feature: add PKI approval workflows by carlosmonastyrski · Pull Request #5218 · Infisical/infisical

carlosmonastyrski · 2026-01-20T21:49:11Z

Context

This PR adds approval workflows for certificate issuance. When users request certificates, the backend checks for approval policies on the certificate profile and, if required, creates an approval request that must be approved before the certificate is issued. Admins can create approval policies that specify which profiles require approval, how many approvers are needed, and who can approve. The frontend includes pages to view pending approval requests, approve or reject them, and manage approval policies. Certificate requests are linked to approval requests, and the certificate is only issued after the approval workflow completes.

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

maidul98 · 2026-01-20T21:49:50Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-01-20T21:54:46Z

Greptile Summary

This PR implements approval workflows for PKI certificate issuance, allowing administrators to require approval before certificates are issued from specific profiles. The implementation includes backend approval policy matching, multi-step approval flows, and frontend UI for managing policies and approving requests.

Key Changes:

Database schema extended to link certificate requests with approval requests and track machine identity requesters
Approval workflow integrated into certificate issuance pipeline for both direct issuance and CSR signing
API responses updated to return pending status when approval is required instead of immediate certificate
Frontend pages added for managing approval policies and viewing/approving certificate requests
Machine identity bypass option allows automated systems to skip approval workflows

Critical Issues Found:

Certificate issuance uses approver's actor context instead of original requester's identity, potentially allowing privilege escalation
Machine identity bypass doesn't validate specific identities, allowing any machine identity to skip approval
Breaking API changes without endpoint versioning will break existing integrations
Foreign key constraint could orphan certificate requests if approval requests are deleted

Confidence Score: 2/5

This PR has critical security vulnerabilities that must be fixed before merging
Score reflects multiple high-severity security issues: (1) approval bypass allows any machine identity to skip approval without validation, (2) certificates are issued using approver's permissions instead of original requester's identity, (3) breaking API changes without versioning, and (4) potential for orphaned certificate requests due to SET NULL foreign key constraint
Pay close attention to backend/src/services/certificate-v3/certificate-v3-service.ts and backend/src/services/approval-policy/approval-policy-service.ts - both contain critical security flaws in the approval and issuance flow

Important Files Changed

Filename	Overview
backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts	Adds database schema for approval workflows: links certificate requests to approval requests, adds machine identity tracking, and bypass flag for policies. Foreign key uses SET NULL which could orphan requests.
backend/src/services/certificate-v3/certificate-v3-service.ts	Core certificate issuance logic with approval workflow integration. Contains critical security issues: approval bypass doesn't validate specific identities, and certificate issuance uses approver's context instead of requester's.
backend/src/services/approval-policy/approval-policy-service.ts	Approval policy service with certificate issuance post-approval routine. Security flaw: issues certificates using approver's actor context rather than original requester's identity.
backend/src/server/routes/v1/certificate-router.ts	API endpoints updated to handle approval workflow responses. Breaking change: certificate response can now be null with status/message fields when approval is required.
backend/src/services/approval-policy/cert-request/cert-request-policy-factory.ts	Certificate request approval policy factory. Matches policies by profile name and creates approval grants. canAccess always returns false which may prevent legitimate request viewing.

greptile-apps

Additional Comments (1)

backend/src/server/routes/v1/certificate-router.ts, line 175-192 (link)

logic: Breaking API Change: response schema now includes optional status and message fields, and certificate can be null when status is PENDING_APPROVAL. Existing API consumers expecting certificates to always be returned will break.

Consider versioning this endpoint (e.g., /v2/certificates/issue) or ensuring backwards compatibility by always including certificate data in v1.

_{73 files reviewed, 7 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/services/certificate-v3/certificate-v3-service.ts

backend/src/services/approval-policy/approval-policy-service.ts

backend/src/services/certificate-v3/certificate-v3-service.ts

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts

backend/src/services/approval-policy/cert-request/cert-request-policy-factory.ts

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts

backend/src/ee/services/pki-acme/pki-acme-service.ts

backend/src/services/approval-policy/approval-policy-service.ts

backend/src/services/approval-policy/approval-request-dal.ts

backend/src/services/approval-policy/cert-request/cert-request-policy-factory.ts

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

backend/src/services/certificate-request/certificate-request-service.ts

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts

backend/src/services/approval-policy/approval-policy-service.ts

backend/src/services/approval-policy/cert-request/cert-request-policy-schemas.ts

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts

backend/src/services/certificate-v3/certificate-v3-service.ts

backend/src/services/certificate-v3/certificate-v3-types.ts

frontend/src/hooks/api/approvalGrants/index.tsx

frontend/src/hooks/api/approvalGrants/types.ts

...nd/src/pages/cert-manager/ApprovalRequestDetailPage/components/CertificateDetailsSection.tsx

frontend/src/pages/cert-manager/ApprovalsPage/components/PolicyTab/components/PoliciesTable.tsx

frontend/src/pages/cert-manager/ApprovalsPage/components/PolicyTab/components/PolicyModal.tsx

frontend/src/components/approvals/PolicyApprovalSteps.tsx

frontend/src/pages/cert-manager/ApprovalsPage/components/RequestsTab/RequestDetailModal.tsx

frontend/src/pages/cert-manager/CertificateRequestsPage/components/CertificateRequestRow.tsx

frontend/src/pages/pam/ApprovalRequestDetailPage/components/ApprovalStepsSection.tsx

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts

backend/src/services/approval-policy/cert-request/cert-request-policy-factory.ts

backend/src/services/certificate-v3/certificate-approval-fns.ts

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts

docs/documentation/platform/pki/guides/certificate-approvals.mdx

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts

Add PKI approval workflows

2cedff6

greptile-apps bot reviewed Jan 20, 2026

View reviewed changes

carlosmonastyrski added 4 commits January 20, 2026 21:35

Minor fix on approveRequest permissions check

8895138

Added missing EST cert request and approvals management

4e9fdb8

Fix CertificateRequestsSchema

08587ba

Fix ApprovalPoliciesSchema

8098fb7

carlosmonastyrski requested a review from sheensantoscapadngan January 21, 2026 03:14

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/db/migrations/20260116104856_pki-certificate-approvals.ts Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/ee/services/pki-acme/pki-acme-service.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/approval-policy/approval-policy-service.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/approval-policy/approval-request-dal.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/approval-policy/cert-request/cert-request-policy-factory.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/certificate-est-v3/certificate-est-v3-service.ts Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/certificate-request/certificate-request-service.ts Outdated Show resolved Hide resolved

sheensantoscapadngan reviewed Jan 21, 2026

View reviewed changes

backend/src/services/certificate-authority/internal/internal-certificate-authority-types.ts Show resolved Hide resolved