EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

+ Cisco IOS quirk fixtures + ManagedCertificate.Source provenance +
EST bulk-revoke endpoint + 13 typed audit action codes.

Phase 10.1 — libest reference-client sidecar:
- deploy/test/libest/Dockerfile: multi-stage Debian-bookworm-slim
  build of Cisco's libest v3.2.0-2 from source (autoconf/automake/
  libtool + libcurl4-openssl-dev + libssl-dev). Runtime stage
  carries only estclient + bash + openssl + ca-certificates so the
  exec surface stays small + predictable.
- docker-compose.test.yml libest-client entry (profiles: [est-e2e])
  with bind mounts for /config/est (test workspace) + /config/certs
  (certctl CA bundle for TLS pinning); IP 10.30.50.9 (10.30.50.8
  was already taken by certctl-agent).
- deploy/test/est/.gitkeep keeps the bind-mount target tracked.

Phase 10.2 — 5 integration tests (//go:build integration) in
deploy/test/est_e2e_test.go:
- TestEST_LibESTClient_Enrollment_Integration (cacerts → simpleenroll
  → cert-shape assertion)
- TestEST_LibESTClient_MTLSEnrollment_Integration (mTLS sibling-route
  cert auth; skip when bootstrap cert absent)
- TestEST_LibESTClient_ServerKeygen_Integration (RFC 7030 §4.4
  multipart; skip when profile gate disabled)
- TestEST_LibESTClient_RateLimited_Integration (4th enroll trips
  per-principal cap, asserts 429-shaped error)
- TestEST_LibESTClient_ChannelBinding_Integration (libest
  --tls-exporter; skip when libest build lacks the flag).
- requireESTSidecar guard skips the suite when the operator forgot
  --profile est-e2e; helpful error message includes the exact
  command to bring the sidecar up.

Phase 10.3 — Cisco IOS quirk fixtures + 3 unit tests in
internal/api/handler/cisco_ios_quirks_test.go:
- testdata/cisco_ios_15x_pem_csr.txt: PEM body sent with
  Content-Type application/x-pem-file. Handler dispatches on
  body-prefix not Content-Type — accepts cleanly.
- testdata/cisco_ios_16x_trailing_newline_csr.txt: extra trailing
  newlines after base64 body. strings.TrimSpace tolerates.
- testdata/cisco_ios_crlf_b64_csr.txt: CRLF-wrapped base64.
  base64.StdEncoding handles CRLF + LF identically.

Phase 11.1 — ManagedCertificate.Source provenance:
- New domain.CertificateSource enum (Unspecified/EST/SCEP/API/Agent).
- Migration 000023_managed_certificates_source.up.sql adds source
  TEXT NOT NULL DEFAULT '' so existing rows scan as
  CertificateSourceUnspecified — back-compat: bulk-revoke filter
  treats empty as "any source".
- Postgres repo Insert/Update/scan paths all wire the new column.

Phase 11.2 — EST bulk-revoke endpoint:
- BulkRevocationCriteria.Source field (Source-only requests rejected
  as too broad — must accompany at least one narrower criterion).
- service.bulk_revocation.resolveCertificates post-filter by Source
  (empty=any, no SQL change so existing CertificateFilter callers
  unaffected).
- New BulkRevocationHandler.BulkRevokeEST method pins Source=EST +
  dispatches; new route POST /api/v1/est/certificates/bulk-revoke
  (M-008 admin-gated). openapi.yaml documented + parity-guard green.

Phase 11.3 — 13 typed audit action codes in
internal/service/est_audit_actions.go:
- est_simple_enroll_success / _failed
- est_simple_reenroll_success / _failed
- est_server_keygen_success / _failed
- est_auth_failed_basic / _mtls / _channel_binding
- est_rate_limited
- est_csr_policy_violation
- est_bulk_revoke
- est_trust_anchor_reloaded
- ESTService.processEnrollment + SimpleServerKeygen + ReloadTrust
  split-emit BOTH the legacy bare action codes (back-compat for the
  GUI activity-tab chip filters that match by exact string +
  existing audit-log analysers) AND the new typed _success / _failed
  variants (operator grep target + per-failure-mode counter).

Tests:
- internal/api/handler/bulk_revocation_est_test.go — 5 cases
  (admin-true happy path pins Source=EST + non-admin 403 +
  empty-criteria 400 + invalid-reason 400 + method-not-allowed).
- internal/service/est_audit_actions_test.go — 5 cases (SimpleEnroll
  legacy+typed emission / SimpleReEnroll typed / IssuerError
  typed-failed / PolicyViolation triple-emit /
  unique-string invariant).

Pre-commit verification (sandbox): gofmt clean, go vet clean
(excluding repository/postgres testcontainers limit), staticcheck
clean across api/handler/api/router/domain/service/deploy/test,
go test -short -count=1 green for every non-postgres Go package +
integration build (`go build -tags integration ./deploy/test/...`)
clean. G-3 docs-drift guard reproduced locally clean (Phases 10-11
added zero new env vars).

Spec preserved at cowork/est-rfc7030-hardening-prompt.md. Phases
12-13 (docs/est.md + WiFi/802.1X / IoT bootstrap / FreeRADIUS
recipes; release prep + tag) remain — post-2.1.0 work.

internal/service/est.go

@@ -88,15 +88,23 @@ func (s *ESTService) GetCACerts(ctx context.Context) (string, error) {
 
 // SimpleEnroll processes an initial enrollment request.
 // RFC 7030 Section 4.2: /simpleenroll accepts a PKCS#10 CSR and returns a signed cert.
+//
+// Phase 11.3: typed audit codes — the inner processEnrollment emits
+// `est_simple_enroll_success` on success + `est_simple_enroll_failed`
+// on any rejection. The legacy bare `est_simple_enroll` is retained
+// for back-compat (the GUI's activity-tab chip-filter matches by
+// prefix so both shapes render under the same chip).
 func (s *ESTService) SimpleEnroll(ctx context.Context, csrPEM string) (*domain.ESTEnrollResult, error) {
-	return s.processEnrollment(ctx, csrPEM, "est_simple_enroll")
+	return s.processEnrollment(ctx, csrPEM, "est_simple_enroll",
+		AuditActionESTSimpleEnrollSuccess, AuditActionESTSimpleEnrollFailed)
 }
 
 // SimpleReEnroll processes a re-enrollment request.
 // RFC 7030 Section 4.2.2: /simplereenroll is functionally identical to /simpleenroll
 // but is used when renewing an existing certificate.
 func (s *ESTService) SimpleReEnroll(ctx context.Context, csrPEM string) (*domain.ESTEnrollResult, error) {
-	return s.processEnrollment(ctx, csrPEM, "est_simple_reenroll")
+	return s.processEnrollment(ctx, csrPEM, "est_simple_reenroll",
+		AuditActionESTSimpleReEnrollSuccess, AuditActionESTSimpleReEnrollFailed)
 }
 
 // GetCSRAttrs returns the CSR attributes the server wants clients to include.
@@ -180,28 +188,58 @@ func (s *ESTService) GetCSRAttrs(ctx context.Context) ([]byte, error) {
 }
 
 // processEnrollment handles the common enrollment logic for both simpleenroll and simplereenroll.
-func (s *ESTService) processEnrollment(ctx context.Context, csrPEM string, auditAction string) (*domain.ESTEnrollResult, error) {
+//
+// Phase 11.3 split-emit: every audit RecordEvent call goes to BOTH the
+// legacy bare action code (auditAction param, e.g. "est_simple_enroll")
+// AND the typed success/failed code (typedSuccess / typedFailed params)
+// so existing GUI activity-tab chip filters stay green while operators
+// gain the typed grep surface.
+func (s *ESTService) processEnrollment(ctx context.Context, csrPEM, auditAction, typedSuccess, typedFailed string) (*domain.ESTEnrollResult, error) {
+	// emitFailed is the in-line helper that records BOTH the bare +
+	// typed failed-event so every error path stays one-liner. Returns
+	// the input err verbatim so call sites stay one-shot.
+	emitFailed := func(reason string, err error) {
+		if s.auditService == nil {
+			return
+		}
+		details := map[string]interface{}{
+			"reason":    reason,
+			"error":     err.Error(),
+			"protocol":  "EST",
+			"issuer_id": s.issuerID,
+		}
+		if s.profileID != "" {
+			details["profile_id"] = s.profileID
+		}
+		_ = s.auditService.RecordEvent(ctx, "est-client", "system", auditAction+"_failed", "certificate", "", details)
+		_ = s.auditService.RecordEvent(ctx, "est-client", "system", typedFailed, "certificate", "", details)
+	}
+	_ = emitFailed // referenced inside the body below
 	// Parse the CSR to extract CN and SANs
 	block, _ := pem.Decode([]byte(csrPEM))
 	if block == nil {
 		s.counters.inc(estCounterCSRInvalid)
+		emitFailed("csr_pem_decode", fmt.Errorf("invalid CSR PEM"))
 		return nil, fmt.Errorf("invalid CSR PEM")
 	}
 
 	csr, err := x509.ParseCertificateRequest(block.Bytes)
 	if err != nil {
 		s.counters.inc(estCounterCSRInvalid)
+		emitFailed("csr_parse", err)
 		return nil, fmt.Errorf("failed to parse CSR: %w", err)
 	}
 
 	if err := csr.CheckSignature(); err != nil {
 		s.counters.inc(estCounterCSRSignatureMismatch)
+		emitFailed("csr_signature", err)
 		return nil, fmt.Errorf("CSR signature verification failed: %w", err)
 	}
 
 	commonName := csr.Subject.CommonName
 	if commonName == "" {
 		s.counters.inc(estCounterCSRInvalid)
+		emitFailed("csr_missing_cn", fmt.Errorf("missing CN"))
 		return nil, fmt.Errorf("CSR must include a Common Name")
 	}
 
@@ -231,6 +269,15 @@ func (s *ESTService) processEnrollment(ctx context.Context, csrPEM string, audit
 	}
 	if _, csrErr := ValidateCSRAgainstProfile(csrPEM, profile); csrErr != nil {
 		s.counters.inc(estCounterCSRPolicyViolation)
+		// Emit BOTH the typed-failed code (for the Activity tab) AND
+		// the standalone est_csr_policy_violation code (for the
+		// per-failure-mode counter that ops greppers prefer).
+		emitFailed("csr_policy_violation", csrErr)
+		if s.auditService != nil {
+			_ = s.auditService.RecordEvent(ctx, "est-client", "system",
+				AuditActionESTCSRPolicyViolation, "certificate", "",
+				map[string]interface{}{"error": csrErr.Error(), "issuer_id": s.issuerID, "profile_id": s.profileID})
+		}
 		s.logger.Error("EST enrollment rejected: crypto policy violation",
 			"action", auditAction,
 			"common_name", commonName,
@@ -262,6 +309,7 @@ func (s *ESTService) processEnrollment(ctx context.Context, csrPEM string, audit
 	result, err := s.issuer.IssueCertificate(ctx, commonName, sans, csrPEM, ekus, maxTTLSeconds, mustStaple)
 	if err != nil {
 		s.counters.inc(estCounterIssuerError)
+		emitFailed("issuer_error", err)
 		s.logger.Error("EST enrollment failed",
 			"action", auditAction,
 			"common_name", commonName,
@@ -276,7 +324,10 @@ func (s *ESTService) processEnrollment(ctx context.Context, csrPEM string, audit
 		s.counters.inc(estCounterSuccessSimpleEnroll)
 	}
 
-	// Audit the enrollment
+	// Audit the enrollment — split-emit per Phase 11.3: legacy bare
+	// action code (back-compat for the GUI activity tab + existing
+	// audit-log analysers) + typed _success suffix variant + the
+	// canonical typed code from the AuditAction* constants.
 	if s.auditService != nil {
 		details := map[string]interface{}{
 			"common_name": commonName,
@@ -289,6 +340,7 @@ func (s *ESTService) processEnrollment(ctx context.Context, csrPEM string, audit
 			details["profile_id"] = s.profileID
 		}
 		_ = s.auditService.RecordEvent(ctx, "est-client", "system", auditAction, "certificate", result.Serial, details)
+		_ = s.auditService.RecordEvent(ctx, "est-client", "system", typedSuccess, "certificate", result.Serial, details)
 	}
 
 	s.logger.Info("EST enrollment successful",
@@ -524,6 +576,8 @@ func (s *ESTService) SimpleServerKeygen(ctx context.Context, csrPEM string) (*ES
 			details["profile_id"] = s.profileID
 		}
 		_ = s.auditService.RecordEvent(ctx, "est-client", "system", "est_server_keygen", "certificate", issued.Serial, details)
+		// Phase 11.3: typed _success suffix for the operator grep surface.
+		_ = s.auditService.RecordEvent(ctx, "est-client", "system", AuditActionESTServerKeygenSuccess, "certificate", issued.Serial, details)
 	}
 	s.logger.Info("EST serverkeygen successful",
 		"common_name", commonName, "serial", issued.Serial,