mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-07 15:01:32 +00:00
shankar0123
c461ef3339
Continuing Phase 9 ARCH-M2 closure. Sprints 1+2 extracted pure-data
structs (NotifierConfig, then the ACME family). Sprint 3 is the
first split that ALSO moves helper functions — the SCEP family has
three structs AND three unexported package-internal helpers that
move together.
What moved
==========
internal/config/scep.go (new, 402 lines including BSL header +
Phase 9 doc-comment + the 3 imports +
3 structs + 3 helpers verbatim)
Three structs:
- SCEPConfig (top-level: Enabled + Profiles slice
+ legacy single-profile flat fields
kept for backward compat)
- SCEPProfileConfig (one endpoint binding: PathID,
IssuerID, ProfileID, ChallengePassword,
RA cert/key, MTLSEnabled + bundle path,
per-profile Intune block)
- SCEPIntuneProfileConfig (Enabled, ConnectorCertPath, Audience,
ChallengeValidity, PerDeviceRateLimit24h,
ClockSkewTolerance)
Three unexported helpers:
- loadSCEPProfilesFromEnv() — reads CERTCTL_SCEP_PROFILES +
expands each name into a
SCEPProfileConfig via the
CERTCTL_SCEP_PROFILE_<NAME>_*
indexed env-var family.
- mergeSCEPLegacyIntoProfiles() — backward-compat shim: synthesize
Profiles[0] from the legacy flat
fields when Profiles is empty.
- validSCEPPathID() — path-segment validator (ASCII
[a-z0-9-], no leading/trailing
hyphen, empty allowed).
Why move the helpers along
==========================
Each helper is exclusively SCEP-specific: live grep across the repo
shows ZERO callers outside internal/config/config.go's Load() and
Validate(). Both still live in config.go and continue to resolve
the moved helpers via same-package lookup. Specifically:
- Load() (still in config.go) calls loadSCEPProfilesFromEnv() during
initial cfg.SCEP construction (call site at the original line ~1840,
now closer to line ~1840 after Sprints 1+2 + 3 deletions).
- Load() calls mergeSCEPLegacyIntoProfiles(&cfg.SCEP) after the
initial profile-load.
- Validate() calls validSCEPPathID(p.PathID) per-profile in the
Profiles-iteration loop.
The unexported helpers getEnv / getEnvBool / getEnvInt / getEnvDuration
used by loadSCEPProfilesFromEnv stay in config.go (shared across every
config family); same-package resolution makes the calls work.
What stayed in config.go
========================
- All Load() + Validate() bodies — the SCEP-specific call sites stay
where they are (cross-cutting validation logic, not split-target).
- Every getEnv* helper.
- The Config{}.SCEP master-struct field declaration.
Edit shape
==========
The edit was performed in two sed passes:
1. sed -i '775,1004d' — deleted the SCEP struct block (the three
types + their doc-comments).
2. sed -i '1813,1916d' — deleted the SCEP helper-function block
(the three helpers + their doc-comments).
Then gofmt -w to collapse a residual double-blank-line at the first
join point. The two-pass approach was necessary because the structs
and helpers live in different regions of config.go (struct
definitions in the top half, function bodies near the bottom).
Public-surface invariant
========================
Every type, field, exported method, and doc-comment is byte-identical
to pre-split. Package stays `config`. Every caller's
`config.SCEPConfig` / `config.SCEPProfileConfig` /
`config.SCEPIntuneProfileConfig` import path is preserved without
modification. The three helpers are unexported so their move is
invisible to package consumers; same-package callers in config.go
continue to resolve them via the package symbol table.
Verification (all clean):
gofmt -l internal/config/ → clean (after -w)
go build ./internal/config/... → clean
go test ./internal/config/... -count=1 → ok (0.68s)
staticcheck ./internal/config/... → clean
go build ./internal/api/router/...
./internal/scheduler/...
./cmd/server/... → clean (broader importers
still resolve every type)
grep -nE '^type SCEP|^func .*SCEP' internal/config/config.go
→ empty (none remain in config.go)
grep -nE '^type SCEP|^func .*SCEP' internal/config/scep.go
→ 3 types + 3 funcs (correct: SCEPConfig, SCEPProfileConfig,
SCEPIntuneProfileConfig,
loadSCEPProfilesFromEnv,
mergeSCEPLegacyIntoProfiles,
validSCEPPathID)
LOC delta:
config.go: 3108 → 2774 (-334 lines: -230 from struct block,
-103 from helper block,
-1 from double-blank collapse)
scep.go: new, 402 lines (incl. 72-line Phase 9 doc-comment + BSL
header + package decl + 3 imports)
Cumulative Phase 9 progress (Sprints 1+2+3 from config.go):
Pre-Phase-9: 3403 LOC
After Sprint 1 (Notifier): 3335 LOC (-68)
After Sprint 2 (ACME): 3108 LOC (-227)
After Sprint 3 (SCEP): 2774 LOC (-334)
Total Sprint 1+2+3: -629 LOC (-18.5%)
Pattern lesson logged
=====================
The "Do not assume line numbers" rule continues to pay off: every
sprint of Phase 9 has touched line numbers from prior sprints
(Sprint 1's 65-line removal shifted SCEPConfig from line 1083 to
1015 to its Sprint 3 starting position of 786). The Phase 9 prompt
told us to re-derive every fact; the live-grep audit at the start
of each sprint catches the drift.
Next queued (Sprint 4): EST family from config.go →
internal/config/est.go (~250-300 LOC including ESTConfig +
ESTProfileConfig + loadESTProfilesFromEnv +
mergeESTLegacyIntoProfiles + parseAuthModes + validESTPathID +
validESTAuthMode). Same complexity shape as SCEP — three structs
+ multiple helpers + same Load()/Validate() callers that stay
in config.go.
Closes: cowork/certctl-architecture-diligence-audit.html#fix-ARCH-M2
(partial — 3 of 12 — full ARCH-M2 closure is the aggregate)