Port 1.2.0 product rename and fixes onto DNS plugin support (release-2.0)

cscglobal-caplugin.Tests/CSCGlobalCAPluginTests.cs

@@ -758,10 +758,19 @@ public void GetTemplateParameterAnnotations_ReturnsExpectedKeys()
     }
 
     [Fact]
-    public void GetProductIds_ReturnsCanonicalTenProducts()
+    public void GetProductIds_ReturnsCanonicalAndLegacyNames()
     {
         var plugin = MakePlugin();
-        Assert.Equal(10, plugin.GetProductIds().Count);
+        var ids = plugin.GetProductIds();
+
+        // Command uses this list to auto-resolve a CA for a template when none is explicitly
+        // selected, so pre-1.2.0 legacy-named templates need their names advertised here too,
+        // not just the 10 canonical names.
+        Assert.Equal(17, ids.Count);
+        Assert.Contains("CSC TrustedSecure OV", ids);
+        Assert.Contains("CSC TrustedSecure DV Wildcard, Multiple Names", ids);
+        Assert.Contains("CSC TrustedSecure EV Certificate", ids);
+        Assert.Contains("CSC TrustedSecure Domain Validated SSL", ids);
     }
 
     // ---------------------------------------------------------------------

cscglobal-caplugin/Client/CscGlobalClient.cs

@@ -22,6 +22,12 @@ public sealed class CscGlobalClient : ICscGlobalClient
     private readonly ILogger Logger;
 
     public CscGlobalClient(IAnyCAPluginConfigProvider config) : this(config, null)
+    {
+    }
+
+    // internal so the test project can supply a fake HttpMessageHandler via
+    // InternalsVisibleTo, instead of the client making real HTTP calls in unit tests.
+    internal CscGlobalClient(IAnyCAPluginConfigProvider config, HttpMessageHandler? handler)
     {
         Logger = LogHandler.GetClassLogger<CscGlobalClient>();
 
@@ -68,7 +74,7 @@ public CscGlobalClient(IAnyCAPluginConfigProvider config) : this(config, null)
             }
             Logger.LogTrace("CscGlobalClient: BearerToken is present (length={Length}).", Authorization.Length);
 
-            RestClient = ConfigureRestClient();
+            RestClient = ConfigureRestClient(handler);
             Logger.LogTrace("CscGlobalClient: RestClient configured successfully.");
         }
         else

cscglobal-caplugin/Constants.cs

@@ -23,14 +23,31 @@ public class ProductIDs
 {
     public static List<String> productIds = new List<string>()
     {
-        "CSC TrustedSecure Premium Certificate",
-        "CSC TrustedSecure EV Certificate",
-        "CSC TrustedSecure UC Certificate",
-        "CSC TrustedSecure Premium Wildcard Certificate",
-        "CSC TrustedSecure Domain Validated SSL",
-        "CSC Trusted Secure Domain Validated Wildcard SSL",
-        "CSC Trusted Secure Domain Validated UC Certificate"
+        "CSC TrustedSecure OV",
+        "CSC TrustedSecure OV Wildcard",
+        "CSC TrustedSecure OV, Multiple Names",
+        "CSC TrustedSecure EV",
+        "CSC TrustedSecure DV",
+        "CSC TrustedSecure DV Wildcard",
+        "CSC TrustedSecure DV, Multiple Names",
+        "CSC TrustedSecure EV, Multiple Names",
+        "CSC TrustedSecure OV Wildcard, Multiple Names",
+        "CSC TrustedSecure DV Wildcard, Multiple Names"
     };
+
+    // Pre-1.2.0 template names. Existing Certificate Templates in Command may still
+    // reference these, so they're accepted as aliases for their canonical replacement.
+    public static Dictionary<string, string> legacyProductIdAliases =
+        new(StringComparer.InvariantCultureIgnoreCase)
+        {
+            ["CSC TrustedSecure Premium Certificate"] = "CSC TrustedSecure OV",
+            ["CSC TrustedSecure Premium Wildcard Certificate"] = "CSC TrustedSecure OV Wildcard",
+            ["CSC TrustedSecure UC Certificate"] = "CSC TrustedSecure OV, Multiple Names",
+            ["CSC TrustedSecure EV Certificate"] = "CSC TrustedSecure EV",
+            ["CSC TrustedSecure Domain Validated SSL"] = "CSC TrustedSecure DV",
+            ["CSC Trusted Secure Domain Validated Wildcard SSL"] = "CSC TrustedSecure DV Wildcard",
+            ["CSC Trusted Secure Domain Validated UC Certificate"] = "CSC TrustedSecure DV, Multiple Names"
+        };
 }
 
 public class EnrollmentConfigConstants

cscglobal-caplugin/FlowLogger.cs

@@ -55,7 +55,7 @@
     }
 
     /// <summary>Record a completed step.</summary>
     public FlowLogger Step(string name, string detail = null)
     {
         var step = new FlowStep { Name = name, Status = FlowStepStatus.Success, Detail = detail };
         AddStep(step);
@@ -65,7 +65,7 @@
     }
 
     /// <summary>Record a step that executes an action and times it.</summary>
     public FlowLogger Step(string name, Action action, string detail = null)
     {
         var sw = Stopwatch.StartNew();
         var step = new FlowStep { Name = name, Detail = detail };
@@ -95,7 +95,7 @@
     }
 
     /// <summary>Record an async step that executes and times it.</summary>
     public async Task<FlowLogger> StepAsync(string name, Func<Task> action, string detail = null)
     {
         var sw = Stopwatch.StartNew();
         var step = new FlowStep { Name = name, Detail = detail };
@@ -124,8 +124,44 @@
         return this;
     }
 
+    /// <summary>
+    ///     Record an async step whose own return value becomes the step's detail - unlike the
+    ///     <paramref name="detail" /> parameter on the other overload (which is evaluated before
+    ///     the action runs and so can't reflect anything the action decided), this reflects what
+    ///     actually happened during execution (e.g. why a conditional step was a no-op).
+    /// </summary>
+    public async Task<FlowLogger> StepAsync(string name, Func<Task<string>> action)
+    {
+        var sw = Stopwatch.StartNew();
+        var step = new FlowStep { Name = name };
+        try
+        {
+            _logger.LogTrace("  [{FlowName}] {StepName} ...", _flowName, name);
+            var detail = await action();
+            sw.Stop();
+            step.Status = FlowStepStatus.Success;
+            step.ElapsedMs = sw.ElapsedMilliseconds;
+            step.Detail = detail;
+            AddStep(step);
+            _logger.LogTrace("  [{FlowName}] {StepName} ... OK ({Elapsed}ms){Detail}",
+                _flowName, name, sw.ElapsedMilliseconds, detail != null ? $" {detail}" : "");
+        }
+        catch (Exception ex)
+        {
+            sw.Stop();
+            step.Status = FlowStepStatus.Failed;
+            step.ElapsedMs = sw.ElapsedMilliseconds;
+            step.Detail = ex.Message;
+            AddStep(step);
+            _logger.LogTrace("  [{FlowName}] {StepName} ... FAILED ({Elapsed}ms): {Error}",
+                _flowName, name, sw.ElapsedMilliseconds, ex.Message);
+            throw;
+        }
+        return this;
+    }
+
     /// <summary>Record a failed step without throwing.</summary>
     public FlowLogger Fail(string name, string reason = null)
     {
         var step = new FlowStep { Name = name, Status = FlowStepStatus.Failed, Detail = reason };
         AddStep(step);
@@ -135,7 +171,7 @@
     }
 
     /// <summary>Record a skipped step.</summary>
     public FlowLogger Skip(string name, string reason = null)
     {
         var step = new FlowStep { Name = name, Status = FlowStepStatus.Skipped, Detail = reason };
         AddStep(step);
@@ -219,6 +255,86 @@
         return sb.ToString();
     }
 
+    /// <summary>
+    ///     Concise step-by-step summary suitable for surfacing in a user-facing failure message
+    ///     (unlike <see cref="RenderFlow" />'s ASCII-art tree, which is meant for Trace logs only).
+    /// </summary>
+    public string GetSummary()
+    {
+        var hasFailures = _steps.Any(s => s.Status == FlowStepStatus.Failed) ||
+            _steps.SelectMany(s => s.Children).Any(c => c.Status == FlowStepStatus.Failed);
+        var overallStatus = hasFailures ? "FAILED" : "OK";
+
+        var sb = new StringBuilder();
+        sb.AppendLine($"Flow: {_flowName}  [{overallStatus}]  Total: {_totalTimer.ElapsedMilliseconds}ms");
+        sb.AppendLine("----------------------------------------");
+
+        foreach (var step in _steps)
+        {
+            AppendSummaryLine(sb, step, 0);
+            foreach (var child in step.Children)
+                AppendSummaryLine(sb, child, 1);
+        }
+
+        return sb.ToString();
+    }
+
+    private static void AppendSummaryLine(StringBuilder sb, FlowStep step, int indentLevel)
+    {
+        var indent = new string(' ', indentLevel * 2);
+        var icon = GetStatusIcon(step.Status);
+        var elapsed = step.ElapsedMs > 0 ? $" ({step.ElapsedMs}ms)" : "";
+        var detail = !string.IsNullOrEmpty(step.Detail) ? $" - {step.Detail}" : "";
+        sb.AppendLine($"{indent}{icon} {step.Name}{elapsed}{detail}");
+    }
+
+    /// <summary>
+    ///     Same information as <see cref="GetSummary" />, but as one entry per step instead of a
+    ///     single multi-line block. Intended for callers (e.g. EnrollmentResult.EnrollmentContext)
+    ///     whose rendering surface displays a dictionary as a bulleted list and doesn't respect
+    ///     embedded newlines - each step becomes its own bullet instead of one run-on line.
+    /// </summary>
+    public Dictionary<string, string> GetSummaryEntries()
+    {
+        var allSteps = _steps.Concat(_steps.SelectMany(s => s.Children)).ToList();
+        var hasFailures = allSteps.Any(s => s.Status == FlowStepStatus.Failed);
+        var overallStatus = hasFailures ? "FAILED" : "OK";
+        var succeeded = allSteps.Count(s => s.Status == FlowStepStatus.Success);
+        var failed = allSteps.Count(s => s.Status == FlowStepStatus.Failed);
+        var skipped = allSteps.Count(s => s.Status == FlowStepStatus.Skipped);
+
+        var entries = new Dictionary<string, string>
+        {
+            [$"Flow: {_flowName}"] =
+                $"[{overallStatus}] {_totalTimer.ElapsedMilliseconds}ms total - " +
+                $"{allSteps.Count} steps ({succeeded} ok, {failed} failed, {skipped} skipped)"
+        };
+
+        var stepNumber = 0;
+        foreach (var step in _steps)
+        {
+            stepNumber++;
+            AddSummaryEntry(entries, step, stepNumber, false);
+
+            foreach (var child in step.Children)
+            {
+                stepNumber++;
+                AddSummaryEntry(entries, child, stepNumber, true);
+            }
+        }
+
+        return entries;
+    }
+
+    private static void AddSummaryEntry(Dictionary<string, string> entries, FlowStep step, int stepNumber, bool indent)
+    {
+        var icon = GetStatusIcon(step.Status);
+        var time = step.ElapsedMs > 0 ? $" ({step.ElapsedMs}ms)" : "";
+        var detail = !string.IsNullOrEmpty(step.Detail) ? $" - {step.Detail}" : "";
+        var prefix = indent ? "  " : "";
+        entries[$"Flow Step {stepNumber:00}: {prefix}{step.Name}"] = $"{icon}{time}{detail}";
+    }
+
     private static string GetStatusIcon(FlowStepStatus status)
     {
         return status switch

cscglobal-caplugin/RequestManager.cs

@@ -388,55 +388,39 @@ public RegistrationRequest GetRegistrationRequest(EnrollmentProductInfo productI
         };
     }
 
-    // Maps Keyfactor product ID -> CSC API certificate type code (used for enrollment requests)
+    // Maps Keyfactor product ID -> CSC API certificate type code (used for enrollment requests).
+    // Each product has an entry for its current (1.2.0+) canonical name and its pre-1.2.0 legacy
+    // name, so existing Certificate Templates in Command using the old names keep working.
+    // Types 7/8/9 are new in 1.2.0 and have no legacy name.
     private static readonly Dictionary<string, string> ProductIdToCodeMap = new(StringComparer.OrdinalIgnoreCase)
     {
+        ["CSC TrustedSecure OV"] = "0",
         ["CSC TrustedSecure Premium Certificate"] = "0",
+        ["CSC TrustedSecure OV Wildcard"] = "1",
         ["CSC TrustedSecure Premium Wildcard Certificate"] = "1",
+        ["CSC TrustedSecure OV, Multiple Names"] = "2",
         ["CSC TrustedSecure UC Certificate"] = "2",
+        ["CSC TrustedSecure EV"] = "3",
         ["CSC TrustedSecure EV Certificate"] = "3",
+        ["CSC TrustedSecure DV"] = "4",
         ["CSC TrustedSecure Domain Validated SSL"] = "4",
         ["CSC Trusted Secure Domain Validated SSL"] = "4",
+        ["CSC TrustedSecure DV Wildcard"] = "5",
         ["CSC Trusted Secure Domain Validated Wildcard SSL"] = "5",
+        ["CSC TrustedSecure DV, Multiple Names"] = "6",
         ["CSC Trusted Secure Domain Validated UC Certificate"] = "6",
+        ["CSC TrustedSecure EV, Multiple Names"] = "7",
+        ["CSC TrustedSecure OV Wildcard, Multiple Names"] = "8",
+        ["CSC TrustedSecure DV Wildcard, Multiple Names"] = "9",
     };
 
-    // Reverse map: CSC API certificateType string -> Keyfactor product ID (used during sync)
-    // Note: CSC naming is inconsistent — first 4 types use "TrustedSecure" (no space),
-    //       DV Wildcard and DV UC use "Trusted Secure" (with space),
-    //       but CSC API returns DV SSL as "CSC Trusted Secure Domain Validated SSL" (with space)
-    //       while the product ID is "CSC TrustedSecure Domain Validated SSL" (no space).
-    private static readonly Dictionary<string, string> CodeToProductIdMap = new(StringComparer.OrdinalIgnoreCase)
-    {
-        // Premium
-        ["0"] = "CSC TrustedSecure Premium Certificate",
-        ["CSC TrustedSecure Premium Certificate"] = "CSC TrustedSecure Premium Certificate",
-        ["CSC Trusted Secure Premium Certificate"] = "CSC TrustedSecure Premium Certificate",
-        // Premium Wildcard
-        ["1"] = "CSC TrustedSecure Premium Wildcard Certificate",
-        ["CSC TrustedSecure Premium Wildcard Certificate"] = "CSC TrustedSecure Premium Wildcard Certificate",
-        ["CSC Trusted Secure Premium Wildcard Certificate"] = "CSC TrustedSecure Premium Wildcard Certificate",
-        // UC
-        ["2"] = "CSC TrustedSecure UC Certificate",
-        ["CSC TrustedSecure UC Certificate"] = "CSC TrustedSecure UC Certificate",
-        ["CSC Trusted Secure UC Certificate"] = "CSC TrustedSecure UC Certificate",
-        // EV
-        ["3"] = "CSC TrustedSecure EV Certificate",
-        ["CSC TrustedSecure EV Certificate"] = "CSC TrustedSecure EV Certificate",
-        ["CSC Trusted Secure EV Certificate"] = "CSC TrustedSecure EV Certificate",
-        // DV SSL — product ID has no space, but CSC API returns with space
-        ["4"] = "CSC TrustedSecure Domain Validated SSL",
-        ["CSC TrustedSecure Domain Validated SSL"] = "CSC TrustedSecure Domain Validated SSL",
-        ["CSC Trusted Secure Domain Validated SSL"] = "CSC TrustedSecure Domain Validated SSL",
-        // DV Wildcard — product ID has space (matches CSC API)
-        ["5"] = "CSC Trusted Secure Domain Validated Wildcard SSL",
-        ["CSC Trusted Secure Domain Validated Wildcard SSL"] = "CSC Trusted Secure Domain Validated Wildcard SSL",
-        ["CSC TrustedSecure Domain Validated Wildcard SSL"] = "CSC Trusted Secure Domain Validated Wildcard SSL",
-        // DV UC — product ID has space (matches CSC API)
-        ["6"] = "CSC Trusted Secure Domain Validated UC Certificate",
-        ["CSC Trusted Secure Domain Validated UC Certificate"] = "CSC Trusted Secure Domain Validated UC Certificate",
-        ["CSC TrustedSecure Domain Validated UC Certificate"] = "CSC Trusted Secure Domain Validated UC Certificate",
-    };
+    /// <summary>
+    ///     True if productId resolves to a known CSC certificate type - either its canonical
+    ///     (1.2.0+) name or a pre-1.2.0 legacy name. Used by ValidateProductInfo so the list of
+    ///     accepted names can't drift out of sync with what GetCertificateType actually resolves.
+    /// </summary>
+    public bool IsKnownProductId(string productId) =>
+        !string.IsNullOrEmpty(productId) && ProductIdToCodeMap.ContainsKey(productId);
 
     private string GetCertificateType(string productId)
     {
@@ -450,22 +434,6 @@ private string GetCertificateType(string productId)
         return "-1";
     }
 
-    /// <summary>
-    ///     Maps a CSC API certificateType value back to a Keyfactor product ID.
-    ///     Handles numeric codes, descriptive strings, and passthrough of already-correct values.
-    /// </summary>
-    public string MapCertificateTypeToProductId(string cscCertificateType)
-    {
-        Logger.LogTrace("MapCertificateTypeToProductId: input='{CscCertType}'", cscCertificateType ?? "(null)");
-        if (!string.IsNullOrEmpty(cscCertificateType) && CodeToProductIdMap.TryGetValue(cscCertificateType, out var productId))
-        {
-            Logger.LogTrace("MapCertificateTypeToProductId: mapped '{CscCertType}' -> '{ProductId}'", cscCertificateType, productId);
-            return productId;
-        }
-        Logger.LogWarning("MapCertificateTypeToProductId: no mapping for '{CscCertType}', passing through as-is.", cscCertificateType);
-        return cscCertificateType ?? "CscGlobal";
-    }
-
     public Notifications GetNotifications(EnrollmentProductInfo productInfo)
     {
         Logger.LogTrace("GetNotifications: building notifications.");
@@ -561,6 +529,14 @@ private List<SubjectAlternativeName> GetSubjectAlternativeNames(EnrollmentProduc
             ? productInfo.ProductParameters["Domain Control Validation Method"]
             : null;
 
+        // CSC Global rejects the request if any subjectAlternativeNames entry is missing
+        // domainControlValidation, so every SAN below must resolve to a non-null value - falling
+        // back to the primary CN's DCV email when no per-domain override matches.
+        var commonNameValidationEmail = productInfo?.ProductParameters != null
+            && productInfo.ProductParameters.ContainsKey(EnrollmentConfigConstants.CnDcvEmail)
+            ? productInfo.ProductParameters[EnrollmentConfigConstants.CnDcvEmail]
+            : null;
+
         Logger.LogTrace("GetSubjectAlternativeNames: processing {Count} DNS names, methodType='{MethodType}'",
             dnsNames.Length, methodType ?? "(null)");
 
@@ -579,18 +555,19 @@ private List<SubjectAlternativeName> GetSubjectAlternativeNames(EnrollmentProduc
 
             if (!string.IsNullOrEmpty(methodType) && methodType.ToUpper() == "EMAIL")
             {
-                var emailsRaw = productInfo.ProductParameters.ContainsKey("Addtl Sans Comma Separated DVC Emails")
-                    ? productInfo.ProductParameters["Addtl Sans Comma Separated DVC Emails"]
+                var emailsRaw = productInfo.ProductParameters.ContainsKey(EnrollmentConfigConstants.AdditionalSansCommaSeparatedDcvEmails)
+                    ? productInfo.ProductParameters[EnrollmentConfigConstants.AdditionalSansCommaSeparatedDcvEmails]
                     : null;
                 var emailAddresses = !string.IsNullOrEmpty(emailsRaw) ? emailsRaw.Split(',') : Array.Empty<string>();
                 Logger.LogTrace("GetSubjectAlternativeNames: EMAIL validation, {Count} email addresses for domain='{Domain}'",
                     emailAddresses.Length, domainName);
-                san.DomainControlValidation = GetDomainControlValidation(methodType, emailAddresses, domainName);
+                san.DomainControlValidation = GetDomainControlValidation(methodType, emailAddresses, domainName)
+                    ?? GetDomainControlValidation(methodType, commonNameValidationEmail);
             }
             else
             {
                 Logger.LogTrace("GetSubjectAlternativeNames: CNAME/other validation for domain='{Domain}'", domainName);
-                san.DomainControlValidation = GetDomainControlValidation(methodType, "");
+                san.DomainControlValidation = GetDomainControlValidation(methodType, commonNameValidationEmail);
             }
 
             subjectNameList.Add(san);

integration-manifest.json

@@ -94,6 +94,16 @@
                 }
             ],
             "product_ids": [
+                "CSC TrustedSecure OV",
+                "CSC TrustedSecure OV Wildcard",
+                "CSC TrustedSecure OV, Multiple Names",
+                "CSC TrustedSecure EV",
+                "CSC TrustedSecure DV",
+                "CSC TrustedSecure DV Wildcard",
+                "CSC TrustedSecure DV, Multiple Names",
+                "CSC TrustedSecure EV, Multiple Names",
+                "CSC TrustedSecure OV Wildcard, Multiple Names",
+                "CSC TrustedSecure DV Wildcard, Multiple Names",
                 "CSC TrustedSecure Premium Certificate",
                 "CSC TrustedSecure EV Certificate",
                 "CSC TrustedSecure UC Certificate",
@@ -104,4 +114,4 @@
             ]
         }
     }
-}
+}