feat: DMS: add certificate Issuance Profile support by jgalipienzo · Pull Request #276 · lamassuiot/lamassuiot

jgalipienzo · 2025-06-27T08:11:24Z

This PR introduces support for configurable issuance profiles on a per-DMS basis, providing greater flexibility and control over device certificate management.

Closes #274

New functionality:

Added a new IssuanceProfile field to the DMS settings struct.
Updated the DMS create/update logic to check if the supplied issuance's profile validity doesn't exceed enrollment CA's limits.
Updated the enroll and reenroll logic to use the IssuanceProfile from the DMS configuration, defaulting to the enrollment CA's issuance profile when not provided at the DMS.

This feature enables fine-grained control over certificate issuance policies for each DMS.

codecov · 2025-06-27T08:12:19Z

Codecov Report

Attention: Patch coverage is 50.00000% with 1 line in your changes missing coverage. Please review.

Project coverage is 45.81%. Comparing base (7c4cb0e) to head (5be2ab6).
Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
backend/pkg/controllers/dmsmanager.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #276      +/-   ##
==========================================
- Coverage   45.82%   45.81%   -0.01%     
==========================================
  Files         128      128              
  Lines        8570     8569       -1     
==========================================
- Hits         3927     3926       -1     
  Misses       4307     4307              
  Partials      336      336

Flag	Coverage Δ
backend	`59.11% <50.00%> (-0.01%)`	⬇️
connector-awsiot	`4.91% <ø> (ø)`
core	`61.97% <ø> (ø)`
monolithic	`0.00% <ø> (ø)`
sdk	`0.00% <ø> (ø)`
shared-http	`7.07% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

…roll Signed-off-by: Jon Galipienzo <[email protected]>

Signed-off-by: Jon Galipienzo <[email protected]>

sonarqubecloud · 2025-06-30T16:12:49Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull Request Overview

This PR adds configurable certificate issuance profiles to the DMS, enhancing control over device certificate management.

Introduces a new IssuanceProfile field in DMS settings with associated validation and default assignment logic.
Updates create, update, enroll, and reenroll operations to validate the issuance profile against the enrollment CA’s certificate.
Adds new error definitions and test cases to capture invalid issuance profile scenarios.

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
core/pkg/models/dms.go	Added a new IssuanceProfile field to the DMS settings struct
core/pkg/errs/dms.go	Added new error ErrDMSIssuanceProfile for issuance profile validation failures
backend/pkg/x509engines/x509engine.go	Updated error message wording for certificate expiration checks
backend/pkg/services/dmsmanager.go	Integrated issuance profile validation and default assignment in DMS operations
backend/pkg/controllers/dmsmanager.go	Adjusted HTTP error responses to use consistent JSON formatting
backend/pkg/assemblers/dms-manager_test.go	Added tests covering invalid issuance profile scenarios

Comments suppressed due to low confidence (1)

core/pkg/errs/dms.go:8

[nitpick] Standardize the error message wording for issuance profile validation so that it matches the log messages produced in the validation function; this will help reduce ambiguity when troubleshooting.

	ErrDMSIssuanceProfile error = errors.New("DMS certificate expiration exceeds that of the enrollment CA")

* feat: use Issuance Profile definition from DMS during enroll and reenroll Signed-off-by: Jon Galipienzo <[email protected]> * test: add/update tests to cover the new configuration Signed-off-by: Jon Galipienzo <[email protected]> * feat: provide enrollment CA's IssuanceProfile as default Signed-off-by: Jon Galipienzo <[email protected]> * test: add test for default issuance profile Signed-off-by: Jon Galipienzo <[email protected]> * test: fix tests Signed-off-by: Jon Galipienzo <[email protected]> * feat: validate issuance profile on create/update Signed-off-by: Jon Galipienzo <[email protected]> --------- Signed-off-by: Jon Galipienzo <[email protected]> Signed-off-by: Haritz <haritzsaiz>

…d with colons (#279) * fix crl urls Signed-off-by: Haritz <haritzsaiz> * fix tests Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix SubjectKeyIDs Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix crl Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix import tests Signed-off-by: Haritz <haritzsaiz> * fix va role fetching Signed-off-by: Haritz <haritzsaiz> * chore: Bump dependencies (#278) Signed-off-by: Juan Jose Rodriguez <[email protected]> Signed-off-by: Haritz <haritzsaiz> * feat: DMS: add certificate Issuance Profile support (#276) * feat: use Issuance Profile definition from DMS during enroll and reenroll Signed-off-by: Jon Galipienzo <[email protected]> * test: add/update tests to cover the new configuration Signed-off-by: Jon Galipienzo <[email protected]> * feat: provide enrollment CA's IssuanceProfile as default Signed-off-by: Jon Galipienzo <[email protected]> * test: add test for default issuance profile Signed-off-by: Jon Galipienzo <[email protected]> * test: fix tests Signed-off-by: Jon Galipienzo <[email protected]> * feat: validate issuance profile on create/update Signed-off-by: Jon Galipienzo <[email protected]> --------- Signed-off-by: Jon Galipienzo <[email protected]> Signed-off-by: Haritz <haritzsaiz> * feat: va: Remove get roles (#280) Remove get roles Signed-off-by: Haritz <haritzsaiz> Co-authored-by: Haritz <haritzsaiz> Signed-off-by: Haritz <haritzsaiz> * chore: monolithic: add labels and standard ports in docker containers (#281) add labels and standard ports Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> --------- Signed-off-by: Haritz <haritzsaiz> Signed-off-by: haritz <[email protected]> Signed-off-by: Juan Jose Rodriguez <[email protected]> Signed-off-by: Jon Galipienzo <[email protected]> Signed-off-by: Haritz S. Sierra <[email protected]> Co-authored-by: Haritz <haritzsaiz> Co-authored-by: Juanjo Rodriguez <[email protected]> Co-authored-by: Jon Galipienzo <[email protected]>

…d with colons (#279) * fix crl urls Signed-off-by: Haritz <haritzsaiz> * fix tests Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix SubjectKeyIDs Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix crl Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> * fix import tests Signed-off-by: Haritz <haritzsaiz> * fix va role fetching Signed-off-by: Haritz <haritzsaiz> * chore: Bump dependencies (#278) Signed-off-by: Juan Jose Rodriguez <[email protected]> Signed-off-by: Haritz <haritzsaiz> * feat: DMS: add certificate Issuance Profile support (#276) * feat: use Issuance Profile definition from DMS during enroll and reenroll Signed-off-by: Jon Galipienzo <[email protected]> * test: add/update tests to cover the new configuration Signed-off-by: Jon Galipienzo <[email protected]> * feat: provide enrollment CA's IssuanceProfile as default Signed-off-by: Jon Galipienzo <[email protected]> * test: add test for default issuance profile Signed-off-by: Jon Galipienzo <[email protected]> * test: fix tests Signed-off-by: Jon Galipienzo <[email protected]> * feat: validate issuance profile on create/update Signed-off-by: Jon Galipienzo <[email protected]> --------- Signed-off-by: Jon Galipienzo <[email protected]> Signed-off-by: Haritz <haritzsaiz> * feat: va: Remove get roles (#280) Remove get roles Signed-off-by: Haritz <haritzsaiz> Co-authored-by: Haritz <haritzsaiz> Signed-off-by: Haritz <haritzsaiz> * chore: monolithic: add labels and standard ports in docker containers (#281) add labels and standard ports Signed-off-by: haritz <[email protected]> Signed-off-by: Haritz <haritzsaiz> --------- Signed-off-by: Haritz <haritzsaiz> Signed-off-by: haritz <[email protected]> Signed-off-by: Juan Jose Rodriguez <[email protected]> Signed-off-by: Jon Galipienzo <[email protected]> Signed-off-by: Haritz S. Sierra <[email protected]> Co-authored-by: Haritz <haritzsaiz> Co-authored-by: Juanjo Rodriguez <[email protected]> Co-authored-by: Jon Galipienzo <[email protected]> Signed-off-by: haritz <[email protected]>

jgalipienzo changed the title ~~feat: DMS: use Issuance Profile from DMS during enroll and reenroll~~ feat: DMS: add Issuance Profile support to DMS Jun 27, 2025

jgalipienzo added the enhancement New feature or request label Jun 27, 2025

jgalipienzo marked this pull request as ready for review June 27, 2025 14:35

jgalipienzo added 5 commits June 27, 2025 16:36

feat: use Issuance Profile definition from DMS during enroll and reen…

d94117f

…roll Signed-off-by: Jon Galipienzo <[email protected]>

test: add/update tests to cover the new configuration

832c8e1

Signed-off-by: Jon Galipienzo <[email protected]>

feat: provide enrollment CA's IssuanceProfile as default

36ccbd7

Signed-off-by: Jon Galipienzo <[email protected]>

test: add test for default issuance profile

cf32188

Signed-off-by: Jon Galipienzo <[email protected]>

test: fix tests

42aec29

Signed-off-by: Jon Galipienzo <[email protected]>

jgalipienzo force-pushed the feat/dms-issuance-profile branch from a85a413 to 42aec29 Compare June 27, 2025 14:36

jgalipienzo requested a review from jjrodrig June 27, 2025 15:02

jgalipienzo marked this pull request as draft June 27, 2025 16:07

jgalipienzo removed the request for review from jjrodrig June 27, 2025 16:07

feat: validate issuance profile on create/update

5be2ab6

Signed-off-by: Jon Galipienzo <[email protected]>

jgalipienzo force-pushed the feat/dms-issuance-profile branch from 7f62113 to 5be2ab6 Compare June 30, 2025 16:12

jgalipienzo changed the title ~~feat: DMS: add Issuance Profile support to DMS~~ feat: DMS: add certificate Issuance Profile support Jun 30, 2025

jgalipienzo marked this pull request as ready for review June 30, 2025 16:28

jgalipienzo requested a review from jjrodrig June 30, 2025 16:28

jgalipienzo mentioned this pull request Jun 30, 2025

feat: add certificate issuance profile options to DMS form lamassuiot/lamassu-ui-old#93

Open

jjrodrig requested a review from Copilot July 1, 2025 06:01

Copilot AI reviewed Jul 1, 2025

View reviewed changes

lamassuiot deleted a comment from Copilot AI Jul 1, 2025

jjrodrig approved these changes Jul 2, 2025

View reviewed changes

haritzsaiz approved these changes Jul 2, 2025

View reviewed changes

haritzsaiz merged commit 75da76a into main Jul 2, 2025
37 checks passed

haritzsaiz deleted the feat/dms-issuance-profile branch July 2, 2025 08:32

This was referenced Sep 23, 2025

chore: release: prepare release 3.5.0 #306

Closed

chore: release: prepare release 3.5.0 #307

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: DMS: add certificate Issuance Profile support#276

feat: DMS: add certificate Issuance Profile support#276
haritzsaiz merged 6 commits intomainfrom
feat/dms-issuance-profile

jgalipienzo commented Jun 27, 2025 •

edited

Loading

Uh oh!

codecov bot commented Jun 27, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Jun 30, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

jgalipienzo commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

New functionality:

Uh oh!

codecov bot commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

sonarqubecloud bot commented Jun 30, 2025

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

jgalipienzo commented Jun 27, 2025 •

edited

Loading

codecov bot commented Jun 27, 2025 •

edited

Loading