38,9 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
-      const subscriber = await server.services.pkiSubscriber.getSubscriberById({
-        subscriberId: req.params.subscriberId,
+      const subscriber = await server.services.pkiSubscriber.getSubscriber({
+        subscriberName: req.params.subscriberName,
+        projectId: req.query.projectId,
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -47,7 +53,8 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
         event: {
           type: EventType.GET_PKI_SUBSCRIBER,
           metadata: {
-            pkiSubscriberId: subscriber.id
+            pkiSubscriberId: subscriber.id,
+            name: subscriber.name
           }
         }
       });
@@ -76,6 +83,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
           .describe(PKI_SUBSCRIBERS.CREATE.caId),
         name: slugSchema({ min: 1, max: 64, field: "name" }).describe(PKI_SUBSCRIBERS.CREATE.name),
         commonName: z.string().trim().min(1).describe(PKI_SUBSCRIBERS.CREATE.commonName),
+        status: z
+          .nativeEnum(PkiSubscriberStatus)
+          .default(PkiSubscriberStatus.ACTIVE)
+          .describe(PKI_SUBSCRIBERS.CREATE.status),
         ttl: z
           .string()
           .trim()
@@ -137,7 +148,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
   server.route({
     method: "PATCH",
-    url: "/:subscriberId",
+    url: "/:subscriberName",
     config: {
       rateLimit: writeLimit
     },
@@ -147,9 +158,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       tags: [ApiDocsTags.PkiSubscribers],
       description: "Update PKI Subscriber",
       params: z.object({
-        subscriberId: z.string().trim().describe(PKI_SUBSCRIBERS.UPDATE.subscriberId)
+        subscriberName: z.string().trim().describe(PKI_SUBSCRIBERS.UPDATE.subscriberName)
       }),
       body: z.object({
+        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.UPDATE.projectId),
         caId: z
           .string()
           .trim()
@@ -159,6 +171,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
           .describe(PKI_SUBSCRIBERS.UPDATE.caId),
         name: slugSchema({ min: 1, max: 64, field: "name" }).describe(PKI_SUBSCRIBERS.UPDATE.name).optional(),
         commonName: z.string().trim().min(1).describe(PKI_SUBSCRIBERS.UPDATE.commonName).optional(),
+        status: z.nativeEnum(PkiSubscriberStatus).optional().describe(PKI_SUBSCRIBERS.UPDATE.status),
         subjectAlternativeNames: validateAltNameField
           .array()
           .optional()
@@ -188,7 +201,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     },
     handler: async (req) => {
       const subscriber = await server.services.pkiSubscriber.updateSubscriber({
-        subscriberId: req.params.subscriberId,
+        subscriberName: req.params.subscriberName,
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -220,7 +233,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
   server.route({
     method: "DELETE",
-    url: "/:subscriberId",
+    url: "/:subscriberName",
     config: {
       rateLimit: writeLimit
     },
@@ -229,7 +242,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       tags: [ApiDocsTags.PkiSubscribers],
       description: "Delete PKI Subscriber",
       params: z.object({
-        subscriberId: z.string().describe(PKI_SUBSCRIBERS.DELETE.subscriberId)
+        subscriberName: z.string().describe(PKI_SUBSCRIBERS.DELETE.subscriberName)
+      }),
+      body: z.object({
+        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.DELETE.projectId)
       }),
       response: {
         200: sanitizedPkiSubscriber
@@ -238,7 +254,8 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const subscriber = await server.services.pkiSubscriber.deleteSubscriber({
-        subscriberId: req.params.subscriberId,
+        subscriberName: req.params.subscriberName,
+        projectId: req.body.projectId,
         actor: req.permission.type,
         actorId: req.permission.id,
         actorAuthMethod: req.permission.authMethod,
@@ -251,7 +268,8 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
         event: {
           type: EventType.DELETE_PKI_SUBSCRIBER,
           metadata: {
-            pkiSubscriberId: subscriber.id
+            pkiSubscriberId: subscriber.id,
+            name: subscriber.name
           }
         }
       });
@@ -262,7 +280,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
   server.route({
     method: "POST",
-    url: "/:subscriberId/issue-certificate",
+    url: "/:subscriberName/issue-certificate",
     config: {
       rateLimit: writeLimit
     },
@@ -272,7 +290,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       tags: [ApiDocsTags.PkiSubscribers],
       description: "Issue certificate",
       params: z.object({
-        subscriberId: z.string().describe(PKI_SUBSCRIBERS.ISSUE_CERT.subscriberId)
+        subscriberName: z.string().describe(PKI_SUBSCRIBERS.ISSUE_CERT.subscriberName)
+      }),
+      body: z.object({
+        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.ISSUE_CERT.projectId)
       }),
       response: {
         200: z.object({
@@ -287,7 +308,8 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, privateKey, serialNumber, subscriber } =
         await server.services.pkiSubscriber.issueSubscriberCert({
-          subscriberId: req.params.subscriberId,
+          subscriberName: req.params.subscriberName,
+          projectId: req.body.projectId,
           actor: req.permission.type,
           actorId: req.permission.id,
           actorAuthMethod: req.permission.authMethod,
@@ -296,11 +318,12 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        orgId: req.permission.orgId,
+        projectId: subscriber.projectId,
         event: {
           type: EventType.ISSUE_PKI_SUBSCRIBER_CERT,
           metadata: {
             subscriberId: subscriber.id,
+            name: subscriber.name,
             serialNumber
           }
         }
@@ -328,7 +351,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
   server.route({
     method: "POST",
-    url: "/:subscriberId/sign-certificate",
+    url: "/:subscriberName/sign-certificate",
     config: {
       rateLimit: writeLimit
     },
@@ -338,9 +361,10 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       tags: [ApiDocsTags.PkiSubscribers],
       description: "Sign certificate",
       params: z.object({
-        subscriberId: z.string().describe(PKI_SUBSCRIBERS.ISSUE_CERT.subscriberId)
+        subscriberName: z.string().describe(PKI_SUBSCRIBERS.ISSUE_CERT.subscriberName)
       }),
       body: z.object({
+        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.ISSUE_CERT.projectId),
         csr: z.string().trim().min(1)
       }),
       response: {
@@ -355,7 +379,8 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
     handler: async (req) => {
       const { certificate, certificateChain, issuingCaCertificate, serialNumber, subscriber } =
         await server.services.pkiSubscriber.signSubscriberCert({
-          subscriberId: req.params.subscriberId,
+          subscriberName: req.params.subscriberName,
+          projectId: req.body.projectId,
           csr: req.body.csr,
           actor: req.permission.type,
           actorId: req.permission.id,
@@ -365,11 +390,12 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
 
       await server.services.auditLog.createAuditLog({
         ...req.auditLogInfo,
-        orgId: req.permission.orgId,
+        projectId: subscriber.projectId,
         event: {
           type: EventType.SIGN_PKI_SUBSCRIBER_CERT,
           metadata: {
             subscriberId: subscriber.id,
+            name: subscriber.name,
             serialNumber
           }
         }
@@ -393,4 +419,60 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
       };
     }
   });
+
+  server.route({
+    method: "GET",
+    url: "/:subscriberName/certificates",
+    config: {
+      rateLimit: readLimit
+    },
+    schema: {
+      hide: false,
+      tags: [ApiDocsTags.PkiSubscribers],
+      description: "List PKI Subscriber certificates",
+      params: z.object({
+        subscriberName: z.string().describe(PKI_SUBSCRIBERS.GET.subscriberName)
+      }),
+      querystring: z.object({
+        projectId: z.string().trim().describe(PKI_SUBSCRIBERS.LIST_CERTS.projectId),
+        offset: z.coerce.number().min(0).max(100).default(0).describe(PKI_SUBSCRIBERS.LIST_CERTS.offset),
+        limit: z.coerce.number().min(1).max(100).default(25).describe(PKI_SUBSCRIBERS.LIST_CERTS.limit)
+      }),
+      response: {
+        200: z.object({
+          certificates: z.array(CertificatesSchema),
+          totalCount: z.number()
+        })
+      }
+    },
+    onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
+    handler: async (req) => {
+      const { totalCount, certificates } = await server.services.pkiSubscriber.listSubscriberCerts({
+        subscriberName: req.params.subscriberName,
+        actor: req.permission.type,
+        actorId: req.permission.id,
+        actorAuthMethod: req.permission.authMethod,
+        actorOrgId: req.permission.orgId,
+        ...req.query
+      });
+
+      await server.services.auditLog.createAuditLog({
+        ...req.auditLogInfo,
+        projectId: req.query.projectId,
+        event: {
+          type: EventType.LIST_PKI_SUBSCRIBER_CERTS,
+          metadata: {
+            subscriberId: req.params.subscriberName,
+            name: req.params.subscriberName,
+            projectId: req.query.projectId
+          }
+        }
+      });
+
+      return {
+        certificates,
+        totalCount
+      };
+    }
+  });
 };

backend/src/server/routes/v2/project-router.ts

@@ -16,7 +16,6 @@ import { sanitizedSshCertificateTemplate } from "@app/ee/services/ssh-certificat
 import { loginMappingSchema, sanitizedSshHost } from "@app/ee/services/ssh-host/ssh-host-schema";
 import { LoginMappingSource } from "@app/ee/services/ssh-host/ssh-host-types";
 import { sanitizedSshHostGroup } from "@app/ee/services/ssh-host-group/ssh-host-group-schema";
-import { sanitizedPkiSubscriber } from "@app/services/pki-subscriber/pki-subscriber-schema";
 import { ApiDocsTags, PROJECTS } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { slugSchema } from "@app/server/lib/schemas";
@@ -25,6 +24,7 @@ import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 import { CaStatus } from "@app/services/certificate-authority/certificate-authority-types";
 import { sanitizedCertificateTemplate } from "@app/services/certificate-template/certificate-template-schema";
+import { sanitizedPkiSubscriber } from "@app/services/pki-subscriber/pki-subscriber-schema";
 import { ProjectFilterType } from "@app/services/project/project-types";
 import { PostHogEventTypes } from "@app/services/telemetry/telemetry-types";
 
@@ -657,6 +657,8 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       rateLimit: readLimit
     },
     schema: {
+      hide: false,
+      tags: [ApiDocsTags.SshHosts],
       params: z.object({
         projectId: z.string().trim().describe(PROJECTS.LIST_SSH_HOSTS.projectId)
       }),
@@ -695,6 +697,8 @@ export const registerProjectRouter = async (server: FastifyZodProvider) => {
       rateLimit: readLimit
     },
     schema: {
+      hide: false,
+      tags: [ApiDocsTags.SshHostGroups],
       params: z.object({
         projectId: z.string().trim().describe(PROJECTS.LIST_SSH_HOST_GROUPS.projectId)
       }),

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -1169,7 +1169,7 @@ export const certificateAuthorityServiceFactory = ({
       ProjectPermissionSub.Certificates
     );
 
-    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
     if (ca.requireTemplateForIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template is required for issuance" });
@@ -1520,7 +1520,7 @@ export const certificateAuthorityServiceFactory = ({
       );
     }
 
-    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
     if (ca.requireTemplateForIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template is required for issuance" });

backend/src/services/certificate/certificate-dal.ts

@@ -44,8 +44,27 @@ export const certificateDALFactory = (db: TDbClient) => {
     }
   };
 
+  const countCertificatesForPkiSubscriber = async (subscriberId: string) => {
+    try {
+      interface CountResult {
+        count: string;
+      }
+
+      const query = db
+        .replicaNode()(TableName.Certificate)
+        .where(`${TableName.Certificate}.pkiSubscriberId`, subscriberId);
+
+      const count = await query.count("*").first();
+
+      return parseInt((count as unknown as CountResult).count || "0", 10);
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Count all subscriber certificates" });
+    }
+  };
+
   return {
     ...certificateOrm,
-    countCertificatesInProject
+    countCertificatesInProject,
+    countCertificatesForPkiSubscriber
   };
 };

backend/src/services/pki-subscriber/pki-subscriber-dal.ts

@@ -6,8 +6,5 @@ export type TPkiSubscriberDALFactory = ReturnType<typeof pkiSubscriberDALFactory
 
 export const pkiSubscriberDALFactory = (db: TDbClient) => {
   const pkiSubscriberOrm = ormify(db, TableName.PkiSubscriber);
-
-  return {
-    ...pkiSubscriberOrm
-  };
+  return pkiSubscriberOrm;
 };

backend/src/services/pki-subscriber/pki-subscriber-schema.ts

@@ -6,6 +6,7 @@ export const sanitizedPkiSubscriber = PkiSubscribersSchema.pick({
   caId: true,
   name: true,
   commonName: true,
+  status: true,
   subjectAlternativeNames: true,
   ttl: true,
   keyUsages: true,

backend/src/services/pki-subscriber/pki-subscriber-service.ts

@@ -1,5 +1,5 @@
 /* eslint-disable no-bitwise */
-import { ForbiddenError } from "@casl/ability";
+import { ForbiddenError, subject } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
 import crypto, { KeyObject } from "crypto";
 
@@ -40,10 +40,12 @@ import { TProjectDALFactory } from "@app/services/project/project-dal";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
 import {
+  PkiSubscriberStatus,
   TCreatePkiSubscriberDTO,
   TDeletePkiSubscriberDTO,
-  TGetPkiSubscriberByIdDTO,
+  TGetPkiSubscriberDTO,
   TIssuePkiSubscriberCertDTO,
+  TListPkiSubscriberCertsDTO,
   TSignPkiSubscriberCertDTO,
   TUpdatePkiSubscriberDTO
 } from "./pki-subscriber-types";
@@ -51,13 +53,13 @@ import {
 type TPkiSubscriberServiceFactoryDep = {
   pkiSubscriberDAL: Pick<
     TPkiSubscriberDALFactory,
-    "create" | "findById" | "updateById" | "deleteById" | "transaction" | "find"
+    "create" | "findById" | "updateById" | "deleteById" | "transaction" | "find" | "findOne"
   >;
   certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findById">;
   certificateAuthorityCertDAL: Pick<TCertificateAuthorityCertDALFactory, "findById">;
   certificateAuthoritySecretDAL: Pick<TCertificateAuthoritySecretDALFactory, "findOne">;
   certificateAuthorityCrlDAL: Pick<TCertificateAuthorityCrlDALFactory, "findOne">;
-  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction">;
+  certificateDAL: Pick<TCertificateDALFactory, "create" | "transaction" | "countCertificatesForPkiSubscriber" | "find">;
   certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
   certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
   projectDAL: Pick<TProjectDALFactory, "findOne" | "updateById" | "transaction" | "findById" | "find">;
@@ -83,6 +85,7 @@ export const pkiSubscriberServiceFactory = ({
   const createSubscriber = async ({
     name,
     commonName,
+    status,
     caId,
     ttl,
     subjectAlternativeNames,
@@ -103,69 +106,42 @@ export const pkiSubscriberServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    // (dangtony98): TODO: make permission more granular
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPkiSubscriberActions.Read,
-      ProjectPermissionSub.PkiSubscribers
+      ProjectPermissionPkiSubscriberActions.Create,
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name
+      })
     );
 
-    const newSubscriber = await pkiSubscriberDAL.transaction(async (tx) => {
-      // (dangtony98): room to optimize check to ensure that
-      // the PKI subscriber name is unique across the whole org
-      const project = await projectDAL.findById(projectId, tx);
-      if (!project) throw new NotFoundError({ message: `Project with ID '${projectId}' not found` });
-      const projects = await projectDAL.find(
-        {
-          orgId: project.orgId
-        },
-        { tx }
-      );
-
-      const existingPkiSubscriber = await pkiSubscriberDAL.find(
-        {
-          name,
-          $in: {
-            projectId: projects.map((p) => p.id)
-          }
-        },
-        { tx }
-      );
-
-      if (existingPkiSubscriber.length) {
-        throw new BadRequestError({
-          message: `PKI subscriber with name '${name}' already exists in the organization`
-        });
-      }
-
-      const subscriber = await pkiSubscriberDAL.create(
-        {
-          caId,
-          projectId,
-          name,
-          commonName,
-          ttl,
-          subjectAlternativeNames,
-          keyUsages,
-          extendedKeyUsages
-        },
-        tx
-      );
-
-      return subscriber;
+    const newSubscriber = await pkiSubscriberDAL.create({
+      caId,
+      projectId,
+      name,
+      commonName,
+      status,
+      ttl,
+      subjectAlternativeNames,
+      keyUsages,
+      extendedKeyUsages
     });
 
     return newSubscriber;
   };
 
-  const getSubscriberById = async ({
-    subscriberId,
+  const getSubscriber = async ({
+    subscriberName,
+    projectId,
     actorId,
     actorAuthMethod,
     actor,
     actorOrgId
-  }: TGetPkiSubscriberByIdDTO) => {
-    const subscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber with ID '${subscriberId}' not found` });
+  }: TGetPkiSubscriberDTO) => {
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
+    });
+
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -176,19 +152,22 @@ export const pkiSubscriberServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    // (dangtony98): TODO: make permission more granular
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPkiSubscriberActions.Read,
-      ProjectPermissionSub.PkiSubscribers
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
     );
 
     return subscriber;
   };
 
   const updateSubscriber = async ({
-    subscriberId,
+    subscriberName,
+    projectId,
     name,
     commonName,
+    status,
     caId,
     ttl,
     subjectAlternativeNames,
@@ -199,83 +178,11 @@ export const pkiSubscriberServiceFactory = ({
     actor,
     actorOrgId
   }: TUpdatePkiSubscriberDTO) => {
-    const foundSubscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!foundSubscriber) throw new NotFoundError({ message: `PKI subscriber with ID '${subscriberId}' not found` });
-
-    const { permission } = await permissionService.getProjectPermission({
-      actor,
-      actorId,
-      projectId: foundSubscriber.projectId,
-      actorAuthMethod,
-      actorOrgId,
-      actionProjectType: ActionProjectType.CertificateManager
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
     });
-
-    // (dangtony98): TODO: make permission more granular
-    ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPkiSubscriberActions.Edit,
-      ProjectPermissionSub.PkiSubscribers
-    );
-
-    const updatedSubscriber = await pkiSubscriberDAL.transaction(async (tx) => {
-      if (name) {
-        // (dangtony98): room to optimize check to ensure that
-        // the PKI subscriber name is unique across the whole org
-        const project = await projectDAL.findById(foundSubscriber.projectId, tx);
-        if (!project) throw new NotFoundError({ message: `Project with ID '${foundSubscriber.projectId}' not found` });
-        const projects = await projectDAL.find(
-          {
-            orgId: project.orgId
-          },
-          { tx }
-        );
-
-        const existingPkiSubscriber = await pkiSubscriberDAL.find(
-          {
-            name,
-            $in: {
-              projectId: projects.map((p) => p.id)
-            }
-          },
-          { tx }
-        );
-
-        if (existingPkiSubscriber.length) {
-          throw new BadRequestError({
-            message: `PKI subscriber with name '${name}' already exists in the organization`
-          });
-        }
-      }
-
-      const subscriber = await pkiSubscriberDAL.updateById(
-        subscriberId,
-        {
-          caId,
-          name,
-          commonName,
-          ttl,
-          subjectAlternativeNames,
-          keyUsages,
-          extendedKeyUsages
-        },
-        tx
-      );
-
-      return subscriber;
-    });
-
-    return updatedSubscriber;
-  };
-
-  const deleteSubscriber = async ({
-    subscriberId,
-    actorId,
-    actorAuthMethod,
-    actor,
-    actorOrgId
-  }: TDeletePkiSubscriberDTO) => {
-    const subscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber with ID '${subscriberId}' not found` });
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
 
     const { permission } = await permissionService.getProjectPermission({
       actor,
@@ -286,26 +193,76 @@ export const pkiSubscriberServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    // (dangtony98): TODO: make permission more granular
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPkiSubscriberActions.Delete,
-      ProjectPermissionSub.PkiSubscribers
+      ProjectPermissionPkiSubscriberActions.Edit,
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
     );
 
-    await pkiSubscriberDAL.deleteById(subscriberId);
+    const updatedSubscriber = await pkiSubscriberDAL.updateById(subscriber.id, {
+      caId,
+      name,
+      commonName,
+      status,
+      ttl,
+      subjectAlternativeNames,
+      keyUsages,
+      extendedKeyUsages
+    });
+
+    return updatedSubscriber;
+  };
+
+  const deleteSubscriber = async ({
+    subscriberName,
+    projectId,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId
+  }: TDeletePkiSubscriberDTO) => {
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
+    });
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: subscriber.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiSubscriberActions.Delete,
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
+    );
+
+    await pkiSubscriberDAL.deleteById(subscriber.id);
 
     return subscriber;
   };
 
   const issueSubscriberCert = async ({
-    subscriberId,
+    subscriberName,
+    projectId,
     actorId,
     actorAuthMethod,
     actor,
     actorOrgId
   }: TIssuePkiSubscriberCertDTO) => {
-    const subscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber with ID '${subscriberId}' not found` });
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
+    });
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
+
     const ca = await certificateAuthorityDAL.findById(subscriber.caId);
     if (!ca) throw new NotFoundError({ message: `CA with ID '${subscriber.caId}' not found` });
 
@@ -318,13 +275,16 @@ export const pkiSubscriberServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    // (dangtony98): TODO: make permission more granular
     ForbiddenError.from(permission).throwUnlessCan(
       ProjectPermissionPkiSubscriberActions.IssueCert,
-      ProjectPermissionSub.PkiSubscribers
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
     );
 
-    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (subscriber.status !== PkiSubscriberStatus.ACTIVE)
+      throw new BadRequestError({ message: "Subscriber is not active" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
     if (ca.requireTemplateForIssuance) {
       throw new BadRequestError({ message: "Certificate template is required for issuance" });
@@ -452,6 +412,7 @@ export const pkiSubscriberServiceFactory = ({
         {
           caId: ca.id,
           caCertId: caCert.id,
+          pkiSubscriberId: subscriber.id,
           status: CertStatus.ACTIVE,
           friendlyName: subscriber.commonName,
           commonName: subscriber.commonName,
@@ -495,7 +456,8 @@ export const pkiSubscriberServiceFactory = ({
   };
 
   const signSubscriberCert = async ({
-    subscriberId,
+    subscriberName,
+    projectId,
     csr,
     actorId,
     actorAuthMethod,
@@ -503,8 +465,11 @@ export const pkiSubscriberServiceFactory = ({
     actorOrgId
   }: TSignPkiSubscriberCertDTO) => {
     const appCfg = getConfig();
-    const subscriber = await pkiSubscriberDAL.findById(subscriberId);
-    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber with ID '${subscriberId}' not found` });
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
+    });
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
     const ca = await certificateAuthorityDAL.findById(subscriber.caId);
     if (!ca) throw new NotFoundError({ message: `CA with ID '${subscriber.caId}' not found` });
 
@@ -517,13 +482,16 @@ export const pkiSubscriberServiceFactory = ({
       actionProjectType: ActionProjectType.CertificateManager
     });
 
-    // (dangtony98): TODO: make permission more granular
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionPkiSubscriberActions.SignCert,
-      ProjectPermissionSub.PkiSubscribers
+      ProjectPermissionPkiSubscriberActions.IssueCert,
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
     );
 
-    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (subscriber.status !== PkiSubscriberStatus.ACTIVE)
+      throw new BadRequestError({ message: "Subscriber is not active" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.activeCaCertId) throw new BadRequestError({ message: "CA does not have a certificate installed" });
     if (ca.requireTemplateForIssuance) {
       throw new BadRequestError({ message: "Certificate template is required for issuance" });
@@ -711,6 +679,7 @@ export const pkiSubscriberServiceFactory = ({
         {
           caId: ca.id,
           caCertId: caCert.id,
+          pkiSubscriberId: subscriber.id,
           status: CertStatus.ACTIVE,
           friendlyName: subscriber.commonName,
           commonName: subscriber.commonName,
@@ -747,12 +716,62 @@ export const pkiSubscriberServiceFactory = ({
     };
   };
 
+  const listSubscriberCerts = async ({
+    subscriberName,
+    projectId,
+    offset,
+    limit,
+    actorId,
+    actorAuthMethod,
+    actor,
+    actorOrgId
+  }: TListPkiSubscriberCertsDTO) => {
+    const subscriber = await pkiSubscriberDAL.findOne({
+      name: subscriberName,
+      projectId
+    });
+    if (!subscriber) throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
+    const ca = await certificateAuthorityDAL.findById(subscriber.caId);
+    if (!ca) throw new NotFoundError({ message: `CA with ID '${subscriber.caId}' not found` });
+
+    const { permission } = await permissionService.getProjectPermission({
+      actor,
+      actorId,
+      projectId: ca.projectId,
+      actorAuthMethod,
+      actorOrgId,
+      actionProjectType: ActionProjectType.CertificateManager
+    });
+
+    ForbiddenError.from(permission).throwUnlessCan(
+      ProjectPermissionPkiSubscriberActions.ListCerts,
+      subject(ProjectPermissionSub.PkiSubscribers, {
+        name: subscriber.name
+      })
+    );
+
+    const certificates = await certificateDAL.find(
+      {
+        pkiSubscriberId: subscriber.id
+      },
+      { offset, limit, sort: [["updatedAt", "desc"]] }
+    );
+
+    const count = await certificateDAL.countCertificatesForPkiSubscriber(subscriber.id);
+
+    return {
+      certificates,
+      totalCount: count
+    };
+  };
+
   return {
     createSubscriber,
-    getSubscriberById,
+    getSubscriber,
     updateSubscriber,
     deleteSubscriber,
     issueSubscriberCert,
-    signSubscriberCert
+    signSubscriberCert,
+    listSubscriberCerts
   };
 };

backend/src/services/pki-subscriber/pki-subscriber-types.ts

@@ -2,40 +2,53 @@ import { TProjectPermission } from "@app/lib/types";
 
 import { CertExtendedKeyUsage, CertKeyUsage } from "../certificate/certificate-types";
 
+export enum PkiSubscriberStatus {
+  ACTIVE = "active",
+  DISABLED = "disabled"
+}
+
 export type TCreatePkiSubscriberDTO = {
   caId: string;
   name: string;
   commonName: string;
+  status: PkiSubscriberStatus;
   ttl: string;
   subjectAlternativeNames: string[];
   keyUsages: CertKeyUsage[];
   extendedKeyUsages: CertExtendedKeyUsage[];
 } & TProjectPermission;
 
-export type TGetPkiSubscriberByIdDTO = {
-  subscriberId: string;
-} & Omit<TProjectPermission, "projectId">;
+export type TGetPkiSubscriberDTO = {
+  subscriberName: string;
+} & TProjectPermission;
 
 export type TUpdatePkiSubscriberDTO = {
-  subscriberId: string;
+  subscriberName: string;
   caId?: string;
   name?: string;
   commonName?: string;
+  status?: PkiSubscriberStatus;
   ttl?: string;
   subjectAlternativeNames?: string[];
   keyUsages?: CertKeyUsage[];
   extendedKeyUsages?: CertExtendedKeyUsage[];
-} & Omit<TProjectPermission, "projectId">;
+} & TProjectPermission;
 
 export type TDeletePkiSubscriberDTO = {
-  subscriberId: string;
-} & Omit<TProjectPermission, "projectId">;
+  subscriberName: string;
+} & TProjectPermission;
 
 export type TIssuePkiSubscriberCertDTO = {
-  subscriberId: string;
-} & Omit<TProjectPermission, "projectId">;
+  subscriberName: string;
+} & TProjectPermission;
 
 export type TSignPkiSubscriberCertDTO = {
-  subscriberId: string;
+  subscriberName: string;
   csr: string;
-} & Omit<TProjectPermission, "projectId">;
+} & TProjectPermission;
+
+export type TListPkiSubscriberCertsDTO = {
+  subscriberName: string;
+  offset: number;
+  limit: number;
+} & TProjectPermission;

backend/src/services/project/project-service.ts

@@ -1083,19 +1083,13 @@ export const projectServiceFactory = ({
 
     for (const subscriber of subscribers) {
       try {
-        // (dangtony98): Add more granular permissions
         ForbiddenError.from(permission).throwUnlessCan(
           ProjectPermissionPkiSubscriberActions.Read,
-          ProjectPermissionSub.PkiSubscribers
+          subject(ProjectPermissionSub.PkiSubscribers, {
+            name: subscriber.name
+          })
         );
 
-        // ForbiddenError.from(permission).throwUnlessCan(
-        //   ProjectPermissionSshHostActions.Read,
-        //   subject(ProjectPermissionSub.SshHosts, {
-        //     hostname: host.hostname
-        //   })
-        // );
-
         allowedSubscribers.push(subscriber);
       } catch {
         // intentionally ignore subscribers where user lacks access