shankar0123 a4b2919f59 Merge Fix 13 (HIGH-2 fourth call site): CSRF rotation on Logout ...

# Conflicts:
#	CHANGELOG.md

2026-05-11 13:01:56 +00:00

..

testdata

EST RFC 7030 hardening master bundle Phases 10-11: libest sidecar e2e

2026-04-30 00:52:43 +00:00

acme_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

acme.go

2026-05-05 18:18:29 +00:00

admin_crl_cache_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

admin_crl_cache.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

admin_est_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

admin_est.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

admin_scep_intune_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

admin_scep_intune.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

adversarial_est_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

adversarial_path_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

adversarial_query_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

agent_bootstrap_test.go

fix(bundle-5): Operational Liveness + Bootstrap — 4 audit findings closed

2026-04-25 23:54:18 +00:00

agent_bootstrap.go

fix(bundle-5): CI green-up — drop unused sync.Once + document new env vars

2026-04-26 00:03:03 +00:00

agent_group_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

agent_groups.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

agent_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

agent_retire_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

agents.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

approval_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

approval.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

audit_category_test.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

audit_export_test.go

fix(audit): ship streaming NDJSON audit export endpoint (HIGH-9 / HIGH-11)

2026-05-10 21:36:01 +00:00

audit_handler_test.go

fix(audit): ship streaming NDJSON audit export endpoint (HIGH-9 / HIGH-11)

2026-05-10 21:36:01 +00:00

audit.go

chore(fmt): gofmt cleanup on files touched by audit-2026-05-11 fix bundle

2026-05-11 11:29:48 +00:00

auth_bootstrap_test.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

auth_bootstrap.go

auth-bundle-1 Phase 6-7-8: bootstrap path + scope-down CLI + auditor-role split

2026-05-09 20:15:43 +00:00

auth_breakglass.go

feat(gui+auth): break-glass admin GUI surface (CRIT-4 closure)

2026-05-10 20:24:52 +00:00

auth_session_oidc_test.go

harden(auth/sessions): CSRF rotation on logout closes HIGH-2 fourth call site

2026-05-11 12:24:41 +00:00

auth_session_oidc.go

harden(auth/sessions): CSRF rotation on logout closes HIGH-2 fourth call site

2026-05-11 12:24:41 +00:00

auth_test.go

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

auth_users_test.go

fix(auth/users): close MED-11 lying field — DeactivatedAt loaded + enforced on login (A-2)

2026-05-11 02:21:05 +00:00

auth_users.go

fix(auth/users): close MED-11 lying field — DeactivatedAt loaded + enforced on login (A-2)

2026-05-11 02:21:05 +00:00

auth.go

fix(auth/rbac): scope-aware ActorRole revoke (A-4)

2026-05-11 10:50:34 +00:00

bcl_replay_test.go

fix(oidc/bcl): jti replay-cache + iat freshness check (HIGH-3 closure)

2026-05-10 20:53:29 +00:00

bulk_partial_failure_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

bulk_reassignment_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

bulk_reassignment.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

bulk_renewal_handler_test.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

bulk_renewal.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

bulk_revocation_est_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

bulk_revocation_handler_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

bulk_revocation.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

certificate_handler_test.go

cli: promote --force on renew + require --reason on revoke (closes P3-1, P3-2)

2026-05-05 19:49:34 +00:00

certificates.go

cli: promote --force on renew + require --reason on revoke (closes P3-1, P3-2)

2026-05-05 19:49:34 +00:00

cisco_ios_quirks_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

demo_residual_test.go

harden(auth): demo-mode residual-grants detector + cleanup endpoint + CI guard (A-8)

2026-05-11 11:45:54 +00:00

demo_residual.go

harden(auth): demo-mode residual-grants detector + cleanup endpoint + CI guard (A-8)

2026-05-11 11:45:54 +00:00

digest_handler_test.go

feat(m28+m29+m30): ACME ARI, email digest, and Helm chart

2026-03-28 21:18:35 -04:00

digest.go

F-001/F-002/F-003: CRL prefix-scan, digest error sanitization, ctx-aware sleeps

2026-04-20 16:51:52 +00:00

discovery_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

discovery.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

est_clock.go

EST RFC 7030 hardening master bundle Phases 2-4: end-to-end mTLS sibling

2026-04-29 23:15:35 +00:00

est_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

est_hardening_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

est_serverkeygen_helpers_test.go

EST RFC 7030 hardening master bundle Phases 5-7: end-to-end serverkeygen

2026-04-29 23:57:45 +00:00

est_serverkeygen_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

est_transport_test.go

fix(bundle-4): EST/SCEP Attack Surface Hardening — 3 audit findings closed

2026-04-25 21:14:41 +00:00

est.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

export_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

export.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

health_check_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

health_check.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

health_test.go

auth-bundle-1 Phase 0-5 closure: demo-mode wire, named-key backfill, AuthCheck enrichment, OpenAPI schema, intermediate-ca comment refresh

2026-05-09 19:33:07 +00:00

health.go

feat(oidc): Enabled toggle on OIDCProvider (MED-9)

2026-05-10 21:59:17 +00:00

intermediate_ca_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

intermediate_ca.go

auth-bundle-1 Phase 0-5 closure: demo-mode wire, named-key backfill, AuthCheck enrichment, OpenAPI schema, intermediate-ca comment refresh

2026-05-09 19:33:07 +00:00

issuer_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

issuers.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

job_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

jobs.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

m008_admin_gate_test.go

auth-bundle-1 Phase 3.5: handler IsAdmin -> router-wrapped RequirePermission

2026-05-09 17:00:30 +00:00

metrics.go

2026-05-05 18:18:29 +00:00

network_scan_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

network_scan.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

notification_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

notifications.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

oidc_redirect_categories_test.go

fix(auth/ux): cause-aware OIDC + session error surfacing (HIGH-7 + HIGH-8 closure)

2026-05-10 21:12:11 +00:00

owner_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

owners.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

policies.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

policy_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

profile_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

profiles.go

auth-bundle-1 Phase 9 + 10: approval-bypass closure + RBAC GUI

2026-05-09 21:03:59 +00:00

renewal_policy_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

renewal_policy.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

response_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

response.go

auth-bundle-1 Phase 0: extract internal/auth/ from middleware package

2026-05-09 15:51:31 +00:00

round_out_test.go

Bundle N.C-extended (Coverage Audit Extension): service + handler round-out — M-002 + M-003 partial-closed

2026-04-27 21:40:09 +00:00

scep_chromeos_test.go

2026-05-05 18:18:29 +00:00

scep_fuzz_test.go

fix(bundle-4): EST/SCEP Attack Surface Hardening — 3 audit findings closed

2026-04-25 21:14:41 +00:00

scep_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

scep_intune_e2e_test.go

2026-05-05 18:18:29 +00:00

scep_mtls_test.go

feat(scep): mTLS sibling route /scep-mtls/<pathID> (opt-in)

2026-04-29 13:58:18 +00:00

scep_profile_counter_isolation_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

scep.go

refactor(scep+ejbca): drop dead conditionals on always-empty vars (CodeQL #18, #19)

2026-05-04 05:17:16 +00:00

stats_handler_test.go

test + docs: close 12 test gaps (~250 new tests) and expand testing guide to 34 parts

2026-03-28 17:57:25 -04:00

stats.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

target_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

targets.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

team_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

teams.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

test_utils.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

validation_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

validation.go

fix(policies): close the D-006 loop — TitleCase seed canonicals + severity-aware, config-consuming rule engine (D-008)

2026-04-18 14:55:56 +00:00

verification_handler_test.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

verification.go

chore: rename Go module path to github.com/certctl-io/certctl

2026-05-04 00:30:29 +00:00

version_handler_test.go

fix(deploy,db,handler): close fresh-clone postgres init failure + 4 ride-along audit findings (U-3 master)

2026-04-25 13:29:23 +00:00

version.go

chore(security): bump Go toolchain 1.25.9 -> 1.25.10 + golang.org/x/net 0.49 -> 0.53

2026-05-09 21:35:46 -04:00