mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 16:11:29 +00:00
shankar0123
62a412c488
Closes M-006 + M-007 + M-008 + M-015 + M-016 + M-019 + M-020 from
comprehensive-audit-2026-04-25. M-028 was already closed by the
Bundle B CI follow-up.
M-006 (CWE-913) — Idempotent migration 000014
migrations/000014_policy_violation_severity_check.up.sql:
Prepended ALTER TABLE ... DROP CONSTRAINT IF EXISTS before the
ADD. Mirrors the down migration's existing IF EXISTS shape and
the M-7 idempotent-index idiom. Re-runs against partially-applied
DBs now succeed.
M-007 — Bulk-op partial-failure tests (3 new)
internal/api/handler/bulk_partial_failure_test.go:
TestBulkRevoke_PartialFailure_ReportsBoth
TestBulkRenew_PartialFailure_ReportsBoth
TestBulkReassign_PartialFailure_ReportsBoth
Each asserts HTTP 200 + both success/failure counters round-trip
+ per-cert errors[] preserved with non-empty messages so operators
can correlate each failure to its certificate ID.
M-008 — Admin-gated handler enumeration pin (verified-already-clean)
Recon: only one admin-gated handler — bulk_revocation.go — with
full 3-branch test triplet already in place. health.go calls
IsAdmin informationally to surface the flag to the GUI without
gating.
internal/api/handler/m008_admin_gate_test.go:
Walks every handler .go file, asserts every middleware.IsAdmin
call site is in AdminGatedHandlers (with required test triplet)
or InformationalIsAdminCallers (justified). Adding a new admin
gate without updating both the constant AND adding the test
triplet fails CI.
M-015 — Single-profile cardinality pin (verified-already-clean)
Audit claim 'no cardinality validation' was wrong — enforced at
struct level. domain.ManagedCertificate.{CertificateProfileID,
RenewalPolicyID,IssuerID,OwnerID} and RenewalPolicy.
CertificateProfileID are bare strings, not slices.
internal/domain/m015_cardinality_test.go:
reflect-based pin on kind=String. Schema change to N:N would
have to update renewal.go's lookup loop in the same commit.
M-016 (CWE-754) — Reap stale-agent jobs
internal/repository/postgres/job.go::ListJobsWithOfflineAgents:
JOIN jobs to agents on agent_id, filter (status=Running AND
a.last_heartbeat_at < cutoff), exclude server-keygen jobs.
internal/service/job.go::ReapJobsWithOfflineAgents:
Flips matched jobs to Failed reason agent_offline so I-001
retry loop re-queues them on a healthy agent. Records audit
event per reap.
internal/scheduler/scheduler.go:
Scheduler.runJobTimeout cycle now calls both reaper arms.
agentOfflineJobTTL default 5min (5x agent-health-check default);
SetAgentOfflineJobTTL knob for operator override.
internal/service/job_offline_agent_reaper_test.go: 6 unit tests
cover happy path, server-keygen-skip, non-Running-skip, non-
positive-TTL fail-loud, repo-error propagation, audit-event
recording.
M-019 — Configurable ARI HTTP timeout
Audit claim 'no fallback timeout' was wrong — ari.go:52 already
had a 15s timeout. Bundle C makes it configurable.
internal/connector/issuer/acme/acme.go:
Config.ARIHTTPTimeoutSeconds field with env path
CERTCTL_ACME_ARI_HTTP_TIMEOUT_SECONDS.
internal/connector/issuer/acme/ari.go:
Both HTTP clients (GetRenewalInfo + getARIEndpoint) now use the
new ariHTTPTimeout() helper. Zero / negative / nil-config all
fall back to the historic 15s default.
ari_timeout_test.go: 4 dispatch arm tests.
M-020 (CWE-770) — OCSP DoS hardening
Pre-bundle the noAuthHandler chain had no rate limit. An attacker
could DoS the OCSP responder, which for fail-open relying parties
is a revocation bypass.
cmd/server/main.go:
noAuthHandler refactored from fixed middleware.Chain(...) to a
conditional slice that appends middleware.NewRateLimiter when
cfg.RateLimit.Enabled. Per-IP keying applies; OCSP/CRL/EST/SCEP
are unauth.
docs/security.md (NEW):
Operator runbook documenting Must-Staple TLS Feature extension
RFC 7633 as the architectural fix for fail-open relying parties.
Profile-flip guidance + nginx/Apache/HAProxy/Envoy stapling
snippets + explicit scope statement on what the rate limiter
alone does NOT solve.
Audit deliverables:
cowork/comprehensive-audit-2026-04-25/audit-report.md: score
31/55 -> 38/55 closed (Medium 13/27 -> 20/27).
cowork/comprehensive-audit-2026-04-25/findings.yaml: 7 status
flips open -> closed with closure notes citing the Bundle C
mechanism.
certctl/CHANGELOG.md: Bundle C section under [unreleased].
Verification:
go vet ./internal/service ./internal/scheduler ./internal/connector/issuer/acme
./internal/api/handler ./internal/domain ./cmd/server clean
go test -count=1 -short on the same packages all green
helm template + helm lint clean
internal/repository/postgres setup-fail sandbox disk
pressure (same on master HEAD before this branch)
38 lines
2.0 KiB
SQL
38 lines
2.0 KiB
SQL
-- Migration 000014: CHECK constraint on policy_violations.severity
|
|
--
|
|
-- Sibling to migration 000013, which added severity + CHECK to policy_rules.
|
|
-- policy_violations has carried a severity column since the initial schema
|
|
-- (000001, line 183) but without any CHECK. The engine used to hardcode
|
|
-- `Warning` on every violation regardless of the triggering rule's severity
|
|
-- (see pre-D-008 internal/service/policy.go:evaluateRule), so the column
|
|
-- value was uniform by accident of implementation, not by constraint.
|
|
--
|
|
-- D-008 rewrites evaluateRule to copy rule.Severity into the violation. The
|
|
-- engine now writes values drawn from the application-layer PolicySeverity
|
|
-- allowlist, but nothing at the DB level prevents a future caller — or a
|
|
-- bypassed write from a migration or psql session — from inserting casing
|
|
-- drift ('warning', 'ERROR', etc.) and re-opening the same class of bug
|
|
-- that D-005 and D-006 closed. This constraint is the defense-in-depth
|
|
-- complement to the handler validator.
|
|
--
|
|
-- Pre-existing seed_demo.sql rows use lowercase severity values. D-008
|
|
-- updates those in the same commit so this migration can apply cleanly
|
|
-- against both a fresh install and an upgraded install that has already
|
|
-- seeded the demo data.
|
|
--
|
|
-- Named constraint (policy_violations_severity_check) so the down migration
|
|
-- can DROP it by name without ambiguity; un-named CHECK constraints use
|
|
-- a synthesized PostgreSQL name that varies by environment.
|
|
|
|
-- Bundle C / Audit M-006 (CWE-913): idempotency guard. Drop-if-exists
|
|
-- before ADD so a re-run of this migration against a partially-applied
|
|
-- DB doesn't fail with "constraint already exists". Mirrors the down
|
|
-- migration's DROP CONSTRAINT IF EXISTS shape and the M-7 idempotent-
|
|
-- index idiom.
|
|
ALTER TABLE policy_violations
|
|
DROP CONSTRAINT IF EXISTS policy_violations_severity_check;
|
|
|
|
ALTER TABLE policy_violations
|
|
ADD CONSTRAINT policy_violations_severity_check
|
|
CHECK (severity IN ('Warning', 'Error', 'Critical'));
|