awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-19 02:25:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address greptile comments

Browse Source
This commit is contained in:
Carlos Monastyrski
2025-10-23 10:23:40 -03:00
parent e70162dad3
commit e364eb15db
14 changed files with 396 additions and 358 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/src/services/certificate-common/certificate-constants.ts
+30
View File
@@ -175,6 +175,36 @@ export enum CertSignatureAlgorithm {
ECDSA_SHA512 = "ECDSA-SHA512"
}
export enum CertificateRenewalErrorType {
TEMPLATE_VALIDATION_FAILED = "TEMPLATE_VALIDATION_FAILED",
CA_NOT_FOUND = "CA_NOT_FOUND",
CA_INACTIVE = "CA_INACTIVE",
CERTIFICATE_OUTLIVES_CA = "CERTIFICATE_OUTLIVES_CA",
TTL_TOO_SHORT = "TTL_TOO_SHORT",
NOT_ELIGIBLE = "NOT_ELIGIBLE",
VALIDITY_EXCEEDS_MAXIMUM = "VALIDITY_EXCEEDS_MAXIMUM",
NOT_ALLOWED_BY_TEMPLATE = "NOT_ALLOWED_BY_TEMPLATE",
UNKNOWN_ERROR = "UNKNOWN_ERROR"
}
export const CERTIFICATE_RENEWAL_ERROR_MESSAGES = {
[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED]:
"Auto-renewal failed: certificate template policy has changed and this certificate no longer meets the requirements",
[CertificateRenewalErrorType.CA_NOT_FOUND]:
"Auto-renewal failed: Certificate Authority for this certificate is no longer available",
[CertificateRenewalErrorType.CA_INACTIVE]: "Auto-renewal failed: Certificate Authority is currently inactive",
[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA]:
"Auto-renewal failed: certificate would outlive the Certificate Authority",
[CertificateRenewalErrorType.TTL_TOO_SHORT]:
"Auto-renewal failed: certificate validity period is too short for the renewal threshold",
[CertificateRenewalErrorType.NOT_ELIGIBLE]: "Auto-renewal failed: certificate is not eligible for automatic renewal",
[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM]:
"Auto-renewal failed: certificate validity period exceeds the maximum allowed by the profile template",
[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE]:
"Auto-renewal failed: certificate settings are no longer allowed by the profile template",
[CertificateRenewalErrorType.UNKNOWN_ERROR]: "Auto-renewal failed: an unexpected error occurred"
} as const;
export const CERTIFICATE_RENEWAL_CONFIG = {
MIN_RENEW_BEFORE_DAYS: 1,
MAX_RENEW_BEFORE_DAYS: 30,
backend/src/services/certificate-common/certificate-utils.ts
+75
View File
@@ -1,8 +1,12 @@
import RE2 from "re2";
import { BadRequestError, ForbiddenRequestError, NotFoundError } from "@app/lib/errors";
import { CertExtendedKeyUsage, CertKeyUsage } from "../certificate/certificate-types";
import {
CertExtendedKeyUsageType,
CERTIFICATE_RENEWAL_ERROR_MESSAGES,
CertificateRenewalErrorType,
CertKeyUsageType,
mapExtendedKeyUsageToLegacy,
mapKeyUsageToLegacy,
@@ -196,3 +200,74 @@ export const convertExtendedKeyUsageArrayToLegacy = (
): CertExtendedKeyUsage[] | undefined => {
return usages?.map(convertToLegacyExtendedKeyUsage);
};
export const categorizeCertificateRenewalError = (error: unknown): string => {
if (!error) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.UNKNOWN_ERROR];
}
const errorMessage = error instanceof Error ? error.message : String(error);
if (error instanceof NotFoundError) {
if (errorMessage.includes("Certificate Authority")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_NOT_FOUND];
}
if (errorMessage.includes("Certificate template")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
}
if (error instanceof BadRequestError) {
if (errorMessage.includes("Certificate Authority is") && errorMessage.includes("must be ACTIVE")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_INACTIVE];
}
if (errorMessage.includes("would expire") && errorMessage.includes("after its issuing CA")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA];
}
if (errorMessage.includes("TTL") && errorMessage.includes("must be greater than renewal threshold")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TTL_TOO_SHORT];
}
if (errorMessage.includes("not eligible for renewal")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ELIGIBLE];
}
if (errorMessage.includes("Requested validity period exceeds maximum allowed duration")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM];
}
if (errorMessage.includes("not allowed by template policy")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE];
}
}
if (error instanceof ForbiddenRequestError) {
if (errorMessage.includes("Template validation failed")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
}
if (errorMessage.includes("Template validation failed")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TEMPLATE_VALIDATION_FAILED];
}
if (errorMessage.includes("Certificate Authority") && errorMessage.includes("not found")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_NOT_FOUND];
}
if (errorMessage.includes("Certificate Authority is") && errorMessage.includes("must be ACTIVE")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CA_INACTIVE];
}
if (errorMessage.includes("would expire") && errorMessage.includes("after its issuing CA")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.CERTIFICATE_OUTLIVES_CA];
}
if (errorMessage.includes("TTL") && errorMessage.includes("must be greater than renewal threshold")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.TTL_TOO_SHORT];
}
if (errorMessage.includes("not eligible for renewal")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ELIGIBLE];
}
if (errorMessage.includes("Requested validity period exceeds maximum allowed duration")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.VALIDITY_EXCEEDS_MAXIMUM];
}
if (errorMessage.includes("not allowed by template policy")) {
return CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.NOT_ALLOWED_BY_TEMPLATE];
}
return `${CERTIFICATE_RENEWAL_ERROR_MESSAGES[CertificateRenewalErrorType.UNKNOWN_ERROR]}: ${errorMessage}`;
};