misc: addressed review comments

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -6,6 +6,7 @@ import { KeyObject } from "crypto";
 import { TableName } from "@app/db/schemas";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { OrgServiceActor } from "@app/lib/types";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TAppConnectionDALFactory } from "@app/services/app-connection/app-connection-dal";
 import { AppConnection, AWSRegion } from "@app/services/app-connection/app-connection-enums";
 import { decryptAppConnection } from "@app/services/app-connection/app-connection-fns";
@@ -406,6 +407,8 @@ export const AcmeCertificateAuthorityFns = ({
       );
     }
 
+    await blockLocalAndPrivateIpAddresses(acmeCa.configuration.directoryUrl);
+
     const acmeClient = new acme.Client({
       directoryUrl: acmeCa.configuration.directoryUrl,
       accountKey

backend/src/services/certificate-authority/acme/acme-certificate-authority-schemas.ts

@@ -11,13 +11,13 @@ import {
 import { AcmeDnsProvider } from "./acme-certificate-authority-enums";
 
 export const AcmeCertificateAuthorityConfigurationSchema = z.object({
-  dnsAppConnectionId: z.string().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
+  dnsAppConnectionId: z.string().uuid().trim().describe(CertificateAuthorities.CONFIGURATIONS.ACME.dnsAppConnectionId),
   // soon, differentiate via the provider property
   dnsProviderConfig: z.object({
     provider: z.nativeEnum(AcmeDnsProvider).describe(CertificateAuthorities.CONFIGURATIONS.ACME.provider),
     hostedZoneId: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.hostedZoneId)
   }),
-  directoryUrl: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
+  directoryUrl: z.string().url().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.directoryUrl),
   accountEmail: z.string().trim().min(1).describe(CertificateAuthorities.CONFIGURATIONS.ACME.accountEmail)
 });
 

backend/src/services/certificate-authority/certificate-authority-queue.ts

@@ -156,7 +156,7 @@ export const certificateAuthorityQueueFactory = ({
           await pkiSubscriberDAL.updateById(subscriberId, {
             lastOperationStatus: SubscriberOperationStatus.SUCCESS,
             lastOperationMessage: "Certificate ordered successfully",
-            lastOperationAt: new Date().toISOString()
+            lastOperationAt: new Date()
           });
         }
       } catch (e: unknown) {
@@ -164,7 +164,7 @@ export const certificateAuthorityQueueFactory = ({
           await pkiSubscriberDAL.updateById(subscriberId, {
             lastOperationStatus: SubscriberOperationStatus.FAILED,
             lastOperationMessage: e.message,
-            lastOperationAt: new Date().toISOString()
+            lastOperationAt: new Date()
           });
         }
         logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -140,7 +140,7 @@ export const certificateAuthorityServiceFactory = ({
         type,
         disableDirectIssuance: ca.disableDirectIssuance,
         name: ca.internalCa?.friendlyName,
-        projectId,
+        projectId: finalProjectId,
         status,
         configuration: ca.internalCa
       } as TCertificateAuthority;

backend/src/services/certificate/certificate-dal.ts

@@ -11,14 +11,18 @@ export const certificateDALFactory = (db: TDbClient) => {
   const certificateOrm = ormify(db, TableName.Certificate);
 
   const findLatestActiveCertForSubscriber = async ({ subscriberId }: { subscriberId: string }) => {
-    const cert = await db
-      .replicaNode()(TableName.Certificate)
-      .where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
-      .where("notAfter", ">", new Date())
-      .orderBy("notBefore", "desc")
-      .first();
+    try {
+      const cert = await db
+        .replicaNode()(TableName.Certificate)
+        .where({ pkiSubscriberId: subscriberId, status: CertStatus.ACTIVE })
+        .where("notAfter", ">", new Date())
+        .orderBy("notBefore", "desc")
+        .first();
 
-    return cert;
+      return cert;
+    } catch (error) {
+      throw new DatabaseError({ error, name: "Find latest active certificate for subscriber" });
+    }
   };
 
   const countCertificatesInProject = async ({

backend/src/services/pki-subscriber/pki-subscriber-service.ts

@@ -710,6 +710,10 @@ export const pkiSubscriberServiceFactory = ({
       projectId
     });
 
+    if (!subscriber) {
+      throw new NotFoundError({ message: `PKI subscriber named '${subscriberName}' not found` });
+    }
+
     const { permission } = await permissionService.getProjectPermission({
       actor,
       actorId,