2 Commits

Author	SHA1	Message	Date
shankar0123	a4df1f86ae	crl/ocsp: admin observability endpoint + Phase 6 e2e scaffold ... Phase 5 (admin endpoint slice) + Phase 6 (e2e test stub) of the CRL/OCSP responder bundle. Closes the deferred items from the backend-slice merge (77d6326). What landed: Phase 5 — admin observability: * GET /api/v1/admin/crl/cache (handler.AdminCRLCacheHandler): - Per-issuer cache state + most recent N generation events - Admin-gated via middleware.IsAdmin (M-003 pattern); non-admin callers get 403 + the service is never invoked - Reveals issuer set + CRL cadence, hence the gate - Returns CachePresent=false rows for never-generated issuers so the GUI can show 'not yet generated' instead of 404 - Per-issuer Get failures decorate the row's RecentEvents rather than failing the whole response * AdminCRLCacheServiceImpl: thin handler-side composition over repository.CRLCacheRepository + an issuer-IDs callback (avoids importing internal/service from internal/api/handler) * M-008 admin-gate pin updated: admin_crl_cache.go added to AdminGatedHandlers; full triplet of tests (NonAdmin_Returns403, AdminExplicitFalse_Returns403, AdminPermitted_ForwardsActor) + RejectsNonGetMethod + PropagatesServiceError * Router registration + HandlerRegistry field + main.go wiring (callback closure over issuerRegistry.List) * OpenAPI entry under CRL & OCSP tag Phase 6 — e2e scaffold: * deploy/test/crl_ocsp_e2e_test.go with TestCRLOCSPLifecycle + TestCRLOCSPPostEndpoint * Lifecycle test exercises issue → fetch OCSP (Good) → revoke → wait → fetch CRL (entry present) → fetch OCSP (Revoked) → verify dedicated responder cert + id-pkix-ocsp-nocheck * Helpers (issueLocalCert, revokeCertViaAPI, fetchCRL, fetchOCSP, fetchCACert) currently call t.Skip with TODO markers — sandbox has no Docker so the harness can't be wired end-to-end here; when CI / a fresh dev workstation runs, the implementer wires each helper to the existing integration_test.go primitives * Build-tagged //go:build integration so the standard go test sweep skips it; runs via the deploy/test integration workflow Coverage: handler 80.6% (above 75 floor; was 79.8% pre-Phase-5). All other packages unchanged. Backward compat: admin endpoint inert until an admin Bearer key is configured. The e2e test stub is no-op (skips) until wired. Deferred: * GUI cert-detail-page revocation panel — pure frontend work, no backend impact, separate session * E2E test helper wiring — depends on extracting the existing integration-test harness primitives into shared helpers; doable in a follow-up that has Docker available * V3-Pro polish (delta CRLs, OCSP rate-limiting, OCSP stapling)	2026-04-29 01:55:39 +00:00
shankar0123	62a412c488	Bundle C: Renewal/reliability cluster — 7 findings closed ... Closes M-006 + M-007 + M-008 + M-015 + M-016 + M-019 + M-020 from comprehensive-audit-2026-04-25. M-028 was already closed by the Bundle B CI follow-up. M-006 (CWE-913) — Idempotent migration 000014 migrations/000014_policy_violation_severity_check.up.sql: Prepended ALTER TABLE ... DROP CONSTRAINT IF EXISTS before the ADD. Mirrors the down migration's existing IF EXISTS shape and the M-7 idempotent-index idiom. Re-runs against partially-applied DBs now succeed. M-007 — Bulk-op partial-failure tests (3 new) internal/api/handler/bulk_partial_failure_test.go: TestBulkRevoke_PartialFailure_ReportsBoth TestBulkRenew_PartialFailure_ReportsBoth TestBulkReassign_PartialFailure_ReportsBoth Each asserts HTTP 200 + both success/failure counters round-trip + per-cert errors[] preserved with non-empty messages so operators can correlate each failure to its certificate ID. M-008 — Admin-gated handler enumeration pin (verified-already-clean) Recon: only one admin-gated handler — bulk_revocation.go — with full 3-branch test triplet already in place. health.go calls IsAdmin informationally to surface the flag to the GUI without gating. internal/api/handler/m008_admin_gate_test.go: Walks every handler .go file, asserts every middleware.IsAdmin call site is in AdminGatedHandlers (with required test triplet) or InformationalIsAdminCallers (justified). Adding a new admin gate without updating both the constant AND adding the test triplet fails CI. M-015 — Single-profile cardinality pin (verified-already-clean) Audit claim 'no cardinality validation' was wrong — enforced at struct level. domain.ManagedCertificate.{CertificateProfileID, RenewalPolicyID,IssuerID,OwnerID} and RenewalPolicy. CertificateProfileID are bare strings, not slices. internal/domain/m015_cardinality_test.go: reflect-based pin on kind=String. Schema change to N:N would have to update renewal.go's lookup loop in the same commit. M-016 (CWE-754) — Reap stale-agent jobs internal/repository/postgres/job.go::ListJobsWithOfflineAgents: JOIN jobs to agents on agent_id, filter (status=Running AND a.last_heartbeat_at < cutoff), exclude server-keygen jobs. internal/service/job.go::ReapJobsWithOfflineAgents: Flips matched jobs to Failed reason agent_offline so I-001 retry loop re-queues them on a healthy agent. Records audit event per reap. internal/scheduler/scheduler.go: Scheduler.runJobTimeout cycle now calls both reaper arms. agentOfflineJobTTL default 5min (5x agent-health-check default); SetAgentOfflineJobTTL knob for operator override. internal/service/job_offline_agent_reaper_test.go: 6 unit tests cover happy path, server-keygen-skip, non-Running-skip, non- positive-TTL fail-loud, repo-error propagation, audit-event recording. M-019 — Configurable ARI HTTP timeout Audit claim 'no fallback timeout' was wrong — ari.go:52 already had a 15s timeout. Bundle C makes it configurable. internal/connector/issuer/acme/acme.go: Config.ARIHTTPTimeoutSeconds field with env path CERTCTL_ACME_ARI_HTTP_TIMEOUT_SECONDS. internal/connector/issuer/acme/ari.go: Both HTTP clients (GetRenewalInfo + getARIEndpoint) now use the new ariHTTPTimeout() helper. Zero / negative / nil-config all fall back to the historic 15s default. ari_timeout_test.go: 4 dispatch arm tests. M-020 (CWE-770) — OCSP DoS hardening Pre-bundle the noAuthHandler chain had no rate limit. An attacker could DoS the OCSP responder, which for fail-open relying parties is a revocation bypass. cmd/server/main.go: noAuthHandler refactored from fixed middleware.Chain(...) to a conditional slice that appends middleware.NewRateLimiter when cfg.RateLimit.Enabled. Per-IP keying applies; OCSP/CRL/EST/SCEP are unauth. docs/security.md (NEW): Operator runbook documenting Must-Staple TLS Feature extension RFC 7633 as the architectural fix for fail-open relying parties. Profile-flip guidance + nginx/Apache/HAProxy/Envoy stapling snippets + explicit scope statement on what the rate limiter alone does NOT solve. Audit deliverables: cowork/comprehensive-audit-2026-04-25/audit-report.md: score 31/55 -> 38/55 closed (Medium 13/27 -> 20/27). cowork/comprehensive-audit-2026-04-25/findings.yaml: 7 status flips open -> closed with closure notes citing the Bundle C mechanism. certctl/CHANGELOG.md: Bundle C section under [unreleased]. Verification: go vet ./internal/service ./internal/scheduler ./internal/connector/issuer/acme ./internal/api/handler ./internal/domain ./cmd/server clean go test -count=1 -short on the same packages all green helm template + helm lint clean internal/repository/postgres setup-fail sandbox disk pressure (same on master HEAD before this branch)	2026-04-27 00:08:25 +00:00