Make PR review adjustments

backend/src/db/migrations/20240802181855_ca-cert-version.ts

@@ -25,7 +25,7 @@ export async function up(knex: Knex): Promise<void> {
     if (!hasVersionColumn) {
       await knex.schema.alterTable(TableName.CertificateAuthorityCert, (t) => {
         t.integer("version").nullable();
-        // t.dropUnique(["caId"]);
+        t.dropUnique(["caId"]);
       });
 
       await knex(TableName.CertificateAuthorityCert).update({ version: 1 }).whereNull("version");

backend/src/db/migrations/20240818024923_cert-alerting.ts

@@ -15,6 +15,8 @@ export async function up(knex: Knex): Promise<void> {
     });
   }
 
+  await createOnUpdateTrigger(knex, TableName.PkiCollection);
+
   if (!(await knex.schema.hasTable(TableName.PkiCollectionItem))) {
     await knex.schema.createTable(TableName.PkiCollectionItem, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
@@ -28,6 +30,8 @@ export async function up(knex: Knex): Promise<void> {
     });
   }
 
+  await createOnUpdateTrigger(knex, TableName.PkiCollectionItem);
+
   if (!(await knex.schema.hasTable(TableName.PkiAlert))) {
     await knex.schema.createTable(TableName.PkiAlert, (t) => {
       t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
@@ -43,7 +47,6 @@ export async function up(knex: Knex): Promise<void> {
     });
   }
 
-  await createOnUpdateTrigger(knex, TableName.PkiCollection);
   await createOnUpdateTrigger(knex, TableName.PkiAlert);
 }
 

backend/src/queue/queue-service.ts

@@ -16,6 +16,7 @@ export enum QueueName {
   // TODO(akhilmhdh): This will get removed later. For now this is kept to stop the repeatable queue
   AuditLogPrune = "audit-log-prune",
   DailyResourceCleanUp = "daily-resource-cleanup",
+  DailyExpiringPkiItemAlert = "daily-expiring-pki-item-alert",
   TelemetryInstanceStats = "telemtry-self-hosted-stats",
   IntegrationSync = "sync-integrations",
   SecretWebhook = "secret-webhook",
@@ -36,6 +37,7 @@ export enum QueueJobs {
   // TODO(akhilmhdh): This will get removed later. For now this is kept to stop the repeatable queue
   AuditLogPrune = "audit-log-prune-job",
   DailyResourceCleanUp = "daily-resource-cleanup-job",
+  DailyExpiringPkiItemAlert = "daily-expiring-pki-item-alert",
   SecWebhook = "secret-webhook-trigger",
   TelemetryInstanceStats = "telemetry-self-hosted-stats",
   IntegrationSync = "secret-integration-pull",
@@ -71,6 +73,10 @@ export type TQueueJobTypes = {
     name: QueueJobs.DailyResourceCleanUp;
     payload: undefined;
   };
+  [QueueName.DailyExpiringPkiItemAlert]: {
+    name: QueueJobs.DailyExpiringPkiItemAlert;
+    payload: undefined;
+  };
   [QueueName.AuditLogPrune]: {
     name: QueueJobs.AuditLogPrune;
     payload: undefined;

backend/src/server/routes/index.ts

@@ -131,6 +131,7 @@ import { orgRoleServiceFactory } from "@app/services/org/org-role-service";
 import { orgServiceFactory } from "@app/services/org/org-service";
 import { orgAdminServiceFactory } from "@app/services/org-admin/org-admin-service";
 import { orgMembershipDALFactory } from "@app/services/org-membership/org-membership-dal";
+import { dailyExpiringPkiItemAlertQueueServiceFactory } from "@app/services/pki-alert/expiring-pki-item-alert-queue";
 import { pkiAlertDALFactory } from "@app/services/pki-alert/pki-alert-dal";
 import { pkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
 import { pkiCollectionDALFactory } from "@app/services/pki-collection/pki-collection-dal";
@@ -1063,7 +1064,6 @@ export const registerRoutes = async (
   const dailyResourceCleanUp = dailyResourceCleanUpQueueServiceFactory({
     auditLogDAL,
     queueService,
-    pkiAlertService,
     secretVersionDAL,
     secretFolderVersionDAL: folderVersionDAL,
     snapshotDAL,
@@ -1073,6 +1073,11 @@ export const registerRoutes = async (
     identityUniversalAuthClientSecretDAL: identityUaClientSecretDAL
   });
 
+  const dailyExpiringPkiItemAlert = dailyExpiringPkiItemAlertQueueServiceFactory({
+    queueService,
+    pkiAlertService
+  });
+
   const oidcService = oidcConfigServiceFactory({
     orgDAL,
     orgMembershipDAL,
@@ -1097,6 +1102,7 @@ export const registerRoutes = async (
 
   await telemetryQueue.startTelemetryCheck();
   await dailyResourceCleanUp.startCleanUp();
+  await dailyExpiringPkiItemAlert.startSendingAlerts();
   await kmsService.startService();
 
   // inject all services

backend/src/server/routes/v1/index.ts

@@ -76,8 +76,8 @@ export const registerV1Routes = async (server: FastifyZodProvider) => {
     async (pkiRouter) => {
       await pkiRouter.register(registerCaRouter, { prefix: "/ca" });
       await pkiRouter.register(registerCertRouter, { prefix: "/certificates" });
-      await server.register(registerPkiAlertRouter, { prefix: "/alerts" });
+      await pkiRouter.register(registerPkiAlertRouter, { prefix: "/alerts" });
-      await server.register(registerPkiCollectionRouter, { prefix: "/collections" });
+      await pkiRouter.register(registerPkiCollectionRouter, { prefix: "/collections" });
     },
     { prefix: "/pki" }
   );

backend/src/server/routes/v1/pki-alert-router.ts

@@ -22,7 +22,11 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
         pkiCollectionId: z.string().trim().describe(ALERTS.CREATE.pkiCollectionId),
         name: z.string().trim().describe(ALERTS.CREATE.name),
         alertBeforeDays: z.number().describe(ALERTS.CREATE.alertBeforeDays),
-        emails: z.array(z.string().trim().email({ message: "Invalid email address" })).describe(ALERTS.CREATE.emails)
+        emails: z
+          .array(z.string().trim().email({ message: "Invalid email address" }))
+          .min(1, { message: "You must specify at least 1 email" })
+          .max(5, { message: "You can specify a maximum of 5 emails" })
+          .describe(ALERTS.CREATE.emails)
       }),
       response: {
         200: PkiAlertsSchema
@@ -114,6 +118,8 @@ export const registerPkiAlertRouter = async (server: FastifyZodProvider) => {
         pkiCollectionId: z.string().trim().optional().describe(ALERTS.UPDATE.pkiCollectionId),
         emails: z
           .array(z.string().trim().email({ message: "Invalid email address" }))
+          .min(1, { message: "You must specify at least 1 email" })
+          .max(5, { message: "You can specify a maximum of 5 emails" })
           .optional()
           .describe(ALERTS.UPDATE.emails)
       }),

backend/src/services/certificate-authority/certificate-authority-fns.ts

@@ -1,7 +1,7 @@
 import * as x509 from "@peculiar/x509";
 import crypto from "crypto";
 
-import { BadRequestError } from "@app/lib/errors";
+import { NotFoundError } from "@app/lib/errors";
 import { getProjectKmsCertificateKeyId } from "@app/services/project/project-fns";
 
 import { CertKeyAlgorithm, CertStatus } from "../certificate/certificate-types";
@@ -106,10 +106,10 @@ export const getCaCredentials = async ({
   kmsService
 }: TGetCaCredentialsDTO) => {
   const ca = await certificateAuthorityDAL.findById(caId);
-  if (!ca) throw new BadRequestError({ message: "CA not found" });
+  if (!ca) throw new NotFoundError({ message: "CA not found" });
 
   const caSecret = await certificateAuthoritySecretDAL.findOne({ caId });
-  if (!caSecret) throw new BadRequestError({ message: "CA secret not found" });
+  if (!caSecret) throw new NotFoundError({ message: "CA secret not found" });
 
   const keyId = await getProjectKmsCertificateKeyId({
     projectId: ca.projectId,
@@ -158,7 +158,7 @@ export const getCaCertChains = async ({
   kmsService
 }: TGetCaCertChainsDTO) => {
   const ca = await certificateAuthorityDAL.findById(caId);
-  if (!ca) throw new BadRequestError({ message: "CA not found" });
+  if (!ca) throw new NotFoundError({ message: "CA not found" });
 
   const keyId = await getProjectKmsCertificateKeyId({
     projectId: ca.projectId,
@@ -205,7 +205,7 @@ export const getCaCertChain = async ({
   kmsService
 }: TGetCaCertChainDTO) => {
   const caCert = await certificateAuthorityCertDAL.findById(caCertId);
-  if (!caCert) throw new BadRequestError({ message: "CA certificate not found" });
+  if (!caCert) throw new NotFoundError({ message: "CA certificate not found" });
   const ca = await certificateAuthorityDAL.findById(caCert.caId);
 
   const keyId = await getProjectKmsCertificateKeyId({
@@ -249,7 +249,7 @@ export const rebuildCaCrl = async ({
   kmsService
 }: TRebuildCaCrlDTO) => {
   const ca = await certificateAuthorityDAL.findById(caId);
-  if (!ca) throw new BadRequestError({ message: "CA not found" });
+  if (!ca) throw new NotFoundError({ message: "CA not found" });
 
   const caSecret = await certificateAuthoritySecretDAL.findOne({ caId: ca.id });
 

backend/src/services/pki-alert/expiring-pki-item-alert-queue.ts

@@ -0,0 +1,48 @@
+import { logger } from "@app/lib/logger";
+import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
+import { TPkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
+
+type TDailyExpiringPkiItemAlertQueueServiceFactoryDep = {
+  queueService: TQueueServiceFactory;
+  pkiAlertService: Pick<TPkiAlertServiceFactory, "sendPkiItemExpiryNotices">;
+};
+
+export type TDailyExpiringPkiItemAlertQueueServiceFactory = ReturnType<
+  typeof dailyExpiringPkiItemAlertQueueServiceFactory
+>;
+
+export const dailyExpiringPkiItemAlertQueueServiceFactory = ({
+  queueService,
+  pkiAlertService
+}: TDailyExpiringPkiItemAlertQueueServiceFactoryDep) => {
+  queueService.start(QueueName.DailyExpiringPkiItemAlert, async () => {
+    logger.info(`${QueueName.DailyExpiringPkiItemAlert}: queue task started`);
+    await pkiAlertService.sendPkiItemExpiryNotices();
+    logger.info(`${QueueName.DailyExpiringPkiItemAlert}: queue task completed`);
+  });
+
+  // we do a repeat cron job in utc timezone at 12 Midnight each day
+  const startSendingAlerts = async () => {
+    // clear previous job
+    await queueService.stopRepeatableJob(
+      QueueName.DailyExpiringPkiItemAlert,
+      QueueJobs.DailyExpiringPkiItemAlert,
+      { pattern: "0 0 * * *", utc: true },
+      QueueName.DailyExpiringPkiItemAlert // just a job id
+    );
+
+    await queueService.queue(QueueName.DailyExpiringPkiItemAlert, QueueJobs.DailyExpiringPkiItemAlert, undefined, {
+      delay: 5000,
+      jobId: QueueName.DailyExpiringPkiItemAlert,
+      repeat: { pattern: "0 0 * * *", utc: true }
+    });
+  };
+
+  queueService.listen(QueueName.DailyExpiringPkiItemAlert, "failed", (_, err) => {
+    logger.error(err, `${QueueName.DailyExpiringPkiItemAlert}: Expiring PKI item alert failed`);
+  });
+
+  return {
+    startSendingAlerts
+  };
+};

backend/src/services/pki-alert/pki-alert-service.ts

@@ -12,8 +12,11 @@ import { TPkiAlertDALFactory } from "./pki-alert-dal";
 import { TCreateAlertDTO, TDeleteAlertDTO, TGetAlertByIdDTO, TUpdateAlertDTO } from "./pki-alert-types";
 
 type TPkiAlertServiceFactoryDep = {
-  pkiAlertDAL: TPkiAlertDALFactory;
+  pkiAlertDAL: Pick<
-  pkiCollectionDAL: TPkiCollectionDALFactory;
+    TPkiAlertDALFactory,
+    "create" | "findById" | "updateById" | "deleteById" | "getExpiringPkiCollectionItemsForAlerting"
+  >;
+  pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "findById">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
   smtpService: Pick<TSmtpService, "sendMail">;
 };

backend/src/services/pki-collection/pki-collection-item-dal.ts

@@ -81,7 +81,7 @@ export const pkiCollectionItemDALFactory = (db: TDbClient) => {
 
       return parseInt((count as unknown as CountResult).count || "0", 10);
     } catch (error) {
-      throw new DatabaseError({ error, name: "Count all project certificates" });
+      throw new DatabaseError({ error, name: "Count all PKI collection items" });
     }
   };
 

backend/src/services/pki-collection/pki-collection-service.ts

@@ -22,10 +22,13 @@ import {
 } from "./pki-collection-types";
 
 type TPkiCollectionServiceFactoryDep = {
-  pkiCollectionDAL: TPkiCollectionDALFactory; // TODO: Pick
+  pkiCollectionDAL: Pick<TPkiCollectionDALFactory, "create" | "findById" | "updateById" | "deleteById">;
-  pkiCollectionItemDAL: TPkiCollectionItemDALFactory;
+  pkiCollectionItemDAL: Pick<
-  certificateAuthorityDAL: TCertificateAuthorityDALFactory;
+    TPkiCollectionItemDALFactory,
-  certificateDAL: TCertificateDALFactory;
+    "findOne" | "create" | "deleteById" | "findPkiCollectionItems" | "countItemsInPkiCollection"
+  >;
+  certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "find" | "findOne">;
+  certificateDAL: Pick<TCertificateDALFactory, "find">;
   permissionService: Pick<TPermissionServiceFactory, "getProjectPermission">;
 };
 
@@ -139,7 +142,7 @@ export const pkiCollectionServiceFactory = ({
     );
 
     ForbiddenError.from(permission).throwUnlessCan(
-      ProjectPermissionActions.Create,
+      ProjectPermissionActions.Delete,
       ProjectPermissionSub.PkiCollections
     );
     pkiCollection = await pkiCollectionDAL.deleteById(collectionId);

backend/src/services/resource-cleanup/resource-cleanup-queue.ts

@@ -2,7 +2,6 @@ import { TAuditLogDALFactory } from "@app/ee/services/audit-log/audit-log-dal";
 import { TSnapshotDALFactory } from "@app/ee/services/secret-snapshot/snapshot-dal";
 import { logger } from "@app/lib/logger";
 import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
-import { TPkiAlertServiceFactory } from "@app/services/pki-alert/pki-alert-service";
 
 import { TIdentityAccessTokenDALFactory } from "../identity-access-token/identity-access-token-dal";
 import { TIdentityUaClientSecretDALFactory } from "../identity-ua/identity-ua-client-secret-dal";
@@ -21,7 +20,6 @@ type TDailyResourceCleanUpQueueServiceFactoryDep = {
   snapshotDAL: Pick<TSnapshotDALFactory, "pruneExcessSnapshots">;
   secretSharingDAL: Pick<TSecretSharingDALFactory, "pruneExpiredSharedSecrets">;
   queueService: TQueueServiceFactory;
-  pkiAlertService: Pick<TPkiAlertServiceFactory, "sendPkiItemExpiryNotices">;
 };
 
 export type TDailyResourceCleanUpQueueServiceFactory = ReturnType<typeof dailyResourceCleanUpQueueServiceFactory>;
@@ -29,7 +27,6 @@ export type TDailyResourceCleanUpQueueServiceFactory = ReturnType<typeof dailyRe
 export const dailyResourceCleanUpQueueServiceFactory = ({
   auditLogDAL,
   queueService,
-  pkiAlertService,
   snapshotDAL,
   secretVersionDAL,
   secretFolderVersionDAL,
@@ -48,7 +45,6 @@ export const dailyResourceCleanUpQueueServiceFactory = ({
     await secretVersionDAL.pruneExcessVersions();
     await secretVersionV2DAL.pruneExcessVersions();
     await secretFolderVersionDAL.pruneExcessVersions();
-    await pkiAlertService.sendPkiItemExpiryNotices();
     logger.info(`${QueueName.DailyResourceCleanUp}: queue task completed`);
   });
 

frontend/src/views/Project/CertificatesPage/components/CertificatesTab/components/CertificateModal.tsx

@@ -186,32 +186,34 @@ export const CertificateModal = ({ popUp, handlePopUpToggle }: Props) => {
                 </FormControl>
               )}
             />
-            <Controller
+            {!cert && (
-              control={control}
+              <Controller
-              name="collectionId"
+                control={control}
-              render={({ field: { onChange, ...field }, fieldState: { error } }) => (
+                name="collectionId"
-                <FormControl
+                render={({ field: { onChange, ...field }, fieldState: { error } }) => (
-                  label="Certificate Collection (Optional)"
+                  <FormControl
-                  errorText={error?.message}
+                    label="Certificate Collection (Optional)"
-                  isError={Boolean(error)}
+                    errorText={error?.message}
-                  className="mt-4"
+                    isError={Boolean(error)}
-                >
+                    className="mt-4"
-                  <Select
-                    defaultValue={field.value}
-                    {...field}
-                    onValueChange={(e) => onChange(e)}
-                    className="w-full"
-                    isDisabled={Boolean(cert)}
                   >
-                    {(data?.collections || []).map(({ id, name }) => (
+                    <Select
-                      <SelectItem value={id} key={`pki-collection-${id}`}>
+                      defaultValue={field.value}
-                        {name}
+                      {...field}
-                      </SelectItem>
+                      onValueChange={(e) => onChange(e)}
-                    ))}
+                      className="w-full"
-                  </Select>
+                      isDisabled={Boolean(cert)}
-                </FormControl>
+                    >
-              )}
+                      {(data?.collections || []).map(({ id, name }) => (
-            />
+                        <SelectItem value={id} key={`pki-collection-${id}`}>
+                          {name}
+                        </SelectItem>
+                      ))}
+                    </Select>
+                  </FormControl>
+                )}
+              />
+            )}
             <Controller
               control={control}
               defaultValue=""

frontend/src/views/Project/PkiCollectionPage/components/PkiCollectionItemsTable.tsx

@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { faBoxesStacked, faTrash } from "@fortawesome/free-solid-svg-icons";
+import { faBoxesStacked, faXmark } from "@fortawesome/free-solid-svg-icons";
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import { format } from "date-fns";
 
@@ -85,7 +85,7 @@ export const PkiCollectionItemsTable = ({ collectionId, type, handlePopUpOpen }:
                                   });
                                 }}
                               >
-                                <FontAwesomeIcon icon={faTrash} />
+                                <FontAwesomeIcon icon={faXmark} />
                               </IconButton>
                             </Tooltip>
                           )}