@andrewheberle/serverless-ssh-ca 0.17.12 → 0.17.15

package/dist/db.js

@@ -1,111 +0,0 @@
-import { tryWhile } from "@cloudflare/actors";
-import { logger } from "./logger";
-export var CertificateType;
-(function (CertificateType) {
-    CertificateType[CertificateType["User"] = 0] = "User";
-    CertificateType[CertificateType["Host"] = 1] = "Host";
-})(CertificateType || (CertificateType = {}));
-export const runStatement = async (stmt) => {
-    return await tryWhile(async () => {
-        return await stmt.run();
-    }, shouldRetry);
-};
-export const shouldRetry = (err, nextAttempt) => {
-    const errMsg = String(err);
-    const isRetryableError = errMsg.includes("Network connection lost") ||
-        errMsg.includes("storage caused object to be reset") ||
-        errMsg.includes("reset because its code was updated") ||
-        errMsg.includes("stream because client disconnected");
-    if (nextAttempt <= 5 && isRetryableError) {
-        return true;
-    }
-    return false;
-};
-export const dbCleanup = async (env) => {
-    const l = logger(env).with("retention", env.DB_CERTIFICATE_RETENTION);
-    if (env.DB_CERTIFICATE_RETENTION === "infinite") {
-        l.info("skipping database cleanup");
-    }
-    l.info("starting database cleanup");
-    try {
-        const stmt = env.DB.prepare("DELETE FROM certificates WHERE unixepoch('subsec') > unixepoch(valid_before,'subsec',?)")
-            .bind(env.DB_CERTIFICATE_RETENTION);
-        const res = await stmt.run();
-        l.info("completed database cleanup", "changes", res.meta.changes);
-    }
-    catch (err) {
-        l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION);
-    }
-};
-export const recordCertificate = async (env, certificate, keyid, certificateType = CertificateType.User) => {
-    const serial = certificate.serial.readBigUInt64BE(0);
-    const subjects = certificate.subjects.map((v) => {
-        return v.toString();
-    }).join(",");
-    const extensions = certificate.getExtensions().map((v) => {
-        // @ts-ignore: the name property does exist
-        return v.name;
-    }).join(",");
-    const stmt = env.DB
-        .prepare("INSERT INTO certificates (serial, key_id, principals, extensions, valid_after, valid_before, certificate_type, public_key) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")
-        .bind(`${serial}`, keyid, subjects, extensions, certificate.validFrom.toISOString(), certificate.validUntil.toISOString(), certificateType, certificate.subjectKey.toString("ssh"));
-    const res = await runStatement(stmt);
-    if (!res.success) {
-        if (res.error !== undefined) {
-            throw new Error(res.error);
-        }
-        throw new Error("error during query");
-    }
-};
-export const isRevoked = async (env, serial) => {
-    const stmt = env.DB
-        .prepare("SELECT serial FROM certificates WHERE serial = ? AND revoked_at NOTNULL")
-        .bind(`${serial}`);
-    const res = await runStatement(stmt);
-    return res.results.length > 0;
-};
-export var RevocationStatus;
-(function (RevocationStatus) {
-    RevocationStatus[RevocationStatus["NotFound"] = 0] = "NotFound";
-    RevocationStatus[RevocationStatus["Revoked"] = 1] = "Revoked";
-    RevocationStatus[RevocationStatus["Revokable"] = 2] = "Revokable";
-    RevocationStatus[RevocationStatus["Unrevokable"] = 3] = "Unrevokable";
-})(RevocationStatus || (RevocationStatus = {}));
-export const revocationStatus = async (env, serial, publickey, certificateType) => {
-    const stmt = env.DB
-        .prepare("SELECT public_key, revoked_at as count FROM certificates WHERE serial = ? AND public_key = ? AND certificate_type = ?")
-        .bind(`${serial}`, publickey, certificateType);
-    const res = await runStatement(stmt);
-    if (res.results.length === 0) {
-        return RevocationStatus.NotFound;
-    }
-    const row = res.results?.[0];
-    if (!row) {
-        return RevocationStatus.NotFound;
-    }
-    if (row.revoked_at !== null) {
-        return RevocationStatus.Revoked;
-    }
-    if (publickey === row.public_key) {
-        return RevocationStatus.Revokable;
-    }
-    return RevocationStatus.Unrevokable;
-};
-export const getRevocationList = async (env, certificateType) => {
-    const stmt = env.DB
-        .prepare("SELECT serial FROM certificates WHERE revoked_at NOTNULL AND certificate_type = ? AND unixepoch('subsec') < unixepoch(valid_before,'subsec','24 hours')")
-        .bind(certificateType);
-    const res = await runStatement(stmt);
-    const result = [];
-    for (const item of res.results) {
-        result.push(item.serial);
-    }
-    return result;
-};
-export const revokeCertificate = async (env, serial) => {
-    const stmt = env.DB
-        .prepare("UPDATE certificates SET revoked_at = ? WHERE serial = ? RETURNING revoked_at")
-        .bind((new Date).toISOString(), `${serial}`);
-    const res = await runStatement(stmt);
-    return res.results;
-};