mirror of
https://github.com/certctl-io/certctl.git
synced 2026-08-27 02:51:24 +02:00
Closes four 2026-04-24 audit findings via per-page Edit modals on five
existing pages, a brand-new RenewalPoliciesPage for the rp-* CRUD surface,
and removal of one dead duplicate so the public client surface stops
growing without consumers. Anchored by a CI grep guardrail that fails
the build if any of the eight previously-orphan client functions loses
its non-test page consumer or if exportCertificatePEM is resurrected.
Per-page Edit modals (mirroring existing CreateXModal scaffolding):
- web/src/pages/OwnersPage.tsx — EditOwnerModal (name/email/team_id)
- web/src/pages/TeamsPage.tsx — EditTeamModal (name/description)
- web/src/pages/AgentGroupsPage.tsx — EditAgentGroupModal (full match-rule
set: name/description/match_os/match_architecture/match_ip_cidr/
match_version/enabled)
- web/src/pages/IssuersPage.tsx — EditIssuerModal (rename-only; type
locked, config blob preserved untouched, footer note about delete+
recreate for credential rotation)
- web/src/pages/ProfilesPage.tsx — EditProfileModal (rename + description
only; policy fields preserved untouched, footer note about deferred
policy editing)
New page (closes cat-b-4631ca092bee — RenewalPolicy CRUD orphan):
- web/src/pages/RenewalPoliciesPage.tsx — full CRUD page with shared
PolicyFormModal for Create + Edit (form shape identical), 7-column
DataTable (Policy/RenewalWindow/Auto/Retries/AlertThresholds/Created/
Actions), comma-separated alert_thresholds_days input parser, and
alert() surfacing of repository.ErrRenewalPolicyInUse (409) on Delete
so operators can re-target dependent certs before deletion.
- web/src/main.tsx — adds /renewal-policies route.
- web/src/components/Layout.tsx — adds sidebar nav item slotted between
Policies and Profiles.
Removed (closes cat-b-9b97ffb35ef7 — dead duplicate):
- web/src/api/client.ts::exportCertificatePEM — zero consumers across
web/, MCP, CLI, tests; downloadCertificatePEM is the actual call site
in CertificateDetailPage. Test references in client.test.ts and
client.error.test.ts also removed.
CI regression guardrail:
- .github/workflows/ci.yml — adds 'Forbidden orphan-CRUD client function
regression guard (B-1)' step. Greps for all eight previously-orphan
fns (updateOwner/updateTeam/updateAgentGroup/updateIssuer/updateProfile
+ createRenewalPolicy/updateRenewalPolicy/deleteRenewalPolicy) under
web/src/pages/ and fails the build if any has zero non-test consumers.
Also blocks resurrection of exportCertificatePEM. Verified locally
(all 8 fns have ≥2 consumers; exportCertificatePEM is gone) and
against synthetic regressions.
Documentation:
- CHANGELOG.md — new B-1 section above L-1 under [unreleased].
- docs/architecture.md — Web Dashboard section gains a new paragraph
capturing the 'every backend CRUD must have a GUI consumer' rule
with reference to the CI guardrail.
- coverage-gap-audit-2026-04-24-v5/unified-audit.md — flips four
findings to ✅ RESOLVED with detailed Status blocks; bumps Live
Tracker score 16/47 → 20/47 (P1: 9→12, P3: 1→2); adds B-1 row to
closed-bundle index.
Verification:
- cd web && tsc --noEmit — clean
- cd web && vitest run — 9 test files, 294 tests, all passing
- cd web && vite build — clean (no new warnings)
- B-1 guardrail dry-run — all 8 client fns have ≥2 page consumers,
exportCertificatePEM removed (good), FAIL=0
Audit findings closed:
- cat-b-31ceb6aaa9f1 (P1, updateOwner/updateTeam/updateAgentGroup orphan)
- cat-b-7a34f893a8f9 (P1, updateIssuer/updateProfile orphan, rename-only)
- cat-b-4631ca092bee (P1, RenewalPolicy CRUD orphan)
- cat-b-9b97ffb35ef7 (P3, exportCertificatePEM dead duplicate)
Deferred follow-ups:
- Fuller EditIssuerModal with credential-rotation flow (needs threat
model: rotation reuse window, in-flight CSR cancellation, audit-trail
granularity).
- Fuller EditProfileModal with policy-field editing (max-TTL, allowed
EKUs, allowed key algorithms — affect already-issued cert evaluation).
- Per-page Vitest coverage for the new Edit modals (CI grep guardrail
catches the same regression vector at lower cost).
334 lines
12 KiB
TypeScript
334 lines
12 KiB
TypeScript
import { useEffect, useState } from 'react';
|
|
import { useQuery, useMutation, useQueryClient } from '@tanstack/react-query';
|
|
import { getOwners, getTeams, deleteOwner, createOwner, updateOwner } from '../api/client';
|
|
import PageHeader from '../components/PageHeader';
|
|
import DataTable from '../components/DataTable';
|
|
import type { Column } from '../components/DataTable';
|
|
import ErrorState from '../components/ErrorState';
|
|
import { formatDateTime } from '../api/utils';
|
|
import type { Owner, Team } from '../api/types';
|
|
|
|
interface CreateOwnerModalProps {
|
|
isOpen: boolean;
|
|
onClose: () => void;
|
|
onSuccess: () => void;
|
|
isLoading: boolean;
|
|
error: string | null;
|
|
teamsData?: { data: Team[] };
|
|
}
|
|
|
|
function CreateOwnerModal({ isOpen, onClose, onSuccess, isLoading, error, teamsData }: CreateOwnerModalProps) {
|
|
const [name, setName] = useState('');
|
|
const [email, setEmail] = useState('');
|
|
const [teamId, setTeamId] = useState('');
|
|
|
|
const handleSubmit = async (e: React.FormEvent) => {
|
|
e.preventDefault();
|
|
if (!name.trim() || !email.trim()) return;
|
|
await createOwner({
|
|
name: name.trim(),
|
|
email: email.trim(),
|
|
team_id: teamId || undefined,
|
|
});
|
|
setName('');
|
|
setEmail('');
|
|
setTeamId('');
|
|
onSuccess();
|
|
};
|
|
|
|
if (!isOpen) return null;
|
|
|
|
const teams = teamsData?.data || [];
|
|
|
|
return (
|
|
<div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
|
|
<div className="bg-surface border border-surface-border rounded p-5 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
|
|
<h2 className="text-lg font-semibold text-ink mb-4">Create Owner</h2>
|
|
{error && <div className="mb-4 p-3 bg-red-50 border border-red-200 rounded text-sm text-red-700">{error}</div>}
|
|
<form onSubmit={handleSubmit} className="space-y-4">
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Name *</label>
|
|
<input
|
|
value={name}
|
|
onChange={e => setName(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
placeholder="e.g., Alice Smith"
|
|
required
|
|
/>
|
|
</div>
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Email *</label>
|
|
<input
|
|
type="email"
|
|
value={email}
|
|
onChange={e => setEmail(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
placeholder="alice@example.com"
|
|
required
|
|
/>
|
|
</div>
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Team</label>
|
|
<select
|
|
value={teamId}
|
|
onChange={e => setTeamId(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
>
|
|
<option value="">Unassigned</option>
|
|
{teams.map(team => (
|
|
<option key={team.id} value={team.id}>{team.name}</option>
|
|
))}
|
|
</select>
|
|
</div>
|
|
<div className="flex gap-2 pt-4">
|
|
<button
|
|
type="submit"
|
|
disabled={isLoading}
|
|
className="flex-1 btn btn-primary disabled:opacity-50 disabled:cursor-not-allowed"
|
|
>
|
|
{isLoading ? 'Creating...' : 'Create Owner'}
|
|
</button>
|
|
<button
|
|
type="button"
|
|
onClick={onClose}
|
|
className="flex-1 btn btn-ghost"
|
|
>
|
|
Cancel
|
|
</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
// EditOwnerModal — B-1 master closure (cat-b-31ceb6aaa9f1). Pre-B-1 the
|
|
// only way to rename an owner was delete-and-recreate, which destroyed
|
|
// audit history and broke every cert that referenced the old owner_id.
|
|
// Mirrors CreateOwnerModal shape; pre-populates from the editing owner;
|
|
// calls updateOwner(id, fields) instead of createOwner.
|
|
interface EditOwnerModalProps {
|
|
owner: Owner | null;
|
|
onClose: () => void;
|
|
onSuccess: () => void;
|
|
isLoading: boolean;
|
|
error: string | null;
|
|
teamsData?: { data: Team[] };
|
|
}
|
|
|
|
function EditOwnerModal({ owner, onClose, onSuccess, isLoading, error, teamsData }: EditOwnerModalProps) {
|
|
const [name, setName] = useState('');
|
|
const [email, setEmail] = useState('');
|
|
const [teamId, setTeamId] = useState('');
|
|
|
|
// Reset form fields whenever the editing target changes (modal opens).
|
|
useEffect(() => {
|
|
if (owner) {
|
|
setName(owner.name);
|
|
setEmail(owner.email);
|
|
setTeamId(owner.team_id || '');
|
|
}
|
|
}, [owner]);
|
|
|
|
const handleSubmit = async (e: React.FormEvent) => {
|
|
e.preventDefault();
|
|
if (!owner || !name.trim() || !email.trim()) return;
|
|
await updateOwner(owner.id, {
|
|
name: name.trim(),
|
|
email: email.trim(),
|
|
team_id: teamId || undefined,
|
|
});
|
|
onSuccess();
|
|
};
|
|
|
|
if (!owner) return null;
|
|
const teams = teamsData?.data || [];
|
|
|
|
return (
|
|
<div className="fixed inset-0 bg-black/40 flex items-center justify-center z-50" onClick={onClose}>
|
|
<div className="bg-surface border border-surface-border rounded p-5 w-full max-w-md shadow-xl" onClick={e => e.stopPropagation()}>
|
|
<h2 className="text-lg font-semibold text-ink mb-4">Edit Owner</h2>
|
|
<p className="text-xs text-ink-muted mb-4 font-mono">{owner.id}</p>
|
|
{error && <div className="mb-4 p-3 bg-red-50 border border-red-200 rounded text-sm text-red-700">{error}</div>}
|
|
<form onSubmit={handleSubmit} className="space-y-4">
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Name *</label>
|
|
<input
|
|
value={name}
|
|
onChange={e => setName(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
required
|
|
/>
|
|
</div>
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Email *</label>
|
|
<input
|
|
type="email"
|
|
value={email}
|
|
onChange={e => setEmail(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
required
|
|
/>
|
|
</div>
|
|
<div>
|
|
<label className="block text-sm font-medium text-ink mb-1">Team</label>
|
|
<select
|
|
value={teamId}
|
|
onChange={e => setTeamId(e.target.value)}
|
|
className="w-full bg-white border border-surface-border rounded px-3 py-2 text-sm text-ink focus:outline-none focus:border-brand-400"
|
|
>
|
|
<option value="">Unassigned</option>
|
|
{teams.map(team => (
|
|
<option key={team.id} value={team.id}>{team.name}</option>
|
|
))}
|
|
</select>
|
|
</div>
|
|
<div className="flex gap-2 pt-4">
|
|
<button type="submit" disabled={isLoading} className="flex-1 btn btn-primary disabled:opacity-50 disabled:cursor-not-allowed">
|
|
{isLoading ? 'Saving...' : 'Save Changes'}
|
|
</button>
|
|
<button type="button" onClick={onClose} className="flex-1 btn btn-ghost">Cancel</button>
|
|
</div>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
);
|
|
}
|
|
|
|
export default function OwnersPage() {
|
|
const queryClient = useQueryClient();
|
|
const [showCreate, setShowCreate] = useState(false);
|
|
const [editingOwner, setEditingOwner] = useState<Owner | null>(null);
|
|
|
|
const { data, isLoading, error, refetch } = useQuery({
|
|
queryKey: ['owners'],
|
|
queryFn: () => getOwners(),
|
|
});
|
|
|
|
const { data: teamsData } = useQuery({
|
|
queryKey: ['teams'],
|
|
queryFn: () => getTeams(),
|
|
});
|
|
|
|
const deleteMutation = useMutation({
|
|
mutationFn: deleteOwner,
|
|
onSuccess: () => queryClient.invalidateQueries({ queryKey: ['owners'] }),
|
|
onError: (err: Error) => alert(`Delete failed: ${err.message}`),
|
|
});
|
|
|
|
const createMutation = useMutation({
|
|
mutationFn: createOwner,
|
|
onSuccess: () => {
|
|
queryClient.invalidateQueries({ queryKey: ['owners'] });
|
|
setShowCreate(false);
|
|
},
|
|
});
|
|
|
|
const updateMutation = useMutation({
|
|
mutationFn: ({ id, data }: { id: string; data: Partial<Owner> }) => updateOwner(id, data),
|
|
onSuccess: () => {
|
|
queryClient.invalidateQueries({ queryKey: ['owners'] });
|
|
setEditingOwner(null);
|
|
},
|
|
});
|
|
|
|
const teamMap = new Map<string, Team>();
|
|
(teamsData?.data || []).forEach((t) => teamMap.set(t.id, t));
|
|
|
|
const columns: Column<Owner>[] = [
|
|
{
|
|
key: 'name',
|
|
label: 'Owner',
|
|
render: (o) => (
|
|
<div>
|
|
<div className="font-medium text-ink">{o.name}</div>
|
|
<div className="text-xs text-ink-faint font-mono">{o.id}</div>
|
|
</div>
|
|
),
|
|
},
|
|
{
|
|
key: 'email',
|
|
label: 'Email',
|
|
render: (o) => <span className="text-ink">{o.email || '\u2014'}</span>,
|
|
},
|
|
{
|
|
key: 'team',
|
|
label: 'Team',
|
|
render: (o) => {
|
|
const team = teamMap.get(o.team_id);
|
|
return team
|
|
? <span className="text-brand-400">{team.name}</span>
|
|
: <span className="text-ink-faint font-mono text-xs">{o.team_id || '\u2014'}</span>;
|
|
},
|
|
},
|
|
{
|
|
key: 'created',
|
|
label: 'Created',
|
|
render: (o) => <span className="text-xs text-ink-muted">{formatDateTime(o.created_at)}</span>,
|
|
},
|
|
{
|
|
key: 'actions',
|
|
label: '',
|
|
render: (o) => (
|
|
<div className="flex gap-3 justify-end">
|
|
<button
|
|
onClick={(e) => { e.stopPropagation(); setEditingOwner(o); }}
|
|
className="text-xs text-brand-400 hover:text-brand-500 transition-colors"
|
|
>
|
|
Edit
|
|
</button>
|
|
<button
|
|
onClick={(e) => { e.stopPropagation(); if (confirm(`Delete owner ${o.name}?`)) deleteMutation.mutate(o.id); }}
|
|
className="text-xs text-red-600 hover:text-red-700 transition-colors"
|
|
>
|
|
Delete
|
|
</button>
|
|
</div>
|
|
),
|
|
},
|
|
];
|
|
|
|
return (
|
|
<>
|
|
<PageHeader
|
|
title="Owners"
|
|
subtitle={data ? `${data.total} owners` : undefined}
|
|
action={
|
|
<button onClick={() => setShowCreate(true)} className="btn btn-primary">
|
|
+ New Owner
|
|
</button>
|
|
}
|
|
/>
|
|
<div className="flex-1 overflow-y-auto">
|
|
{error ? (
|
|
<ErrorState error={error as Error} onRetry={() => refetch()} />
|
|
) : (
|
|
<DataTable columns={columns} data={data?.data || []} isLoading={isLoading} emptyMessage="No owners configured" />
|
|
)}
|
|
</div>
|
|
<CreateOwnerModal
|
|
isOpen={showCreate}
|
|
onClose={() => setShowCreate(false)}
|
|
onSuccess={() => {
|
|
queryClient.invalidateQueries({ queryKey: ['owners'] });
|
|
setShowCreate(false);
|
|
}}
|
|
isLoading={createMutation.isPending}
|
|
error={createMutation.error ? (createMutation.error as Error).message : null}
|
|
teamsData={teamsData}
|
|
/>
|
|
<EditOwnerModal
|
|
owner={editingOwner}
|
|
onClose={() => setEditingOwner(null)}
|
|
onSuccess={() => {
|
|
queryClient.invalidateQueries({ queryKey: ['owners'] });
|
|
setEditingOwner(null);
|
|
}}
|
|
isLoading={updateMutation.isPending}
|
|
error={updateMutation.error ? (updateMutation.error as Error).message : null}
|
|
teamsData={teamsData}
|
|
/>
|
|
</>
|
|
);
|
|
}
|