oriolrius/pki-manager-web v3.2.0

v3.2.0 — SSH REST API parity (principals + revocation/KRL)

on GitHub

v3.2.0 — SSH REST API parity (principals + revocation/KRL)

Completes the /api/v1/ssh REST surface so the entire SSH certificate lifecycle —
including the emergency kill switch — can be driven over REST, without falling back to
tRPC. All new endpoints delegate to the existing services (no behavior change) and are
covered by integration tests.

Added — Principals (RBAC catalog + host mapping)

• GET /api/v1/ssh/principals — list roles
• POST /api/v1/ssh/principals — create a role
• POST /api/v1/ssh/principals/map — map a principal to a local account on a host
• GET /api/v1/ssh/hosts/:id/auth-principals — render the AuthorizedPrincipalsFile

Added — Revocation / KRL

• POST /api/v1/ssh/certs/:id/revoke — revoke a certificate (rebuilds the CA KRL)
• POST /api/v1/ssh/cas/:caId/krl — generate / rebuild the KRL
• GET /api/v1/ssh/cas/:caId/revocations — list revocations
• GET /api/v1/ssh/cas/:caId/krl.bin — the bare KRL bytes (the RevokedKeys file a
  server consumes), lazily (re)built with a last‑good fallback

The revocation test issues a user cert, revokes it, lists the revocation, fetches the KRL
bytes, and confirms ssh-keygen -Q reports the cert REVOKED.

Docker images

• ghcr.io/oriolrius/pki-manager-web/backend:3.2.0
• ghcr.io/oriolrius/pki-manager-web/frontend:3.2.0

Full changelog: v3.1.0...v3.2.0