fix: Require exact ADCS trust paths in creation and composition BED-9336

[JonasBK]

Description

This PR makes ADCS edge creation and composition use the same exact certificate-chain and NTAuth trust patterns for the target domain.

Where a rooted certificate chain is required, the selected Enterprise CA must follow:

(eca:EnterpriseCA)-[:IssuedSignedBy|EnterpriseCAFor*1..]->(:RootCA)-[:RootCAFor]->(d:Domain)

The repeated portion may pass through EnterpriseCA and AIACA nodes before reaching the RootCA.

Where NTAuth trust is required, the selected Enterprise CA must follow:

(eca:EnterpriseCA)-[:TrustedForNTAuth]->(:NTAuthStore)-[:NTAuthStoreFor]->(d:Domain)

This change:

• Introduces shared traversal patterns for rooted CA chains and NTAuth trust.
• Requires the certificate chain to terminate at a RootCA connected to the exact target domain.
• Supports valid multi-tier chains through EnterpriseCA and AIACA nodes.
• Rejects direct EnterpriseCA-[:RootCAFor]->Domain shortcuts and unsupported intermediate node kinds.
• Requires NTAuth to be the exact two-hop path through an NTAuthStore.
• Rejects direct-to-domain NTAuth shortcuts, arbitrary intermediate nodes, and extra NTAuth-store hops.
• Reuses the requirements across creation queries and affected ADCS compositions.
• Adds no node kinds, relationship kinds, or stored provenance.

Stack

• Base: BED-9336-adcs-managed-account-dns
• Head: BED-9336-adcs-trust-paths
• This is PR 2 of 4.
• After PR 1 merges, retarget this PR to main.
• After this PR merges, retarget BED-9336-adcs-host-validation to main.

Commit review order

1. fix: require rooted ADCS certificate chains BED-9336

   • Tightens creation-side certificate-chain traversal.
   • Adds the shared composition pattern.
   • Covers valid multi-tier chains and invalid shortcuts or intermediates.

2. fix: require exact ADCS NTAuth paths BED-9336

   • Tightens creation-side and composition-side NTAuth traversal.
   • Fixes the final certificate-chain hop depths.
   • Adds positive and negative coverage for the exact NTAuth topology.

Motivation and Context

Resolves BED-9336

The previous traversals primarily checked whether a domain was reachable through a set of relationship kinds. They did not consistently enforce node kinds, relationship order, path length, or the exact target domain.

Malformed or shortcut paths could therefore qualify during creation or appear in composition. The shared patterns make the documented PKI and NTAuth topology explicit and keep edge creation and composition equivalent.

How Has This Been Tested?

Validated with:

• go test ./packages/go/analysis/ad -count=1
• just prepare-for-codereview

Coverage includes:

• A direct Enterprise CA-to-Root CA chain.
• A multi-tier chain through both AIACA and intermediate EnterpriseCA nodes.
• Rejection of direct RootCAFor shortcuts.
• Rejection of unsupported intermediate node kinds.
• A valid exact TrustedForNTAuth -> NTAuthStoreFor path.
• Rejection of direct-to-domain, arbitrary-intermediate, and multi-store NTAuth paths.
• Existing ADCS composition harnesses using the shared traversal patterns.

Screenshots (optional):

N/A — backend graph analysis only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)

Checklist:

• I have met the contributing prerequisites
  • Assigned myself to this PR
  • Added the appropriate labels
  • Associated an issue: Issues and Pull Requests README #672
  • Read the Contributing guide: https://github.com/SpecterOps/BloodHound/wiki/Contributing
• I have ensured that related documentation is up-to-date
  • Open API docs
  • Code comments (GoDocs / JSDocs)
• I have followed proper test practices
  • Added/updated tests to cover my changes
  • All new and existing tests passed

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 81e27e5c-4975-47b3-a9a2-b6b61dd15f6b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}