8 Commits

Author	SHA1	Message	Date
Shankar	08ffbadb97	M-029 Pass 1 batch 1: migrate 4 single-mutation pages to useTrackedMutation ... Drains the Bundle 8 useMutation backlog (56 -> 52). Each migration declares explicit invalidates per the M-009 contract; the wrapper invalidates BEFORE calling the caller's onSuccess so user code drops the redundant qc.invalidateQueries. Pages migrated: - AgentsPage.tsx invalidates: [['agents'], ['agents', 'retired']] - CertificatesPage.tsx invalidates: [['certificates']] - DigestPage.tsx invalidates: 'noop' (sendDigest is a server-side email dispatch — no client query reflects digest-send state) - IssuerDetailPage.tsx invalidates: [['issuer', id]] (testIssuerConnection updates last_tested_at server-side) Verification: legacy useMutation count 56 -> 52 (-4 sites) useTrackedMutation count 0 -> 4 (+4 sites) invalidation surface 82 -> 84 (+2; DigestPage is noop, AgentsPage collapses 2 invalidates into 1 array, others +1) Closes 4 of 56 sites toward M-029 Pass 1 completion.	2026-04-27 02:37:25 +00:00
certctl-bot	3f5c2344ab	fix(web,ci): close TS↔Go type drift across 5 entities (D-2 master) ... Closes five 2026-04-24 audit findings (all P2, all category cat-f / diff-05x06-*) by reconciling the TypeScript interfaces in web/src/api/types.ts with the on-wire JSON shape Go's internal/domain/*.go structs actually emit. D-1 closed the same pattern for one entity (Certificate / ManagedCertificate); D-2 covers the remaining five. Per-entity verdicts (audit's "stricter side is the contract"): Agent — TRIM 5 phantoms (last_heartbeat, capabilities, tags, created_at, updated_at). Go emits last_heartbeat_at only. Target — ADD 2 (retired_at?, retired_reason?) — I-004 fields. DiscCert — ADD pem_data? — real field, real Go emit, omitempty. Issuer — TRIM phantom status. Go has Enabled bool only. Notif — TRIM phantom subject. Go has Message string only. Certificate — verify-only; D-1 closure confirmed clean at recon. Consumer fixes (same commit as the trim): - AgentDetailPage.tsx — remove dead Capabilities + Tags sections (always rendered empty); replace agent.created_at/updated_at row with the Go-emitted registered_at; widen heartbeatStatus() to accept undefined. - AgentsPage.tsx — same heartbeatStatus widening. - IssuersPage.tsx + IssuerDetailPage.tsx — issuerStatus() now derives from `enabled` exclusively; the dead `issuer.status || 'Unknown'` fallback is gone. - NotificationsPage.tsx — drop dead `|| n.subject` fallback. - NotificationsPage.test.tsx — drop dead `subject:` from mocks. - api/utils.ts::timeAgo widened to accept string | undefined | null. - api/types.test.ts — Agent (I-004) fixture trimmed of the 5 phantoms. Tests (Vitest): - 5 new describe blocks in web/src/api/types.test.ts: - Agent interface (D-2 phantom-fields trim) — 2 it blocks - Target interface (D-2 retirement fields) — 2 it blocks - DiscoveredCertificate interface (D-2 pem_data ADD) — 2 it blocks - Issuer interface (D-2 status phantom trim) — 1 it block - Notification interface (D-2 subject phantom trim) — 1 it block - Each block uses the literal-construction pattern from D-1; trimmed fields are pinned via excess-property comments that compile-fail when uncommented if a phantom is reintroduced. CI regression guardrail: - .github/workflows/ci.yml — existing D-1 step renamed to "Forbidden StatusBadge dead-key + TS phantom-field regression guard (D-1 + D-2)". Three new awk-windowed greps over Agent / Issuer / Notification interfaces in types.ts. The Agent grep includes a `grep -v 'last_heartbeat_at'` filter to avoid false positives on the legitimate Go-emitted heartbeat field. Documentation: - CHANGELOG.md — new D-2 section above B-1 under [unreleased] with full Added/Removed/Audit findings closed/Known follow-ups breakdown. - docs/architecture.md — Web Dashboard section gains a new "TS ↔ Go type contract rule (D-1 + D-2 closure)" paragraph capturing the stricter-side-wins rule and the CI guardrail it's anchored by. - coverage-gap-audit-2026-04-24-v5/unified-audit.md — Live Tracker score 20/47 → 25/47 (P2: 6/27 → 11/27). Per-finding ✅ RESOLVED Status blocks added to all 5 diff-05x06-* entries plus the verify-only Certificate entry. Closed-bundle index gets D-2 row. Verification (all gates green): - cd web && tsc --noEmit → clean - cd web && vitest run --reporter=dot → 9 files, 302 tests passing (was 294 → +8 D-2 cases) - cd web && vite build → clean - go vet ./internal/... ./cmd/... → clean (no Go touched) - golangci-lint v2.11.4 run ./... → 0 issues - D-2 Agent guardrail dry-run → empty (good) - D-2 Issuer guardrail dry-run → empty (good) - D-2 Notification guardrail dry-run → empty (good) - D-2 Target ADD-shape sanity → 2 retirement fields present - D-2 DiscCert ADD-shape sanity → pem_data present - D-1 Certificate guardrail still clean → empty (good) - OpenAPI YAML parses → 89 paths Audit findings closed: - diff-05x06-7cdf4e78ae24 (P2, Agent TS↔Go drift) - diff-05x06-2044a46f4dd0 (P2, Target TS↔DeploymentTarget Go drift) - diff-05x06-85ab6b98a2f7 (P2, DiscoveredCertificate TS↔Go drift) - diff-05x06-97fab8783a5c (P2, Issuer TS↔Go drift) - diff-05x06-caba9eb3620e (P2, Notification TS↔NotificationEvent drift) - diff-05x06-af18a8d7ef41 (P2) — verified clean since D-1; no edit Deferred follow-ups: - Issuer richer status view (enabled × test_status) — UX scope, not drift. - Real Agent metadata (capabilities, tags) — backend feature, not drift. - DiscoveredCertificate pem_data list-response perf — separate backend change.	2026-04-25 16:07:31 +00:00
Shankar Reddy	49002c8cba	Close I-004 (agent hard-delete cascades targets) coverage-gap finding ... Operator decision answered as full soft-delete with optional forced cascade — hard-delete is not reachable from any public surface. Prior to this commit, DELETE /agents/{id} ran a plain `DELETE FROM agents` whose schema-level `ON DELETE CASCADE` on deployment_targets.agent_id silently wiped every target, orphaning certs and aborting in-flight jobs. The finding closure reshapes the agent-removal contract around soft retirement with explicit preflight counts, an opt-in cascade gated by a mandatory reason, and unconditional protection for the four reserved sentinel agents used by discovery sources. Schema — migration 000015: migrations/000015_agent_retire.up.sql flips deployment_targets_agent_id_fkey from ON DELETE CASCADE to ON DELETE RESTRICT, so a stray `DELETE FROM agents` now errors at the DB boundary instead of quietly destroying targets. Both `agents` and `deployment_targets` grow a retired_at TIMESTAMPTZ + retired_reason TEXT pair (TEXT not VARCHAR so operator comments are never truncated), indexed via partial indexes WHERE retired_at IS NOT NULL. The migration is self-healing (ADD COLUMN IF NOT EXISTS, DROP CONSTRAINT IF EXISTS then ADD CONSTRAINT, CREATE INDEX IF NOT EXISTS) so repeated runs against partially-migrated databases converge. migrations/000015_agent_retire.down.sql restores CASCADE and drops the new columns for clean rollback. A dedicated repository-layer testcontainers test (internal/repository/postgres/migration_000015_test.go) asserts the before/after FK action, column presence, index presence, and round-trip idempotency under up→down→up. Domain — sentinel guard + dependency counts: internal/domain/connector.go gains IsRetired() on Agent, the exported SentinelAgentIDs slice listing server-scanner, cloud-aws-sm, cloud-azure-kv, cloud-gcp-sm verbatim (matching the four reserved IDs documented in CLAUDE.md and created at startup in cmd/server/main.go), IsSentinelAgent(id string) predicate, AgentDependencyCounts{ActiveTargets, ActiveCertificates, PendingJobs} with a HasDependencies() method, and ActorTypeAgent / ActorTypeSystem enum values used by audit emission downstream. Coverage locked down by internal/domain/connector_test.go. Service — 8-step ordered contract: internal/service/agent_retire.go:RetireAgent(ctx, id, actor, opts{Force, Reason}) enforces a fixed execution order: (1) sentinel guard — IsSentinelAgent(id) returns ErrAgentIsSentinel unconditionally; force=true does NOT bypass it. (2) fetch — ErrAgentNotFound on miss. (3) idempotency — if IsRetired() already, return AgentRetirementResult{AlreadyRetired: true} with no new audit event and no state change (safe to replay from flaky clients). (4) preflight counts — collectAgentDependencyCounts runs ActiveTargets, ActiveCertificates, PendingJobs sequentially (not in parallel; keeps the per-query timeout predictable and matches the repo's existing call-chain shape). (5) force-reason guard — opts.Force=true with empty Reason returns ErrForceReasonRequired (wired into the 400 status surface). (6) dependency guard — HasDependencies() with opts.Force=false returns BlockedByDependenciesError{Counts} (wired into the 409 body with per-bucket counts). (7) mutation — single pinned retiredAt := time.Now(); agent retirement first, then cascade target retirement if opts.Force, all under the repo's single transaction so the two retired_at stamps match to the second. (8) best-effort audit — agent_retired always; agent_retirement_ cascaded additionally on the force path. Actor is whatever the handler resolves from the request; actor type is mapped by resolveActorType (system/agent-prefix→Agent/else→User). Audit emission failures are logged via slog.Error but do not abort the retirement (matches the house convention used by every other scheduler-emitted event). BlockedByDependenciesError implements Error() as "active_targets=%d, active_certificates=%d, pending_jobs=%d" and Unwrap() → ErrBlockedByDependencies. The single struct satisfies errors.Is via Unwrap (used by scheduler-level tests) and errors.As via the concrete type (used by the handler to fish out Counts for the 409 body). ListRetiredAgents(page, perPage) adds a separate paginated accessor with page<1→1 and perPage<1→50 normalization so retired rows are queryable without polluting the default agent listing. Sentinel guard coverage is asymmetric by design: all four reserved IDs are protected, and force=true cannot override. Regression tests in internal/service/agent_retire_test.go assert each of the eight steps in order, plus sentinel bypass attempts and idempotency replay. Handler + router — status-code surface: internal/api/handler/agents.go:RetireAgent exposes seven status codes on DELETE /agents/{id}: 200 on a fresh retirement (body echoes AgentRetirementResult). 204 on idempotent replay (AlreadyRetired=true; no new audit). 400 on ErrForceReasonRequired. 403 on ErrAgentIsSentinel. 404 on ErrAgentNotFound. 409 on BlockedByDependenciesError, with a custom body shape {error, counts{active_targets, active_certificates, pending_jobs}} that bypasses the default ErrorWithRequestID envelope so callers get the per-bucket numbers directly. 500 on any other error. Heartbeat HandleHeartbeat returns 410 Gone when the agent is retired (ErrAgentRetired), signalling the agent to shut down. Query params `force=true` and `reason=<text>` drive the cascade path; both are forwarded as url.Values through the new MCP transport. internal/api/router/router.go registers GET /api/v1/agents/retired literal-path BEFORE /api/v1/agents/{id} — Go 1.22 ServeMux's literal-beats-pattern-var precedence routes "retired" to the paginated retired-agents listing instead of fetching a hypothetical agent named "retired". Agent binary — clean shutdown on 410: cmd/agent/main.go gains the ErrAgentRetired sentinel, a retiredOnce sync.Once, and a retiredSignal chan struct{}. A markRetired(source, statusCode, body) helper closes the channel exactly once; the Run() select loop observes the close and returns ErrAgentRetired; main() matches via errors.Is(err, ErrAgentRetired) and exits cleanly instead of spinning in the heartbeat retry loop. The 410 Gone surface is therefore terminal for the agent process. MCP transport: internal/mcp/client.go adds Client.DeleteWithQuery(path, query), a new additive transport method. Client.Delete is path-only; without this method the retire tool would silently drop `force` and `reason`, turning every cascade retire into a default soft-retire. The new method shares do()'s 204 normalization and 4xx/5xx error propagation so tool authors get one contract. internal/mcp/tools.go + internal/mcp/types.go expose the retire_agent tool with Force+Reason inputs wired through DeleteWithQuery. CLI: cmd/cli/main.go + internal/cli/client.go add two CLI surfaces: `agents list --retired` (client-side strip of --retired then delegation to ListRetiredAgents, sharing --page/--per-page parsing with the default listing) and `agents retire <id> [--force --reason "…"]` (mirrors ErrForceReasonRequired — force without reason is rejected client-side before the request is sent). JSON + table output modes both honor the new columns. Frontend: web/src/pages/AgentsPage.tsx surfaces retired/retire affordances. web/src/api/client.ts + web/src/api/types.ts expose the retire endpoint and the retired-listing. 4 new Vitest regression cases. OpenAPI: api/openapi.yaml documents DELETE /agents/{id} with all seven status codes, 410 on heartbeat, and the 409 per-bucket body shape. Regression coverage (six new test files, all green): internal/service/agent_retire_test.go — 8-step contract + sentinel guards internal/api/handler/agent_retire_handler_test.go — 7-status-code surface + 410 heartbeat internal/mcp/retire_agent_test.go — DeleteWithQuery wire-through internal/cli/agent_retire_test.go — --retired listing + --force/--reason pairing internal/repository/postgres/migration_000015_test.go — FK flip + columns + indexes + up↔down internal/domain/connector_test.go — IsRetired, IsSentinelAgent, SentinelAgentIDs, HasDependencies Files: api/openapi.yaml — DELETE + 410 + 409 body shape cmd/agent/main.go — ErrAgentRetired, markRetired, retiredSignal cmd/cli/main.go — handleAgents list/get/retire dispatch docs/architecture.md, docs/concepts.md, docs/testing-guide.md — retirement contract narrative internal/api/handler/agents.go — RetireAgent, status surface, 410 on heartbeat internal/api/handler/agent_handler_test.go — extended coverage internal/api/handler/agent_retire_handler_test.go — new internal/api/router/router.go — /agents/retired before /agents/{id} internal/cli/agent_retire_test.go — new internal/cli/client.go — ListRetiredAgents + RetireAgent internal/domain/connector.go — IsRetired, SentinelAgentIDs, IsSentinelAgent, AgentDependencyCounts, ActorTypeAgent/System internal/domain/connector_test.go — new internal/integration/lifecycle_test.go — retirement fixture internal/mcp/client.go — DeleteWithQuery additive transport internal/mcp/retire_agent_test.go — new internal/mcp/tools.go, internal/mcp/types.go — retire_agent tool + Force/Reason inputs internal/repository/interfaces.go — AgentRepository retirement methods internal/repository/postgres/agent.go — retire + cascade target retire + counts internal/repository/postgres/migration_000015_test.go — new internal/service/agent.go — wire into AgentService surface internal/service/agent_retire.go — new 8-step contract internal/service/agent_retire_test.go — new internal/service/deployment.go — skip retired agents internal/service/target.go — skip retired agents internal/service/testutil_test.go — shared mocks extended migrations/000015_agent_retire.up.sql — new migrations/000015_agent_retire.down.sql — new web/src/api/client.ts, types.ts + tests — retire endpoint wiring web/src/pages/AgentsPage.tsx — retire UI	2026-04-19 05:24:00 +00:00
Shankar	28d8771d8c	docs: rewrite features.md, audit README + architecture against repo ... Rewrote docs/features.md from scratch as authoritative feature inventory (1255 lines, every claim verified against source files). Audited README.md and architecture.md against repo — fixed 19 stale references: K8s Secrets status, issuer counts, dashboard page counts, CI thresholds, missing connectors in Mermaid diagrams, OpenAPI operation count, GetCACertPEM behavior, and V2/V4 roadmap accuracy. Also includes related fixes discovered during audit: - Scheduler skips expired/failed/revoked certs from auto-renewal - Seed demo expiry dates moved outside 31-day scheduler query window - Agent pages use correct last_heartbeat_at field name Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-15 00:22:57 -04:00
Shankar	ed8fa7e11f	feat: dashboard theme overhaul — light content area with branded teal sidebar ... Complete frontend visual redesign using certctl logo color palette: - Deep teal sidebar (#0c2e25) with prominent centered logo (64px in white pill) - Light content area (#f0f4f8) with white cards and visible borders - Brand colors from logo: teal (#2ea88f), blue (#3b7dd8), orange (#e8873a), green (#4ebe6e) - Inter + JetBrains Mono typography, colored stat card top borders - All 17 pages + 7 components updated (25 files, ~700 lines changed) - 15 new dashboard screenshots replacing old dark theme screenshots - Prometheus metrics e2e test added, integration test mock fixes - Docs updated: architecture.md theme description, testing-guide.md DNS-PERSIST-01 coverage Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-26 23:27:42 -04:00
Shankar	1a9e3ab8ce	feat: M10 — agent metadata collection, Apache httpd + HAProxy target connectors ... Agents now report OS, architecture, IP address, hostname, and version via heartbeat using runtime.GOOS, runtime.GOARCH, and net.Dial. New migration adds columns to agents table. Heartbeat handler, service, and repository updated to accept and persist metadata. GUI shows OS/Arch in agent list and full system info in agent detail page. Apache httpd connector: separate cert/chain/key files, apachectl configtest validation, graceful reload. HAProxy connector: combined PEM file (cert+chain+key), optional config validation, reload. Both wired into agent binary's target connector switch. 14 tests for new connectors. All existing tests updated for new Heartbeat/UpdateHeartbeat signatures. Docs updated across README, architecture, concepts, and connectors guides. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 02:19:28 -04:00
Shankar	58253535f5	Implement M6: functional GUI views, GitHub Actions CI ... Wire all remaining dashboard views to real API: agent detail page with heartbeat status and capabilities, audit trail with time range/ actor/resource filters, notifications with grouped-by-cert view and read/unread state, policies with severity summary bar, new issuers and targets list views. Add GitHub Actions CI with parallel Go and Frontend jobs. Update Makefile with test-cover and frontend-build targets. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-15 11:12:49 -04:00
Shankar	9c4e157bf2	Implement M5: hardening, input validation, and Vite+React+TS dashboard ... Backend hardening: - Fix 6 nginx.go non-constant format string build errors - Add validation.go with hostname, PEM, and enum validators - Apply input validation to all POST/PUT handlers (certificates, agents, CSR, policies, teams, owners, targets, issuers) - Fix unchecked JSON decode in TriggerDeployment handler Frontend (Vite + React + TypeScript): - Migrate from single-file SPA to proper build pipeline - 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs, Notifications, Policies, Audit Trail - TanStack Query for server state with auto-refetch intervals - Certificate detail with version history and renewal trigger - Job cancellation, status/type filtering, expiry countdowns - Reusable components: DataTable, StatusBadge, ErrorState, PageHeader - Dark theme with Tailwind CSS, sidebar nav via React Router Server integration: - Go server serves web/dist/ (Vite output) with SPA fallback - Falls back to web/index.html for legacy mode - .gitignore updated for web/node_modules/ and web/dist/ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-15 01:19:19 -04:00