fix(ipsec): подтвердить сертификатный клиент и сообщать сбой истории

backend/src/services/ipsec-live.ts

@@ -280,7 +280,10 @@ export function mapClients(state: IpsecServerState): IpsecClientDto[] {
     const comment = identity?.comment ?? ""
     const mcName = (identity?.["mode-config"] ?? "").trim()
     const cn = String(cert["common-name"] ?? "").trim()
-    const active = (cn ? findActive(cn) : undefined)
+    // Our issued certificates have a single CN subject; match the whole DN, never a CN substring.
+    const singleCn = cn && !/[,+=<>;\\"\u0000]/.test(cn) && state.certs.filter(c => c["common-name"] === cn).length === 1
+      ? activeByRemote.get(`CN=${cn}`) : undefined
+    const active = (cn ? findActive(cn) : undefined) ?? singleCn
       ?? (identity?.["remote-id"] ? findActive(String(identity["remote-id"]).trim()) : undefined)
     out.push({
       id: `${server.id}:${identity ? "identity" : "cert"}:${String(identity?.[".id"] ?? cert[".id"] ?? certName)}`,

backend/src/services/ipsec-state.test.ts

@@ -92,4 +92,11 @@ for (const prefix of ["fqdn", "user-fqdn", "address", "unknown"]) {
   sessionState.active = [{ ".id": "*ACTIVE", id: "alice", state: "established" }]
   assert.equal(mapClients(sessionState)[0]?.online, prefix !== "unknown"); checks++
 }
+state.active = [{ ".id": "*CERTACTIVE", id: "CN=Original CN", state: "established", "dynamic-address": "198.18.79.250", uptime: "1s" }]
+assert.equal(mapClients(state).find(c => c.certName === "client")?.online, true); checks++
+state.active[0]!.id = "CN=Original CN,O=Other"
+assert.equal(mapClients(state).find(c => c.certName === "client")?.online, false); checks++
+state.active[0]!.id = "CN=Original CN"
+state.certs.push({ ".id": "*DUPCN", name: "duplicate-cn", "common-name": "Original CN", ca: "ca", "key-usage": "tls-client" })
+assert.equal(mapClients(state).find(c => c.certName === "client")?.online, false); checks++
 console.log(`ipsec-state: ${checks} checks passed`)