3 Commits

Author	SHA1	Message	Date
shankar0123	10f9574bcd	fix: TICKET-016 document InsecureSkipVerify, TICKET-019 consistent error wrapping, TICKET-020 config struct docs ... TICKET-016: Document InsecureSkipVerify rationale - Added detailed security comments above each InsecureSkipVerify usage - Explained that discovery/verification must see ALL certificates - Clarified that InsecureSkipVerify is scoped to probing only - Referenced full security audit rationale - Updated: internal/service/network_scan.go, cmd/agent/verify.go TICKET-019: Consistent error wrapping in services - Wrapped raw error returns with context in DeleteTarget (network_scan.go) - Wrapped raw error returns in ClaimDiscovered (discovery.go) - Wrapped raw error returns in DismissDiscovered (discovery.go) - Pattern: return fmt.Errorf("failed to <operation>: %w", err) TICKET-020: Config struct documentation - Added godoc comments to all config struct fields - Documented valid values, defaults, requirements, dependencies - Updated: NotifierConfig, KeygenConfig, CAConfig, StepCAConfig - Updated: ACMEConfig, OpenSSLConfig, ESTConfig - Updated: SchedulerConfig, LogConfig, AuthConfig, RateLimitConfig - Updated: ServerConfig, DatabaseConfig, VerificationConfig, NetworkScanConfig - All fields now have comprehensive inline documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-27 21:41:56 -04:00
shankar0123	fd6ae98222	fix: resolve M25 compile errors in verification tests ... - Fix undefined tls.Listener in verify_test.go (type doesn't exist in crypto/tls); use server.Listener.Addr() and server.TLS.Certificates - Fix mockJobRepository missing Delete/ListByStatus/ListByCertificate/ UpdateStatus/GetPendingJobs methods required by JobRepository interface - Fix mockAuditService type mismatch: NewVerificationService expects *AuditService (concrete), not a mock; use real AuditService with mock repo following existing testutil_test.go patterns - Fix List() signature mismatch (had extra filter param) - Add nil-safe logger checks in verify.go to prevent panics in tests - Remove unused imports (crypto/tls, bytes, repository) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-27 21:21:24 -04:00
shankar0123	be72627aeb	feat: M25 post-deployment TLS verification + M26 Traefik/Caddy targets ... M25: After deploying a certificate, the agent probes the live TLS endpoint and compares SHA-256 fingerprints to verify the correct cert is being served. Best-effort — failures don't block deployments. New endpoints: POST /jobs/{id}/verify, GET /jobs/{id}/verification. Migration 000008 adds verification columns to jobs table. M26: Traefik target connector (file provider, auto-reload) and Caddy target connector (dual-mode: admin API hot-reload or file-based). Both wired into agent dispatch. Also: restructured README to highlight supported integrations (issuers, targets, notifiers) earlier, moved API/CLI/MCP sections lower. Updated all docs (features, connectors, architecture, testing guide, why-certctl) and fixed integration tests for 18-param RegisterHandlers signature. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-27 21:07:16 -04:00