UI: Add max ttl to acme certificates (#26906)

* add max ttl to acme

* change test title?

* hide toggle

* update sign-intermediate

* add enforce_leaf_not_after_behavior

ui/app/models/pki/config/acme.js

@@ -66,6 +66,15 @@ export default class PkiConfigAcmeModel extends Model {
   })
   dnsResolver;
 
+  @attr({
+    label: 'Max TTL',
+    editType: 'ttl',
+    hideToggle: true,
+    helperTextEnabled:
+      'Specify the maximum TTL for ACME certificates. Role TTL values will be limited to this value.',
+  })
+  maxTtl;
+
   @lazyCapabilities(apiPath`${'id'}/config/acme`, 'id')
   acmePath;
 

ui/app/models/pki/sign-intermediate.js

@@ -19,6 +19,7 @@ const validations = {
   'excludeCnFromSans',
   'customTtl',
   'notBeforeDuration',
+  'enforceLeafNotAfterBehavior',
   'format',
   'permittedDnsDomains',
   'maxPathLength',
@@ -56,6 +57,11 @@ export default class PkiSignIntermediateModel extends PkiCertificateBaseModel {
   })
   notBeforeDuration;
 
+  @attr('boolean', {
+    subText: "Do not truncate the NotAfter field, use the issuer's configured leaf_not_after_behavior",
+  })
+  enforceLeafNotAfterBehavior;
+
   @attr({
     label: 'Permitted DNS domains',
     subText:

ui/lib/pki/addon/components/page/pki-configuration-details.hbs

@@ -42,6 +42,7 @@
       <InfoTableRow
         @label={{or attr.options.label (humanize (dasherize attr.name))}}
         @value={{or (get @acme attr.name) "None"}}
+        @formatTtl={{eq attr.options.editType "ttl"}}
       />
     {{/each}}
   {{/if}}

ui/tests/acceptance/open-api-path-help-test.js

@@ -19,46 +19,49 @@ import expectedAuthAttrs from 'vault/tests/helpers/openapi/expected-auth-attrs';
  * if it is not updated automatically or is a more involved feature request.
  * Marked as enterprise so it only runs periodically
  */
-module('Acceptance | OpenAPI provides expected attributes enterprise', function (hooks) {
-  setupApplicationTest(hooks);
-  hooks.beforeEach(function () {
-    this.pathHelp = this.owner.lookup('service:pathHelp');
-    this.store = this.owner.lookup('service:store');
-    return authPage.login();
-  });
-
-  // Secret engines that use OpenAPI
-  ['ssh', 'kmip', 'pki'].forEach(function (testCase) {
-    return module(`${testCase} engine`, function (hooks) {
-      hooks.beforeEach(async function () {
-        this.backend = `${testCase}-openapi`;
-        await runCmd(mountEngineCmd(testCase, this.backend), false);
-      });
-      hooks.afterEach(async function () {
-        await runCmd(deleteEngineCmd(this.backend), false);
-      });
-
-      secretEngineHelper(test, testCase);
+module(
+  'Acceptance | Heads up - backend param changes! Expected OpenAPI attributes enterprise',
+  function (hooks) {
+    setupApplicationTest(hooks);
+    hooks.beforeEach(function () {
+      this.pathHelp = this.owner.lookup('service:pathHelp');
+      this.store = this.owner.lookup('service:store');
+      return authPage.login();
     });
-  });
 
-  // All auth backends use OpenAPI except aws
-  ['azure', 'userpass', 'cert', 'gcp', 'github', 'jwt', 'kubernetes', 'ldap', 'okta', 'radius'].forEach(
-    function (testCase) {
-      return module(`${testCase} auth`, function (hooks) {
+    // Secret engines that use OpenAPI
+    ['ssh', 'kmip', 'pki'].forEach(function (testCase) {
+      return module(`${testCase} engine`, function (hooks) {
         hooks.beforeEach(async function () {
-          this.mount = `${testCase}-openapi`;
-          await runCmd(mountAuthCmd(testCase, this.mount), false);
+          this.backend = `${testCase}-openapi`;
+          await runCmd(mountEngineCmd(testCase, this.backend), false);
         });
         hooks.afterEach(async function () {
-          await runCmd(deleteAuthCmd(this.backend), false);
+          await runCmd(deleteEngineCmd(this.backend), false);
         });
 
-        authEngineHelper(test, testCase);
+        secretEngineHelper(test, testCase);
       });
-    }
-  );
-});
+    });
+
+    // All auth backends use OpenAPI except aws
+    ['azure', 'userpass', 'cert', 'gcp', 'github', 'jwt', 'kubernetes', 'ldap', 'okta', 'radius'].forEach(
+      function (testCase) {
+        return module(`${testCase} auth`, function (hooks) {
+          hooks.beforeEach(async function () {
+            this.mount = `${testCase}-openapi`;
+            await runCmd(mountAuthCmd(testCase, this.mount), false);
+          });
+          hooks.afterEach(async function () {
+            await runCmd(deleteAuthCmd(this.backend), false);
+          });
+
+          authEngineHelper(test, testCase);
+        });
+      }
+    );
+  }
+);
 
 function secretEngineHelper(test, secretEngine) {
   const engineData = expectedSecretAttrs[secretEngine];

ui/tests/helpers/openapi/expected-secret-attrs.js

@@ -569,6 +569,12 @@ const pki = {
       fieldGroup: 'default',
       type: 'boolean',
     },
+    maxTtl: {
+      editType: 'ttl',
+      fieldGroup: 'default',
+      helpText:
+        'Specify the maximum TTL for ACME certificates. Role TTL values will be limited to this value',
+    },
   },
   'pki/certificate/generate': {
     role: {
@@ -1200,6 +1206,12 @@ const pki = {
       fieldGroup: 'default',
       type: 'string',
     },
+    enforceLeafNotAfterBehavior: {
+      editType: 'boolean',
+      fieldGroup: 'default',
+      helpText: "Do not truncate the NotAfter field, use the issuer's configured leaf_not_after_behavior",
+      type: 'boolean',
+    },
     excludeCnFromSans: {
       editType: 'boolean',
       helpText:

ui/tests/integration/components/pki/pki-sign-intermediate-form-test.js

@@ -47,7 +47,7 @@ module('Integration | Component | pki-sign-intermediate-form', function (hooks)
 
     assert.dom(selectors.form).exists('Form is rendered');
     assert.dom(selectors.resultsContainer).doesNotExist('Results display not rendered');
-    assert.dom('[data-test-field]').exists({ count: 9 }, '9 default fields shown');
+    assert.dom('[data-test-field]').exists({ count: 10 }, '10 default fields shown');
     assert.dom(selectors.toggleSigningOptions).exists();
     assert.dom(selectors.toggleSANOptions).exists();
     assert.dom(selectors.toggleAdditionalFields).exists();