Kyle Isom a5bb366558 Allow system accounts to issue certificates ...

Service tokens from MCIAS have account_type "system" but no roles.
Thread AccountType through CallerInfo and treat system accounts as
users for certificate issuance. This allows services to request
their own TLS certificates without admin credentials.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-25 20:07:22 -07:00

..

acme.go

Add grpcserver test coverage

2026-03-15 13:07:42 -07:00

auth.go

Migrate db, auth to mcdsl; remove mcias client dependency

2026-03-25 18:42:43 -07:00

barrier.go

Add MEK rotation, per-engine DEKs, and v2 ciphertext format (audit #6, #22)

2026-03-16 18:27:44 -07:00

ca.go

Allow system accounts to issue certificates

2026-03-25 20:07:22 -07:00

engine.go

Fix ECDH zeroization, add audit logging, and remediate high findings

2026-03-17 14:04:39 -07:00

grpcserver_test.go

Migrate db, auth to mcdsl; remove mcias client dependency

2026-03-25 18:42:43 -07:00

interceptors.go

Fix ECDH zeroization, add audit logging, and remediate high findings

2026-03-17 14:04:39 -07:00

pki.go

Add CRL endpoint, sign-CSR web route, and policy-based issuance authorization

2026-03-16 15:22:04 -07:00

policy.go

Add audit logging for all mutating gRPC operations

2026-03-15 13:11:17 -07:00

server.go

Fix ECDH zeroization, add audit logging, and remediate high findings

2026-03-17 14:04:39 -07:00

sshca.go

Add SSH CA engine with host/user cert signing, profiles, and KRL

2026-03-16 19:43:32 -07:00

system.go

Add audit logging for all mutating gRPC operations

2026-03-15 13:11:17 -07:00

transit.go

Implement transit encryption engine with versioned key management

2026-03-16 19:45:56 -07:00

user.go

Add user-to-user encryption engine with ECDH key exchange and AES-256-GCM

2026-03-16 19:44:11 -07:00