Track which CA signed each device certificate (#3024)

A device certificate names its signer by key id:
`device_certificates.aki` holds the CA's `ski`. There's no foreign key,
and nothing in the UI followed that link. Opening a device told you it
had a certificate but not who signed it, and the Certificate Authorities
list gave no way to tell a signer with a fleet behind it from one
nothing uses.

Closes #659

## Device settings

Each certificate now shows `Signer CA:` alongside its serial and
validity, linking to the CA.

The lookup is scoped to the device's org, so a certificate signed by
another org's CA reads "Unknown" rather than exposing that CA.
Certificates whose signer was never registered read "Unknown" too. That
includes the NervesHubCA-signed certificates the AKI validation lets
through from other orgs.

## A show page for a CA

There wasn't one. The only per-CA page was the edit form, whose save is
gated on `certificate_authority:update`, so it's the wrong place to send
a viewer who just wants to look.
`/org/:org/settings/certificates/:serial` shows the CA's details and a
Devices card: the total, then a row per product linking to that
product's device list filtered by this CA.

The device list is scoped to one product and a CA is scoped to the org,
so per-product rows are the only shape a working link can take.

The list page loses its per-row Edit and Delete buttons and the `Check
expiration?` / `JITP Enabled?` columns; the serial links to the show
page, and Delete lives there now. It gains a Devices count.

## Filtering

A `Signer CA` select in the device list sidebar, built from the CAs that
signed a certificate held by a device in this product. That's the same
treatment the firmware version filter got in #3020, and it carries the
same kind of hint tooltip explaining why a CA you expected might be
missing. A "No known CA" option covers shared secret devices and
unregistered signers.

It goes through the same filter map as every other sidebar filter, so
`filters[signer_ca]` works on the device list API. There's a matching
`signer_ca` advanced query column supporting `=` and `!=`:

```
signer_ca = "613033017807900175"
signer_ca != ":not_set" and connection = "connected"
```

Autosuggest shows the CA's description and sends the serial, the way
`firmware` shows a version and sends a UUID. The OpenAPI spec documents
both.

## The index

`device_certificates` had no index on `aki`, so every count and every
filtered device list would sequential-scan it. This adds `(aki,
device_id)` concurrently. The device id is in there so the counts can be
answered from the index alone.

## Two things in `CAHelpers` that stopped working

Both are casualties of #2494, which deleted the old SCSS. The components
survived; the CSS they depended on didn't.

`check_expiration_tooltip/1` styles nothing: `tooltip-info` and
`tooltip-text` have no rules behind them any more, and `display: none`
was the line that made it a tooltip. Without it the text is always on,
which is the paragraph sitting in the middle of the new and edit CA
forms. It's rebuilt on the `ToolTip` hook, the same shape `HealthStatus`
uses, so it degrades to hidden rather than to visible. The show page
calls it instead of carrying its own copy.

`certificate_status/1` had the same problem with more at stake:
`.certificate-status-expired` (red) and
`.certificate-status-expiring-soon` (amber) went with the SCSS, so an
expired CA rendered in the same colour as a current one. It now returns
`text-alert-content` / `text-warning-content` / `text-base-400` rather
than class names Tailwind's `@source` scanning can't see.

Writing the first test for `certificate_status/1` turned up a third
problem. "Expiring Soon" was unreachable:

```elixir
DateTime.after?(DateTime.shift(DateTime.utc_now(), month: -3), assigns.not_after)
```

A negative shift puts the cutoff three months in the *past*, so the
clause only matched certificates that expired over three months ago,
which the `Expired` clause above it had already taken. The shift is now
positive, and the status has test coverage for all three branches.

## Noticed but not fixed

The edit page looks a CA up by serial alone, with no org check. Serials
are globally unique, so a member of one org can open and save another
org's CA. The show page added here uses
`get_ca_certificate_by_org_and_serial/2`. Fixing edit is a separate
change.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: joshk

lib/nerves_hub/devices/advanced_query/compiler.ex

@@ -111,6 +111,27 @@ defmodule NervesHub.Devices.AdvancedQuery.Compiler do
     )
   end
 
+  defp signer_ca_exists() do
+    dynamic(
+      [d],
+      fragment(
+        "EXISTS (SELECT 1 FROM device_certificates dc JOIN ca_certificates ca ON ca.ski = dc.aki WHERE dc.device_id = ?)",
+        d.id
+      )
+    )
+  end
+
+  defp signer_ca_exists(serial) do
+    dynamic(
+      [d],
+      fragment(
+        "EXISTS (SELECT 1 FROM device_certificates dc JOIN ca_certificates ca ON ca.ski = dc.aki WHERE dc.device_id = ? AND ca.serial = ?)",
+        d.id,
+        ^serial
+      )
+    )
+  end
+
   # `like`/`not like` use SQL ILIKE (case-insensitive); the value is the user's
   # pattern, so they supply `%`/`_` wildcards themselves.
   defp comparison_dynamic("identifier", "like", value), do: dynamic([d], ilike(d.identifier, ^value))
@@ -164,6 +185,20 @@ defmodule NervesHub.Devices.AdvancedQuery.Compiler do
         fragment("NOT EXISTS (SELECT 1 FROM deployments dg WHERE dg.id = ? AND dg.name = ?)", d.deployment_id, ^name)
       )
 
+  # A device certificate records its signer's key id as its AKI, which is the
+  # CA's SKI - so the join is on that rather than a foreign key. The not-set
+  # sentinel matches devices holding no certificate from a registered CA, which
+  # covers shared secret authenticated devices as well as certificates whose
+  # signer was never registered.
+  defp comparison_dynamic("signer_ca", "=", @not_set_value), do: dynamic([d], not (^signer_ca_exists()))
+
+  defp comparison_dynamic("signer_ca", "!=", @not_set_value), do: signer_ca_exists()
+
+  # CA serials are globally unique, so the serial alone identifies the CA.
+  defp comparison_dynamic("signer_ca", "=", serial), do: signer_ca_exists(serial)
+
+  defp comparison_dynamic("signer_ca", "!=", serial), do: dynamic([d], not (^signer_ca_exists(serial)))
+
   defp comparison_dynamic("architecture", "=", value), do: dynamic([d], d.firmware_metadata["architecture"] == ^value)
 
   defp comparison_dynamic("architecture", "!=", value), do: dynamic([d], d.firmware_metadata["architecture"] != ^value)

lib/nerves_hub/devices/advanced_query/schema.ex

@@ -10,6 +10,7 @@ defmodule NervesHub.Devices.AdvancedQuery.Schema do
 
   alias NervesHub.Devices
   alias NervesHub.Devices.Alarms
+  alias NervesHub.Devices.CACertificates
   alias NervesHub.Firmwares
   alias NervesHub.ManagedDeployments
 
@@ -65,6 +66,12 @@ defmodule NervesHub.Devices.AdvancedQuery.Schema do
       operators: ["=", "!="],
       values: &__MODULE__.firmware_validation_status_values/1
     },
+    # The value is the signer CA's serial (or the not-set sentinel); the live
+    # view's schema JSON shows the CA's description in the autosuggest.
+    "signer_ca" => %{
+      operators: ["=", "!="],
+      values: &__MODULE__.signer_ca_values/1
+    },
     "connection" => %{
       operators: ["=", "!="],
       values: &__MODULE__.connection_values/1
@@ -242,6 +249,14 @@ defmodule NervesHub.Devices.AdvancedQuery.Schema do
   @doc false
   def tag_values(product_id), do: Devices.distinct_tags(product_id) ++ [@not_set_value]
 
+  @doc false
+  def signer_ca_values(product_id) do
+    product_id
+    |> CACertificates.signer_cas_for_product()
+    |> Enum.map(& &1.serial)
+    |> Kernel.++([@not_set_value])
+  end
+
   @doc false
   def deployment_group_values(product_id) do
     ManagedDeployments.deployment_group_names(product_id) ++ [@not_set_value]

lib/nerves_hub/devices/ca_certificates.ex

@@ -12,6 +12,8 @@ defmodule NervesHub.Devices.CACertificates do
   alias NervesHub.Accounts.Org
   alias NervesHub.Certificate
   alias NervesHub.Devices.CACertificate
+  alias NervesHub.Devices.DeviceCertificate
+  alias NervesHub.Products.Product
   alias NervesHub.Repo
 
   @spec create_ca_certificate(Org.t(), map()) ::
@@ -94,6 +96,91 @@ defmodule NervesHub.Devices.CACertificates do
     |> Repo.fetch()
   end
 
+  @doc """
+  Counts the devices in the org whose certificates were signed by each of its
+  CAs, keyed by the CA's SKI.
+
+  A device certificate records its signer's key id as its AKI, so a CA's SKI is
+  what ties the two together. Devices with more than one certificate from the
+  same CA are only counted once, and soft deleted devices are left out so the
+  count matches what the device list shows by default.
+  """
+  @spec device_counts_by_ski(Org.t()) :: %{binary() => non_neg_integer()}
+  def device_counts_by_ski(%Org{id: org_id}) do
+    from(dc in DeviceCertificate,
+      join: d in assoc(dc, :device),
+      where: dc.org_id == ^org_id,
+      where: is_nil(d.deleted_at),
+      group_by: dc.aki,
+      select: {dc.aki, count(dc.device_id, :distinct)}
+    )
+    |> Repo.all()
+    |> Map.new()
+  end
+
+  @doc """
+  The products which have devices signed by the CA, along with each product's
+  device count, ordered by product name.
+
+  The device list is scoped to a single product, so this is what a "devices
+  using this CA" link has to be broken down by.
+  """
+  @spec device_counts_by_product(CACertificate.t()) ::
+          [%{product: Product.t(), device_count: non_neg_integer()}]
+  def device_counts_by_product(%CACertificate{ski: ski, org_id: org_id}) do
+    from(dc in DeviceCertificate,
+      join: d in assoc(dc, :device),
+      join: p in assoc(d, :product),
+      where: dc.aki == ^ski,
+      where: dc.org_id == ^org_id,
+      where: is_nil(d.deleted_at),
+      where: is_nil(p.deleted_at),
+      group_by: p.id,
+      order_by: p.name,
+      select: %{product: p, device_count: count(d.id, :distinct)}
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  The org's CAs which signed a certificate held by a device in the product,
+  ordered by description then serial.
+
+  Built from the devices rather than from the org's CA list so the device list's
+  signer CA filter only offers CAs that can actually match something.
+  """
+  @spec signer_cas_for_product(pos_integer()) :: [CACertificate.t()]
+  def signer_cas_for_product(product_id) do
+    from(ca in CACertificate,
+      join: dc in DeviceCertificate,
+      on: dc.aki == ca.ski,
+      join: d in assoc(dc, :device),
+      where: d.product_id == ^product_id,
+      where: ca.org_id == d.org_id,
+      distinct: true,
+      order_by: [asc: ca.description, asc: ca.serial],
+      select: ca
+    )
+    |> Repo.all()
+  end
+
+  @doc """
+  The org's CAs matching the given SKIs, keyed by SKI.
+
+  Scoped to the org so a certificate signed by another org's CA reads as
+  unknown rather than exposing that CA.
+  """
+  @spec by_ski(Org.t() | pos_integer(), [binary()]) :: %{binary() => CACertificate.t()}
+  def by_ski(%Org{id: org_id}, skis), do: by_ski(org_id, skis)
+
+  def by_ski(org_id, skis) when is_integer(org_id) do
+    skis = Enum.reject(skis, &is_nil/1)
+
+    from(ca in CACertificate, where: ca.org_id == ^org_id and ca.ski in ^skis)
+    |> Repo.all()
+    |> Map.new(&{&1.ski, &1})
+  end
+
   def update_ca_certificate(%CACertificate{} = certificate, params) do
     certificate
     |> CACertificate.update_changeset(params)

lib/nerves_hub/devices/device_filtering.ex

@@ -14,6 +14,7 @@ defmodule NervesHub.Devices.DeviceFiltering do
     connection_type: "",
     firmware_version: "",
     firmware_validation_status: "",
+    signer_ca: "",
     platform: "",
     healthy: "",
     health_status: "",
@@ -39,6 +40,7 @@ defmodule NervesHub.Devices.DeviceFiltering do
     connection_type: :string,
     firmware_version: :string,
     firmware_validation_status: :string,
+    signer_ca: :string,
     platform: :string,
     healthy: :string,
     health_status: :string,
@@ -189,6 +191,12 @@ defmodule NervesHub.Devices.DeviceFiltering do
     advanced(query, "firmware_validation_status", "=", value)
   end
 
+  # The value is the signer CA's serial, or the not-set sentinel for devices
+  # with no certificate from a CA registered with this org.
+  def filter(query, _filters, :signer_ca, value) do
+    advanced(query, "signer_ca", "=", value)
+  end
+
   def filter(query, _filters, :platform, "Unknown") do
     where(query, [d], is_nil(d.firmware_metadata["platform"]))
   end

lib/nerves_hub_web/components/ca_helpers.ex

@@ -1,14 +1,32 @@
 defmodule NervesHubWeb.Components.CAHelpers do
   use NervesHubWeb, :component
 
+  alias NervesHub.Devices.CACertificate
+  alias NervesHubWeb.Components.Utils
+
+  @doc """
+  How to refer to a CA in a sentence: its description, or its formatted serial
+  when it has none (the description is optional).
+  """
+  @spec label(CACertificate.t()) :: String.t()
+  def label(%CACertificate{description: description, serial: serial}) do
+    if description in [nil, ""], do: Utils.format_serial(serial), else: description
+  end
+
+  attr(:id, :string, default: "check-expiration-tooltip")
+  attr(:placement, :string, default: "right")
+
   def check_expiration_tooltip(assigns) do
     ~H"""
-    <span class="tooltip-info"></span>
-    <span class="tooltip-text">
-      By default, the time validity of CA certificates is unchecked. You can
-      toggle this to check expiration to prevent device certificates
-      from being created from an expired signing CA certificate.
-    </span>
+    <div class="relative z-20 flex items-center" id={@id} phx-hook="ToolTip" data-placement={@placement}>
+      <.icon name="info" class="stroke-base-400" />
+      <div class="bg-surface-muted border-base-700 tooltip-content absolute top-0 left-0 z-20 hidden w-max max-w-72 rounded border px-2 py-1.5 text-xs">
+        By default, the time validity of CA certificates is unchecked. You can
+        toggle this to check expiration to prevent device certificates
+        from being created from an expired signing CA certificate.
+        <div class="bg-surface-muted border-base-700 tooltip-arrow absolute size-2 origin-center rotate-45"></div>
+      </div>
+    </div>
     """
   end
 
@@ -18,7 +36,10 @@ defmodule NervesHubWeb.Components.CAHelpers do
         DateTime.after?(DateTime.utc_now(), assigns.not_after) ->
           "Expired"
 
-        DateTime.after?(DateTime.shift(DateTime.utc_now(), month: -3), assigns.not_after) ->
+        # Expires within the next three months. The shift was negative, which
+        # put the cutoff three months in the past - a window the `Expired`
+        # clause above has already taken, so this never matched.
+        DateTime.after?(DateTime.shift(DateTime.utc_now(), month: 3), assigns.not_after) ->
           "Expiring Soon"
 
         true ->
@@ -37,12 +58,9 @@ defmodule NervesHubWeb.Components.CAHelpers do
     """
   end
 
-  defp certificate_status_class(status) do
-    formatted =
-      status
-      |> String.downcase()
-      |> String.replace(" ", "-")
-
-    "certificate-status-#{formatted}"
-  end
+  # The `-content` colours are the ones defined for both themes; a bare
+  # `text-alert` stays red-500 on the light theme, which is too hot.
+  defp certificate_status_class("Expired"), do: "text-alert-content"
+  defp certificate_status_class("Expiring Soon"), do: "text-warning-content"
+  defp certificate_status_class("Current"), do: "text-base-400"
 end

lib/nerves_hub_web/components/device_page/settings_tab.ex

@@ -3,10 +3,12 @@ defmodule NervesHubWeb.Components.DevicePage.SettingsTab do
 
   alias NervesHub.Certificate
   alias NervesHub.Devices
+  alias NervesHub.Devices.CACertificates
   alias NervesHub.Devices.Certificates
   alias NervesHub.Devices.Device
   alias NervesHub.Devices.Updates
   alias NervesHub.Extensions
+  alias NervesHubWeb.Components.CAHelpers
   alias NervesHubWeb.Components.Utils
   alias NervesHubWeb.LayoutView.DateTimeFormat
 
@@ -28,7 +30,15 @@ defmodule NervesHubWeb.Components.DevicePage.SettingsTab do
   def render(assigns) do
     device = Certificates.preload_device_certificates(assigns.device, force: true)
 
-    assigns = Map.put(assigns, :device, device)
+    # A device certificate names its signer by key id (its AKI, the CA's SKI)
+    # rather than by a foreign key, and the signer may never have been
+    # registered - so the lookup can come up empty.
+    signer_cas = CACertificates.by_ski(device.org_id, Enum.map(device.device_certificates, & &1.aki))
+
+    assigns =
+      assigns
+      |> Map.put(:device, device)
+      |> Map.put(:signer_cas, signer_cas)
 
     ~H"""
     <div
@@ -201,6 +211,11 @@ defmodule NervesHubWeb.Components.DevicePage.SettingsTab do
                   <span>Not after:</span>
                   <.local_datetime at={certificate.not_after} time_zone={@time_zone} format={:date} zone_label={false} />
                 </div>
+
+                <div class="text-base-400 text-xs tracking-wide">
+                  <span>Signer CA:</span>
+                  <.signer_ca signer_ca={@signer_cas[certificate.aki]} org={@org} />
+                </div>
               </div>
             </div>
             <div class="flex gap-2">
@@ -309,6 +324,23 @@ defmodule NervesHubWeb.Components.DevicePage.SettingsTab do
     """
   end
 
+  attr(:signer_ca, :any, required: true)
+  attr(:org, :map, required: true)
+
+  defp signer_ca(%{signer_ca: nil} = assigns) do
+    ~H"""
+    <span>Unknown</span>
+    """
+  end
+
+  defp signer_ca(assigns) do
+    ~H"""
+    <.link navigate={~p"/org/#{@org}/settings/certificates/#{@signer_ca}"} class="hover:text-base-300 underline">
+      {CAHelpers.label(@signer_ca)}
+    </.link>
+    """
+  end
+
   def hooked_event("validate-device-settings", %{"device" => device_params}, socket) do
     changeset = Device.changeset(socket.assigns.device, device_params)
 

lib/nerves_hub_web/controllers/api/openapi/device_controller_specs.ex

@@ -54,6 +54,7 @@ defmodule NervesHubWeb.API.OpenAPI.DeviceControllerSpecs do
           * `health_status != "healthy" or alarm_status = "with"`
           * `metric:battery_soc < 20 and updates = "enabled"`
           * `firmware_validation_status = "not_validated"`
+          * `signer_ca = "1234567890"`
           """,
           example: ~s|metric:cpu_temp > 70 and connection = "connected"|
         },
@@ -67,6 +68,12 @@ defmodule NervesHubWeb.API.OpenAPI.DeviceControllerSpecs do
           enum: ["validated", "not_validated", "unknown"]
         },
         firmware_version: %OpenApiSpex.Schema{type: :string, example: "1.10.0"},
+        signer_ca: %OpenApiSpex.Schema{
+          type: :string,
+          description:
+            "The serial of the CA which signed the device's certificate, or `:not_set` for devices with no certificate from a registered CA.",
+          example: "1234567890"
+        },
         has_no_tags: %OpenApiSpex.Schema{type: :string, enum: ["true", "false"]},
         health_status: %OpenApiSpex.Schema{
           type: :string,