Implement certificate compliance policies

[Copilot]

Adds policy-based certificate compliance enforcement as specified in v1.2 roadmap. Administrators can define policies with 8 rule types (key size, algorithms, expiration, Microsoft-only, subject patterns) evaluated against device certificates with severity levels (Info/Warning/Critical).

Implementation

Models & Storage

• CertificateCompliancePolicy, PolicyRule, ComplianceResult in Shared
• PolicyEntity with JSON-serialized rules
• EF Core migration adds Policies table with indexes on IsEnabled, FleetId

API

• PoliciesController: CRUD operations for policy management
• ComplianceController: Evaluate devices individually, bulk, or summary statistics
• PolicyEvaluationService: Rule evaluation logic with fleet-scoping and priority ordering

UI

• Policy list/create pages with dynamic rule builder
• Compliance status card on device details showing violations by severity
• Client-side validation ensures rules have required values

Testing

• 8 unit tests cover all rule types, fleet filtering, disabled policies

Example Policy

{
  "name": "Basic Security",
  "isEnabled": true,
  "priority": 100,
  "rules": [
    {
      "ruleType": "MinimumKeySize",
      "severity": "Critical",
      "value": "2048"
    },
    {
      "ruleType": "DisallowExpiredCertificates",
      "severity": "Critical"
    }
  ]
}

Security

Fixed CodeQL log forging alerts by removing user-controlled policy names from log statements.

Migration Required

dotnet ef database update --project SecureBootDashboard.Api

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Certificate compliance policies</issue_title>
<issue_description>Implement feature Certificate compliance policies as described in roadmap</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Certificate compliance policies #3

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.