v0,28,2

src/admin/operations.rs

@@ -319,6 +319,10 @@ struct CertificateApiRotate {
     token: Option<String>,
     #[serde(default)]
     comment: Option<String>,
+    #[serde(default)]
+    certificate_ids: Vec<String>,
+    #[serde(default)]
+    allow_deploy: bool,
 }
 
 fn valid_certificate_api_comment(value: &str) -> bool {
@@ -377,10 +381,36 @@ async fn certificate_api_rotate(
             "certificate_api.invalid_comment".into(),
         ));
     }
+    let mut certificate_ids: Vec<String> = input
+        .certificate_ids
+        .into_iter()
+        .map(|value| value.trim().to_owned())
+        .filter(|value| !value.is_empty())
+        .collect();
+    certificate_ids.sort();
+    certificate_ids.dedup();
+    if certificate_ids.is_empty()
+        || certificate_ids.len() > 32
+        || certificate_ids
+            .iter()
+            .any(|value| value == "*" || !crate::config::valid_id(value))
+    {
+        return Err(ApiError(
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "certificate_api.invalid_certificate_ids".into(),
+        ));
+    }
     let token_hash = auth::secret_hash(&token);
     let credential = state
         .store
-        .upsert_certificate_api_credential(&key_id, &token_hash, &comment, &session.username)
+        .upsert_certificate_api_credential(
+            &key_id,
+            &token_hash,
+            &comment,
+            input.allow_deploy,
+            &certificate_ids,
+            &session.username,
+        )
         .await
         .map_err(|error| {
             if error.to_string().contains("credential limit reached") {