Add PEM encoded certificate to external api response

nexus/db-model/src/certificate.rs

@@ -82,6 +82,13 @@ impl TryFrom<Certificate> for views::Certificate {
         Ok(Self {
             identity: cert.identity(),
             service: cert.service.try_into()?,
+            // This is expected to succeed in normal circumstances. Certificates are stored in the
+            // database with PEM encoding which are essentially bundles of Base64 encoded text.
+            // The only cases in which this conversion should fail is when our internal database
+            // representation of the certificate is invalid.
+            cert: String::from_utf8(cert.cert).map_err(|_| {
+                Error::internal_error("Certificate is not valid UTF-8")
+            })?,
         })
     }
 }

nexus/types/src/external_api/views.rs

@@ -177,7 +177,10 @@ pub struct Project {
 pub struct Certificate {
     #[serde(flatten)]
     pub identity: IdentityMetadata,
+    /// The service using this certificate
     pub service: ServiceUsingCertificate,
+    /// PEM-formatted string containing public certificate chain
+    pub cert: String,
 }
 
 // IMAGES

openapi/nexus.json

@@ -11021,6 +11021,10 @@
         "description": "View of a Certificate",
         "type": "object",
         "properties": {
+          "cert": {
+            "description": "PEM-formatted string containing public certificate chain",
+            "type": "string"
+          },
           "description": {
             "description": "human-readable free-form text about a resource",
             "type": "string"
@@ -11039,7 +11043,12 @@
             ]
           },
           "service": {
-            "$ref": "#/components/schemas/ServiceUsingCertificate"
+            "description": "The service using this certificate",
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/ServiceUsingCertificate"
+              }
+            ]
           },
           "time_created": {
             "description": "timestamp when this resource was created",
@@ -11053,6 +11062,7 @@
           }
         },
         "required": [
+          "cert",
           "description",
           "id",
           "name",