`ValidityYears` template enrollment parameter is a silent no-op

[spbsoluble]

Symptom

Constants.EnrollmentParam.ValidityYears is declared as a per-template enrollment parameter annotation (CERTInextCAPluginConfig.cs:390-397):

[Constants.EnrollmentParam.ValidityYears] = new PropertyConfigInfo
{
    Comments = "OPTIONAL: Subscription validity in years: 1, 2, or 3. Default: 1. " +
               "Note: CERTInext validates per 390-day certificate within the subscription; " +
               "the 'validity' field in the order is the subscription term, not certificate lifetime.",
    Hidden = false,
    DefaultValue = 1,
    Type = "Number"
},

This shows up in Command's UI as a settable per-template field with a DefaultValue of 1, promising that an administrator can override subscription validity years per enrollment template.

It is never read anywhere. CERTInext/Models/EnrollmentParams.cs — the wrapper around EnrollmentProductInfo.ProductParameters that every other enrollment param goes through (GetString/GetInt/GetBool) — has no ValidityYears property. Neither CERTInextCAPlugin.cs nor CERTInext/Client/CERTInextClient.cs ever look up Constants.EnrollmentParam.ValidityYears from ProductParameters. The only "validity years" value actually consumed at order-build time is the connector-level config SubscriptionValidityYears (CERTInextClient.cs:1316-1320, default "1").

So setting ValidityYears on a template had zero effect on the order placed — the connector-level default (or override) always won, silently.

Root cause

ValidityYears was added to the enrollment-param annotations (alongside the deprecated ProfileId/ValidityDays params) but the corresponding read/plumb-through into EnrollmentParams and the order-build path was never added. The deprecated ValidityDays param is wired up (EnrollmentParams.cs:56), which is likely how the gap went unnoticed — ValidityDays works, its replacement ValidityYears didn't.

Severity

Medium — no crash, no wrong cert issued, but a documented, admin-facing template override silently did nothing.

Fix

Fixed by #13 — added a ValidityYears int getter to EnrollmentParams (mirroring the existing GetInt pattern) and consumed it in CERTInextClient.BuildOrderRequestFromLegacyEnrollRequest ahead of the legacy ValidityDays param and the connector-level SubscriptionValidityYears fallback. Covered by unit tests asserting the per-template override reaches the built order body, and that it still falls back correctly when unset.

[github-actions]

Thanks for opening this issue! Our team has been notified and will follow up here.