Release v1.2.0 - #60
Merged
Merged
Conversation
* feat(DPAV-2437): Add Vault-integrated PKI service for certificate management with tests - Implements `VaultPkiService` for managing PKI operations via HashiCorp Vault. - Adds supporting DTOs (`CreateKeyRequestDTO`, `CreateKeyResponseDTO`, `CreateCsrResponseDTO`, `IntermediateCertResponseDTO`, etc.). - Includes a controller for exposing PKI-related endpoints. - Adds unit and integration tests for the service and controller. - Updates configurations for Vault integration via a dedicated mount point. - Adds `docker-compose` setup for an isolated Vault instance. Refs: DPAV-2437 * feat(DPAV-2437): Add Vault-integrated PKI service for certificate management with tests - Implements `VaultPkiService` for managing PKI operations via HashiCorp Vault. - Adds supporting DTOs (`CreateKeyRequestDTO`, `CreateKeyResponseDTO`, `CreateCsrResponseDTO`, `IntermediateCertResponseDTO`, etc.). - Includes a controller for exposing PKI-related endpoints. - Adds unit and integration tests for the service and controller. - Updates configurations for Vault integration via a dedicated mount point. - Adds `docker-compose` setup for an isolated Vault instance. Refs: DPAV-2437 * Refactor: Standardize formatting, optimize imports, and enhance Vault PKI service functionality - Reformatted code for consistency and removed unused imports across multiple modules. - Enhanced `signCsr` method in `VaultPkiService` to use default role and TTL when not provided. - Updated related tests to validate role and TTL fallback functionality. - Applied minor cleanups in DTOs, exception handlers, and test classes for clarity. Refs: DPAV-2437 * Refactor: Standardize formatting, optimize imports, and enhance Vault PKI service functionality - Reformatted code for consistency and removed unused imports across multiple modules. - Enhanced `signCsr` method in `VaultPkiService` to use default role and TTL when not provided. - Updated related tests to validate role and TTL fallback functionality. - Applied minor cleanups in DTOs, exception handlers, and test classes for clarity. Refs: DPAV-2437 * Refactor: Standardize formatting, optimize imports, and enhance Vault PKI service functionality - Reformatted code for consistency and removed unused imports across multiple modules. - Enhanced `signCsr` method in `VaultPkiService` to use default role and TTL when not provided. - Updated related tests to validate role and TTL fallback functionality. - Applied minor cleanups in DTOs, exception handlers, and test classes for clarity. Refs: DPAV-2437 * Refactor: Standardize formatting, optimize imports, and enhance Vault PKI service functionality - Reformatted code for consistency and removed unused imports across multiple modules. - Enhanced `signCsr` method in `VaultPkiService` to use default role and TTL when not provided. - Updated related tests to validate role and TTL fallback functionality. - Applied minor cleanups in DTOs, exception handlers, and test classes for clarity. Refs: DPAV-2437 * Refactor: Standardize formatting, optimize imports, and enhance Vault PKI service functionality - Reformatted code for consistency and removed unused imports across multiple modules. - Enhanced `signCsr` method in `VaultPkiService` to use default role and TTL when not provided. - Updated related tests to validate role and TTL fallback functionality. - Applied minor cleanups in DTOs, exception handlers, and test classes for clarity. Refs: DPAV-2437 * Refactor: Remove `@Builder` from DTOs and standardize Lombok annotations - Removed `@Builder` annotations from multiple DTOs for alignment with project conventions. - Explicitly added required Lombok annotations (`@Getter`, `@Setter`, `@NoArgsConstructor`, `@AllArgsConstructor`). - Removed unnecessary exception classes from test coverage exclusions in `pom.xml`. * Add `@Builder` annotation to certificate DTOs for streamlined object construction
* feat(DPAV-2627): Add persistence for new certificate schema * feat(DPAV-2627): Add org cert validation and config filtering Adds a HandlerInterceptor that validates organisation certificates on all /api/** requests. Using an interceptor rather than a filter so it caninspect controller annotations allowing for the @AllowBootstrapCertificates annotation used for certificate endpoints. Updates producer and consumer config responses to exclude organisations without active certificates. * feat(DPAV-2627): Record certificate details and audit events on CSR signing Adds CertificateSigningProvider to orchestrate the /csr/sign endpoint, updating the org certificate record and creating audit events on renewal. Rejects requests for manual or non-renewable certs with 403. Fixes serial number format mismatch between Vault (colon-separated) and Java X509 (plain hex) in the validation interceptor. * feat(DPAV-2627): Resolve Sonar issues
* feat(DPAV-2440): Add bootstrap certificate endpoint Adds POST /api/v1/certificate/bootstrap endpoint that generates a short-lived certificate and returns it as a ZIP download containing PKCS#12 keystore, truststore, and password files. * feat(DPAV-2440): Add role-based authorization to bootstrap endpoint * fix(DPAV-2440): Fix serial number mismatch on renewal Vault returns serials with leading-zero hex octets (02:ca:22:2b) but BigInteger.toString(16) strips leading zeros (2ca22b), which caused random 403 with leading zeros. Switched to storing the result from parsed certificate instead so we don't need to perform conversion. * fix(DPAV-2440): Resolve Sonar issues * fix(DPAV-2440): Refactor bootstrap endpoint to accept caller-provided CSR - Accept CSR PEM instead of generating keypair server-side - Return PEM files (certificate.pem, ca-chain.pem) instead of PKCS#12 keystores - Use management-node-level role (request_bootstrap_certificate) instead of per-client hasRole - Rename download to bootstrap_bundle.zip - Fix GlobalExceptionHandler: resolve "No suitable resolver" error by splitting AuthorizationDeniedException into dedicated 403 handler - Remove dead code: KeyStoreBuilder, VaultPkiService.generateKeyPair/createCsr(KeyPair) - Add request_bootstrap_certificate role to Keycloak Terraform * feat(DPAV-2440): Add bootstrap OID marker and exclude bootstrap from cert validation - Add other_sans support to VaultPkiService.signCsr() to embed a configurable bootstrap OID (1.3.6.1.4.1.32473.1.1) in bootstrap certificates. - Exclude the bootstrap endpoint from CertificateValidationInterceptor so admin clients without org cert records can call it. * feat(OSPO): synchronise OSPO workflows --------- Co-authored-by: jsmith-informed <217566155+jsmith-informed@users.noreply.github.com>
…#52) * feat(DPAV-2440): Bootstrap endpoint changes and interceptor exemption - Exclude all /api/v1/certificate/** from CertificateValidationInterceptor as caller may be an internal service without an organisation - Bootstrap endpoint now takes organisationId instead of clientId so orgs without producers/consumers can be bootstrapped - Create organisation_certificate record automatically if one does not exist - Update migration, remove schema prefix and add missing SPDX header * feat(DPAV-2440): Remove dead @AllowBootstrapCertificates annotation
…eline (#49) * feat(dpav-2563): add trivy vulnerability check to management-node pipeline * feat(OSPO): synchronise OSPO workflows * feat(dpav-2563): use correct trivy-action commit hash * feat(dpav-2563): build and scan management node image * feat(dpav-2563): Build management node image correctly * feat(dpav-2563): add scan permissions * feat(dpav-2563): set up jdk prior to get_version step * feat(dpav-2563): tag docker image prior to scan * feat(dpav-2563): test use of repo environment variable * feat(dpav-2563): remove trailing quote * test repo variable * test permissions * Use env.REPO in with block * use github event context for repository name * test setting repository name * feat(dpav-2563): use correct env names * feat(dpav-2563): use correct env reference * use env.repo outside of shell context * Correct syntax for env reference * [DPAV-2563] Update to more recent images to resolve vulnerabilities * feat(OSPO): synchronise OSPO workflows * feat(dpav-2563): change used image and rename step * feat(dpav-2563): upgrade dev dockerfile maven image --------- Co-authored-by: Nikan Negaresh <84400913+nikan-negaresh-informed@users.noreply.github.com>
* feat(DPAV-2601): Resolve CVE-2026-22732 Upgrade spring-security to 6.5.9 https://spring.io/security/cve-2026-22732 * feat(OSPO): synchronise OSPO workflows --------- Co-authored-by: jsmith-informed <217566155+jsmith-informed@users.noreply.github.com>
…#55) * feat(dpav-2563): fix to vulnerability and update to trivy scan config * feat(OSPO): synchronise OSPO workflows * feat(dpav-2563): update to ignore file * feat(dpav:2563): update ignore file * feat(dpav-2563): update trivy ignore file * feat(dpav-2563): update spring boot starter parent version to 3.5.12 * feat(dpav-2563): reduce spring back to 3.5.11
* chore: pre release 1.2.0 * feat(OSPO): synchronise OSPO workflows
github-actions
Bot
added
documentation
Contributor
✅ OSS Checks PassedAll tracked OSS checks passed in this run.
Results from commit abab8c9, view the full job summary |
|
nikan-negaresh-informed
approved these changes
Mar 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sensitive Credential Checks
Motivation and Context
Release v1.2.0
Description
How Has This Been Tested?
Screenshots (if appropriate):
Checklist: