2 Commits

Author	SHA1	Message	Date
shankar0123	6b5af27546	Bundle G: Final audit closure — L-004 + D-003/4/5/7 closed; 54/55 + 7/7 ... Closes the 2026-04-25 audit's final-closure cluster. Score 51/55 -> 54/55 (98% closed); deferred 4/7 -> 7/7 (100%). All severity-graded findings now closed except M-029 (frontend per-PR migration backlog, by design incremental). L-004 (CWE-924) — dual-key API rotation overlap window: internal/config/config.go::ParseNamedAPIKeys rewritten to allow same-name duplicate entries iff admin flag matches. Mismatched-admin entries rejected at startup (privilege escalation guard); exact (name,key) duplicates rejected (typo guard — rotation requires DIFFERENT keys under the same name). Startup INFO log per name with multiple entries surfaces the active rotation window. NewAuthWithNamedKeys was already shaped correctly (constant-time hash compare across all entries, same UserKey + AdminKey for either bearer); Bundle B's M-025 per-user rate-limit bucket and audit-trail actor inherit consistency across the rollover automatically. 8 new tests pin the contract end-to-end. docs/security.md::API key rotation walks the 6-step zero-downtime rollover. D-003 — Mutation testing wired: security-deep-scan.yml gets a go-mutesting step covering ./internal/crypto/..., ./internal/pkcs7/..., ./internal/connector/issuer/local/... with per-package summary lines extracted into go-mutesting.txt artefact. D-007 — Frontend semgrep wired (recon found Bundle 7's wiring claim was false): security-deep-scan.yml gets a 'semgrep p/react-security' step running returntocorp/semgrep:latest --config=p/react-security against /src/web/src; results uploaded as semgrep-react.json. D-004 + D-005 — Operator runbook published: docs/testing-strategy.md (NEW) consolidates per-tool local-run procedures, acceptance thresholds, and triage paths for go-mutesting, ZAP baseline DAST, testssl.sh, and semgrep p/react-security. Closes the 'wired CI-only, no local-run validation' framing for D-004/D-005 by giving operators the same commands the CI workflow runs. Verification: gofmt -l no diff go vet ./internal/config/... ./internal/api/middleware/... clean go test -short -count=1 ./internal/config/... ./internal/api/middleware/... PASS python3 -c 'yaml.safe_load(...)' YAML OK G-3 env-var docs guard no phantom env-vars Audit deliverables: audit-report.md: L-004 + D-003/4/5/7 boxes flipped [x]; score 51/55 -> 54/55 findings.yaml: 5 status flips; new bundle-G-final-closure closure_log entry CHANGELOG.md: Bundle G entry under [unreleased]; supersedes Bundle E + F L-004-deferred framing	2026-04-27 02:27:44 +00:00
shankar0123	62a412c488	Bundle C: Renewal/reliability cluster — 7 findings closed ... Closes M-006 + M-007 + M-008 + M-015 + M-016 + M-019 + M-020 from comprehensive-audit-2026-04-25. M-028 was already closed by the Bundle B CI follow-up. M-006 (CWE-913) — Idempotent migration 000014 migrations/000014_policy_violation_severity_check.up.sql: Prepended ALTER TABLE ... DROP CONSTRAINT IF EXISTS before the ADD. Mirrors the down migration's existing IF EXISTS shape and the M-7 idempotent-index idiom. Re-runs against partially-applied DBs now succeed. M-007 — Bulk-op partial-failure tests (3 new) internal/api/handler/bulk_partial_failure_test.go: TestBulkRevoke_PartialFailure_ReportsBoth TestBulkRenew_PartialFailure_ReportsBoth TestBulkReassign_PartialFailure_ReportsBoth Each asserts HTTP 200 + both success/failure counters round-trip + per-cert errors[] preserved with non-empty messages so operators can correlate each failure to its certificate ID. M-008 — Admin-gated handler enumeration pin (verified-already-clean) Recon: only one admin-gated handler — bulk_revocation.go — with full 3-branch test triplet already in place. health.go calls IsAdmin informationally to surface the flag to the GUI without gating. internal/api/handler/m008_admin_gate_test.go: Walks every handler .go file, asserts every middleware.IsAdmin call site is in AdminGatedHandlers (with required test triplet) or InformationalIsAdminCallers (justified). Adding a new admin gate without updating both the constant AND adding the test triplet fails CI. M-015 — Single-profile cardinality pin (verified-already-clean) Audit claim 'no cardinality validation' was wrong — enforced at struct level. domain.ManagedCertificate.{CertificateProfileID, RenewalPolicyID,IssuerID,OwnerID} and RenewalPolicy. CertificateProfileID are bare strings, not slices. internal/domain/m015_cardinality_test.go: reflect-based pin on kind=String. Schema change to N:N would have to update renewal.go's lookup loop in the same commit. M-016 (CWE-754) — Reap stale-agent jobs internal/repository/postgres/job.go::ListJobsWithOfflineAgents: JOIN jobs to agents on agent_id, filter (status=Running AND a.last_heartbeat_at < cutoff), exclude server-keygen jobs. internal/service/job.go::ReapJobsWithOfflineAgents: Flips matched jobs to Failed reason agent_offline so I-001 retry loop re-queues them on a healthy agent. Records audit event per reap. internal/scheduler/scheduler.go: Scheduler.runJobTimeout cycle now calls both reaper arms. agentOfflineJobTTL default 5min (5x agent-health-check default); SetAgentOfflineJobTTL knob for operator override. internal/service/job_offline_agent_reaper_test.go: 6 unit tests cover happy path, server-keygen-skip, non-Running-skip, non- positive-TTL fail-loud, repo-error propagation, audit-event recording. M-019 — Configurable ARI HTTP timeout Audit claim 'no fallback timeout' was wrong — ari.go:52 already had a 15s timeout. Bundle C makes it configurable. internal/connector/issuer/acme/acme.go: Config.ARIHTTPTimeoutSeconds field with env path CERTCTL_ACME_ARI_HTTP_TIMEOUT_SECONDS. internal/connector/issuer/acme/ari.go: Both HTTP clients (GetRenewalInfo + getARIEndpoint) now use the new ariHTTPTimeout() helper. Zero / negative / nil-config all fall back to the historic 15s default. ari_timeout_test.go: 4 dispatch arm tests. M-020 (CWE-770) — OCSP DoS hardening Pre-bundle the noAuthHandler chain had no rate limit. An attacker could DoS the OCSP responder, which for fail-open relying parties is a revocation bypass. cmd/server/main.go: noAuthHandler refactored from fixed middleware.Chain(...) to a conditional slice that appends middleware.NewRateLimiter when cfg.RateLimit.Enabled. Per-IP keying applies; OCSP/CRL/EST/SCEP are unauth. docs/security.md (NEW): Operator runbook documenting Must-Staple TLS Feature extension RFC 7633 as the architectural fix for fail-open relying parties. Profile-flip guidance + nginx/Apache/HAProxy/Envoy stapling snippets + explicit scope statement on what the rate limiter alone does NOT solve. Audit deliverables: cowork/comprehensive-audit-2026-04-25/audit-report.md: score 31/55 -> 38/55 closed (Medium 13/27 -> 20/27). cowork/comprehensive-audit-2026-04-25/findings.yaml: 7 status flips open -> closed with closure notes citing the Bundle C mechanism. certctl/CHANGELOG.md: Bundle C section under [unreleased]. Verification: go vet ./internal/service ./internal/scheduler ./internal/connector/issuer/acme ./internal/api/handler ./internal/domain ./cmd/server clean go test -count=1 -short on the same packages all green helm template + helm lint clean internal/repository/postgres setup-fail sandbox disk pressure (same on master HEAD before this branch)	2026-04-27 00:08:25 +00:00