@andrewheberle/serverless-ssh-ca 0.17.12 → 0.17.15

package/src/api/v3/index.ts

@@ -0,0 +1,419 @@
+import { group } from "@andrewheberle/ts-slog"
+import {
+	ApiException,
+	ConflictException,
+	ForbiddenException,
+	fromHono,
+	InternalServerErrorException,
+	NotFoundException,
+	OpenAPIRoute,
+	UnauthorizedException,
+	UnprocessableEntityException,
+} from "chanfana"
+import { Hono } from "hono"
+import { AppContext } from "../../router"
+import { CertificateSignerResponse } from "../../types"
+import {
+	BadIssuerError,
+	CreateCertificateOptions,
+	CreateHostCertificateOptions,
+	createSignedCertificate,
+	createSignedHostCertificate,
+
+} from "../../certificate"
+import {
+	getPublic,
+	split,
+} from "../../utils"
+import {
+	KeyParseError,
+	parsePrivateKey,
+} from "sshpk"
+import {
+	CertificateType,
+	getRevocationList,
+	recordCertificate,
+	RevocationStatus,
+	revocationStatus,
+	revokeCertificate,
+} from "../../db"
+import { KRLBuilder } from "../../krl"
+import {
+	CaPublicKeyEndpointSchema,
+	createUserCertificateRequestEndpointSchema,
+	createRevocationListEndpointSchema,
+	createHostCertificateRequestEndpointSchema,
+	createHostCertificateRenewEndpointSchema,
+	createRevokeCertificateEndpointSchema,
+} from "./schema"
+import { logger } from "../../logger"
+import type { SshCaBindings } from "../../types"
+
+const CaPublicKeyEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = CaPublicKeyEndpointSchema
+
+		override async handle(c: AppContext) {
+			const l = logger(env).with(
+				...group("request", "action", "ca"),
+			)
+			try {
+				const pub = await getPublic(c.env)
+
+				return c.text(`${pub.toString("ssh").trim()}\n`)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof KeyParseError):
+						l.error("error parsing private key")
+						throw new InternalServerErrorException("error parsing private key")
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const UserCertificateRequestEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createUserCertificateRequestEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "user",
+					"action", "request",
+				),
+				...group("auth_token",
+					"email", data.headers.Authorization.email,
+					"sub", data.headers.Authorization.sub,
+				),
+				...group("id_token",
+					"sub", data.body.identity.sub,
+				),
+			)
+
+			if (data.body.identity.sub !== data.headers["Authorization"].sub) {
+				l.error("token subjects did not match")
+				throw new ForbiddenException("Possible token substitution as subjects for authentication and identity tokens did not match")
+			}
+
+			const opts: CreateCertificateOptions = {
+				lifetime: data.body.lifetime,
+				principals: data.body.identity.principals,
+				extensions: data.body.extensions,
+			}
+
+			try {
+				const certificate = await createSignedCertificate(c.env, data.headers.Authorization.email, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, data.headers.Authorization.email)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const RevocationListEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createRevocationListEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", data.params.certificateType,
+					"action", "krl",
+				),
+			)
+
+			const certificateType = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host
+
+			try {
+				// get revoked serials
+				const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v))
+
+				// grab private key from secret store
+				const secret = await c.env.PRIVATE_KEY.get()
+
+				// parse key
+				const key = parsePrivateKey(secret)
+
+				// generate KRL
+				const krl = new KRLBuilder(key)
+					.addSerials(serials)
+
+				const krlBytes = krl.generate()
+
+				// convert to base64
+				const bytes = new Uint8Array(krlBytes)
+				let binary = ""
+				for (const byte of bytes) {
+					binary += String.fromCharCode(byte)
+				}
+				const base64Krl = btoa(binary)
+
+				const signature = await krl.signature()
+
+				return c.json({
+					krl: base64Krl,
+					signature: signature,
+				})
+			} catch (err) {
+				switch (true) {
+					case (err instanceof KeyParseError):
+						l.error("error parsing private key")
+						throw new InternalServerErrorException("error parsing private key")
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const HostCertificateRequestEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createHostCertificateRequestEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "host",
+					"action", "request",
+				),
+				...group("auth_token",
+					"email", data.headers.Authorization.email,
+					"sub", data.headers.Authorization.sub,
+				),
+				...group("id_token",
+					"sub", data.body.identity.sub,
+				),
+			)
+
+			// check id and access token are for the same user
+			if (data.body.identity.sub !== data.headers.Authorization.sub) {
+				l.error("token subjects did not match")
+				throw new ForbiddenException("possible token substitution as subjects for authentication and identity tokens did not match")
+			}
+
+			// check user can issue host certificates
+			if (!split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_EMAILS).includes(data.headers.Authorization.email) && !data.body.identity.principals.some((p: string) => split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_ROLES).includes(p))) {
+				l.error("unauthorized host certificate request")
+				throw new UnauthorizedException("User not allowed to issue host certificates")
+			}
+
+			const opts: CreateHostCertificateOptions = {
+				lifetime: data.body.lifetime,
+				principals: data.body.principals,
+			}
+
+			try {
+				const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const HostCertificateRenewEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createHostCertificateRenewEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+			const serial = data.body.certificate.serial.readBigUInt64BE(0)
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "host",
+					"action", "renewal",
+					"serial", serial,
+				),
+			)
+
+			// use smaller of the current certificate lifetime and the requested lifetime
+			const originalLifetime = (data.body.certificate.validUntil.getTime() - data.body.certificate.validFrom.getTime()) / 1000
+			const lifetime = originalLifetime > data.body.lifetime
+				? data.body.lifetime
+				: originalLifetime
+
+			const opts: CreateHostCertificateOptions = {
+				lifetime: lifetime,
+				subjects: data.body.certificate.subjects
+			}
+
+			try {
+				const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					case (err instanceof BadIssuerError):
+						throw new UnprocessableEntityException(err.message)
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const RevokeCertificateEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createRevokeCertificateEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request", "type", data.params.certificateType, "action", "revoke", "serial", data.body.serial),
+			)
+
+			const certificatetype = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host
+
+			// ensure certificate can be revoked
+			const status = await revocationStatus(c.env, data.body.serial, data.body.public_key.toString("ssh"), certificatetype)
+			switch (status) {
+				case RevocationStatus.Revoked:
+					l.warn("certificate is already revoked")
+					throw new ConflictException("certificate is already revoked")
+				case RevocationStatus.Unrevokable:
+					l.warn("cannot revoke this certificate")
+					throw new ForbiddenException("cannot revoke this certificate")
+				case RevocationStatus.NotFound:
+					l.warn("certificate not found")
+					throw new NotFoundException("certificate not found")
+			}
+
+			try {
+				const res = await revokeCertificate(c.env, data.body.serial)
+
+				if (res.length === 0) {
+					throw new InternalServerErrorException("no results were returned for revocation")
+				}
+
+				if (res.length > 1) {
+					l.warn("more than one revocation result was returned", "count", res.length)
+				}
+
+				l.info("completed revocation")
+				return c.json({
+					revoked_at: res[0]!.revoked_at
+				})
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+
+export const createApi = (env: SshCaBindings) => {
+	const api = fromHono(new Hono())
+
+	api.get("/ca", CaPublicKeyEndpoint(env))
+	api.post("/user/certificate", UserCertificateRequestEndpoint(env))
+	api.get("/:certificateType/krl", RevocationListEndpoint(env))
+	api.post("/host/certificate", HostCertificateRequestEndpoint(env))
+	api.post("/host/renew", HostCertificateRenewEndpoint(env))
+	api.post("/:certificateType/revoke", RevokeCertificateEndpoint(env))
+
+	return api
+}

package/src/api/v3/schema.ts

@@ -0,0 +1,265 @@
+import z from "zod"
+import type { SshCaBindings } from "../../types"
+import {
+	split,
+	refineCertificateRequest,
+	transformAuthorizationHeader,
+	transformProofOfPossession,
+	transformPublicKey,
+	transformRenewalProofOfPossession,
+	refineHostCertificateRequest,
+	transformCertificate,
+	refineHostCertificateRenewal,
+	refineRevokeCertificate,
+	transformIdentityToken,
+} from "../../utils"
+import {
+	ConflictException,
+	contentJson,
+	ForbiddenException,
+	InputValidationException,
+	InternalServerErrorException,
+	UnauthorizedException,
+	UnprocessableEntityException,
+} from "chanfana"
+import { seconds } from "itty-time"
+import { isRevoked } from "../../db"
+
+const openapiStringByte = z.base64()
+	.transform((v) => {
+		const a = z.util.base64ToUint8Array(v)
+		return Buffer.from(
+			a.buffer,
+			a.byteOffset,
+			a.length
+		)
+	})
+	.openapi({ format: "byte" })
+
+const proofOfPossession = z.string()
+	.meta({
+		description: "Proof of possession comprising of ${timestamp}.${fingerprint}.${signature}",
+		example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0KVTFOSVUwbEhBQUFBQVFBQUFHZ0FBQUFUWldOa2MyRXRjMmhoTWkxdWFYTjBjREkxTmdBQUFBaHVhWE4wY0RJMQpOZ0FBQUVFRUR6Ymk4OE10alBYSDFCb1JURU9HaS96aEc4QnhQNVZUUW5OQkFNMGZtMExtekErUUZkUlNVYVRFCkdNN2l0QjhINmZNZFAydlAxcElQcGUyOWVLQkJZd0FBQUFSbWFXeGxBQUFBQUFBQUFBWnphR0UxTVRJQUFBQmsKQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUJKQUFBQUlHdmZVZGNDQkRXa3ZwL0ZHS3NkakgrRQpKZzZXN0EvWUJVZng2Z0srQ01raEFBQUFJUUQxOFd5cDNZejZ0eXNvdllXbEJHTXprRnlYbFRrSHM5blVVRXJqCkczNWVPQT09Ci0tLS0tRU5EIFNTSCBTSUdOQVRVUkUtLS0tLQo="
+	})
+
+const publicKey = openapiStringByte
+	.transform(transformPublicKey)
+	.meta({
+		description: "SSH public key to sign",
+		example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
+	})
+
+export const createIdentityTokenSchema = (env: SshCaBindings) => (
+	z.string()
+		.meta({
+			description: "Identity Token JWT from OIDC IdP",
+			example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
+		})
+		.transform((val, ctx) => transformIdentityToken(env, val, ctx))
+)
+
+export const createAccessTokenSchema = (env: SshCaBindings) => (
+    z.string()
+        .meta({
+            description: "Access Token JWT from OIDC IdP",
+          	example: "Bearer eyJ..."
+        })
+        .transform((val, ctx) => transformAuthorizationHeader(env, val, ctx))
+)
+
+const krl = openapiStringByte
+	.meta({ description: "Key Revocation List" })
+
+const createHeaderSchema = (env: SshCaBindings) => (
+	z.object({
+		"Authorization": createAccessTokenSchema(env)
+	})
+)
+
+const certificate = openapiStringByte
+	.meta({ description: "Issued Certificate" })
+
+export const CaPublicKeyEndpointSchema = {
+	responses: {
+		"200": {
+			content: {
+				"text/plain": {
+					schema: z.string()
+				}
+			},
+			description: "Returns SSH Certificate Authority Public Key",
+		},
+		...InternalServerErrorException.schema(),
+	}
+}
+
+export const createUserCertificateRequestEndpointSchema = (env: SshCaBindings) => ({
+	security: [{ oidcAuth: [] }],
+	request: {
+		headers: createHeaderSchema(env),
+		body: contentJson(
+			z.object({
+				public_key: publicKey,
+				proof: proofOfPossession
+					.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+				identity: createIdentityTokenSchema(env),
+				extensions: z.array(z.string())
+					.default(split(env.SSH_CERTIFICATE_EXTENSIONS))
+					.meta({ description: "Extensions to include in the issued SSH certificate" }),
+				lifetime: z.int()
+					.min(seconds("5 minutes"))
+					.max(seconds(env.SSH_CERTIFICATE_LIFETIME))
+					.default(seconds(env.SSH_CERTIFICATE_LIFETIME))
+					.meta({ description: "Lifetime of issued SSH certificate" }),
+			})
+				.superRefine((val, ctx) => refineCertificateRequest(env, val, ctx))
+				.openapi("User Certificate Request")
+		)
+	},
+	responses: {
+		"200": {
+			description: "SSH User Certificate issued successfully",
+			...contentJson(z.object({
+				certificate: certificate,
+			})
+				.openapi("Certificate Response")
+			)
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const createRevocationListEndpointSchema = (env: SshCaBindings) => ({
+	request: {
+		params: z.object({
+			certificateType: z.enum(["user", "host"])
+		}),
+	},
+	responses: {
+		"200": {
+			description: "Returns an Open SSH Key Revocation List as BASE64 and an SSHSIG signature for verification",
+			...contentJson(z.object({
+				krl: krl,
+				signature: z.string()
+			})
+				.openapi("Key Revocation List Response")
+			)
+		},
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const createHostCertificateRequestEndpointSchema = (env: SshCaBindings) => ({
+	security: [{ oidcAuth: [] }],
+	request: {
+		headers: createHeaderSchema(env),
+		body: contentJson(
+			z.object({
+				public_key: publicKey,
+				proof: proofOfPossession
+					.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+				identity: createIdentityTokenSchema(env),
+				principals: z.array(z.string()).min(1)
+					.meta({ description: "List of principals to include on the issued certificate" }),
+				lifetime: z.int()
+					.min(seconds("24 hours"))
+					.max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.meta({ description: "Lifetime of issued Host SSH certificate" }),
+			})
+				.superRefine((val, ctx) => refineHostCertificateRequest(env, val, ctx))
+				.openapi("Host Certificate Request")
+		)
+	},
+	responses: {
+		"200": {
+			description: "SSH Host Certificate issued successfully",
+			...contentJson(z.object({
+				certificate: certificate,
+			})
+				.openapi("Certificate Response")
+			)
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const createHostCertificateRenewEndpointSchema = (env: SshCaBindings) => ({
+	request: {
+		body: contentJson(
+			z.object({
+				certificate: openapiStringByte
+					.transform(transformCertificate)
+					.meta({ description: "SSH certificate to renew" }),
+				public_key: publicKey,
+				proof: proofOfPossession
+					.transform((val, ctx) => transformRenewalProofOfPossession(env, val, ctx)),
+				lifetime: z.int()
+					.min(seconds("24 hours"))
+					.max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.meta({ description: "Lifetime of renewed Host SSH certificate" }),
+			})
+				.superRefine((val, ctx) => refineHostCertificateRenewal(env, isRevoked, val, ctx))
+				.openapi("Host Certificate Renew")
+		)
+	},
+	responses: {
+		"200": {
+			description: "SSH Host Certificate renewed successfully",
+			...contentJson(z.object({
+				certificate: certificate
+			})
+				.openapi("Certificate Response")
+			),
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const createRevokeCertificateEndpointSchema = (env: SshCaBindings) => ({
+	request: {
+		params: z.object({
+			certificateType: z.enum(["user", "host"])
+		}),
+		body: contentJson(
+			z.object({
+				serial: z.bigint()
+					.meta({ description: "Serial number of certificate to revoke" }),
+				public_key: publicKey,
+				proof: proofOfPossession
+					.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+			})
+				.openapi("Certificate Revocation")
+				.superRefine((val, ctx) => refineRevokeCertificate(env, val, ctx))
+		)
+	},
+	responses: {
+		"200": {
+			description: "SSH certificate revoked successfully",
+			...contentJson(z.object({
+				revoked_at: z.iso.datetime(),
+			})
+				.openapi("Revocation Response")
+			),
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+		...ConflictException.schema()
+	}
+})