gsadmin/certctl
1
0
Fork 0
mirror of https://github.com/shankar0123/certctl.git synced 2026-06-11 20:38:51 +00:00
Code Issues Packages Projects Releases Wiki Activity
149 Commits 1 Branch 82 Tags
fd18ff20a93e2ff2c75bc7bf0032c7d117bcb9f5
Commit Graph

6 Commits

Author SHA1 Message Date
Shankar 304b2d3d02 fix: add GetCACertPEM to connector-layer mock for go vet 
The EST milestone (M23) added GetCACertPEM to the issuer.Connector
interface but missed updating mockConnectorLayerIssuer in the adapter
test file. This caused go vet to fail in CI.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-25 15:48:49 -04:00
Shankar 522b13e296 fix: use service-layer types in adapter tests 
GenerateCRL test was passing []issuer.RevokedCertEntry instead of
[]CRLEntry, causing go vet failure. Also fixed OCSPSignRequest
references to use service-layer type for consistency.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-22 15:21:03 -04:00
Shankar 489ec92aca fix: remove unused variable failing go vet in CI 
expectedCRL was declared but never used in TestIssuerConnectorAdapter_GenerateCRL_Success.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-22 15:18:30 -04:00
Shankar 458a8c2740 feat: M15b — OCSP responder, DER CRL, short-lived exemption, revocation GUI 
Backend:
- Embedded OCSP responder: GET /api/v1/ocsp/{issuer_id}/{serial} returns
  signed OCSP responses (good/revoked/unknown) using CA key
- DER-encoded X.509 CRL: GET /api/v1/crl/{issuer_id} returns proper DER CRL
  signed by issuing CA with 24h validity window
- Short-lived cert exemption: certs with profile TTL < 1 hour skip CRL/OCSP
  (expiry is sufficient revocation for ephemeral workloads)
- Extended issuer connector interface with GenerateCRL and SignOCSPResponse
- Local CA implements full CRL/OCSP signing; ACME and step-ca return
  appropriate "use native endpoint" errors
- IssuerConnectorAdapter bridges new methods between layers

Frontend:
- Revoke button on certificate detail page with RFC 5280 reason modal
- Revocation banner with reason display and timestamp
- Revocation status indicators in lifecycle section
- "Revoked" filter option in certificates list
- API client: revokeCertificate() function and Certificate type extensions

Tests: ~31 new tests across connector, service, handler, and adapter layers
Docs: milestones renumbered (M13-M14, M16-M18), M15b marked complete

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-22 14:39:10 -04:00
Shankar 5cd9e890f4 feat: M15a — certificate revocation API, CRL endpoint, and revocation notifications 
Implements core revocation infrastructure: POST /api/v1/certificates/{id}/revoke
with all 8 RFC 5280 reason codes, JSON-formatted CRL at GET /api/v1/crl, webhook
and email revocation notifications, best-effort issuer notification, and immutable
revocation audit trail. Includes 48 new tests across service, handler, integration,
and domain layers (600+ total). Fixes 3 pre-existing test bugs (team_test error
matching, agent_group delete status code, team handler per_page validation).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-22 10:59:18 -04:00
Shankar b9accf010c test: comprehensive test expansion — 330+ to 525+ tests, close M11b coverage gaps 
Add 195+ new tests across service, handler, connector, and integration layers:
- Service tests: team (23), owner (21), agent_group (25), issuer (18), issuer_adapter (6)
- Handler tests: teams (26), owners (21)
- NGINX target connector tests (13): config validation, deployment, reload
- Integration tests: 19 M11b endpoint subtests (teams, owners, agent groups CRUD)
- CI pipeline: add ./internal/connector/target/... to test coverage path
- Docs: update test counts to 525+ across README, architecture, CLAUDE.md

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
 2026-03-21 23:43:32 -04:00