misc: addressed review comments

backend/src/db/migrations/20250512133213_add-external-ca-pki.ts

@@ -12,12 +12,8 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("certificateAuthorityId").nullable();
     });
 
-    const caRows = await knex(TableName.CertificateAuthority).select("*");
-    if (caRows.length > 0) {
-      // @ts-expect-error intentional: migration
-      await knex(TableName.InternalCertificateAuthority).insert(caRows);
-    }
-
+    // @ts-expect-error intentional: migration
+    await knex(TableName.InternalCertificateAuthority).insert(knex(TableName.CertificateAuthority).select("*"));
     await knex(TableName.InternalCertificateAuthority).update("certificateAuthorityId", knex.ref("id"));
 
     await knex.schema.alterTable(TableName.InternalCertificateAuthority, (t) => {
@@ -90,7 +86,7 @@ export async function up(knex: Knex): Promise<void> {
       t.string("ttl").nullable().alter();
       t.string("lastOperationStatus");
       t.text("lastOperationMessage");
-      t.string("lastOperationAt");
+      t.dateTime("lastOperationAt");
     });
   }
 }

backend/src/db/schemas/pki-subscribers.ts

@@ -22,7 +22,7 @@ export const PkiSubscribersSchema = z.object({
   status: z.string(),
   lastOperationStatus: z.string().nullable().optional(),
   lastOperationMessage: z.string().nullable().optional(),
-  lastOperationAt: z.string().nullable().optional()
+  lastOperationAt: z.date().nullable().optional()
 });
 
 export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

backend/src/server/routes/v1/certificate-authority-routers/certificate-authority-endpoints.ts

@@ -204,7 +204,7 @@ export const registerCertificateAuthorityEndpoints = <
 
   server.route({
     method: "DELETE",
-    url: `/:certificateAuthorityId`,
+    url: "/:certificateAuthorityId",
     config: {
       rateLimit: writeLimit
     },

backend/src/server/routes/v2/certificate-authority-router.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-floating-promises */
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -6,6 +6,7 @@ import { KeyObject } from "crypto";
 import { TableName } from "@app/db/schemas";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
@@ -406,6 +407,8 @@ export const AcmeCertificateAuthorityFns = ({
       );
     }
 
+    await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
+
     const acmeClient = new acme.Client({
       directoryUrl: acmeCa.configuration.directoryUrl,
       accountKey

backend/src/services/certificate-authority/acme/acme-certificate-authority-schemas.ts

@@ -11,13 +11,13 @@ import {
 import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
 
 export const AcmeCertificateAuthorityConfigurationSchema = z.object({
-  dnsAppConnectionId: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
+  dnsAppConnectionId: z.string().uuid().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
   // soon, differentiate via the provider property
   dnsProviderConfig: z.object({
     provider: z.nativeEnum(AcmeDnsProvider).describe(CertificateAuthorities.CONFIGURATIONS.ACME.provider),
     hostedZoneId: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.hostedZoneId)
   }),
-  directoryUrl: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
+  directoryUrl: z.string().url().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
   accountEmail: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.accountEmail)
 });
 

backend/src/services/certificate-authority/certificate-authority-queue.ts

@@ -156,7 +156,7 @@ export const certificateAuthorityQueueFactory = ({
           await pkiSubscriberDAL.updateById(subscriberId, {
             lastOperationStatus: SubscriberOperationStatus.SUCCESS,
             lastOperationMessage: "Certificate ordered successfully",
-            lastOperationAt: new Date().toISOString()
+            lastOperationAt: new Date()
           });
         }
       } catch (e: unknown) {
@@ -164,7 +164,7 @@ export const certificateAuthorityQueueFactory = ({
           await pkiSubscriberDAL.updateById(subscriberId, {
             lastOperationStatus: SubscriberOperationStatus.FAILED,
             lastOperationMessage: e.message,
-            lastOperationAt: new Date().toISOString()
+            lastOperationAt: new Date()
           });
         }
         logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -140,7 +140,7 @@ export const certificateAuthorityServiceFactory = ({
         type,
         disableDirectIssuance: ca.disableDirectIssuance,
         name: ca.internalCa?.friendlyName,
-        projectId,
+        projectId: finalProjectId,
         status,
         configuration: ca.internalCa
       } as TCertificateAuthority;

backend/src/services/certificate/certificate-dal.ts

@@ -11,14 +11,18 @@ export const certificateDALFactory = (db: TDbClient) => {
   const certificateOrm = ormify(db, TableName.Certificate);
 
   const findLatestActiveCertForSubscriber = async ({ subscriberId }: { subscriberId: string }) => {
-    const cert = await db
-      .replicaNode()(TableName.Certificate)
-      .where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
-      .where("notAfter", ">", new Date())
-      .orderBy("notBefore", "desc")
-      .first();
+    try {
+      const cert = await db
+        .replicaNode()(TableName.Certificate)
+        .where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
+        .where("notAfter", ">", new Date())
+        .orderBy("notBefore", "desc")
+        .first();
 
-    return cert;
+      return cert;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find latest active certificate for subscriber" });
+    }
   };
 
   const countCertificatesInProject = async ({

backend/src/services/pki-subscriber/pki-subscriber-service.ts

@@ -710,6 +710,10 @@ export const pkiSubscriberServiceFactory = ({
       projectId
     });
 
+    if (!subscriber) {
+      throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,