kipuka/routes/

cms_est.rs

//! CMS-wrapped EST endpoints (RFC 8295).
//!
//! These endpoints accept EST requests wrapped in CMS SignedData for
//! authentication and return responses wrapped in CMS EnvelopedData
//! for confidentiality.  This enables EST over plain HTTP when a
//! TLS-terminating proxy strips the TLS layer.
//!
//! RFC 8295 §4: All EST operations are supported with CMS wrapping.
//! The Content-Type for all requests and responses is
//! `application/pkcs7-mime`.
//!
//! # Route structure
//!
//! ```text
//! /.well-known/est/cms/
//!     simpleenroll     POST (§4.2 + CMS wrapping)
//!     simplereenroll   POST (§4.2.2 + CMS wrapping)
//!     serverkeygen     POST (§4.4 + CMS wrapping)
//!     fullcmc          POST (§4.3 + CMS wrapping)
//! ```

use std::sync::Arc;

use axum::Router;
use axum::body::Bytes;
use axum::extract::State;
use axum::http::{HeaderValue, StatusCode, header};
use axum::response::{IntoResponse, Response};
use axum::routing::post;

use crate::auth::cms_auth;
use crate::error::KipukaError;
use crate::routes::LabelExtractor;
use crate::state::AppState;

/// Content-Type for CMS-wrapped EST payloads (RFC 8295 §4).
const CONTENT_TYPE_PKCS7: &str = "application/pkcs7-mime";

/// Build the CMS-EST sub-router.
///
/// Mounts CMS-wrapped variants of the core EST enrollment endpoints
/// under `/.well-known/est/cms/`.  Each handler unwraps the CMS
/// SignedData, delegates to the standard EST logic, and optionally
/// wraps the response in CMS EnvelopedData.
pub fn cms_est_router() -> Router<Arc<AppState>> {
    Router::new()
        .route("/simpleenroll", post(post_cms_simpleenroll))
        .route("/simplereenroll", post(post_cms_simplereenroll))
        .route("/serverkeygen", post(post_cms_serverkeygen))
        .route("/fullcmc", post(post_cms_fullcmc))
}

/// Extract and validate the CMS-EST configuration from application state.
///
/// Returns the configuration reference if CMS-EST is enabled, or an
/// `KipukaError::Est` error if it is disabled or absent.
fn get_cms_est_config(state: &AppState) -> Result<&crate::config::CmsEstConfig, KipukaError> {
    match state.config.cms_est {
        Some(ref cfg) if cfg.enabled => Ok(cfg),
        _ => Err(KipukaError::Est("CMS-EST is not enabled".into())),
    }
}

/// Build a truststore (list of DER-encoded trust anchors) from the
/// CA certificate chains in application state.
///
/// RFC 8295 §3.1: the signer certificate must chain to a trust anchor
/// known to the EST server.  We use the CA certificates as the
/// truststore for CMS signature verification.
fn build_truststore(state: &AppState) -> Vec<Vec<u8>> {
    state
        .cas
        .values()
        .flat_map(|ca| ca.cert_chain.iter().cloned())
        .collect()
}

/// `POST /.well-known/est/cms/simpleenroll`
///
/// CMS-wrapped simple enrollment (RFC 8295 §4 + RFC 7030 §4.2).
///
/// # Request
///
/// | Header       | Value                    |
/// |--------------|--------------------------|
/// | Content-Type | `application/pkcs7-mime` |
/// | Body         | DER-encoded CMS SignedData wrapping a PKCS#10 CSR |
///
/// # Processing
///
/// 1. Verify CMS SignedData signature and signer certificate chain.
/// 2. Extract the PKCS#10 CSR payload from the signed content.
/// 3. Extract signer identity for authorization.
/// 4. Delegate to the standard enrollment logic.
/// 5. Optionally wrap the response certificate in CMS EnvelopedData.
///
/// # Response
///
/// | Header       | Value                    |
/// |--------------|--------------------------|
/// | Content-Type | `application/pkcs7-mime` |
/// | Body         | DER-encoded CMS EnvelopedData (or raw cert if encryption disabled) |
pub async fn post_cms_simpleenroll(
    label: LabelExtractor,
    State(state): State<Arc<AppState>>,
    body: Bytes,
) -> Result<Response, KipukaError> {
    let cms_config = get_cms_est_config(&state)?;
    if label.disconnected.unwrap_or(state.config.est.disconnected) {
        return Err(KipukaError::ServiceUnavailable(
            "CMS enrollment is unavailable in disconnected mode; use queued EST simpleenroll"
                .into(),
        ));
    }
    if state
        .config
        .est
        .labels
        .iter()
        .find(|c| c.name == label.label)
        .is_some_and(|c| {
            !c.auth_methods.is_empty()
                && !c.auth_methods.contains(&crate::config::EstAuthMethod::Cms)
        })
    {
        return Err(KipukaError::Forbidden(
            "CMS authentication is not permitted for this label".into(),
        ));
    }
    let ca_id = label.ca_id();

    tracing::info!(
        ca_id = %ca_id,
        label = %label.label,
        "CMS simpleenroll request"
    );

    // CMS payloads are raw DER — no base64 decoding needed (RFC 8295 §4).
    if body.is_empty() {
        return Err(KipukaError::BadRequest(
            "empty CMS SignedData request body".into(),
        ));
    }

    // Verify the CMS SignedData and extract the CSR payload.
    let truststore = build_truststore(&state);
    let cms_result = cms_auth::verify_cms_signed_data(&body, &truststore)?;
    crate::auth::mtls::check_revocation(&cms_result.signer_cert_der, &state)
        .await
        .map_err(KipukaError::Auth)?;

    // Extract the signer identity for authorization decisions.
    let auth_result = cms_auth::extract_signer_identity(&cms_result)?;
    let identity = &auth_result.identity;
    state.admit_enrollment(identity, "cms_est").await?;

    tracing::info!(
        ca_id = %ca_id,
        identity = %identity,
        signature_algorithm = %cms_result.signature_algorithm,
        "CMS signature verified for simpleenroll"
    );

    // The unwrapped payload is the PKCS#10 CSR.
    let csr_der = &cms_result.payload;
    if csr_der.len() < 60 {
        return Err(KipukaError::BadRequest(
            "extracted CSR is too short to be valid".into(),
        ));
    }

    // Enrollment authorization (FDP_ACF.1): bind the CMS signer identity to the
    // requested names and enforce the label allowlist — the same policy the
    // direct /simpleenroll path applies, so the CMS transport is not a bypass.
    if let Err(reason) =
        crate::auth::enroll_authz::authorize_csr_der(csr_der, identity, &label.enroll_policy())
    {
        tracing::warn!(ca_id = %ca_id, identity = %identity, %reason, "CMS simpleenroll authorization denied");
        state
            .record_audit_event_with_actor(
                "cms_simpleenroll_denied",
                identity,
                &format!("ca_id={ca_id}, identity={identity}, reason={reason}"),
            )
            .await;
        return Err(KipukaError::Forbidden(format!(
            "enrollment not authorized: {reason}"
        )));
    }

    // Delegate to the standard direct-signing enrollment pipeline.  A bad CSR
    // (e.g. failed proof-of-possession) surfaces as BadRequest (400); audit
    // that client-caused rejection as enroll.reject before returning, so the
    // CMS-EST transport is audited exactly like the direct HTTP path (NIAP
    // FAU_GEN.1).
    let cert_der = match issue_certificate_from_csr(&state, ca_id, csr_der).await {
        Ok(cert_der) => cert_der,
        Err(e) => {
            if matches!(e, KipukaError::BadRequest(_)) {
                state
                    .record_audit_event_with_actor(
                        "cms_simpleenroll_denied",
                        identity,
                        &format!("ca_id={ca_id}, identity={identity}, reason={e}"),
                    )
                    .await;
            }
            return Err(e);
        }
    };

    // Wrap in PKCS#7 certs-only, then optionally encrypt with CMS EnvelopedData.
    let pkcs7_der =
        crate::routes::cacerts::build_certs_only_pkcs7(std::slice::from_ref(&cert_der))?;
    let response_body = if cms_config.encrypt_responses {
        let enc_alg = cms_config
            .allowed_content_encryption
            .first()
            .map(|s| s.as_str())
            .unwrap_or("AES-256-GCM");

        cms_auth::build_cms_enveloped_data(&pkcs7_der, &cms_result.signer_cert_der, enc_alg)?
    } else {
        pkcs7_der
    };

    state
        .record_audit_event(
            "cms_simpleenroll_success",
            &format!("ca_id={ca_id}, identity={identity}"),
        )
        .await;

    build_cms_response(StatusCode::OK, &response_body)
}

/// `POST /.well-known/est/cms/simplereenroll`
///
/// CMS-wrapped simple re-enrollment (RFC 8295 §4 + RFC 7030 §4.2.2).
///
/// Similar to [`post_cms_simpleenroll`] but for certificate renewal.
/// The CMS signer certificate serves as proof of the existing identity,
/// analogous to the mTLS client certificate in standard re-enrollment.
pub async fn post_cms_simplereenroll(
    label: LabelExtractor,
    State(state): State<Arc<AppState>>,
    body: Bytes,
) -> Result<Response, KipukaError> {
    let cms_config = get_cms_est_config(&state)?;
    if label.disconnected.unwrap_or(state.config.est.disconnected) {
        return Err(KipukaError::ServiceUnavailable(
            "CMS enrollment is unavailable in disconnected mode; use queued EST simpleenroll"
                .into(),
        ));
    }
    if state
        .config
        .est
        .labels
        .iter()
        .find(|c| c.name == label.label)
        .is_some_and(|c| {
            !c.auth_methods.is_empty()
                && !c.auth_methods.contains(&crate::config::EstAuthMethod::Cms)
        })
    {
        return Err(KipukaError::Forbidden(
            "CMS authentication is not permitted for this label".into(),
        ));
    }
    let ca_id = label.ca_id();

    tracing::info!(
        ca_id = %ca_id,
        label = %label.label,
        "CMS simplereenroll request"
    );

    if body.is_empty() {
        return Err(KipukaError::BadRequest(
            "empty CMS SignedData request body".into(),
        ));
    }

    let truststore = build_truststore(&state);
    let cms_result = cms_auth::verify_cms_signed_data(&body, &truststore)?;
    crate::auth::mtls::check_revocation(&cms_result.signer_cert_der, &state)
        .await
        .map_err(KipukaError::Auth)?;
    let auth_result = cms_auth::extract_signer_identity(&cms_result)?;
    let identity = &auth_result.identity;
    state.admit_enrollment(identity, "cms_est").await?;

    tracing::info!(
        ca_id = %ca_id,
        identity = %identity,
        signature_algorithm = %cms_result.signature_algorithm,
        "CMS signature verified for simplereenroll"
    );

    let csr_der = &cms_result.payload;
    if csr_der.len() < 60 {
        return Err(KipukaError::BadRequest(
            "extracted CSR is too short to be valid".into(),
        ));
    }

    // For re-enrollment, verify the signer certificate matches the CSR subject.
    //
    // RFC 7030 §3.5 POP linking: the CMS signer certificate subject
    // MUST match the CSR subject.  This is analogous to the mTLS POP
    // linking check in standard re-enrollment.
    {
        let csr = synta_certificate::csr::CertificationRequest::from_der(csr_der).map_err(|e| {
            KipukaError::BadRequest(format!("CSR parse failed for POP linking: {e}"))
        })?;

        let csr_subject_der = csr
            .certification_request_info
            .subject
            .to_der()
            .map_err(|e| KipukaError::BadRequest(format!("CSR subject encode failed: {e}")))?;
        let csr_subject = synta_certificate::format_dn(&csr_subject_der);

        let signer_norm = cms_result.signer_subject_dn.trim().to_lowercase();
        let csr_norm = csr_subject.trim().to_lowercase();

        if signer_norm != csr_norm {
            tracing::warn!(
                signer_subject = %cms_result.signer_subject_dn,
                csr_subject = %csr_subject,
                "CMS simplereenroll POP linking failed: subject mismatch"
            );
            return Err(KipukaError::Forbidden(format!(
                "POP linking failed: CSR subject '{csr_subject}' does not match \
                 CMS signer subject '{}'",
                cms_result.signer_subject_dn,
            )));
        }

        tracing::info!("CMS simplereenroll POP linking: CSR subject matches signer");
    }

    // Enrollment authorization (FDP_ACF.1): POP linking above proves the CSR
    // subject equals the signer, but the per-label SAN binding and name
    // allowlist are independent controls — apply them here too.
    if let Err(reason) =
        crate::auth::enroll_authz::authorize_csr_der(csr_der, identity, &label.enroll_policy())
    {
        tracing::warn!(ca_id = %ca_id, identity = %identity, %reason, "CMS simplereenroll authorization denied");
        state
            .record_audit_event_with_actor(
                "cms_simplereenroll_denied",
                identity,
                &format!("ca_id={ca_id}, identity={identity}, reason={reason}"),
            )
            .await;
        return Err(KipukaError::Forbidden(format!(
            "enrollment not authorized: {reason}"
        )));
    }

    // Delegate to the standard direct-signing enrollment pipeline.
    // Re-enrollment uses the same certificate issuance path as simple enrollment;
    // the authentication difference is that the CMS signer cert IS the existing
    // certificate being renewed (verified above via CMS SignedData).
    let cert_der = match issue_certificate_from_csr(&state, ca_id, csr_der).await {
        Ok(cert_der) => cert_der,
        Err(e) => {
            // Client-caused rejection (bad CSR/PoP) → audit enroll.reject.
            if matches!(e, KipukaError::BadRequest(_)) {
                state
                    .record_audit_event_with_actor(
                        "cms_simplereenroll_denied",
                        identity,
                        &format!("ca_id={ca_id}, identity={identity}, reason={e}"),
                    )
                    .await;
            }
            return Err(e);
        }
    };

    let pkcs7_der =
        crate::routes::cacerts::build_certs_only_pkcs7(std::slice::from_ref(&cert_der))?;
    let response_body = if cms_config.encrypt_responses {
        let enc_alg = cms_config
            .allowed_content_encryption
            .first()
            .map(|s| s.as_str())
            .unwrap_or("AES-256-GCM");

        cms_auth::build_cms_enveloped_data(&pkcs7_der, &cms_result.signer_cert_der, enc_alg)?
    } else {
        pkcs7_der
    };

    state
        .record_audit_event(
            "cms_simplereenroll_success",
            &format!("ca_id={ca_id}, identity={identity}"),
        )
        .await;

    build_cms_response(StatusCode::OK, &response_body)
}

/// `POST /.well-known/est/cms/serverkeygen`
///
/// CMS-wrapped server-side key generation (RFC 8295 §4 + RFC 7030 §4.4).
///
/// The server generates a key pair, signs a certificate, and returns
/// both the certificate and private key wrapped in CMS EnvelopedData
/// for confidentiality.
pub async fn post_cms_serverkeygen(
    label: LabelExtractor,
    State(state): State<Arc<AppState>>,
    body: Bytes,
) -> Result<Response, KipukaError> {
    let cms_config = get_cms_est_config(&state)?;
    if label.disconnected.unwrap_or(state.config.est.disconnected) {
        return Err(KipukaError::ServiceUnavailable(
            "CMS enrollment is unavailable in disconnected mode; use queued EST simpleenroll"
                .into(),
        ));
    }
    if state
        .config
        .est
        .labels
        .iter()
        .find(|c| c.name == label.label)
        .is_some_and(|c| {
            !c.auth_methods.is_empty()
                && !c.auth_methods.contains(&crate::config::EstAuthMethod::Cms)
        })
    {
        return Err(KipukaError::Forbidden(
            "CMS authentication is not permitted for this label".into(),
        ));
    }
    let ca_id = label.ca_id();

    if !state.config.est.serverkeygen {
        return Err(KipukaError::Est(
            "server-side key generation is not enabled".into(),
        ));
    }

    tracing::info!(
        ca_id = %ca_id,
        label = %label.label,
        "CMS serverkeygen request"
    );

    if body.is_empty() {
        return Err(KipukaError::BadRequest(
            "empty CMS SignedData request body".into(),
        ));
    }

    let truststore = build_truststore(&state);
    let cms_result = cms_auth::verify_cms_signed_data(&body, &truststore)?;
    crate::auth::mtls::check_revocation(&cms_result.signer_cert_der, &state)
        .await
        .map_err(KipukaError::Auth)?;
    let auth_result = cms_auth::extract_signer_identity(&cms_result)?;
    let identity = &auth_result.identity;
    state.admit_enrollment(identity, "cms_est").await?;

    tracing::info!(
        ca_id = %ca_id,
        identity = %identity,
        signature_algorithm = %cms_result.signature_algorithm,
        "CMS signature verified for serverkeygen"
    );

    // The payload is the CSR template with the desired subject/extensions.
    let csr_template = &cms_result.payload;

    // Enrollment authorization (FDP_ACF.1): the requested subject/SANs in the
    // template must be authorized for this signer identity and label, exactly
    // as for a client-supplied CSR.
    if let Err(reason) =
        crate::auth::enroll_authz::authorize_csr_der(csr_template, identity, &label.enroll_policy())
    {
        tracing::warn!(ca_id = %ca_id, identity = %identity, %reason, "CMS serverkeygen authorization denied");
        state
            .record_audit_event_with_actor(
                "cms_serverkeygen_denied",
                identity,
                &format!("ca_id={ca_id}, identity={identity}, reason={reason}"),
            )
            .await;
        return Err(KipukaError::Forbidden(format!(
            "enrollment not authorized: {reason}"
        )));
    }

    let key_type = super::serverkeygen::detect_key_type_from_csr(csr_template);
    let generated = crate::ca::keygen::generate_key_pair(
        &key_type,
        &crate::ca::keygen::KeyGenConfig::default(),
    )
    .map_err(|e| KipukaError::Ca(format!("CMS key generation failed: {e}")))?;
    let new_csr = super::serverkeygen::build_keygen_csr(
        csr_template,
        &generated.public_key_der,
        &generated.private_key_der,
    )?;
    let cert_der = issue_certificate_from_csr(&state, ca_id, &new_csr).await?;
    let certificates = super::cacerts::build_certs_only_pkcs7(&[cert_der])?;
    let key_and_cert =
        super::serverkeygen::build_multipart_response(&certificates, &generated.private_key_der);

    // Server key generation responses MUST always be encrypted —
    // the response may contain the private key.
    let enc_alg = cms_config
        .allowed_content_encryption
        .first()
        .map(|s| s.as_str())
        .unwrap_or("AES-256-GCM");

    let response_body = cms_auth::build_cms_enveloped_data(
        key_and_cert.as_bytes(),
        &cms_result.signer_cert_der,
        enc_alg,
    )?;

    state
        .record_audit_event(
            "cms_serverkeygen_success",
            &format!("ca_id={ca_id}, identity={identity}"),
        )
        .await;

    build_cms_response(StatusCode::OK, &response_body)
}

/// `POST /.well-known/est/cms/fullcmc`
///
/// CMS-wrapped Full CMC request (RFC 8295 §4 + RFC 7030 §4.3).
///
/// The outer CMS SignedData provides message-level authentication; the
/// inner payload is the CMC request (itself a SignedData containing
/// PKIData).  The signer MUST hold the id-kp-cmcRA EKU.
pub async fn post_cms_fullcmc(
    label: LabelExtractor,
    State(state): State<Arc<AppState>>,
    body: Bytes,
) -> Result<Response, KipukaError> {
    let cms_config = get_cms_est_config(&state)?;
    if label.disconnected.unwrap_or(state.config.est.disconnected) {
        return Err(KipukaError::ServiceUnavailable(
            "CMS enrollment is unavailable in disconnected mode; use queued EST simpleenroll"
                .into(),
        ));
    }
    if state
        .config
        .est
        .labels
        .iter()
        .find(|c| c.name == label.label)
        .is_some_and(|c| {
            !c.auth_methods.is_empty()
                && !c.auth_methods.contains(&crate::config::EstAuthMethod::Cms)
        })
    {
        return Err(KipukaError::Forbidden(
            "CMS authentication is not permitted for this label".into(),
        ));
    }
    let ca_id = label.ca_id();

    if !state.config.est.fullcmc {
        return Err(KipukaError::Est("Full CMC is not enabled".into()));
    }

    tracing::info!(
        ca_id = %ca_id,
        label = %label.label,
        "CMS fullcmc request"
    );

    if body.is_empty() {
        return Err(KipukaError::BadRequest(
            "empty CMS SignedData request body".into(),
        ));
    }

    let truststore = build_truststore(&state);
    let cms_result = cms_auth::verify_cms_signed_data(&body, &truststore)?;
    crate::auth::mtls::check_revocation(&cms_result.signer_cert_der, &state)
        .await
        .map_err(KipukaError::Auth)?;
    let auth_result = cms_auth::extract_signer_identity(&cms_result)?;
    let identity = &auth_result.identity;
    state.admit_enrollment(identity, "cms_est").await?;

    // RHELBU-3536 R15: Validate id-kp-cmcRA EKU on the signer certificate.
    //
    // The signer MUST hold id-kp-cmcRA (1.3.6.1.5.5.7.3.28) to submit
    // Full CMC requests.  Extract the EKU extension from the signer
    // certificate and verify the OID is present.
    {
        let signer_cert = synta_certificate::Certificate::from_der(&cms_result.signer_cert_der)
            .map_err(|e| {
                KipukaError::BadRequest(format!(
                    "failed to parse CMS signer certificate for EKU check: {e}"
                ))
            })?;

        let has_cmc_ra = signer_cert
            .tbs_certificate
            .extensions
            .as_ref()
            .and_then(|ext_raw| {
                synta_certificate::find_extension_value(
                    ext_raw.as_bytes(),
                    synta_certificate::oids::EXTENDED_KEY_USAGE,
                )
            })
            .map(|eku_bytes| {
                let mut decoder = synta::Decoder::new(eku_bytes, synta::Encoding::Der);
                let oids: Vec<synta::ObjectIdentifier> = decoder.decode().unwrap_or_default();
                oids.iter()
                    .any(|oid| oid.to_string() == crate::auth::CMC_RA_EKU_OID)
            })
            .unwrap_or(false);

        if !has_cmc_ra {
            tracing::warn!(
                identity = %identity,
                "CMS fullcmc rejected: signer certificate lacks id-kp-cmcRA EKU"
            );
            return Err(KipukaError::Forbidden(
                "CMC signer certificate must have id-kp-cmcRA EKU (1.3.6.1.5.5.7.3.28)".into(),
            ));
        }

        tracing::info!("CMS fullcmc: signer has id-kp-cmcRA EKU");
    }

    tracing::info!(
        ca_id = %ca_id,
        identity = %identity,
        signature_algorithm = %cms_result.signature_algorithm,
        "CMS signature verified for fullcmc"
    );

    // The inner payload is the CMC request (itself a CMS SignedData
    // containing PKIData).  Unwrap the inner SignedData and parse PKIData.
    let cmc_request_der = &cms_result.payload;

    // Unwrap the inner CMC SignedData to get the PKIData content.
    let (pki_data_der, _inner_signer_certs) = synta_cmc::parser::unwrap_signed_cmc(cmc_request_der)
        .map_err(|e| KipukaError::BadRequest(format!("CMC inner SignedData unwrap failed: {e}")))?;

    if pki_data_der.is_empty() {
        return Err(KipukaError::BadRequest(
            "CMC inner SignedData has empty eContent".into(),
        ));
    }

    // Parse PKIData to extract controls and certification requests.
    let pki_data = synta_cmc::parser::parse_pki_data(&pki_data_der)
        .map_err(|e| KipukaError::BadRequest(format!("CMC PKIData parse failed: {e}")))?;

    let transaction_id = synta_cmc::controls::extract_transaction_id(&pki_data.control_sequence);
    let sender_nonce = synta_cmc::controls::extract_sender_nonce(&pki_data.control_sequence);

    tracing::info!(
        ca_id = %ca_id,
        identity = %identity,
        transaction_id = ?transaction_id,
        num_requests = pki_data.req_sequence.len(),
        "CMS fullcmc: PKIData parsed"
    );

    if pki_data.req_sequence.is_empty() {
        return Err(KipukaError::BadRequest(
            "CMC request contains no certification requests".into(),
        ));
    }

    // Process each certification request using the shared enrollment helper.
    let mut issued_certs: Vec<Vec<u8>> = Vec::new();
    let mut body_part_ids: Vec<u32> = Vec::new();
    let mut failed_body_part_ids: Vec<u32> = Vec::new();

    let requests = crate::ca::protocol::cmc_requests(&pki_data)?;
    for entry in &requests {
        let body_part_id = entry.body_part_id;

        if entry.request_type == 0 {
            crate::auth::enroll_authz::authorize_csr_der(
                &entry.der,
                identity,
                &label.enroll_policy(),
            )
            .map_err(KipukaError::Forbidden)?;
            match issue_certificate_from_csr(&state, ca_id, &entry.der).await {
                Ok(cert) => {
                    issued_certs.push(cert);
                    body_part_ids.push(body_part_id);
                }
                Err(e) => {
                    tracing::error!(body_part_id, error = %e, "CMS fullcmc: certificate issuance failed");
                    failed_body_part_ids.push(body_part_id);
                }
            }
        } else {
            tracing::warn!(body_part_id, request_type = ?entry.request_type, "CMS fullcmc: unsupported request type (only PKCS#10 supported)");
            failed_body_part_ids.push(body_part_id);
        }
    }

    // Build the CMC PKIResponse.
    let mut resp_builder = synta_cmc::builder::PKIResponseBuilder::new();

    if !body_part_ids.is_empty() {
        resp_builder = resp_builder
            .add_status(&body_part_ids)
            .map_err(|e| KipukaError::Ca(format!("CMC response builder failed (status): {e}")))?;
    }

    if !failed_body_part_ids.is_empty() {
        resp_builder = resp_builder
            .add_failed(
                &failed_body_part_ids,
                synta_cmc::status::CMCFailInfo::InternalCaError,
            )
            .map_err(|e| {
                KipukaError::Ca(format!("CMC response builder failed (failed status): {e}"))
            })?;
    }

    // Echo sender nonce as recipient nonce per RFC 5272 §6.6.
    if let Some(nonce) = &sender_nonce {
        resp_builder = resp_builder.recipient_nonce(nonce).map_err(|e| {
            KipukaError::Ca(format!(
                "CMC response builder failed (recipient nonce): {e}"
            ))
        })?;
    }

    let cmc_response_der = resp_builder
        .build()
        .map_err(|e| KipukaError::Ca(format!("CMC PKIResponse build failed: {e}")))?;

    let ca = state.get_ca(ca_id).ok_or(KipukaError::NotFound)?;
    let ca_cfg = state
        .config
        .cas
        .iter()
        .find(|c| c.id == ca_id)
        .ok_or(KipukaError::NotFound)?;
    let key = crate::ca::issue::resolve_signing_key(ca_cfg, state.hsm.as_ref()).await?;
    let cmc_response_der = crate::ca::protocol::cmc_transaction(&cmc_response_der, transaction_id)?;
    let cmc_response_der = crate::ca::protocol::signed_cmc(
        &cmc_response_der,
        &issued_certs,
        &ca.cert_der,
        key.as_signing_key(),
        &ca.hash_algorithm,
    )?;
    let response_body = if cms_config.encrypt_responses {
        let enc_alg = cms_config
            .allowed_content_encryption
            .first()
            .map(|s| s.as_str())
            .unwrap_or("AES-256-GCM");

        cms_auth::build_cms_enveloped_data(&cmc_response_der, &cms_result.signer_cert_der, enc_alg)?
    } else {
        cmc_response_der
    };

    state
        .record_audit_event(
            "cms_fullcmc_success",
            &format!("ca_id={ca_id}, identity={identity}"),
        )
        .await;

    build_cms_response(StatusCode::OK, &response_body)
}

/// Build an HTTP response for a CMS-wrapped EST operation.
///
/// Sets Content-Type to `application/pkcs7-mime` per RFC 8295 §4.
/// The body is raw DER — no base64 transfer encoding is used for
/// CMS-wrapped payloads.
fn build_cms_response(status: StatusCode, body: &[u8]) -> Result<Response, KipukaError> {
    let mut resp = (status, body.to_vec()).into_response();
    resp.headers_mut().insert(
        header::CONTENT_TYPE,
        HeaderValue::from_static(CONTENT_TYPE_PKCS7),
    );
    Ok(resp)
}

/// Issue a certificate from a DER-encoded CSR using the direct-signing path.
///
/// This is the shared enrollment pipeline used by all CMS-EST handlers.
/// It resolves the CA backend (HSM or PEM key), builds an enrollment profile,
/// calls `issue_certificate`, and returns the DER-encoded issued certificate.
///
/// # Errors
///
/// Returns `KipukaError::NotFound` if the CA is unknown, `KipukaError::Ca`
/// on signing failures, and `KipukaError::ServiceUnavailable` if the HSM
/// is offline.
async fn issue_certificate_from_csr(
    state: &AppState,
    ca_id: &str,
    csr_der: &[u8],
) -> Result<Vec<u8>, KipukaError> {
    let ca = state.get_ca(ca_id).ok_or(KipukaError::NotFound)?;

    let ca_cfg = state
        .config
        .cas
        .iter()
        .find(|c| c.id == ca_id)
        .ok_or_else(|| KipukaError::Ca(format!("CA config not found for id={ca_id}")))?;

    // Resolve key material.
    let resolved_key = crate::ca::issue::resolve_signing_key(ca_cfg, state.hsm.as_ref()).await?;

    let profile = crate::ca::issue::EnrollmentProfile {
        max_validity_days: ca
            .validity_days
            .min(crate::ca::issue::cab_forum_max_validity_days()),
        ..crate::ca::issue::EnrollmentProfile::default()
    };

    let result = crate::ca::issue::issue_certificate(
        csr_der,
        &profile,
        &ca.cert_der,
        resolved_key.as_signing_key(),
        &ca.hash_algorithm,
        ca.ocsp_url.as_deref(),
        ca.crl_url.as_deref(),
    )
    .map_err(KipukaError::from)?;

    crate::ca::issue::persist_certificate(state, ca_id, &profile.name, &result).await?;
    Ok(result.certificate_der)
}