feat(ipsec): enhance IPsec management with peer and certificate handling

- Added support for managing IPsec peers, including editing and deleting functionality.
- Introduced a new UI component for displaying peers and their details within the IPsec server grid.
- Updated the IPsec user creation form to allow binding identities to specific peers.
- Enhanced backend routes and services to handle peer patching and deletion requests.
- Improved data structures to accommodate multiple peers and certificates for each server.
- Added tests to ensure proper functionality of new peer management features.

backend/src/services/ipsec-config.test.ts

@@ -5,6 +5,7 @@ import {
   buildSswanConfig,
   clientCertName,
   findFreePoolIp,
+  identityDisplayName,
   ipsecManagedComment,
   ipsecSlug,
   ipsecUserComment,
@@ -52,6 +53,31 @@ import {
   assert.equal(findFreePoolIp("мусор", []), null)
 }
 
+{
+  // managed: user= из comment
+  assert.equal(identityDisplayName({ comment: ipsecUserComment("alice"), ".id": "*1" }, []), "alice")
+  // существующий RouterOS identity: сырой comment
+  assert.equal(identityDisplayName({ comment: "home office", ".id": "*2" }, []), "home office")
+  // remote-id
+  assert.equal(identityDisplayName({ "remote-id": "[email protected]", ".id": "*3" }, []), "[email protected]")
+  // CN сертификата по remote-certificate
+  assert.equal(
+    identityDisplayName(
+      { "remote-certificate": "ipsec-user-bob", ".id": "*4" },
+      [{ name: "ipsec-user-bob", "common-name": "bob" }],
+    ),
+    "bob",
+  )
+  // fallback: peer#shortId
+  assert.equal(
+    identityDisplayName({ peer: "ikev2-srv", ".id": "*AB12CD34" }, []),
+    "ikev2-srv#AB12CD",
+  )
+  // fallback: rosId
+  assert.equal(identityDisplayName({ ".id": "*FF" }, []), "FF")
+  assert.equal(identityDisplayName({}, []), "identity")
+}
+
 {
   const sswan = buildSswanConfig({
     name: "IKEv2 vpn.example.com",

backend/src/services/ipsec-config.ts

@@ -24,6 +24,35 @@ export function parseIpsecUserComment(comment: string | undefined | null): strin
   return m?.[1] ?? null
 }
 
+type IdentityLike = {
+  ".id"?: string
+  comment?: string
+  "remote-id"?: string
+  "remote-certificate"?: string
+  peer?: string
+}
+
+type CertLike = { name?: string; "common-name"?: string }
+
+/** Отображаемое имя identity: managed user= → сырой comment → remote-id → CN сертификата → peer#id. */
+export function identityDisplayName(i: IdentityLike, certs: CertLike[] = []): string {
+  const comment = (i.comment ?? "").trim()
+  const managedName = parseIpsecUserComment(comment)
+  if (managedName) return managedName
+  if (comment) return comment
+  const remoteId = (i["remote-id"] ?? "").trim()
+  if (remoteId) return remoteId
+  const remoteCert = (i["remote-certificate"] ?? "").trim()
+  if (remoteCert) {
+    const cn = String(certs.find((c) => String(c.name ?? "").trim() === remoteCert)?.["common-name"] ?? "").trim()
+    return cn || remoteCert
+  }
+  const rosId = String(i[".id"] ?? "").replace(/^\*/, "")
+  const peer = (i.peer ?? "").trim()
+  if (peer) return `${peer}#${rosId.slice(0, 6) || "identity"}`
+  return rosId || "identity"
+}
+
 // ── naming-конвенции управляемых объектов RouterOS ──────────────────────────
 
 export const IPSEC_CA_CERT = "ipsec-ca"

backend/src/services/ipsec-live.ts

@@ -16,8 +16,8 @@ import {
   IPSEC_COMMON_NAME,
   IPSEC_SERVER_CERT,
   clientCertName,
+  identityDisplayName,
   isIpsecManagedComment,
-  parseIpsecUserComment,
 } from "./ipsec-config.js"
 import {
   canonicalIpsecSnapshot,
@@ -111,6 +111,8 @@ export function mapCertificate(c: RosCertRow): IpsecCertInfoDto {
   const name = String(c.name ?? "")
   const keyUsage = String(c["key-usage"] ?? "")
   const isCa = keyUsage.includes("key-cert-sign")
+  const isServer = keyUsage.includes("tls-server")
+  const isClient = keyUsage.includes("tls-client")
   const isUser = name.startsWith("ipsec-user-")
   return {
     name,
@@ -120,7 +122,7 @@ export function mapCertificate(c: RosCertRow): IpsecCertInfoDto {
     expiresAt: c["invalid-after"] || undefined,
     trusted: asBool(c.trusted),
     hasPrivateKey: asBool(c["private-key"]),
-    role: isCa ? "ca" : name === IPSEC_SERVER_CERT ? "server" : isUser ? "client" : "other",
+    role: isCa ? "ca" : name === IPSEC_SERVER_CERT || isServer ? "server" : isUser || isClient ? "client" : "other",
     managed: isCa && name === IPSEC_CA_CERT
       || name === IPSEC_SERVER_CERT
       || isUser
@@ -202,14 +204,9 @@ export async function fetchIpsecState(server: ServerRow): Promise<IpsecServerSta
   return { server, client, peers, identities, modeConfigs, pools, policies, nat, active, certs }
 }
 
-/** Клиенты = managed-идентичности (созданы менеджером). */
+/** Клиенты = все identity роутера (managed + существующие RouterOS). */
 export function mapClients(state: IpsecServerState): IpsecClientDto[] {
   const server = state.server
-  const certByCommonName = new Map<string, RosCertRow>()
-  for (const c of state.certs) {
-    const cn = String(c["common-name"] ?? "").trim()
-    if (cn) certByCommonName.set(cn, c)
-  }
   const mcByName = new Map(state.modeConfigs.map((m) => [(m.name ?? "").trim(), m]))
   const activeByRemote = new Map<string, RosIpsecActivePeer>()
   for (const a of state.active) {
@@ -218,10 +215,10 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
   }
 
   return state.identities
-    .filter((i) => isIpsecManagedComment(i.comment))
     .map((i): IpsecClientDto => {
       const comment = i.comment ?? ""
-      const name = parseIpsecUserComment(comment) ?? (comment || "client")
+      const managed = isIpsecManagedComment(comment)
+      const name = identityDisplayName(i, state.certs)
       const psk = (i["auth-method"] ?? "") === "pre-shared-key"
       const certName = (i["remote-certificate"] ?? "").trim()
       const cn = certName
@@ -229,8 +226,8 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
         : ""
       const mcName = (i["mode-config"] ?? "").trim()
       const mc = mcByName.get(mcName)
-      const staticIp = mc && (mc.name ?? "").startsWith("mc-ipsec-")
-        ? (mc.address ?? mc["address-prefix"] ?? "").replace(/\/\d+$/, "") || undefined
+      const staticIp = mc
+        ? ((mc.address ?? mc["address-prefix"] ?? "").replace(/\/\d+$/, "").trim() || undefined)
         : undefined
       const active = (cn ? activeByRemote.get(cn) : undefined)
         ?? (i["remote-id"] ? activeByRemote.get(i["remote-id"]) : undefined)
@@ -252,7 +249,7 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
         activeSince: active?.established || undefined,
         disabled: asBool(i.disabled),
         comment: comment || undefined,
-        managed: true,
+        managed,
       }
     })
     .sort((a, b) => a.name.localeCompare(b.name))
@@ -262,6 +259,8 @@ export function mapServerSummary(state: IpsecServerState, clients: IpsecClientDt
   const server = state.server
   const managedPeer = state.peers.find((p) => isIpsecManagedComment(p.comment))
     ?? state.peers.find((p) => (p.name ?? "").trim() === IPSEC_COMMON_NAME)
+  /** Для отображения: managed peer, иначе первый существующий peer роутера. */
+  const primaryPeer = managedPeer ?? state.peers[0]
   const sharedMc = state.modeConfigs.find(
     (m) => (m.name ?? "").trim() === IPSEC_COMMON_NAME || (isIpsecManagedComment(m.comment) && !(m.name ?? "").startsWith("mc-ipsec-")),
   )
@@ -270,7 +269,9 @@ export function mapServerSummary(state: IpsecServerState, clients: IpsecClientDt
       ?? state.pools.find((p) => isIpsecManagedComment(p.comment))
     : undefined
   const caCert = state.certs.find((c) => String(c.name ?? "") === IPSEC_CA_CERT)
+    ?? state.certs.find((c) => String(c["key-usage"] ?? "").includes("key-cert-sign"))
   const serverCert = state.certs.find((c) => String(c.name ?? "") === IPSEC_SERVER_CERT)
+    ?? state.certs.find((c) => String(c["key-usage"] ?? "").includes("tls-server"))
   const natRuleManaged = state.nat.some((r) => isIpsecManagedComment(r.comment) && r.chain === "srcnat")
   return {
     serverId: String(server.id),
@@ -278,7 +279,8 @@ export function mapServerSummary(state: IpsecServerState, clients: IpsecClientDt
     serverCountry: server.country ?? undefined,
     initialized: Boolean(managedPeer && caCert && serverCert),
     serverEndpoint: serverCert ? String(serverCert["common-name"] ?? "") || undefined : undefined,
-    peer: managedPeer ? mapPeer(server, managedPeer) : undefined,
+    peer: primaryPeer ? mapPeer(server, primaryPeer) : undefined,
+    peers: state.peers.map((p) => mapPeer(server, p)),
     pool: pool ? mapPool(server, pool) : undefined,
     sharedModeConfig: sharedMc ? mapModeConfig(server, sharedMc) : undefined,
     caCert: caCert ? mapCertificate(caCert) : undefined,
@@ -286,15 +288,14 @@ export function mapServerSummary(state: IpsecServerState, clients: IpsecClientDt
     natRuleManaged,
     clientsTotal: clients.length,
     clientsOnline: clients.filter((c) => c.online).length,
-    certs: state.certs
-      .filter((c) => {
-        const n = String(c.name ?? "")
-        return n === IPSEC_CA_CERT || n === IPSEC_SERVER_CERT || n.startsWith("ipsec-user-")
-      })
-      .map(mapCertificate),
+    certs: state.certs.map(mapCertificate),
   }
 }
 
+/**
+ * Snapshot для истории/отката намеренно остаётся managed-only (`MikrotikManager:ipsec`):
+ * restore не должен трогать/пересоздавать уже существующие на роутере (не наших) объекты.
+ */
 export async function captureIpsecSnapshot(server: ServerRow): Promise<IpsecSnapshot> {
   const state = await fetchIpsecState(server)
   return canonicalIpsecSnapshot({

backend/src/services/ipsec-ros.ts

@@ -206,6 +206,14 @@ export async function deleteIdentity(client: MikrotikClient, rosId: string): Pro
   await client.delete(`/ip/ipsec/identity/${encodeURIComponent(rosId)}`)
 }
 
+export async function patchPeer(client: MikrotikClient, rosId: string, body: Record<string, string>): Promise<void> {
+  await client.patch(`/ip/ipsec/peer/${encodeURIComponent(rosId)}`, body)
+}
+
+export async function deletePeer(client: MikrotikClient, rosId: string): Promise<void> {
+  await client.delete(`/ip/ipsec/peer/${encodeURIComponent(rosId)}`)
+}
+
 /** Снять с identity персональный mode-config (вернуть выдачу из пула) безопасно: пустой patch не шлём. */
 export async function clearIdentityModeConfig(client: MikrotikClient, rosId: string, sharedModeConfig: string): Promise<void> {
   await patchIdentity(client, rosId, toRosBody({ "mode-config": sharedModeConfig }))