3 Commits

Author	SHA1	Message	Date
shankar0123	0e06f6c4fc	cli: promote --force on renew + require --reason on revoke (closes P3-1, P3-2) ... Closes findings P3-1 and P3-2 from the 2026-05-05 CLI/API/MCP↔GUI parity audit (cowork/cli-gui-parity-audit-2026-05-05/RESULTS.md). Both findings flagged hidden defaults that the CLI was sending without exposing them to operators: `force=false` baked into every renew payload, and a silent fallback to `reason="unspecified"` whenever --reason was omitted. P3-1 — promote --force on `certs renew` (full end-to-end plumbing) The pre-2026-05-05 CLI sent `{"force": false}` in the renew body. The API handler never decoded it — a textbook "lying field" per the operator's CLAUDE.md "complete path, not the easy path" rule: the body field stored a value, claimed to do something, and silently did nothing because the wire never reached the consumer. Adding a --force flag that also went unread would have created another lying field. This commit takes the complete path: service.CertificateService.TriggerRenewal grew a `force bool` parameter (internal/service/certificate.go). When force=true, the RenewalInProgress block is overridden so operators can recover stuck in-flight renewals where a previous job hung without releasing the status flag. Archived and Expired remain terminal blockers regardless of force — those are semantic dead-ends that --force should not paper over (archived = decommissioned, expired = issue a new cert instead of renewing a dead one). handler.CertificateHandler.TriggerRenewal parses force from ?force=true (or ?force=1) query param, OR {"force": true} JSON body, whichever the client picks. Defaults to false. Passes through to the service. internal/cli/client.go::RenewCertificate(id, force bool) sends ?force=true on the URL when --force is set. The historical hardcoded `{"force": false}` body is gone — no more lying field. cmd/cli/main.go dispatches `certs renew <id> [--force]` (ID-first flag-second convention matches the existing `agents retire <id> [--force]`). P3-2 — require --reason on `certs revoke` (Option A: strict refusal) The pre-2026-05-05 CLI dropped to `--reason unspecified` whenever the operator omitted the flag. Compliance reporting (RFC 5280 §5.3.1, PCI- DSS §3.6, HIPAA §164.312) relies on the reason code being meaningful; silent fallback defeats the audit trail because every revocation looks identical. cmd/cli/main.go dispatch refuses to send when --reason is empty, prints the canonical RFC 5280 §5.3.1 reason-code menu, and exits non-zero. internal/cli/client.go exposes ValidRevokeReasons() returning the canonical camelCase list (unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, removeFromCRL, privilegeWithdrawn, aaCompromise) and NormalizeRevokeReason() that accepts both camelCase and snake_case inputs and normalises to the canonical wire form. Off-list reasons are rejected at dispatch with the menu re-printed. Test pins: internal/cli/client_test.go::TestClient_RenewCertificate_ForceFlag — --force=true sends ?force=true with empty body; --force=false sends no query and no body. internal/cli/client_test.go::TestNormalizeRevokeReason + TestValidRevokeReasons — canonical-camelCase + snake_case + reject- off-enum behaviour. cmd/cli/dispatch_test.go::TestHandleCerts_Revoke_RequiresReason + TestHandleCerts_Revoke_RejectsUnknownReason + TestHandleCerts_Renew_ForceFlag — dispatch-layer pins for the same contracts. internal/api/handler/certificate_handler_test.go::TestTriggerRenewal_ ForceQueryParam — query-param passthrough (no-flag, force=true, force=1, force=false) flows through to the service-layer parameter. internal/service/certificate_test.go::TestTriggerRenewal_ ForceOverridesInProgress — force=false preserves the RenewalInProgress block; force=true clears it. Existing TestTriggerRenewal_Archived extended to assert force=true still blocks Archived (terminal-state guarantee). Docs: docs/reference/cli.md updated with the --force example for renew and the strict --reason semantics for revoke (including snake_case input acceptance). Acceptance gate (verified): - go build ./cmd/server/... ./cmd/agent/... ./cmd/cli/... ./cmd/mcp-server/... clean. - go vet ./... clean. - go test -short -count=1 ./... pass repo-wide. - bash scripts/ci-guards/openapi-handler-parity.sh clean (router 178, OpenAPI 144, exceptions 36 — unchanged; we add parameter parsing, not routes). - gofmt -l clean.	2026-05-05 19:49:34 +00:00
shankar0123	8b75e0311b	chore: rename Go module path to github.com/certctl-io/certctl ... Mechanical sed across the main go.mod's module declaration, the f5-mock-icontrol sub-module's go.mod, every Go file's import path (361 files), and a rebuild of the checked-in f5-mock-icontrol binary so its embedded build-info reflects the new module path. No behavior change. Choice B from cowork/transfer-certctl-to-org.md, executed 2026-05-04. Choice A (keep module path declared as github.com/shankar0123/certctl regardless of repo URL) shipped on the day of the org transfer (2026-05-03) since we had no external Go consumers; this commit closes that deferral. Backward-compat: GitHub HTTP redirects continue to forward github.com/shankar0123/certctl → github.com/certctl-io/certctl at the URL level, but Go's module proxy uses the path declared in go.mod as the canonical name. Pre-fix, anyone trying `go get github.com/certctl-io/certctl/...` hit a "module path mismatch" error because go.mod said github.com/shankar0123/certctl and the URL they fetched it from said certctl-io/certctl. Post-fix, the canonical name and the URL agree, so go get / go install / external Go consumers / Go-tooling integrations work cleanly via either the new path (preferred) or the old path (which redirects and Go follows the redirect for source fetch). Anyone still importing the old path inside their own code keeps working provided they update their go.mod's `require` line to match — the module path declared in their consumer's go.sum / go.mod is the authoritative import name, so a mass sed across their import statements is the migration on the consumer side. No external consumers exist today. Diff shape: 361 *.go files — import path replacement only 2 go.mod — module declaration replacement only 1 binary — deploy/test/f5-mock-icontrol/f5-mock-icontrol rebuilt so embedded build-info reflects the new path (8618965 vs 8618933 bytes; 32-byte diff is the build-info change) Total: 364 files, 730 insertions / 730 deletions, net-zero size, pure mechanical substitution. Verification: gofmt: 17 files needed re-alignment after sed (the new path is one char shorter than the old, so column-aligned import groups drifted). Applied `gofmt -w` to fix. go mod tidy: clean exit on both modules. go vet ./...: clean exit. go build ./...: clean exit. go test -short -count=1 on representative packages: all green (internal/domain, internal/validation, internal/crypto, internal/crypto/signer, cmd/agent). Test output now reads `ok github.com/certctl-io/certctl/...` confirming the module path resolves correctly. binary: f5-mock-icontrol rebuilt; `strings | grep shankar0123` returns nothing; `strings | grep certctl-io/certctl` shows the new module path embedded in build-info. Files intentionally NOT touched in this commit: README.md / CHANGELOG.md / docs/ / etc. — already swept to certctl-io URLs in commit 0729ee4 (the post-transfer URL refresh). This commit is purely the Go-tooling layer. Scarf pixels (`shankar0123.docker.scarf.sh/...`) — Scarf-account namespace, not a Go import or GitHub repo URL. Stays. This is a non-blocking, non-customer-impacting change. Operators pulling container images, running `make verify`, hitting the API, or installing the agent see no functional difference. Only Go-tooling consumers (none today) are affected, and they're enabled — not broken — by this commit.	2026-05-04 00:30:29 +00:00
shankar0123	95d0d85391	Bundle Q (Coverage Audit Closure): property-based pilot + hygiene — L-001/L-002/L-003/L-004/I-001 closed ... Five small closures wrapping the Low-tier and Info-tier audit findings. Q.1 — cmd/cli round-out (L-001 closed) ====================================== cmd/cli/dispatch_test.go: ~30 dispatch tests across handleCerts / handleAgents / handleJobs / handleImport / handleStatus. httptest.NewTLSServer mocks the API; cli.NewClient(_, _, _, _, true) constructs an insecure-skip-verify client. Each test pins the missing-args usage-print path AND the happy-path delegation. Result: 7.1% -> 63.5% coverage (gate: >=30%). Q.2 — awssm round-out (L-002 closed) ====================================== internal/connector/discovery/awssm/awssm_edge_test.go: New() default constructor, extractKeyInfo (ECDSA/Ed25519/unknown — was RSA-only), processSecret filter arms (NamePrefix mismatch / TagFilter mismatch / empty-value / GetSecretValue error), realSMClient stub-contract pin (ListSecrets / GetSecretValue / NewRealSMClient), and EmailAddresses SAN extraction. Result: 78.2% -> 96.0% coverage (gate: >=85%). Q.3 — Property-based testing pilot (L-003 closed) ====================================== gopter@v0.2.11 added to go.mod (test-only). internal/crypto/encryption_property_test.go: - TestProperty_EncryptDecryptRoundTrip — 50 successful tests, DecryptIfKeySet(EncryptIfKeySet(x, k), k) == x - TestProperty_WrongPassphraseRejected — 30 successful tests, AEAD never returns nil-error AND bytes-equal plaintext under wrong passphrase Both skipped under -short to keep developer loop fast (PBKDF2 600k rounds × 50 iters ≈ 15s on -race CI). internal/pkcs7/length_property_test.go: - TestProperty_ASN1LengthRoundTrip — three sub-properties: decodeLength(encode(x)) == x for x ∈ [0, 2³¹−1]; short-form invariant (length<128 → 1 byte == length); long-form invariant (length>=128 → high bit set + N bytes follow). 500 successful tests in <10ms. Q.4 — Architecture diagram multi-agent update (L-004 closed) ====================================== docs/qa-test-guide.md::Architecture: ASCII diagram updated to show 'certctl-agent (×N)' + callout explaining seed_demo.sql provisions 12 agent rows (1 active, 2 retired, 9 reserved/sentinel) for Parts 04, 05, 55 + FSM coverage. Operators running parallel-agent topologies guided to AGENT_COUNT=N + 'make qa-stats'. Q.5 — Test-naming CI guard (I-001 closed) ====================================== .github/workflows/ci.yml: Test-naming convention guard added after the QA-doc seed-count drift guard. Greps for func Test<X>( missing the <X>_<Scenario> suffix. Prints first 20 non-conformant as ::warning:: annotations. continue-on-error: true (informational). Excludes TestMain + TestProperty_*. Promotion to hard-fail tracked as I-001-extended. Verification ====================================== - python3 yaml.safe_load on ci.yml: OK - go vet ./cmd/cli/... ./internal/connector/discovery/awssm/... ./internal/crypto/... ./internal/pkcs7/...: clean - go test -short -count=1 across all four packages: PASS - go test -count=1 (full property tests): PASS - crypto 15.4s (50 + 30 × 600k PBKDF2) - pkcs7 5ms Audit deliverables ====================================== - gap-backlog.md: strikethroughs on L-001/L-002/L-003/L-004/I-001 with per-finding closure note - closure-plan.md: ticks Bundle Q [x] with per-item breakdown Closes: L-001, L-002, L-003, L-004, I-001 Bundle: Q (Property-Based + Hygiene)	2026-04-27 18:36:47 +00:00