acme-client 2.0.32 → 2.0.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b80e3ea41ac7fd634bb6a5f27597389cda7370255369051fe0c2c3a50ea82d82
-  data.tar.gz: ee54f220befe3999b1f070b697b60a2d57526f9a5d6df93645ef3910e2866072
+  metadata.gz: 89c12bcb307e446e08b101e2ceade09f0edb11bbdbac66406706bf3cc5235f2d
+  data.tar.gz: cf2b1335b4e3080c344fd685731d41d15340265e152037ac9fe4c8e362f8199b
 SHA512:
-  metadata.gz: eff5d82a38dbe7740a818c7a21b65b6cbdcd79dd82c070a7aa8a1cc0ddc8f065bb1af75f2532913614fd44ccb369e730dd16da3087882c7d6395778b5712fa4c
-  data.tar.gz: bd35aaba72b277860c0fde3fadba19c1e4dbf46d404289b9a362615efc982140855b26141bec28fdd058de069d1ed079510ce8c57b7afc4fbae78770fb6f38d1
+  metadata.gz: b0a658e05c3d12188e8615cc0bad63b23649b0839fe96352cc3362be6a567e5b05527f94b645bbee093830a8f2f8e12ca39ca422f44bfa6f479e50e1740d1035
+  data.tar.gz: 00b4f8042dbae77cd3ae156b650f7a63927c6628142ba4b65831892937b237b096b4f00f944436444d3078afc7b2c36f50cef5a17f392a48e2de43b6a656d75b

data/CHANGELOG.md

@@ -1,3 +1,13 @@
+## `2.0.34`
+
+* Add badAttestationStatement error
+
+## `2.0.33`
+
+* Add `Acme::Client::Problem` for structured RFC 7807 / RFC 8555 ACME problem documents
+* Expose `Acme::Client::Error#problem` and problem field accessors while keeping `#acme_error_body` behavior
+* Add typed error mappings for all currently registered IANA ACME error types and verify them against IANA's CSV registry
+
 ## `2.0.32`
 
 * Fix `valid_ip_address?` method definition. Was mistakenly defined on Object instead of `Acme::Client::CertificateRequest`

data/acme-client.gemspec

@@ -20,6 +20,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'rspec', '~> 3.9'
   spec.add_development_dependency 'vcr', '~> 6.0'
   spec.add_development_dependency 'bigdecimal'
+  spec.add_development_dependency 'csv'
   spec.add_development_dependency 'webmock', '~> 3.8'
   spec.add_development_dependency 'webrick', '~> 1.7'
 

data/lib/acme/client/error/rate_limited.rb

@@ -2,14 +2,14 @@ class Acme::Client::Error::RateLimited < Acme::Client::Error::ServerError
   DEFAULT_MESSAGE = 'Error message: urn:ietf:params:acme:error:rateLimited'
   DEFAULT_RETRY_SECONDS = 10
 
-  def initialize(message = DEFAULT_MESSAGE, retry_after = nil, acme_error_body: nil, subproblems: nil)
+  def initialize(message = DEFAULT_MESSAGE, retry_after = nil, acme_error_body: nil, subproblems: nil, problem: nil)
     retry_after_time = case retry_after
                        when Time then retry_after
                        when nil then Time.now + DEFAULT_RETRY_SECONDS
                        else Acme::Client::Util.parse_retry_after(retry_after) || Time.now + DEFAULT_RETRY_SECONDS
                        end
     int_retry_after = retry_after.nil? ? DEFAULT_RETRY_SECONDS : [(retry_after_time - Time.now).ceil, 0].max
-    super(message, retry_after: int_retry_after, acme_error_body: acme_error_body, subproblems: subproblems)
+    super(message, retry_after: int_retry_after, acme_error_body: acme_error_body, subproblems: subproblems, problem: problem)
     @retry_after_time = retry_after_time
   end
 end

data/lib/acme/client/error.rb

@@ -1,5 +1,7 @@
+require 'acme/client/problem'
+
 class Acme::Client::Error < StandardError
-  attr_reader :retry_after, :retry_after_time, :subproblems, :acme_error_body
+  attr_reader :retry_after, :retry_after_time, :subproblems, :acme_error_body, :problem
 
   Subproblem = Struct.new(:type, :detail, :identifier, keyword_init: true) do
     def to_h
@@ -7,12 +9,13 @@ class Acme::Client::Error < StandardError
     end
   end
 
-  def initialize(message = nil, retry_after: nil, acme_error_body: nil, subproblems: nil)
+  def initialize(message = nil, retry_after: nil, acme_error_body: nil, subproblems: nil, problem: nil)
     super(message)
     @retry_after_time = Acme::Client::Util.parse_retry_after(retry_after)
     @retry_after = @retry_after_time ? [(@retry_after_time - Time.now).ceil, 0].max : nil
-    @acme_error_body = acme_error_body
-    @subproblems = parse_subproblems(subproblems)
+    @problem = Acme::Client::Problem.from(problem || acme_error_body)
+    @acme_error_body = acme_error_body || @problem&.to_h
+    @subproblems = parse_subproblems(subproblems || @problem&.raw_subproblems)
   end
 
   private
@@ -31,6 +34,26 @@ class Acme::Client::Error < StandardError
 
   public
 
+  def type
+    problem&.type
+  end
+
+  def code
+    problem&.code
+  end
+
+  def detail
+    problem&.detail || message
+  end
+
+  def status
+    problem&.status
+  end
+
+  def identifier
+    problem&.identifier
+  end
+
   class Timeout < Acme::Client::Error; end
 
   class ClientError < Acme::Client::Error; end
@@ -63,10 +86,18 @@ class Acme::Client::Error < StandardError
   class UserActionRequired < ServerError; end
   class BadRevocationReason < ServerError; end
   class Caa < ServerError; end
+  class Compound < ServerError; end
   class Dns < ServerError; end
   class Connection < ServerError; end
   class Tls < ServerError; end
   class IncorrectResponse < ServerError; end
+  class AutoRenewalCanceled < ServerError; end
+  class AutoRenewalExpired < ServerError; end
+  class AutoRenewalCancellationInvalid < ServerError; end
+  class AutoRenewalRevocationNotSupported < ServerError; end
+  class UnknownDelegation < ServerError; end
+  class OnionCAARequired < ServerError; end
+  class BadAttestationStatement < ServerError; end
 
   ACME_ERRORS = {
     'urn:ietf:params:acme:error:alreadyReplaced' => AlreadyReplaced,
@@ -89,9 +120,17 @@ class Acme::Client::Error < StandardError
     'urn:ietf:params:acme:error:userActionRequired' => UserActionRequired,
     'urn:ietf:params:acme:error:badRevocationReason' => BadRevocationReason,
     'urn:ietf:params:acme:error:caa' => Caa,
+    'urn:ietf:params:acme:error:compound' => Compound,
     'urn:ietf:params:acme:error:dns' => Dns,
     'urn:ietf:params:acme:error:connection' => Connection,
     'urn:ietf:params:acme:error:tls' => Tls,
-    'urn:ietf:params:acme:error:incorrectResponse' => IncorrectResponse
+    'urn:ietf:params:acme:error:incorrectResponse' => IncorrectResponse,
+    'urn:ietf:params:acme:error:autoRenewalCanceled' => AutoRenewalCanceled,
+    'urn:ietf:params:acme:error:autoRenewalExpired' => AutoRenewalExpired,
+    'urn:ietf:params:acme:error:autoRenewalCancellationInvalid' => AutoRenewalCancellationInvalid,
+    'urn:ietf:params:acme:error:autoRenewalRevocationNotSupported' => AutoRenewalRevocationNotSupported,
+    'urn:ietf:params:acme:error:unknownDelegation' => UnknownDelegation,
+    'urn:ietf:params:acme:error:onionCAARequired' => OnionCAARequired,
+    'urn:ietf:params:acme:error:badAttestationStatement' => BadAttestationStatement,
   }
 end

data/lib/acme/client/http_client.rb

@@ -103,11 +103,12 @@ module Acme::Client::HTTPClient
     def raise_on_error!
       retry_after = env.response_headers['retry-after']
       body = env.body.is_a?(Hash) ? env.body : nil
+      problem = Acme::Client::Problem.from(body)
       subproblems = error_subproblems
       if error_class == Acme::Client::Error::RateLimited
-        raise error_class.new(error_message, retry_after, acme_error_body: body, subproblems: subproblems)
+        raise error_class.new(error_message, retry_after, acme_error_body: body, subproblems: subproblems, problem: problem)
       end
-      raise error_class.new(error_message, retry_after: retry_after, acme_error_body: body, subproblems: subproblems)
+      raise error_class.new(error_message, retry_after: retry_after, acme_error_body: body, subproblems: subproblems, problem: problem)
     end
 
     def error_message

data/lib/acme/client/problem.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+module Acme; end
+class Acme::Client; end
+
+class Acme::Client::Problem
+  ERROR_PREFIX = 'urn:ietf:params:acme:error:'.freeze
+
+  # Registry descriptions for problem types, not fallback values for problem details.
+  REGISTERED_ERROR_TYPE_DESCRIPTIONS = {
+    'accountDoesNotExist' => 'The request specified an account that does not exist',
+    'alreadyRevoked' => 'The request specified a certificate to be revoked that has already been revoked',
+    'badCSR' => 'The CSR is unacceptable (e.g., due to a short key)',
+    'badNonce' => 'The client sent an unacceptable anti-replay nonce',
+    'badPublicKey' => 'The JWS was signed by a public key the server does not support',
+    'badRevocationReason' => 'The revocation reason provided is not allowed by the server',
+    'badSignatureAlgorithm' => 'The JWS was signed with an algorithm the server does not support',
+    'caa' => 'Certification Authority Authorization (CAA) records forbid the CA from issuing a certificate',
+    'compound' => 'Specific error conditions are indicated in the "subproblems" array',
+    'connection' => 'The server could not connect to validation target',
+    'dns' => 'There was a problem with a DNS query during identifier validation',
+    'externalAccountRequired' => 'The request must include a value for the "externalAccountBinding" field',
+    'incorrectResponse' => "Response received didn't match the challenge's requirements",
+    'invalidContact' => 'A contact URL for an account was invalid',
+    'malformed' => 'The request message was malformed',
+    'orderNotReady' => 'The request attempted to finalize an order that is not ready to be finalized',
+    'rateLimited' => 'The request exceeds a rate limit',
+    'rejectedIdentifier' => 'The server will not issue certificates for the identifier',
+    'serverInternal' => 'The server experienced an internal error',
+    'tls' => 'The server received a TLS error during validation',
+    'unauthorized' => 'The client lacks sufficient authorization',
+    'unsupportedContact' => 'A contact URL for an account used an unsupported protocol scheme',
+    'unsupportedIdentifier' => 'An identifier is of an unsupported type',
+    'userActionRequired' => 'Visit the "instance" URL and take actions specified there',
+    'autoRenewalCanceled' => 'The short-term certificate is no longer available because the auto-renewal Order has been explicitly canceled by the IdO',
+    'autoRenewalExpired' => 'The short-term certificate is no longer available because the auto-renewal Order has expired',
+    'autoRenewalCancellationInvalid' => 'A request to cancel an auto-renewal Order that is not in state "valid" has been received',
+    'autoRenewalRevocationNotSupported' => 'A request to revoke an auto-renewal Order has been received',
+    'unknownDelegation' => 'An unknown configuration is listed in the delegation attribute of the order request',
+    'onionCAARequired' => 'The CA only supports checking the CAA for Hidden Services in-band, but the client has not provided an in-band CAA',
+    'alreadyReplaced' => 'The request specified a predecessor certificate that has already been marked as replaced',
+    'badAttestationStatement' => 'The attestation statement is unacceptable (e.g. not signed by an attestation authority trusted by the CA)'
+  }.freeze
+
+  def self.from(value)
+    case value
+    when nil
+      nil
+    when Acme::Client::Problem
+      value
+    when Hash
+      new(value)
+    end
+  end
+
+  attr_reader :raw
+
+  def initialize(raw = {})
+    @raw = raw || {}
+  end
+
+  def type
+    fetch('type')
+  end
+
+  def code
+    return unless type
+    return unless type.start_with?(ERROR_PREFIX)
+
+    type[ERROR_PREFIX.length..-1]
+  end
+
+  def title
+    fetch('title')
+  end
+
+  def detail
+    fetch('detail')
+  end
+
+  def status
+    fetch('status')
+  end
+
+  def instance
+    fetch('instance')
+  end
+
+  def identifier
+    fetch('identifier')
+  end
+
+  def subproblems
+    return [] unless raw_subproblems.is_a?(Array)
+
+    raw_subproblems.map { |subproblem| self.class.new(subproblem) }
+  end
+
+  def raw_subproblems
+    fetch('subproblems')
+  end
+
+  def registered?
+    REGISTERED_ERROR_TYPE_DESCRIPTIONS.key?(code)
+  end
+
+  alias standard? registered?
+
+  def description
+    REGISTERED_ERROR_TYPE_DESCRIPTIONS[code]
+  end
+
+  def matches?(type_or_code)
+    candidate = type_or_code.to_s
+    candidate == type || candidate == code || "#{ERROR_PREFIX}#{candidate}" == type
+  end
+
+  def message
+    detail || title || type
+  end
+
+  def to_h
+    raw
+  end
+
+  def as_json(*_arguments)
+    to_h
+  end
+
+  private
+
+  def fetch(key)
+    raw[key] || raw[key.to_sym]
+  end
+end

data/lib/acme/client/resources/challenges/base.rb

@@ -31,10 +31,11 @@ class Acme::Client::Resources::Challenges::Base
   def typed_error
     return nil unless error
 
-    error_type = error['type']
-    error_detail = error['detail'] || 'Unknown error'
+    problem = Acme::Client::Problem.from(error)
+    error_type = problem&.type
+    error_detail = problem&.detail || 'Unknown error'
     error_class = Acme::Client::Error::ACME_ERRORS.fetch(error_type, Acme::Client::Error)
-    error_class.new(error_detail)
+    error_class.new(error_detail, problem: problem)
   end
 
   def to_h

data/lib/acme/client/version.rb

@@ -2,6 +2,6 @@
 
 module Acme
   class Client
-    VERSION = '2.0.32'.freeze
+    VERSION = '2.0.34'.freeze
   end
 end

data/lib/acme/client.rb

@@ -14,6 +14,7 @@ module Acme; end
 class Acme::Client; end
 
 require 'acme/client/version'
+require 'acme/client/problem'
 require 'acme/client/http_client'
 require 'acme/client/certificate_request'
 require 'acme/client/self_sign_certificate'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: acme-client
 version: !ruby/object:Gem::Version
-  version: 2.0.32
+  version: 2.0.34
 platform: ruby
 authors:
 - Charles Barbier
@@ -65,6 +65,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: csv
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -158,6 +172,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- acme-client-2.0.32.gem
 - acme-client.gemspec
 - bin/console
 - bin/generate_keystash
@@ -176,6 +191,7 @@ files:
 - lib/acme/client/jwk/ecdsa.rb
 - lib/acme/client/jwk/hmac.rb
 - lib/acme/client/jwk/rsa.rb
+- lib/acme/client/problem.rb
 - lib/acme/client/resources.rb
 - lib/acme/client/resources/account.rb
 - lib/acme/client/resources/authorization.rb