From d58e059c8e366860c0460734a61009b8d5deb249 Mon Sep 17 00:00:00 2001
From: david <davidfolkesmd@gmail.com>
Date: Sat, 19 Sep 2026 12:22:54 -0400
Subject: [PATCH] Add cluster certificate renewal classification

---
 functions/cluster_cert.py | 132 +++++++++++++++++++++++++++++++++++---
 1 file changed, 122 insertions(+), 10 deletions(-)

diff --git a/functions/cluster_cert.py b/functions/cluster_cert.py
index fc676b8..29ccd8f 100644
--- a/functions/cluster_cert.py
+++ b/functions/cluster_cert.py
@@ -51,22 +51,109 @@ UPLOAD_DOMAIN_FRAGMENT = '''\t\tconst certificate = await internalCertificate.up
 '''
 
 
+SCHEDULER_PROVIDER_ANCHOR = '.andWhere("provider", "letsencrypt")\n'
+
+SCHEDULER_FILTER_ANCHOR = "if (!certificates?.length) {"
+
+SCHEDULER_FILTER_FRAGMENT = '''const renewableCertificates = (certificates || []).filter(
+							(certificate) =>
+								certificate.provider === "letsencrypt" ||
+								(
+									certificate.provider === "other" &&
+									certificate.meta?.cluster_managed === true &&
+									certificate.meta?.acme_renew === true
+								),
+						);
+
+						if (!renewableCertificates.length) {'''
+
+SCHEDULER_FOREACH_ANCHOR = "certificates.forEach((certificate) => {"
+
+SCHEDULER_FOREACH_FRAGMENT = (
+    "renewableCertificates.forEach((certificate) => {"
+)
+
+CLUSTER_RENEW_THROW_ANCHOR = (
+    "throw new error.ValidationError("
+    "\"Only Let'sEncrypt certificates can be renewed\");"
+)
+
+CLUSTER_RENEW_THROW_FRAGMENT = '''if (
+			certificate.provider === "other" &&
+			certificate.meta?.cluster_managed === true &&
+			certificate.meta?.acme_renew === true
+		) {
+			throw new error.ValidationError(
+				"Cluster-managed ACME renewal path is not yet enabled",
+			);
+		}
+
+		throw new error.ValidationError("Only Let'sEncrypt certificates can be renewed");'''
+
+
 def apply_certificate_js(source: str) -> str:
     if UPLOAD_DOMAIN_FRAGMENT in source:
         log("cluster_cert_upload_domains=already-present")
-        return source
+    else:
+        source = replace_exactly_once(
+            source,
+            UPLOAD_DOMAIN_ANCHOR,
+            UPLOAD_DOMAIN_FRAGMENT,
+            description="cluster certificate upload domain preservation",
+        )
+        log("cluster_cert_upload_domains=added")
 
-    source = replace_exactly_once(
-        source,
-        UPLOAD_DOMAIN_ANCHOR,
-        UPLOAD_DOMAIN_FRAGMENT,
-        description="cluster certificate upload domain preservation",
-    )
+    if SCHEDULER_PROVIDER_ANCHOR in source:
+        source = replace_exactly_once(
+            source,
+            SCHEDULER_PROVIDER_ANCHOR,
+            "",
+            description="cluster certificate scheduler provider restriction",
+        )
+        log("cluster_cert_scheduler_query=added")
+    elif SCHEDULER_FILTER_FRAGMENT in source:
+        log("cluster_cert_scheduler_query=already-present")
+    else:
+        raise RuntimeError(
+            "cluster certificate scheduler query: "
+            "provider restriction missing but classifier is not present"
+        )
+
+    if SCHEDULER_FILTER_FRAGMENT in source:
+        log("cluster_cert_scheduler_filter=already-present")
+    else:
+        source = replace_exactly_once(
+            source,
+            SCHEDULER_FILTER_ANCHOR,
+            SCHEDULER_FILTER_FRAGMENT,
+            description="cluster certificate scheduler filter",
+        )
+        log("cluster_cert_scheduler_filter=added")
+
+    if SCHEDULER_FOREACH_FRAGMENT in source:
+        log("cluster_cert_scheduler_foreach=already-present")
+    else:
+        source = replace_exactly_once(
+            source,
+            SCHEDULER_FOREACH_ANCHOR,
+            SCHEDULER_FOREACH_FRAGMENT,
+            description="cluster certificate scheduler foreach",
+        )
+        log("cluster_cert_scheduler_foreach=added")
+
+    if CLUSTER_RENEW_THROW_FRAGMENT in source:
+        log("cluster_cert_renew_dispatch=already-present")
+    else:
+        source = replace_exactly_once(
+            source,
+            CLUSTER_RENEW_THROW_ANCHOR,
+            CLUSTER_RENEW_THROW_FRAGMENT,
+            description="cluster certificate renewal dispatch",
+        )
+        log("cluster_cert_renew_dispatch=added")
 
-    log("cluster_cert_upload_domains=added")
     return source
 
-
 def verify_certificate_js(source: str) -> None:
     require_fragment(
         source,
@@ -80,8 +167,33 @@ def verify_certificate_js(source: str) -> None:
         description="cluster certificate custom write verification",
     )
 
-    log("cluster_cert_upload_domains_verification=passed")
+    if SCHEDULER_PROVIDER_ANCHOR in source:
+        raise RuntimeError(
+            "cluster certificate scheduler verification: "
+            "old letsencrypt-only provider restriction remains"
+        )
 
+    require_fragment(
+        source,
+        SCHEDULER_FILTER_FRAGMENT,
+        description="cluster certificate scheduler filter verification",
+    )
+
+    require_fragment(
+        source,
+        SCHEDULER_FOREACH_FRAGMENT,
+        description="cluster certificate scheduler foreach verification",
+    )
+
+    require_fragment(
+        source,
+        CLUSTER_RENEW_THROW_FRAGMENT,
+        description="cluster certificate renewal dispatch verification",
+    )
+
+    log("cluster_cert_upload_domains_verification=passed")
+    log("cluster_cert_scheduler_verification=passed")
+    log("cluster_cert_renew_dispatch_verification=passed")
 
 def apply_schema(source: str) -> str:
     try: