Skip to content

fix: promote certificate validity dates to signer root - #8039

Open
rodrigodev wants to merge 1 commit into
LibreSign:mainfrom
rodrigodev:fix/signer-expiration-7825
Open

fix: promote certificate validity dates to signer root#8039
rodrigodev wants to merge 1 commit into
LibreSign:mainfrom
rodrigodev:fix/signer-expiration-7825

Conversation

@rodrigodev

Copy link
Copy Markdown
Contributor

Fixes #7825

Problem

On the document validation panel, every signer shows "No expiration date" even though the signer's leaf certificate carries a valid notAfter.

Root cause

The Apr-2026 refactor that extracted CertificateSignersMergeService::processChainData() stopped promoting the end-entity (leaf) certificate's valid_from/valid_to to the top-level signer object. Before that refactor, SignersLoader merged chain[0]'s fields into the signer root via array_merge.

The validation UI (src/components/validation/SignerDetails.vue) and the SignerDetail OpenAPI schema both read valid_from/valid_to from the signer root, so the panel always rendered "No expiration date".

A unit test (testLoadSignersFromCertDataPreventsDuplicateFormattedDates) had accidentally codified the buggy behavior by asserting root-level valid_to should be absent — contradicting the existing contract from Oct-2025 (FileServiceTest + OpenAPI).

Fix

  • CertificateSignersMergeService::processChainData(): promote the ISO UTC valid_from/valid_to from chain[0] to the signer root. The chain still carries the full per-certificate dates for the certificate-chain view.
  • Tests:
    • New regression test testMergePromotesLeafCertValidityDatesToSignerRoot.
    • Updated testLoadSignersFromCertDataPreventsDuplicateFormattedDates to assert the corrected contract (ISO dates present at root, locale-formatted backend strings and technical fields still excluded).
    • Behat: tests/integration/features/file/validate.feature now asserts valid_from/valid_to on signers[0] of the validate endpoint response.

Validation

  • Full PHPUnit suite: 3518 tests / 8564 assertions OK (run before any behat/environment activity)
  • Focused suites for the changed area pass (31 tests / 117 assertions)
  • php -l, php-cs-fixer dry-run, psalm (no errors)
  • Behat feature not executed locally (dev-container PHP built-in server + memcache limitation documented in AGENTS.md); the added jq assertion matches the established test() pattern used in page/index.feature

The certificate signers merge service stopped promoting the end-entity
certificate validity dates (valid_from/valid_to) to the top-level signer
object. The validation panel and the SignerDetail API contract read these
fields from the signer root, so the panel always showed "No expiration
date" even though the leaf certificate carries a valid notAfter.

Restore the promotion of the ISO UTC validity dates from chain[0] to the
signer root, as the pre-refactor logic did. Update the SignersLoader test
that had codified the buggy behavior and add a regression test covering
the merged contract.

Signed-off-by: r.carneiro <rodrigo.carneiro.dev@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 0. Backlog

Development

Successfully merging this pull request may close these issues.

Signer expiration shows "No expiration date" although notAfter is present in the embedded certificate chain

1 participant