e445cbef22
feat: M11b — ownership tracking, agent groups, interactive renewal approval
...
Ownership: owners/teams GUI pages, notification email resolution via
resolveRecipient (owner_id → owner.email lookup). Agent groups: dynamic
device grouping by OS/arch/IP CIDR/version with manual include/exclude
membership, migration 000004, full CRUD stack (domain → repo → service →
handler → frontend). Interactive approval: AwaitingApproval job state,
approve/reject API endpoints with reason tracking. Tests: 12 agent group
handler tests, 8 approve/reject job handler tests, integration tests
updated for 13-param RegisterHandlers. Docs updated across architecture,
concepts, and seed data.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-20 21:02:35 -04:00
1ef16984eb
feat: M11a — certificate profiles, crypto policy enforcement, short-lived cert expiry
...
Add certificate profiles as named enrollment templates that control allowed
key algorithms, max TTL, permitted EKUs, required SAN patterns, and optional
SPIFFE URI SANs. CSR submissions are validated against profile rules at
signing time (key type + minimum size). Short-lived certs (TTL < 1 hour)
auto-expire via a new scheduler loop — expiry acts as revocation, no
CRL/OCSP needed.
New files:
- Migration 000003: certificate_profiles table, FK columns on
managed_certificates/renewal_policies, key metadata on certificate_versions
- domain/profile.go: CertificateProfile + KeyAlgorithmRule structs
- repository/postgres/profile.go: full CRUD with JSONB marshaling
- service/profile.go: ProfileService with validation + audit logging
- service/crypto_validation.go: CSR-against-profile validation (RSA/ECDSA/Ed25519)
- handler/profiles.go: 5 HTTP endpoints under /api/v1/profiles
- web/src/pages/ProfilesPage.tsx: profiles management page
Modified:
- renewal.go: CSR validation in CompleteAgentCSRRenewal, ExpireShortLivedCertificates
- scheduler.go: 30s short-lived expiry check loop
- certificate.go (repo): nullable profile FK, key metadata on versions
- main.go: profile repo/service/handler wiring, 8-param NewRenewalService
- router.go: 12-param RegisterHandlers with profile routes
- seed_demo.sql: 4 demo profiles (standard, mtls, short-lived, high-security)
- Frontend: types, API client, routing, sidebar nav
Tests: 40 new tests across handler (15), service (13), crypto validation (12)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-20 20:39:49 -04:00
b9bc2ace8e
Implement M9: test hardening with handler tests, negative paths, CI coverage gates
...
All 7 handler files now have test coverage: jobs (14 tests), notifications
(11), policies (15), issuers (15), targets (14). Negative-path integration
tests cover nonexistent resources, invalid payloads, malformed CSR, expired
cert lifecycle, and method-not-allowed errors. CI now enforces coverage
thresholds (service 60%+, handler 50%+) and includes connector tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-15 14:06:48 -04:00
Shankar