667a30870d
feat: M18b Filesystem Certificate Discovery — agent scanning, server dedup, triage API
...
Agent-side:
- Filesystem scanner walks configured directories (CERTCTL_DISCOVERY_DIRS)
- Parses PEM (.pem, .crt, .cer, .cert) and DER (.der) certificate files
- Extracts CN, SANs, serial, issuer/subject DN, validity, key info, SHA-256 fingerprint
- Reports discoveries to control plane on startup + every 6 hours
- Skips files >1MB and private key files
Server-side:
- Migration 000006: discovered_certificates + discovery_scans tables
- Domain model: DiscoveredCertificate, DiscoveryScan, DiscoveryReport
- Three triage states: Unmanaged, Managed (claimed), Dismissed
- Repository with upsert dedup (fingerprint + agent + path)
- Service layer: process reports, claim, dismiss, list, summary
- 7 new API endpoints (84 total):
POST /agents/{id}/discoveries, GET /discovered-certificates,
GET /discovered-certificates/{id}, POST .../claim, POST .../dismiss,
GET /discovery-scans, GET /discovery-summary
- Audit trail: scan_completed, cert_claimed, cert_dismissed events
Tests: 28 new test functions (domain, handler, service layers)
Docs: README, quickstart, demo-guide, demo-advanced, architecture,
concepts, connectors, features.md all updated
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-24 00:25:00 -04:00
ee75f149ae
feat: M14 — Observability (dashboard charts, agent fleet, stats API, metrics, structured logging, rollback)
...
Backend: StatsService with 5 aggregation methods, JSON metrics endpoint, slog-based
structured logging middleware. Stats API: dashboard summary, certificates-by-status,
expiration timeline, job trends, issuance rate. 23 new backend tests.
Frontend: Recharts-powered dashboard with 4 charts (status pie, expiration heatmap,
job trends line, issuance bar), agent fleet overview page with OS/arch grouping and
version breakdown, deployment rollback buttons on version history. 7 new frontend tests.
78 API endpoints, 744+ total tests (658 Go + 86 Vitest).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-22 19:46:13 -04:00
5d98e373e3
feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications
...
Implements core revocation infrastructure: POST /api/v1/certificates/{id}/revoke
with all 8 RFC 5280 reason codes, JSON-formatted CRL at GET /api/v1/crl, webhook
and email revocation notifications, best-effort issuer notification, and immutable
revocation audit trail. Includes 48 new tests across service, handler, integration,
and domain layers (600+ total). Fixes 3 pre-existing test bugs (team_test error
matching, agent_group delete status code, team handler per_page validation).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-22 10:59:18 -04:00
690765b53e
test: comprehensive test expansion — 330+ to 525+ tests, close M11b coverage gaps
...
Add 195+ new tests across service, handler, connector, and integration layers:
- Service tests: team (23), owner (21), agent_group (25), issuer (18), issuer_adapter (6)
- Handler tests: teams (26), owners (21)
- NGINX target connector tests (13): config validation, deployment, reload
- Integration tests: 19 M11b endpoint subtests (teams, owners, agent groups CRUD)
- CI pipeline: add ./internal/connector/target/... to test coverage path
- Docs: update test counts to 525+ across README, architecture, CLAUDE.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-21 23:43:32 -04:00
b0549e6f05
feat: M11b — ownership tracking, agent groups, interactive renewal approval
...
Ownership: owners/teams GUI pages, notification email resolution via
resolveRecipient (owner_id → owner.email lookup). Agent groups: dynamic
device grouping by OS/arch/IP CIDR/version with manual include/exclude
membership, migration 000004, full CRUD stack (domain → repo → service →
handler → frontend). Interactive approval: AwaitingApproval job state,
approve/reject API endpoints with reason tracking. Tests: 12 agent group
handler tests, 8 approve/reject job handler tests, integration tests
updated for 13-param RegisterHandlers. Docs updated across architecture,
concepts, and seed data.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-20 21:02:35 -04:00
a579a84c7f
feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry
...
Add certificate profiles as named enrollment templates that control allowed
key algorithms, max TTL, permitted EKUs, required SAN patterns, and optional
SPIFFE URI SANs. CSR submissions are validated against profile rules at
signing time (key type + minimum size). Short-lived certs (TTL < 1 hour)
auto-expire via a new scheduler loop — expiry acts as revocation, no
CRL/OCSP needed.
New files:
- Migration 000003: certificate_profiles table, FK columns on
managed_certificates/renewal_policies, key metadata on certificate_versions
- domain/profile.go: CertificateProfile + KeyAlgorithmRule structs
- repository/postgres/profile.go: full CRUD with JSONB marshaling
- service/profile.go: ProfileService with validation + audit logging
- service/crypto_validation.go: CSR-against-profile validation (RSA/ECDSA/Ed25519)
- handler/profiles.go: 5 HTTP endpoints under /api/v1/profiles
- web/src/pages/ProfilesPage.tsx: profiles management page
Modified:
- renewal.go: CSR validation in CompleteAgentCSRRenewal, ExpireShortLivedCertificates
- scheduler.go: 30s short-lived expiry check loop
- certificate.go (repo): nullable profile FK, key metadata on versions
- main.go: profile repo/service/handler wiring, 8-param NewRenewalService
- router.go: 12-param RegisterHandlers with profile routes
- seed_demo.sql: 4 demo profiles (standard, mtls, short-lived, high-security)
- Frontend: types, API client, routing, sidebar nav
Tests: 40 new tests across handler (15), service (13), crypto validation (12)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-20 20:39:49 -04:00
ac594d88c0
Fix agent registration URL in negative test and connector test path in CI
...
negative_test.go used /api/v1/agents/register but the route is POST
/api/v1/agents. ci.yml used ./internal/connector/... which includes
packages with no test files causing "no such tool covdata" errors;
narrowed to ./internal/connector/issuer/local/... which has tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-15 14:12:42 -04:00
8526314a44
Implement M9: test hardening with handler tests, negative paths, CI coverage gates
...
All 7 handler files now have test coverage: jobs (14 tests), notifications
(11), policies (15), issuers (15), targets (14). Negative-path integration
tests cover nonexistent resources, invalid payloads, malformed CSR, expired
cert lifecycle, and method-not-allowed errors. CI now enforces coverage
thresholds (service 60%+, handler 50%+) and includes connector tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-15 14:06:48 -04:00
shankar0123