Address greptile comments

backend/src/server/routes/v1/certificate-profiles-router.ts

@@ -1,7 +1,7 @@
 import RE2 from "re2";
 import { z } from "zod";
 
-import { CertificateProfilesSchema } from "@app/db/schemas";
+import { PkiCertificateProfilesSchema } from "@app/db/schemas";
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
 import { ApiDocsTags } from "@app/lib/api-docs";
 import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
@@ -72,7 +72,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         ),
       response: {
         200: z.object({
-          certificateProfile: CertificateProfilesSchema
+          certificateProfile: PkiCertificateProfilesSchema
         })
       }
     },
@@ -126,7 +126,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       }),
       response: {
         200: z.object({
-          certificateProfiles: CertificateProfilesSchema.extend({
+          certificateProfiles: PkiCertificateProfilesSchema.extend({
             metrics: z
               .object({
                 profileId: z.string(),
@@ -177,7 +177,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       hide: false,
       tags: [ApiDocsTags.PkiCertificateProfiles],
       params: z.object({
-        id: z.string().min(1)
+        id: z.string().uuid()
       }),
       querystring: z.object({
         includeMetrics: z.coerce.boolean().optional().default(false),
@@ -185,7 +185,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       }),
       response: {
         200: z.object({
-          certificateProfile: CertificateProfilesSchema.extend({
+          certificateProfile: PkiCertificateProfilesSchema.extend({
             certificateAuthority: z
               .object({
                 id: z.string(),
@@ -207,7 +207,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
                 id: z.string(),
                 disableBootstrapCaValidation: z.boolean(),
                 hashedPassphrase: z.string(),
-                encryptedCaChain: z.any()
+                encryptedCaChain: z.string()
               })
               .optional(),
             apiConfig: z
@@ -288,7 +288,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       }),
       response: {
         200: z.object({
-          certificateProfile: CertificateProfilesSchema
+          certificateProfile: PkiCertificateProfilesSchema
         })
       }
     },
@@ -317,7 +317,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       hide: false,
       tags: [ApiDocsTags.PkiCertificateProfiles],
       params: z.object({
-        id: z.string().min(1)
+        id: z.string().uuid()
       }),
       body: z
         .object({
@@ -363,7 +363,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
         ),
       response: {
         200: z.object({
-          certificateProfile: CertificateProfilesSchema
+          certificateProfile: PkiCertificateProfilesSchema
         })
       }
     },
@@ -408,7 +408,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       }),
       response: {
         200: z.object({
-          certificateProfile: CertificateProfilesSchema
+          certificateProfile: PkiCertificateProfilesSchema
         })
       }
     },
@@ -448,11 +448,11 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
       hide: false,
       tags: [ApiDocsTags.PkiCertificateProfiles],
       params: z.object({
-        id: z.string().min(1)
+        id: z.string().uuid()
       }),
       querystring: z.object({
-        offset: z.number().min(0).default(0),
-        limit: z.number().min(1).max(100).default(20),
+        offset: z.coerce.number().min(0).default(0),
+        limit: z.coerce.number().min(1).max(100).default(20),
         status: z.enum(["active", "expired", "revoked"]).optional(),
         search: z.string().optional()
       }),

backend/src/server/routes/v2/certificate-templates-v2-router.ts

@@ -1,3 +1,4 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
@@ -93,9 +94,19 @@ const templateV2SanSchema = z
 const templateV2ValiditySchema = z.object({
   max: z
     .string()
-    .regex(/^\d+[dhmy]$/, {
-      message: "Max validity must be in format like '365d', '12m', '1y', or '24h'"
-    })
+    .refine(
+      (val) => {
+        if (!val) return true;
+        if (val.length < 2) return false;
+        const unit = val.slice(-1);
+        const number = val.slice(0, -1);
+        const digitRegex = new RE2("^\\d+$");
+        return ["d", "h", "m", "y"].includes(unit) && digitRegex.test(number);
+      },
+      {
+        message: "Max validity must be in format like '365d', '12m', '1y', or '24h'"
+      }
+    )
     .optional()
 });
 

backend/src/server/routes/v3/certificates-router.ts

@@ -1,3 +1,4 @@
+import RE2 from "re2";
 import { z } from "zod";
 
 import { EventType } from "@app/ee/services/audit-log/audit-log-types";
@@ -90,24 +91,28 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
         keyUsages: req.body.keyUsages,
         extendedKeyUsages: req.body.extendedKeyUsages,
         altNames: req.body.subjectAltNames
-          ? req.body.subjectAltNames
-              .split(", ")
-              .map((name) => name.trim())
-              .map((name) => {
-                const mappedType = validateAndMapAltNameType(name);
-                if (!mappedType) return null;
-                const typeMapping = {
-                  dns: "dns_name",
-                  ip: "ip_address",
-                  email: "email",
-                  url: "uri"
-                } as const;
-                return {
-                  type: typeMapping[mappedType.type] as CertSubjectAlternativeNameType,
-                  value: mappedType.value
-                };
-              })
-              .filter((item): item is NonNullable<typeof item> => item !== null)
+          ? (() => {
+              const splitRegex = new RE2("[,;]+");
+              return req.body.subjectAltNames
+                .split(splitRegex)
+                .map((name) => name.trim())
+                .filter((name) => name.length > 0)
+                .map((name) => {
+                  const mappedType = validateAndMapAltNameType(name);
+                  if (!mappedType) return null;
+                  const typeMapping = {
+                    dns: "dns_name",
+                    ip: "ip_address",
+                    email: "email",
+                    url: "uri"
+                  } as const;
+                  return {
+                    type: typeMapping[mappedType.type] as CertSubjectAlternativeNameType,
+                    value: mappedType.value
+                  };
+                })
+                .filter((item): item is NonNullable<typeof item> => item !== null);
+            })()
           : undefined,
         validity: {
           ttl: req.body.ttl
@@ -223,7 +228,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
             certificateProfileId: req.body.profileId,
             certificateId: data.certificateId,
             profileName: data.profileName,
-            commonName: req.body.csr || ""
+            commonName: ""
           }
         }
       });