archbilesherman commented on code in PR #532:
URL: https://github.com/apache/airavata-custos/pull/532#discussion_r3907668001
##########
extensions/SSH-Certificate-Signer/internal/store/revocation.go:
##########
@@ -56,3 +75,119 @@ func (d *DB) InsertRevocationEvent(ctx context.Context, ev
*RevocationEvent) err
}
return nil
}
+
+// RevokeCertificateBySerial revokes the certificate identified by serial. It
does
+// NOT scope by owner — authorization is enforced by the caller (an
administrator
+// holding signer:certificates:write, or a trusted machine client). It is
+// idempotent: a repeat revoke returns the existing revocation
(AlreadyRevoked=true)
+// without inserting a duplicate event. The revocation event inherits the
+// certificate's tenant/client.
+func (d *DB) RevokeCertificateBySerial(
+ ctx context.Context,
+ serialNumber int64,
+ reason string,
+ revokedBy string,
+) (*RevokedCertificate, error) {
+ return d.revokeCertificateBySerial(ctx, serialNumber, reason,
revokedBy, false)
+}
+
+// RevokeActiveCertificateBySerial is the administrator-facing variant. It
+// refuses a first-time revocation outside the certificate validity interval,
+// while preserving idempotent success for retries of an earlier revocation.
+func (d *DB) RevokeActiveCertificateBySerial(
+ ctx context.Context,
+ serialNumber int64,
+ reason string,
+ revokedBy string,
+) (*RevokedCertificate, error) {
+ return d.revokeCertificateBySerial(ctx, serialNumber, reason,
revokedBy, true)
+}
+
+func (d *DB) revokeCertificateBySerial(
Review Comment:
Logic has been removed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
