@andrewheberle/serverless-ssh-ca 0.17.13 → 0.17.16

package/dist/types.d.ts

@@ -25,18 +25,18 @@ export interface SshCaBindings {
     PRIVATE_KEY: SecretsStoreSecret;
     SSH_CERTIFICATE_EXTENSIONS: string;
     SSH_CERTIFICATE_LIFETIME: string;
-    SSH_CERTIFICATE_INCLUDE_SELF: string;
-    SSH_CERTIFICATE_PRINCIPALS: string;
+    SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean;
+    SSH_CERTIFICATE_PRINCIPALS?: string | string[];
     SSH_HOST_CERTIFICATE_LIFETIME: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_ROLES: string;
+    SSH_HOST_CERTIFICATE_ALLOWED_EMAILS?: string | string[];
+    SSH_HOST_CERTIFICATE_ALLOWED_ROLES?: string | string[];
     ISSUER_DN: string;
     JWT_JWKS_URL: string;
-    JWT_AUD: string;
+    JWT_AUD?: string | string[];
     JWT_ISSUER: string;
-    JWT_ALGORITHMS: string;
+    JWT_ALGORITHMS: string | string[];
     JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM: string;
-    SSH_HOST_CERTIFICATE_ALLOWED_ROLES_CLAIM: string;
     CERTIFICATE_REQUEST_TIME_SKEW_MAX: string;
-    LOG_LEVEL: string;
+    LOG_LEVEL?: string;
 }
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAGjC,MAAM,MAAM,wBAAwB,GAAG;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACd,KAAK,CAAC,EAAE,MAAM,CAAA;CACjB,CAAA;AAED,MAAM,MAAM,yBAAyB,GAAG;IACpC,WAAW,EAAE,MAAM,CAAA;CACtB,CAAA;AAGD,MAAM,MAAM,4BAA4B,GAAG;IACvC,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,EAAE,CAAA;CACnC,GAAG,UAAU,CAAA;AAEd,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;CAC5B,CAAA;AAED,MAAM,WAAW,aAAa;IAC1B,EAAE,EAAE,UAAU,CAAA;IACd,wBAAwB,EAAE,MAAM,CAAA;IAChC,WAAW,EAAE,kBAAkB,CAAA;IAC/B,0BAA0B,EAAE,MAAM,CAAA;IAClC,wBAAwB,EAAE,MAAM,CAAA;IAChC,4BAA4B,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAC/C,0BAA0B,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC9C,6BAA6B,EAAE,MAAM,CAAA;IACrC,mCAAmC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACvD,kCAAkC,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtD,SAAS,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACjC,oCAAoC,EAAE,MAAM,CAAA;IAC5C,iCAAiC,EAAE,MAAM,CAAA;IACzC,SAAS,CAAC,EAAE,MAAM,CAAA;CAClB"}

package/dist/types.js

@@ -1 +1,2 @@
 export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/utils.d.ts

@@ -55,6 +55,7 @@ type ParsedRevokeCertificate = {
     proof: ProofOfPossession;
 };
 export declare const refineRevokeCertificate: (env: SshCaBindings, val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
-export declare const split: (v: string) => string[];
+export declare const split: (v?: string | string[]) => string[];
 export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<Key>;
 export {};
+//# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,OAAO,EAAE,WAAW,EAAE,GAAG,EAAqF,UAAU,EAAE,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,SAAS,CAAA;AAC3F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,MAAM,CAAA;AAIpD,eAAO,MAAM,UAAU,GAAI,KAAK,CAAC,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,GAAI,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAyCrI,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,KAAK,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED,eAAO,MAAM,kBAAkB,GAAI,KAAK,aAAa,EAAE,SAAS,4BAA4B,EAAE,QAAQ,MAAM,KAAG,MAAM,EA0BpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,GAAG,SAAS,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAU,KAAK,aAAa,EAAE,KAAK,wBAAwB,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,GAAI,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,GAAU,KAAK,aAAa,EAAE,WAAW,OAAO,WAAW,EAAE,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAoC5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,GAAU,KAAK,aAAa,EAAE,KAAK,uBAAuB,EAAE,KAAK,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,GAAI,IAAI,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED,eAAO,MAAM,SAAS,GAAU,KAAK,aAAa,EAAE,MAAM,UAAU,KAAG,OAAO,CAAC,GAAG,CAejF,CAAA"}

package/dist/utils.js

@@ -40,6 +40,9 @@ export const transformProofOfPossession = (env, val, ctx) => {
     }
 };
 export const transformAuthorizationHeader = async (env, val, ctx) => {
+    if (!val.startsWith("Bearer ") || val.length <= 7) {
+        return fatalIssue(ctx, "authorization header must be a Bearer token", val);
+    }
     const jwt = val.replace("Bearer ", "");
     const l = logger(env);
     if (jwt === "") {
@@ -110,10 +113,6 @@ export const identityPrincipals = (env, payload, claim) => {
         claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM;
     }
     const l = logger(env);
-    if (claim === "__proto__" || claim === "prototype" || claim === "constructor") {
-        l.warn("invalid principals claim configured", "claim", claim);
-        return [];
-    }
     const p = payload[claim];
     if (p === undefined) {
         l.warn("claim was missing despite being set in CA config", "claim", claim);
@@ -133,8 +132,8 @@ export const parseIdentity = async (env, jwt, claim) => {
     if (jwt === undefined) {
         throw new Error("missing identity token");
     }
-    const aud = env.JWT_AUD === undefined || env.JWT_AUD === "" ? undefined : split(env.JWT_AUD);
-    const { payload } = await verifyJWT(env, jwt, { aud: aud });
+    const aud = split(env.JWT_AUD);
+    const { payload } = await verifyJWT(env, jwt, { aud: aud.length === 0 ? undefined : aud });
     const principals = identityPrincipals(env, payload, claim);
     return {
         sub: payload.sub,
@@ -146,7 +145,7 @@ export const transformIdentityToken = async (env, val, ctx) => {
         const identity = await parseIdentity(env, val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM);
         return identity;
     }
-    catch (err) {
+    catch {
         ctx.issues.push({
             code: "custom",
             message: "problem parsing identity token",
@@ -302,10 +301,13 @@ export const refineRevokeCertificate = async (env, val, ctx) => {
     }
 };
 export const split = (v) => {
-    if (v === "" || v === undefined) {
-        return [];
-    }
-    return v.split(",");
+    return v === undefined
+        ? []
+        : typeof v === "string"
+            ? v === ""
+                ? []
+                : v.split(",")
+            : v;
 };
 export const getPublic = async (env, key) => {
     if (key === undefined) {
@@ -320,3 +322,4 @@ export const getPublic = async (env, key) => {
     // return in ssh format trimmed of any whitespace
     return pub;
 };
+//# sourceMappingURL=utils.js.map

package/dist/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACvG,OAAO,EAAoB,aAAa,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,eAAe,EAAc,MAAM,OAAO,CAAA;AACvI,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEpC,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAA;AAE3F,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAE9B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAoB,EAAE,OAAe,EAAE,GAAY,EAAE,EAAE;IACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QACf,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,GAAG;KACV,CAAC,CAAA;IAEF,OAAO,CAAC,CAAC,KAAK,CAAA;AACf,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAkC,EAA6B,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,IAAI,iBAAiB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;QAExG,OAAO,KAAK,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1D,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,oBAAoB,CAAC;gBACzC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,+CAA+C;oBACxD,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAgC,EAAE;IACzI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACnD,OAAO,UAAU,CAAC,GAAG,EAAE,6CAA6C,EAAE,GAAG,CAAC,CAAA;IAC3E,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IACtC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAErB,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QAChB,OAAO,UAAU,CAAC,GAAG,EAAE,+BAA+B,EAAE,GAAG,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACJ,aAAa;QACb,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAE7C,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,uDAAuD,EAAE,GAAG,CAAC,CAAA;QACrF,CAAC;QAED,OAAO;YACN,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAA;YAC5D,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,sCAAsC,EAAE,GAAG,CAAC,CAAA;YACpE,KAAK,CAAC,GAAG,YAAY,UAAU,CAAC;gBAC/B,OAAO,UAAU,CAAC,GAAG,EAAE,kCAAkC,EAAE,GAAG,CAAC,CAAA;YAChE,KAAK,CAAC,GAAG,YAAY,WAAW,CAAC;gBAChC,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE,KAAK,CAAC,GAAG,YAAY,wBAAwB,CAAC;gBAC7C,OAAO,UAAU,CAAC,GAAG,EAAE,mCAAmC,EAAE,GAAG,CAAC,CAAA;YACjE;gBACC,CAAC,CAAC,KAAK,CAAC,yCAAyC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACtG,OAAO,UAAU,CAAC,GAAG,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAe,EAAE;IAC9G,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAE1F,OAAO,GAAG,CAAA;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;gBAClC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,oCAAoC;oBAC7C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,OAAqC,EAAE,KAAc,EAAY,EAAE;IACzH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,GAAG,GAAG,CAAC,oCAAoC,CAAA;IACjD,CAAC;IAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IAEpB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;IAEzB,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,kDAAkD,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QAC1E,OAAO,EAAE,CAAA;IACV,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,EAAE,CAAA;IACV,CAAC;IAED,0EAA0E;IAC1E,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;IAE7C,CAAC,CAAC,IAAI,CAAC,oCAAoC,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;IAEtE,OAAO,UAAU,CAAA;AAClB,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAuB,EAAE,KAAc,EAA0B,EAAE;IAC1H,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAA;IAC1C,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;IAE1F,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE1D,OAAO;QACN,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,UAAU;KACtB,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAkC,EAAE;IACrI,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,oCAAoC,CAAC,CAAA;QAExF,OAAO,QAAQ,CAAA;IAChB,CAAC;IAAC,MAAM,CAAC;QACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gCAAgC;YACzC,KAAK,EAAE,GAAG;SACV,CAAC,CAAA;QACF,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAqC,EAAE,GAAoB,EAAuB,EAAE;IACxH,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;QAEjI,OAAO,IAAI,CAAA;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,SAAS,CAAC;gBAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN,KAAK,CAAC,GAAG,YAAY,qBAAqB,CAAC;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;gBACF,MAAK;YACN;gBACC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,qCAAqC;oBAC9C,KAAK,EAAE,GAAG;iBACV,CAAC,CAAA;QACJ,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;AACF,CAAC,CAAA;AAUD,MAAM,CAAC,MAAM,wBAAwB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA6B,EAAE,GAAoB,EAAkB,EAAE;IACzI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC3G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,GAAkB,EAAE,GAAW,EAAE,GAAoB,EAAoC,EAAE;IAC5I,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,OAAO,IAAI,wBAAwB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,iCAAiC,CAAC,EAAE,CAAC,CAAA;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;YACzC,OAAO,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACzC,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACpH,OAAO,UAAU,CAAC,GAAG,EAAE,+CAA+C,EAAE,GAAG,CAAC,CAAA;IAC7E,CAAC;AACF,CAAC,CAAA;AAYD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IACjJ,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,CAAA;IAEhE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAElB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,YAAY,EAAE,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;QACrF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;YAClE,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAA;QACnC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;YACzD,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAEf,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACzE,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAOD,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAAE,GAAkB,EAAE,SAA6B,EAAE,GAAiC,EAAE,GAAoB,EAAkB,EAAE;IAChL,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,OAAO,UAAU,CAAC,GAAG,EAAE,oDAAoD,EAAE,GAAG,CAAC,CAAA;QAClF,CAAC;QAED,mCAAmC;QACnC,IAAI,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YACjC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,0DAA0D;QAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QACxD,IAAI,MAAM,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;YAClC,OAAO,UAAU,CAAC,GAAG,EAAE,qCAAqC,EAAE,GAAG,CAAC,CAAA;QACnE,CAAC;QAED,uFAAuF;QACvF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,OAAO,UAAU,CAAC,GAAG,EAAE,8EAA8E,EAAE,GAAG,CAAC,CAAA;QAC5G,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAQD,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,GAAkB,EAAE,GAA4B,EAAE,GAAoB,EAAkB,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACrB,IAAI,CAAC;QACJ,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxC,OAAO,UAAU,CAAC,GAAG,EAAE,0DAA0D,EAAE,GAAG,CAAC,CAAA;QACxF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAA;QACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,OAAO,UAAU,CAAC,GAAG,EAAE,iDAAiD,EAAE,GAAG,CAAC,CAAA;QAC/E,CAAC;QAED,OAAO,CAAC,CAAC,KAAK,CAAA;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,KAAK,CAAC,kDAAkD,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC1G,OAAO,UAAU,CAAC,GAAG,EAAE,kDAAkD,EAAE,GAAG,CAAC,CAAA;IAChF,CAAC;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAqB,EAAY,EAAE;IACxD,OAAO,CAAC,KAAK,SAAS;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ;YACtB,CAAC,CAAC,CAAC,KAAK,EAAE;gBACT,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,CAAC,CAAA;AACN,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAgB,EAAgB,EAAE;IACrF,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACvB,qCAAqC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAA;QAE1C,WAAW;QACX,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED,0CAA0C;IAC1C,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAA;IAC1B,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,SAAS,CAAA;IAE3B,iDAAiD;IACjD,OAAO,GAAG,CAAA;AACX,CAAC,CAAA"}

package/dist/verify.d.ts

@@ -5,3 +5,4 @@ type VerifyOptions = {
 };
 export declare const verifyJWT: (env: SshCaBindings, jwt: string, opts?: VerifyOptions) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
 export {};
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,4BAA4B,EAAE,MAAM,SAAS,CAAA;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAG5C,KAAK,aAAa,GAAG;IACpB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,SAAS,GAAU,KAAK,aAAa,EAAE,KAAK,MAAM,EAAE,OAAM,aAAkB,uGAexF,CAAA"}

package/dist/verify.js

@@ -14,3 +14,4 @@ export const verifyJWT = async (env, jwt, opts = {}) => {
         algorithms: split(env.JWT_ALGORITHMS),
     });
 };
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAGpD,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAM/B,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,GAAkB,EAAE,GAAW,EAAE,OAAsB,EAAE,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAA;IAE7D,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;YAC/D,MAAM,EAAE,GAAG,CAAC,UAAU;YACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;YACrC,QAAQ,EAAE,IAAI,CAAC,GAAG;SAClB,CAAC,CAAA;IACH,CAAC;IAEE,OAAO,MAAM,SAAS,CAA+B,GAAG,EAAE,IAAI,EAAE;QAC5D,MAAM,EAAE,GAAG,CAAC,UAAU;QACtB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC;KACxC,CAAC,CAAA;AACN,CAAC,CAAA"}

package/package.json

@@ -1,11 +1,12 @@
 {
 	"name": "@andrewheberle/serverless-ssh-ca",
-	"version": "0.17.13",
+	"version": "0.17.16",
 	"description": "A serverless SSH CA built on Cloudflare Workers",
 	"type": "module",
 	"types": "./dist/index.d.ts",
 	"files": [
-		"dist"
+		"dist",
+		"src"
 	],
 	"exports": {
 		".": {
@@ -16,29 +17,37 @@
 	"scripts": {
 		"build": "tsc",
 		"coverage": "vitest run --coverage",
-		"test": "vitest run",
-		"test:watch": "vitest",
+		"lint": "eslint",
 		"prepublishOnly": "npm run build",
-		"release": "release-it"
+		"release": "release-it",
+		"release:ci": "npm run release:patch",
+		"release:ci:major": "release-it major --ci",
+		"release:ci:minor": "release-it minor --ci",
+		"release:ci:patch": "release-it patch --ci",
+		"release:dryrun": "release-it --dry-run",
+		"schema": "node --require tsx/cjs scripts/export-schema.cjs",
+		"test": "vitest run",
+		"test:watch": "vitest"
 	},
 	"dependencies": {
 		"@andrewheberle/ts-slog": "^1.3.0",
-		"@cloudflare/actors": "^0.0.1-beta.6",
 		"@cloudflare/workers-types": "^4.20260528.1",
 		"chanfana": "^3.0.0",
 		"hono": "^4.10.6",
 		"itty-time": "^2.0.2",
 		"jose": "^6.0.12",
+		"workers-qb": "^1.14.0",
 		"sshpk": "^1.18.0",
 		"zod": "^4.0.0"
 	},
 	"devDependencies": {
+		"@eslint/js": "^10.0.1",
 		"@types/sshpk": "^1.17.4",
-		"@vitest/coverage-istanbul": "^4.1.7",
-		"auto-changelog": "^2.5.1",
-		"release-it": "^20.0.1",
+		"@vitest/coverage-v8": "^4.1.7",
+		"eslint": "^10.4.1",
 		"tsx": "^4.21.0",
 		"typescript": "^6.0.0",
+		"typescript-eslint": "^8.61.0",
 		"vitest": "^4.1.7"
 	},
 	"repository": {
@@ -50,5 +59,12 @@
 		"url": "https://github.com/andrewheberle/serverless-ssh-ca/issues"
 	},
 	"author": "Andrew Heberle",
-	"license": "Apache-2.0"
+	"license": "Apache-2.0",
+	"release-it": {
+		"git": false,
+		"npm": {
+			"publish": true,
+			"skipChecks": true
+		}
+	}
 }

package/src/api/v3/index.ts

@@ -0,0 +1,419 @@
+import { group } from "@andrewheberle/ts-slog"
+import {
+	ApiException,
+	ConflictException,
+	ForbiddenException,
+	fromHono,
+	InternalServerErrorException,
+	NotFoundException,
+	OpenAPIRoute,
+	UnauthorizedException,
+	UnprocessableEntityException,
+} from "chanfana"
+import { Hono } from "hono"
+import { AppContext } from "../../router"
+import { CertificateSignerResponse } from "../../types"
+import {
+	BadIssuerError,
+	CreateCertificateOptions,
+	CreateHostCertificateOptions,
+	createSignedCertificate,
+	createSignedHostCertificate,
+
+} from "../../certificate"
+import {
+	getPublic,
+	split,
+} from "../../utils"
+import {
+	KeyParseError,
+	parsePrivateKey,
+} from "sshpk"
+import {
+	CertificateType,
+	getRevocationList,
+	recordCertificate,
+	RevocationStatus,
+	revocationStatus,
+	revokeCertificate,
+} from "../../db"
+import { KRLBuilder } from "../../krl"
+import {
+	CaPublicKeyEndpointSchema,
+	createUserCertificateRequestEndpointSchema,
+	createRevocationListEndpointSchema,
+	createHostCertificateRequestEndpointSchema,
+	createHostCertificateRenewEndpointSchema,
+	createRevokeCertificateEndpointSchema,
+} from "./schema"
+import { logger } from "../../logger"
+import type { SshCaBindings } from "../../types"
+
+const CaPublicKeyEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = CaPublicKeyEndpointSchema
+
+		override async handle(c: AppContext) {
+			const l = logger(env).with(
+				...group("request", "action", "ca"),
+			)
+			try {
+				const pub = await getPublic(c.env)
+
+				return c.text(`${pub.toString("ssh").trim()}\n`)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof KeyParseError):
+						l.error("error parsing private key")
+						throw new InternalServerErrorException("error parsing private key")
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const UserCertificateRequestEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createUserCertificateRequestEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "user",
+					"action", "request",
+				),
+				...group("auth_token",
+					"email", data.headers.Authorization.email,
+					"sub", data.headers.Authorization.sub,
+				),
+				...group("id_token",
+					"sub", data.body.identity.sub,
+				),
+			)
+
+			if (data.body.identity.sub !== data.headers["Authorization"].sub) {
+				l.error("token subjects did not match")
+				throw new ForbiddenException("Possible token substitution as subjects for authentication and identity tokens did not match")
+			}
+
+			const opts: CreateCertificateOptions = {
+				lifetime: data.body.lifetime,
+				principals: data.body.identity.principals,
+				extensions: data.body.extensions,
+			}
+
+			try {
+				const certificate = await createSignedCertificate(c.env, data.headers.Authorization.email, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, data.headers.Authorization.email)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const RevocationListEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createRevocationListEndpointSchema()
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", data.params.certificateType,
+					"action", "krl",
+				),
+			)
+
+			const certificateType = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host
+
+			try {
+				// get revoked serials
+				const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v))
+
+				// grab private key from secret store
+				const secret = await c.env.PRIVATE_KEY.get()
+
+				// parse key
+				const key = parsePrivateKey(secret)
+
+				// generate KRL
+				const krl = new KRLBuilder(key)
+					.addSerials(serials)
+
+				const krlBytes = krl.generate()
+
+				// convert to base64
+				const bytes = new Uint8Array(krlBytes)
+				let binary = ""
+				for (const byte of bytes) {
+					binary += String.fromCharCode(byte)
+				}
+				const base64Krl = btoa(binary)
+
+				const signature = await krl.signature()
+
+				return c.json({
+					krl: base64Krl,
+					signature: signature,
+				})
+			} catch (err) {
+				switch (true) {
+					case (err instanceof KeyParseError):
+						l.error("error parsing private key")
+						throw new InternalServerErrorException("error parsing private key")
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const HostCertificateRequestEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createHostCertificateRequestEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "host",
+					"action", "request",
+				),
+				...group("auth_token",
+					"email", data.headers.Authorization.email,
+					"sub", data.headers.Authorization.sub,
+				),
+				...group("id_token",
+					"sub", data.body.identity.sub,
+				),
+			)
+
+			// check id and access token are for the same user
+			if (data.body.identity.sub !== data.headers.Authorization.sub) {
+				l.error("token subjects did not match")
+				throw new ForbiddenException("possible token substitution as subjects for authentication and identity tokens did not match")
+			}
+
+			// check user can issue host certificates
+			if (!split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_EMAILS).includes(data.headers.Authorization.email) && !data.body.identity.principals.some((p: string) => split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_ROLES).includes(p))) {
+				l.error("unauthorized host certificate request")
+				throw new UnauthorizedException("User not allowed to issue host certificates")
+			}
+
+			const opts: CreateHostCertificateOptions = {
+				lifetime: data.body.lifetime,
+				principals: data.body.principals,
+			}
+
+			try {
+				const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const HostCertificateRenewEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createHostCertificateRenewEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+			const serial = data.body.certificate.serial.readBigUInt64BE(0)
+
+			const l = logger(env).with(
+				...group("request",
+					"type", "host",
+					"action", "renewal",
+					"serial", serial,
+				),
+			)
+
+			// use smaller of the current certificate lifetime and the requested lifetime
+			const originalLifetime = (data.body.certificate.validUntil.getTime() - data.body.certificate.validFrom.getTime()) / 1000
+			const lifetime = originalLifetime > data.body.lifetime
+				? data.body.lifetime
+				: originalLifetime
+
+			const opts: CreateHostCertificateOptions = {
+				lifetime: lifetime,
+				subjects: data.body.certificate.subjects
+			}
+
+			try {
+				const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts)
+				const response: CertificateSignerResponse = {
+					certificate: btoa(certificate.toString("openssh"))
+				}
+
+				try {
+					await recordCertificate(c.env, certificate, `host_${certificate.subjects[0]!.hostname}`, CertificateType.Host)
+				} catch (err) {
+					l.error("there was a problem adding issued certificate to database", "error", err)
+				}
+
+				l.info("completed issuing certificate",
+					...group(
+						"certificate", "principals",
+						certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0),
+					),
+				)
+
+				return c.json(response)
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					case (err instanceof BadIssuerError):
+						throw new UnprocessableEntityException(err.message)
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+const RevokeCertificateEndpoint = (env: SshCaBindings) => {
+	return class extends OpenAPIRoute {
+		override schema = createRevokeCertificateEndpointSchema(env)
+
+		override async handle(c: AppContext) {
+			const data = await this.getValidatedData<typeof this.schema>()
+
+			const l = logger(env).with(
+				...group("request", "type", data.params.certificateType, "action", "revoke", "serial", data.body.serial),
+			)
+
+			const certificatetype = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host
+
+			// ensure certificate can be revoked
+			const status = await revocationStatus(c.env, data.body.serial, data.body.public_key.toString("ssh"), certificatetype)
+			switch (status) {
+				case RevocationStatus.Revoked:
+					l.warn("certificate is already revoked")
+					throw new ConflictException("certificate is already revoked")
+				case RevocationStatus.Unrevokable:
+					l.warn("cannot revoke this certificate")
+					throw new ForbiddenException("cannot revoke this certificate")
+				case RevocationStatus.NotFound:
+					l.warn("certificate not found")
+					throw new NotFoundException("certificate not found")
+			}
+
+			try {
+				const res = await revokeCertificate(c.env, data.body.serial)
+
+				if (res.length === 0) {
+					throw new InternalServerErrorException("no results were returned for revocation")
+				}
+
+				if (res.length > 1) {
+					l.warn("more than one revocation result was returned", "count", res.length)
+				}
+
+				l.info("completed revocation")
+				return c.json({
+					revoked_at: res[0]!.revoked_at
+				})
+			} catch (err) {
+				switch (true) {
+					case (err instanceof ApiException):
+						// re-throw any exisiting chanfana error
+						throw err
+					default:
+						// otherwise throw as InternalServerErrorException
+						l.error("unhandled error", "error", err)
+						throw new InternalServerErrorException("internal server error")
+				}
+			}
+		}
+	}
+}
+
+
+export const createApi = (env: SshCaBindings) => {
+	const api = fromHono(new Hono())
+
+	api.get("/ca", CaPublicKeyEndpoint(env))
+	api.post("/user/certificate", UserCertificateRequestEndpoint(env))
+	api.get("/:certificateType/krl", RevocationListEndpoint(env))
+	api.post("/host/certificate", HostCertificateRequestEndpoint(env))
+	api.post("/host/renew", HostCertificateRenewEndpoint(env))
+	api.post("/:certificateType/revoke", RevokeCertificateEndpoint(env))
+
+	return api
+}