misc: addressed first set of review comments

backend/src/services/certificate-authority/acme/acme-certificate-authority-fns.ts

@@ -77,8 +77,8 @@ export const castDbEntryToAcmeCertificateAuthority = (
   return {
     id: ca.id,
     type: CaType.ACME,
-    disableDirectIssuance: ca.disableDirectIssuance,
-    name: ca.externalCa.name,
+    enableDirectIssuance: ca.enableDirectIssuance,
+    name: ca.name,
     projectId: ca.projectId,
     credentials: ca.externalCa.credentials,
     configuration: {
@@ -90,7 +90,7 @@ export const castDbEntryToAcmeCertificateAuthority = (
       directoryUrl: dbConfigurationCol.directoryUrl,
       accountEmail: dbConfigurationCol.accountEmail
     },
-    status: ca.externalCa.status as CaStatus
+    status: ca.status as CaStatus
   };
 };
 
@@ -176,7 +176,7 @@ export const AcmeCertificateAuthorityFns = ({
     name,
     projectId,
     configuration,
-    disableDirectIssuance,
+    enableDirectIssuance,
     actor,
     status
   }: {
@@ -184,7 +184,7 @@ export const AcmeCertificateAuthorityFns = ({
     name: string;
     projectId: string;
     configuration: TCreateAcmeCertificateAuthorityDTO["configuration"];
-    disableDirectIssuance: boolean;
+    enableDirectIssuance: boolean;
     actor: OrgServiceActor;
   }) => {
     const { dnsAppConnectionId, directoryUrl, accountEmail, dnsProviderConfig } = configuration;
@@ -208,25 +208,24 @@ export const AcmeCertificateAuthorityFns = ({
         const ca = await certificateAuthorityDAL.create(
           {
             projectId,
-            disableDirectIssuance
+            enableDirectIssuance,
+            name,
+            status
           },
           tx
         );
 
         await externalCertificateAuthorityDAL.create(
           {
-            certificateAuthorityId: ca.id,
+            caId: ca.id,
             dnsAppConnectionId,
             type: CaType.ACME,
-            name,
-            projectId,
             configuration: {
               directoryUrl,
               accountEmail,
               dnsProvider: dnsProviderConfig.provider,
               hostedZoneId: dnsProviderConfig.hostedZoneId
-            },
-            status
+            }
           },
           tx
         );
@@ -255,14 +254,14 @@ export const AcmeCertificateAuthorityFns = ({
     id,
     status,
     configuration,
-    disableDirectIssuance,
+    enableDirectIssuance,
     actor,
     name
   }: {
     id: string;
     status?: CaStatus;
     configuration: TUpdateAcmeCertificateAuthorityDTO["configuration"];
-    disableDirectIssuance?: boolean;
+    enableDirectIssuance?: boolean;
     actor: OrgServiceActor;
     name?: string;
   }) => {
@@ -290,7 +289,7 @@ export const AcmeCertificateAuthorityFns = ({
 
         await externalCertificateAuthorityDAL.update(
           {
-            certificateAuthorityId: id,
+            caId: id,
             type: CaType.ACME
           },
           {
@@ -306,23 +305,13 @@ export const AcmeCertificateAuthorityFns = ({
         );
       }
 
-      await externalCertificateAuthorityDAL.update(
-        {
-          certificateAuthorityId: id,
-          type: CaType.ACME
-        },
-        {
-          name,
-          status
-        },
-        tx
-      );
-
-      if (disableDirectIssuance !== undefined) {
+      if (name || status || enableDirectIssuance) {
         await certificateAuthorityDAL.updateById(
           id,
           {
-            disableDirectIssuance
+            name,
+            status,
+            enableDirectIssuance
           },
           tx
         );
@@ -399,7 +388,7 @@ export const AcmeCertificateAuthorityFns = ({
       });
       await externalCertificateAuthorityDAL.update(
         {
-          certificateAuthorityId: acmeCa.id
+          caId: acmeCa.id
         },
         {
           credentials: encryptedNewCredentials

backend/src/services/certificate-authority/certificate-authority-dal.ts

@@ -14,25 +14,25 @@ export type TCertificateAuthorityWithAssociatedCa = Awaited<
 export const certificateAuthorityDALFactory = (db: TDbClient) => {
   const caOrm = ormify(db, TableName.CertificateAuthority);
 
-  const findByIdWithAssociatedCa = async (caId: string, tx?: Knex) => {
+  const findByNameAndProjectIdWithAssociatedCa = async (caName: string, projectId: string, tx?: Knex) => {
     const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
       .leftJoin(
         TableName.InternalCertificateAuthority,
         `${TableName.CertificateAuthority}.id`,
-        `${TableName.InternalCertificateAuthority}.certificateAuthorityId`
+        `${TableName.InternalCertificateAuthority}.caId`
       )
       .leftJoin(
         TableName.ExternalCertificateAuthority,
         `${TableName.CertificateAuthority}.id`,
-        `${TableName.ExternalCertificateAuthority}.certificateAuthorityId`
+        `${TableName.ExternalCertificateAuthority}.caId`
       )
-      .where(`${TableName.CertificateAuthority}.id`, caId)
+      .where(`${TableName.CertificateAuthority}.name`, caName)
+      .where(`${TableName.CertificateAuthority}.projectId`, projectId)
       .select(selectAllTableCols(TableName.CertificateAuthority))
       .select(
         db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
         db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
         db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
-        db.ref("status").withSchema(TableName.InternalCertificateAuthority).as("internalStatus"),
         db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
         db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
         db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
@@ -46,17 +46,11 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
         db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
         db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
         db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
-        db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId"),
-        db
-          .ref("certificateAuthorityId")
-          .withSchema(TableName.InternalCertificateAuthority)
-          .as("internalCertificateAuthorityId")
+        db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
       )
       .select(
         db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
-        db.ref("name").withSchema(TableName.ExternalCertificateAuthority).as("externalName"),
         db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
-        db.ref("status").withSchema(TableName.ExternalCertificateAuthority).as("externalStatus"),
         db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
         db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
         db
@@ -74,7 +68,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
             id: result.internalCaId,
             parentCaId: result.internalParentCaId,
             type: result.internalType,
-            status: result.internalStatus,
             friendlyName: result.internalFriendlyName,
             organization: result.internalOrganization,
             ou: result.internalOu,
@@ -88,16 +81,97 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
             keyAlgorithm: result.internalKeyAlgorithm,
             notBefore: result.internalNotBefore?.toISOString(),
             notAfter: result.internalNotAfter?.toISOString(),
-            activeCaCertId: result.internalActiveCaCertId,
-            certificateAuthorityId: result.internalCertificateAuthorityId
+            activeCaCertId: result.internalActiveCaCertId
+          }
+        : undefined,
+      externalCa: result
+        ? {
+            id: result.externalCaId,
+            type: result.externalType,
+            configuration: result.externalConfiguration,
+            dnsAppConnectionId: result.externalDnsAppConnectionId,
+            appConnectionId: result.externalAppConnectionId,
+            credentials: result.externalCredentials
+          }
+        : undefined
+    };
+
+    return data;
+  };
+
+  const findByIdWithAssociatedCa = async (caId: string, tx?: Knex) => {
+    const result = await (tx || db.replicaNode())(TableName.CertificateAuthority)
+      .leftJoin(
+        TableName.InternalCertificateAuthority,
+        `${TableName.CertificateAuthority}.id`,
+        `${TableName.InternalCertificateAuthority}.caId`
+      )
+      .leftJoin(
+        TableName.ExternalCertificateAuthority,
+        `${TableName.CertificateAuthority}.id`,
+        `${TableName.ExternalCertificateAuthority}.caId`
+      )
+      .where(`${TableName.CertificateAuthority}.id`, caId)
+      .select(selectAllTableCols(TableName.CertificateAuthority))
+      .select(
+        db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
+        db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
+        db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
+        db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
+        db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
+        db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
+        db.ref("country").withSchema(TableName.InternalCertificateAuthority).as("internalCountry"),
+        db.ref("province").withSchema(TableName.InternalCertificateAuthority).as("internalProvince"),
+        db.ref("locality").withSchema(TableName.InternalCertificateAuthority).as("internalLocality"),
+        db.ref("commonName").withSchema(TableName.InternalCertificateAuthority).as("internalCommonName"),
+        db.ref("dn").withSchema(TableName.InternalCertificateAuthority).as("internalDn"),
+        db.ref("serialNumber").withSchema(TableName.InternalCertificateAuthority).as("internalSerialNumber"),
+        db.ref("maxPathLength").withSchema(TableName.InternalCertificateAuthority).as("internalMaxPathLength"),
+        db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
+        db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
+        db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
+        db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
+      )
+      .select(
+        db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
+        db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
+        db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
+        db.ref("credentials").withSchema(TableName.ExternalCertificateAuthority).as("externalCredentials"),
+        db
+          .ref("dnsAppConnectionId")
+          .withSchema(TableName.ExternalCertificateAuthority)
+          .as("externalDnsAppConnectionId"),
+        db.ref("appConnectionId").withSchema(TableName.ExternalCertificateAuthority).as("externalAppConnectionId")
+      )
+      .first();
+
+    const data = {
+      ...CertificateAuthoritiesSchema.parse(result),
+      internalCa: result
+        ? {
+            id: result.internalCaId,
+            parentCaId: result.internalParentCaId,
+            type: result.internalType,
+            friendlyName: result.internalFriendlyName,
+            organization: result.internalOrganization,
+            ou: result.internalOu,
+            country: result.internalCountry,
+            province: result.internalProvince,
+            locality: result.internalLocality,
+            commonName: result.internalCommonName,
+            dn: result.internalDn,
+            serialNumber: result.internalSerialNumber,
+            maxPathLength: result.internalMaxPathLength,
+            keyAlgorithm: result.internalKeyAlgorithm,
+            notBefore: result.internalNotBefore?.toISOString(),
+            notAfter: result.internalNotAfter?.toISOString(),
+            activeCaCertId: result.internalActiveCaCertId
           }
         : undefined,
       externalCa: result
         ? {
             id: result.externalCaId,
-            name: result.externalName,
             type: result.externalType,
-            status: result.externalStatus,
             configuration: result.externalConfiguration,
             dnsAppConnectionId: result.externalDnsAppConnectionId,
             appConnectionId: result.externalAppConnectionId,
@@ -153,12 +227,12 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
         .leftJoin(
           TableName.InternalCertificateAuthority,
           `${TableName.CertificateAuthority}.id`,
-          `${TableName.InternalCertificateAuthority}.certificateAuthorityId`
+          `${TableName.InternalCertificateAuthority}.caId`
         )
         .leftJoin(
           TableName.ExternalCertificateAuthority,
           `${TableName.CertificateAuthority}.id`,
-          `${TableName.ExternalCertificateAuthority}.certificateAuthorityId`
+          `${TableName.ExternalCertificateAuthority}.caId`
         )
         // eslint-disable-next-line @typescript-eslint/no-misused-promises
         .where(buildFindFilter(filter))
@@ -167,7 +241,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
           db.ref("id").withSchema(TableName.InternalCertificateAuthority).as("internalCaId"),
           db.ref("parentCaId").withSchema(TableName.InternalCertificateAuthority).as("internalParentCaId"),
           db.ref("type").withSchema(TableName.InternalCertificateAuthority).as("internalType"),
-          db.ref("status").withSchema(TableName.InternalCertificateAuthority).as("internalStatus"),
           db.ref("friendlyName").withSchema(TableName.InternalCertificateAuthority).as("internalFriendlyName"),
           db.ref("organization").withSchema(TableName.InternalCertificateAuthority).as("internalOrganization"),
           db.ref("ou").withSchema(TableName.InternalCertificateAuthority).as("internalOu"),
@@ -181,17 +254,11 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
           db.ref("keyAlgorithm").withSchema(TableName.InternalCertificateAuthority).as("internalKeyAlgorithm"),
           db.ref("notBefore").withSchema(TableName.InternalCertificateAuthority).as("internalNotBefore"),
           db.ref("notAfter").withSchema(TableName.InternalCertificateAuthority).as("internalNotAfter"),
-          db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId"),
-          db
-            .ref("certificateAuthorityId")
-            .withSchema(TableName.InternalCertificateAuthority)
-            .as("internalCertificateAuthorityId")
+          db.ref("activeCaCertId").withSchema(TableName.InternalCertificateAuthority).as("internalActiveCaCertId")
         )
         .select(
           db.ref("id").withSchema(TableName.ExternalCertificateAuthority).as("externalCaId"),
-          db.ref("name").withSchema(TableName.ExternalCertificateAuthority).as("externalName"),
           db.ref("type").withSchema(TableName.ExternalCertificateAuthority).as("externalType"),
-          db.ref("status").withSchema(TableName.ExternalCertificateAuthority).as("externalStatus"),
           db.ref("configuration").withSchema(TableName.ExternalCertificateAuthority).as("externalConfiguration"),
           db
             .ref("dnsAppConnectionId")
@@ -220,7 +287,6 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
               id: ca.internalCaId,
               parentCaId: ca.internalParentCaId,
               type: ca.internalType,
-              status: ca.internalStatus,
               friendlyName: ca.internalFriendlyName,
               organization: ca.internalOrganization,
               ou: ca.internalOu,
@@ -234,16 +300,13 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
               keyAlgorithm: ca.internalKeyAlgorithm,
               notBefore: ca.internalNotBefore?.toISOString(),
               notAfter: ca.internalNotAfter?.toISOString(),
-              activeCaCertId: ca.internalActiveCaCertId,
-              certificateAuthorityId: ca.internalCertificateAuthorityId
+              activeCaCertId: ca.internalActiveCaCertId
             }
           : undefined,
         externalCa: ca
           ? {
               id: ca.externalCaId,
-              name: ca.externalName,
               type: ca.externalType,
-              status: ca.externalStatus,
               configuration: ca.externalConfiguration,
               dnsAppConnectionId: ca.externalDnsAppConnectionId,
               appConnectionId: ca.externalAppConnectionId,
@@ -260,6 +323,7 @@ export const certificateAuthorityDALFactory = (db: TDbClient) => {
     ...caOrm,
     findWithAssociatedCa,
     buildCertificateChain,
-    findByIdWithAssociatedCa
+    findByIdWithAssociatedCa,
+    findByNameAndProjectIdWithAssociatedCa
   };
 };

backend/src/services/certificate-authority/certificate-authority-fns.ts

@@ -329,6 +329,6 @@ export const expandInternalCa = (
   return {
     ...ca.internalCa,
     ...ca,
-    requireTemplateForIssuance: ca.disableDirectIssuance
+    requireTemplateForIssuance: !ca.enableDirectIssuance
   } as const;
 };

backend/src/services/certificate-authority/certificate-authority-schemas.ts

@@ -8,10 +8,10 @@ import { CaStatus, CaType } from "./certificate-authority-enums";
 
 export const BaseCertificateAuthoritySchema = CertificateAuthoritiesSchema.pick({
   projectId: true,
-  disableDirectIssuance: true,
+  enableDirectIssuance: true,
+  name: true,
   id: true
 }).extend({
-  name: z.string(),
   status: z.nativeEnum(CaStatus)
 });
 
@@ -19,13 +19,14 @@ export const GenericCreateCertificateAuthorityFieldsSchema = (type: CaType) =>
   z.object({
     name: slugSchema({ field: "name" }).describe(CertificateAuthorities.CREATE(type).name),
     projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.CREATE(type).projectId),
-    disableDirectIssuance: z.boolean().describe(CertificateAuthorities.CREATE(type).disableDirectIssuance),
+    enableDirectIssuance: z.boolean().describe(CertificateAuthorities.CREATE(type).enableDirectIssuance),
     status: z.nativeEnum(CaStatus).describe(CertificateAuthorities.CREATE(type).status)
   });
 
 export const GenericUpdateCertificateAuthorityFieldsSchema = (type: CaType) =>
   z.object({
     name: slugSchema({ field: "name" }).optional().describe(CertificateAuthorities.UPDATE(type).name),
-    disableDirectIssuance: z.boolean().optional().describe(CertificateAuthorities.UPDATE(type).disableDirectIssuance),
+    projectId: z.string().trim().min(1, "Project ID required").describe(CertificateAuthorities.UPDATE(type).projectId),
+    enableDirectIssuance: z.boolean().optional().describe(CertificateAuthorities.UPDATE(type).enableDirectIssuance),
     status: z.nativeEnum(CaStatus).optional().describe(CertificateAuthorities.UPDATE(type).status)
   });

backend/src/services/certificate-authority/certificate-authority-service.ts

@@ -46,6 +46,7 @@ type TCertificateAuthorityServiceFactoryDep = {
     | "findOne"
     | "findByIdWithAssociatedCa"
     | "findWithAssociatedCa"
+    | "findByNameAndProjectIdWithAssociatedCa"
   >;
   externalCertificateAuthorityDAL: Pick<TExternalCertificateAuthorityDALFactory, "create" | "update">;
   internalCertificateAuthorityService: TInternalCertificateAuthorityServiceFactory;
@@ -94,7 +95,7 @@ export const certificateAuthorityServiceFactory = ({
   });
 
   const createCertificateAuthority = async (
-    { type, projectId, name, disableDirectIssuance, configuration, status }: TCreateCertificateAuthorityDTO,
+    { type, projectId, name, enableDirectIssuance, configuration, status }: TCreateCertificateAuthorityDTO,
     actor: OrgServiceActor
   ) => {
     let finalProjectId: string = projectId;
@@ -126,7 +127,7 @@ export const certificateAuthorityServiceFactory = ({
         ...(configuration as TCreateInternalCertificateAuthorityDTO["configuration"]),
         isInternal: true,
         projectId: finalProjectId,
-        requireTemplateForIssuance: disableDirectIssuance
+        requireTemplateForIssuance: !enableDirectIssuance
       });
 
       if (!ca.internalCa) {
@@ -138,8 +139,8 @@ export const certificateAuthorityServiceFactory = ({
       return {
         id: ca.id,
         type,
-        disableDirectIssuance: ca.disableDirectIssuance,
-        name: ca.internalCa?.friendlyName,
+        enableDirectIssuance: ca.enableDirectIssuance,
+        name: ca.name,
         projectId: finalProjectId,
         status,
         configuration: ca.internalCa
@@ -151,7 +152,7 @@ export const certificateAuthorityServiceFactory = ({
         name,
         projectId: finalProjectId,
         configuration: configuration as TCreateAcmeCertificateAuthorityDTO["configuration"],
-        disableDirectIssuance,
+        enableDirectIssuance,
         status,
         actor
       });
@@ -160,15 +161,18 @@ export const certificateAuthorityServiceFactory = ({
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
-  const findCertificateAuthorityById = async (
-    { certificateAuthorityId, type }: { certificateAuthorityId: string; type: CaType },
+  const findCertificateAuthorityByNameAndProjectId = async (
+    { caName, type, projectId }: { caName: string; type: CaType; projectId: string },
     actor: OrgServiceActor
   ) => {
-    const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(certificateAuthorityId);
+    const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
+      caName,
+      projectId
+    );
 
     if (!certificateAuthority)
       throw new NotFoundError({
-        message: `Could not find certificate authority with ID "${certificateAuthorityId}"`
+        message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
       });
 
     const { permission } = await permissionService.getProjectPermission({
@@ -188,24 +192,24 @@ export const certificateAuthorityServiceFactory = ({
     if (type === CaType.INTERNAL) {
       if (!certificateAuthority.internalCa?.id) {
         throw new NotFoundError({
-          message: `Internal certificate authority with ID "${certificateAuthorityId}" not found`
+          message: `Internal certificate authority with name "${caName}" in project "${projectId}" not found`
         });
       }
 
       return {
         id: certificateAuthority.id,
         type,
-        disableDirectIssuance: certificateAuthority.disableDirectIssuance,
-        name: certificateAuthority.internalCa.friendlyName,
+        enableDirectIssuance: certificateAuthority.enableDirectIssuance,
+        name: certificateAuthority.name,
         projectId: certificateAuthority.projectId,
         configuration: certificateAuthority.internalCa,
-        status: certificateAuthority.internalCa.status
+        status: certificateAuthority.status
       } as TCertificateAuthority;
     }
 
     if (certificateAuthority.externalCa?.type !== type) {
       throw new NotFoundError({
-        message: `Could not find external certificate authority with ID "${certificateAuthorityId}" and type "${type}"`
+        message: `Could not find external certificate authority with name "${caName}" in project "${projectId}" and type "${type}"`
       });
     }
 
@@ -255,11 +259,11 @@ export const certificateAuthorityServiceFactory = ({
         .map((ca) => ({
           id: ca.id,
           type,
-          disableDirectIssuance: ca.disableDirectIssuance,
-          name: ca.internalCa.friendlyName,
+          enableDirectIssuance: ca.enableDirectIssuance,
+          name: ca.name,
           projectId: ca.projectId,
           configuration: ca.internalCa,
-          status: ca.internalCa.status
+          status: ca.status
         })) as TCertificateAuthority[];
     }
 
@@ -271,14 +275,17 @@ export const certificateAuthorityServiceFactory = ({
   };
 
   const updateCertificateAuthority = async (
-    { id, type, configuration, disableDirectIssuance, status, name }: TUpdateCertificateAuthorityDTO,
+    { caName, type, configuration, enableDirectIssuance, status, name, projectId }: TUpdateCertificateAuthorityDTO,
     actor: OrgServiceActor
   ) => {
-    const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
+    const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
+      caName,
+      projectId
+    );
 
     if (!certificateAuthority)
       throw new NotFoundError({
-        message: `Could not find certificate authority with ID "${id}"`
+        message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
       });
 
     const { permission } = await permissionService.getProjectPermission({
@@ -298,15 +305,16 @@ export const certificateAuthorityServiceFactory = ({
     if (type === CaType.INTERNAL) {
       if (!certificateAuthority.internalCa?.id) {
         throw new NotFoundError({
-          message: `Internal certificate authority with ID "${id}" not found`
+          message: `Internal certificate authority with name "${caName}" in project "${projectId}" not found`
         });
       }
 
       const updatedCa = await internalCertificateAuthorityService.updateCaById({
         ...configuration,
         isInternal: true,
-        requireTemplateForIssuance: disableDirectIssuance,
-        caId: id
+        requireTemplateForIssuance: !enableDirectIssuance,
+        caId: certificateAuthority.id,
+        name
       });
 
       if (!updatedCa.internalCa) {
@@ -318,19 +326,19 @@ export const certificateAuthorityServiceFactory = ({
       return {
         id: updatedCa.id,
         type,
-        disableDirectIssuance: updatedCa.disableDirectIssuance,
-        name: updatedCa.internalCa?.friendlyName,
+        enableDirectIssuance: updatedCa.enableDirectIssuance,
+        name: updatedCa.name,
         projectId: updatedCa.projectId,
         configuration: updatedCa.internalCa,
-        status: updatedCa.internalCa?.status
+        status: updatedCa.status
       } as TCertificateAuthority;
     }
 
     if (type === CaType.ACME) {
       return acmeFns.updateCertificateAuthority({
-        id,
+        id: certificateAuthority.id,
         configuration: configuration as TUpdateAcmeCertificateAuthorityDTO["configuration"],
-        disableDirectIssuance,
+        enableDirectIssuance,
         actor,
         status,
         name
@@ -340,12 +348,18 @@ export const certificateAuthorityServiceFactory = ({
     throw new BadRequestError({ message: "Invalid certificate authority type" });
   };
 
-  const deleteCertificateAuthority = async ({ id, type }: { id: string; type: CaType }, actor: OrgServiceActor) => {
-    const certificateAuthority = await certificateAuthorityDAL.findByIdWithAssociatedCa(id);
+  const deleteCertificateAuthority = async (
+    { caName, type, projectId }: { caName: string; type: CaType; projectId: string },
+    actor: OrgServiceActor
+  ) => {
+    const certificateAuthority = await certificateAuthorityDAL.findByNameAndProjectIdWithAssociatedCa(
+      caName,
+      projectId
+    );
 
     if (!certificateAuthority)
       throw new NotFoundError({
-        message: `Could not find certificate authority with ID "${id}"`
+        message: `Could not find certificate authority with name "${caName}" in project "${projectId}"`
       });
 
     const { permission } = await permissionService.getProjectPermission({
@@ -374,17 +388,17 @@ export const certificateAuthorityServiceFactory = ({
       });
     }
 
-    await certificateAuthorityDAL.deleteById(id);
+    await certificateAuthorityDAL.deleteById(certificateAuthority.id);
 
     if (type === CaType.INTERNAL) {
       return {
         id: certificateAuthority.id,
         type,
-        disableDirectIssuance: certificateAuthority.disableDirectIssuance,
-        name: certificateAuthority.internalCa?.friendlyName,
+        enableDirectIssuance: certificateAuthority.enableDirectIssuance,
+        name: certificateAuthority.name,
         projectId: certificateAuthority.projectId,
         configuration: certificateAuthority.internalCa,
-        status: certificateAuthority.internalCa?.status
+        status: certificateAuthority.status
       } as TCertificateAuthority;
     }
 
@@ -397,7 +411,7 @@ export const certificateAuthorityServiceFactory = ({
 
   return {
     createCertificateAuthority,
-    findCertificateAuthorityById,
+    findCertificateAuthorityByNameAndProjectId,
     listCertificateAuthoritiesByProjectId,
     updateCertificateAuthority,
     deleteCertificateAuthority

backend/src/services/certificate-authority/certificate-authority-types.ts

@@ -13,5 +13,6 @@ export type TCreateCertificateAuthorityDTO = Omit<TCertificateAuthority, "id">;
 
 export type TUpdateCertificateAuthorityDTO = Partial<Omit<TCreateCertificateAuthorityDTO, "projectId">> & {
   type: CaType;
-  id: string;
+  caName: string;
+  projectId: string;
 };

backend/src/services/certificate-authority/internal/internal-certificate-authority-service.ts

@@ -1,6 +1,7 @@
 /* eslint-disable no-bitwise */
 import { ForbiddenError } from "@casl/ability";
 import * as x509 from "@peculiar/x509";
+import slugify from "@sindresorhus/slugify";
 import crypto, { KeyObject } from "crypto";
 import { z } from "zod";
 
@@ -21,6 +22,7 @@ import { extractX509CertFromChain } from "@app/lib/certificates/extract-certific
 import { getConfig } from "@app/lib/config/env";
 import { BadRequestError, NotFoundError } from "@app/lib/errors";
 import { ms } from "@app/lib/ms";
+import { alphaNumericNanoId } from "@app/lib/nanoid";
 import { isFQDN } from "@app/lib/validator/validate-url";
 import { TCertificateBodyDALFactory } from "@app/services/certificate/certificate-body-dal";
 import { TCertificateDALFactory } from "@app/services/certificate/certificate-dal";
@@ -200,14 +202,16 @@ export const internalCertificateAuthorityServiceFactory = ({
       const ca = await certificateAuthorityDAL.create(
         {
           projectId,
-          disableDirectIssuance: requireTemplateForIssuance
+          enableDirectIssuance: !requireTemplateForIssuance,
+          name: slugify(`${friendlyName || dn}-${alphaNumericNanoId(8)}`),
+          status: type === InternalCaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE
         },
         tx
       );
 
       const internalCa = await internalCertificateAuthorityDAL.create(
         {
-          certificateAuthorityId: ca.id,
+          caId: ca.id,
           type,
           organization,
           ou,
@@ -216,7 +220,6 @@ export const internalCertificateAuthorityServiceFactory = ({
           locality,
           friendlyName: friendlyName || dn,
           commonName,
-          status: type === InternalCaType.ROOT ? CaStatus.ACTIVE : CaStatus.PENDING_CERTIFICATE,
           dn,
           keyAlgorithm,
           ...(type === InternalCaType.ROOT && {
@@ -357,7 +360,7 @@ export const internalCertificateAuthorityServiceFactory = ({
    * Update CA with id [caId].
    * Note: Used to enable/disable CA
    */
-  const updateCaById = async ({ caId, status, requireTemplateForIssuance, ...dto }: TUpdateCaDTO) => {
+  const updateCaById = async ({ caId, status, requireTemplateForIssuance, name, ...dto }: TUpdateCaDTO) => {
     const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(caId);
     if (!ca.internalCa) throw new NotFoundError({ message: `CA with ID '${caId}' not found` });
 
@@ -378,20 +381,14 @@ export const internalCertificateAuthorityServiceFactory = ({
     }
 
     const updatedCa = await certificateAuthorityDAL.transaction(async (tx) => {
-      if (status !== undefined) {
-        await internalCertificateAuthorityDAL.update(
-          {
-            certificateAuthorityId: ca.id
-          },
-          { status },
+      if (requireTemplateForIssuance !== undefined || status !== undefined || name !== undefined) {
+        await certificateAuthorityDAL.updateById(
+          ca.id,
+          { enableDirectIssuance: !requireTemplateForIssuance, status, name },
           tx
         );
       }
 
-      if (requireTemplateForIssuance !== undefined) {
-        await certificateAuthorityDAL.updateById(ca.id, { disableDirectIssuance: requireTemplateForIssuance }, tx);
-      }
-
       return certificateAuthorityDAL.findByIdWithAssociatedCa(caId, tx);
     });
 
@@ -509,7 +506,7 @@ export const internalCertificateAuthorityServiceFactory = ({
       ProjectPermissionSub.CertificateAuthorities
     );
 
-    if (ca.internalCa.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
 
     // get latest CA certificate
     const caCert = await certificateAuthorityCertDAL.findById(ca.internalCa.activeCaCertId);
@@ -604,7 +601,7 @@ export const internalCertificateAuthorityServiceFactory = ({
 
           await internalCertificateAuthorityDAL.update(
             {
-              certificateAuthorityId: ca.id
+              caId: ca.id
             },
             {
               activeCaCertId: newCaCert.id,
@@ -746,7 +743,7 @@ export const internalCertificateAuthorityServiceFactory = ({
 
           await internalCertificateAuthorityDAL.update(
             {
-              certificateAuthorityId: ca.id
+              caId: ca.id
             },
             {
               activeCaCertId: newCaCert.id,
@@ -914,7 +911,7 @@ export const internalCertificateAuthorityServiceFactory = ({
       ProjectPermissionSub.CertificateAuthorities
     );
 
-    if (ca.internalCa.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
+    if (ca.status === CaStatus.DISABLED) throw new BadRequestError({ message: "CA is disabled" });
     if (!ca.internalCa.activeCaCertId)
       throw new BadRequestError({ message: "CA does not have a certificate installed" });
 
@@ -1150,12 +1147,15 @@ export const internalCertificateAuthorityServiceFactory = ({
         tx
       );
 
+      await certificateAuthorityDAL.updateById(ca.id, {
+        status: CaStatus.ACTIVE
+      });
+
       await internalCertificateAuthorityDAL.update(
         {
-          certificateAuthorityId: ca.id
+          caId: ca.id
         },
         {
-          status: CaStatus.ACTIVE,
           maxPathLength: maxPathLength === undefined ? -1 : maxPathLength,
           notBefore: new Date(certObj.notBefore),
           notAfter: new Date(certObj.notAfter),
@@ -1231,10 +1231,10 @@ export const internalCertificateAuthorityServiceFactory = ({
       ProjectPermissionSub.Certificates
     );
 
-    if (ca.internalCa.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.internalCa.activeCaCertId)
       throw new BadRequestError({ message: "CA does not have a certificate installed" });
-    if (ca.disableDirectIssuance && !certificateTemplate) {
+    if (!ca.enableDirectIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
     }
 
@@ -1589,10 +1589,10 @@ export const internalCertificateAuthorityServiceFactory = ({
       );
     }
 
-    if (ca.internalCa.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
+    if (ca.status !== CaStatus.ACTIVE) throw new BadRequestError({ message: "CA is not active" });
     if (!ca.internalCa.activeCaCertId)
       throw new BadRequestError({ message: "CA does not have a certificate installed" });
-    if (ca.disableDirectIssuance && !certificateTemplate) {
+    if (!ca.enableDirectIssuance && !certificateTemplate) {
       throw new BadRequestError({ message: "Certificate template or subscriber is required for issuance" });
     }
 

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

@@ -69,12 +69,14 @@ export type TUpdateCaDTO =
   | {
       isInternal: true;
       caId: string;
+      name?: string;
       status?: CaStatus;
       requireTemplateForIssuance?: boolean;
     }
   | ({
       isInternal: false;
       caId: string;
+      name?: string;
       status?: CaStatus;
       requireTemplateForIssuance?: boolean;
     } & Omit<TProjectPermission, "projectId">);

backend/src/services/certificate-template/certificate-template-dal.ts

@@ -21,7 +21,7 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
         )
         .join(
           TableName.InternalCertificateAuthority,
-          `${TableName.InternalCertificateAuthority}.certificateAuthorityId`,
+          `${TableName.InternalCertificateAuthority}.caId`,
           `${TableName.CertificateAuthority}.id`
         )
         .where(`${TableName.CertificateAuthority}.projectId`, "=", projectId)
@@ -48,7 +48,7 @@ export const certificateTemplateDALFactory = (db: TDbClient) => {
         .join(TableName.Project, `${TableName.Project}.id`, `${TableName.CertificateAuthority}.projectId`)
         .join(
           TableName.InternalCertificateAuthority,
-          `${TableName.InternalCertificateAuthority}.certificateAuthorityId`,
+          `${TableName.InternalCertificateAuthority}.caId`,
           `${TableName.CertificateAuthority}.id`
         )
         .where(`${TableName.CertificateTemplate}.id`, "=", id)

backend/src/services/pki-alert/pki-alert-dal.ts

@@ -37,7 +37,7 @@ export const pkiAlertDALFactory = (db: TDbClient) => {
           "pci.pkiCollectionId"
         )
         .from(`${TableName.CertificateAuthority} as ${PkiItemType.CA}`)
-        .join(`${TableName.InternalCertificateAuthority} as ic`, `${PkiItemType.CA}.id`, "ic.certificateAuthorityId")
+        .join(`${TableName.InternalCertificateAuthority} as ic`, `${PkiItemType.CA}.id`, "ic.caId")
         .join(`${TableName.PkiCollectionItem} as pci`, `${PkiItemType.CA}.id`, "pci.caId")
         .unionAll((qb) => {
           void qb

backend/src/services/pki-collection/pki-collection-item-dal.ts

@@ -44,7 +44,7 @@ export const pkiCollectionItemDALFactory = (db: TDbClient) => {
         .leftJoin(
           TableName.InternalCertificateAuthority,
           `${TableName.PkiCollectionItem}.caId`,
-          `${TableName.InternalCertificateAuthority}.certificateAuthorityId`
+          `${TableName.InternalCertificateAuthority}.caId`
         )
         .leftJoin(TableName.Certificate, `${TableName.PkiCollectionItem}.certId`, `${TableName.Certificate}.id`)
         .where((builder) => {