awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address greptile comments

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-23 10:23:40 -03:00
parent e70162dad3
commit e364eb15db
14 changed files with 396 additions and 358 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/db/migrations/20251021112356_add-certificate-auto-renewal.ts
View File

@@ -5,8 +5,7 @@ import { TableName } from "../schemas";
export async function up(knex: Knex): Promise<void> {
if (await knex.schema.hasColumn(TableName.PkiApiEnrollmentConfig, "autoRenewDays")) {
await knex.schema.alterTable(TableName.PkiApiEnrollmentConfig, (t) => {
t.dropColumn("autoRenewDays");
t.integer("renewBeforeDays");
t.renameColumn("autoRenewDays", "renewBeforeDays");
});
}
@@ -46,8 +45,7 @@ export async function down(knex: Knex): Promise<void> {
if (await knex.schema.hasColumn(TableName.PkiApiEnrollmentConfig, "renewBeforeDays")) {
await knex.schema.alterTable(TableName.PkiApiEnrollmentConfig, (t) => {
t.dropColumn("renewBeforeDays");
t.integer("autoRenewDays");
t.renameColumn("renewBeforeDays", "autoRenewDays");
});
}
}

3
backend/src/server/routes/index.ts
View File

@@ -2147,9 +2147,6 @@ export const registerRoutes = async (
const certificateV3Queue = certificateV3QueueServiceFactory({
queueService,
certificateDAL,
certificateAuthorityDAL,
certificateProfileDAL,
projectDAL,
certificateV3Service,
auditLogService
});

12
backend/src/server/routes/v3/certificates-router.ts
View File

@@ -406,10 +406,14 @@ export const registerCertificatesRouter = async (server: FastifyZodProvider) =>
params: z.object({
certificateId: z.string().uuid()
}),
body: z.object({
renewBeforeDays: z.number().int().min(1).max(30).optional(),
disableAutoRenewal: z.boolean().optional()
}),
body: z
.object({
renewBeforeDays: z.number().int().min(1).max(30).optional(),
disableAutoRenewal: z.boolean().optional()
})
.refine((data) => !(data.renewBeforeDays !== undefined && data.disableAutoRenewal === true), {
message: "Cannot specify both renewBeforeDays and disableAutoRenewal"
}),
response: {
200: z.object({
message: z.string(),

30
backend/src/services/certificate-common/certificate-constants.ts
View File

@@ -175,6 +175,36 @@ export enum CertSignatureAlgorithm {
ECDSA_SHA512 = "ECDSA-SHA512"
}
export enum CertificateRenewalErrorType {
TEMPLATE_VALIDATION_FAILED = "TEMPLATE_VALIDATION_FAILED",
CA_NOT_FOUND = "CA_NOT_FOUND",
CA_INACTIVE = "CA_INACTIVE",
CERTIFICATE_OUTLIVES_CA = "CERTIFICATE_OUTLIVES_CA",
TTL_TOO_SHORT = "TTL_TOO_SHORT",
NOT_ELIGIBLE = "NOT_ELIGIBLE",
VALIDITY_EXCEEDS_MAXIMUM = "VALIDITY_EXCEEDS_MAXIMUM",
NOT_ALLOWED_BY_TEMPLATE = "NOT_ALLOWED_BY_TEMPLATE",
UNKNOWN_ERROR = "UNKNOWN_ERROR"
}
export const CERTIFICATE_RENEWAL_ERROR_MESSAGES = {
[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED]:
"Auto-renewal failed: certificate template policy has changed and this certificate no longer meets the requirements",
[CertificateRenewalErrorType.CA_NOT_FOUND]:
"Auto-renewal failed: Certificate Authority for this certificate is no longer available",
[CertificateRenewalErrorType.CA_INACTIVE]: "Auto-renewal failed: Certificate Authority is currently inactive",
[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA]:
"Auto-renewal failed: certificate would outlive the Certificate Authority",
[CertificateRenewalErrorType.TTL_TOO_SHORT]:
"Auto-renewal failed: certificate validity period is too short for the renewal threshold",
[CertificateRenewalErrorType.NOT_ELIGIBLE]: "Auto-renewal failed: certificate is not eligible for automatic renewal",
[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM]:
"Auto-renewal failed: certificate validity period exceeds the maximum allowed by the profile template",
[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE]:
"Auto-renewal failed: certificate settings are no longer allowed by the profile template",
[CertificateRenewalErrorType.UNKNOWN_ERROR]: "Auto-renewal failed: an unexpected error occurred"
} as const;
export const CERTIFICATE_RENEWAL_CONFIG = {
MIN_RENEW_BEFORE_DAYS: 1,
MAX_RENEW_BEFORE_DAYS: 30,

75
backend/src/services/certificate-common/certificate-utils.ts
View File

@@ -1,8 +1,12 @@
import RE2 from "re2";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { CertExtendedKeyUsage, CertKeyUsage } from "../certificate/certificate-types";
import {
CertExtendedKeyUsageType,
CERTIFICATE_RENEWAL_ERROR_MESSAGES,
CertificateRenewalErrorType,
CertKeyUsageType,
mapExtendedKeyUsageToLegacy,
mapKeyUsageToLegacy,
@@ -196,3 +200,74 @@ export const convertExtendedKeyUsageArrayToLegacy = (
): CertExtendedKeyUsage[] | undefined => {
return usages?.map(convertToLegacyExtendedKeyUsage);
};
export const categorizeCertificateRenewalError = (error: unknown): string => {
if (!error) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.UNKNOWN_ERROR];
}
const errorMessage = error instanceof Error ? error.message : String(error);
if (error instanceof NotFoundError) {
if (errorMessage.includes("Certificate Authority")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_NOT_FOUND];
}
if (errorMessage.includes("Certificate template")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
}
if (error instanceof BadRequestError) {
if (errorMessage.includes("Certificate Authority is") && errorMessage.includes("must be ACTIVE")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_INACTIVE];
}
if (errorMessage.includes("would expire") && errorMessage.includes("after its issuing CA")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA];
}
if (errorMessage.includes("TTL") && errorMessage.includes("must be greater than renewal threshold")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TTL_TOO_SHORT];
}
if (errorMessage.includes("not eligible for renewal")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ELIGIBLE];
}
if (errorMessage.includes("Requested validity period exceeds maximum allowed duration")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM];
}
if (errorMessage.includes("not allowed by template policy")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE];
}
}
if (error instanceof ForbiddenRequestError) {
if (errorMessage.includes("Template validation failed")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
}
if (errorMessage.includes("Template validation failed")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
if (errorMessage.includes("Certificate Authority") && errorMessage.includes("not found")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_NOT_FOUND];
}
if (errorMessage.includes("Certificate Authority is") && errorMessage.includes("must be ACTIVE")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_INACTIVE];
}
if (errorMessage.includes("would expire") && errorMessage.includes("after its issuing CA")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA];
}
if (errorMessage.includes("TTL") && errorMessage.includes("must be greater than renewal threshold")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TTL_TOO_SHORT];
}
if (errorMessage.includes("not eligible for renewal")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ELIGIBLE];
}
if (errorMessage.includes("Requested validity period exceeds maximum allowed duration")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM];
}
if (errorMessage.includes("not allowed by template policy")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE];
}
return `${CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.UNKNOWN_ERROR]}: ${errorMessage}`;
};

266
backend/src/services/certificate-v3/certificate-v3-queue.ts
View File

@@ -5,19 +5,13 @@ import { QueueJobs, QueueName, TQueueServiceFactory } from "@app/queue";
import { ActorType } from "../auth/auth-type";
import { TCertificateDALFactory } from "../certificate/certificate-dal";
import { CertStatus } from "../certificate/certificate-types";
import { TCertificateAuthorityDALFactory } from "../certificate-authority/certificate-authority-dal";
import { CERTIFICATE_RENEWAL_CONFIG } from "../certificate-common/certificate-constants";
import { TCertificateProfileDALFactory } from "../certificate-profile/certificate-profile-dal";
import { TProjectDALFactory } from "../project/project-dal";
import { categorizeCertificateRenewalError } from "../certificate-common/certificate-utils";
import { TCertificateV3ServiceFactory } from "./certificate-v3-service";
type TCertificateV3QueueServiceFactoryDep = {
queueService: TQueueServiceFactory;
certificateDAL: TCertificateDALFactory;
certificateAuthorityDAL: Pick<TCertificateAuthorityDALFactory, "findByIdWithAssociatedCa">;
certificateProfileDAL: Pick<TCertificateProfileDALFactory, "findByIdWithConfigs">;
projectDAL: Pick<TProjectDALFactory, "findById">;
certificateDAL: Pick<TCertificateDALFactory, "findCertificatesEligibleForRenewal" | "updateById">;
certificateV3Service: TCertificateV3ServiceFactory;
auditLogService: Pick<TAuditLogServiceFactory, "createAuditLog">;
};
@@ -25,9 +19,6 @@ type TCertificateV3QueueServiceFactoryDep = {
export const certificateV3QueueServiceFactory = ({
queueService,
certificateDAL,
certificateAuthorityDAL,
certificateProfileDAL,
projectDAL,
certificateV3Service,
auditLogService
}: TCertificateV3QueueServiceFactoryDep) => {
@@ -38,190 +29,109 @@ export const certificateV3QueueServiceFactory = ({
const { QUEUE_BATCH_SIZE } = CERTIFICATE_RENEWAL_CONFIG;
let offset = 0;
let hasMore = true;
let totalCertificatesFound = 0;
let totalCertificatesRenewed = 0;
while (hasMore) {
const certificates = await certificateDAL.find(
{
$notNull: ["profileId"],
status: CertStatus.ACTIVE,
renewedById: null,
renewalError: null,
revokedAt: null
},
{
limit: QUEUE_BATCH_SIZE,
offset
}
);
const certificates = await certificateDAL.findCertificatesEligibleForRenewal({
limit: QUEUE_BATCH_SIZE,
offset
});
if (certificates.length === 0) {
hasMore = false;
break;
}
await Promise.all(
certificates.map(async (certificate) => {
try {
if (!certificate.profileId || !certificate.notAfter) {
return;
}
const profile = await certificateProfileDAL.findByIdWithConfigs(certificate.profileId);
if (!profile) {
logger.warn(`Profile not found for certificate ${certificate.id}`);
return;
}
const ca = await certificateAuthorityDAL.findByIdWithAssociatedCa(profile.caId);
if (!ca) {
logger.warn(`CA not found for certificate ${certificate.id}`);
return;
}
const profileAutoRenewEnabled = profile.apiConfig?.autoRenew === true;
const certificateHasRenewalConfig =
certificate.renewBeforeDays != null && certificate.renewBeforeDays > 0;
if (!profileAutoRenewEnabled && !certificateHasRenewalConfig) {
return;
}
const now = new Date();
if (certificate.notAfter <= now) {
return;
}
const renewBeforeDays = certificate.renewBeforeDays || profile.apiConfig?.renewBeforeDays;
if (!renewBeforeDays) {
return;
}
totalCertificatesFound += certificates.length;
logger.info(
`${QueueJobs.CertificateV3DailyAutoRenewal}: found ${certificates.length} certificates eligible for renewal (batch ${Math.floor(offset / QUEUE_BATCH_SIZE) + 1}, total found so far: ${totalCertificatesFound})`
);
for (const certificate of certificates) {
try {
if (certificate.renewBeforeDays) {
const { MIN_RENEW_BEFORE_DAYS, MAX_RENEW_BEFORE_DAYS } = CERTIFICATE_RENEWAL_CONFIG;
if (renewBeforeDays < MIN_RENEW_BEFORE_DAYS || renewBeforeDays > MAX_RENEW_BEFORE_DAYS) {
logger.warn(`Invalid renewal threshold ${renewBeforeDays} for certificate ${certificate.id}`);
return;
}
const expiryDate = new Date(certificate.notAfter);
const renewalDate = new Date(expiryDate.getTime() - renewBeforeDays * 24 * 60 * 60 * 1000);
const shouldRenew = renewalDate <= now;
if (shouldRenew) {
logger.info(`Auto-renewing certificate ${certificate.id} (common name: ${certificate.commonName})`);
const project = await projectDAL.findById(certificate.projectId);
if (!project) {
logger.error(`Project not found for certificate ${certificate.id}`);
return;
}
await certificateV3Service.renewCertificate({
actor: ActorType.PLATFORM,
actorId: "",
actorAuthMethod: null,
actorOrgId: project.orgId,
certificateId: certificate.id,
internal: true
});
await certificateDAL.updateById(certificate.id, {
renewalError: null
});
await auditLogService.createAuditLog({
projectId: certificate.projectId,
actor: {
type: ActorType.PLATFORM,
metadata: {}
},
event: {
type: EventType.AUTOMATED_RENEW_CERTIFICATE,
metadata: {
certificateId: certificate.id,
commonName: certificate.commonName || "",
profileId: certificate.profileId,
renewBeforeDays: certificate.renewBeforeDays?.toString() || ""
}
}
});
logger.info(`Successfully auto-renewed certificate ${certificate.id}`);
}
} catch (error) {
logger.error(
error,
`Failed to auto-renew certificate ${certificate.id} (common name: ${certificate.commonName})`
);
const errorMessage = error instanceof Error ? error.message : "Unknown error";
let categorizedError = errorMessage;
if (errorMessage.includes("Template validation failed")) {
categorizedError =
"Auto-renewal failed: certificate template policy has changed and this certificate no longer meets the requirements";
} else if (errorMessage.includes("Certificate Authority") && errorMessage.includes("not found")) {
categorizedError =
"Auto-renewal failed: Certificate Authority for this certificate is no longer available";
} else if (errorMessage.includes("Certificate Authority is") && errorMessage.includes("must be ACTIVE")) {
categorizedError = "Auto-renewal failed: Certificate Authority is currently inactive";
} else if (errorMessage.includes("would expire") && errorMessage.includes("after its issuing CA")) {
categorizedError = "Auto-renewal failed: certificate would outlive the Certificate Authority";
} else if (
errorMessage.includes("TTL") &&
errorMessage.includes("must be greater than renewal threshold")
if (
certificate.renewBeforeDays < MIN_RENEW_BEFORE_DAYS ||
certificate.renewBeforeDays > MAX_RENEW_BEFORE_DAYS
) {
categorizedError =
"Auto-renewal failed: certificate validity period is too short for the renewal threshold";
} else if (errorMessage.includes("not eligible for renewal")) {
categorizedError = "Auto-renewal failed: certificate is not eligible for automatic renewal";
} else if (errorMessage.includes("Requested validity period exceeds maximum allowed duration")) {
categorizedError =
"Auto-renewal failed: certificate validity period exceeds the maximum allowed by the profile template";
} else if (errorMessage.includes("not allowed by template policy")) {
categorizedError =
"Auto-renewal failed: certificate settings are no longer allowed by the profile template";
} else {
categorizedError = `Auto-renewal failed: ${errorMessage}`;
}
try {
await certificateDAL.updateById(certificate.id, {
renewalError: categorizedError
});
} catch (updateError) {
logger.error(updateError, `Failed to update renewal error for certificate ${certificate.id}`);
}
try {
await auditLogService.createAuditLog({
projectId: certificate.projectId,
actor: {
type: ActorType.PLATFORM,
metadata: {}
},
event: {
type: EventType.AUTOMATED_RENEW_CERTIFICATE_FAILED,
metadata: {
certificateId: certificate.id,
commonName: certificate.commonName || "",
profileId: certificate.profileId || "",
renewBeforeDays: certificate.renewBeforeDays?.toString() || "",
error: categorizedError
}
}
});
} catch (auditError) {
logger.error(auditError, `Failed to create audit log for failed certificate renewal ${certificate.id}`);
// eslint-disable-next-line no-continue
continue;
}
}
})
);
await certificateV3Service.renewCertificate({
actor: ActorType.PLATFORM,
actorId: "",
actorAuthMethod: null,
actorOrgId: "",
certificateId: certificate.id,
internal: true
});
await certificateDAL.updateById(certificate.id, {
renewalError: null
});
totalCertificatesRenewed += 1;
await auditLogService.createAuditLog({
projectId: certificate.projectId,
actor: {
type: ActorType.PLATFORM,
metadata: {}
},
event: {
type: EventType.AUTOMATED_RENEW_CERTIFICATE,
metadata: {
certificateId: certificate.id,
commonName: certificate.commonName || "",
profileId: certificate.profileId!,
renewBeforeDays: certificate.renewBeforeDays?.toString() || ""
}
}
});
} catch (error) {
const categorizedError: string = categorizeCertificateRenewalError(error);
try {
await certificateDAL.updateById(certificate.id, {
renewalError: categorizedError
});
} catch (updateError) {
logger.error(updateError, `Failed to update renewal error for certificate ${certificate.id}`);
}
try {
await auditLogService.createAuditLog({
projectId: certificate.projectId,
actor: {
type: ActorType.PLATFORM,
metadata: {}
},
event: {
type: EventType.AUTOMATED_RENEW_CERTIFICATE_FAILED,
metadata: {
certificateId: certificate.id,
commonName: certificate.commonName || "",
profileId: certificate.profileId || "",
renewBeforeDays: certificate.renewBeforeDays?.toString() || "",
error: categorizedError
}
}
});
} catch (auditError) {
logger.error(auditError, `Failed to create audit log for failed certificate renewal ${certificate.id}`);
}
}
}
offset += QUEUE_BATCH_SIZE;
}
logger.info(`${QueueJobs.CertificateV3DailyAutoRenewal}: queue task completed`);
logger.info(
`${QueueJobs.CertificateV3DailyAutoRenewal}: queue task completed. Renewed ${totalCertificatesRenewed} certificates out of ${totalCertificatesFound}`
);
}
});

4
backend/src/services/certificate-v3/certificate-v3-service.test.ts
View File

@@ -1646,7 +1646,7 @@ describe("CertificateV3Service", () => {
...mockActor
})
).rejects.toThrow(
"Certificate renewal failed because requested validity period exceeds maximum allowed duration by the profile template"
"Certificate renewal failed because requested validity period exceeds maximum allowed duration by the profile template: Subject alternative name not allowed"
);
// Should store template validation error
@@ -1788,7 +1788,7 @@ describe("CertificateV3Service", () => {
certificateId: "cert-123",
...mockActor
})
).rejects.toThrow("New certificate would expire");
).rejects.toThrow(/New certificate would expire \(.+\) after its issuing CA \(.+\)/);
});
it("should allow manual renewal outside window (manual renewal always bypasses window)", async () => {

5
backend/src/services/certificate-v3/certificate-v3-service.ts
View File

@@ -733,8 +733,9 @@ export const certificateV3ServiceFactory = ({
? originalCert.altNames.split(",").map((san) => {
const trimmed = san.trim();
const isIp =
new RE2("^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$").test(trimmed) ||
new RE2("^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$").test(trimmed);
trimmed.length <= 45 &&
(new RE2("^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$").test(trimmed) ||
new RE2("^([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}$").test(trimmed));
return {
type: isIp ? CertSubjectAlternativeNameType.IP_ADDRESS : CertSubjectAlternativeNameType.DNS_NAME,
value: trimmed

45
backend/src/services/certificate/certificate-dal.ts
View File

@@ -114,12 +114,55 @@ export const certificateDALFactory = (db: TDbClient) => {
}
};
const findCertificatesEligibleForRenewal = async ({
limit,
offset
}: {
limit: number;
offset: number;
}): Promise<TCertificates[]> => {
try {
const now = new Date();
const endOfDay = new Date(now.getFullYear(), now.getMonth(), now.getDate(), 23, 59, 59, 999);
const certs = (await db
.replicaNode()(TableName.Certificate)
.select(`${TableName.Certificate}.*`)
.where(`${TableName.Certificate}.status`, CertStatus.ACTIVE)
.whereNull(`${TableName.Certificate}.renewedById`)
.whereNull(`${TableName.Certificate}.renewalError`)
.whereNull(`${TableName.Certificate}.revokedAt`)
.whereNotNull(`${TableName.Certificate}.profileId`)
.whereNotNull(`${TableName.Certificate}.notAfter`)
.where(`${TableName.Certificate}.notAfter`, ">", now)
.where((queryBuilder) => {
void queryBuilder.where((subQuery) => {
void subQuery
.whereNotNull(`${TableName.Certificate}.renewBeforeDays`)
.where(`${TableName.Certificate}.renewBeforeDays`, ">", 0)
.whereRaw(
`"${TableName.Certificate}"."notAfter" - INTERVAL '1 day' * "${TableName.Certificate}"."renewBeforeDays" <= ?`,
[endOfDay]
);
});
})
.limit(limit)
.offset(offset)
.orderBy(`${TableName.Certificate}.notAfter`, "asc")) as TCertificates[];
return certs;
} catch (error) {
throw new DatabaseError({ error, name: "Find certificates eligible for renewal" });
}
};
return {
...certificateOrm,
countCertificatesInProject,
countCertificatesForPkiSubscriber,
findLatestActiveCertForSubscriber,
findAllActiveCertsForSubscriber,
findExpiredSyncedCertificates
findExpiredSyncedCertificates,
findCertificatesEligibleForRenewal
};
};

2
frontend/src/hooks/api/certificates/mutations.tsx
View File

@@ -115,7 +115,7 @@ export const useUpdateRenewalConfig = () => {
return useMutation<
{ message: string; renewBeforeDays?: number },
object,
TUpdateRenewalConfigDTO & { disableAutoRenewal?: boolean }
TUpdateRenewalConfigDTO
>({
mutationFn: async ({ certificateId, renewBeforeDays, disableAutoRenewal }) => {
const { data } = await apiRequest.patch<{ message: string; renewBeforeDays?: number }>(

1
frontend/src/hooks/api/certificates/types.ts
View File

@@ -67,5 +67,6 @@ export type TRenewCertificateResponse = {
export type TUpdateRenewalConfigDTO = {
certificateId: string;
renewBeforeDays?: number;
disableAutoRenewal?: boolean;
projectSlug: string;
};

225
frontend/src/pages/cert-manager/CertificatesPage/components/CertificateManageRenewalModal.tsx
View File

@@ -13,24 +13,91 @@ const DEFAULT_RENEWAL_BEFORE_DAYS = 20;
const MIN_RENEWAL_BEFORE_DAYS = 1;
const MAX_RENEWAL_BEFORE_DAYS = 30;
const formSchema = z
.object({
const createFormSchema = (ttlDays: number, notAfter: string) =>
z.object({
renewBeforeDays: z
.number()
.min(MIN_RENEWAL_BEFORE_DAYS, `Renewal days must be at least ${MIN_RENEWAL_BEFORE_DAYS}`)
.max(MAX_RENEWAL_BEFORE_DAYS, `Renewal days cannot exceed ${MAX_RENEWAL_BEFORE_DAYS}`)
})
.refine(() => {
return true;
}, "Invalid renewal configuration");
.refine(
(value) => value < ttlDays,
(value) => ({
message: `Renewal days (${value}) must be less than certificate TTL (${ttlDays} days)`
})
)
.refine(
(value) => {
const expiryDate = new Date(notAfter);
const renewalDate = new Date(expiryDate.getTime() - value * 24 * 60 * 60 * 1000);
const tomorrow = new Date();
tomorrow.setDate(tomorrow.getDate() + 1);
tomorrow.setHours(0, 0, 0, 0);
return renewalDate >= tomorrow;
},
() => ({
message: "Renewals can only be scheduled from tomorrow onwards."
})
)
});
type FormData = z.infer<typeof formSchema>;
type FormData = z.infer<ReturnType<typeof createFormSchema>>;
type Props = {
popUp: UsePopUpState<["manageRenewal"]>;
handlePopUpToggle: (popUpName: keyof UsePopUpState<["manageRenewal"]>, state?: boolean) => void;
};
const RenewalConfigForm = ({
control,
errors,
onSubmit,
isLoading,
buttonText,
onCancel
}: {
control: any;
errors: { renewBeforeDays?: { message?: string } };
onSubmit: (e?: React.BaseSyntheticEvent) => Promise<void>;
isLoading: boolean;
buttonText: string;
onCancel: () => void;
}) => (
<form onSubmit={onSubmit}>
<FormControl
label="Renewal Days Before Expiration"
errorText={errors.renewBeforeDays?.message}
className="mb-6"
>
<Controller
control={control}
name="renewBeforeDays"
render={({ field }) => (
<Input
{...field}
type="number"
min={MIN_RENEWAL_BEFORE_DAYS}
max={MAX_RENEWAL_BEFORE_DAYS}
onChange={(e) => {
const value = parseInt(e.target.value, 10);
field.onChange(value);
}}
placeholder="Enter days before expiration"
/>
)}
/>
</FormControl>
<div className="flex justify-end gap-3">
<Button type="button" colorSchema="secondary" variant="plain" onClick={onCancel}>
Cancel
</Button>
<Button type="submit" colorSchema="primary" isLoading={isLoading} isDisabled={isLoading}>
{buttonText}
</Button>
</div>
</form>
);
export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Props) => {
const { currentProject } = useProject();
const { mutateAsync: updateRenewalConfig, isPending: isUpdatingConfig } =
@@ -41,7 +108,7 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
commonName: string;
profileId: string;
renewBeforeDays?: number;
ttlDays: number;
ttlDays?: number;
notAfter: string;
renewalError?: string;
renewedFromId?: string;
@@ -54,6 +121,11 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
const hasRenewalError = Boolean(certificateData?.renewalError);
const formSchema = createFormSchema(
certificateData?.ttlDays || 365,
certificateData?.notAfter || ""
);
const {
control,
handleSubmit,
@@ -84,30 +156,6 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
return;
}
if (data.renewBeforeDays >= certificateData.ttlDays) {
createNotification({
text: `Renewal days (${data.renewBeforeDays}) must be less than certificate TTL (${certificateData.ttlDays} days)`,
type: "error"
});
return;
}
const expiryDate = new Date(certificateData.notAfter);
const renewalDate = new Date(
expiryDate.getTime() - data.renewBeforeDays * 24 * 60 * 60 * 1000
);
const tomorrow = new Date();
tomorrow.setDate(tomorrow.getDate() + 1);
tomorrow.setHours(0, 0, 0, 0);
if (renewalDate < tomorrow) {
createNotification({
text: "The renewal date cannot be set to today or any past date. Renewals can only be scheduled from tomorrow onwards.",
type: "error"
});
return;
}
await updateRenewalConfig({
certificateId: certificateData.certificateId,
renewBeforeDays: data.renewBeforeDays,
@@ -133,8 +181,6 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
}
};
const isLoading = isUpdatingConfig;
const getModalTitle = () => {
if (hasRenewalError) {
return `Fix Auto-Renewal: ${certificateData?.commonName || ""}`;
@@ -145,6 +191,10 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
return `Enable Auto-Renewal for ${certificateData?.commonName || ""}`;
};
if (!certificateData) {
return null;
}
return (
<Modal
isOpen={popUp?.manageRenewal?.isOpen}
@@ -153,7 +203,6 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
}}
>
<ModalContent title={getModalTitle()}>
{/* Show renewal error if present */}
{hasRenewalError && (
<div className="mb-6 rounded-md border border-red-600 bg-red-900/20 p-4">
<div className="flex items-start gap-3">
@@ -173,100 +222,26 @@ export const CertificateManageRenewalModal = ({ popUp, handlePopUpToggle }: Prop
</div>
)}
{/* Configuration form - shown for all cases except when enabled and no error */}
{(!isAutoRenewalEnabled || hasRenewalError) && (
<form onSubmit={handleSubmit(onUpdateRenewal)}>
<FormControl
label="Renewal Days Before Expiration"
errorText={errors.renewBeforeDays?.message}
className="mb-6"
>
<Controller
control={control}
name="renewBeforeDays"
render={({ field }) => (
<Input
{...field}
type="number"
min={MIN_RENEWAL_BEFORE_DAYS}
max={MAX_RENEWAL_BEFORE_DAYS}
onChange={(e) => {
const value = parseInt(e.target.value, 10);
field.onChange(value);
}}
placeholder="Enter days before expiration"
/>
)}
/>
</FormControl>
<div className="flex justify-end gap-3">
<Button
type="button"
colorSchema="secondary"
variant="plain"
onClick={() => handlePopUpToggle("manageRenewal", false)}
>
Cancel
</Button>
<Button
type="submit"
colorSchema="primary"
isLoading={isUpdatingConfig}
isDisabled={isLoading}
>
{isAutoRenewalEnabled ? "Update Configuration" : "Enable Auto-Renewal"}
</Button>
</div>
</form>
<RenewalConfigForm
control={control}
errors={errors}
onSubmit={handleSubmit(onUpdateRenewal)}
isLoading={isUpdatingConfig}
buttonText={isAutoRenewalEnabled ? "Update Configuration" : "Enable Auto-Renewal"}
onCancel={() => handlePopUpToggle("manageRenewal", false)}
/>
)}
{/* Show edit form for enabled auto-renewal without errors */}
{isAutoRenewalEnabled && !hasRenewalError && (
<form onSubmit={handleSubmit(onUpdateRenewal)}>
<FormControl
label="Renewal Days Before Expiration"
errorText={errors.renewBeforeDays?.message}
className="mb-6"
>
<Controller
control={control}
name="renewBeforeDays"
render={({ field }) => (
<Input
{...field}
type="number"
min={MIN_RENEWAL_BEFORE_DAYS}
max={MAX_RENEWAL_BEFORE_DAYS}
onChange={(e) => {
const value = parseInt(e.target.value, 10);
field.onChange(value);
}}
placeholder="Enter days before expiration"
/>
)}
/>
</FormControl>
<div className="flex justify-end gap-3">
<Button
type="button"
colorSchema="secondary"
variant="plain"
onClick={() => handlePopUpToggle("manageRenewal", false)}
>
Cancel
</Button>
<Button
type="submit"
colorSchema="primary"
isLoading={isUpdatingConfig}
isDisabled={isLoading}
>
Update Configuration
</Button>
</div>
</form>
<RenewalConfigForm
control={control}
errors={errors}
onSubmit={handleSubmit(onUpdateRenewal)}
isLoading={isUpdatingConfig}
buttonText="Update Configuration"
onCancel={() => handlePopUpToggle("manageRenewal", false)}
/>
)}
</ModalContent>
</Modal>

35
frontend/src/pages/cert-manager/CertificatesPage/components/CertificateRenewalConfigModal.tsx
View File

@@ -8,14 +8,21 @@ import { useProject } from "@app/context";
import { useUpdateRenewalConfig } from "@app/hooks/api";
import { UsePopUpState } from "@app/hooks/usePopUp";
const formSchema = z.object({
renewBeforeDays: z
.number()
.min(1, "Renewal days must be at least 1")
.max(365, "Renewal days cannot exceed 365")
});
const createFormSchema = (ttlDays: number) =>
z.object({
renewBeforeDays: z
.number()
.min(1, "Renewal days must be at least 1")
.max(365, "Renewal days cannot exceed 365")
.refine(
(value) => value < ttlDays,
(value) => ({
message: `Renewal days (${value}) must be less than certificate TTL (${ttlDays} days)`
})
)
});
type FormData = z.infer<typeof formSchema>;
type FormData = z.infer<ReturnType<typeof createFormSchema>>;
type Props = {
popUp: UsePopUpState<["configureRenewal"]>;
@@ -37,6 +44,8 @@ export const CertificateRenewalConfigModal = ({ popUp, handlePopUpToggle }: Prop
ttlDays: number;
};
const formSchema = createFormSchema(certificateData.ttlDays);
const {
control,
handleSubmit,
@@ -45,7 +54,7 @@ export const CertificateRenewalConfigModal = ({ popUp, handlePopUpToggle }: Prop
} = useForm<FormData>({
resolver: zodResolver(formSchema),
defaultValues: {
renewBeforeDays: certificateData?.renewBeforeDays || 7
renewBeforeDays: certificateData?.renewBeforeDays || 1
}
});
@@ -53,14 +62,6 @@ export const CertificateRenewalConfigModal = ({ popUp, handlePopUpToggle }: Prop
const onSubmit = async (data: FormData) => {
try {
if (data.renewBeforeDays >= certificateData.ttlDays) {
createNotification({
text: `Renewal days (${data.renewBeforeDays}) must be less than certificate TTL (${certificateData.ttlDays} days)`,
type: "error"
});
return;
}
if (!currentProject?.slug) {
createNotification({
text: "Project not found",
@@ -144,7 +145,7 @@ export const CertificateRenewalConfigModal = ({ popUp, handlePopUpToggle }: Prop
{renewBeforeDays && certificateData?.ttlDays && (
<div className="mt-2 rounded bg-primary-900/20 p-2">
<p className="text-sm text-primary-300">
{renewBeforeDays >= (certificateData.ttlDays || 0)
{renewBeforeDays >= certificateData.ttlDays
? "⚠️ Renewal days must be less than certificate TTL"
: `✓ Certificate will be renewed ${renewBeforeDays} days before expiration`}
</p>

45
frontend/src/pages/cert-manager/CertificatesPage/components/CertificatesTable.tsx
View File

@@ -91,10 +91,14 @@ const getAutoRenewalInfo = (certificate: TCertificate) => {
return { text: "Due Now", variant: "danger" as const };
}
const daysUntilRenewal = Math.ceil(
const daysUntilRenewal = Math.floor(
(renewalDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000)
);
if (daysUntilRenewal === 0) {
return { text: "Renews today", variant: "primary" as const };
}
if (daysUntilRenewal <= 7) {
return { text: `Renews in ${daysUntilRenewal}d`, variant: "primary" as const };
}
@@ -204,6 +208,14 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
data?.certificates.map((certificate) => {
const { variant, label } = getCertValidUntilBadgeDetails(certificate.notAfter);
const autoRenewalInfo = getAutoRenewalInfo(certificate);
const isRevoked = certificate.status === CertStatus.REVOKED;
const isExpired = new Date(certificate.notAfter) < new Date();
const isExpiringWithinDay = isExpiringWithinOneDay(certificate.notAfter);
const hasFailed = Boolean(certificate.renewalError);
const isAutoRenewalEnabled = Boolean(
certificate.renewBeforeDays && certificate.renewBeforeDays > 0
);
return (
<Tr className="h-10" key={`certificate-${certificate.id}`}>
<Td>{certificate.commonName}</Td>
@@ -297,10 +309,6 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
</ProjectPermissionCan>
{/* Manage auto renewal option - not shown for failed renewals */}
{(() => {
const isRevoked = certificate.status === CertStatus.REVOKED;
const isExpired = new Date(certificate.notAfter) < new Date();
const hasFailed = Boolean(certificate.renewalError);
const isExpiringWithinDay = isExpiringWithinOneDay(certificate.notAfter);
const canManageRenewal =
certificate.profileId &&
!certificate.renewedById &&
@@ -317,10 +325,6 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
a={ProjectPermissionSub.Certificates}
>
{(isAllowed) => {
const isAutoRenewalEnabled = Boolean(
certificate.renewBeforeDays && certificate.renewBeforeDays > 0
);
return (
<DropdownMenuItem
className={twMerge(
@@ -329,10 +333,17 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
)}
onClick={async () => {
const notAfterDate = new Date(certificate.notAfter);
const notBeforeDate = new Date(certificate.notBefore);
const ttlDays = Math.ceil(
(notAfterDate.getTime() - notBeforeDate.getTime()) /
(24 * 60 * 60 * 1000)
const notBeforeDate = certificate.notBefore
? new Date(certificate.notBefore)
: new Date(
notAfterDate.getTime() - 365 * 24 * 60 * 60 * 1000
);
const ttlDays = Math.max(
1,
Math.ceil(
(notAfterDate.getTime() - notBeforeDate.getTime()) /
(24 * 60 * 60 * 1000)
)
);
handlePopUpOpen("manageRenewal", {
certificateId: certificate.id,
@@ -360,12 +371,6 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
})()}
{/* Disable auto renewal option - only shown when auto renewal is active */}
{(() => {
const isRevoked = certificate.status === CertStatus.REVOKED;
const isExpired = new Date(certificate.notAfter) < new Date();
const isExpiringWithinDay = isExpiringWithinOneDay(certificate.notAfter);
const isAutoRenewalEnabled = Boolean(
certificate.renewBeforeDays && certificate.renewBeforeDays > 0
);
const canDisableRenewal =
certificate.profileId &&
!certificate.renewedById &&
@@ -404,8 +409,6 @@ export const CertificatesTable = ({ handlePopUpOpen }: Props) => {
})()}
{/* Manual renewal action for profile-issued certificates that are not revoked/expired (including failed ones) */}
{(() => {
const isRevoked = certificate.status === CertStatus.REVOKED;
const isExpired = new Date(certificate.notAfter) < new Date();
const canRenew =
certificate.profileId &&
!certificate.renewedById &&