feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets

M25: After deploying a certificate, the agent probes the live TLS endpoint and compares SHA-256 fingerprints to verify the correct cert is being served. Best-effort — failures don't block deployments. New endpoints: POST /jobs/{id}/verify, GET /jobs/{id}/verification. Migration 000008 adds verification columns to jobs table. M26: Traefik target connector (file provider, auto-reload) and Caddy target connector (dual-mode: admin API hot-reload or file-based). Both wired into agent dispatch. Also: restructured README to highlight supported integrations (issuers, targets, notifiers) earlier, moved API/CLI/MCP sections lower. Updated all docs (features, connectors, architecture, testing guide, why-certctl) and fixed integration tests for 18-param RegisterHandlers signature. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-06-12 15:28:52 +00:00 · 2026-03-27 21:07:16 -04:00
parent 369a674619
commit 492a392e52
28 changed files with 3365 additions and 177 deletions
@@ -0,0 +1,139 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"log/slog"
+	"time"
+
+	"github.com/shankar0123/certctl/internal/domain"
+	"github.com/shankar0123/certctl/internal/repository"
+)
+
+// VerificationService handles recording and querying certificate deployment verification results.
+type VerificationService struct {
+	jobRepo       repository.JobRepository
+	auditService  *AuditService
+	logger        *slog.Logger
+}
+
+// NewVerificationService creates a new verification service.
+func NewVerificationService(
+	jobRepo repository.JobRepository,
+	auditService *AuditService,
+	logger *slog.Logger,
+) *VerificationService {
+	return &VerificationService{
+		jobRepo:       jobRepo,
+		auditService:  auditService,
+		logger:        logger,
+	}
+}
+
+// RecordVerificationResult updates a job with the results of TLS endpoint verification.
+// This records both success and failure results, along with timestamp and fingerprint comparison.
+// An audit event is recorded for every verification result.
+func (s *VerificationService) RecordVerificationResult(ctx context.Context, result *domain.VerificationResult) error {
+	if result == nil {
+		return fmt.Errorf("verification result is required")
+	}
+	if result.JobID == "" {
+		return fmt.Errorf("job ID is required")
+	}
+
+	// Get the current job to update it
+	job, err := s.jobRepo.Get(ctx, result.JobID)
+	if err != nil {
+		return fmt.Errorf("failed to fetch job for verification: %w", err)
+	}
+
+	// Determine verification status
+	var status domain.VerificationStatus
+	if result.Error != "" {
+		status = domain.VerificationFailed
+	} else if result.Verified {
+		status = domain.VerificationSuccess
+	} else {
+		status = domain.VerificationFailed
+	}
+
+	// Update job with verification results
+	job.VerificationStatus = status
+	job.VerifiedAt = &result.VerifiedAt
+	job.VerificationFp = &result.ActualFingerprint
+	if result.Error != "" {
+		job.VerificationError = &result.Error
+	}
+
+	if err := s.jobRepo.Update(ctx, job); err != nil {
+		if s.logger != nil {
+			s.logger.Error("failed to record verification result",
+				"job_id", result.JobID,
+				"error", err)
+		}
+		return fmt.Errorf("failed to update job with verification result: %w", err)
+	}
+
+	// Record audit event
+	auditEvent := "job_verification_success"
+	auditDetails := map[string]interface{}{
+		"job_id":                  result.JobID,
+		"target_id":               result.TargetID,
+		"expected_fingerprint":    result.ExpectedFingerprint,
+		"actual_fingerprint":      result.ActualFingerprint,
+		"verified":                result.Verified,
+	}
+
+	if result.Error != "" {
+		auditEvent = "job_verification_failed"
+		auditDetails["error"] = result.Error
+	}
+
+	s.auditService.RecordEvent(ctx, "agent", domain.ActorTypeAgent,
+		auditEvent, "job", result.JobID,
+		auditDetails)
+
+	if s.logger != nil {
+		s.logger.Info("recorded verification result",
+			"job_id", result.JobID,
+			"status", status,
+			"verified", result.Verified)
+	}
+
+	return nil
+}
+
+// GetVerificationResult retrieves the verification status and details for a job.
+func (s *VerificationService) GetVerificationResult(ctx context.Context, jobID string) (*domain.VerificationResult, error) {
+	if jobID == "" {
+		return nil, fmt.Errorf("job ID is required")
+	}
+
+	job, err := s.jobRepo.Get(ctx, jobID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to fetch job: %w", err)
+	}
+
+	result := &domain.VerificationResult{
+		JobID:  job.ID,
+		Verified: job.VerificationStatus == domain.VerificationSuccess,
+	}
+
+	// If target ID is set, populate it
+	if job.TargetID != nil {
+		result.TargetID = *job.TargetID
+	}
+
+	// Populate fingerprints if available
+	if job.VerificationFp != nil {
+		result.ActualFingerprint = *job.VerificationFp
+	}
+	if job.VerificationError != nil {
+		result.Error = *job.VerificationError
+	}
+	if job.VerifiedAt != nil {
+		result.VerifiedAt = *job.VerifiedAt
+	}
+
+	return result, nil
+}
@@ -0,0 +1,281 @@
+package service
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"testing"
+	"time"
+
+	"github.com/shankar0123/certctl/internal/domain"
+	"github.com/shankar0123/certctl/internal/repository"
+)
+
+// mockJobRepository is a test double for JobRepository.
+type mockJobRepository struct {
+	jobs map[string]*domain.Job
+	err  error
+}
+
+func (m *mockJobRepository) Get(ctx context.Context, id string) (*domain.Job, error) {
+	if m.err != nil {
+		return nil, m.err
+	}
+	job, ok := m.jobs[id]
+	if !ok {
+		return nil, errors.New("job not found")
+	}
+	return job, nil
+}
+
+func (m *mockJobRepository) Create(ctx context.Context, job *domain.Job) error {
+	m.jobs[job.ID] = job
+	return nil
+}
+
+func (m *mockJobRepository) Update(ctx context.Context, job *domain.Job) error {
+	if m.err != nil {
+		return m.err
+	}
+	m.jobs[job.ID] = job
+	return nil
+}
+
+func (m *mockJobRepository) List(ctx context.Context, filter *repository.JobFilter) ([]*domain.Job, error) {
+	return nil, nil
+}
+
+// mockAuditService is a test double for AuditService.
+type mockAuditService struct {
+	events []interface{}
+}
+
+func (m *mockAuditService) RecordEvent(ctx context.Context, actor string, actorType domain.ActorType, event string, resourceType string, resourceID string, details map[string]interface{}) {
+	m.events = append(m.events, map[string]interface{}{
+		"actor":        actor,
+		"actor_type":   actorType,
+		"event":        event,
+		"resource_type": resourceType,
+		"resource_id":   resourceID,
+		"details":      details,
+	})
+}
+
+func TestVerificationService_RecordVerificationResult_Success(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{
+			"j-test1": {
+				ID:     "j-test1",
+				Status: domain.JobStatusCompleted,
+			},
+		},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result := &domain.VerificationResult{
+		JobID:               "j-test1",
+		TargetID:            "t-nginx1",
+		ExpectedFingerprint: "abc123",
+		ActualFingerprint:   "abc123",
+		Verified:            true,
+		VerifiedAt:          time.Now().UTC(),
+	}
+
+	err := service.RecordVerificationResult(ctx, result)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// Check job was updated
+	job, _ := mockJobRepo.Get(ctx, "j-test1")
+	if job.VerificationStatus != domain.VerificationSuccess {
+		t.Errorf("expected VerificationSuccess, got %s", job.VerificationStatus)
+	}
+	if !*job.VerifiedAt == result.VerifiedAt {
+		t.Errorf("verified_at mismatch")
+	}
+
+	// Check audit event was recorded
+	if len(mockAudit.events) != 1 {
+		t.Errorf("expected 1 audit event, got %d", len(mockAudit.events))
+	}
+}
+
+func TestVerificationService_RecordVerificationResult_Failed(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{
+			"j-test2": {
+				ID:     "j-test2",
+				Status: domain.JobStatusCompleted,
+			},
+		},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result := &domain.VerificationResult{
+		JobID:               "j-test2",
+		TargetID:            "t-apache1",
+		ExpectedFingerprint: "aaa111",
+		ActualFingerprint:   "bbb222",
+		Verified:            false,
+		VerifiedAt:          time.Now().UTC(),
+	}
+
+	err := service.RecordVerificationResult(ctx, result)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	job, _ := mockJobRepo.Get(ctx, "j-test2")
+	if job.VerificationStatus != domain.VerificationFailed {
+		t.Errorf("expected VerificationFailed, got %s", job.VerificationStatus)
+	}
+}
+
+func TestVerificationService_RecordVerificationResult_WithError(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{
+			"j-test3": {
+				ID:     "j-test3",
+				Status: domain.JobStatusCompleted,
+			},
+		},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result := &domain.VerificationResult{
+		JobID:      "j-test3",
+		TargetID:   "t-haproxy1",
+		VerifiedAt: time.Now().UTC(),
+		Error:      "connection refused",
+	}
+
+	err := service.RecordVerificationResult(ctx, result)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	job, _ := mockJobRepo.Get(ctx, "j-test3")
+	if job.VerificationStatus != domain.VerificationFailed {
+		t.Errorf("expected VerificationFailed, got %s", job.VerificationStatus)
+	}
+	if job.VerificationError == nil || *job.VerificationError != "connection refused" {
+		t.Error("expected verification error to be set")
+	}
+}
+
+func TestVerificationService_RecordVerificationResult_JobNotFound(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result := &domain.VerificationResult{
+		JobID:      "j-nonexistent",
+		TargetID:   "t-nginx1",
+		VerifiedAt: time.Now().UTC(),
+	}
+
+	err := service.RecordVerificationResult(ctx, result)
+	if err == nil {
+		t.Error("expected error for nonexistent job")
+	}
+}
+
+func TestVerificationService_RecordVerificationResult_MissingJobID(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result := &domain.VerificationResult{
+		TargetID:   "t-nginx1",
+		VerifiedAt: time.Now().UTC(),
+	}
+
+	err := service.RecordVerificationResult(ctx, result)
+	if err == nil {
+		t.Error("expected error for missing job ID")
+	}
+}
+
+func TestVerificationService_RecordVerificationResult_NilResult(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	err := service.RecordVerificationResult(ctx, nil)
+	if err == nil {
+		t.Error("expected error for nil result")
+	}
+}
+
+func TestVerificationService_GetVerificationResult_Success(t *testing.T) {
+	ctx := context.Background()
+	now := time.Now().UTC()
+	targetID := "t-nginx1"
+	fp := "abc123"
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{
+			"j-test1": {
+				ID:                 "j-test1",
+				TargetID:           &targetID,
+				VerificationStatus: domain.VerificationSuccess,
+				VerifiedAt:         &now,
+				VerificationFp:     &fp,
+			},
+		},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	result, err := service.GetVerificationResult(ctx, "j-test1")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if result.JobID != "j-test1" {
+		t.Errorf("expected job ID j-test1, got %s", result.JobID)
+	}
+	if !result.Verified {
+		t.Error("expected Verified to be true")
+	}
+	if result.ActualFingerprint != "abc123" {
+		t.Errorf("expected fingerprint abc123, got %s", result.ActualFingerprint)
+	}
+}
+
+func TestVerificationService_GetVerificationResult_NotFound(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{
+		jobs: map[string]*domain.Job{},
+	}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	_, err := service.GetVerificationResult(ctx, "j-nonexistent")
+	if err == nil {
+		t.Error("expected error for nonexistent job")
+	}
+}
+
+func TestVerificationService_GetVerificationResult_EmptyJobID(t *testing.T) {
+	ctx := context.Background()
+	mockJobRepo := &mockJobRepository{jobs: map[string]*domain.Job{}}
+	mockAudit := &mockAuditService{events: []interface{}{}}
+	service := NewVerificationService(mockJobRepo, mockAudit, slog.Default())
+
+	_, err := service.GetVerificationResult(ctx, "")
+	if err == nil {
+		t.Error("expected error for empty job ID")
+	}
+}