BREAKING CHANGE(certs): Introduce domain-centric certificate provisioning with per-domain exponential backoff and a staggered serial scheduler; add domain-based reprovision API and UI backoff display; change certificate overview API to be domain-first and include backoff info; bump related deps.

ts/opsserver/handlers/certificate.handler.ts

@@ -23,24 +23,45 @@ export class CertificateHandler {
       )
     );
 
-    // Reprovision Certificate
+    // Legacy route-based reprovision (backward compat)
     this.typedrouter.addTypedHandler(
       new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ReprovisionCertificate>(
         'reprovisionCertificate',
         async (dataArg) => {
-          return this.reprovisionCertificate(dataArg.routeName);
+          return this.reprovisionCertificateByRoute(dataArg.routeName);
+        }
+      )
+    );
+
+    // Domain-based reprovision (preferred)
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ReprovisionCertificateDomain>(
+        'reprovisionCertificateDomain',
+        async (dataArg) => {
+          return this.reprovisionCertificateDomain(dataArg.domain);
         }
       )
     );
   }
 
+  /**
+   * Build domain-centric certificate overview.
+   * Instead of one row per route, we produce one row per unique domain.
+   */
   private async buildCertificateOverview(): Promise<interfaces.requests.ICertificateInfo[]> {
     const dcRouter = this.opsServerRef.dcRouterRef;
     const smartProxy = dcRouter.smartProxy;
     if (!smartProxy) return [];
 
     const routes = smartProxy.routeManager.getRoutes();
-    const certificates: interfaces.requests.ICertificateInfo[] = [];
+
+    // Phase 1: Collect unique domains with their associated route info
+    const domainMap = new Map<string, {
+      routeNames: string[];
+      source: interfaces.requests.TCertificateSource;
+      tlsMode: 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
+      canReprovision: boolean;
+    }>();
 
     for (const route of routes) {
       if (!route.name) continue;
@@ -58,7 +79,6 @@ export class CertificateHandler {
       // Determine source
       let source: interfaces.requests.TCertificateSource = 'none';
       if (tls.certificate === 'auto') {
-        // Check if a certProvisionFunction is configured
         if ((smartProxy.settings as any).certProvisionFunction) {
           source = 'provision-function';
         } else {
@@ -68,15 +88,44 @@ export class CertificateHandler {
         source = 'static';
       }
 
-      // Start with unknown status
+      const canReprovision = source === 'acme' || source === 'provision-function';
+      const tlsMode = tls.mode as 'terminate' | 'terminate-and-reencrypt' | 'passthrough';
+
+      for (const domain of routeDomains) {
+        const existing = domainMap.get(domain);
+        if (existing) {
+          // Add this route name to the existing domain entry
+          if (!existing.routeNames.includes(route.name)) {
+            existing.routeNames.push(route.name);
+          }
+          // Upgrade source if more specific
+          if (existing.source === 'none' && source !== 'none') {
+            existing.source = source;
+            existing.canReprovision = canReprovision;
+          }
+        } else {
+          domainMap.set(domain, {
+            routeNames: [route.name],
+            source,
+            tlsMode,
+            canReprovision,
+          });
+        }
+      }
+    }
+
+    // Phase 2: Resolve status for each unique domain
+    const certificates: interfaces.requests.ICertificateInfo[] = [];
+
+    for (const [domain, info] of domainMap) {
       let status: interfaces.requests.TCertificateStatus = 'unknown';
       let expiryDate: string | undefined;
       let issuedAt: string | undefined;
       let issuer: string | undefined;
       let error: string | undefined;
 
-      // Check event-based status from DcRouter's certificateStatusMap
-      const eventStatus = dcRouter.certificateStatusMap.get(route.name);
+      // Check event-based status from certificateStatusMap (now keyed by domain)
+      const eventStatus = dcRouter.certificateStatusMap.get(domain);
       if (eventStatus) {
         status = eventStatus.status;
         expiryDate = eventStatus.expiryDate;
@@ -87,10 +136,10 @@ export class CertificateHandler {
         }
       }
 
-      // Try Rust-side certificate status if no event data
-      if (status === 'unknown') {
+      // Try SmartProxy certificate status if no event data
+      if (status === 'unknown' && info.routeNames.length > 0) {
         try {
-          const rustStatus = await smartProxy.getCertificateStatus(route.name);
+          const rustStatus = await smartProxy.getCertificateStatus(info.routeNames[0]);
           if (rustStatus) {
             if (rustStatus.expiryDate) expiryDate = rustStatus.expiryDate;
             if (rustStatus.issuer) issuer = rustStatus.issuer;
@@ -105,22 +154,19 @@ export class CertificateHandler {
       }
 
       // Check persisted cert data from StorageManager
-      if (status === 'unknown' && routeDomains.length > 0) {
-        for (const domain of routeDomains) {
-          if (expiryDate) break;
-          const cleanDomain = domain.replace(/^\*\.?/, '');
-          const certData = await dcRouter.storageManager.getJSON(`/certs/${cleanDomain}`);
-          if (certData?.validUntil) {
-            expiryDate = new Date(certData.validUntil).toISOString();
-            if (certData.created) {
-              issuedAt = new Date(certData.created).toISOString();
-            }
-            issuer = 'smartacme-dns-01';
+      if (status === 'unknown') {
+        const cleanDomain = domain.replace(/^\*\.?/, '');
+        const certData = await dcRouter.storageManager.getJSON(`/certs/${cleanDomain}`);
+        if (certData?.validUntil) {
+          expiryDate = new Date(certData.validUntil).toISOString();
+          if (certData.created) {
+            issuedAt = new Date(certData.created).toISOString();
           }
+          issuer = 'smartacme-dns-01';
         }
       }
 
-      // Compute status from expiry date if we have one and status is still valid/unknown
+      // Compute status from expiry date
       if (expiryDate && (status === 'valid' || status === 'unknown')) {
         const expiry = new Date(expiryDate);
         const now = new Date();
@@ -136,28 +182,36 @@ export class CertificateHandler {
       }
 
       // Static certs with no other info default to 'valid'
-      if (source === 'static' && status === 'unknown') {
+      if (info.source === 'static' && status === 'unknown') {
         status = 'valid';
       }
 
       // ACME/provision-function routes with no cert data are still provisioning
-      if (status === 'unknown' && (source === 'acme' || source === 'provision-function')) {
+      if (status === 'unknown' && (info.source === 'acme' || info.source === 'provision-function')) {
         status = 'provisioning';
       }
 
-      const canReprovision = source === 'acme' || source === 'provision-function';
+      // Phase 3: Attach backoff info
+      let backoffInfo: interfaces.requests.ICertificateInfo['backoffInfo'];
+      if (dcRouter.certProvisionScheduler) {
+        const bi = await dcRouter.certProvisionScheduler.getBackoffInfo(domain);
+        if (bi) {
+          backoffInfo = bi;
+        }
+      }
 
       certificates.push({
-        routeName: route.name,
-        domains: routeDomains,
+        domain,
+        routeNames: info.routeNames,
         status,
-        source,
-        tlsMode: tls.mode as 'terminate' | 'terminate-and-reencrypt' | 'passthrough',
+        source: info.source,
+        tlsMode: info.tlsMode,
         expiryDate,
         issuer,
         issuedAt,
         error,
-        canReprovision,
+        canReprovision: info.canReprovision,
+        backoffInfo,
       });
     }
 
@@ -187,7 +241,10 @@ export class CertificateHandler {
     return summary;
   }
 
-  private async reprovisionCertificate(routeName: string): Promise<{ success: boolean; message?: string }> {
+  /**
+   * Legacy route-based reprovisioning
+   */
+  private async reprovisionCertificateByRoute(routeName: string): Promise<{ success: boolean; message?: string }> {
     const dcRouter = this.opsServerRef.dcRouterRef;
     const smartProxy = dcRouter.smartProxy;
 
@@ -197,11 +254,58 @@ export class CertificateHandler {
 
     try {
       await smartProxy.provisionCertificate(routeName);
-      // Clear event-based status so it gets refreshed
-      dcRouter.certificateStatusMap.delete(routeName);
+      // Clear event-based status for domains in this route
+      for (const [domain, entry] of dcRouter.certificateStatusMap) {
+        if (entry.routeNames.includes(routeName)) {
+          dcRouter.certificateStatusMap.delete(domain);
+        }
+      }
       return { success: true, message: `Certificate reprovisioning triggered for route '${routeName}'` };
     } catch (err) {
       return { success: false, message: err.message || 'Failed to reprovision certificate' };
     }
   }
+
+  /**
+   * Domain-based reprovisioning — clears backoff first, then triggers provision
+   */
+  private async reprovisionCertificateDomain(domain: string): Promise<{ success: boolean; message?: string }> {
+    const dcRouter = this.opsServerRef.dcRouterRef;
+    const smartProxy = dcRouter.smartProxy;
+
+    if (!smartProxy) {
+      return { success: false, message: 'SmartProxy is not running' };
+    }
+
+    // Clear backoff for this domain (user override)
+    if (dcRouter.certProvisionScheduler) {
+      await dcRouter.certProvisionScheduler.clearBackoff(domain);
+    }
+
+    // Clear status map entry so it gets refreshed
+    dcRouter.certificateStatusMap.delete(domain);
+
+    // Try to provision via SmartAcme directly
+    if (dcRouter.smartAcme) {
+      try {
+        await dcRouter.smartAcme.getCertificateForDomain(domain);
+        return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}'` };
+      } catch (err) {
+        return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
+      }
+    }
+
+    // Fallback: try provisioning via the first matching route
+    const routeNames = dcRouter.findRouteNamesForDomain(domain);
+    if (routeNames.length > 0) {
+      try {
+        await smartProxy.provisionCertificate(routeNames[0]);
+        return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}' via route '${routeNames[0]}'` };
+      } catch (err) {
+        return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
+      }
+    }
+
+    return { success: false, message: `No routes found for domain '${domain}'` };
+  }
 }