puppetserver-ca 0.7.0 → 1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1d0f3441468d38c6a0385a7c2ed7e3056e9e7407
-  data.tar.gz: 84e643ade9ca258be16166e16b1577dd454ec9f8
+  metadata.gz: 4aae686f8f63d4fb8c675758fd9c910f8608187a
+  data.tar.gz: 36404974656f555dbd6253aaa6a5792b9b3b0069
 SHA512:
-  metadata.gz: 6dd35a352ff2ca7aec331efd573781224471e03efcd451fd35d5c13416b6f2d2cceec34339d0ff9016840a77af321b9821d6fff1f2d6d42a568316786b8e19bd
-  data.tar.gz: 6e460d0db0cf328e17968950741eade841198ce165e306b5ca07e81343d1c29045b3baab88ce0be78c90c3a50c969fc4323c6e626f195814bd7fba6f08707e78
+  metadata.gz: 4f43caf76164963786227c950886504fa2d3c7ffa583228cbe82256bca53c8a6867ba7c7cb3278bc604e3730f79dcb934146a22bd209642aa1a347fb5ea86811
+  data.tar.gz: 98b4178cadbc8ec770585a97b5ce9d44a770956d5d85b839cc5553962a1377998853b93a67378519577a13f032cf1ac6bd954641dab013fbeedd480b9e369944

data/lib/puppetserver/ca/action/clean.rb

@@ -87,9 +87,15 @@ BANNER
           puppet = Config::Puppet.parse(config)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
-          passed = clean_certs(certnames, puppet.settings)
-
-          return passed ? 0 : 1
+          result = clean_certs(certnames, puppet.settings)
+          case result
+          when :success
+            return 0
+          when :invalid
+            return 24
+          when :not_found, :error
+            return 1
+          end
         end
 
         def clean_certs(certnames, settings)

data/lib/puppetserver/ca/action/revoke.rb

@@ -86,9 +86,16 @@ BANNER
           puppet = Config::Puppet.parse(config)
           return 1 if CliParsing.handle_errors(@logger, puppet.errors)
 
-          passed = revoke_certs(certnames, puppet.settings)
-
-          return passed ? 0 : 1
+          result =  revoke_certs(certnames, puppet.settings)
+
+          case result
+          when :success
+            return 0
+          when :invalid
+            return 24
+          when :not_found, :error
+            return 1
+          end
         end
 
         def revoke_certs(certnames, settings)

data/lib/puppetserver/ca/certificate_authority.rb

@@ -18,31 +18,49 @@ module Puppetserver
         @ca_port = settings[:ca_port]
       end
 
+      def worst_result(previous_result, current_result)
+        %i{success invalid not_found error}.each do |state|
+          if previous_result == state
+            return current_result
+          elsif current_result == state
+            return previous_result
+          else
+            next
+          end
+        end
+      end
+
       # Returns a URI-like wrapper around CA specific urls
       def make_ca_url(resource_type = nil, certname = nil)
         HttpClient::URL.new('https', @ca_server, @ca_port, 'puppet-ca', 'v1', resource_type, certname)
       end
 
       def sign_certs(certnames)
-        put(certnames,
-            resource_type: 'certificate_status',
-            body: SIGN_BODY,
-            type: :sign)
+        results = put(certnames,
+                      resource_type: 'certificate_status',
+                      body: SIGN_BODY,
+                      type: :sign)
+
+        results.all? {|result| result == :success }
       end
 
       def revoke_certs(certnames)
-        put(certnames,
-            resource_type: 'certificate_status',
-            body: REVOKE_BODY,
-            type: :revoke)
+        results = put(certnames,
+                    resource_type: 'certificate_status',
+                    body: REVOKE_BODY,
+                    type: :revoke)
+
+        results.reduce {|prev, curr| worst_result(prev, curr) }
       end
 
       def submit_certificate_request(certname, csr)
-        put([certname],
-            resource_type: 'certificate_request',
-            body: csr.to_pem,
-            headers: {'Content-Type' => 'text/plain'},
-            type: :submit)
+        results = put([certname],
+                    resource_type: 'certificate_request',
+                    body: csr.to_pem,
+                    headers: {'Content-Type' => 'text/plain'},
+                    type: :submit)
+
+        results.all? {|result| result == :success }
       end
 
       # Make an HTTP PUT request to CA
@@ -60,8 +78,6 @@ module Puppetserver
             process_results(type, certname, result)
           end
         end
-
-        results.all?
       end
 
       # logs the action and returns true/false for success
@@ -71,45 +87,49 @@ module Puppetserver
           case result.code
           when '204'
             @logger.inform "Successfully signed certificate request for #{certname}"
-            return true
+            return :success
           when '404'
             @logger.err 'Error:'
             @logger.err "    Could not find certificate request for #{certname}"
-            return false
+            return :not_found
           else
             @logger.err 'Error:'
             @logger.err "    When attempting to sign certificate request '#{certname}', received"
             @logger.err "      code: #{result.code}"
             @logger.err "      body: #{result.body.to_s}" if result.body
-            return false
+            return :error
           end
         when :revoke
           case result.code
           when '200', '204'
             @logger.inform "Revoked certificate for #{certname}"
-            return true
+            return :success
           when '404'
             @logger.err 'Error:'
             @logger.err "    Could not find certificate for #{certname}"
-            return false
+            return :not_found
+          when '409'
+            @logger.err 'Error:'
+            @logger.err "    Could not revoke unsigned csr for #{certname}"
+            return :invalid
           else
             @logger.err 'Error:'
             @logger.err "    When attempting to revoke certificate '#{certname}', received:"
             @logger.err "      code: #{result.code}"
             @logger.err "      body: #{result.body.to_s}" if result.body
-            return false
+            return :error
           end
         when :submit
           case result.code
           when '200', '204'
             @logger.inform "Successfully submitted certificate request for #{certname}"
-            return true
+            return :success
           else
             @logger.err 'Error:'
             @logger.err "    When attempting to submit certificate request for '#{certname}', received:"
             @logger.err "      code: #{result.code}"
             @logger.err "      body: #{result.body.to_s}" if result.body
-            return false
+            return :error
           end
         end
       end
@@ -132,11 +152,24 @@ module Puppetserver
               cleaned = check_clean(certname, clean_result)
             end
 
-            cleaned == :success && [:success, :not_found].include?(revoked)
+            if revoked == :error || cleaned != :success
+              :error
+
+            # If we get passed the first conditional we know that
+            # cleaned must == :success and revoked must be one of
+            # :invalid, :not_found, or :success. We'll treat both
+            # :not_found and :success of revocation here as successes.
+            # However we'll treat invalid's specially.
+            elsif revoked == :invalid
+              :invalid
+
+            else
+              :success
+            end
           end
         end
 
-        return results.all?
+        return results.reduce {|prev, curr| worst_result(prev, curr) }
       end
 
       # possibly logs the action, always returns a status symbol 👑
@@ -145,6 +178,8 @@ module Puppetserver
         when '200', '204'
           @logger.inform "Revoked certificate for #{certname}"
           return :success
+        when '409'
+          return :invalid
         when '404'
           return :not_found
         else

data/lib/puppetserver/ca/version.rb

@@ -1,5 +1,5 @@
 module Puppetserver
   module Ca
-    VERSION = "0.7.0"
+    VERSION = "1.0.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetserver-ca
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 1.0.0
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-12 00:00:00.000000000 Z
+date: 2018-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: facter