improvement(pki): add metadata support to certificate and certificate requests including searching by saifsmailbox98 · Pull Request #5555 · Infisical/infisical

saifsmailbox98 · 2026-02-27T19:03:49Z

Context

Allows addition of metadata to certs and cert requests, also allows searching with them

Screenshots

Please check the docs for the screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Read the contributing guide

linear · 2026-02-27T19:03:51Z

ENG-4595 Add metadata support in PKI

maidul98 · 2026-02-27T19:04:31Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-02-27T19:08:45Z

Greptile Summary

This PR adds comprehensive metadata support to certificates and certificate requests, enabling users to attach custom key-value pairs for organization and tracking.

Key Changes:

Database migration adds certificateId and certificateRequestId columns to ResourceMetadata table with proper foreign keys and composite FK support
Backend implements metadata insertion across all certificate issuance flows (CSR, managed, ACME order)
Metadata filtering added to certificate and certificate request listing endpoints with custom query parameter parsing
Frontend adds UI for attaching metadata during issuance, editing metadata on certificate details page, and filtering by metadata
Metadata automatically carries over when certificates are renewed
Comprehensive documentation added with screenshots

Security & Quality:

All previous issues addressed: regex replaced with string splitting, composite FK fields added, actorOrgId used correctly
Authorization properly checked at certificate level using existing permission system
SQL queries use parameterized inputs preventing injection
Migration is idempotent with proper hasColumn checks
No breaking API changes - all metadata parameters are optional

Confidence Score: 5/5

This PR is safe to merge with minimal risk - all critical issues from previous review rounds have been addressed
Score reflects thorough implementation with proper security practices: parameterized queries prevent SQL injection, authorization checks are in place, migration is idempotent, and no breaking API changes introduced. Previous issues with regex usage, composite FK handling, and orgId assignment have been resolved.
No files require special attention - all implementations follow established patterns and security best practices

Important Files Changed

Filename	Overview
backend/src/db/migrations/20260227211617_add-certificate-to-resource-metadata.ts	Idempotent migration adds certificateId and certificateRequestId columns with proper foreign keys to ResourceMetadata table
backend/src/server/routes/v1/certificate-router.ts	Adds optional metadata parameter to certificate issuance endpoints and new PATCH endpoint for updating certificate metadata with proper validation
backend/src/services/certificate/certificate-dal.ts	Implements metadata filtering using whereExists subqueries and adds findByIdWithMetadata method for fetching certificates with metadata
backend/src/services/certificate-request/certificate-request-dal.ts	Implements metadata filtering for certificate requests and adds findByIdWithMetadata method using nested relationship handling
backend/src/services/certificate-v3/certificate-v3-service.ts	Integrates metadata insertion across all certificate issuance flows and implements metadata copying during renewal with proper composite FK handling
frontend/src/pages/cert-manager/CertificateDetailsByIDPage/components/CertificateMetadataSection.tsx	New component for viewing and editing certificate metadata with proper permission checks and optimistic UI updates

_{Last reviewed commit: b96a9b1}

greptile-apps

_{29 files reviewed, 6 comments}

_{Edit Code Review Agent Settings | Greptile}

backend/src/server/routes/v1/certificate-router.ts

backend/src/server/routes/v1/project-router.ts

backend/src/services/certificate-request/certificate-request-dal.ts

backend/src/services/certificate/certificate-dal.ts

…uters.

saifsmailbox98 · 2026-02-27T20:14:22Z

@greptile review this again

backend/src/services/certificate-v3/certificate-v3-service.ts

…ction payloads

…rgId`

saifsmailbox98 · 2026-02-27T20:56:25Z

@greptile review this again

…to avoid FK violations; document metadata support

saifsmailbox98 · 2026-02-27T22:26:50Z

@greptile review this again

Regarding your comment on the confidence score
(1) Lack of docs: I have added docs to support this
(2) Special character handling in metadata filter: We do something similar v4/secret-router.ts:72. We can fix them all together later.

…cking

backend/src/server/routes/v1/certificate-router.ts

…ueue

…metadata migration

…equest DALs

…dd key validation

backend/src/server/routes/v1/certificate-router.ts

backend/src/db/migrations/20260227211617_add-certificate-to-resource-metadata.ts

backend/src/server/routes/sanitizedSchemas.ts

…polish metadata card UI

…ata field limits

…lues

…ema, hide deprecated GET endpoints

…cs page

…ncation of short keys

…truncation

Add metadata support to cert and cert requests

8db4f1e

greptile-apps bot reviewed Feb 27, 2026

View reviewed changes

Simplify key-value pair splitting logic in certificate and project ro…

d9a8c5b

…uters.

greptile-apps bot reviewed Feb 27, 2026

View reviewed changes

backend/src/services/certificate-v3/certificate-v3-service.ts Show resolved Hide resolved

backend/src/services/certificate-v3/certificate-v3-service.ts Outdated Show resolved Hide resolved

saifsmailbox98 added 2 commits February 28, 2026 02:02

Add certificateRequestCreatedAt field to certificate request transa…

d0f0643

…ction payloads

Update orgId field in certificate metadata insertion to use `actorO…

2b0bac4

…rgId`

Ensure millisecond precision for createdAt in certificate requests …

b96a9b1

…to avoid FK violations; document metadata support

saifsmailbox98 added 2 commits February 28, 2026 04:23

Add createdAt field to certificate request payload for improved tra…

6d9592d

…cking

Fix UTs

ba2473d

saifsmailbox98 commented Feb 28, 2026

View reviewed changes

backend/src/server/routes/v1/certificate-router.ts Show resolved Hide resolved

saifsmailbox98 added 10 commits February 28, 2026 11:46

refactor: extract shared metadataFilter Zod schema to sanitizedSchemas

6b58e02

refactor: extract metadata copy/insert helpers to resource-metadata-fns

140cbe8

refactor: extract shared applyMetadataFilter helper for DAL queries

1f850ed

refactor: make resourceMetadataDAL required in certificate issuance q…

258f11b

…ueue

fix: improve React key for metadata Badge to reduce collision risk

ade6ddf

fix: add indexes on FK columns and millisecond precision to resource …

6c18b59

…metadata migration

feat: add audit log for certificate metadata updates

e4f5f0e

refactor: extract shared MetadataFilterSection component

dab41fb

fix: revert datetime precision to match referenced column

faccb58

fix: set explicit createdAt on approval-path cert request creation

a1fd4d9

saifsmailbox98 requested a review from carlosmonastyrski February 28, 2026 08:17

saifsmailbox98 added 2 commits March 1, 2026 23:51

remove unused findByIdWithMetadata from certificate and certificate-r…

7de90e2

…equest DALs

Make it consistent with the next PR (PAM metadata changes)

58e9914

saifsmailbox98 changed the title ~~feat(pki): add metadata support to certificate and certificate requests including searching~~ improvement(pki): add metadata support to certificate and certificate requests including searching Mar 1, 2026

saifsmailbox98 added 5 commits March 2, 2026 19:49

fix: include full metadata array in certificate metadata audit log

c339846

simplify type cast in createCertificateRequest

786732d

refactor: replace certificate metadata inline editor with modal and a…

dba44ca

…dd key validation

fix: improve MetadataForm spacing and label alignment

4131588

update: replace certificate metadata screenshots in docs

7fa1f5a

carlosmonastyrski requested changes Mar 2, 2026

View reviewed changes

refactor: generalize certificate metadata endpoint to PATCH /:id and …

b8af257

…polish metadata card UI

saifsmailbox98 assigned saifsmailbox98 and unassigned saifsmailbox98 Mar 2, 2026

saifsmailbox98 added 3 commits March 3, 2026 03:37

Add POST /search endpoint for project certificates and validate metad…

175450b

…ata field limits

Omit empty metadata value in filter so key-only search matches all va…

2b99fef

…lues

Enhance MetadataForm with empty state UI

fcfd16e

saifsmailbox98 requested a review from carlosmonastyrski March 3, 2026 00:52

saifsmailbox98 added 10 commits March 3, 2026 20:41

feat: add POST /certificate-requests/search, remove metadataFilterSch…

54ee562

…ema, hide deprecated GET endpoints

docs: add search certificate requests endpoint page

ade38c3

chore: hide and deprecate v2 certificate list endpoint, remove its do…

bccd78a

…cs page

simplify MetadataForm empty state for compact modal context

6b734c0

fix: use paired badge pattern for certificate metadata to prevent tru…

4974ee9

…ncation of short keys

fix: use fixed max-width for metadata key badge to prevent short key …

6260312

…truncation

hide empty value badge for metadata entries without a value

93ce02e

add metadata section to certificate approval request detail page

48afbd3

show metadata section with empty state when no metadata is attached

9dd1a2a

fix: autofix import sort order in MetadataForm

feff715

carlosmonastyrski approved these changes Mar 3, 2026

View reviewed changes

saifsmailbox98 merged commit 2b4a77a into main Mar 3, 2026
12 of 14 checks passed

Conversation

saifsmailbox98 commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear bot commented Feb 27, 2026

Uh oh!

maidul98 commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

greptile-apps bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Feb 27, 2026

Uh oh!

Uh oh!

Uh oh!

saifsmailbox98 commented Feb 27, 2026

Uh oh!

saifsmailbox98 commented Feb 27, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

saifsmailbox98 commented Feb 27, 2026 •

edited

Loading

maidul98 commented Feb 27, 2026 •

edited

Loading

greptile-apps bot commented Feb 27, 2026 •

edited

Loading

greptile-apps bot left a comment •

edited

Loading