misc: add indicators for errors

backend/src/db/migrations/20250512133213_add-external-ca-pki.ts

@@ -88,6 +88,9 @@ export async function up(knex: Knex): Promise<void> {
   if (await knex.schema.hasTable(TableName.PkiSubscriber)) {
     await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
       t.string("ttl").nullable().alter();
+      t.string("lastOperationStatus");
+      t.text("lastOperationMessage");
+      t.string("lastOperationAt");
     });
   }
 }
@@ -164,4 +167,12 @@ export async function down(knex: Knex): Promise<void> {
   if (hasExternalCATable) {
     await knex.schema.dropTable(TableName.ExternalCertificateAuthority);
   }
+
+  if (await knex.schema.hasTable(TableName.PkiSubscriber)) {
+    await knex.schema.alterTable(TableName.PkiSubscriber, (t) => {
+      t.dropColumn("lastOperationStatus");
+      t.dropColumn("lastOperationMessage");
+      t.dropColumn("lastOperationAt");
+    });
+  }
 }

backend/src/db/schemas/pki-subscribers.ts

@@ -19,7 +19,10 @@ export const PkiSubscribersSchema = z.object({
   ttl: z.string().nullable().optional(),
   keyUsages: z.string().array(),
   extendedKeyUsages: z.string().array(),
-  status: z.string()
+  status: z.string(),
+  lastOperationStatus: z.string().nullable().optional(),
+  lastOperationMessage: z.string().nullable().optional(),
+  lastOperationAt: z.string().nullable().optional()
 });
 
 export type TPkiSubscribers = z.infer<typeof PkiSubscribersSchema>;

backend/src/server/routes/v1/pki-subscriber-router.ts

@@ -180,7 +180,7 @@ export const registerPkiSubscriberRouter = async (server: FastifyZodProvider) =>
         ttl: z
           .string()
           .trim()
-          .refine((val) => ms(val) > 0, "TTL must be a positive number")
+          .refine((val) => !val || ms(val) > 0, "TTL must be a positive number")
           .optional()
           .describe(PKI_SUBSCRIBERS.UPDATE.ttl),
         keyUsages: z

backend/src/services/certificate-authority/certificate-authority-dal.ts

@@ -86,8 +86,8 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
             serialNumber: result.internalSerialNumber,
             maxPathLength: result.internalMaxPathLength,
             keyAlgorithm: result.internalKeyAlgorithm,
-            notBefore: result.internalNotBefore,
-            notAfter: result.internalNotAfter,
+            notBefore: result.internalNotBefore?.toISOString(),
+            notAfter: result.internalNotAfter?.toISOString(),
             activeCaCertId: result.internalActiveCaCertId,
             certificateAuthorityId: result.internalCertificateAuthorityId
           }
@@ -232,8 +232,8 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
               serialNumber: ca.internalSerialNumber,
               maxPathLength: ca.internalMaxPathLength,
               keyAlgorithm: ca.internalKeyAlgorithm,
-              notBefore: ca.internalNotBefore,
-              notAfter: ca.internalNotAfter,
+              notBefore: ca.internalNotBefore?.toISOString(),
+              notAfter: ca.internalNotAfter?.toISOString(),
               activeCaCertId: ca.internalActiveCaCertId,
               certificateAuthorityId: ca.internalCertificateAuthorityId
             }

backend/src/services/certificate-authority/certificate-authority-queue.ts

@@ -19,6 +19,7 @@ import { TAppConnectionServiceFactory } from "../app-connection/app-connection-s
 import { TCertificateBodyDALFactory } from "../certificate/certificate-body-dal";
 import { TCertificateSecretDALFactory } from "../certificate/certificate-secret-dal";
 import { TPkiSubscriberDALFactory } from "../pki-subscriber/pki-subscriber-dal";
+import { SubscriberOperationStatus } from "../pki-subscriber/pki-subscriber-types";
 import { AcmeCertificateAuthorityFns } from "./acme/acme-certificate-authority-fns";
 import { TCertificateAuthorityDALFactory } from "./certificate-authority-dal";
 import { CaType } from "./certificate-authority-enums";
@@ -47,7 +48,7 @@ type TCertificateAuthorityQueueFactoryDep = {
   certificateBodyDAL: Pick<TCertificateBodyDALFactory, "create">;
   certificateSecretDAL: Pick<TCertificateSecretDALFactory, "create">;
   queueService: TQueueServiceFactory;
-  pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById">;
+  pkiSubscriberDAL: Pick<TPkiSubscriberDALFactory, "findById" | "updateById">;
 };
 
 export type TCertificateAuthorityQueueFactory = ReturnType<typeof certificateAuthorityQueueFactory>;
@@ -152,8 +153,20 @@ export const certificateAuthorityQueueFactory = ({
       try {
         if (caType === CaType.ACME) {
           await acmeFns.orderSubscriberCertificate(subscriberId);
+          await pkiSubscriberDAL.updateById(subscriberId, {
+            lastOperationStatus: SubscriberOperationStatus.SUCCESS,
+            lastOperationMessage: "Certificate ordered successfully",
+            lastOperationAt: new Date().toISOString()
+          });
+        }
+      } catch (e: unknown) {
+        if (e instanceof Error) {
+          await pkiSubscriberDAL.updateById(subscriberId, {
+            lastOperationStatus: SubscriberOperationStatus.FAILED,
+            lastOperationMessage: e.message,
+            lastOperationAt: new Date().toISOString()
+          });
         }
-      } catch (e) {
         logger.error(e, `CaOrderCertificate Failed [subscriberId=${subscriberId}] [job=${job.name}]`);
       } finally {
         await lock.release();

backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts

@@ -18,7 +18,7 @@ const InternalCertificateAuthorityConfigurationSchema = z
     organization: z.string().trim(),
     ou: z.string().trim(),
     dn: z.string().trim(),
-    parentCaId: z.string().uuid().optional(),
+    parentCaId: z.string().uuid().nullish(),
     serialNumber: z.string().trim().optional(),
     activeCaCertId: z.string().uuid().optional(),
     country: z.string().trim(),

backend/src/services/pki-subscriber/pki-subscriber-schema.ts

@@ -12,7 +12,10 @@ export const sanitizedPkiSubscriber = PkiSubscribersSchema.pick({
   subjectAlternativeNames: true,
   ttl: true,
   keyUsages: true,
-  extendedKeyUsages: true
+  extendedKeyUsages: true,
+  lastOperationStatus: true,
+  lastOperationMessage: true,
+  lastOperationAt: true
 }).extend({
   supportsImmediateCertIssuance: z.boolean().optional()
 });

backend/src/services/pki-subscriber/pki-subscriber-types.ts

@@ -56,3 +56,8 @@ export type TListPkiSubscriberCertsDTO = {
   offset: number;
   limit: number;
 } & TProjectPermission;
+
+export enum SubscriberOperationStatus {
+  SUCCESS = "success",
+  FAILED = "failed"
+}