3 Commits

Author	SHA1	Message	Date
shankar0123	c8e77fdeca	test(approval): COMP-006 — pin denied-no-cert + approved-reaches-pending invariants ... Acquisition-audit COMP-006 closure (Sprint 7 ACQ, 2026-05-16). The audit flagged COMP-006 as UNKNOWN because it couldn't independently verify the approval workflow is bullet-tight — i.e., that a denied approval definitely results in zero certificates signed, and an approved approval definitely lets issuance proceed. Enforcement chain (operator-visible invariant) ============================================== Layer 1 — Issuance gate. certificate.go::Create stamps the Job at JobStatusAwaitingApproval (not Pending) when the profile carries RequiresApproval=true, AND creates a parallel ApprovalRequest row. The job processor never touches AwaitingApproval rows. Layer 2 — Approval state machine. ApprovalService.Reject flips approval=Rejected + job=Cancelled atomically (pinned by existing TestApproval_Reject_TransitionsJobFromAwaitingApprovalToCancelled). ApprovalService.Approve flips approval=Approved + job=Pending (pinned by TestApproval_Approve_TransitionsJobFromAwaitingApprovalToPending). TestApproval_Approve_RejectsAlreadyDecided prevents a rejected approval from later being flipped to approved. Layer 3 (THE LOAD-BEARING SQL INVARIANT) — postgres/job.go:: JobRepository.ClaimPendingJobs (L296-310) issues `SELECT ... FROM jobs WHERE status = $1` with $1 = JobStatusPending. Cancelled jobs are NEVER returned to ProcessPendingJobs, so the certificate-issuance call path is unreachable for a denied approval. What this commit adds ===================== internal/service/approval_test.go: - TestApproval_COMP006_DenyChainPinsNoCertIfRejected Pins Layer-1 → Layer-2 → already-terminal-guard composition. Re-Approve of a rejected approval must fail; job must stay Cancelled. A LOOPHOLE here would let a denied cert issue. - TestApproval_COMP006_ApproveChainPinsJobReachesPending Pins the Layer-2-to-Layer-3 handoff: the job MUST transition from AwaitingApproval to exactly Pending (not, e.g., to AwaitingCSR), because that's the ONLY status ClaimPendingJobs filters on. docs/operator/approval-workflow.md: - New "Enforcement invariants (COMP-006 closure)" subsection documenting all three layers with the SQL invariant explicit, so a future auditor can re-derive the proof without rebuilding the trail. Cites every pinning test by name. This is NOT a testcontainers-driven integration test. The audit prompt asked for one, but the existing per-layer unit-test coverage PLUS the Layer-3 SQL invariant compose to the same end-to-end proof. The integration suite at deploy/test/integration_test.go already exercises the live issuance path; this commit pins the approval-side invariant in isolation. Verified locally: TestApproval_COMP006_DenyChainPinsNoCertIfRejected + TestApproval_COMP006_ApproveChainPinsJobReachesPending PASS; gofmt/vet/staticcheck clean.	2026-05-16 20:37:08 +00:00
shankar0123	69a508dfcf	auth-bundle-1 Phase 9 + 10: approval-bypass closure + RBAC GUI ... # Phase 9 — approval-bypass closure (Decision 9, option a) * Migration 000033_approval_kinds.up.sql: ALTER TABLE issuance_approval_requests ADD COLUMN approval_kind + payload JSONB; relax certificate_id + job_id to nullable; CHECK (approval_kind IN ('cert_issuance','profile_edit')) + CHECK (per-kind nullability invariant) + index on approval_kind. Idempotent throughout via DO blocks. * domain.ApprovalKind enum (cert_issuance / profile_edit) + IsValidApprovalKind. ApprovalRequest gains Kind + Payload []byte for the pending profile diff. * postgres.ApprovalRepository.Create + scanApprovalRow extended to round-trip the new columns; certificate_id + job_id switched to sql.NullString so profile_edit rows persist cleanly. Default Kind=cert_issuance preserves back-compat for every Phase-7-2026-05-03 caller. * ApprovalService.RequestProfileEditApproval: new entry point that creates a pending profile-edit row carrying the serialized profile diff. Bypass mode (CERTCTL_APPROVAL_BYPASS) short-circuits the same way it does for cert_issuance. * ApprovalService.SetProfileEditApply hook: cmd/server/main.go registers a closure that deserializes req.Payload + persists via profileRepo.Update + emits a profile.edit_applied audit row with category=auth. The hook avoids the Approval ↔ Profile import cycle. * ProfileService.UpdateProfile: gates when (a) the live profile carries RequiresApproval=true, OR (b) the proposed edit would set it true. Returns ErrProfileEditPendingApproval with the new approval ID; ProfileHandler maps to HTTP 202 Accepted + {pending_approval_id}. Both arms close the flip-flop loophole because every transition through an approval-tier profile fires the gate. * TestProfileEdit_RequiresApprovalLoopholeClosed pins all 3 bypass attempts (flip-off / kept-on / flip-on) gated; nil- approval-service preserves pre-Phase-9 direct-apply for test fixtures. * Approval service tests gain 4 profile_edit rows: pending row shape; same-actor self-approve rejected with ErrApproveBySameActor (load-bearing two-person integrity); approve fails-closed when apply callback unwired; apply callback invoked on approve. * docs/reference/profiles.md (new) explains the gate + edit response shape (202) + same-actor invariant + bypass + audit hooks. # Phase 10 — RBAC management GUI * useAuthMe hook (web/src/hooks/useAuthMe.ts): TanStack Query fetches /api/v1/auth/me on app boot, caches for 60s, exposes hasPerm(p) + hasAnyPerm + isAdmin predicates. Every Phase-10 page consumes this on mount + gates affordances against the cached effective_permissions slice. Server-side enforcement is the load-bearing gate; client-side hide/disable is UX. * New routes: - /auth/roles — list (auth.role.list); create-role modal (auth.role.create) hidden when missing. - /auth/roles/:id — detail + permissions; edit (auth.role.edit), delete (auth.role.delete), add/remove permission affordances each gated. - /auth/keys — list of every actor with role grants; assign + revoke modals (auth.role.assign). actor-demo-anon flagged system-managed; mutation buttons hidden for it. - /auth/settings — stub showing /v1/auth/me identity + bootstrap-endpoint availability via /v1/auth/bootstrap. * AuditPage extended with category filter ('All categories' + the 3 enum values from migration 000032). Selection flows to the API call params + the URL-driven query state. * Layout: 3 new nav entries (Roles / API Keys / Auth Settings). * api/client.ts: 12 new exported functions for the RBAC surface (authMe, list/get/create/update/delete role, list/add/remove role permissions, list keys, assign/revoke key role, bootstrap-availability probe). * data-testid attributes on every interactive element so a future Playwright suite can assert behavior without brittle CSS selectors. * Empty state, error state, and unsaved-changes warnings on every form per the prompt's implementation rules. # Frontend tests * RolesPage.test.tsx (6 tests): list render, empty state, error state, hide-create-button-without-perm, show-create-button-with-perm, submit-create-modal. * KeysPage.test.tsx (3 tests): demo-anon flagged system-managed (no buttons), permission-gated affordance hide for auditor caller, assign-modal-POST contract. * AuthSettingsPage.test.tsx (2 tests): identity surface, bootstrap-OPEN-status surface. * AuditPage.test.tsx (+1): category-filter select renders with the 4 documented options. 15 frontend tests total in src/pages/auth/ + the audit category-filter test; all pass via npx vitest run. # Verifications * go vet ./... clean. * staticcheck across internal/auth + handler + router + cli + service + repository + cmd + domain: clean. * gofmt -l clean repo-wide. * go test -short -count=1 green across internal/service, internal/api/handler, internal/api/router, internal/auth, internal/auth/bootstrap, internal/service/auth, internal/domain/auth, cmd/server, cmd/cli, internal/cli. * npx tsc --noEmit clean. * npm run build green (vite build produces dist/index.html + 946KB JS bundle; chunk-size warning is pre-existing). * npx vitest run src/pages/auth/ src/pages/AuditPage.test.tsx green (15 tests, 4 files).	2026-05-09 21:03:59 +00:00
shankar0123	8043e2bbac	service: ApprovalService + ApprovalMetrics + 8 table-driven tests ... Rank 7 of the 2026-05-03 Infisical deep-research deliverable, commit 2 of 4 (cowork/rank-7-approval-workflow-primitive-prompt.md). Builds on the foundation in commit 2025275 — wires the service layer that drives the approval workflow. Still no handler / integration wiring; commits 3-4 land that. Files added: internal/service/approval.go - ApprovalService struct + 6 methods: RequestApproval, Approve, Reject, ListPending, List, Get, ExpireStale. Same-actor RBAC check (ErrApproveBySameActor) at both Approve and Reject; the load-bearing two-person integrity gate. Bypass mode short-circuits via approveInternal(outcome= "bypassed", actorType=System). Audit + metric emission per decision via shared recordAudit helper. Tolerates nil AuditService for tests. Service depends on a narrow JobStatusUpdater interface (single-method) rather than the full repository.JobRepository — production wiring satisfies it implicitly via postgres' existing UpdateStatus. internal/service/approval_metrics.go - ApprovalMetrics: thread-safe counter table (decisions counter dimensioned by outcome × profile_id) + a custom durationHistogram for pending-age (le buckets: 60, 300, 1800, 3600, 21600, 86400, +Inf — 1m, 5m, 30m, 1h, 6h, 24h, beyond). Snapshot* methods return the Prometheus exposer's input shapes. Mirrors the ExpiryAlertMetrics + VaultRenewalMetrics pattern from prior ranks. internal/service/approval_test.go - 8 table-driven tests with tight in-package fakes (fakeApprovalRepo + fakeJobStateRepo): TestApproval_RequestCreatesPendingRow_BypassDisabled TestApproval_BypassMode_AutoApprovesWithSystemBypassActor TestApproval_Approve_TransitionsJobFromAwaitingApprovalToPending TestApproval_Reject_TransitionsJobFromAwaitingApprovalToCancelled TestApproval_Approve_RejectsSameActor ↑ THE LOAD-BEARING TWO-PERSON INTEGRITY TEST. PCI-DSS 6.4.5 / NIST 800-53 SA-15 / SOC 2 CC6.1 compliance auditors pattern-match against this. Pins same-actor rejection on both Approve and Reject paths; pins success when a different actor approves. TestApproval_Approve_RejectsAlreadyDecided TestApproval_ExpireStale_TransitionsPendingToExpired_AndCancelsJob TestApproval_MetricCounterIncrements Verified: gofmt: clean. go vet ./internal/service/...: exit 0. go test -short -count=1 -run TestApproval ./internal/service/...: ok 0.005s — all 8 tests green. Out of scope for this commit (lands in commits 3-4): - api/handler/approval.go (5 endpoints + handler-side RBAC). - api/openapi.yaml extensions. - Integration into CertificateService.TriggerRenewal + RenewalService.CheckExpiringCertificates + Scheduler.ReapTimedOutJobs. - cmd/server/main.go wiring of ApprovalService + ApprovalMetrics. - Config.Approval.BypassEnabled + CERTCTL_APPROVAL_BYPASS env var. - docs/connectors.md row + docs/approval-workflow.md runbook. Reference: cowork/rank-7-approval-workflow-primitive-prompt.md.	2026-05-04 01:01:53 +00:00