@andrewheberle/serverless-ssh-ca 0.17.13 → 0.17.16

package/src/api/v3/schema.ts

@@ -0,0 +1,273 @@
+import z from "zod"
+import type { SshCaBindings } from "../../types"
+import {
+	split,
+	refineCertificateRequest,
+	transformAuthorizationHeader,
+	transformProofOfPossession,
+	transformPublicKey,
+	transformRenewalProofOfPossession,
+	refineHostCertificateRequest,
+	transformCertificate,
+	refineHostCertificateRenewal,
+	refineRevokeCertificate,
+	transformIdentityToken,
+} from "../../utils"
+import {
+	ConflictException,
+	contentJson,
+	ForbiddenException,
+	InputValidationException,
+	InternalServerErrorException,
+	UnauthorizedException,
+	UnprocessableEntityException,
+} from "chanfana"
+import { seconds } from "itty-time"
+import { isRevoked } from "../../db"
+
+const openapiStringByte = z.base64()
+	.transform((v) => {
+		const a = z.util.base64ToUint8Array(v)
+		return Buffer.from(
+			a.buffer,
+			a.byteOffset,
+			a.length
+		)
+	})
+	.openapi({ format: "byte" })
+
+const proofOfPossession = z.string()
+	.meta({
+		description: "Proof of possession comprising of ${timestamp}.${fingerprint}.${signature}",
+		example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0KVTFOSVUwbEhBQUFBQVFBQUFHZ0FBQUFUWldOa2MyRXRjMmhoTWkxdWFYTjBjREkxTmdBQUFBaHVhWE4wY0RJMQpOZ0FBQUVFRUR6Ymk4OE10alBYSDFCb1JURU9HaS96aEc4QnhQNVZUUW5OQkFNMGZtMExtekErUUZkUlNVYVRFCkdNN2l0QjhINmZNZFAydlAxcElQcGUyOWVLQkJZd0FBQUFSbWFXeGxBQUFBQUFBQUFBWnphR0UxTVRJQUFBQmsKQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUJKQUFBQUlHdmZVZGNDQkRXa3ZwL0ZHS3NkakgrRQpKZzZXN0EvWUJVZng2Z0srQ01raEFBQUFJUUQxOFd5cDNZejZ0eXNvdllXbEJHTXprRnlYbFRrSHM5blVVRXJqCkczNWVPQT09Ci0tLS0tRU5EIFNTSCBTSUdOQVRVUkUtLS0tLQo="
+	})
+
+const publicKey = openapiStringByte
+	.transform(transformPublicKey)
+	.meta({
+		description: "SSH public key to sign",
+		example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
+	})
+
+export const createIdentityTokenSchema = (env: SshCaBindings) => (
+	z.string()
+		.meta({
+			description: "Identity Token JWT from OIDC IdP",
+			example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
+		})
+		.transform((val, ctx) => transformIdentityToken(env, val, ctx))
+)
+
+export const createAccessTokenSchema = (env: SshCaBindings) => (
+	z.string()
+		.meta({
+			description: "Access Token JWT from OIDC IdP",
+			example: "Bearer eyJ..."
+		})
+		.transform((val, ctx) => transformAuthorizationHeader(env, val, ctx))
+)
+
+const krl = openapiStringByte
+	.meta({ description: "Key Revocation List" })
+
+export const createHeaderSchema = (env: SshCaBindings) => (
+	z.object({
+		"Authorization": createAccessTokenSchema(env)
+	})
+)
+
+const certificate = openapiStringByte
+	.meta({ description: "Issued Certificate" })
+
+export const CaPublicKeyEndpointSchema = {
+	responses: {
+		"200": {
+			content: {
+				"text/plain": {
+					schema: z.string()
+				}
+			},
+			description: "Returns SSH Certificate Authority Public Key",
+		},
+		...InternalServerErrorException.schema(),
+	}
+}
+
+export const userCertificateRequestEndpointBodySchema = (env: SshCaBindings) => (
+	z.object({
+		public_key: publicKey,
+		proof: proofOfPossession
+			.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+		identity: createIdentityTokenSchema(env),
+		extensions: z.array(z.string())
+			.default(split(env.SSH_CERTIFICATE_EXTENSIONS))
+			.meta({ description: "Extensions to include in the issued SSH certificate" }),
+		lifetime: z.int()
+			.min(seconds("5 minutes"))
+			.max(seconds(env.SSH_CERTIFICATE_LIFETIME))
+			.default(seconds(env.SSH_CERTIFICATE_LIFETIME))
+			.meta({ description: "Lifetime of issued SSH certificate" }),
+	})
+		.superRefine((val, ctx) => refineCertificateRequest(env, val, ctx))
+		.openapi("User Certificate Request")
+)
+
+export const createUserCertificateRequestEndpointSchema = (env: SshCaBindings) => ({
+	security: [{ oidcAuth: [] }],
+	request: {
+		headers: createHeaderSchema(env),
+		body: contentJson(userCertificateRequestEndpointBodySchema(env)),
+	},
+	responses: {
+		"200": {
+			description: "SSH User Certificate issued successfully",
+			...contentJson(z.object({
+				certificate: certificate,
+			})
+				.openapi("Certificate Response")
+			)
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const createRevocationListEndpointSchema = () => ({
+	request: {
+		params: z.object({
+			certificateType: z.enum(["user", "host"])
+		}),
+	},
+	responses: {
+		"200": {
+			description: "Returns an Open SSH Key Revocation List as BASE64 and an SSHSIG signature for verification",
+			...contentJson(z.object({
+				krl: krl,
+				signature: z.string()
+			})
+				.openapi("Key Revocation List Response")
+			)
+		},
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const hostCertificateRequestEndpointBodySchema = (env: SshCaBindings) => (
+	z.object({
+				public_key: publicKey,
+				proof: proofOfPossession
+					.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+				identity: createIdentityTokenSchema(env),
+				principals: z.array(z.string()).min(1)
+					.meta({ description: "List of principals to include on the issued certificate" }),
+				lifetime: z.int()
+					.min(seconds("24 hours"))
+					.max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+					.meta({ description: "Lifetime of issued Host SSH certificate" }),
+			})
+				.superRefine((val, ctx) => refineHostCertificateRequest(env, val, ctx))
+				.openapi("Host Certificate Request")
+)
+
+export const createHostCertificateRequestEndpointSchema = (env: SshCaBindings) => ({
+	security: [{ oidcAuth: [] }],
+	request: {
+		headers: createHeaderSchema(env),
+		body: contentJson(hostCertificateRequestEndpointBodySchema(env))
+	},
+	responses: {
+		"200": {
+			description: "SSH Host Certificate issued successfully",
+			...contentJson(z.object({
+				certificate: certificate,
+			})
+				.openapi("Certificate Response")
+			)
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const hostCertificateRenewEndpointBodySchema = (env: SshCaBindings) => (
+	z.object({
+			certificate: openapiStringByte
+				.transform(transformCertificate)
+				.meta({ description: "SSH certificate to renew" }),
+			public_key: publicKey,
+			proof: proofOfPossession
+				.transform((val, ctx) => transformRenewalProofOfPossession(env, val, ctx)),
+			lifetime: z.int()
+				.min(seconds("24 hours"))
+				.max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+				.default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+				.meta({ description: "Lifetime of renewed Host SSH certificate" }),
+		})
+			.superRefine((val, ctx) => refineHostCertificateRenewal(env, isRevoked, val, ctx))
+			.openapi("Host Certificate Renew")
+)
+
+export const createHostCertificateRenewEndpointSchema = (env: SshCaBindings) => ({
+	request: {
+		body: contentJson(hostCertificateRenewEndpointBodySchema(env))
+	},
+	responses: {
+		"200": {
+			description: "SSH Host Certificate renewed successfully",
+			...contentJson(z.object({
+				certificate: certificate
+			})
+				.openapi("Certificate Response")
+			),
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+	}
+})
+
+export const revokeCertificateEndpointBodySchema = (env: SshCaBindings) => (
+	z.object({
+			serial: z.bigint()
+				.meta({ description: "Serial number of certificate to revoke" }),
+			public_key: publicKey,
+			proof: proofOfPossession
+				.transform((val, ctx) => transformProofOfPossession(env, val, ctx)),
+		})
+			.openapi("Certificate Revocation")
+			.superRefine((val, ctx) => refineRevokeCertificate(env, val, ctx))
+)
+
+export const createRevokeCertificateEndpointSchema = (env: SshCaBindings) => ({
+	request: {
+		params: z.object({
+			certificateType: z.enum(["user", "host"])
+		}),
+		body: contentJson(revokeCertificateEndpointBodySchema(env))
+	},
+	responses: {
+		"200": {
+			description: "SSH certificate revoked successfully",
+			...contentJson(z.object({
+				revoked_at: z.iso.datetime(),
+			})
+				.openapi("Revocation Response")
+			),
+		},
+		...UnauthorizedException.schema(),
+		...ForbiddenException.schema(),
+		...InputValidationException.schema(),
+		...UnprocessableEntityException.schema(),
+		...InternalServerErrorException.schema(),
+		...ConflictException.schema()
+	}
+})

package/src/certificate.ts

@@ -0,0 +1,220 @@
+import { seconds } from "itty-time"
+import { Certificate, createCertificate, Identity, identityForHost, identityForUser, identityFromDN, Key, parsePrivateKey, PrivateKey } from "sshpk"
+import { SSHExtension } from "./types"
+import { split } from "./utils"
+import type { SshCaBindings } from "./types"
+
+// const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+
+export type CreateCertificateOptions = {
+	lifetime?: number
+	principals?: string[]
+	extensions?: string[]
+}
+
+/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
+	lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
+	principals: [],
+	extensions: sshCertificateExtensions
+} */
+
+export class CertificateError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "CertificateError"
+
+		// This is necessary for proper stack trace in TypeScript
+		Object.setPrototypeOf(this, CertificateError.prototype)
+	}
+}
+
+export type GenerateCertificateOptions = {
+	/**
+	 * @internal
+	 * Override the certificate serial number.
+	 * Should only be set in tests.
+	 */
+	serial?: bigint
+} & CreateCertificateOptions
+
+export const generateCertificate = (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions): Certificate => {
+	let { lifetime } = options ?? {}
+	const { principals, extensions, serial } = options ?? {}
+
+	// add identities
+	const includeSelf = env.SSH_CERTIFICATE_INCLUDE_SELF === undefined
+		? false
+		: typeof env.SSH_CERTIFICATE_INCLUDE_SELF === "string"
+			? env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
+			: env.SSH_CERTIFICATE_INCLUDE_SELF
+	const identity = includeSelf
+		? [identityForUser(email.split("@")[0]!)]
+		: []
+	if (principals !== undefined) {
+		for (const p of principals) {
+			identity.push(identityForUser(p))
+		}
+	}
+
+	for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
+		identity.push(identityForUser(p))
+	}
+
+
+	// lifetime is the smaller of what was provided in the options or the default
+	lifetime = lifetime !== undefined
+		? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_CERTIFICATE_LIFETIME)
+
+	// generate value for serial of certificate
+	const s = generateSerial(serial)
+
+	// set issuer of certificate based on ISSUER_DN
+	const issuer = identityFromDN(env.ISSUER_DN)
+
+	// create certificate
+	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s })
+
+	// ensure openssh info is included in certificate (should not occur)
+	if (certificate.signatures.openssh === undefined) {
+		throw new CertificateError("missing openssh information in certificate")
+	}
+
+	const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS)
+
+	// add usage extensions
+	const sshextensions: SSHExtension[] = []
+	if (extensions !== undefined) {
+		// if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
+		for (const ext of extensions) {
+			if (!sshCertificateExtensions.includes(ext)) {
+				throw new CertificateError(`${ext} is not allowed`)
+			}
+
+			// add to list of allowed extensions
+			sshextensions.push({
+				critical: false,
+				name: ext,
+				data: Buffer.alloc(0)
+			})
+		}
+	} else {
+		// use defaults if not provided
+		sshCertificateExtensions.forEach((ext: string) => {
+			sshextensions.push({
+				critical: false,
+				name: ext,
+				data: Buffer.alloc(0)
+			})
+		})
+
+	}
+
+	// add info to certificate
+	certificate.signatures = {
+		openssh: {
+			nonce: certificate.signatures.openssh.nonce,
+			keyId: email,
+			signature: certificate.signatures.openssh.signature,
+			exts: sshextensions
+		}
+	}
+
+	// re-sign after changes
+	certificate.signWith(key)
+
+	return certificate
+}
+
+export async function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate> {
+	// grab private key from secret store
+	const secret = await env.PRIVATE_KEY.get()
+
+	// parse key
+	const key = parsePrivateKey(secret)
+
+	if (options === undefined) {
+		options = {
+			lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
+			principals: [],
+			extensions: split(env.SSH_CERTIFICATE_EXTENSIONS)
+		}
+	}
+
+	return generateCertificate(env, email, key, public_key, options)
+}
+
+export type CreateHostCertificateOptions = {
+	lifetime?: number
+	principals?: string[]
+	subjects?: Identity[]
+}
+
+/* const DefaultCreateHostertificateOptions: CreateHostCertificateOptions = {
+	lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
+	principals: [],
+} */
+
+export class BadIssuerError extends Error {
+	constructor(message: string) {
+		super(message)
+		this.name = "BadIssuerError"
+
+		Object.setPrototypeOf(this, BadIssuerError.prototype)
+	}
+}
+
+export async function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate> {
+	if (options === undefined) {
+		options = {
+			lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
+			principals: []
+		}
+	}
+	// generate list of identities for host key
+	const identity: Identity[] = []
+	if (options.principals !== undefined) {
+		for (const p of options.principals) {
+			identity.push(identityForHost(p))
+		}
+	}
+
+	// add any already provided subjects (for renewals only)
+	if (options.subjects !== undefined) {
+		identity.push(...options.subjects)
+	}
+
+	// grab private key from secret store
+	const secret = await env.PRIVATE_KEY.get()
+
+	// parse private key
+	const key = parsePrivateKey(secret)
+
+	// lifetime is the smaller of what was provided in the options or the default
+	const lifetime = options.lifetime !== undefined
+		? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+		: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME)
+
+	// generate value for serial of certificate
+	const serial = generateSerial()
+
+	// set issuer of certificate based on ISSUER_DN
+	const issuer = identityFromDN(env.ISSUER_DN)
+
+	// create certificate
+	const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial })
+
+	return certificate
+}
+
+export const generateSerial = (serial?: bigint): Buffer<ArrayBuffer> => {
+	if (serial !== undefined) {
+		const s = Buffer.alloc(8)
+		s.writeBigUInt64BE(serial)
+
+		return s
+	}
+
+	const randomBytes = crypto.getRandomValues(new Uint8Array(8))
+	return Buffer.from(randomBytes)
+}

package/src/db/index.ts

@@ -0,0 +1,194 @@
+import { Certificate, Format, Identity } from "sshpk"
+import { logger } from "../logger"
+import type { SshCaBindings } from "../types"
+import { D1QB } from "workers-qb"
+import { migrations } from "./migrations"
+
+export enum CertificateType {
+	User,
+	Host
+}
+
+export type CertificateRecord = {
+	id: number
+	serial: string
+	key_id: string
+	principals: string
+	extensions: string | null
+	valid_after: Date
+	valid_before: Date
+	revoked_at: Date | null
+	certificate_type: CertificateType
+	public_key: string | null
+}
+
+export type DatabaseSchema = {
+	certificates: CertificateRecord
+}
+
+const connect = async (env: SshCaBindings): Promise<D1QB<DatabaseSchema>> => {
+	const l = logger(env)
+
+	try {
+		l.info("connecting to database")
+
+		const qb = new D1QB<DatabaseSchema>(env.DB)
+		const migrationBuilder = qb.migrations({ migrations })
+		const appliedMigrations = await migrationBuilder.apply()
+
+		l.info("applied database migrations", "migrations", appliedMigrations.length, "migration_names", appliedMigrations.map(m => m.name))
+
+		return qb
+	} catch (err) {
+		l.error("error connecting to database", "error", err)
+		throw err
+	}
+}
+
+export const dbCleanup = async (env: SshCaBindings) => {
+	const l = logger(env).with("retention", env.DB_CERTIFICATE_RETENTION)
+
+	if (env.DB_CERTIFICATE_RETENTION === "infinite") {
+		l.info("skipping database cleanup")
+	}
+
+	l.info("starting database cleanup")
+	try {
+		const qb = await connect(env)
+		const res = await qb.delete({
+			tableName: "certificates",
+			where: {
+				conditions: "unixepoch('subsec') > unixepoch(valid_before,'subsec',?)",
+				params: env.DB_CERTIFICATE_RETENTION
+			}
+		}).execute()
+		l.info("completed database cleanup", "changes", res.meta?.changes)
+	} catch (err) {
+		l.error("error during database cleanup", "retention", env.DB_CERTIFICATE_RETENTION, "error", err)
+	}
+}
+
+export const recordCertificate = async (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType: CertificateType = CertificateType.User) => {
+	const serial = certificate.serial.readBigUInt64BE(0)
+	const subjects = certificate.subjects.map((v: Identity): string => {
+		return v.toString()
+	}).join(",")
+	const extensions = certificate.getExtensions().map((v: Format.OpenSshSignatureExt | Format.x509SignatureExt): string => {
+		// @ts-expect-error: the name property does exist
+		return v.name as string
+	}).join(",")
+	const qb = await connect(env)
+	const res = await qb.insert({
+		tableName: "certificates",
+		data: {
+			serial: `${serial}`,
+			key_id: keyid,
+			principals: subjects,
+			extensions: extensions,
+			valid_after: certificate.validFrom.toISOString(),
+			valid_before: certificate.validUntil.toISOString(),
+			certificate_type: certificateType,
+			public_key: certificate.subjectKey.toString("ssh")
+		},
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+}
+
+export const isRevoked = async (env: SshCaBindings, serial: bigint): Promise<boolean> => {
+	const qb = await connect(env)
+	const res = await qb.fetchOne({
+		tableName: "certificates",
+		fields: ["serial"],
+		where: {
+			conditions: "serial = ? AND revoked_at NOTNULL",
+			params: `${serial}`
+		},
+	}).execute()
+
+	return res.results !== undefined
+}
+
+export enum RevocationStatus {
+	NotFound,
+	Revoked,
+	Revokable,
+	Unrevokable
+}
+
+export const revocationStatus = async (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType): Promise<RevocationStatus> => {
+	const qb = await connect(env)
+	const res = await qb.fetchOne({
+		tableName: "certificates",
+		fields: ["public_key", "revoked_at"],
+		where: {
+			conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
+			params: [`${serial}`, publickey, certificateType]
+		}
+	}).execute()
+
+	if (res.results === undefined) {
+		return RevocationStatus.NotFound
+	}
+
+	if (res.results.revoked_at !== null) {
+		return RevocationStatus.Revoked
+	}
+
+	if (publickey === res.results.public_key) {
+		return RevocationStatus.Revokable
+	}
+
+	return RevocationStatus.Unrevokable
+}
+
+export const getRevocationList = async (env: SshCaBindings, certificateType: CertificateType): Promise<string[]> => {
+	const qb = await connect(env)
+	const res = await qb.fetchAll({
+		tableName: "certificates",
+		fields: ["serial"],
+		where: {
+			conditions: "revoked_at NOTNULL AND certificate_type = ? AND unixepoch('subsec') < unixepoch(valid_before,'subsec','24 hours')",
+			params: certificateType
+		}
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+
+	if (res.results === undefined) {
+		return []
+	}
+
+	return res.results.map(item => item.serial)
+}
+
+type RevokedCertificate = Pick<CertificateRecord, "revoked_at">
+
+export const revokeCertificate = async (env: SshCaBindings, serial: bigint): Promise<RevokedCertificate[]> => {
+	const qb = await connect(env)
+	const res = await qb.update<RevokedCertificate>({
+		tableName: "certificates",
+		data: {
+			revoked_at: (new Date).toISOString()
+		},
+		where: {
+			conditions: "serial = ?",
+			params: `${serial}`
+		},
+		returning: ["revoked_at"]
+	}).execute()
+
+	if (!res.success) {
+		throw new Error("error during query")
+	}
+
+	if (res.results === undefined) {
+		return []
+	}
+
+	return res.results
+}

package/src/db/migrations/0001_initial_schema.ts

@@ -0,0 +1,25 @@
+import { type Migration } from "workers-qb";
+
+export const migration: Migration = {
+	name: "0001_initial_schema",
+	sql: `
+		CREATE TABLE IF NOT EXISTS certificates (
+			id INTEGER PRIMARY KEY,
+			serial TEXT UNIQUE NOT NULL,
+			key_id TEXT NOT NULL,
+			principals TEXT NOT NULL,
+			extensions TEXT,
+			valid_after TIMESTAMP NOT NULL,
+			valid_before TIMESTAMP NOT NULL,
+			revoked_at TIMESTAMP,
+			certificate_type INTEGER NOT NULL DEFAULT 0,
+			public_key TEXT
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_certificates_serial ON certificates(serial);
+		CREATE INDEX IF NOT EXISTS idx_certificates_valid_after ON certificates(valid_after);
+		CREATE INDEX IF NOT EXISTS idx_certificates_valid_before ON certificates(valid_before);
+		CREATE INDEX IF NOT EXISTS idx_certificates_revoked_at ON certificates(revoked_at);
+		CREATE INDEX IF NOT EXISTS idx_certificates_certificate_type ON certificates(certificate_type);
+	`
+}