mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 18:51:32 +00:00
shankar0123
0725713e19
Operator decision answered as full soft-delete with optional forced
cascade — hard-delete is not reachable from any public surface. Prior
to this commit, DELETE /agents/{id} ran a plain `DELETE FROM agents`
whose schema-level `ON DELETE CASCADE` on deployment_targets.agent_id
silently wiped every target, orphaning certs and aborting in-flight
jobs. The finding closure reshapes the agent-removal contract around
soft retirement with explicit preflight counts, an opt-in cascade
gated by a mandatory reason, and unconditional protection for the
four reserved sentinel agents used by discovery sources.
Schema — migration 000015:
migrations/000015_agent_retire.up.sql flips
deployment_targets_agent_id_fkey from ON DELETE CASCADE to ON DELETE
RESTRICT, so a stray `DELETE FROM agents` now errors at the DB
boundary instead of quietly destroying targets. Both `agents` and
`deployment_targets` grow a retired_at TIMESTAMPTZ + retired_reason
TEXT pair (TEXT not VARCHAR so operator comments are never
truncated), indexed via partial indexes WHERE retired_at IS NOT
NULL. The migration is self-healing (ADD COLUMN IF NOT EXISTS, DROP
CONSTRAINT IF EXISTS then ADD CONSTRAINT, CREATE INDEX IF NOT
EXISTS) so repeated runs against partially-migrated databases
converge. migrations/000015_agent_retire.down.sql restores CASCADE
and drops the new columns for clean rollback. A dedicated
repository-layer testcontainers test
(internal/repository/postgres/migration_000015_test.go) asserts the
before/after FK action, column presence, index presence, and
round-trip idempotency under up→down→up.
Domain — sentinel guard + dependency counts:
internal/domain/connector.go gains IsRetired() on Agent, the
exported SentinelAgentIDs slice listing server-scanner,
cloud-aws-sm, cloud-azure-kv, cloud-gcp-sm verbatim (matching the
four reserved IDs documented in CLAUDE.md and created at startup in
cmd/server/main.go), IsSentinelAgent(id string) predicate,
AgentDependencyCounts{ActiveTargets, ActiveCertificates,
PendingJobs} with a HasDependencies() method, and ActorTypeAgent /
ActorTypeSystem enum values used by audit emission downstream.
Coverage locked down by internal/domain/connector_test.go.
Service — 8-step ordered contract:
internal/service/agent_retire.go:RetireAgent(ctx, id, actor,
opts{Force, Reason}) enforces a fixed execution order:
(1) sentinel guard — IsSentinelAgent(id) returns ErrAgentIsSentinel
unconditionally; force=true does NOT bypass it.
(2) fetch — ErrAgentNotFound on miss.
(3) idempotency — if IsRetired() already, return
AgentRetirementResult{AlreadyRetired: true} with no new audit
event and no state change (safe to replay from flaky clients).
(4) preflight counts — collectAgentDependencyCounts runs
ActiveTargets, ActiveCertificates, PendingJobs sequentially
(not in parallel; keeps the per-query timeout predictable and
matches the repo's existing call-chain shape).
(5) force-reason guard — opts.Force=true with empty Reason returns
ErrForceReasonRequired (wired into the 400 status surface).
(6) dependency guard — HasDependencies() with opts.Force=false
returns BlockedByDependenciesError{Counts} (wired into the 409
body with per-bucket counts).
(7) mutation — single pinned retiredAt := time.Now(); agent
retirement first, then cascade target retirement if opts.Force,
all under the repo's single transaction so the two retired_at
stamps match to the second.
(8) best-effort audit — agent_retired always; agent_retirement_
cascaded additionally on the force path. Actor is whatever the
handler resolves from the request; actor type is mapped by
resolveActorType (system/agent-prefix→Agent/else→User). Audit
emission failures are logged via slog.Error but do not abort
the retirement (matches the house convention used by every
other scheduler-emitted event).
BlockedByDependenciesError implements Error() as
"active_targets=%d, active_certificates=%d, pending_jobs=%d" and
Unwrap() → ErrBlockedByDependencies. The single struct satisfies
errors.Is via Unwrap (used by scheduler-level tests) and errors.As
via the concrete type (used by the handler to fish out Counts for
the 409 body). ListRetiredAgents(page, perPage) adds a separate
paginated accessor with page<1→1 and perPage<1→50 normalization so
retired rows are queryable without polluting the default agent
listing.
Sentinel guard coverage is asymmetric by design: all four reserved
IDs are protected, and force=true cannot override. Regression tests
in internal/service/agent_retire_test.go assert each of the eight
steps in order, plus sentinel bypass attempts and idempotency
replay.
Handler + router — status-code surface:
internal/api/handler/agents.go:RetireAgent exposes seven status
codes on DELETE /agents/{id}:
200 on a fresh retirement (body echoes AgentRetirementResult).
204 on idempotent replay (AlreadyRetired=true; no new audit).
400 on ErrForceReasonRequired.
403 on ErrAgentIsSentinel.
404 on ErrAgentNotFound.
409 on BlockedByDependenciesError, with a custom body shape
{error, counts{active_targets, active_certificates,
pending_jobs}} that bypasses the default ErrorWithRequestID
envelope so callers get the per-bucket numbers directly.
500 on any other error.
Heartbeat HandleHeartbeat returns 410 Gone when the agent is
retired (ErrAgentRetired), signalling the agent to shut down.
Query params `force=true` and `reason=<text>` drive the cascade
path; both are forwarded as url.Values through the new MCP
transport.
internal/api/router/router.go registers GET /api/v1/agents/retired
literal-path BEFORE /api/v1/agents/{id} — Go 1.22 ServeMux's
literal-beats-pattern-var precedence routes "retired" to the
paginated retired-agents listing instead of fetching a hypothetical
agent named "retired".
Agent binary — clean shutdown on 410:
cmd/agent/main.go gains the ErrAgentRetired sentinel, a
retiredOnce sync.Once, and a retiredSignal chan struct{}. A
markRetired(source, statusCode, body) helper closes the channel
exactly once; the Run() select loop observes the close and returns
ErrAgentRetired; main() matches via errors.Is(err, ErrAgentRetired)
and exits cleanly instead of spinning in the heartbeat retry loop.
The 410 Gone surface is therefore terminal for the agent process.
MCP transport:
internal/mcp/client.go adds Client.DeleteWithQuery(path, query),
a new additive transport method. Client.Delete is path-only; without
this method the retire tool would silently drop `force` and `reason`,
turning every cascade retire into a default soft-retire. The new
method shares do()'s 204 normalization and 4xx/5xx error
propagation so tool authors get one contract.
internal/mcp/tools.go + internal/mcp/types.go expose the
retire_agent tool with Force+Reason inputs wired through
DeleteWithQuery.
CLI:
cmd/cli/main.go + internal/cli/client.go add two CLI surfaces:
`agents list --retired` (client-side strip of --retired then
delegation to ListRetiredAgents, sharing --page/--per-page parsing
with the default listing) and `agents retire <id> [--force --reason
"…"]` (mirrors ErrForceReasonRequired — force without reason is
rejected client-side before the request is sent). JSON + table
output modes both honor the new columns.
Frontend:
web/src/pages/AgentsPage.tsx surfaces retired/retire affordances.
web/src/api/client.ts + web/src/api/types.ts expose the retire
endpoint and the retired-listing. 4 new Vitest regression cases.
OpenAPI:
api/openapi.yaml documents DELETE /agents/{id} with all seven
status codes, 410 on heartbeat, and the 409 per-bucket body shape.
Regression coverage (six new test files, all green):
internal/service/agent_retire_test.go — 8-step contract + sentinel guards
internal/api/handler/agent_retire_handler_test.go — 7-status-code surface + 410 heartbeat
internal/mcp/retire_agent_test.go — DeleteWithQuery wire-through
internal/cli/agent_retire_test.go — --retired listing + --force/--reason pairing
internal/repository/postgres/migration_000015_test.go — FK flip + columns + indexes + up↔down
internal/domain/connector_test.go — IsRetired, IsSentinelAgent, SentinelAgentIDs, HasDependencies
Files:
api/openapi.yaml — DELETE + 410 + 409 body shape
cmd/agent/main.go — ErrAgentRetired, markRetired, retiredSignal
cmd/cli/main.go — handleAgents list/get/retire dispatch
docs/architecture.md, docs/concepts.md,
docs/testing-guide.md — retirement contract narrative
internal/api/handler/agents.go — RetireAgent, status surface, 410 on heartbeat
internal/api/handler/agent_handler_test.go — extended coverage
internal/api/handler/agent_retire_handler_test.go — new
internal/api/router/router.go — /agents/retired before /agents/{id}
internal/cli/agent_retire_test.go — new
internal/cli/client.go — ListRetiredAgents + RetireAgent
internal/domain/connector.go — IsRetired, SentinelAgentIDs,
IsSentinelAgent, AgentDependencyCounts,
ActorTypeAgent/System
internal/domain/connector_test.go — new
internal/integration/lifecycle_test.go — retirement fixture
internal/mcp/client.go — DeleteWithQuery additive transport
internal/mcp/retire_agent_test.go — new
internal/mcp/tools.go, internal/mcp/types.go — retire_agent tool + Force/Reason inputs
internal/repository/interfaces.go — AgentRepository retirement methods
internal/repository/postgres/agent.go — retire + cascade target retire + counts
internal/repository/postgres/migration_000015_test.go — new
internal/service/agent.go — wire into AgentService surface
internal/service/agent_retire.go — new 8-step contract
internal/service/agent_retire_test.go — new
internal/service/deployment.go — skip retired agents
internal/service/target.go — skip retired agents
internal/service/testutil_test.go — shared mocks extended
migrations/000015_agent_retire.up.sql — new
migrations/000015_agent_retire.down.sql — new
web/src/api/client.ts, types.ts + tests — retire endpoint wiring
web/src/pages/AgentsPage.tsx — retire UI
299 lines
18 KiB
Go
299 lines
18 KiB
Go
package mcp
|
|
|
|
// Input types for MCP tool arguments.
|
|
// The jsonschema struct tags provide descriptions for LLM tool discovery.
|
|
|
|
// ── Pagination ──────────────────────────────────────────────────────
|
|
|
|
type ListParams struct {
|
|
Page int `json:"page,omitempty" jsonschema:"Page number (default 1)"`
|
|
PerPage int `json:"per_page,omitempty" jsonschema:"Results per page (default 50, max 500)"`
|
|
}
|
|
|
|
// ── Certificates ────────────────────────────────────────────────────
|
|
|
|
type ListCertificatesInput struct {
|
|
ListParams
|
|
Status string `json:"status,omitempty" jsonschema:"Filter by status: Pending, Active, Expiring, Expired, RenewalInProgress, Failed, Revoked, Archived"`
|
|
Environment string `json:"environment,omitempty" jsonschema:"Filter by environment"`
|
|
OwnerID string `json:"owner_id,omitempty" jsonschema:"Filter by owner ID"`
|
|
TeamID string `json:"team_id,omitempty" jsonschema:"Filter by team ID"`
|
|
IssuerID string `json:"issuer_id,omitempty" jsonschema:"Filter by issuer ID"`
|
|
}
|
|
|
|
type GetByIDInput struct {
|
|
ID string `json:"id" jsonschema:"Resource ID (e.g. mc-api-prod, t-platform)"`
|
|
}
|
|
|
|
type CreateCertificateInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Certificate ID (auto-generated if empty)"`
|
|
Name string `json:"name" jsonschema:"Display name"`
|
|
CommonName string `json:"common_name" jsonschema:"Certificate common name (e.g. api.example.com)"`
|
|
SANs []string `json:"sans,omitempty" jsonschema:"Subject Alternative Names"`
|
|
Environment string `json:"environment,omitempty" jsonschema:"Environment (e.g. production, staging)"`
|
|
OwnerID string `json:"owner_id" jsonschema:"Owner ID (required)"`
|
|
TeamID string `json:"team_id" jsonschema:"Team ID (required)"`
|
|
IssuerID string `json:"issuer_id" jsonschema:"Issuer connector ID"`
|
|
TargetIDs []string `json:"target_ids,omitempty" jsonschema:"Deployment target IDs"`
|
|
RenewalPolicyID string `json:"renewal_policy_id" jsonschema:"Renewal policy ID (required)"`
|
|
ProfileID string `json:"certificate_profile_id,omitempty" jsonschema:"Certificate profile ID"`
|
|
Tags map[string]string `json:"tags,omitempty" jsonschema:"Key-value tags"`
|
|
}
|
|
|
|
type UpdateCertificateInput struct {
|
|
ID string `json:"id" jsonschema:"Certificate ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Display name"`
|
|
Environment string `json:"environment,omitempty" jsonschema:"Environment"`
|
|
OwnerID string `json:"owner_id,omitempty" jsonschema:"Owner ID"`
|
|
TeamID string `json:"team_id,omitempty" jsonschema:"Team ID"`
|
|
TargetIDs []string `json:"target_ids,omitempty" jsonschema:"Deployment target IDs"`
|
|
RenewalPolicyID string `json:"renewal_policy_id,omitempty" jsonschema:"Renewal policy ID"`
|
|
ProfileID string `json:"certificate_profile_id,omitempty" jsonschema:"Certificate profile ID"`
|
|
Tags map[string]string `json:"tags,omitempty" jsonschema:"Key-value tags"`
|
|
}
|
|
|
|
type TriggerDeploymentInput struct {
|
|
ID string `json:"id" jsonschema:"Certificate ID"`
|
|
TargetID string `json:"target_id,omitempty" jsonschema:"Optional specific target ID"`
|
|
}
|
|
|
|
type RevokeCertificateInput struct {
|
|
ID string `json:"id" jsonschema:"Certificate ID to revoke"`
|
|
Reason string `json:"reason,omitempty" jsonschema:"RFC 5280 reason: unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, privilegeWithdrawn"`
|
|
}
|
|
|
|
type BulkRevokeCertificatesInput struct {
|
|
Reason string `json:"reason" jsonschema:"RFC 5280 reason: unspecified, keyCompromise, caCompromise, affiliationChanged, superseded, cessationOfOperation, certificateHold, privilegeWithdrawn"`
|
|
ProfileID string `json:"profile_id,omitempty" jsonschema:"Revoke all certs matching this profile ID"`
|
|
OwnerID string `json:"owner_id,omitempty" jsonschema:"Revoke all certs owned by this owner"`
|
|
AgentID string `json:"agent_id,omitempty" jsonschema:"Revoke all certs deployed via this agent"`
|
|
IssuerID string `json:"issuer_id,omitempty" jsonschema:"Revoke all certs issued by this issuer"`
|
|
TeamID string `json:"team_id,omitempty" jsonschema:"Revoke all certs owned by members of this team"`
|
|
CertificateIDs []string `json:"certificate_ids,omitempty" jsonschema:"Explicit list of certificate IDs to revoke"`
|
|
}
|
|
|
|
type ListVersionsInput struct {
|
|
ID string `json:"id" jsonschema:"Certificate ID"`
|
|
ListParams
|
|
}
|
|
|
|
// ── CRL & OCSP ──────────────────────────────────────────────────────
|
|
|
|
type GetDERCRLInput struct {
|
|
IssuerID string `json:"issuer_id" jsonschema:"Issuer ID for DER-encoded CRL"`
|
|
}
|
|
|
|
type OCSPInput struct {
|
|
IssuerID string `json:"issuer_id" jsonschema:"Issuer ID"`
|
|
Serial string `json:"serial" jsonschema:"Hex-encoded certificate serial number"`
|
|
}
|
|
|
|
// ── Issuers ─────────────────────────────────────────────────────────
|
|
|
|
type CreateIssuerInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Issuer ID"`
|
|
Name string `json:"name" jsonschema:"Issuer display name"`
|
|
Type string `json:"type" jsonschema:"Issuer type: ACME, GenericCA, StepCA"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Issuer-specific configuration"`
|
|
Enabled bool `json:"enabled,omitempty" jsonschema:"Whether the issuer is enabled"`
|
|
}
|
|
|
|
type UpdateIssuerInput struct {
|
|
ID string `json:"id" jsonschema:"Issuer ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Issuer display name"`
|
|
Type string `json:"type,omitempty" jsonschema:"Issuer type"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Issuer-specific configuration"`
|
|
Enabled *bool `json:"enabled,omitempty" jsonschema:"Whether the issuer is enabled"`
|
|
}
|
|
|
|
// ── Targets ─────────────────────────────────────────────────────────
|
|
|
|
type CreateTargetInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Target ID"`
|
|
Name string `json:"name" jsonschema:"Target display name"`
|
|
Type string `json:"type" jsonschema:"Target type: NGINX, Apache, HAProxy, F5, IIS"`
|
|
AgentID string `json:"agent_id" jsonschema:"Agent ID that manages this target (required)"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Target-specific configuration"`
|
|
Enabled bool `json:"enabled,omitempty" jsonschema:"Whether the target is enabled"`
|
|
}
|
|
|
|
type UpdateTargetInput struct {
|
|
ID string `json:"id" jsonschema:"Target ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Target display name"`
|
|
Type string `json:"type,omitempty" jsonschema:"Target type"`
|
|
AgentID string `json:"agent_id,omitempty" jsonschema:"Agent ID"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Target-specific configuration"`
|
|
Enabled *bool `json:"enabled,omitempty" jsonschema:"Whether the target is enabled"`
|
|
}
|
|
|
|
// ── Agents ──────────────────────────────────────────────────────────
|
|
|
|
type RegisterAgentInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Agent ID"`
|
|
Name string `json:"name" jsonschema:"Agent display name"`
|
|
Hostname string `json:"hostname" jsonschema:"Agent hostname"`
|
|
}
|
|
|
|
type AgentCSRInput struct {
|
|
AgentID string `json:"agent_id" jsonschema:"Agent ID"`
|
|
CSRPEM string `json:"csr_pem" jsonschema:"PEM-encoded certificate signing request"`
|
|
CertificateID string `json:"certificate_id,omitempty" jsonschema:"Certificate ID for the CSR"`
|
|
}
|
|
|
|
type AgentPickupInput struct {
|
|
AgentID string `json:"agent_id" jsonschema:"Agent ID"`
|
|
CertID string `json:"cert_id" jsonschema:"Certificate ID to pick up"`
|
|
}
|
|
|
|
type AgentJobStatusInput struct {
|
|
AgentID string `json:"agent_id" jsonschema:"Agent ID"`
|
|
JobID string `json:"job_id" jsonschema:"Job ID"`
|
|
Status string `json:"status" jsonschema:"Job status to report"`
|
|
Error string `json:"error,omitempty" jsonschema:"Error message if job failed"`
|
|
}
|
|
|
|
// RetireAgentInput pins the MCP tool surface for certctl_retire_agent. I-004
|
|
// introduces a soft-retirement flow that the handler exposes on DELETE
|
|
// /api/v1/agents/{id} with two optional query flags: force=true cascades
|
|
// through dependent active targets/certs/jobs, and reason is the human-readable
|
|
// string captured in the audit trail. The handler enforces
|
|
// ErrForceReasonRequired when force=true is sent without a reason; we surface
|
|
// both as separate fields so the LLM can populate them independently and so
|
|
// the retire_agent_test shape assertion stays aligned with the JSON-wire
|
|
// contract. ID is always emitted (no omitempty) because a retire call without
|
|
// a target agent is meaningless; Force and Reason are omitempty so the default
|
|
// soft-retire path sends no query suffix at all.
|
|
type RetireAgentInput struct {
|
|
ID string `json:"id" jsonschema:"Agent ID to soft-retire"`
|
|
Force bool `json:"force,omitempty" jsonschema:"Cascade-retire downstream active targets, certs, and jobs (requires reason)"`
|
|
Reason string `json:"reason,omitempty" jsonschema:"Human-readable reason (required when force=true)"`
|
|
}
|
|
|
|
// ── Jobs ────────────────────────────────────────────────────────────
|
|
|
|
type ListJobsInput struct {
|
|
ListParams
|
|
Status string `json:"status,omitempty" jsonschema:"Filter by status: Pending, AwaitingCSR, AwaitingApproval, Running, Completed, Failed, Cancelled"`
|
|
Type string `json:"type,omitempty" jsonschema:"Filter by type: Issuance, Renewal, Deployment, Validation"`
|
|
}
|
|
|
|
type RejectJobInput struct {
|
|
ID string `json:"id" jsonschema:"Job ID to reject"`
|
|
Reason string `json:"reason,omitempty" jsonschema:"Reason for rejection"`
|
|
}
|
|
|
|
// ── Policies ────────────────────────────────────────────────────────
|
|
|
|
type CreatePolicyInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Policy ID"`
|
|
Name string `json:"name" jsonschema:"Policy display name"`
|
|
Type string `json:"type" jsonschema:"Policy type: AllowedIssuers, AllowedDomains, RequiredMetadata, AllowedEnvironments, RenewalLeadTime"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Policy-specific configuration"`
|
|
Enabled bool `json:"enabled,omitempty" jsonschema:"Whether the policy is enabled"`
|
|
Severity string `json:"severity,omitempty" jsonschema:"Violation severity: Warning, Error, or Critical (default: Warning)"`
|
|
}
|
|
|
|
type UpdatePolicyInput struct {
|
|
ID string `json:"id" jsonschema:"Policy ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Policy display name"`
|
|
Type string `json:"type,omitempty" jsonschema:"Policy type"`
|
|
Config interface{} `json:"config,omitempty" jsonschema:"Policy-specific configuration"`
|
|
Enabled *bool `json:"enabled,omitempty" jsonschema:"Whether the policy is enabled"`
|
|
Severity string `json:"severity,omitempty" jsonschema:"Violation severity: Warning, Error, or Critical"`
|
|
}
|
|
|
|
type ListViolationsInput struct {
|
|
ID string `json:"id" jsonschema:"Policy ID"`
|
|
ListParams
|
|
}
|
|
|
|
// ── Profiles ────────────────────────────────────────────────────────
|
|
|
|
type CreateProfileInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Profile ID"`
|
|
Name string `json:"name" jsonschema:"Profile display name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Profile description"`
|
|
AllowedKeyAlgorithms interface{} `json:"allowed_key_algorithms,omitempty" jsonschema:"Allowed key algorithms and minimum sizes"`
|
|
MaxTTLSeconds int `json:"max_ttl_seconds,omitempty" jsonschema:"Maximum certificate TTL in seconds"`
|
|
AllowedEKUs []string `json:"allowed_ekus,omitempty" jsonschema:"Allowed Extended Key Usages"`
|
|
RequiredSANPatterns []string `json:"required_san_patterns,omitempty" jsonschema:"Required SAN patterns"`
|
|
AllowShortLived bool `json:"allow_short_lived,omitempty" jsonschema:"Allow short-lived certificates (TTL < 1 hour)"`
|
|
Enabled bool `json:"enabled,omitempty" jsonschema:"Whether the profile is enabled"`
|
|
}
|
|
|
|
type UpdateProfileInput struct {
|
|
ID string `json:"id" jsonschema:"Profile ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Profile display name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Profile description"`
|
|
AllowedKeyAlgorithms interface{} `json:"allowed_key_algorithms,omitempty" jsonschema:"Allowed key algorithms and minimum sizes"`
|
|
MaxTTLSeconds *int `json:"max_ttl_seconds,omitempty" jsonschema:"Maximum certificate TTL in seconds"`
|
|
AllowedEKUs []string `json:"allowed_ekus,omitempty" jsonschema:"Allowed Extended Key Usages"`
|
|
RequiredSANPatterns []string `json:"required_san_patterns,omitempty" jsonschema:"Required SAN patterns"`
|
|
AllowShortLived *bool `json:"allow_short_lived,omitempty" jsonschema:"Allow short-lived certificates"`
|
|
Enabled *bool `json:"enabled,omitempty" jsonschema:"Whether the profile is enabled"`
|
|
}
|
|
|
|
// ── Teams ───────────────────────────────────────────────────────────
|
|
|
|
type CreateTeamInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Team ID"`
|
|
Name string `json:"name" jsonschema:"Team name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Team description"`
|
|
}
|
|
|
|
type UpdateTeamInput struct {
|
|
ID string `json:"id" jsonschema:"Team ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Team name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Team description"`
|
|
}
|
|
|
|
// ── Owners ──────────────────────────────────────────────────────────
|
|
|
|
type CreateOwnerInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Owner ID"`
|
|
Name string `json:"name" jsonschema:"Owner display name"`
|
|
Email string `json:"email,omitempty" jsonschema:"Owner email for notifications"`
|
|
TeamID string `json:"team_id,omitempty" jsonschema:"Team ID the owner belongs to"`
|
|
}
|
|
|
|
type UpdateOwnerInput struct {
|
|
ID string `json:"id" jsonschema:"Owner ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Owner display name"`
|
|
Email string `json:"email,omitempty" jsonschema:"Owner email"`
|
|
TeamID string `json:"team_id,omitempty" jsonschema:"Team ID"`
|
|
}
|
|
|
|
// ── Agent Groups ────────────────────────────────────────────────────
|
|
|
|
type CreateAgentGroupInput struct {
|
|
ID string `json:"id,omitempty" jsonschema:"Agent group ID"`
|
|
Name string `json:"name" jsonschema:"Group display name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Group description"`
|
|
MatchOS string `json:"match_os,omitempty" jsonschema:"Match agents by OS (e.g. linux, darwin, windows)"`
|
|
MatchArchitecture string `json:"match_architecture,omitempty" jsonschema:"Match agents by architecture (e.g. amd64, arm64)"`
|
|
MatchIPCIDR string `json:"match_ip_cidr,omitempty" jsonschema:"Match agents by IP CIDR range"`
|
|
MatchVersion string `json:"match_version,omitempty" jsonschema:"Match agents by version"`
|
|
Enabled bool `json:"enabled,omitempty" jsonschema:"Whether the group is enabled"`
|
|
}
|
|
|
|
type UpdateAgentGroupInput struct {
|
|
ID string `json:"id" jsonschema:"Agent group ID to update"`
|
|
Name string `json:"name,omitempty" jsonschema:"Group display name"`
|
|
Description string `json:"description,omitempty" jsonschema:"Group description"`
|
|
MatchOS string `json:"match_os,omitempty" jsonschema:"Match agents by OS"`
|
|
MatchArchitecture string `json:"match_architecture,omitempty" jsonschema:"Match agents by architecture"`
|
|
MatchIPCIDR string `json:"match_ip_cidr,omitempty" jsonschema:"Match agents by IP CIDR range"`
|
|
MatchVersion string `json:"match_version,omitempty" jsonschema:"Match agents by version"`
|
|
Enabled *bool `json:"enabled,omitempty" jsonschema:"Whether the group is enabled"`
|
|
}
|
|
|
|
// ── Stats ───────────────────────────────────────────────────────────
|
|
|
|
type TimelineInput struct {
|
|
Days int `json:"days,omitempty" jsonschema:"Number of days to look back (default 30, max 365)"`
|
|
}
|
|
|
|
// ── Empty ───────────────────────────────────────────────────────────
|
|
|
|
type EmptyInput struct{}
|