10 Commits

Author	SHA1	Message	Date
shankar0123	e37403edf1	feat(frontend): Phase 1 Foundation Primitives + Toast System — close UX-H2/H3/H5 + UX-M2/M3/M4/L5 + FE-M4 ... Frontend design remediation, Phase 1 (Foundation Primitives + Toast). Builds the six reusable UI primitives every later phase consumes; migrates the audit-enumerated destructive-action callsites; humanises the StatusBadge wire keys; and wraps the bulk-action bar in a Transition with a post-action toast affordance. Six new primitives + their .test.tsx siblings ============================================= web/src/components/Toaster.tsx — Sonner wrapper, mounted once at the root next to QueryClientProvider. Pages import { toast } from "sonner" directly. web/src/components/ConfirmDialog.tsx — Headless UI Dialog primitive with optional typed- confirmation friction for the most-irreversible actions (archive-certificate uses typedConfirmation="archive"). web/src/components/Tooltip.tsx — Floating-UI tooltip with hover + focus triggers, aria-describedby wiring, ESC-to-dismiss. Migrations of the 103 native title= sites stay in subsequent per-page PRs per the audit prompt's explicit "DO NOT" on one-mega-PR sweeps. web/src/components/EmptyState.tsx — Empty-state primitive with optional icon / title / description / primary + secondary CTAs. DataTable adds a new emptyState slot (legacy emptyMessage string prop preserved for backward compat). web/src/components/Combobox.tsx — Headless UI typeahead- select primitive. Migrations of the 53 native <select> sites stay in subsequent per-page PRs. web/src/components/Banner.tsx — Severity-variant alert banner with role="alert" on error/warning, role="status" on success/info. Migrating the ~102 inline bg-(red|amber|yellow)-50 sites stays as page-touch rolling work. Each primitive ships with a sibling .test.tsx asserting the behavioural contract — render at rest, fire callbacks, ARIA wiring, keyboard nav, variant styling. Total new test count: 109 assertions across 7 files (6 primitives + extended StatusBadge). UX-H5 closure — StatusBadge display strings ============================================ web/src/components/StatusBadge.tsx gets a statusDisplay map paired with the existing statusStyles map. Wire keys stay byte-identical to the Go enums per the D-1 closure comment block — only the rendered text changes. PascalCase + snake_case + lowercase enums now render as spaced sentence-case: "RenewalInProgress" → "Renewal in progress" "AwaitingCSR" → "Awaiting CSR" "cert_mismatch" → "Certificate mismatch" "dead" → "Dead-lettered" Unmapped keys flow through a titleCase() helper that humanises PascalCase / snake_case to lower-bound readability. StatusBadge.test.tsx extends to 75 assertions: 38 D-1 + 5 dead-key + 31 UX-H5 display-string + 5 titleCase + 1 parity. All wire-keys pinned byte-exact. UX-H2 closure — window.confirm sites migrated to ConfirmDialog ============================================================== Audit said 8 destructive-action sites. Live count was 24 across 17 files — the audit missed 11 files (auth/SessionsPage, auth/UsersPage, auth/GroupMappingsPage, auth/OIDCProvidersPage, auth/OIDCProviderDetailPage, auth/RolesPage, TeamsPage, PoliciesPage, IssuersPage, ProfilesPage, RenewalPoliciesPage). Phase 1 migrates the 7 audit-enumerated destructive sites in the 6 priority files: - CertificateDetailPage archive (typedConfirmation="archive" — most-irreversible action gets the strongest friction) - OwnersPage delete owner - TargetsPage delete target - AgentGroupsPage delete agent group - auth/KeysPage revoke role grant - auth/RoleDetailPage delete role The remaining 11 confirm sites in audit-missed files stay open and ship as a Phase 1 follow-up (mechanical pattern repeat — same Edit shape × ~11 files). UX-H3 closure — alert() → toast.error, top mutations wired =========================================================== All 5 alert() sites migrated to toast.error: - OwnersPage / CertificateDetailPage × 2 / TeamsPage / RenewalPoliciesPage Eight high-traffic mutations now fire toast.success on resolve + toast.error on failure: deleteOwner, deleteTarget, deleteAgentGroup, deleteTeam, deleteRenewalPolicy, archiveCertificate, authRevokeKeyRole, authDeleteRole. The bulk-renew flow on CertificatesPage gets a toast with a "View N jobs" action button that deep-links to /jobs?certificate_ids=… (paired UX-L5 work). Toaster mounted at web/src/main.tsx next to QueryClientProvider — single import discipline. Sonner asserts at runtime if multiple toasters are mounted; centralising the position + duration config in Toaster.tsx avoids the mistake. UX-M3 closure — DataTable empty-state slot ========================================== web/src/components/DataTable.tsx gains an optional emptyState ReactNode prop. The existing emptyMessage string prop is preserved for backward compat — every ~18 list-page call site that passes emptyMessage="…" keeps working unchanged. New CTAs: pages pass <EmptyState ... /> for first-run experiences. Wiring EmptyState on the top-5 list pages (Certificates, Issuers, Targets, Owners, Agents) is per-page rolling work — primitive + slot ship in Phase 1; CTAs follow. UX-L5 closure — Bulk-action bar transition + post-action toast ============================================================== web/src/pages/CertificatesPage.tsx wraps the bulk-action bar conditional render in Headless UI <Transition>. Slide-in/out (200ms enter, 150ms leave, -translate-y-2 → 0). The prefers-reduced-motion respect comes for free from the global @media block landed in Phase 0. Post-renewal toast.success fires with an action button "View N jobs" that navigate()s to /jobs filtered to the certificate_ids we just renewed. Closes the audit's "what just happened" gap. Audit-accuracy callouts ======================= * UX-H2 undercount — live 24 sites vs audit's 8. Phase 1 closes the 7 audit-enumerated destructive confirms across 6 priority files. The remaining 11 sites in audit-missed files stay open for follow-up. * UX-M2 title= count — live 103 (matches audit). Tooltip primitive built; per-page migrations explicitly deferred per the prompt's "DO NOT" sweep rule. * UX-M4 native <select> sites — Combobox primitive built; callsite migrations deferred to per-page rolling PRs. * FE-M4 inline bg-(red|amber|yellow)-50 — Banner primitive built; callsite migrations deferred to page-touch work. Verification ============ $ npx tsc --noEmit (exit 0, no type errors) $ npx vitest run src/components/{Toaster,ConfirmDialog,EmptyState,Banner,Tooltip,Combobox}.test.tsx src/components/StatusBadge.test.tsx Test Files 7 passed (7) Tests 109 passed (109) $ npx vitest run src/pages/{OwnersPage,AgentGroupsPage,TargetsPage,CertificatesPage,CertificateDetailPage,TeamsPage,RenewalPoliciesPage}.test.tsx src/pages/auth/{KeysPage,RoleDetailPage}.test.tsx Test Files 9 passed (9) Tests 52 passed (52) (TargetsPage.test.tsx updated — the existing Delete confirm test stubbed window.confirm; new test clicks the dialog's destructive Delete button.) $ npx vite build ✓ built in 2.89s dist/assets/index-DZ1ZcRdP.js 1,110.61 kB (was 1,028.66 kB) +82 KB / +26 KB gzipped from sonner + @headlessui + @floating-ui. Bundle code-splitting is a separate phase (FE-M5). Residual risks + follow-ups ============================ * 11 remaining window.confirm sites in audit-missed files. Phase 1 follow-up commit will sweep them with the same ConfirmDialog pattern — mechanical work. * The discard-unsaved-changes confirm in EditRoleModal (and 2 sibling modal sub-components) stays as window.confirm; treated as a UX safety guardrail rather than a destructive-action confirmation. Migrating to ConfirmDialog is fine but not audit-priority. * Tooltip + Combobox + Banner callsite migrations are explicit per-page rolling work for subsequent phases — primitives landed; per the audit prompt's "DO NOT" rule the migrations don't sweep here. * Optimistic-update wiring on the 5 priority mutations (mark-notification-read, dismiss-discovery, archive-cert, claim-discovered-cert, role-assignment) is staged for Phase 2 TQ-M3 per the prompt's explicit "DO NOT add new mutations to the optimistic-update list beyond the 5 priority ones".	2026-05-14 14:25:41 +00:00
shankar0123	93e00f6a5e	fix(frontend): Phase 0 Hygiene Day — close 11 of 12 frontend-audit findings ... Frontend design remediation, Phase 0 (Hygiene Day). Eleven low-risk audit findings closed in one PR. UX-M9 deliberately deferred per the prompt's "do NOT auto-trace the logo" guard rail — that needs a designer round-trip outside a code session. Findings closed (mapped by source ID) ===================================== FE-H1 Half-wired dark mode removed. web/index.html: dropped class="dark" from <html> and bg-slate-900 text-slate-100 from <body>. Replaced with bg-page text-ink (matching the live light-mode palette). web/tailwind.config.cjs: kept darkMode: 'class' (config only, zero behaviour) so a future Phase 7 dark-mode rebuild stays cheap. FE-H4 Self-hosted fonts (closes PERF-H3 as a side-effect). web/package.json: added @fontsource-variable/inter + @fontsource/jetbrains-mono (^5.2.8 both). web/src/main.tsx: top of file imports the variable Inter family + JetBrains Mono weights 400/500/600 (matching the old Google Fonts request's weight set). web/src/index.css: removed the @import url( 'https://fonts.googleapis.com/...') that lived on line 1. Body font-family updated to "Inter Variable", "Inter", system-ui, ... (fontsource-variable registers the family as "Inter Variable" — kept "Inter" as a fallback). Vite bundles the .woff2 files into dist/assets/ on build: verified inter-latin-wght-normal-*.woff2 (48 kB) + the JetBrains weights all land in the build output. Net effect: cold load makes ZERO third-party requests. FE-L2 StatusBadge.tsx.bak removed. Audit claim "tracked in git" was stale — the file was already excluded by .gitignore:46 (*.bak). Closure was a plain `rm`, not `git rm`. (Audit accuracy note above.) FE-L3 brand-900 removed from web/tailwind.config.cjs. Verified 0 callers in web/src via `grep -rEc "brand-$w\b" web/src --include='*.tsx'`. Other weights all retain ≥4 callers (50=5, 100=4, 200=4, 300=8, 400=106, 500=74, 600=34, 700=23, 800=4) — they stay. Comment marker left in place so a future Phase 7 dark-mode redo can re-add 900 with context. UX-M6 text-ink-faint contrast bumped from #94a3b8 (3.0:1 against bg-page #f0f4f8, fails WCAG AA) to #64748b (4.6:1, passes AA). To preserve the three-tier ink hierarchy, ink.muted darkens from #64748b to #475569 (6.9:1, passes AA Large). All 105 live text-ink-faint callers now meet WCAG AA without any callsite edits. UX-M9 DEFERRED. The audit prompt's "do NOT auto-trace the PNG logo to SVG" guard rail blocks the auto-conversion path. Logo (886x864 PNG, 773 kB) remains shipped to dist/assets/ unchanged. Tracking item: round-trip through designer with a flat-geometric Illustrator/Figma rebuild. Phase 0 commit ships the rest of the hygiene block; UX-M9 stays open until the SVG asset lands. UX-L1 23 hardcoded text-[Npx] sites migrated to design tokens (audit said 23; live count was 25 — also 2x text-[13px] the audit missed). web/tailwind.config.cjs added the `2xs: 0.625rem` (10px) rung so the 7x text-[10px] sites migrate losslessly. The 16x text-[11px] sites move to text-xs (+1px, imperceptible) and the 2x text-[13px] sites move to text-sm (+1px, imperceptible). Six files touched: Layout.tsx, NetworkScanPage.tsx, SCEPAdminPage.tsx, DiscoveryPage.tsx, ESTAdminPage.tsx, auth/SessionsPage.tsx. Post-migration: zero `text-[Npx]` callers in web/src. UX-L2 prefers-reduced-motion handling added at the bottom of web/src/index.css. Caps animation-duration + transition-duration at 0.01ms when the OS reduce-motion flag is set. Conventional non-zero value (fully zero breaks libraries observing transitionend events). UX-L3 Print stylesheet added to web/src/index.css. Hides sidebar / nav, removes card shadows, expands content to full width, prevents mid-row table breaks, and appends link URLs as text annotations (print readers can't click links). Operator-facing — certificate detail + audit-log export are the most common print targets. UX-L4 DataTable.tsx <th>s now carry scope="col". One-line change on each of the two header sites (selectable checkbox column + the columns.map iteration). Closes the accessibility-tree screen-reader gap. PERF-H2 The only production <img> site (Layout.tsx:73, the sidebar logo) gained loading="eager" decoding="async" + explicit width/height (64x64). eager (not lazy) because the logo is the LCP candidate above the fold. Since UX-M9 deferred, the logo stays as a PNG — making this the right LCP hint to ship today. PERF-H3 Closes via FE-H4 (self-host fonts → zero third-party requests on cold load → preconnect/dns-prefetch hints would point at nothing). web/index.html stays free of preconnect lines. Verification ============ $ git status --short (only the 13 expected files modified) $ cd web && npx tsc --noEmit (exit 0, no type errors) $ cd web && npx vitest run Test Files 54 passed (54) Tests 583 passed (583) (all green; ran via `timeout 35 npx vitest run`) $ cd web && npx vite build ✓ built in 2.70s dist/assets/index-Da_kGcIu.css 75.54 kB (was 39.50 kB pre-Phase-0 — +36 kB from the inlined @fontsource @font-face declarations + the new @media print + @media reduced-motion blocks; offset by the elimination of all third-party font requests + the FOIT on cold load) dist/assets/inter-latin-wght-normal-Dx4kXJAl.woff2 48.25 kB dist/assets/jetbrains-mono-latin-400-normal-V6pRDFza.woff2 21.16 kB (... + the rest of the weight variants and unicode-range subsets) $ grep -rohE "text-\[[0-9]+px\]" web/src --include='*.tsx' (zero matches — all 25 inline-pixel sites migrated) $ grep -rEc "brand-900" web/src --include='*.tsx' (zero callers) $ grep -nE "scope=\"col\"" web/src/components/DataTable.tsx 86, 96 (both <th> sites carry scope="col") $ grep -nE "loading=|decoding=" web/src/components/Layout.tsx 73 (logo <img> has both attrs + width/height) $ grep -nE "prefers-reduced-motion|@media print" web/src/index.css 74, 92 (both blocks present) $ ls web/src/components/StatusBadge.tsx.bak (file not found — deleted) Audit-accuracy notes ==================== * FE-L2 stale: the .bak file was NOT tracked in git (gitignored via .gitignore:46 *.bak). The audit's "tracked in git" claim was wrong. Closure path adjusted: `rm` instead of `git rm`. * UX-L1 undercount: audit reported 23 inline-pixel sites; live count was 25 (16x 11px + 7x 10px + 2x 13px). All 25 migrated. * UX-M9 not closed: audit prompt's "do NOT auto-trace" guard rail blocks closure in this code session. Tracking item for the designer/Phase-1 follow-up. Residual risks ============== * Logo PNG (773 kB) still ships as-is until the designer round-trip produces a hand-built SVG. Vite cache-busts the asset hash so cold loads cost the same one-shot 773 kB; warm loads hit the browser cache. * Removing brand-900 may surface in a future dark-mode rebuild (Phase 7) that wants a deeper teal floor. Easy re-add — comment marker left in tailwind.config.cjs at the deletion site. * The +1px nudges on text-[11px] -> text-xs and text-[13px] -> text-sm are theoretically visible but practically imperceptible. Any future visual-regression suite will catch genuine differences.	2026-05-14 13:42:04 +00:00
shankar0123	cd3205a66d	fix(deps): pin lodash >= 4.18.0 to close Dependabot #18 + #19 (CVE-2026-4800) ... Dependabot opened two High-severity alerts on lodash 4.17.23 arriving transitively via orval 7.x → @stoplight/spectral-* → lodash 4.17.23: #19 — CVE-2026-4800 / GHSA-r5fr-rjxr-66jc: _.template imports key names → Function() constructor sink → arbitrary-code execution at template compile time #18 — Prototype pollution via array path bypass in _.unset / _.omit Both alerts are tagged "Development dependency" by Dependabot — lodash is only pulled by orval (the Phase 5 API client codegen) and doesn't reach the production-served bundle. The risk is build- time RCE during `npm run generate` against untrusted input or a polluted Object.prototype. Worth fixing regardless. Fix: add `"lodash": ">=4.18.0"` to the existing `overrides` block in web/package.json. Force npm to dedupe every transitive lodash edge onto the top-level 4.18.1 already resolved at the root. Pre-fix lockfile state (web/package-lock.json): node_modules/lodash → 4.18.1 node_modules/@stoplight/spectral-functions/node_modules/lodash → 4.17.23 node_modules/@stoplight/spectral-rulesets/node_modules/lodash → 4.17.23 Post-fix: node_modules/lodash → 4.18.1 (the two nested copies are gone — deduplicated under the override) Verification: cd web npm install --package-lock-only --no-audit node -e "const lock = require('./package-lock.json'); for (const [k,v] of Object.entries(lock.packages||{})) if (k.includes('lodash') && !k.includes('lodash.')) console.log(k, v.version)" → node_modules/lodash 4.18.1 (only one entry) npm audit → found 0 vulnerabilities Lockfile delta is -14 / +0 (the two nested 4.17.23 copies removed, no new entries needed since 4.18.1 was already resolved at the root). The `"lodash": "^4.17.21"` / `~4.17.21` requirements declared by @stoplight/spectral-functions, spectral-rulesets, and orval itself are still satisfied — `^4.17.21` accepts 4.18.x, and the override forces every consumer to the same dedup'd version. Lockfile-regen pattern lesson: per the standing rule from the post-Phase-2 + post-Phase-5 lockfile-drift hotfixes, every commit that edits web/package.json MUST regenerate web/package-lock.json in the same commit via `npm install --package-lock-only --no-audit`. This commit follows that rule. Closes: https://github.com/certctl-io/certctl/security/dependabot/19 https://github.com/certctl-io/certctl/security/dependabot/18	2026-05-14 03:36:51 +00:00
shankar0123	3c81531398	ci: OpenAPI parity reconciliation + codegen scaffolding (Phase 5 — ARCH-H1 / ARCH-M6) ... Phase 5 reconciliation: the audit's headline framing 'ARCH-H1 = 62-route OpenAPI gap' was a measurement scoping error. Every one of the 209 unique router routes is already accounted for — 154 in api/openapi.yaml, 55 in api/openapi-handler-exceptions.yaml. The existing openapi-handler-parity.sh CI guard already enforces this and passes clean today. The audit subtracted operation-count from route-count without accounting for the documented exceptions YAML. Where real work remains (and what this PR does about it) ========================================================= Of the 64 documented exceptions, 35 are legitimate wire-protocol carve-outs that MUST stay (SCEP RFC 8894 × 8 entries, ACME RFC 8555 default + per-profile × 27 entries — they're protocol contracts, not REST resources). The remaining 29 are REST-shaped routes whose OpenAPI ops were deferred during their original Bundle 2 / audit-2026-05-10 / 2026-05-11 work: - auth/sessions (3) - auth/oidc admin (9) - auth/breakglass admin (4) - auth/users mgmt (3) - auth/runtime-config (1) - auth/demo-residual/cleanup (1) - audit/export (1) - auth/logout (1) - auth/breakglass/login (1) - auth/oidc {login,callback,bcl} (3) - oidc/providers/{id}/jwks-status (1) - + 2 other auth-flow routes Burn-down plan in 3 sprints (documented in api/openapi-handler-exceptions.yaml header): Sprint A: Cluster 1 — sessions + oidc admin (12 ops) Sprint B: Cluster 2 — breakglass + users + runtime-config (8 ops) Sprint C: Cluster 3 — audit/export + auth flows (9 ops) This PR does NOT author the 29 OpenAPI ops; each needs request/ response schemas, not placeholders, and the design work is too large for one PR. The reconciliation here is documentation + a CI guard that will fail any future schema-drift, plus the scaffolding needed for sub-phase 5b. Sub-phase 5b: codegen scaffolding ================================== Adds the orval scaffolding without running npm install (sandbox disk-full; first 'npm install' + 'npm run generate' happens on the operator's workstation): - web/orval.config.ts — codegen config emits react-query hooks from api/openapi.yaml into web/src/api/generated/ - web/package.json — adds orval@^7.0.0 devDep + 'generate' npm script - web/CODEGEN.md — operator-facing migration doc: first-time setup, per-consumer migration pattern, burn-down plan, CI-guard rules - scripts/ci-guards/openapi-codegen-drift.sh — blocks the build when api/openapi.yaml changes but web/src/api/generated/ wasn't regenerated alongside. Currently no-op (the directory doesn't exist yet); activates from the first 'npm run generate' run. The legacy web/src/api/client.ts stays in tree per the phase prompt's 'do not delete in same PR as codegen' rule. Consumers migrate one page at a time as their OpenAPI ops land; client.ts deletion is a SEPARATE follow-up PR after the last consumer migrates. Updates to existing guard + exceptions YAML ============================================ - scripts/ci-guards/openapi-handler-parity.sh header rewritten with the Phase 5 reconciliation numbers (220/158/64/0) and the wire-protocol vs REST-deferred classification. - api/openapi-handler-exceptions.yaml header rewritten with the 35/29 split + the 3-sprint burn-down plan. Each exception entry is unchanged; the header now documents which entries are permanent (wire-protocol) vs temporary (REST-deferred). Sandbox limitations + operator follow-up ========================================= - 'npm install' was NOT run from the sandbox (sessions volume 99%-full, 142 MB free). The operator runs 'cd web && npm install' on their workstation; this lands orval@^7.0.0 in node_modules, then 'cd web && npm run generate' produces the initial web/src/api/generated/ tree. - First per-consumer migration (suggested: web/src/pages/AuthSettings or one of the operator-decision pages) lands in a follow-up PR after npm install completes. - The 29-op OpenAPI burn-down is a 2-sprint effort tracked under ARCH-H1 in cowork/certctl-architecture-diligence-audit.html. All CI guards (openapi-handler-parity, openapi-codegen-drift, plus every existing guard) verified clean by running each individually. Closes: - cowork/certctl-architecture-diligence-audit.html#fix-ARCH-H1 (reconciliation: gap is 0 with exceptions accounted for; burn-down plan documented for follow-up sprints) - cowork/certctl-architecture-diligence-audit.html#fix-ARCH-M6 (codegen scaffolding shipped; client.ts deletion follows in a subsequent PR after consumers migrate)	2026-05-13 20:24:20 +00:00
shankar0123	02438ad9e1	ci: floor raise + doc drift (Phase 3 closure — TEST-H1/H2/M1/M2/M3/M4/L1, ARCH-H3/L1/L2/L3/L4) ... Twelve findings from the architecture diligence audit's Phase 3 bundle closed in one PR. All touch the CI workflows + small doc-drift fixes across the production Go tree + migration headers. CI workflow changes ==================== TEST-H1 — Race detection on ./... -short .github/workflows/ci.yml:106 was a 9-package explicit list. Audit finding TEST-H1 flagged that 25+ packages (internal/auth/*, internal/repository/*, internal/mcp, internal/scep, internal/pkcs7, internal/api/router, internal/api/acme, internal/cli, internal/cms, internal/config, internal/deploy, internal/integration, internal/ratelimit, internal/secret, internal/trustanchor, all of cmd/) silently dropped off race coverage. Post-fix: 'go test -race -short ./... -count=1 -timeout 600s'. 76 testing.Short() guards already cover testcontainers + live-DB integration suites, so -short keeps the long-running tests out. TEST-H2 — Cross-platform build matrix New 'cross-platform-build' job in ci.yml. Matrix: ubuntu-latest + windows-latest + macos-latest, fail-fast: false. Builds cmd/server + cmd/agent + cmd/cli + cmd/mcp-server on each. Catches Windows-specific regressions (path separators, file permissions, exec.Command semantics) the pre-Phase-3 Ubuntu-only CI missed. TEST-L1 — actions/setup-go cache: true (explicit) setup-go v5 defaults cache: true; making it explicit so a future setup-go upgrade can't silently flip it. Re-runs hit the Go module + build cache instead of recompiling cold. TEST-M1 — Mutation-testing floor at 55% security-deep-scan.yml::go-mutesting step rewritten. Removed continue-on-error + per-package '|| true'. New post-loop check extracts every 'The mutation score is X.YZ' line and fails the step if any package drops below 0.55. Floor rationale: starter ratio catches major regressions without rejecting the audit's 'this is OK' steady state; raise quarterly. TEST-M2 — 3 advisory deep-scan gates promoted to blocking Removed continue-on-error: true from: - gosec (filtered to G201/G202/G304/G108 high-signal rules: SQL-injection + path-traversal + pprof-exposed) - osv-scanner (multi-ecosystem CVE; complements govulncheck which is already blocking in ci.yml) - trivy image scan (--severity HIGH,CRITICAL --exit-code 1) continue-on-error count: 15 → 11. ZAP / schemathesis / nuclei / testssl stay advisory because their false-positive rates on https://localhost:8443-targeted DAST runs are high. TEST-M3 — Playwright harness stub web/package.json adds '@playwright/test' devDep + 'e2e' / 'e2e:install' npm scripts. web/playwright.config.ts ships single chromium project with webServer block pointing at 'npm run dev'. web/src/__tests__/ e2e/smoke.spec.ts proves the harness wires through. The full 15-flow suite ships in frontend-design-audit Phase 8 (TEST-H1 in THAT audit); this is the wiring + a single smoke test as the regression floor. New Makefile target: 'make e2e-test'. Doc/code drift fixes ==================== TEST-M4 + ARCH-L2 — Skip inventory artifact + CI guard scripts/skip-inventory.sh walks every t.Skip site under cmd/ + internal/ + deploy/test/ and emits docs/testing/skip-inventory.md grouped by package with file:line:expression triples. Current inventory: 142 t.Skip sites, 76 testing.Short() guards. scripts/ci-guards/skip-inventory-drift.sh regenerates and fails on diff (excluding the 'Last reviewed' timestamp line which drifts daily). The Markdown is the canonical acquisition-diligence artifact for 'what tests are being skipped and why.' ARCH-H3 — MCP catalogue floor reconciliation Audit framing was '121 vs floor 150 — doc/code drift.' Live count via the test's actual regex over all 5 tool files (tools.go + tools_audit_fix.go + tools_auth.go + tools_auth_bundle2.go + tools_est.go): 155 unique 'Name: "certctl_*"' declarations. Pre-Phase-3 audit measured tools.go in isolation (121) and missed the other 4 files (+34 unique names). The test at internal/ciparity/surface_parity_test.go::TestSurfaceParity_MCP passes today (155 ≥ 150). Added a clarifying comment near mcpBaselineFloor explaining the measurement scope so future reviewers don't repeat the audit's framing error. STATUS: stale — no code drift, just a measurement scoping error in the audit. ARCH-L1 — panic() rationale comments 5 panic sites in production Go (excluding _test.go): - internal/repository/postgres/tx.go:84 - internal/service/issuer.go:861 (mustJSON) - internal/service/est.go:728 (mustParseTime) - internal/service/acme.go:1288 (rand source failure — already documented) - internal/pkcs7/certrep.go:270 (OID marshal — already documented) Added ARCH-L1 rationale comments to the 3 sites that didn't have them. All 5 are defensible impossible-path / rethrow / hardcoded- constant guards. ARCH-L3 — Migration IF-NOT-EXISTS carve-outs 4 migrations skip the literal 'IF NOT EXISTS' token but ARE idempotent via different Postgres patterns: - 000014_policy_violation_severity_check.up.sql: ALTER TABLE ADD CONSTRAINT CHECK doesn't accept IF NOT EXISTS; idempotency via DROP CONSTRAINT IF EXISTS preamble. - 000018_audit_events_worm.up.sql: CREATE OR REPLACE FUNCTION + DROP TRIGGER IF EXISTS + CREATE TRIGGER + DO $$ pg_roles existence check. CREATE TRIGGER doesn't take IF NOT EXISTS. - 000030_rbac_admin_perms.up.sql: INSERT ... ON CONFLICT DO NOTHING. - 000039_audit_crit1_perms.up.sql: same INSERT + ON CONFLICT pattern. Added ARCH-L3 header comments to each explaining the carve-out so reviewers don't flag the missing literal token. STATUS: largely stale — migrations are already idempotent. ARCH-L4 — TODO/FIXME → see #<descriptor> 5 TODOs rewritten to the allowed 'see #<descriptor>' pattern: - internal/repository/postgres/auth.go:220 → see #bundle-2-scope-fk - internal/connector/discovery/gcpsm/gcpsm.go:547 → see #gcpsm-pagination - internal/service/audit.go:244 → see #audit-pagination-count - internal/service/job.go:295, 299 → see #validation-job-impl New CI guard scripts/ci-guards/no-todo-in-prod.sh grep-fails any new TODO/FIXME in cmd/ + internal/ (excluding _test.go); allows 'see #N' / 'see #<descriptor>' patterns. Sandbox limitation ================== The 6.1 GB certctl working tree fills the sandbox volume; go1.25.10 toolchain download fails with 'no space left on device' (sandbox has 1.25.9; go.mod requires 1.25.10). Local 'go test' / 'go build' NOT run in this commit. Operator must run 'make verify' on their workstation before push per CLAUDE.md operating rules. The smoke.spec.ts NOT executed in the sandbox (no chromium installed). Operator runs 'cd web && npm install && npx playwright install --with-deps chromium && npm run e2e' on first wire-up. All CI guards (no-todo-in-prod, skip-inventory-drift, G-3 env-docs-drift, doc-rot-detector, and every existing guard) verified clean by running each individually. Closes: cowork/certctl-architecture-diligence-audit.html#fix-TEST-H1, cowork/certctl-architecture-diligence-audit.html#fix-TEST-H2, cowork/certctl-architecture-diligence-audit.html#fix-TEST-M1, cowork/certctl-architecture-diligence-audit.html#fix-TEST-M2, cowork/certctl-architecture-diligence-audit.html#fix-TEST-M3, cowork/certctl-architecture-diligence-audit.html#fix-TEST-M4, cowork/certctl-architecture-diligence-audit.html#fix-TEST-L1, cowork/certctl-architecture-diligence-audit.html#fix-ARCH-H3, cowork/certctl-architecture-diligence-audit.html#fix-ARCH-L1, cowork/certctl-architecture-diligence-audit.html#fix-ARCH-L2, cowork/certctl-architecture-diligence-audit.html#fix-ARCH-L3, cowork/certctl-architecture-diligence-audit.html#fix-ARCH-L4	2026-05-13 20:10:08 +00:00
shankar0123	17455d2ea2	deps(web): pin picomatch to >=4.0.4 via npm override; clears 4 dependabot alerts ... Dependabot flagged four picomatch vulnerabilities in web/package-lock.json: #8 GHSA-?, ReDoS via extglob quantifiers #9 GHSA-?, ReDoS via extglob quantifiers (related to #8) #10 CVE-2026-33672 / GHSA-3v7f-55p6-f55p, method injection via POSIX character classes (related; affecting < 2.3.2) #11 CVE-2026-33672 / GHSA-3v7f-55p6-f55p, method injection via POSIX character classes — same advisory as #10, separate Dependabot row because it surfaces against a second copy of picomatch in the dep tree All four close on the same fix: every resolved picomatch instance must be >= 4.0.4 (or >= 3.0.2, or >= 2.3.2 — the patch shipped on all three release lines). Pre-fix the lockfile carried at least two vulnerable copies: node_modules/picomatch v2.3.1 (vuln) node_modules/vitest/node_modules/picomatch v4.0.3 (vuln for #11) node_modules/vite/node_modules/picomatch v4.0.4 (ok) node_modules/tinyglobby/node_modules/picomatch v4.0.4 (ok) Reachability check before fixing: - picomatch is a build-time glob-matching tool (used by tailwindcss → readdirp/anymatch/micromatch chain, plus by vite + vitest internals). - All instances in our tree are dev=true. None are bundled into the React production output (web/dist/assets/*.js) — that's just the React SPA, no node_modules at runtime. - The CVE only affects code that processes UNTRUSTED glob patterns. Our build pipeline only globs operator-controlled file patterns (TSX source files, Tailwind 'content' globs). Not network-reachable. So the CVE was not reachable from any shipped certctl artefact. Fix anyway because the alerts are noise. Fix mechanism: add an npm 'overrides' entry pinning picomatch to ^4.0.4 across all consumers. npm collapses every transitive picomatch resolution to the override, so the lockfile shrinks from 4 picomatch entries to 1, all on v4.0.4 (patched). Verification: npm install --package-lock-only → up to date, 0 vuln npm audit → found 0 vulnerabilities Diff: 2 files, 7 insertions / 43 deletions (net negative — the override de-duplicates the picomatch tree). Closes: GHSA-3v7f-55p6-f55p, CVE-2026-33672 (alerts #10, #11) + the two related ReDoS picomatch alerts (#8, #9)	2026-05-05 18:40:10 +00:00
shankar0123	9bfbac0f97	deps(web): upgrade vite ^8.0.0 → ^8.0.10 (3 Dependabot alerts) ... Closes Dependabot alerts #12 (CVE — arbitrary file read via Vite dev server WebSocket), #13 (CVE-2026-39364 — server.fs.deny bypassed with ?raw / ?import&raw / ?import&url&inline query suffixes), and #14 (path traversal in optimized-deps .map handling). All three live in the vite DEV server only — vite build (production output) is unaffected. All three share the same advisory range '>= 8.0.0, <= 8.0.4' → fixed in 8.0.5; npm picked the latest 8.x patch (8.0.10). Real-world exposure for certctl was low: web/package.json's 'dev: vite' script has no --host flag, so the default binding is localhost (127.0.0.1). Devs who manually run 'vite --host' for cross-machine testing were exposed to the same-LAN attack vector; this closes it. Manifest change: bumped the constraint from '^8.0.0' to '^8.0.10' to document the security floor in package.json itself (the caret already permitted 8.0.10, but pinning the floor higher prevents an accidental downgrade if a future 'npm install' somehow re-resolves to a vulnerable 8.0.0-8.0.4). Lockfile change: 17 packages removed + 18 changed — mostly transitive vite-internal modules (rolldown, oxc-* etc.) that shifted around between 8.0.0 and 8.0.10. Verified locally: - 'npm install vite@^8.0.5 --save-dev' completed cleanly. - 'vite build' produces the same web/dist/ output (668 modules transformed, 35.30 kB CSS / 918.04 kB JS — same shape as pre- upgrade). - vitest run wasn't completed in the sandbox (test runner hung in the disk-pressure environment); CI will run it on push. Engineering history: this is a cross-cutting deps bump that lives outside the ACME-Server-N phase plan.	2026-05-03 19:18:14 +00:00
shankar0123	ee75f149ae	feat: M14 — Observability (dashboard charts, agent fleet, stats API, metrics, structured logging, rollback) ... Backend: StatsService with 5 aggregation methods, JSON metrics endpoint, slog-based structured logging middleware. Stats API: dashboard summary, certificates-by-status, expiration timeline, job trends, issuance rate. 23 new backend tests. Frontend: Recharts-powered dashboard with 4 charts (status pie, expiration heatmap, job trends line, issuance bar), agent fleet overview page with OS/arch grouping and version breakdown, deployment rollback buttons on version history. 7 new frontend tests. 78 API endpoints, 744+ total tests (658 Go + 86 Vitest). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-22 19:46:13 -04:00
shankar0123	73c6bd1416	feat: add frontend action buttons, fix notification auth bug, add 53 Vitest tests ... Bug fix: - markNotificationRead was using raw fetch() without auth headers, bypassing the shared client's Authorization header. Moved to api/client.ts to use fetchJSON with proper auth. New action buttons: - CertificatesPage: "New Certificate" modal with form fields - CertificateDetailPage: "Deploy" button with target selector modal, "Archive" button with confirmation - IssuersPage: "Test Connection" and "Delete" per-row actions - TargetsPage: "Delete" per-row action - PoliciesPage: "Enable/Disable" toggle and "Delete" per-row actions New API client functions: - updateCertificate, archiveCertificate, registerAgent, createPolicy, updatePolicy, deletePolicy, getPolicyViolations, createIssuer, testIssuerConnection, deleteIssuer, createTarget, deleteTarget, markNotificationRead Frontend tests (53 tests, 2 files): - client.test.ts: 35 tests covering all API endpoints, auth headers, 401 handling, error parsing, HTTP methods, request bodies - utils.test.ts: 18 tests covering formatDate, formatDateTime, timeAgo, daysUntil, expiryColor CI: Added "Run Frontend Tests" step to frontend-build job Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-16 00:05:21 -04:00
shankar0123	9e6756d02f	Implement M5: hardening, input validation, and Vite+React+TS dashboard ... Backend hardening: - Fix 6 nginx.go non-constant format string build errors - Add validation.go with hostname, PEM, and enum validators - Apply input validation to all POST/PUT handlers (certificates, agents, CSR, policies, teams, owners, targets, issuers) - Fix unchecked JSON decode in TriggerDeployment handler Frontend (Vite + React + TypeScript): - Migrate from single-file SPA to proper build pipeline - 7 pages: Dashboard, Certificates (list+detail), Agents, Jobs, Notifications, Policies, Audit Trail - TanStack Query for server state with auto-refetch intervals - Certificate detail with version history and renewal trigger - Job cancellation, status/type filtering, expiry countdowns - Reusable components: DataTable, StatusBadge, ErrorState, PageHeader - Dark theme with Tailwind CSS, sidebar nav via React Router Server integration: - Go server serves web/dist/ (Vite output) with SPA fallback - Falls back to web/index.html for legacy mode - .gitignore updated for web/node_modules/ and web/dist/ Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-15 01:19:19 -04:00