itsi 0.1.11 → 0.1.12

data/gems/server/ext/itsi_server/src/server/tls.rs

@@ -1,265 +0,0 @@
-use base64::{engine::general_purpose, Engine as _};
-use itsi_error::Result;
-use itsi_tracing::info;
-use locked_dir_cache::LockedDirCache;
-use rcgen::{
-    generate_simple_self_signed, CertificateParams, CertifiedKey, DnType, KeyPair, SanType,
-};
-use rustls::{
-    pki_types::{CertificateDer, PrivateKeyDer},
-    ClientConfig, RootCertStore,
-};
-use rustls_pemfile::{certs, pkcs8_private_keys};
-use std::{
-    collections::HashMap,
-    fs,
-    io::{BufReader, Error},
-    sync::Arc,
-};
-use tokio::sync::Mutex;
-use tokio_rustls::{rustls::ServerConfig, TlsAcceptor};
-use tokio_rustls_acme::{AcmeAcceptor, AcmeConfig, AcmeState};
-
-use crate::env::{
-    ITSI_ACME_CACHE_DIR, ITSI_ACME_CA_PEM_PATH, ITSI_ACME_CONTACT_EMAIL, ITSI_ACME_DIRECTORY_URL,
-    ITSI_LOCAL_CA_DIR,
-};
-mod locked_dir_cache;
-
-#[derive(Clone)]
-pub enum ItsiTlsAcceptor {
-    Manual(TlsAcceptor),
-    Automatic(
-        AcmeAcceptor,
-        Arc<Mutex<AcmeState<Error>>>,
-        Arc<ServerConfig>,
-    ),
-}
-
-/// Generates a TLS configuration based on either :
-/// * Input "cert" and "key" options (either paths or Base64-encoded strings) or
-/// * Performs automatic certificate generation/retrieval. Generated certs use an internal self-signed Isti CA.
-///
-/// If a non-local host or optional domain parameter is provided,
-/// an automated certificate will attempt to be fetched using let's encrypt.
-pub fn configure_tls(
-    host: &str,
-    query_params: &HashMap<String, String>,
-) -> Result<ItsiTlsAcceptor> {
-    let domains = query_params
-        .get("domains")
-        .map(|v| v.split(',').map(String::from).collect::<Vec<_>>())
-        .or_else(|| query_params.get("domain").map(|v| vec![v.to_string()]));
-
-    if query_params.get("cert").is_some_and(|c| c == "acme") {
-        if let Some(domains) = domains {
-            let directory_url = &*ITSI_ACME_DIRECTORY_URL;
-            info!(
-                domains = format!("{:?}", domains),
-                directory_url, "Requesting acme cert"
-            );
-            let acme_contact_email = query_params
-                .get("acme_email")
-                .map(|s| s.to_string())
-                .or_else(|| (*ITSI_ACME_CONTACT_EMAIL).as_ref().ok().map(|s| s.to_string()))
-                .ok_or_else(|| itsi_error::ItsiError::ArgumentError(
-                    "acme_email query param or ITSI_ACME_CONTACT_EMAIL must be set before you can auto-generate let's encrypt certificates".to_string(),
-                ))?;
-
-            let acme_config = AcmeConfig::new(domains)
-                .contact([format!("mailto:{}", acme_contact_email)])
-                .cache(LockedDirCache::new(&*ITSI_ACME_CACHE_DIR))
-                .directory(directory_url);
-
-            let acme_state = if let Ok(ca_pem_path) = &*ITSI_ACME_CA_PEM_PATH {
-                let mut root_cert_store = RootCertStore::empty();
-
-                let ca_pem = fs::read(ca_pem_path).expect("failed to read CA pem file");
-                let mut ca_reader = BufReader::new(&ca_pem[..]);
-                let der_certs: Vec<CertificateDer> = certs(&mut ca_reader)
-                    .collect::<std::result::Result<Vec<CertificateDer>, _>>()
-                    .map_err(|e| {
-                        itsi_error::ItsiError::ArgumentError(format!(
-                            "Invalid ACME CA Pem path {:?}",
-                            e
-                        ))
-                    })?;
-                root_cert_store.add_parsable_certificates(der_certs);
-
-                let client_config = ClientConfig::builder()
-                    .with_root_certificates(root_cert_store)
-                    .with_no_client_auth();
-                acme_config
-                    .client_tls_config(Arc::new(client_config))
-                    .state()
-            } else {
-                acme_config.state()
-            };
-
-            let mut rustls_config = ServerConfig::builder()
-                .with_no_client_auth()
-                .with_cert_resolver(acme_state.resolver());
-
-            rustls_config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-
-            let acceptor = acme_state.acceptor();
-            return Ok(ItsiTlsAcceptor::Automatic(
-                acceptor,
-                Arc::new(Mutex::new(acme_state)),
-                Arc::new(rustls_config),
-            ));
-        }
-    }
-    let (certs, key) = if let (Some(cert_path), Some(key_path)) =
-        (query_params.get("cert"), query_params.get("key"))
-    {
-        // Load from file or Base64
-        let certs = load_certs(cert_path);
-        let key = load_private_key(key_path);
-        (certs, key)
-    } else {
-        generate_ca_signed_cert(domains.unwrap_or(vec![host.to_owned()]))?
-    };
-
-    let mut config = ServerConfig::builder()
-        .with_no_client_auth()
-        .with_single_cert(certs, key)
-        .expect("Failed to build TLS config");
-
-    config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
-    Ok(ItsiTlsAcceptor::Manual(TlsAcceptor::from(Arc::new(config))))
-}
-
-pub fn load_certs(path: &str) -> Vec<CertificateDer<'static>> {
-    let data = if let Some(stripped) = path.strip_prefix("base64:") {
-        general_purpose::STANDARD
-            .decode(stripped)
-            .expect("Invalid base64 certificate")
-    } else {
-        fs::read(path).expect("Failed to read certificate file")
-    };
-
-    if data.starts_with(b"-----BEGIN ") {
-        let mut reader = BufReader::new(&data[..]);
-        let certs_der: Vec<Vec<u8>> = certs(&mut reader)
-            .map(|r| {
-                r.map(|der| der.as_ref().to_vec())
-                    .map_err(itsi_error::ItsiError::from)
-            })
-            .collect::<Result<_>>()
-            .expect("Failed to parse certificate file");
-        certs_der
-            .into_iter()
-            .map(|vec| {
-                // Convert the owned Vec<u8> into a CertificateDer and force 'static.
-                unsafe { std::mem::transmute(CertificateDer::from(vec)) }
-            })
-            .collect()
-    } else {
-        vec![CertificateDer::from(data)]
-    }
-}
-
-/// Loads a private key from a file or Base64.
-pub fn load_private_key(path: &str) -> PrivateKeyDer<'static> {
-    let key_data = if let Some(stripped) = path.strip_prefix("base64:") {
-        general_purpose::STANDARD
-            .decode(stripped)
-            .expect("Invalid base64 private key")
-    } else {
-        fs::read(path).expect("Failed to read private key file")
-    };
-
-    if key_data.starts_with(b"-----BEGIN ") {
-        let mut reader = BufReader::new(&key_data[..]);
-        let keys: Vec<Vec<u8>> = pkcs8_private_keys(&mut reader)
-            .map(|r| {
-                r.map(|key| key.secret_pkcs8_der().to_vec())
-                    .map_err(itsi_error::ItsiError::from)
-            })
-            .collect::<Result<_>>()
-            .expect("Failed to parse private key");
-        if !keys.is_empty() {
-            return PrivateKeyDer::try_from(keys[0].clone()).unwrap();
-        }
-    }
-    PrivateKeyDer::try_from(key_data).unwrap()
-}
-
-pub fn generate_ca_signed_cert(
-    domains: Vec<String>,
-) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
-    info!(
-        domains = format!("{}", domains.join(", ")),
-        "Self signed cert",
-    );
-    info!(
-        "Add {} to your system's trusted cert store to resolve certificate errors.",
-        format!("{}/itsi_dev_ca.crt", ITSI_LOCAL_CA_DIR.to_str().unwrap())
-    );
-    info!("Dev CA path can be overridden by setting env var: `ITSI_LOCAL_CA_DIR`.");
-    let (ca_key_pem, ca_cert_pem) = get_or_create_local_dev_ca()?;
-
-    let ca_kp = KeyPair::from_pem(&ca_key_pem).expect("Failed to load CA key");
-    let ca_cert = CertificateParams::from_ca_cert_pem(&ca_cert_pem)
-        .expect("Failed to parse embedded CA certificate")
-        .self_signed(&ca_kp)
-        .expect("Failed to self-sign embedded CA cert");
-
-    let ee_key = KeyPair::generate_for(&rcgen::PKCS_ECDSA_P256_SHA256).unwrap();
-    let mut ee_params = CertificateParams::default();
-
-    use std::net::IpAddr;
-
-    ee_params.subject_alt_names = domains
-        .iter()
-        .map(|domain| {
-            if let Ok(ip) = domain.parse::<IpAddr>() {
-                SanType::IpAddress(ip)
-            } else {
-                SanType::DnsName(domain.clone().try_into().unwrap())
-            }
-        })
-        .collect();
-
-    ee_params
-        .distinguished_name
-        .push(DnType::CommonName, domains[0].clone());
-
-    ee_params.use_authority_key_identifier_extension = true;
-
-    let ee_cert = ee_params.signed_by(&ee_key, &ca_cert, &ca_kp).unwrap();
-    let ee_cert_der = ee_cert.der().to_vec();
-    let ee_cert = CertificateDer::from(ee_cert_der);
-    let ca_cert = CertificateDer::from(ca_cert.der().to_vec());
-    Ok((
-        vec![ee_cert, ca_cert],
-        PrivateKeyDer::try_from(ee_key.serialize_der()).unwrap(),
-    ))
-}
-
-fn get_or_create_local_dev_ca() -> Result<(String, String)> {
-    let ca_dir = &*ITSI_LOCAL_CA_DIR;
-    fs::create_dir_all(ca_dir)?;
-
-    let key_path = ca_dir.join("itsi_dev_ca.key");
-    let cert_path = ca_dir.join("itsi_dev_ca.crt");
-
-    if key_path.exists() && cert_path.exists() {
-        // Already have a local CA
-        let key_pem = fs::read_to_string(&key_path)?;
-        let cert_pem = fs::read_to_string(&cert_path)?;
-
-        Ok((key_pem, cert_pem))
-    } else {
-        let subject_alt_names = vec!["dev.itsi.fyi".to_string(), "localhost".to_string()];
-
-        let CertifiedKey { cert, key_pair } =
-            generate_simple_self_signed(subject_alt_names).unwrap();
-
-        fs::write(&key_path, key_pair.serialize_pem())?;
-        fs::write(&cert_path, cert.pem())?;
-
-        Ok((key_pair.serialize_pem(), cert.pem()))
-    }
-}

data/gems/server/ext/itsi_tracing/Cargo.lock

@@ -1,274 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "aho-corasick"
-version = "1.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "itsi_tracing"
-version = "0.1.0"
-dependencies = [
- "tracing",
- "tracing-subscriber",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "log"
-version = "0.4.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30bde2b3dc3671ae49d8e2e9f044c7c005836e7a023ee57cffa25ab82764bb9e"
-
-[[package]]
-name = "matchers"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
-dependencies = [
- "regex-automata 0.1.10",
-]
-
-[[package]]
-name = "memchr"
-version = "2.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
-
-[[package]]
-name = "nu-ansi-term"
-version = "0.46.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
-dependencies = [
- "overload",
- "winapi",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.20.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
-
-[[package]]
-name = "overload"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
-
-[[package]]
-name = "pin-project-lite"
-version = "0.2.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.93"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "regex"
-version = "1.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-automata 0.4.9",
- "regex-syntax 0.8.5",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.1.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
-dependencies = [
- "regex-syntax 0.6.29",
-]
-
-[[package]]
-name = "regex-automata"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax 0.8.5",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.6.29"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
-
-[[package]]
-name = "sharded-slab"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
-dependencies = [
- "lazy_static",
-]
-
-[[package]]
-name = "smallvec"
-version = "1.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fcf8323ef1faaee30a44a340193b1ac6814fd9b7b4e88e9d4519a3e4abe1cfd"
-
-[[package]]
-name = "syn"
-version = "2.0.98"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "thread_local"
-version = "1.1.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
-dependencies = [
- "cfg-if",
- "once_cell",
-]
-
-[[package]]
-name = "tracing"
-version = "0.1.41"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
-dependencies = [
- "pin-project-lite",
- "tracing-attributes",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-attributes"
-version = "0.1.28"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "tracing-core"
-version = "0.1.33"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
-dependencies = [
- "once_cell",
- "valuable",
-]
-
-[[package]]
-name = "tracing-log"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
-dependencies = [
- "log",
- "once_cell",
- "tracing-core",
-]
-
-[[package]]
-name = "tracing-subscriber"
-version = "0.3.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
-dependencies = [
- "matchers",
- "nu-ansi-term",
- "once_cell",
- "regex",
- "sharded-slab",
- "smallvec",
- "thread_local",
- "tracing",
- "tracing-core",
- "tracing-log",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
-
-[[package]]
-name = "valuable"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
-
-[[package]]
-name = "winapi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
-dependencies = [
- "winapi-i686-pc-windows-gnu",
- "winapi-x86_64-pc-windows-gnu",
-]
-
-[[package]]
-name = "winapi-i686-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
-
-[[package]]
-name = "winapi-x86_64-pc-windows-gnu"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

data/gems/server/ext/itsi_tracing/Cargo.toml

@@ -1,16 +0,0 @@
-[package]
-name = "itsi_tracing"
-version = "0.1.0"
-edition = "2024"
-
-[dependencies]
-tracing = { version = "0.1.41", features = ["attributes"] }
-tracing-subscriber = { version = "0.3.19", features = [
-  "env-filter",
-  "std",
-  "fmt",
-  "json",
-  "ansi",
-] }
-tracing-attributes = "0.1"
-atty = "0.2.14"

data/gems/server/ext/itsi_tracing/src/lib.rs

@@ -1,58 +0,0 @@
-use std::env;
-
-use atty::{Stream, is};
-use tracing::level_filters::LevelFilter;
-pub use tracing::{debug, error, info, trace, warn};
-pub use tracing_attributes::instrument; // Explicitly export from tracing-attributes
-use tracing_subscriber::{
-    EnvFilter, Layer,
-    fmt::{self, format},
-    layer::SubscriberExt,
-};
-
-#[instrument]
-pub fn init() {
-    let env_filter = EnvFilter::builder()
-        .with_env_var("ITSI_LOG")
-        .try_from_env()
-        .unwrap_or_else(|_| EnvFilter::new("info"));
-
-    let format = fmt::format()
-        .compact()
-        .with_file(false)
-        .with_level(true)
-        .with_line_number(false)
-        .with_source_location(false)
-        .with_target(false)
-        .with_thread_ids(false);
-
-    let is_tty = is(Stream::Stdout);
-
-    let subscriber = tracing_subscriber::fmt()
-        .event_format(format)
-        .with_env_filter(env_filter);
-
-    if (is_tty && env::var("ITSI_LOG_PLAIN").is_err()) || env::var("ITSI_LOG_ANSI").is_ok() {
-        subscriber.with_ansi(true).init();
-    } else {
-        subscriber
-            .fmt_fields(format::JsonFields::default())
-            .event_format(fmt::format().json())
-            .init();
-    }
-}
-
-pub fn run_silently<F, R>(f: F) -> R
-where
-    F: FnOnce() -> R,
-{
-    // Build a minimal subscriber that filters *everything* out
-    let no_op_subscriber =
-        tracing_subscriber::registry().with(fmt::layer().with_filter(LevelFilter::OFF));
-
-    // Turn that subscriber into a `Dispatch`
-    let no_op_dispatch = tracing::dispatcher::Dispatch::new(no_op_subscriber);
-
-    // Temporarily set `no_op_dispatch` as the *default* within this closure
-    tracing::dispatcher::with_default(&no_op_dispatch, f)
-}