awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

PKI revamp: UI improvements

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-10 19:49:15 -03:00
parent ef9a1961f1
commit 8905885254
45 changed files with 1156 additions and 2089 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
backend/src/@types/knex.d.ts vendored
View File

@@ -17,9 +17,9 @@ import {
TAccessApprovalRequestsReviewersInsert,
TAccessApprovalRequestsReviewersUpdate,
TAccessApprovalRequestsUpdate,
TApiEnrollmentConfigs,
TApiEnrollmentConfigsInsert,
TApiEnrollmentConfigsUpdate,
TPkiApiEnrollmentConfigs,
TPkiApiEnrollmentConfigsInsert,
TPkiApiEnrollmentConfigsUpdate,
TApiKeys,
TApiKeysInsert,
TApiKeysUpdate,
@@ -80,9 +80,9 @@ import {
TDynamicSecrets,
TDynamicSecretsInsert,
TDynamicSecretsUpdate,
TEstEnrollmentConfigs,
TEstEnrollmentConfigsInsert,
TEstEnrollmentConfigsUpdate,
TPkiEstEnrollmentConfigs,
TPkiEstEnrollmentConfigsInsert,
TPkiEstEnrollmentConfigsUpdate,
TExternalCertificateAuthorities,
TExternalCertificateAuthoritiesInsert,
TExternalCertificateAuthoritiesUpdate,
@@ -678,15 +678,15 @@ declare module "knex/types/tables" {
TCertificateProfilesInsert,
TCertificateProfilesUpdate
>;
[TableName.EstEnrollmentConfig]: KnexOriginal.CompositeTableType<
TEstEnrollmentConfigs,
TEstEnrollmentConfigsInsert,
TEstEnrollmentConfigsUpdate
[TableName.PkiEstEnrollmentConfig]: KnexOriginal.CompositeTableType<
TPkiEstEnrollmentConfigs,
TPkiEstEnrollmentConfigsInsert,
TPkiEstEnrollmentConfigsUpdate
>;
[TableName.ApiEnrollmentConfig]: KnexOriginal.CompositeTableType<
TApiEnrollmentConfigs,
TApiEnrollmentConfigsInsert,
TApiEnrollmentConfigsUpdate
[TableName.PkiApiEnrollmentConfig]: KnexOriginal.CompositeTableType<
TPkiApiEnrollmentConfigs,
TPkiApiEnrollmentConfigsInsert,
TPkiApiEnrollmentConfigsUpdate
>;
[TableName.CertificateTemplateEstConfig]: KnexOriginal.CompositeTableType<
TCertificateTemplateEstConfigs,

39
backend/src/db/migrations/20251007133321_pki-v3-tables.ts
View File

@@ -10,7 +10,7 @@ export async function up(knex: Knex): Promise<void> {
t.string("projectId").notNullable();
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.string("name", 64).notNullable();
t.string("slug").notNullable();
t.string("description");
t.jsonb("attributes");
@@ -22,13 +22,15 @@ export async function up(knex: Knex): Promise<void> {
t.jsonb("keyAlgorithm");
t.timestamps(true, true, true);
t.unique(["slug", "projectId"]);
});
await createOnUpdateTrigger(knex, TableName.CertificateTemplateV2);
}
if (!(await knex.schema.hasTable(TableName.EstEnrollmentConfig))) {
await knex.schema.createTable(TableName.EstEnrollmentConfig, (t) => {
if (!(await knex.schema.hasTable(TableName.PkiEstEnrollmentConfig))) {
await knex.schema.createTable(TableName.PkiEstEnrollmentConfig, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.boolean("disableBootstrapCaValidation").defaultTo(false);
@@ -38,11 +40,11 @@ export async function up(knex: Knex): Promise<void> {
t.timestamps(true, true, true);
});
await createOnUpdateTrigger(knex, TableName.EstEnrollmentConfig);
await createOnUpdateTrigger(knex, TableName.PkiEstEnrollmentConfig);
}
if (!(await knex.schema.hasTable(TableName.ApiEnrollmentConfig))) {
await knex.schema.createTable(TableName.ApiEnrollmentConfig, (t) => {
if (!(await knex.schema.hasTable(TableName.PkiApiEnrollmentConfig))) {
await knex.schema.createTable(TableName.PkiApiEnrollmentConfig, (t) => {
t.uuid("id", { primaryKey: true }).defaultTo(knex.fn.uuid());
t.boolean("autoRenew").defaultTo(false);
@@ -51,7 +53,7 @@ export async function up(knex: Knex): Promise<void> {
t.timestamps(true, true, true);
});
await createOnUpdateTrigger(knex, TableName.ApiEnrollmentConfig);
await createOnUpdateTrigger(knex, TableName.PkiApiEnrollmentConfig);
}
if (!(await knex.schema.hasTable(TableName.CertificateProfile))) {
@@ -61,25 +63,24 @@ export async function up(knex: Knex): Promise<void> {
t.foreign("projectId").references("id").inTable(TableName.Project).onDelete("CASCADE");
t.uuid("caId").notNullable();
t.foreign("caId").references("id").inTable(TableName.CertificateAuthority).onDelete("CASCADE");
t.foreign("caId").references("id").inTable(TableName.CertificateAuthority);
t.uuid("certificateTemplateId").notNullable();
t.foreign("certificateTemplateId").references("id").inTable(TableName.CertificateTemplateV2).onDelete("CASCADE");
t.foreign("certificateTemplateId").references("id").inTable(TableName.CertificateTemplateV2);
t.string("name", 64).notNullable();
t.string("slug").notNullable();
t.string("description");
t.string("enrollmentType").notNullable().checkIn(["api", "est"]);
t.uuid("estConfigId");
t.foreign("estConfigId").references("id").inTable(TableName.EstEnrollmentConfig).onDelete("SET NULL");
t.foreign("estConfigId").references("id").inTable(TableName.PkiEstEnrollmentConfig).onDelete("SET NULL");
t.uuid("apiConfigId");
t.foreign("apiConfigId").references("id").inTable(TableName.ApiEnrollmentConfig).onDelete("SET NULL");
t.foreign("apiConfigId").references("id").inTable(TableName.PkiApiEnrollmentConfig).onDelete("SET NULL");
t.timestamps(true, true, true);
t.unique(["slug", "projectId"], { indexName: "certificate_profiles_slug_project_id_unique" });
t.unique(["slug", "projectId"]);
});
await createOnUpdateTrigger(knex, TableName.CertificateProfile);
@@ -89,7 +90,7 @@ export async function up(knex: Knex): Promise<void> {
await knex.schema.alterTable(TableName.Certificate, (t) => {
t.uuid("profileId");
t.foreign("profileId").references("id").inTable(TableName.CertificateProfile).onDelete("SET NULL");
t.index("profileId", "idx_certificates_profile_id");
t.index("profileId");
});
}
}
@@ -98,7 +99,7 @@ export async function down(knex: Knex): Promise<void> {
if (await knex.schema.hasColumn(TableName.Certificate, "profileId")) {
await knex.schema.alterTable(TableName.Certificate, (t) => {
t.dropForeign(["profileId"]);
t.dropIndex("profileId", "idx_certificates_profile_id");
t.dropIndex("profileId");
t.dropColumn("profileId");
});
}
@@ -106,11 +107,11 @@ export async function down(knex: Knex): Promise<void> {
await knex.schema.dropTableIfExists(TableName.CertificateProfile);
await dropOnUpdateTrigger(knex, TableName.CertificateProfile);
await knex.schema.dropTableIfExists(TableName.ApiEnrollmentConfig);
await dropOnUpdateTrigger(knex, TableName.ApiEnrollmentConfig);
await knex.schema.dropTableIfExists(TableName.PkiApiEnrollmentConfig);
await dropOnUpdateTrigger(knex, TableName.PkiApiEnrollmentConfig);
await knex.schema.dropTableIfExists(TableName.EstEnrollmentConfig);
await dropOnUpdateTrigger(knex, TableName.EstEnrollmentConfig);
await knex.schema.dropTableIfExists(TableName.PkiEstEnrollmentConfig);
await dropOnUpdateTrigger(knex, TableName.PkiEstEnrollmentConfig);
await knex.schema.dropTableIfExists(TableName.CertificateTemplateV2);
await dropOnUpdateTrigger(knex, TableName.CertificateTemplateV2);

1
backend/src/db/schemas/certificate-profiles.ts
View File

@@ -12,7 +12,6 @@ export const CertificateProfilesSchema = z.object({
projectId: z.string(),
caId: z.string().uuid(),
certificateTemplateId: z.string().uuid(),
name: z.string(),
slug: z.string(),
description: z.string().nullable().optional(),
enrollmentType: z.string(),

2
backend/src/db/schemas/certificate-templates-v2.ts
View File

@@ -10,7 +10,7 @@ import { TImmutableDBKeys } from "./models";
export const CertificateTemplatesV2Schema = z.object({
id: z.string().uuid(),
projectId: z.string(),
name: z.string(),
slug: z.string(),
description: z.string().nullable().optional(),
attributes: z.unknown().nullable().optional(),
keyUsages: z.unknown().nullable().optional(),

4
backend/src/db/schemas/index.ts
View File

@@ -3,7 +3,6 @@ export * from "./access-approval-policies-approvers";
export * from "./access-approval-policies-bypassers";
export * from "./access-approval-requests";
export * from "./access-approval-requests-reviewers";
export * from "./api-enrollment-configs";
export * from "./api-keys";
export * from "./app-connections";
export * from "./audit-log-streams";
@@ -24,7 +23,6 @@ export * from "./certificate-templates-v2";
export * from "./certificates";
export * from "./dynamic-secret-leases";
export * from "./dynamic-secrets";
export * from "./est-enrollment-configs";
export * from "./external-certificate-authorities";
export * from "./external-group-org-role-mappings";
export * from "./external-kms";
@@ -92,8 +90,10 @@ export * from "./pam-folders";
export * from "./pam-resources";
export * from "./pam-sessions";
export * from "./pki-alerts";
export * from "./pki-api-enrollment-configs";
export * from "./pki-collection-items";
export * from "./pki-collections";
export * from "./pki-est-enrollment-configs";
export * from "./pki-subscribers";
export * from "./pki-syncs";
export * from "./project-bots";

4
backend/src/db/schemas/models.ts
View File

@@ -25,8 +25,8 @@ export enum TableName {
CertificateTemplate = "certificate_templates",
CertificateTemplateV2 = "certificate_templates_v2",
CertificateProfile = "certificate_profiles",
EstEnrollmentConfig = "est_enrollment_configs",
ApiEnrollmentConfig = "api_enrollment_configs",
PkiEstEnrollmentConfig = "pki_est_enrollment_configs",
PkiApiEnrollmentConfig = "pki_api_enrollment_configs",
PkiSubscriber = "pki_subscribers",
PkiAlert = "pki_alerts",
PkiCollection = "pki_collections",

10
backend/src/db/schemas/api-enrollment-configs.ts → backend/src/db/schemas/pki-api-enrollment-configs.ts
View File

@@ -7,7 +7,7 @@ import { z } from "zod";
import { TImmutableDBKeys } from "./models";
export const ApiEnrollmentConfigsSchema = z.object({
export const PkiApiEnrollmentConfigsSchema = z.object({
id: z.string().uuid(),
autoRenew: z.boolean().default(false).nullable().optional(),
autoRenewDays: z.number().nullable().optional(),
@@ -15,6 +15,8 @@ export const ApiEnrollmentConfigsSchema = z.object({
updatedAt: z.date()
});
export type TApiEnrollmentConfigs = z.infer<typeof ApiEnrollmentConfigsSchema>;
export type TApiEnrollmentConfigsInsert = Omit<z.input<typeof ApiEnrollmentConfigsSchema>, TImmutableDBKeys>;
export type TApiEnrollmentConfigsUpdate = Partial<Omit<z.input<typeof ApiEnrollmentConfigsSchema>, TImmutableDBKeys>>;
export type TPkiApiEnrollmentConfigs = z.infer<typeof PkiApiEnrollmentConfigsSchema>;
export type TPkiApiEnrollmentConfigsInsert = Omit<z.input<typeof PkiApiEnrollmentConfigsSchema>, TImmutableDBKeys>;
export type TPkiApiEnrollmentConfigsUpdate = Partial<
Omit<z.input<typeof PkiApiEnrollmentConfigsSchema>, TImmutableDBKeys>
>;

10
backend/src/db/schemas/est-enrollment-configs.ts → backend/src/db/schemas/pki-est-enrollment-configs.ts
View File

@@ -9,7 +9,7 @@ import { zodBuffer } from "@app/lib/zod";
import { TImmutableDBKeys } from "./models";
export const EstEnrollmentConfigsSchema = z.object({
export const PkiEstEnrollmentConfigsSchema = z.object({
id: z.string().uuid(),
disableBootstrapCaValidation: z.boolean().default(false).nullable().optional(),
hashedPassphrase: z.string(),
@@ -18,6 +18,8 @@ export const EstEnrollmentConfigsSchema = z.object({
updatedAt: z.date()
});
export type TEstEnrollmentConfigs = z.infer<typeof EstEnrollmentConfigsSchema>;
export type TEstEnrollmentConfigsInsert = Omit<z.input<typeof EstEnrollmentConfigsSchema>, TImmutableDBKeys>;
export type TEstEnrollmentConfigsUpdate = Partial<Omit<z.input<typeof EstEnrollmentConfigsSchema>, TImmutableDBKeys>>;
export type TPkiEstEnrollmentConfigs = z.infer<typeof PkiEstEnrollmentConfigsSchema>;
export type TPkiEstEnrollmentConfigsInsert = Omit<z.input<typeof PkiEstEnrollmentConfigsSchema>, TImmutableDBKeys>;
export type TPkiEstEnrollmentConfigsUpdate = Partial<
Omit<z.input<typeof PkiEstEnrollmentConfigsSchema>, TImmutableDBKeys>
>;

84
backend/src/ee/services/audit-log/audit-log-types.ts
View File

@@ -352,14 +352,10 @@ export enum EventType {
UPDATE_CERTIFICATE_TEMPLATE = "update-certificate-template",
DELETE_CERTIFICATE_TEMPLATE = "delete-certificate-template",
GET_CERTIFICATE_TEMPLATE = "get-certificate-template",
LIST_CERTIFICATE_TEMPLATES = "list-certificate-templates",
CREATE_CERTIFICATE_TEMPLATE_EST_CONFIG = "create-certificate-template-est-config",
UPDATE_CERTIFICATE_TEMPLATE_EST_CONFIG = "update-certificate-template-est-config",
GET_CERTIFICATE_TEMPLATE_EST_CONFIG = "get-certificate-template-est-config",
CREATE_CERTIFICATE_TEMPLATE_V2 = "create-certificate-template-v2",
UPDATE_CERTIFICATE_TEMPLATE_V2 = "update-certificate-template-v2",
DELETE_CERTIFICATE_TEMPLATE_V2 = "delete-certificate-template-v2",
GET_CERTIFICATE_TEMPLATE_V2 = "get-certificate-template-v2",
LIST_CERTIFICATE_TEMPLATES_V2 = "list-certificate-templates-v2",
CREATE_CERTIFICATE_PROFILE = "create-certificate-profile",
UPDATE_CERTIFICATE_PROFILE = "update-certificate-profile",
DELETE_CERTIFICATE_PROFILE = "delete-certificate-profile",
@@ -2525,46 +2521,6 @@ interface LoadProjectKmsBackupEvent {
metadata: Record<string, string>; // no metadata yet
}
interface CreateCertificateTemplate {
type: EventType.CREATE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
caId: string;
pkiCollectionId?: string;
name: string;
commonName: string;
subjectAlternativeName: string;
ttl: string;
};
}
interface GetCertificateTemplate {
type: EventType.GET_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
};
}
interface UpdateCertificateTemplate {
type: EventType.UPDATE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
caId: string;
pkiCollectionId?: string;
name: string;
commonName: string;
subjectAlternativeName: string;
ttl: string;
};
}
interface DeleteCertificateTemplate {
type: EventType.DELETE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
};
}
interface OrgAdminAccessProjectEvent {
type: EventType.ORG_ADMIN_ACCESS_PROJECT;
metadata: {
@@ -2611,8 +2567,8 @@ interface GetCertificateTemplateEstConfig {
};
}
interface CreateCertificateTemplateV2 {
type: EventType.CREATE_CERTIFICATE_TEMPLATE_V2;
interface CreateCertificateTemplate {
type: EventType.CREATE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
name: string;
@@ -2620,30 +2576,32 @@ interface CreateCertificateTemplateV2 {
};
}
interface UpdateCertificateTemplateV2 {
type: EventType.UPDATE_CERTIFICATE_TEMPLATE_V2;
interface UpdateCertificateTemplate {
type: EventType.UPDATE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
name: string;
};
}
interface DeleteCertificateTemplateV2 {
type: EventType.DELETE_CERTIFICATE_TEMPLATE_V2;
interface DeleteCertificateTemplate {
type: EventType.DELETE_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
name: string;
};
}
interface GetCertificateTemplateV2 {
type: EventType.GET_CERTIFICATE_TEMPLATE_V2;
interface GetCertificateTemplate {
type: EventType.GET_CERTIFICATE_TEMPLATE;
metadata: {
certificateTemplateId: string;
name: string;
};
}
interface ListCertificateTemplatesV2 {
type: EventType.LIST_CERTIFICATE_TEMPLATES_V2;
interface ListCertificateTemplates {
type: EventType.LIST_CERTIFICATE_TEMPLATES;
metadata: {
projectId: string;
};
@@ -2710,7 +2668,7 @@ interface OrderCertificateFromProfile {
metadata: {
certificateProfileId: string;
orderId: string;
identifiers: string[];
subjectAlternativeNames: string[];
};
}
@@ -4167,18 +4125,14 @@ export type Event =
| LoadProjectKmsBackupEvent
| OrgAdminAccessProjectEvent
| OrgAdminBypassSSOEvent
| CreateCertificateTemplate
| UpdateCertificateTemplate
| GetCertificateTemplate
| DeleteCertificateTemplate
| CreateCertificateTemplateEstConfig
| UpdateCertificateTemplateEstConfig
| GetCertificateTemplateEstConfig
| CreateCertificateTemplateV2
| UpdateCertificateTemplateV2
| DeleteCertificateTemplateV2
| GetCertificateTemplateV2
| ListCertificateTemplatesV2
| CreateCertificateTemplate
| UpdateCertificateTemplate
| DeleteCertificateTemplate
| GetCertificateTemplate
| ListCertificateTemplates
| CreateCertificateProfile
| UpdateCertificateProfile
| DeleteCertificateProfile

1
backend/src/ee/services/permission/default-roles.ts
View File

@@ -455,6 +455,7 @@ const buildMemberPermissionRules = () => {
// double check if all CRUD are needed for CA and Certificates
can([ProjectPermissionActions.Read], ProjectPermissionSub.CertificateAuthorities);
can([ProjectPermissionPkiTemplateActions.Read], ProjectPermissionSub.CertificateTemplates);
can(
[

17
backend/src/server/routes/v1/certificate-profiles-router.ts
View File

@@ -9,7 +9,6 @@ import { AuthMode } from "@app/services/auth/auth-type";
import {
createCertificateProfileSchema,
deleteCertificateProfileSchema,
getCertificateProfileByIdSchema,
listCertificateProfilesSchema,
updateCertificateProfileSchema
} from "@app/services/certificate-profile/certificate-profile-schemas";
@@ -49,7 +48,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
type: EventType.CREATE_CERTIFICATE_PROFILE,
metadata: {
certificateProfileId: certificateProfile.id,
name: certificateProfile.name,
name: certificateProfile.slug,
projectId: certificateProfile.projectId,
enrollmentType: certificateProfile.enrollmentType
}
@@ -125,7 +124,9 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
schema: {
hide: false,
tags: [ApiDocsTags.PkiCertificateProfiles],
params: getCertificateProfileByIdSchema,
params: z.object({
id: z.string().min(1)
}),
querystring: z.object({
includeMetrics: z.coerce.boolean().optional().default(false),
expiringDays: z.coerce.number().min(1).max(365).optional().default(7)
@@ -262,7 +263,9 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
schema: {
hide: false,
tags: [ApiDocsTags.PkiCertificateProfiles],
params: getCertificateProfileByIdSchema,
params: z.object({
id: z.string().min(1)
}),
body: updateCertificateProfileSchema,
response: {
200: z.object({
@@ -288,7 +291,7 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
type: EventType.UPDATE_CERTIFICATE_PROFILE,
metadata: {
certificateProfileId: certificateProfile.id,
name: certificateProfile.name
name: certificateProfile.slug
}
}
});
@@ -347,7 +350,9 @@ export const registerCertificateProfilesRouter = async (server: FastifyZodProvid
schema: {
hide: false,
tags: [ApiDocsTags.PkiCertificateProfiles],
params: getCertificateProfileByIdSchema,
params: z.object({
id: z.string().min(1)
}),
querystring: z.object({
offset: z.number().min(0).default(0),
limit: z.number().min(1).max(100).default(20),

19
backend/src/server/routes/v1/certificate-template-router.ts
View File

@@ -52,7 +52,8 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
event: {
type: EventType.GET_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.name
}
}
});
@@ -116,12 +117,8 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
type: EventType.CREATE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id,
caId: certificateTemplate.caId,
pkiCollectionId: certificateTemplate.pkiCollectionId as string,
name: certificateTemplate.name,
commonName: certificateTemplate.commonName,
subjectAlternativeName: certificateTemplate.subjectAlternativeName,
ttl: certificateTemplate.ttl
projectId: certificateTemplate.projectId
}
}
});
@@ -184,12 +181,7 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
type: EventType.UPDATE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id,
caId: certificateTemplate.caId,
pkiCollectionId: certificateTemplate.pkiCollectionId as string,
name: certificateTemplate.name,
commonName: certificateTemplate.commonName,
subjectAlternativeName: certificateTemplate.subjectAlternativeName,
ttl: certificateTemplate.ttl
name: certificateTemplate.name
}
}
});
@@ -230,7 +222,8 @@ export const registerCertificateTemplateRouter = async (server: FastifyZodProvid
event: {
type: EventType.DELETE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.name
}
}
});

20
backend/src/server/routes/v2/certificate-templates-v2-router.ts
View File

@@ -48,10 +48,10 @@ export const registerCertificateTemplatesV2Router = async (server: FastifyZodPro
...req.auditLogInfo,
projectId,
event: {
type: EventType.CREATE_CERTIFICATE_TEMPLATE_V2,
type: EventType.CREATE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.name,
name: certificateTemplate.slug,
projectId: certificateTemplate.projectId
}
}
@@ -92,7 +92,7 @@ export const registerCertificateTemplatesV2Router = async (server: FastifyZodPro
...req.auditLogInfo,
projectId: req.query.projectId,
event: {
type: EventType.LIST_CERTIFICATE_TEMPLATES_V2,
type: EventType.LIST_CERTIFICATE_TEMPLATES,
metadata: {
projectId: req.query.projectId
}
@@ -133,9 +133,10 @@ export const registerCertificateTemplatesV2Router = async (server: FastifyZodPro
...req.auditLogInfo,
projectId: certificateTemplate.projectId,
event: {
type: EventType.GET_CERTIFICATE_TEMPLATE_V2,
type: EventType.GET_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.slug
}
}
});
@@ -176,10 +177,10 @@ export const registerCertificateTemplatesV2Router = async (server: FastifyZodPro
...req.auditLogInfo,
projectId: certificateTemplate.projectId,
event: {
type: EventType.UPDATE_CERTIFICATE_TEMPLATE_V2,
type: EventType.UPDATE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.name
name: certificateTemplate.slug
}
}
});
@@ -218,9 +219,10 @@ export const registerCertificateTemplatesV2Router = async (server: FastifyZodPro
...req.auditLogInfo,
projectId: certificateTemplate.projectId,
event: {
type: EventType.DELETE_CERTIFICATE_TEMPLATE_V2,
type: EventType.DELETE_CERTIFICATE_TEMPLATE,
metadata: {
certificateTemplateId: certificateTemplate.id
certificateTemplateId: certificateTemplate.id,
name: certificateTemplate.slug
}
}
});

8
backend/src/server/routes/v3/certificates-router.ts
View File

@@ -196,7 +196,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
tags: [ApiDocsTags.PkiCertificates],
body: z.object({
profileId: z.string().uuid(),
identifiers: z
subjectAlternativeNames: z
.array(
z.object({
type: z.enum(["dns", "ip"]),
@@ -217,7 +217,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
200: z.object({
orderId: z.string(),
status: z.enum(["pending", "processing", "valid", "invalid"]),
identifiers: z.array(
subjectAlternativeNames: z.array(
z.object({
type: z.enum(["dns", "ip"]),
value: z.string(),
@@ -256,7 +256,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
actorOrgId: req.permission.orgId,
profileId: req.body.profileId,
certificateOrder: {
identifiers: req.body.identifiers,
subjectAlternativeNames: req.body.subjectAlternativeNames,
validity: {
ttl: req.body.ttl
},
@@ -286,7 +286,7 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
metadata: {
certificateProfileId: req.body.profileId,
orderId: data.orderId,
identifiers: req.body.identifiers.map((id) => `${id.type}:${id.value}`)
subjectAlternativeNames: req.body.subjectAlternativeNames.map((san) => `${san.type}:${san.value}`)
}
}
});

44
backend/src/services/certificate-profile/certificate-profile-dal.ts
View File

@@ -68,18 +68,24 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
(tx || db).ref("name").withSchema(TableName.CertificateAuthority).as("caName"),
(tx || db).ref("id").withSchema(TableName.CertificateTemplateV2).as("templateId"),
(tx || db).ref("projectId").withSchema(TableName.CertificateTemplateV2).as("templateProjectId"),
(tx || db).ref("name").withSchema(TableName.CertificateTemplateV2).as("templateName"),
(tx || db).ref("slug").withSchema(TableName.CertificateTemplateV2).as("templateName"),
(tx || db).ref("description").withSchema(TableName.CertificateTemplateV2).as("templateDescription"),
(tx || db).ref("id").withSchema(TableName.EstEnrollmentConfig).as("estConfigId"),
(tx || db).ref("id").withSchema(TableName.PkiEstEnrollmentConfig).as("estConfigId"),
(tx || db)
.ref("disableBootstrapCaValidation")
.withSchema(TableName.EstEnrollmentConfig)
.withSchema(TableName.PkiEstEnrollmentConfig)
.as("estConfigDisableBootstrapCaValidation"),
(tx || db).ref("hashedPassphrase").withSchema(TableName.EstEnrollmentConfig).as("estConfigHashedPassphrase"),
(tx || db).ref("encryptedCaChain").withSchema(TableName.EstEnrollmentConfig).as("estConfigEncryptedCaChain"),
(tx || db).ref("id").withSchema(TableName.ApiEnrollmentConfig).as("apiConfigId"),
(tx || db).ref("autoRenew").withSchema(TableName.ApiEnrollmentConfig).as("apiConfigAutoRenew"),
(tx || db).ref("autoRenewDays").withSchema(TableName.ApiEnrollmentConfig).as("apiConfigAutoRenewDays")
(tx || db)
.ref("hashedPassphrase")
.withSchema(TableName.PkiEstEnrollmentConfig)
.as("estConfigHashedPassphrase"),
(tx || db)
.ref("encryptedCaChain")
.withSchema(TableName.PkiEstEnrollmentConfig)
.as("estConfigEncryptedCaChain"),
(tx || db).ref("id").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigId"),
(tx || db).ref("autoRenew").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigAutoRenew"),
(tx || db).ref("autoRenewDays").withSchema(TableName.PkiApiEnrollmentConfig).as("apiConfigAutoRenewDays")
)
.leftJoin(
TableName.CertificateAuthority,
@@ -92,14 +98,14 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
`${TableName.CertificateTemplateV2}.id`
)
.leftJoin(
TableName.EstEnrollmentConfig,
TableName.PkiEstEnrollmentConfig,
`${TableName.CertificateProfile}.estConfigId`,
`${TableName.EstEnrollmentConfig}.id`
`${TableName.PkiEstEnrollmentConfig}.id`
)
.leftJoin(
TableName.ApiEnrollmentConfig,
TableName.PkiApiEnrollmentConfig,
`${TableName.CertificateProfile}.apiConfigId`,
`${TableName.ApiEnrollmentConfig}.id`
`${TableName.PkiApiEnrollmentConfig}.id`
)
.where(`${TableName.CertificateProfile}.id`, id)
.first();
@@ -151,9 +157,8 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
if (search) {
query = query.where((builder) => {
void builder
.whereILike(`${TableName.CertificateProfile}.name`, `%${search}%`)
.orWhereILike(`${TableName.CertificateProfile}.description`, `%${search}%`)
.orWhereILike(`${TableName.CertificateProfile}.slug`, `%${search}%`);
.whereILike(`${TableName.CertificateProfile}.slug`, `%${search}%`)
.orWhereILike(`${TableName.CertificateProfile}.description`, `%${search}%`);
});
}
@@ -225,10 +230,7 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
if (search) {
query = query.where((builder) => {
void builder
.whereILike("name", `%${search}%`)
.orWhereILike("description", `%${search}%`)
.orWhereILike("slug", `%${search}%`);
void builder.orWhereILike("description", `%${search}%`).orWhereILike("slug", `%${search}%`);
});
}
@@ -249,7 +251,9 @@ export const certificateProfileDALFactory = (db: TDbClient) => {
const findByNameAndProjectId = async (name: string, projectId: string, tx?: Knex) => {
try {
const certificateProfile = await (tx || db)(TableName.CertificateProfile).where({ name, projectId }).first();
const certificateProfile = await (tx || db)(TableName.CertificateProfile)
.where({ slug: name, projectId })
.first();
return certificateProfile;
} catch (error) {
throw new DatabaseError({ error, name: "Find certificate profile by name and project id" });

2
backend/src/services/certificate-profile/certificate-profile-schemas.ts
View File

@@ -8,7 +8,6 @@ export const createCertificateProfileSchema = z
projectId: z.string().min(1),
caId: z.string().uuid(),
certificateTemplateId: z.string().uuid(),
name: z.string().min(1).max(255),
slug: z
.string()
.min(1)
@@ -46,7 +45,6 @@ export const createCertificateProfileSchema = z
);
export const updateCertificateProfileSchema = z.object({
name: z.string().min(1).max(255).optional(),
slug: z
.string()
.min(1)

40
backend/src/services/certificate-profile/certificate-profile-service.test.ts
View File

@@ -80,7 +80,6 @@ describe("CertificateProfileService", () => {
const sampleProfile: TCertificateProfile = {
id: "profile-123",
projectId: "project-123",
name: "Test Profile",
description: "Test certificate profile",
slug: "test-profile",
enrollmentType: EnrollmentType.API,
@@ -174,9 +173,8 @@ describe("CertificateProfileService", () => {
describe("createProfile", () => {
const validProfileData = {
name: "New Profile",
description: "New test profile",
slug: "new-profile",
description: "New test profile",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -204,9 +202,8 @@ describe("CertificateProfileService", () => {
expect(mockCertificateTemplateV2DAL.findById).toHaveBeenCalledWith("template-123");
expect(mockCertificateProfileDAL.findBySlugAndProjectId).toHaveBeenCalledWith("new-profile", "project-123");
expect(mockCertificateProfileDAL.create).toHaveBeenCalledWith({
name: "New Profile",
description: "New test profile",
slug: "new-profile",
description: "New test profile",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -273,9 +270,8 @@ describe("CertificateProfileService", () => {
it("should throw ForbiddenRequestError for API enrollment without API config", async () => {
const invalidData = {
name: "Invalid Profile",
description: "Invalid test profile",
slug: "invalid-profile",
description: "Invalid test profile",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123"
@@ -292,9 +288,8 @@ describe("CertificateProfileService", () => {
it("should create profile with API enrollment", async () => {
const apiProfileData = {
name: "API Profile",
description: "Profile with API enrollment",
slug: "api-profile",
description: "Profile with API enrollment",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -317,7 +312,7 @@ describe("CertificateProfileService", () => {
describe("updateProfile", () => {
const updateData = {
name: "Updated Profile",
slug: "updated-profile",
description: "Updated description"
};
@@ -333,7 +328,7 @@ describe("CertificateProfileService", () => {
data: updateData
});
expect(result.name).toBe("Updated Profile");
expect(result.slug).toBe("updated-profile");
expect(mockCertificateProfileDAL.findById).toHaveBeenCalledWith("profile-123");
expect(mockCertificateProfileDAL.updateById).toHaveBeenCalledWith("profile-123", updateData);
});
@@ -697,9 +692,8 @@ describe("CertificateProfileService", () => {
describe("profile configuration validation", () => {
it("should validate EST enrollment configuration", async () => {
const estProfileData = {
name: "EST Profile",
description: "Profile with EST enrollment",
slug: "est-profile",
description: "Profile with EST enrollment",
enrollmentType: EnrollmentType.EST,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -737,9 +731,8 @@ describe("CertificateProfileService", () => {
vi.clearAllMocks();
const duplicateSlugData = {
name: "Different Profile Name",
slug: "different-profile-name",
description: "Profile with duplicate slug",
slug: "test-profile",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -763,9 +756,8 @@ describe("CertificateProfileService", () => {
it("should validate auto-renewal configuration", async () => {
const autoRenewData = {
name: "Auto Renew Profile",
slug: "auto-renew-profile",
description: "Profile with auto-renewal",
slug: "auto-renew",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -987,9 +979,8 @@ describe("CertificateProfileService", () => {
it("should handle invalid template reference during profile creation", async () => {
const profileData = {
name: "Invalid Template Profile",
slug: "invalid-template-profile",
description: "Profile with invalid template",
slug: "invalid-template",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "nonexistent-template",
@@ -1013,9 +1004,8 @@ describe("CertificateProfileService", () => {
it("should handle concurrent profile creation conflicts", async () => {
const conflictingData = {
name: "Concurrent Profile",
description: "Profile created concurrently",
slug: "concurrent-profile",
description: "Profile created concurrently",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",
@@ -1042,9 +1032,8 @@ describe("CertificateProfileService", () => {
describe("permission and security", () => {
it("should validate project ownership for cross-project template access", async () => {
const crossProjectData = {
name: "Cross Project Profile",
slug: "cross-project-profile",
description: "Profile using template from different project",
slug: "cross-project",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-456",
@@ -1056,7 +1045,7 @@ describe("CertificateProfileService", () => {
const foreignTemplate = {
id: "template-456",
projectId: "different-project-456",
name: "Foreign Template"
slug: "foreign-template"
};
(mockCertificateTemplateV2DAL.findById as any).mockResolvedValue(foreignTemplate);
@@ -1072,9 +1061,8 @@ describe("CertificateProfileService", () => {
it("should validate slug format constraints", async () => {
const invalidSlugData = {
name: "Invalid Slug Profile",
slug: "invalid-slug-profile",
description: "Profile with invalid slug format",
slug: "Invalid_Slug_With_Underscores_And_Caps",
enrollmentType: EnrollmentType.API,
caId: "ca-123",
certificateTemplateId: "template-123",

23
backend/src/services/certificate-profile/certificate-profile-service.ts
View File

@@ -277,7 +277,28 @@ export const certificateProfileServiceFactory = ({
});
}
const updatedProfile = await certificateProfileDAL.updateById(profileId, data);
const { estConfig, apiConfig, ...profileUpdateData } = data;
if (estConfig && existingProfile.estConfigId) {
await estEnrollmentConfigDAL.updateById(existingProfile.estConfigId, {
disableBootstrapCaValidation: estConfig.disableBootstrapCaValidation,
...(estConfig.passphrase && {
hashedPassphrase: await crypto.hashing().createHash(estConfig.passphrase, getConfig().SALT_ROUNDS)
}),
...(estConfig.caChain && {
encryptedCaChain: Buffer.from(estConfig.caChain, "base64")
})
});
}
if (apiConfig && existingProfile.apiConfigId) {
await apiEnrollmentConfigDAL.updateById(existingProfile.apiConfigId, {
autoRenew: apiConfig.autoRenew,
autoRenewDays: apiConfig.autoRenewDays
});
}
const updatedProfile = await certificateProfileDAL.updateById(profileId, profileUpdateData);
return convertDalToService(updatedProfile);
};

9
backend/src/services/certificate-profile/certificate-profile-types.ts
View File

@@ -19,6 +19,15 @@ export type TCertificateProfileInsert = Omit<TCertificateProfilesInsert, "enroll
export type TCertificateProfileUpdate = Omit<TCertificateProfilesUpdate, "enrollmentType"> & {
enrollmentType?: EnrollmentType;
estConfig?: {
disableBootstrapCaValidation?: boolean;
passphrase?: string;
caChain?: string;
};
apiConfig?: {
autoRenew?: boolean;
autoRenewDays?: number;
};
};
export type TCertificateProfileWithConfigs = TCertificateProfile & {

12
backend/src/services/certificate-template-v2/certificate-template-v2-dal.ts
View File

@@ -139,7 +139,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
if (search) {
query = query.where((builder) => {
void builder.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
void builder.whereILike("slug", `%${search}%`).orWhereILike("description", `%${search}%`);
});
}
@@ -165,7 +165,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
if (search) {
query = query.where((builder) => {
void builder.whereILike("name", `%${search}%`).orWhereILike("description", `%${search}%`);
void builder.whereILike("slug", `%${search}%`).orWhereILike("description", `%${search}%`);
});
}
@@ -176,10 +176,10 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
}
};
const findByNameAndProjectId = async (name: string, projectId: string, tx?: Knex) => {
const findBySlugAndProjectId = async (slug: string, projectId: string, tx?: Knex) => {
try {
const certificateTemplateV2 = await (tx || db)(TableName.CertificateTemplateV2)
.where({ name, projectId })
.where({ slug, projectId })
.first();
if (!certificateTemplateV2) {
@@ -188,7 +188,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
return parseJsonFields(certificateTemplateV2);
} catch (error) {
throw new DatabaseError({ error, name: "Find certificate template v2 by name and project id" });
throw new DatabaseError({ error, name: "Find certificate template v2 by slug and project id" });
}
};
@@ -213,7 +213,7 @@ export const certificateTemplateV2DALFactory = (db: TDbClient) => {
findById,
findByProjectId,
countByProjectId,
findByNameAndProjectId,
findBySlugAndProjectId,
isTemplateInUse
};
};

19
backend/src/services/certificate-template-v2/certificate-template-v2-schemas.ts
View File

@@ -1,3 +1,4 @@
import RE2 from "re2";
import { z } from "zod";
const attributeTypeSchema = z.enum(["common_name"]);
@@ -87,7 +88,11 @@ export const templateV2KeyAlgorithmSchema = z.object({
export const createCertificateTemplateV2Schema = z.object({
projectId: z.string().min(1),
name: z.string().min(1).max(255),
slug: z
.string()
.min(1)
.max(255)
.regex(new RE2("^[a-z0-9-]+$"), "Slug must contain only lowercase letters, numbers, and hyphens"),
description: z.string().max(1000).optional(),
attributes: z.array(templateV2AttributeSchema).optional(),
keyUsages: templateV2KeyUsagesSchema.optional(),
@@ -99,7 +104,12 @@ export const createCertificateTemplateV2Schema = z.object({
});
export const updateCertificateTemplateV2Schema = z.object({
name: z.string().min(1).max(255).optional(),
slug: z
.string()
.min(1)
.max(255)
.regex(new RE2("^[a-z0-9-]+$"), "Slug must contain only lowercase letters, numbers, and hyphens")
.optional(),
description: z.string().max(1000).optional(),
attributes: z.array(templateV2AttributeSchema).optional(),
keyUsages: templateV2KeyUsagesSchema.optional(),
@@ -114,6 +124,11 @@ export const getCertificateTemplateV2ByIdSchema = z.object({
id: z.string().uuid()
});
export const getCertificateTemplateV2BySlugSchema = z.object({
projectId: z.string().min(1),
slug: z.string().min(1)
});
export const listCertificateTemplatesV2Schema = z.object({
projectId: z.string().min(1),
offset: z.coerce.number().min(0).default(0),

10
backend/src/services/certificate-template-v2/certificate-template-v2-service.test.ts
View File

@@ -27,6 +27,7 @@ describe("CertificateTemplateV2Service", () => {
let service: TCertificateTemplateV2ServiceFactory;
const mockCertificateTemplateV2DAL = {
findBySlugAndProjectId: vi.fn(),
create: vi.fn(),
findById: vi.fn(),
updateById: vi.fn(),
@@ -99,7 +100,7 @@ describe("CertificateTemplateV2Service", () => {
const sampleTemplate: TCertificateTemplateV2 = {
id: "template-123",
projectId: "project-123",
name: "Web Server Template",
slug: "web-server-template",
description: "Template for web server certificates",
...samplePolicy,
createdAt: new Date(),
@@ -136,6 +137,7 @@ describe("CertificateTemplateV2Service", () => {
});
mockCertificateTemplateV2DAL.findByNameAndProjectId.mockResolvedValue(null);
mockCertificateTemplateV2DAL.findBySlugAndProjectId.mockResolvedValue(null);
service = certificateTemplateV2ServiceFactory({
certificateTemplateV2DAL: mockCertificateTemplateV2DAL as TCertificateTemplateV2DALFactory,
@@ -149,7 +151,7 @@ describe("CertificateTemplateV2Service", () => {
describe("createTemplateV2", () => {
const createData: Omit<TCertificateTemplateV2Insert, "projectId"> = {
name: "Test Template",
slug: "test-template",
description: "Test description",
...samplePolicy
};
@@ -239,7 +241,7 @@ describe("CertificateTemplateV2Service", () => {
describe("updateTemplateV2", () => {
it("should update template with valid data", async () => {
const updateData = { name: "Updated Template Name" };
const updateData = { slug: "updated-template-name" };
const updatedTemplate = { ...sampleTemplate, ...updateData };
mockCertificateTemplateV2DAL.findById.mockResolvedValue(sampleTemplate);
@@ -263,7 +265,7 @@ describe("CertificateTemplateV2Service", () => {
service.updateTemplateV2({
...mockActor,
templateId: "nonexistent-template",
data: { name: "Updated Name" }
data: { slug: "updated-name" }
})
).rejects.toThrow(NotFoundError);
});

74
backend/src/services/certificate-template-v2/certificate-template-v2-service.ts
View File

@@ -1,4 +1,5 @@
import { ForbiddenError } from "@casl/ability";
import slugify from "@sindresorhus/slugify";
import RE2 from "re2";
import { ActionProjectType } from "@app/db/schemas";
@@ -8,6 +9,7 @@ import {
ProjectPermissionSub
} from "@app/ee/services/permission/project-permission";
import { ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { alphaNumericNanoId } from "@app/lib/nanoid";
import { ActorAuthMethod, ActorType } from "../auth/auth-type";
import { TCertificateTemplateV2DALFactory } from "./certificate-template-v2-dal";
@@ -115,6 +117,28 @@ export const certificateTemplateV2ServiceFactory = ({
);
};
const generateTemplateSlug = (baseSlug?: string): string => {
if (baseSlug) {
return slugify(baseSlug);
}
return slugify(alphaNumericNanoId(12));
};
const ensureUniqueSlug = async (projectId: string, desiredSlug: string, templateId?: string): Promise<string> => {
const existingTemplate = await certificateTemplateV2DAL.findBySlugAndProjectId(desiredSlug, projectId);
if (!existingTemplate || (templateId && existingTemplate.id === templateId)) {
return desiredSlug;
}
const alternativeSlug = `${desiredSlug}-${alphaNumericNanoId(8)}`;
const existingAlternative = await certificateTemplateV2DAL.findBySlugAndProjectId(alternativeSlug, projectId);
if (!existingAlternative) {
return alternativeSlug;
}
const randomSlug = slugify(alphaNumericNanoId(12));
return randomSlug;
};
const validateRequestAgainstPolicy = (
template: TCertificateTemplateV2,
request: TCertificateRequest
@@ -361,8 +385,12 @@ export const certificateTemplateV2ServiceFactory = ({
keyAlgorithm: data.keyAlgorithm
});
const slug = data.slug || generateTemplateSlug();
const uniqueSlug = await ensureUniqueSlug(projectId, slug);
const template = await certificateTemplateV2DAL.create({
...data,
slug: uniqueSlug,
projectId
});
@@ -417,7 +445,13 @@ export const certificateTemplateV2ServiceFactory = ({
validateTemplatePolicy(mergedPolicy);
}
const updatedTemplate = await certificateTemplateV2DAL.updateById(templateId, data);
const updateData = { ...data };
if (data.slug && typeof data.slug === "string" && data.slug !== existingTemplate.slug) {
const uniqueSlug = await ensureUniqueSlug(existingTemplate.projectId, data.slug, templateId);
updateData.slug = uniqueSlug;
}
const updatedTemplate = await certificateTemplateV2DAL.updateById(templateId, updateData);
if (!updatedTemplate) {
throw new NotFoundError({ message: "Failed to update certificate template" });
}
@@ -459,6 +493,43 @@ export const certificateTemplateV2ServiceFactory = ({
return template;
};
const getTemplateV2BySlug = async ({
actor,
actorId,
actorAuthMethod,
actorOrgId,
projectId,
slug
}: {
actor: ActorType;
actorId: string;
actorAuthMethod: ActorAuthMethod;
actorOrgId: string;
projectId: string;
slug: string;
}): Promise<TCertificateTemplateV2> => {
const { permission } = await permissionService.getProjectPermission({
actor,
actorId,
projectId,
actorAuthMethod,
actorOrgId,
actionProjectType: ActionProjectType.CertificateManager
});
ForbiddenError.from(permission).throwUnlessCan(
ProjectPermissionPkiTemplateActions.Read,
ProjectPermissionSub.CertificateTemplates
);
const template = await certificateTemplateV2DAL.findBySlugAndProjectId(slug, projectId);
if (!template) {
throw new NotFoundError({ message: "Certificate template not found" });
}
return template;
};
const listTemplatesV2 = async ({
actor,
actorId,
@@ -571,6 +642,7 @@ export const certificateTemplateV2ServiceFactory = ({
createTemplateV2,
updateTemplateV2,
getTemplateV2ById,
getTemplateV2BySlug,
listTemplatesV2,
deleteTemplateV2,
validateCertificateRequest

2
backend/src/services/certificate-template-v2/certificate-template-v2-types.ts
View File

@@ -74,7 +74,7 @@ export type TCertificateTemplateV2Insert = Omit<
export type TCertificateTemplateV2Update = Partial<
Pick<
TCertificateTemplateV2,
| "name"
| "slug"
| "description"
| "attributes"
| "keyUsages"

6
backend/src/services/certificate-v3/certificate-v3-service.test.ts
View File

@@ -347,7 +347,7 @@ describe("CertificateV3Service", () => {
describe("orderCertificateFromProfile", () => {
const mockCertificateOrder = {
identifiers: [{ type: "dns" as const, value: "example.com" }],
subjectAlternativeNames: [{ type: "dns" as const, value: "example.com" }],
validity: { ttl: "30d" },
commonName: "example.com",
keyUsages: [CertKeyUsage.DIGITAL_SIGNATURE],
@@ -411,8 +411,8 @@ describe("CertificateV3Service", () => {
expect(result).toHaveProperty("orderId");
expect(result).toHaveProperty("status", "valid");
expect(result).toHaveProperty("certificate");
expect(result.identifiers).toHaveLength(1);
expect(result.identifiers[0]).toEqual({
expect(result.subjectAlternativeNames).toHaveLength(1);
expect(result.subjectAlternativeNames[0]).toEqual({
type: "dns",
value: "example.com",
status: "valid"

20
backend/src/services/certificate-v3/certificate-v3-service.ts
View File

@@ -293,9 +293,9 @@ export const certificateV3ServiceFactory = ({
commonName: certificateOrder.commonName,
keyUsages: certificateOrder.keyUsages,
extendedKeyUsages: certificateOrder.extendedKeyUsages,
subjectAlternativeNames: certificateOrder.identifiers.map((id) => ({
type: id.type === "dns" ? ("dns_name" as const) : ("ip_address" as const),
value: id.value
subjectAlternativeNames: certificateOrder.subjectAlternativeNames.map((san) => ({
type: san.type === "dns" ? ("dns_name" as const) : ("ip_address" as const),
value: san.value
})),
validity: certificateOrder.validity,
notBefore: certificateOrder.notBefore,
@@ -334,16 +334,16 @@ export const certificateV3ServiceFactory = ({
});
const orderId = randomUUID();
const identifiers = certificateOrder.identifiers.map((id) => ({
type: id.type,
value: id.value,
const subjectAlternativeNames = certificateOrder.subjectAlternativeNames.map((san) => ({
type: san.type,
value: san.value,
status: "valid" as const
}));
const authorizations = certificateOrder.identifiers.map((id) => ({
const authorizations = certificateOrder.subjectAlternativeNames.map((san) => ({
identifier: {
type: id.type,
value: id.value
type: san.type,
value: san.value
},
status: "valid" as const,
expires: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(),
@@ -360,7 +360,7 @@ export const certificateV3ServiceFactory = ({
return {
orderId,
status: "valid",
identifiers,
subjectAlternativeNames,
authorizations,
finalize: `/api/v3/certificates/orders/${orderId}/finalize`,
certificate: certificateResult.certificate

4
backend/src/services/certificate-v3/certificate-v3-types.ts
View File

@@ -35,7 +35,7 @@ export type TSignCertificateFromProfileDTO = {
export type TOrderCertificateFromProfileDTO = {
profileId: string;
certificateOrder: {
identifiers: Array<{
subjectAlternativeNames: Array<{
type: "dns" | "ip";
value: string;
}>;
@@ -64,7 +64,7 @@ export type TCertificateFromProfileResponse = {
export type TCertificateOrderResponse = {
orderId: string;
status: "pending" | "processing" | "valid" | "invalid";
identifiers: Array<{
subjectAlternativeNames: Array<{
type: "dns" | "ip";
value: string;
status: "pending" | "processing" | "valid" | "invalid";

20
backend/src/services/enrollment-config/api-enrollment-config-dal.ts
View File

@@ -10,11 +10,11 @@ import { TApiEnrollmentConfigInsert, TApiEnrollmentConfigUpdate } from "./enroll
export type TApiEnrollmentConfigDALFactory = ReturnType<typeof apiEnrollmentConfigDALFactory>;
export const apiEnrollmentConfigDALFactory = (db: TDbClient) => {
const apiEnrollmentConfigOrm = ormify(db, TableName.ApiEnrollmentConfig);
const apiEnrollmentConfigOrm = ormify(db, TableName.PkiApiEnrollmentConfig);
const create = async (data: TApiEnrollmentConfigInsert, tx?: Knex) => {
try {
const [apiConfig] = await (tx || db)(TableName.ApiEnrollmentConfig).insert(data).returning("*");
const [apiConfig] = await (tx || db)(TableName.PkiApiEnrollmentConfig).insert(data).returning("*");
return apiConfig;
} catch (error) {
@@ -24,7 +24,7 @@ export const apiEnrollmentConfigDALFactory = (db: TDbClient) => {
const updateById = async (id: string, data: TApiEnrollmentConfigUpdate, tx?: Knex) => {
try {
const [apiConfig] = await (tx || db)(TableName.ApiEnrollmentConfig).where({ id }).update(data).returning("*");
const [apiConfig] = await (tx || db)(TableName.PkiApiEnrollmentConfig).where({ id }).update(data).returning("*");
return apiConfig;
} catch (error) {
@@ -34,7 +34,7 @@ export const apiEnrollmentConfigDALFactory = (db: TDbClient) => {
const deleteById = async (id: string, tx?: Knex) => {
try {
const [apiConfig] = await (tx || db)(TableName.ApiEnrollmentConfig).where({ id }).del().returning("*");
const [apiConfig] = await (tx || db)(TableName.PkiApiEnrollmentConfig).where({ id }).del().returning("*");
return apiConfig;
} catch (error) {
@@ -44,7 +44,7 @@ export const apiEnrollmentConfigDALFactory = (db: TDbClient) => {
const findById = async (id: string, tx?: Knex) => {
try {
const apiConfig = await (tx || db)(TableName.ApiEnrollmentConfig).where({ id }).first();
const apiConfig = await (tx || db)(TableName.PkiApiEnrollmentConfig).where({ id }).first();
return apiConfig;
} catch (error) {
@@ -60,15 +60,15 @@ export const apiEnrollmentConfigDALFactory = (db: TDbClient) => {
const profiles = await (tx || db)(TableName.CertificateProfile)
.join(
TableName.ApiEnrollmentConfig,
TableName.PkiApiEnrollmentConfig,
`${TableName.CertificateProfile}.apiConfigId`,
`${TableName.ApiEnrollmentConfig}.id`
`${TableName.PkiApiEnrollmentConfig}.id`
)
.where(`${TableName.ApiEnrollmentConfig}.autoRenew`, true)
.where(`${TableName.PkiApiEnrollmentConfig}.autoRenew`, true)
.where((query) => {
void query
.whereNull(`${TableName.ApiEnrollmentConfig}.autoRenewDays`)
.orWhere(`${TableName.ApiEnrollmentConfig}.autoRenewDays`, "<=", renewalThresholdDays);
.whereNull(`${TableName.PkiApiEnrollmentConfig}.autoRenewDays`)
.orWhere(`${TableName.PkiApiEnrollmentConfig}.autoRenewDays`, "<=", renewalThresholdDays);
})
.select((tx || db).ref("id").withSchema(TableName.CertificateProfile))
.select((tx || db).ref("name").withSchema(TableName.CertificateProfile))

28
backend/src/services/enrollment-config/enrollment-config-types.ts
View File

@@ -1,21 +1,21 @@
import {
TApiEnrollmentConfigs,
TApiEnrollmentConfigsInsert,
TApiEnrollmentConfigsUpdate
} from "@app/db/schemas/api-enrollment-configs";
TPkiApiEnrollmentConfigs,
TPkiApiEnrollmentConfigsInsert,
TPkiApiEnrollmentConfigsUpdate
} from "@app/db/schemas/pki-api-enrollment-configs";
import {
TEstEnrollmentConfigs,
TEstEnrollmentConfigsInsert,
TEstEnrollmentConfigsUpdate
} from "@app/db/schemas/est-enrollment-configs";
TPkiEstEnrollmentConfigs,
TPkiEstEnrollmentConfigsInsert,
TPkiEstEnrollmentConfigsUpdate
} from "@app/db/schemas/pki-est-enrollment-configs";
export type TEstEnrollmentConfig = TEstEnrollmentConfigs;
export type TEstEnrollmentConfigInsert = TEstEnrollmentConfigsInsert;
export type TEstEnrollmentConfigUpdate = TEstEnrollmentConfigsUpdate;
export type TEstEnrollmentConfig = TPkiEstEnrollmentConfigs;
export type TEstEnrollmentConfigInsert = TPkiEstEnrollmentConfigsInsert;
export type TEstEnrollmentConfigUpdate = TPkiEstEnrollmentConfigsUpdate;
export type TApiEnrollmentConfig = TApiEnrollmentConfigs;
export type TApiEnrollmentConfigInsert = TApiEnrollmentConfigsInsert;
export type TApiEnrollmentConfigUpdate = TApiEnrollmentConfigsUpdate;
export type TApiEnrollmentConfig = TPkiApiEnrollmentConfigs;
export type TApiEnrollmentConfigInsert = TPkiApiEnrollmentConfigsInsert;
export type TApiEnrollmentConfigUpdate = TPkiApiEnrollmentConfigsUpdate;
export interface TEstConfigData {
disableBootstrapCaValidation: boolean;

10
backend/src/services/enrollment-config/est-enrollment-config-dal.ts
View File

@@ -10,11 +10,11 @@ import { TEstEnrollmentConfigInsert, TEstEnrollmentConfigUpdate } from "./enroll
export type TEstEnrollmentConfigDALFactory = ReturnType<typeof estEnrollmentConfigDALFactory>;
export const estEnrollmentConfigDALFactory = (db: TDbClient) => {
const estEnrollmentConfigOrm = ormify(db, TableName.EstEnrollmentConfig);
const estEnrollmentConfigOrm = ormify(db, TableName.PkiEstEnrollmentConfig);
const create = async (data: TEstEnrollmentConfigInsert, tx?: Knex) => {
try {
const [estConfig] = await (tx || db)(TableName.EstEnrollmentConfig).insert(data).returning("*");
const [estConfig] = await (tx || db)(TableName.PkiEstEnrollmentConfig).insert(data).returning("*");
return estConfig;
} catch (error) {
@@ -24,7 +24,7 @@ export const estEnrollmentConfigDALFactory = (db: TDbClient) => {
const updateById = async (id: string, data: TEstEnrollmentConfigUpdate, tx?: Knex) => {
try {
const [estConfig] = await (tx || db)(TableName.EstEnrollmentConfig).where({ id }).update(data).returning("*");
const [estConfig] = await (tx || db)(TableName.PkiEstEnrollmentConfig).where({ id }).update(data).returning("*");
return estConfig;
} catch (error) {
@@ -34,7 +34,7 @@ export const estEnrollmentConfigDALFactory = (db: TDbClient) => {
const deleteById = async (id: string, tx?: Knex) => {
try {
const [estConfig] = await (tx || db)(TableName.EstEnrollmentConfig).where({ id }).del().returning("*");
const [estConfig] = await (tx || db)(TableName.PkiEstEnrollmentConfig).where({ id }).del().returning("*");
return estConfig;
} catch (error) {
@@ -44,7 +44,7 @@ export const estEnrollmentConfigDALFactory = (db: TDbClient) => {
const findById = async (id: string, tx?: Knex) => {
try {
const estConfig = await (tx || db)(TableName.EstEnrollmentConfig).where({ id }).first();
const estConfig = await (tx || db)(TableName.PkiEstEnrollmentConfig).where({ id }).first();
return estConfig;
} catch (error) {

6
frontend/src/hooks/api/certificateProfiles/types.ts
View File

@@ -3,7 +3,6 @@ export type TCertificateProfile = {
projectId: string;
caId: string;
certificateTemplateId: string;
name: string;
slug: string;
description?: string;
enrollmentType: "api" | "est";
@@ -24,7 +23,7 @@ export type TCertificateProfileWithDetails = TCertificateProfile & {
certificateTemplate?: {
id: string;
projectId: string;
name: string;
slug: string;
description?: string;
};
estConfig?: {
@@ -44,7 +43,6 @@ export type TCreateCertificateProfileDTO = {
projectId: string;
caId: string;
certificateTemplateId: string;
name: string;
slug: string;
description?: string;
enrollmentType: "api" | "est";
@@ -61,7 +59,7 @@ export type TCreateCertificateProfileDTO = {
export type TUpdateCertificateProfileDTO = {
profileId: string;
name?: string;
slug?: string;
description?: string;
estConfig?: {
disableBootstrapCaValidation?: boolean;

6
frontend/src/hooks/api/certificateTemplates/types.ts
View File

@@ -167,7 +167,7 @@ export type TCertificateTemplateV2Policy = {
export type TCertificateTemplateV2New = {
id: string;
projectId: string;
name: string;
slug: string;
description?: string;
attributes: any;
keyUsages: any;
@@ -182,7 +182,7 @@ export type TCertificateTemplateV2New = {
export type TCreateCertificateTemplateV2NewDTO = {
projectId: string;
name: string;
slug: string;
description?: string;
attributes: TCertificateTemplateV2Policy["attributes"];
keyUsages: TCertificateTemplateV2Policy["keyUsages"];
@@ -195,7 +195,7 @@ export type TCreateCertificateTemplateV2NewDTO = {
export type TUpdateCertificateTemplateV2NewDTO = {
templateId: string;
name?: string;
slug?: string;
description?: string;
attributes?: TCertificateTemplateV2Policy["attributes"];
keyUsages?: TCertificateTemplateV2Policy["keyUsages"];

163
frontend/src/pages/cert-manager/CertificatesPage/components/CertificateIssuanceModal.tsx
View File

@@ -15,6 +15,7 @@ import {
AccordionItem,
AccordionTrigger,
Button,
Checkbox,
FormControl,
FormLabel,
IconButton,
@@ -26,7 +27,7 @@ import {
Tooltip
} from "@app/components/v2";
import { useProject } from "@app/context";
import { useCreateCertificateV3, useGetCert, useListWorkspacePkiCollections } from "@app/hooks/api";
import { useCreateCertificateV3, useGetCert } from "@app/hooks/api";
import { useListCertificateProfiles } from "@app/hooks/api/certificateProfiles";
import {
certKeyAlgorithms,
@@ -44,53 +45,15 @@ import { UsePopUpState } from "@app/hooks/usePopUp";
import { CertificateContent } from "./CertificateContent";
type TriStateToggleProps = {
value: boolean | undefined;
onChange: (value: boolean | undefined) => void;
leftLabel: string;
rightLabel: string;
};
const TriStateToggle = ({ value, onChange, leftLabel, rightLabel }: TriStateToggleProps) => {
return (
<div className="flex gap-x-0.5 rounded-md border border-mineshaft-600 bg-mineshaft-800 p-1">
<Button
variant="outline_bg"
onClick={() => {
onChange(value === false ? undefined : false);
}}
size="xs"
className={`${
value === false ? "bg-mineshaft-500" : "bg-transparent"
} min-w-[2.4rem] rounded border-none hover:bg-mineshaft-600`}
>
{leftLabel}
</Button>
<Button
variant="outline_bg"
onClick={() => {
onChange(value === true ? undefined : true);
}}
size="xs"
className={`${
value === true ? "bg-mineshaft-500" : "bg-transparent"
} min-w-[2.4rem] rounded border-none hover:bg-mineshaft-600`}
>
{rightLabel}
</Button>
</div>
);
};
const schema = z.object({
profileId: z.string().min(1, "Profile is required"),
collectionId: z.string().optional(),
friendlyName: z.string(),
subjectAttributes: z
.array(
z.object({
type: z.enum(["common_name"]),
value: z.string().min(1, "Value is required")
value: z.string().min(1, "Value is required"),
include: z.enum(["mandatory", "optional", "prohibit"]).optional()
})
)
.min(1, "At least one subject attribute is required"),
@@ -98,7 +61,8 @@ const schema = z.object({
.array(
z.object({
type: z.enum(["dns", "ip", "email", "uri"]),
value: z.string().min(1, "Value is required")
value: z.string().min(1, "Value is required"),
include: z.enum(["mandatory", "optional", "prohibit"]).optional()
})
)
.default([]),
@@ -159,10 +123,6 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
includeMetrics: false
});
const { data: collectionsData } = useListWorkspacePkiCollections({
projectId: currentProject?.id || ""
});
const { mutateAsync: createCertificate } = useCreateCertificateV3();
const {
@@ -461,7 +421,6 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
const onFormSubmit = async ({
profileId,
friendlyName,
collectionId,
subjectAttributes,
altNames,
ttl,
@@ -481,7 +440,6 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
const { serialNumber, certificate, certificateChain, privateKey } = await createCertificate({
profileId,
projectSlug: currentProject.slug,
pkiCollectionId: collectionId,
friendlyName,
commonName: getAttributeValue("common_name"),
altNames: altNames
@@ -628,34 +586,7 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
>
{profilesData?.certificateProfiles?.map((profile) => (
<SelectItem key={profile.id} value={profile.id}>
{profile.name}
</SelectItem>
))}
</Select>
</FormControl>
)}
/>
<Controller
control={control}
name="collectionId"
render={({ field: { onChange, ...field }, fieldState: { error } }) => (
<FormControl
label="PKI Collection (Optional)"
errorText={error?.message}
isError={Boolean(error)}
>
<Select
defaultValue=""
{...field}
onValueChange={(e) => onChange(e)}
className="w-full"
placeholder="Select a collection (optional)"
position="popper"
>
{collectionsData?.collections?.map((collection: any) => (
<SelectItem key={collection.id} value={collection.id}>
{collection.name}
{profile.slug}
</SelectItem>
))}
</Select>
@@ -701,10 +632,25 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
onChange(newValue);
}}
className="w-48"
position="popper"
>
<SelectItem value="common_name">Common Name</SelectItem>
</Select>
<Select
value={attr.include || "optional"}
onValueChange={(newInclude) => {
const newValue = [...value];
newValue[index] = {
...attr,
include: newInclude as "mandatory" | "optional" | "prohibit"
};
onChange(newValue);
}}
className="w-32"
>
<SelectItem value="mandatory">Mandatory</SelectItem>
<SelectItem value="optional">Optional</SelectItem>
<SelectItem value="prohibit">Prohibited</SelectItem>
</Select>
<Input
value={attr.value}
onChange={(e) => {
@@ -769,14 +715,29 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
};
onChange(newValue);
}}
className="w-32"
position="popper"
className="w-24"
>
<SelectItem value="dns">DNS</SelectItem>
<SelectItem value="ip">IP</SelectItem>
<SelectItem value="email">Email</SelectItem>
<SelectItem value="uri">URI</SelectItem>
</Select>
<Select
value={san.include || "optional"}
onValueChange={(newInclude) => {
const newValue = [...value];
newValue[index] = {
...san,
include: newInclude as "mandatory" | "optional" | "prohibit"
};
onChange(newValue);
}}
className="w-32"
>
<SelectItem value="mandatory">Mandatory</SelectItem>
<SelectItem value="optional">Optional</SelectItem>
<SelectItem value="prohibit">Prohibited</SelectItem>
</Select>
<Input
value={san.value}
onChange={(e) => {
@@ -908,11 +869,11 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
</div>
</div>
<Accordion type="single" collapsible>
<Accordion type="single" collapsible className="w-full">
<AccordionItem value="key-usages">
<AccordionTrigger>Key Usages</AccordionTrigger>
<AccordionContent>
<div className="grid grid-cols-1 gap-3">
<div className="grid grid-cols-2 gap-2 pl-2">
{KEY_USAGES_OPTIONS.filter(({ value }) => {
if (allowedKeyUsages.length === 0) return true;
const templateToEnumMap = {
@@ -933,15 +894,18 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
<Controller
key={label}
control={control}
name={`keyUsages.${value}`}
name={`keyUsages.${value}` as any}
render={({ field }) => (
<div className="flex items-center justify-between">
<span className="text-sm text-mineshaft-300">{label}</span>
<TriStateToggle
value={field.value}
onChange={field.onChange}
leftLabel="None"
rightLabel="Include"
<div className="flex items-center space-x-3">
<Checkbox
id={`key-usage-${value}`}
isChecked={field.value || false}
onCheckedChange={(checked) => field.onChange(checked)}
/>
<FormLabel
id={`key-usage-${value}`}
className="cursor-pointer text-sm text-mineshaft-300"
label={label}
/>
</div>
)}
@@ -954,7 +918,7 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
<AccordionItem value="extended-key-usages">
<AccordionTrigger>Extended Key Usages</AccordionTrigger>
<AccordionContent>
<div className="grid grid-cols-1 gap-3">
<div className="grid grid-cols-2 gap-2 pl-2">
{EXTENDED_KEY_USAGES_OPTIONS.filter(({ value }) => {
if (allowedExtendedKeyUsages.length === 0) return true;
const templateToEnumMap = {
@@ -973,15 +937,18 @@ export const CertificateIssuanceModal = ({ popUp, handlePopUpToggle }: Props) =>
<Controller
key={label}
control={control}
name={`extendedKeyUsages.${value}`}
name={`extendedKeyUsages.${value}` as any}
render={({ field }) => (
<div className="flex items-center justify-between">
<span className="text-sm text-mineshaft-300">{label}</span>
<TriStateToggle
value={field.value}
onChange={field.onChange}
leftLabel="None"
rightLabel="Include"
<div className="flex items-center space-x-3">
<Checkbox
id={`ext-key-usage-${value}`}
isChecked={field.value || false}
onCheckedChange={(checked) => field.onChange(checked)}
/>
<FormLabel
id={`ext-key-usage-${value}`}
className="cursor-pointer text-sm text-mineshaft-300"
label={label}
/>
</div>
)}

8
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CertificateProfilesTab.tsx
View File

@@ -14,7 +14,6 @@ import {
} from "@app/hooks/api/certificateProfiles";
import { CreateProfileModal } from "./CreateProfileModal";
import { EditProfileModal } from "./EditProfileModal";
import { ProfileList } from "./ProfileList";
export const CertificateProfilesTab = () => {
@@ -89,23 +88,24 @@ export const CertificateProfilesTab = () => {
{selectedProfile && (
<>
<EditProfileModal
<CreateProfileModal
isOpen={isEditModalOpen}
onClose={() => {
setIsEditModalOpen(false);
setSelectedProfile(null);
}}
profile={selectedProfile}
mode="edit"
/>
<DeleteActionModal
isOpen={isDeleteModalOpen}
title={`Delete Certificate Profile ${selectedProfile.name}?`}
title={`Delete Certificate Profile ${selectedProfile.slug}?`}
onChange={(isOpen) => {
setIsDeleteModalOpen(isOpen);
if (!isOpen) setSelectedProfile(null);
}}
deleteKey={selectedProfile.name}
deleteKey={selectedProfile.slug}
onDeleteApproved={handleDeleteConfirm}
/>
</>

232
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/CreateProfileModal.tsx
View File

@@ -1,5 +1,3 @@
/* eslint-disable jsx-a11y/label-has-associated-control */
import { useEffect } from "react";
import { Controller, useForm } from "react-hook-form";
import { zodResolver } from "@hookform/resolvers/zod";
import { z } from "zod";
@@ -18,12 +16,15 @@ import {
} from "@app/components/v2";
import { useProject } from "@app/context";
import { useListCasByProjectId } from "@app/hooks/api/ca/queries";
import { useCreateCertificateProfile } from "@app/hooks/api/certificateProfiles";
import {
TCertificateProfileWithDetails,
useCreateCertificateProfile,
useUpdateCertificateProfile
} from "@app/hooks/api/certificateProfiles";
import { useListCertificateTemplatesV2 } from "@app/hooks/api/certificateTemplates/queries";
const schema = z
const createSchema = z
.object({
name: z.string().trim().min(1, "Profile name is required"),
slug: z.string().trim().min(1, "Profile slug is required"),
description: z.string().optional(),
enrollmentType: z.enum(["api", "est"]),
@@ -58,14 +59,52 @@ const schema = z
}
);
export type FormData = z.infer<typeof schema>;
const editSchema = z
.object({
slug: z.string().trim().min(1, "Profile slug is required"),
description: z.string().optional(),
enrollmentType: z.enum(["api", "est"]),
certificateAuthorityId: z.string().optional(),
certificateTemplateId: z.string().optional(),
estConfig: z
.object({
disableBootstrapCaValidation: z.boolean().optional(),
passphrase: z.string().optional(),
caChain: z.string().optional()
})
.optional(),
apiConfig: z
.object({
autoRenew: z.boolean().optional(),
autoRenewDays: z.number().min(1).max(365).optional()
})
.optional()
})
.refine(
(data) => {
if (data.enrollmentType === "est" && !data.estConfig) {
return false;
}
if (data.enrollmentType === "api" && !data.apiConfig) {
return false;
}
return true;
},
{
message: "Configuration is required for selected enrollment type"
}
);
export type FormData = z.infer<typeof createSchema>;
interface Props {
isOpen: boolean;
onClose: () => void;
profile?: TCertificateProfileWithDetails;
mode?: "create" | "edit";
}
export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
export const CreateProfileModal = ({ isOpen, onClose, profile, mode = "create" }: Props) => {
const { currentProject } = useProject();
const { data: caData } = useListCasByProjectId(currentProject?.id || "");
@@ -76,80 +115,97 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
});
const createProfile = useCreateCertificateProfile();
const updateProfile = useUpdateCertificateProfile();
const isEdit = mode === "edit" && profile;
const certificateAuthorities = caData || [];
const certificateTemplates = templateData?.certificateTemplates || [];
const {
control,
handleSubmit,
reset,
watch,
setValue,
formState: { isSubmitting }
} = useForm<FormData>({
resolver: zodResolver(schema),
defaultValues: {
name: "",
slug: "",
description: "",
enrollmentType: "api",
certificateAuthorityId: "",
certificateTemplateId: "",
apiConfig: {
autoRenew: false,
autoRenewDays: 30
}
}
const { control, handleSubmit, reset, watch, setValue } = useForm<FormData>({
resolver: zodResolver(isEdit ? editSchema : createSchema),
defaultValues: isEdit
? {
slug: profile.slug,
description: profile.description || "",
enrollmentType: profile.enrollmentType,
certificateAuthorityId: profile.caId,
certificateTemplateId: profile.certificateTemplateId,
estConfig: {
disableBootstrapCaValidation: profile.estConfig?.disableBootstrapCaValidation || false,
passphrase: "",
caChain: ""
},
apiConfig: {
autoRenew: profile.apiConfig?.autoRenew || false,
autoRenewDays: profile.apiConfig?.autoRenewDays || 30
}
}
: {
slug: "",
description: "",
enrollmentType: "api",
certificateAuthorityId: "",
certificateTemplateId: "",
apiConfig: {
autoRenew: false,
autoRenewDays: 30
}
}
});
const watchedName = watch("name");
const watchedEnrollmentType = watch("enrollmentType");
const watchedDisableBootstrapValidation = watch("estConfig.disableBootstrapCaValidation");
const watchedAutoRenew = watch("apiConfig.autoRenew");
useEffect(() => {
if (watchedName && !watch("slug")) {
const slug = watchedName
.toLowerCase()
.replace(/[^a-z0-9]+/g, "-")
.replace(/(^-|-$)/g, "");
setValue("slug", slug);
}
}, [watchedName, setValue, watch]);
const onFormSubmit = async (data: FormData) => {
try {
if (!currentProject?.id) return;
if (!currentProject?.id && !isEdit) return;
const payload: any = {
projectId: currentProject.id,
name: data.name,
slug: data.slug,
description: data.description,
enrollmentType: data.enrollmentType,
caId: data.certificateAuthorityId,
certificateTemplateId: data.certificateTemplateId
};
if (isEdit) {
const updateData: any = {
profileId: profile.id,
name: data.slug,
description: data.description
};
if (data.enrollmentType === "est" && data.estConfig) {
payload.estConfig = data.estConfig;
} else if (data.enrollmentType === "api" && data.apiConfig) {
payload.apiConfig = data.apiConfig;
if (data.enrollmentType === "est" && data.estConfig) {
updateData.estConfig = data.estConfig;
} else if (data.enrollmentType === "api" && data.apiConfig) {
updateData.apiConfig = data.apiConfig;
}
await updateProfile.mutateAsync(updateData);
} else {
const createData: any = {
projectId: currentProject!.id,
slug: data.slug,
description: data.description,
enrollmentType: data.enrollmentType,
caId: data.certificateAuthorityId,
certificateTemplateId: data.certificateTemplateId
};
if (data.enrollmentType === "est" && data.estConfig) {
createData.estConfig = data.estConfig;
} else if (data.enrollmentType === "api" && data.apiConfig) {
createData.apiConfig = data.apiConfig;
}
await createProfile.mutateAsync(createData);
}
await createProfile.mutateAsync(payload);
createNotification({
text: "Certificate profile created successfully",
text: `Certificate profile ${isEdit ? "updated" : "created"} successfully`,
type: "success"
});
reset();
onClose();
} catch (error) {
console.error("Error creating profile:", error);
console.error(`Error ${isEdit ? "updating" : "creating"} profile:`, error);
createNotification({
text: "Failed to create certificate profile",
text: `Failed to ${isEdit ? "update" : "create"} certificate profile`,
type: "error"
});
}
@@ -166,25 +222,14 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
}}
>
<ModalContent
title="Create Certificate Profile"
subTitle="Configure a new certificate profile for unified certificate issuance"
title={isEdit ? "Edit Certificate Profile" : "Create Certificate Profile"}
subTitle={
isEdit
? `Update configuration for ${profile?.slug}`
: "Configure a new certificate profile for unified certificate issuance"
}
>
<form onSubmit={handleSubmit(onFormSubmit)}>
<Controller
control={control}
name="name"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Profile Name"
isRequired
isError={Boolean(error)}
errorText={error?.message}
>
<Input {...field} placeholder="Enter profile name" />
</FormControl>
)}
/>
<Controller
control={control}
name="slug"
@@ -195,7 +240,7 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
isError={Boolean(error)}
errorText={error?.message}
>
<Input {...field} placeholder="auto-generated-from-name" />
<Input {...field} placeholder="your-profile-name" isDisabled={Boolean(isEdit)} />
</FormControl>
)}
/>
@@ -226,6 +271,7 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
placeholder="Select a certificate authority"
className="w-full"
position="popper"
isDisabled={Boolean(isEdit)}
>
{certificateAuthorities.map((ca: any) => (
<SelectItem key={ca.id} value={ca.id}>
@@ -269,10 +315,11 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
placeholder="Select a certificate template"
className="w-full"
position="popper"
isDisabled={Boolean(isEdit)}
>
{certificateTemplates.map((template) => (
<SelectItem key={template.id} value={template.id}>
{template.name}
{template.slug}
</SelectItem>
))}
</Select>
@@ -290,7 +337,13 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
isError={Boolean(error)}
errorText={error?.message}
>
<Select {...field} onValueChange={onChange} className="w-full" position="popper">
<Select
{...field}
onValueChange={onChange}
className="w-full"
position="popper"
isDisabled={Boolean(isEdit)}
>
<SelectItem value="api">API</SelectItem>
<SelectItem value="est">EST</SelectItem>
</Select>
@@ -314,12 +367,9 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
onCheckedChange={onChange}
/>
<div className="space-y-1">
<label
htmlFor="disableBootstrapCaValidation"
className="text-sm font-medium text-mineshaft-100"
>
<span className="text-sm font-medium text-mineshaft-100">
Disable Bootstrap CA Validation
</label>
</span>
<p className="text-xs text-bunker-300">
Skip CA certificate validation during EST bootstrap phase
</p>
@@ -335,7 +385,7 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
render={({ field, fieldState: { error } }) => (
<FormControl
label="EST Passphrase"
isRequired
isRequired={!isEdit}
isError={Boolean(error)}
errorText={error?.message}
>
@@ -356,7 +406,7 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
render={({ field, fieldState: { error } }) => (
<FormControl
label="CA Chain Certificate"
isRequired
isRequired={!isEdit}
isError={Boolean(error)}
errorText={error?.message}
>
@@ -424,10 +474,18 @@ export const CreateProfileModal = ({ isOpen, onClose }: Props) => {
)}
<div className="flex gap-3">
<Button type="submit" colorSchema="primary" isLoading={isSubmitting}>
Create
<Button
type="submit"
colorSchema="primary"
isLoading={isEdit ? updateProfile.isPending : createProfile.isPending}
>
{isEdit ? "Save Changes" : "Create"}
</Button>
<Button variant="outline_bg" onClick={onClose} disabled={isSubmitting}>
<Button
variant="outline_bg"
onClick={onClose}
disabled={isEdit ? updateProfile.isPending : createProfile.isPending}
>
Cancel
</Button>
</div>

303
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/EditProfileModal.tsx
View File

@@ -1,303 +0,0 @@
import { useEffect, useState } from "react";
import { faSave } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { createNotification } from "@app/components/notifications";
import {
Button,
Checkbox,
FormControl,
Input,
Modal,
ModalContent,
Select,
SelectItem,
TextArea
} from "@app/components/v2";
import { useProject } from "@app/context";
import { useListCasByProjectId } from "@app/hooks/api/ca/queries";
import {
TCertificateProfileWithDetails,
useUpdateCertificateProfile
} from "@app/hooks/api/certificateProfiles";
import { useListCertificateTemplatesV2 } from "@app/hooks/api/certificateTemplates/queries";
interface Props {
isOpen: boolean;
onClose: () => void;
profile: TCertificateProfileWithDetails;
}
export const EditProfileModal = ({ isOpen, onClose, profile }: Props) => {
const { currentProject } = useProject();
const updateProfile = useUpdateCertificateProfile();
const { data: caData } = useListCasByProjectId(currentProject?.id || "");
const { data: templateData } = useListCertificateTemplatesV2({
projectId: currentProject?.id || "",
limit: 100,
offset: 0
});
const certificateAuthorities = caData || [];
const certificateTemplates = templateData?.certificateTemplates || [];
const [formData, setFormData] = useState({
name: "",
slug: "",
description: "",
enrollmentType: "api" as "api" | "est",
certificateAuthorityId: "",
certificateTemplateId: "",
estConfig: {
disableBootstrapCaValidation: false,
passphrase: "",
caChain: ""
},
apiConfig: {
autoRenew: false,
autoRenewDays: 30
}
});
useEffect(() => {
if (profile) {
setFormData({
name: profile.name,
slug: profile.slug,
description: profile.description || "",
enrollmentType: profile.enrollmentType,
certificateAuthorityId: profile.caId,
certificateTemplateId: profile.certificateTemplateId,
estConfig: {
disableBootstrapCaValidation: profile.estConfig?.disableBootstrapCaValidation || false,
passphrase: "",
caChain: ""
},
apiConfig: {
autoRenew: profile.apiConfig?.autoRenew || false,
autoRenewDays: profile.apiConfig?.autoRenewDays || 30
}
});
}
}, [profile]);
const handleInputChange = (field: string, value: string | boolean | number) => {
if (field.includes(".")) {
const [parent, child] = field.split(".");
setFormData((prev) => ({
...prev,
[parent]: {
...(prev as any)[parent],
[child]: value
}
}));
} else {
setFormData((prev) => ({
...prev,
[field]: value
}));
}
};
const handleSubmit = async (e: React.FormEvent) => {
e.preventDefault();
if (!formData.name) {
return;
}
try {
const payload: any = {
profileId: profile.id,
name: formData.name,
description: formData.description
};
if (formData.enrollmentType === "est") {
payload.estConfig = {
disableBootstrapCaValidation: formData.estConfig.disableBootstrapCaValidation,
passphrase: formData.estConfig.passphrase,
caChain: formData.estConfig.caChain
};
} else if (formData.enrollmentType === "api") {
payload.apiConfig = {
autoRenew: formData.apiConfig.autoRenew,
autoRenewDays: formData.apiConfig.autoRenewDays
};
}
await updateProfile.mutateAsync(payload);
createNotification({
text: "Certificate profile updated successfully",
type: "success"
});
onClose();
} catch (error) {
console.error("Error updating profile:", error);
createNotification({
text: "Failed to update certificate profile",
type: "error"
});
}
};
return (
<Modal isOpen={isOpen} onOpenChange={onClose}>
<ModalContent
title="Edit Certificate Profile"
subTitle={`Update configuration for ${profile?.name}`}
>
<form onSubmit={handleSubmit} className="space-y-4">
<FormControl label="Profile Name" isRequired>
<Input
placeholder="Enter profile name"
value={formData.name}
onChange={(e) => handleInputChange("name", e.target.value)}
/>
</FormControl>
<FormControl label="Profile Slug" isRequired>
<Input
placeholder="profile-slug"
value={formData.slug}
onChange={(e) => handleInputChange("slug", e.target.value)}
disabled
/>
</FormControl>
<FormControl label="Description">
<TextArea
placeholder="Enter profile description"
value={formData.description}
onChange={(e) => handleInputChange("description", e.target.value)}
rows={3}
/>
</FormControl>
<FormControl label="Enrollment Type">
<Select
value={formData.enrollmentType}
onValueChange={(value) => handleInputChange("enrollmentType", value)}
isDisabled
>
<SelectItem value="api">API - Programmatic certificate enrollment</SelectItem>
<SelectItem value="est">EST - RFC 7030 certificate enrollment</SelectItem>
</Select>
</FormControl>
<FormControl label="Certificate Authority">
<Select
value={formData.certificateAuthorityId}
onValueChange={(value) => handleInputChange("certificateAuthorityId", value)}
placeholder="Select a certificate authority"
isDisabled
>
{certificateAuthorities.map((ca: any) => (
<SelectItem key={ca.id} value={ca.id}>
{ca.friendlyName || ca.name || ca.commonName}
</SelectItem>
))}
</Select>
</FormControl>
<FormControl label="Certificate Template">
<Select
value={formData.certificateTemplateId}
onValueChange={(value) => handleInputChange("certificateTemplateId", value)}
placeholder="Select a certificate template"
isDisabled
>
{certificateTemplates.map((template) => (
<SelectItem key={template.id} value={template.id}>
{template.name}
</SelectItem>
))}
</Select>
</FormControl>
{/* EST Configuration */}
{formData.enrollmentType === "est" && (
<div className="space-y-4 rounded border border-mineshaft-600 p-4">
<FormControl>
<Checkbox
id="disableBootstrapCaValidation"
isChecked={formData.estConfig.disableBootstrapCaValidation}
onCheckedChange={(checked) =>
handleInputChange("estConfig.disableBootstrapCaValidation", checked)
}
>
Disable Bootstrap CA Validation
</Checkbox>
</FormControl>
<FormControl label="EST Passphrase" isRequired>
<Input
type="password"
placeholder="Enter EST passphrase"
value={formData.estConfig.passphrase}
onChange={(e) => handleInputChange("estConfig.passphrase", e.target.value)}
/>
</FormControl>
<FormControl label="CA Chain" isRequired>
<TextArea
placeholder="Enter CA chain (PEM format)"
value={formData.estConfig.caChain}
onChange={(e) => handleInputChange("estConfig.caChain", e.target.value)}
rows={6}
className="font-mono"
/>
</FormControl>
</div>
)}
{/* API Configuration */}
{formData.enrollmentType === "api" && (
<div className="space-y-4 rounded border border-mineshaft-600 p-4">
<FormControl>
<Checkbox
id="autoRenew"
isChecked={formData.apiConfig.autoRenew}
onCheckedChange={(checked) => handleInputChange("apiConfig.autoRenew", checked)}
>
Enable Auto-Renewal
</Checkbox>
</FormControl>
<FormControl label="Auto-Renewal Days">
<Input
type="number"
placeholder="30"
min="1"
max="365"
value={formData.apiConfig.autoRenewDays}
onChange={(e) =>
handleInputChange("apiConfig.autoRenewDays", parseInt(e.target.value, 10) || 30)
}
/>
</FormControl>
</div>
)}
<div className="flex gap-3 pt-4">
<Button
type="submit"
colorSchema="primary"
leftIcon={<FontAwesomeIcon icon={faSave} />}
isLoading={updateProfile.isPending}
disabled={!formData.name}
>
Save Changes
</Button>
<Button variant="outline_bg" onClick={onClose} disabled={updateProfile.isPending}>
Cancel
</Button>
</div>
</form>
</ModalContent>
</Modal>
);
};

3
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileList.tsx
View File

@@ -34,7 +34,7 @@ export const ProfileList = ({ onEditProfile, onDeleteProfile }: Props) => {
const profiles = data?.certificateProfiles || [];
if (isLoading) {
return <TableSkeleton columns={7} innerKey="certificate-profiles" />;
return <TableSkeleton columns={6} innerKey="certificate-profiles" />;
}
if (!profiles || profiles.length === 0) {
@@ -51,7 +51,6 @@ export const ProfileList = ({ onEditProfile, onDeleteProfile }: Props) => {
<Th>Certificate Authority</Th>
<Th>Template</Th>
<Th>Certificates</Th>
<Th>Created</Th>
<Th className="w-5" />
</Tr>
</THead>

76
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/ProfileRow.tsx
View File

@@ -57,23 +57,16 @@ export const ProfileRow = ({ profile, onEditProfile, onDeleteProfile }: Props) =
return <Badge variant={variant}>{label}</Badge>;
};
const formatDate = (dateString: string) => {
return new Date(dateString).toLocaleDateString();
};
return (
<Tr key={profile.id} className="h-10 transition-colors duration-100 hover:bg-mineshaft-700">
<Td>
<div>
<div className="flex items-center gap-2">
<div className="font-medium text-mineshaft-100">{profile.name}</div>
{profile.description && (
<Tooltip content={profile.description}>
<FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
</Tooltip>
)}
</div>
<div className="text-xs text-bunker-300">{profile.slug}</div>
<div className="flex items-center gap-2">
<div className="font-medium text-mineshaft-100">{profile.slug}</div>
{profile.description && (
<Tooltip content={profile.description}>
<FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />
</Tooltip>
)}
</div>
</Td>
<Td className="text-center">{getEnrollmentTypeBadge(profile.enrollmentType)}</Td>
@@ -84,64 +77,47 @@ export const ProfileRow = ({ profile, onEditProfile, onDeleteProfile }: Props) =
</Td>
<Td>
<span className="text-sm text-mineshaft-300">
{templateData?.name || profile.certificateTemplateId}
{templateData?.slug || profile.certificateTemplateId}
</span>
</Td>
<Td>
<div className="flex gap-2 text-xs">
<div className="flex flex-wrap gap-1">
{profile.metrics ? (
profile.metrics.totalCertificates === 0 ? (
<span className="text-bunker-300">No certificates attached</span>
<Badge variant="primary" className="text-xs">
No certificates
</Badge>
) : (
<>
{profile.metrics.activeCertificates > 0 && (
<span className="text-green-400">
<Badge variant="success" className="text-xs">
{profile.metrics.activeCertificates} active
</span>
</Badge>
)}
{profile.metrics.expiringCertificates > 0 && (
<>
{profile.metrics.activeCertificates > 0 && (
<span className="text-gray-400">•</span>
)}
<span className="text-yellow-400">
{profile.metrics.expiringCertificates} expiring
</span>
</>
<Badge variant="primary" className="text-xs">
{profile.metrics.expiringCertificates} expiring
</Badge>
)}
{profile.metrics.expiredCertificates > 0 && (
<>
{(profile.metrics.activeCertificates > 0 ||
profile.metrics.expiringCertificates > 0) && (
<span className="text-gray-400">•</span>
)}
<span className="text-red-300">
{profile.metrics.expiredCertificates} expired
</span>
</>
<Badge variant="danger" className="text-xs">
{profile.metrics.expiredCertificates} expired
</Badge>
)}
{profile.metrics.revokedCertificates > 0 && (
<>
{(profile.metrics.activeCertificates > 0 ||
profile.metrics.expiringCertificates > 0 ||
profile.metrics.expiredCertificates > 0) && (
<span className="text-gray-400">•</span>
)}
<span className="text-red-400">
{profile.metrics.revokedCertificates} revoked
</span>
</>
<Badge variant="danger" className="text-xs">
{profile.metrics.revokedCertificates} revoked
</Badge>
)}
</>
)
) : (
<span className="text-bunker-300">No metrics available</span>
<Badge variant="primary" className="text-xs">
No metrics
</Badge>
)}
</div>
</Td>
<Td>
<span className="text-sm text-bunker-300">{formatDate(profile.createdAt)}</span>
</Td>
<Td className="text-right">
<DropdownMenu>
<DropdownMenuTrigger asChild className="rounded-lg">

1
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateProfilesTab/index.ts
View File

@@ -1,4 +1,3 @@
export { CertificateProfilesTab } from "./CertificateProfilesTab";
export { CreateProfileModal } from "./CreateProfileModal";
export { EditProfileModal } from "./EditProfileModal";
export { ProfileList } from "./ProfileList";

8
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CertificateTemplatesV2Tab.tsx
View File

@@ -12,7 +12,6 @@ import { useDeleteCertificateTemplateV2New } from "@app/hooks/api/certificateTem
import { TCertificateTemplateV2New } from "@app/hooks/api/certificateTemplates/types";
import { CreateTemplateModal } from "./CreateTemplateModal";
import { EditTemplateModal } from "./EditTemplateModal";
import { TemplateList } from "./TemplateList";
export const CertificateTemplatesV2Tab = () => {
@@ -87,23 +86,24 @@ export const CertificateTemplatesV2Tab = () => {
{selectedTemplate && (
<>
<EditTemplateModal
<CreateTemplateModal
isOpen={isEditModalOpen}
onClose={() => {
setIsEditModalOpen(false);
setSelectedTemplate(null);
}}
template={selectedTemplate}
mode="edit"
/>
<DeleteActionModal
isOpen={isDeleteModalOpen}
title={`Delete Certificate Template ${selectedTemplate.name}?`}
title={`Delete Certificate Template ${selectedTemplate.slug}?`}
onChange={(isOpen) => {
setIsDeleteModalOpen(isOpen);
if (!isOpen) setSelectedTemplate(null);
}}
deleteKey={selectedTemplate.name}
deleteKey={selectedTemplate.slug}
onDeleteApproved={handleDeleteConfirm}
/>
</>

1086
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/CreateTemplateModal.tsx
View File

File diff suppressed because it is too large Load Diff

778
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/EditTemplateModal.tsx
View File

@@ -1,778 +0,0 @@
import { useEffect, useState } from "react";
import { Controller, useForm } from "react-hook-form";
import { faPlus, faTrash } from "@fortawesome/free-solid-svg-icons";
import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
import { zodResolver } from "@hookform/resolvers/zod";
import { z } from "zod";
import { createNotification } from "@app/components/notifications";
import {
Button,
FormControl,
Input,
Modal,
ModalContent,
Select,
SelectItem,
TextArea
} from "@app/components/v2";
import { useUpdateCertificateTemplateV2New } from "@app/hooks/api/certificateTemplates/mutations";
import { TCertificateTemplateV2New } from "@app/hooks/api/certificateTemplates/types";
import { KeyUsagesSection } from "./shared";
const attributeSchema = z.object({
type: z.enum(["common_name"]),
include: z.enum(["mandatory", "optional", "prohibit"]),
value: z.array(z.string()).optional()
});
const sanSchema = z.object({
type: z.enum(["dns_name", "ip_address", "email", "uri"]),
include: z.enum(["mandatory", "optional", "prohibit"]),
value: z.array(z.string()).optional()
});
const schema = z.object({
name: z.string().trim().min(1, "Template name is required"),
description: z.string().optional(),
attributes: z.array(attributeSchema).optional(),
keyUsages: z
.object({
requiredUsages: z.array(z.string()),
optionalUsages: z.array(z.string())
})
.optional(),
extendedKeyUsages: z
.object({
requiredUsages: z.array(z.string()),
optionalUsages: z.array(z.string())
})
.optional(),
subjectAlternativeNames: z.array(sanSchema).optional(),
validity: z
.object({
maxDuration: z.object({
value: z.number().positive(),
unit: z.enum(["days", "months", "years"])
}),
minDuration: z
.object({
value: z.number().positive(),
unit: z.enum(["days", "months", "years"])
})
.optional()
})
.optional(),
signatureAlgorithm: z
.object({
allowedAlgorithms: z.array(z.string()).min(1),
defaultAlgorithm: z.string()
})
.optional(),
keyAlgorithm: z
.object({
allowedKeyTypes: z.array(z.string()).min(1),
defaultKeyType: z.string()
})
.optional()
});
export type FormData = z.infer<typeof schema>;
interface Props {
isOpen: boolean;
onClose: () => void;
template: TCertificateTemplateV2New;
}
const ATTRIBUTE_TYPES = [
{ value: "common_name", label: "Common Name (CN)" }
];
const SAN_TYPES = [
{ value: "dns_name", label: "DNS Name" },
{ value: "ip_address", label: "IP Address" },
{ value: "email", label: "Email" },
{ value: "uri", label: "URI" }
];
const INCLUDE_TYPES = [
{ value: "mandatory", label: "Mandatory", color: "red" },
{ value: "optional", label: "Optional", color: "blue" },
{ value: "prohibit", label: "Prohibited", color: "gray" }
];
const SIGNATURE_ALGORITHMS = [
"SHA256-RSA",
"SHA384-RSA",
"SHA512-RSA",
"SHA256-ECDSA",
"SHA384-ECDSA",
"SHA512-ECDSA"
];
const KEY_ALGORITHMS = [
"RSA-2048",
"RSA-3072",
"RSA-4096",
"ECDSA-P256",
"ECDSA-P384",
"ECDSA-P521"
];
export const EditTemplateModal = ({ isOpen, onClose, template }: Props) => {
const updateTemplate = useUpdateCertificateTemplateV2New();
const [activeTab, setActiveTab] = useState<string>("basic");
const getFormDefaultValues = () => {
if (!template) {
return {
name: "",
description: "",
attributes: [],
keyUsages: { requiredUsages: [], optionalUsages: [] },
extendedKeyUsages: { requiredUsages: [], optionalUsages: [] },
subjectAlternativeNames: [],
validity: { maxDuration: { value: 365, unit: "days" as const } },
signatureAlgorithm: { allowedAlgorithms: ["SHA256-RSA"], defaultAlgorithm: "SHA256-RSA" },
keyAlgorithm: { allowedKeyTypes: ["RSA-2048"], defaultKeyType: "RSA-2048" }
};
}
const backendKeyUsages = template.keyUsages || {
requiredUsages: { all: [] },
optionalUsages: { all: [] }
};
const backendExtendedKeyUsages = template.extendedKeyUsages || {
requiredUsages: { all: [] },
optionalUsages: { all: [] }
};
return {
name: template.name,
description: template.description || "",
attributes: template.attributes || [],
keyUsages: {
requiredUsages: backendKeyUsages.requiredUsages?.all || [],
optionalUsages: backendKeyUsages.optionalUsages?.all || []
},
extendedKeyUsages: {
requiredUsages: backendExtendedKeyUsages.requiredUsages?.all || [],
optionalUsages: backendExtendedKeyUsages.optionalUsages?.all || []
},
subjectAlternativeNames: template.subjectAlternativeNames || [],
validity: template.validity || { maxDuration: { value: 365, unit: "days" as const } },
signatureAlgorithm: template.signatureAlgorithm || {
allowedAlgorithms: ["SHA256-RSA"],
defaultAlgorithm: "SHA256-RSA"
},
keyAlgorithm: template.keyAlgorithm || {
allowedKeyTypes: ["RSA-2048"],
defaultKeyType: "RSA-2048"
}
};
};
const { control, handleSubmit, reset, watch, setValue } = useForm<FormData>({
resolver: zodResolver(schema),
defaultValues: getFormDefaultValues()
});
const watchedAttributes = watch("attributes") || [];
const watchedSans = watch("subjectAlternativeNames") || [];
const watchedKeyUsages = watch("keyUsages");
const watchedExtendedKeyUsages = watch("extendedKeyUsages");
useEffect(() => {
if (template) {
reset(getFormDefaultValues());
}
}, [template, reset]);
const onFormSubmit = async (data: FormData) => {
try {
const templateData = {
templateId: template.id,
name: data.name,
description: data.description,
attributes: data.attributes || [],
keyUsages: {
requiredUsages: { all: data.keyUsages?.requiredUsages || [] },
optionalUsages: { all: data.keyUsages?.optionalUsages || [] }
},
extendedKeyUsages: {
requiredUsages: { all: data.extendedKeyUsages?.requiredUsages || [] },
optionalUsages: { all: data.extendedKeyUsages?.optionalUsages || [] }
},
subjectAlternativeNames: data.subjectAlternativeNames || [],
validity: data.validity || {
maxDuration: { value: 365, unit: "days" as const }
},
signatureAlgorithm: data.signatureAlgorithm || {
allowedAlgorithms: ["SHA256-RSA"],
defaultAlgorithm: "SHA256-RSA"
},
keyAlgorithm: data.keyAlgorithm || {
allowedKeyTypes: ["RSA-2048"],
defaultKeyType: "RSA-2048"
}
};
await updateTemplate.mutateAsync(templateData);
createNotification({
text: "Certificate template updated successfully",
type: "success"
});
onClose();
} catch (error) {
console.error("Error updating template:", error);
createNotification({
text: "Failed to update certificate template",
type: "error"
});
}
};
const addAttribute = () => {
const newAttribute = {
type: "common_name" as const,
include: "optional" as const,
value: []
};
setValue("attributes", [...watchedAttributes, newAttribute]);
};
const removeAttribute = (index: number) => {
const newAttributes = watchedAttributes.filter((_, i) => i !== index);
setValue("attributes", newAttributes);
};
const addSan = () => {
const newSan = {
type: "dns_name" as const,
include: "optional" as const,
value: []
};
setValue("subjectAlternativeNames", [...watchedSans, newSan]);
};
const removeSan = (index: number) => {
const newSans = watchedSans.filter((_, i) => i !== index);
setValue("subjectAlternativeNames", newSans);
};
const toggleKeyUsage = (usage: string, type: "required" | "optional") => {
const current = watchedKeyUsages || { requiredUsages: [], optionalUsages: [] };
const otherType = type === "required" ? "optional" : "required";
const currentList = Array.isArray(current[`${type}Usages`]) ? current[`${type}Usages`] : [];
const otherList = Array.isArray(current[`${otherType}Usages`])
? current[`${otherType}Usages`]
: [];
const newOtherList = otherList.filter((u) => u !== usage);
const newCurrentList = currentList.includes(usage)
? currentList.filter((u) => u !== usage)
: [...currentList, usage];
setValue("keyUsages", {
[`${type}Usages`]: newCurrentList,
[`${otherType}Usages`]: newOtherList
} as any);
};
const toggleExtendedKeyUsage = (usage: string, type: "required" | "optional") => {
const current = watchedExtendedKeyUsages || { requiredUsages: [], optionalUsages: [] };
const otherType = type === "required" ? "optional" : "required";
const currentList = Array.isArray(current[`${type}Usages`]) ? current[`${type}Usages`] : [];
const otherList = Array.isArray(current[`${otherType}Usages`])
? current[`${otherType}Usages`]
: [];
const newOtherList = otherList.filter((u) => u !== usage);
const newCurrentList = currentList.includes(usage)
? currentList.filter((u) => u !== usage)
: [...currentList, usage];
setValue("extendedKeyUsages", {
[`${type}Usages`]: newCurrentList,
[`${otherType}Usages`]: newOtherList
} as any);
};
const tabs = [
{ id: "basic", label: "Basic Info" },
{ id: "attributes", label: "Subject Attributes" },
{ id: "san", label: "Subject Alternative Names" },
{ id: "usages", label: "Key Usages" },
{ id: "constraints", label: "Constraints" }
];
return (
<Modal
isOpen={isOpen}
onOpenChange={(open) => {
if (!open) {
reset();
}
onClose();
}}
>
<ModalContent
className="max-w-4xl"
title="Edit Certificate Template"
subTitle={`Update configuration for ${template?.name}`}
>
<form onSubmit={handleSubmit(onFormSubmit)} className="space-y-6">
{/* Tab Navigation */}
<div className="flex border-b border-mineshaft-600">
{tabs.map((tab) => (
<button
key={tab.id}
type="button"
onClick={() => setActiveTab(tab.id)}
className={`border-b-2 px-4 py-2 text-sm font-medium transition-colors ${
activeTab === tab.id
? "border-primary-500 text-primary-400"
: "border-transparent text-bunker-300 hover:text-mineshaft-200"
}`}
>
{tab.label}
</button>
))}
</div>
{/* Tab Content */}
<div className="max-h-80 overflow-y-auto">
{activeTab === "basic" && (
<div className="space-y-4">
<Controller
control={control}
name="name"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Template Name"
isRequired
isError={Boolean(error)}
errorText={error?.message}
>
<Input {...field} placeholder="Enter template name" className="w-full" />
</FormControl>
)}
/>
<Controller
control={control}
name="description"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Description"
isError={Boolean(error)}
errorText={error?.message}
>
<TextArea {...field} placeholder="Enter template description" rows={3} />
</FormControl>
)}
/>
</div>
)}
{activeTab === "attributes" && (
<div className="space-y-4">
<div className="flex items-center justify-between">
<Button
type="button"
onClick={addAttribute}
size="sm"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
>
Add Attribute
</Button>
</div>
<div className="space-y-3">
{watchedAttributes.length === 0 ? (
<div className="py-8 text-center text-bunker-300">
No subject attributes configured yet. Click &quot;Add Attribute&quot; to get
started.
</div>
) : (
watchedAttributes.map((attr, index) => (
<div
key={`attr-${attr.type}`}
className="flex items-center gap-3 rounded border border-mineshaft-600 p-3"
>
<Select
value={attr.type}
onValueChange={(value) => {
const newAttributes = [...watchedAttributes];
newAttributes[index] = { ...attr, type: value as any };
setValue("attributes", newAttributes);
}}
className="w-56"
>
{ATTRIBUTE_TYPES.map((type) => (
<SelectItem key={type.value} value={type.value}>
{type.label}
</SelectItem>
))}
</Select>
<Select
value={attr.include}
onValueChange={(value) => {
const newAttributes = [...watchedAttributes];
newAttributes[index] = { ...attr, include: value as any };
setValue("attributes", newAttributes);
}}
className="w-36"
>
{INCLUDE_TYPES.map((type) => (
<SelectItem key={type.value} value={type.value}>
{type.label}
</SelectItem>
))}
</Select>
<Input
placeholder="Pattern/Value (optional)"
value={attr.value?.[0] || ""}
onChange={(e) => {
const newAttributes = [...watchedAttributes];
newAttributes[index] = {
...attr,
value: e.target.value ? [e.target.value] : []
};
setValue("attributes", newAttributes);
}}
className="flex-1"
/>
<Button
type="button"
onClick={() => removeAttribute(index)}
variant="outline"
size="sm"
colorSchema="danger"
>
<FontAwesomeIcon icon={faTrash} />
</Button>
</div>
))
)}
</div>
</div>
)}
{activeTab === "san" && (
<div className="space-y-4">
<div className="flex items-center justify-between">
<Button
type="button"
onClick={addSan}
size="sm"
leftIcon={<FontAwesomeIcon icon={faPlus} />}
>
Add SAN
</Button>
</div>
<div className="space-y-3">
{watchedSans.length === 0 ? (
<div className="py-8 text-center text-bunker-300">
No subject alternative names configured yet. Click &quot;Add SAN&quot; to get
started.
</div>
) : (
watchedSans.map((san, index) => (
<div
key={`san-${san.type}`}
className="flex items-center gap-3 rounded border border-mineshaft-600 p-3"
>
<Select
value={san.type}
onValueChange={(value) => {
const newSans = [...watchedSans];
newSans[index] = { ...san, type: value as any };
setValue("subjectAlternativeNames", newSans);
}}
className="w-36"
>
{SAN_TYPES.map((type) => (
<SelectItem key={type.value} value={type.value}>
{type.label}
</SelectItem>
))}
</Select>
<Select
value={san.include}
onValueChange={(value) => {
const newSans = [...watchedSans];
newSans[index] = { ...san, include: value as any };
setValue("subjectAlternativeNames", newSans);
}}
className="w-36"
>
{INCLUDE_TYPES.map((type) => (
<SelectItem key={type.value} value={type.value}>
{type.label}
</SelectItem>
))}
</Select>
<Input
placeholder="Pattern/Value (optional)"
value={san.value?.[0] || ""}
onChange={(e) => {
const newSans = [...watchedSans];
newSans[index] = {
...san,
value: e.target.value ? [e.target.value] : []
};
setValue("subjectAlternativeNames", newSans);
}}
className="flex-1"
/>
<Button
type="button"
onClick={() => removeSan(index)}
variant="outline"
size="sm"
colorSchema="danger"
>
<FontAwesomeIcon icon={faTrash} />
</Button>
</div>
))
)}
</div>
</div>
)}
{activeTab === "usages" && (
<KeyUsagesSection
watchedKeyUsages={watchedKeyUsages}
watchedExtendedKeyUsages={watchedExtendedKeyUsages}
toggleKeyUsage={toggleKeyUsage}
toggleExtendedKeyUsage={toggleExtendedKeyUsage}
/>
)}
{activeTab === "constraints" && (
<div className="space-y-4">
<div className="space-y-4">
<div className="grid grid-cols-2 gap-4">
<Controller
control={control}
name="validity.maxDuration.value"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Max Duration"
isError={Boolean(error)}
errorText={error?.message}
>
<Input {...field} type="number" placeholder="365" className="w-full" />
</FormControl>
)}
/>
<Controller
control={control}
name="validity.maxDuration.unit"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Unit"
isError={Boolean(error)}
errorText={error?.message}
>
<Select {...field} onValueChange={field.onChange} className="w-full">
<SelectItem value="days">Days</SelectItem>
<SelectItem value="months">Months</SelectItem>
<SelectItem value="years">Years</SelectItem>
</Select>
</FormControl>
)}
/>
</div>
</div>
<div className="space-y-3">
<div className="space-y-4">
<Controller
control={control}
name="signatureAlgorithm.allowedAlgorithms"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Allowed Signature Algorithms"
isError={Boolean(error)}
errorText={error?.message}
>
<div className="space-y-2">
<div className="flex flex-wrap gap-2">
{SIGNATURE_ALGORITHMS.map((alg) => {
const isSelected = field.value?.includes(alg);
return (
<Button
key={alg}
type="button"
size="xs"
variant={isSelected ? "solid" : "outline"}
colorSchema={isSelected ? "primary" : "gray"}
onClick={() => {
const current = field.value || [];
let newValue;
if (isSelected) {
if (current.length > 1) {
newValue = current.filter((a) => a !== alg);
} else {
return;
}
} else {
newValue = [...current, alg];
}
field.onChange(newValue);
const currentDefault = watch(
"signatureAlgorithm.defaultAlgorithm"
);
if (!newValue.includes(currentDefault)) {
setValue(
"signatureAlgorithm.defaultAlgorithm",
newValue[0]
);
}
}}
>
{alg}
</Button>
);
})}
</div>
</div>
</FormControl>
)}
/>
<Controller
control={control}
name="signatureAlgorithm.defaultAlgorithm"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Default Signature Algorithm"
isError={Boolean(error)}
errorText={error?.message}
>
<Select
value={field.value || ""}
onValueChange={field.onChange}
className="w-full"
>
{(watch("signatureAlgorithm.allowedAlgorithms") || []).map(
(alg: string) => (
<SelectItem key={alg} value={alg}>
{alg}
</SelectItem>
)
)}
</Select>
</FormControl>
)}
/>
<Controller
control={control}
name="keyAlgorithm.allowedKeyTypes"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Allowed Key Algorithms"
isError={Boolean(error)}
errorText={error?.message}
>
<div className="space-y-2">
<div className="flex flex-wrap gap-2">
{KEY_ALGORITHMS.map((alg) => {
const isSelected = field.value?.includes(alg);
return (
<Button
key={alg}
type="button"
size="xs"
variant={isSelected ? "solid" : "outline"}
colorSchema={isSelected ? "primary" : "gray"}
onClick={() => {
const current = field.value || [];
let newValue;
if (isSelected) {
if (current.length > 1) {
newValue = current.filter((a) => a !== alg);
} else {
return;
}
} else {
newValue = [...current, alg];
}
field.onChange(newValue);
const currentDefault = watch("keyAlgorithm.defaultKeyType");
if (!newValue.includes(currentDefault)) {
setValue("keyAlgorithm.defaultKeyType", newValue[0]);
}
}}
>
{alg}
</Button>
);
})}
</div>
</div>
</FormControl>
)}
/>
<Controller
control={control}
name="keyAlgorithm.defaultKeyType"
render={({ field, fieldState: { error } }) => (
<FormControl
label="Default Key Algorithm"
isError={Boolean(error)}
errorText={error?.message}
>
<Select
value={field.value || ""}
onValueChange={field.onChange}
className="w-full"
>
{(watch("keyAlgorithm.allowedKeyTypes") || []).map((alg: string) => (
<SelectItem key={alg} value={alg}>
{alg}
</SelectItem>
))}
</Select>
</FormControl>
)}
/>
</div>
</div>
</div>
)}
</div>
<div className="flex gap-3">
<Button type="submit" colorSchema="primary" isLoading={updateTemplate.isPending}>
Save Changes
</Button>
<Button variant="outline_bg" onClick={onClose} disabled={updateTemplate.isPending}>
Cancel
</Button>
</div>
</form>
</ModalContent>
</Modal>
);
};

2
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/TemplateList.tsx
View File

@@ -82,7 +82,7 @@ export const TemplateList = ({ onEditTemplate, onDeleteTemplate }: Props) => {
>
<Td>
<div className="flex items-center gap-2">
<div className="font-medium">{template.name}</div>
<div className="font-medium">{template.slug}</div>
{template.description && (
<Tooltip content={template.description}>
<FontAwesomeIcon icon={faCircleInfo} className="text-mineshaft-400" />

1
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/index.ts
View File

@@ -1,4 +1,3 @@
export { CertificateTemplatesV2Tab } from "./CertificateTemplatesV2Tab";
export { CreateTemplateModal } from "./CreateTemplateModal";
export { EditTemplateModal } from "./EditTemplateModal";
export { TemplateList } from "./TemplateList";

2
frontend/src/pages/cert-manager/PoliciesPage/components/CertificateTemplatesV2Tab/shared/schemas.ts
View File

@@ -15,7 +15,7 @@ export const sanSchema = z.object({
});
export const templateSchema = z.object({
name: z.string().trim().min(1, "Template name is required"),
slug: z.string().trim().min(1, "Template name is required"),
description: z.string().optional(),
attributes: z.array(attributeSchema).optional(),
keyUsages: z