feat: add new PKI alert types by carlosmonastyrski · Pull Request #5779 · Infisical/infisical

carlosmonastyrski · 2026-03-21T03:48:25Z

Context

Adds support for certificate issuance, renewal, and revocation alert event types, complementing the existing expiration alerts across all notification channels.

Screenshots

Steps to verify the change

Type

Checklist

Title follows the conventional commit format: type(scope): short description (scope is optional, e.g., fix: prevent crash on sync or fix(api): handle null response).
Tested locally
Updated docs (if needed)
Updated CLAUDE.md files (if needed)
Read the contributing guide

linear · 2026-03-21T03:48:29Z

PKI-155 Add alert webhook event types for certificate updates

mintlify · 2026-03-21T03:48:30Z

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
infisical	🟢 Ready	View Preview	Mar 21, 2026, 3:51 AM

maidul98 · 2026-03-21T03:49:11Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

greptile-apps · 2026-03-21T03:54:03Z

Greptile Summary

This PR extends the PKI alerting system from expiration-only to support four certificate lifecycle event types: Expiration (existing, scheduled daily), Issuance, Renewal, and Revocation (all new, real-time via a new PkiAlertV2Event queue). All notification channels (Email, Slack, PagerDuty, Webhook) are updated to carry event-specific metadata. Frontend and documentation are updated to match. The overall architecture is sound — the queue-based event dispatch is fire-and-forget with retries, which keeps the critical certificate operation paths safe from alert failures.

Key issues found:

Missing CA certificate filter in sendEventNotifications (pki-alert-v2-service.ts): sendAlertNotifications explicitly excludes CertificateOrigin.CA certificates from notifications, but sendEventNotifications does not apply the same filter. CA certificate lifecycle events could inadvertently trigger alerts.
Weak eventType typing in queue payload (queue-service.ts): eventType is typed as string instead of PkiAlertEventType, forcing an unsafe cast in the queue processor.
Potential "undefined" literal in PagerDuty summary (pki-alert-v2-channel-pagerduty-fns.ts): For EXPIRATION alerts, alert.alertBefore is interpolated directly into the summary string. Now that alertBefore is typed as optional, this could render as the literal string "undefined" without a null-fallback.
Structured logging convention not followed (pki-alert-v2-queue.ts): New log lines use plain string interpolation rather than the project's required bracket-formatted structured logging pattern.
useEffect stale closure (CreatePkiAlertV2Modal.tsx): The effect that resets selectedTabIndex suppresses an exhaustive-deps ESLint warning; using a functional state updater would be cleaner and safer.

Confidence Score: 3/5

PR is mostly safe to merge but has a logic inconsistency (missing CA cert filter) and a weak type in the queue payload that should be addressed before shipping.
The overall architecture is solid and new code paths are fire-and-forget with proper error handling. However, the missing CA certificate exclusion in sendEventNotifications (inconsistent with sendAlertNotifications) could send unexpected notifications for CA certificate events. The string typing for eventType in the queue payload requires an unsafe cast. The PagerDuty summary could render "undefined" for malformed expiration alerts. These are correctness concerns rather than security vulnerabilities, but they warrant fixes before the feature ships.
backend/src/services/pki-alert-v2/pki-alert-v2-service.ts (missing CA cert filter), backend/src/queue/queue-service.ts (weak eventType typing), and backend/src/services/pki-alert-v2/pki-alert-v2-channel-pagerduty-fns.ts (alertBefore undefined risk)

Important Files Changed

Filename	Overview
backend/src/services/pki-alert-v2/pki-alert-v2-service.ts	Adds `sendEventNotifications` for real-time event alerts and refactors shared logic into `dispatchToChannels`. Missing CA certificate filter (`enrollmentType !== CertificateOrigin.CA`) present in `sendAlertNotifications` is absent from `sendEventNotifications`.
backend/src/queue/queue-service.ts	Registers new `PkiAlertV2Event` queue name and job. The payload `eventType` is typed as `string` instead of `PkiAlertEventType`, requiring an unsafe cast at processing time.
backend/src/services/pki-alert-v2/pki-alert-v2-channel-pagerduty-fns.ts	Adds event-type-aware severity and summary for PagerDuty alerts. For EXPIRATION alerts, `alert.alertBefore` (now optional) is interpolated directly into the summary string without a null-fallback, potentially rendering as the literal "undefined".
backend/src/services/pki-alert-v2/pki-alert-v2-types.ts	Adds new `PkiAlertEventType` values (ISSUANCE, RENEWAL, REVOCATION), webhook event type mappings, `getRevocationReasonLabel` helper, and makes `alertBefore` optional throughout. Changes look correct and well-structured.
backend/src/services/pki-alert-v2/pki-alert-v2-dal.ts	Adds `certificateId` filter option and `revokedAt`/`revocationReason` fields to certificate queries. Column references are properly qualified with table names, no unsafe OR conditions introduced.
frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2Modal.tsx	Dynamically adjusts form tabs based on event type (removes the "Preview" tab for non-expiration types). The `useEffect` that resets `selectedTabIndex` uses `eslint-disable` to suppress a missing `selectedTabIndex` dependency warning; a functional updater pattern would be safer.
backend/src/services/pki-alert-v2/pki-alert-v2-queue.ts	Adds new PkiAlertV2Event queue and queueCertificateEvent/processEventAlert functions. Log lines for the new queue worker don't follow the project's structured logging convention. The eventType cast from string to PkiAlertEventType bypasses type safety due to the weak typing in queue-service.ts.

Comments Outside Diff (2)

backend/src/services/pki-alert-v2/pki-alert-v2-channel-pagerduty-fns.ts, line 113-116 (link)

alertBefore could render as literal "undefined" in PagerDuty summary

TAlertInfo.alertBefore is now string | undefined. When eventType === EXPIRATION, the summary string is:
```
`Infisical: ${totalCertificates} certificate(s) expiring within ${alert.alertBefore} - Alert: ${alert.name}`
```
If alertBefore is undefined (which shouldn't happen with current validation, but the type allows it), this would produce the literal string "...expiring within undefined..." in the PagerDuty event summary. Add a fallback:
frontend/src/views/PkiAlertsV2Page/components/CreatePkiAlertV2Modal.tsx, line 2081-2085 (link)

useEffect suppresses lint warning about missing selectedTabIndex dependency

The effect reads selectedTabIndex and formTabs but only declares watchedEventType as a dependency. The eslint-disable-line comment suppresses the exhaustive-deps warning. Since formTabs is derived from watchedEventType this is fine, but selectedTabIndex is a true stale-closure risk: if selectedTabIndex changes independently without watchedEventType changing, the guard won't re-run.

Consider using a functional updater to avoid reading selectedTabIndex from the outer scope:
```
useEffect(() => {
  setSelectedTabIndex((prev) => (prev >= formTabs.length ? 0 : prev));
}, [watchedEventType, formTabs.length]);
```
This removes the need for the eslint-disable comment.

_{Last reviewed commit: "Add new PKI alert ty..."}

backend/src/queue/queue-service.ts

backend/src/services/pki-alert-v2/pki-alert-v2-service.ts

backend/src/services/pki-alert-v2/pki-alert-v2-queue.ts

docs/documentation/platform/pki/alerting/overview.mdx

docs/documentation/platform/pki/alerting/webhook-alerts.mdx

backend/src/queue/queue-service.ts

backend/src/services/smtp/emails/PkiExpirationAlertTemplate.tsx

backend/src/services/pki-alert-v2/pki-alert-v2-channel-webhook-fns.ts

backend/src/ee/services/audit-log/audit-log-types.ts

Add new PKI alert types

f0cf865

mintlify bot deployed to staging - docs March 21, 2026 03:51 View deployment

greptile-apps bot reviewed Mar 21, 2026

View reviewed changes

backend/src/queue/queue-service.ts Outdated Show resolved Hide resolved

backend/src/services/pki-alert-v2/pki-alert-v2-service.ts Show resolved Hide resolved

backend/src/services/pki-alert-v2/pki-alert-v2-queue.ts Outdated Show resolved Hide resolved

carlosmonastyrski added 3 commits March 21, 2026 01:04

Address greptile comments

9087b85

Lint fix

ebf0ee1

Add preview to revoke and renew alerts

ce9cf23

saifsmailbox98 requested changes Mar 24, 2026

View reviewed changes

Address PR comments

f2896f7

mintlify bot deployed to staging - docs March 24, 2026 20:00 View deployment

Minor fixes on PKI alerts

e10ca2a

saifsmailbox98 approved these changes Mar 24, 2026

View reviewed changes

carlosmonastyrski merged commit 22e0425 into main Mar 24, 2026
11 of 12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add new PKI alert types#5779

feat: add new PKI alert types#5779
carlosmonastyrski merged 6 commits intomainfrom
feat/PKI-155

carlosmonastyrski commented Mar 21, 2026

Uh oh!

linear bot commented Mar 21, 2026

Uh oh!

mintlify bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

maidul98 commented Mar 21, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 21, 2026 •

edited

Loading

Comments Outside Diff (2)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

carlosmonastyrski commented Mar 21, 2026

Context

Screenshots

Steps to verify the change

Type

Checklist

Uh oh!

linear bot commented Mar 21, 2026

Uh oh!

mintlify bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

maidul98 commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

greptile-apps bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 3/5

Important Files Changed

Comments Outside Diff (2)

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

mintlify bot commented Mar 21, 2026 •

edited

Loading

maidul98 commented Mar 21, 2026 •

edited

Loading

greptile-apps bot commented Mar 21, 2026 •

edited

Loading