CertService: Fix account id requirement by using caller account id as fallback

[resmo]

Description

While implementing an ansible module for ssl cert (ngine-io/ansible-collection-cloudstack#178). I faced this api and experienced this issue. (As a side note: The ssl cert api is IMHO not consistent with other cloudstack apis: e.g. there are no domainId with accountName param but an accountId.)

SSL cert service requires to set the account id (if no project id or lb id), however, this is inconsistent to other cloudstack APIs where (AFAICS) the caller account name is used instead as a fallack.

UPDATE:
I added another commit on top to streamline the api by adding account and domainid to the list api. Let's discuss which way to go.

This change aligns with this behaviour.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Bug Severity

• BLOCKER
• Critical
• Major
• Minor
• Trivial

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

[Copilot]

Pull request overview

Aligns CertService SSL certificate listing behavior with other CloudStack APIs by falling back to the caller’s account when no explicit accountId (and no other filter like project/LB/cert) is provided, removing an unnecessary hard requirement that caused client friction (e.g., automation modules).

Changes:

• Update listSslCerts to use the caller account ID as the default when accountId is not provided.
• Add a unit test ensuring the no-filter case queries certificates for the caller’s account.
• Minor cleanup: parameterized logging and correct string comparison for key algorithm checks.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java	Implements caller-account fallback for listing certs; minor logging/string-compare adjustments; updates PEM reader close handling.
server/src/test/java/org/apache/cloudstack/network/ssl/CertServiceTest.java	Adds a regression test validating caller-account fallback behavior for listSslCerts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java:375

• The comment and logic here are misleading: this block is not about "encryption for DSA"; it conditionally performs an RSA signature round-trip to validate that the keypair matches, and it skips validation for any non-RSA algorithm (not just DSA). Consider updating the comment and using a null-safe string comparison for clarity.

        // No encryption for DSA
        if (!pubKey.getAlgorithm().equals("RSA")) {
            return;
        }

[codecov]

Codecov Report

❌ Patch coverage is 23.07692% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.65%. Comparing base (5a67f19) to head (8a3871f).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...api/command/user/loadbalancer/ListSslCertsCmd.java	16.66%	5 Missing ⚠️
...apache/cloudstack/network/ssl/CertServiceImpl.java	28.57%	2 Missing and 3 partials ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #13818   +/-   ##
=========================================
  Coverage     19.64%   19.65%           
- Complexity    19790    19791    +1     
=========================================
  Files          6368     6368           
  Lines        574889   574897    +8     
  Branches      70353    70354    +1     
=========================================
+ Hits         112962   112982   +20     
+ Misses       449656   449637   -19     
- Partials      12271    12278    +7     

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	20.92% <23.07%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (2)

server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java:206

• The owner-selection condition can silently ignore a provided accountName when domainId is missing because it uses StringUtils.isNotEmpty(...) as a gate. This bypasses _accountMgr.finalizeOwner(...) validation (which would throw when accountName != null && domainId == null), and the current &&/|| expression is also hard to read due to operator precedence. Consider keying on accountName != null (not non-empty) and grouping the projectId/accountName cases explicitly so invalid parameter combinations are rejected instead of being ignored.

        Account owner = null;
        if (StringUtils.isNotEmpty(listSslCertCmd.getAccountName()) && listSslCertCmd.getDomainId() != null || listSslCertCmd.getProjectId() != null) {
            owner = _accountMgr.finalizeOwner(caller, listSslCertCmd.getAccountName(), listSslCertCmd.getDomainId(), listSslCertCmd.getProjectId());
        } else {
            owner = caller;

api/src/main/java/org/apache/cloudstack/api/command/user/loadbalancer/ListSslCertsCmd.java:28

• import org.apache.cloudstack.api.response.*; introduces a wildcard import, which is inconsistent with the surrounding API command classes in this package that use explicit response imports (e.g. CreateLoadBalancerRuleCmd.java:30-34, DeleteSslCertCmd.java:27-28). Using explicit imports avoids accidental unused dependencies and keeps diffs more readable.

import org.apache.cloudstack.api.response.*;

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

server/src/main/java/org/apache/cloudstack/network/ssl/CertServiceImpl.java:203

• The owner resolution condition mixes && and || without parentheses and only calls finalizeOwner when (accountName && domainId) or projectId is set. This means invalid combinations like specifying accountName without domainId are silently ignored (finalizeOwner would normally throw), and it also allows ambiguous requests when accountId is supplied together with account/domainId or projectId. Consider computing a single hasOwnerParams flag, calling finalizeOwner whenever any owner-related parameter is provided (so validation/permission checks run), and rejecting combinations that include both deprecated accountId and the new owner parameters.

        Account owner = null;
        if (StringUtils.isNotEmpty(listSslCertCmd.getAccountName()) && listSslCertCmd.getDomainId() != null || listSslCertCmd.getProjectId() != null) {
            owner = _accountMgr.finalizeOwner(caller, listSslCertCmd.getAccountName(), listSslCertCmd.getDomainId(), listSslCertCmd.getProjectId());