@andrewheberle/serverless-ssh-ca 0.17.5

package/dist/api/v3/index.d.ts

@@ -0,0 +1,2 @@
+import type { SshCaBindings } from "../../types";
+export declare const createApi: (env: SshCaBindings) => import("chanfana").HonoOpenAPIRouterType<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;

package/dist/api/v3/index.js

@@ -0,0 +1,278 @@
+import { group } from "@andrewheberle/ts-slog";
+import { ApiException, ConflictException, ForbiddenException, fromHono, InternalServerErrorException, NotFoundException, OpenAPIRoute, UnauthorizedException, UnprocessableEntityException, } from "chanfana";
+import { Hono } from "hono";
+import { BadIssuerError, createSignedCertificate, createSignedHostCertificate, } from "../../certificate";
+import { getPublic, split, } from "../../utils";
+import { KeyParseError, parsePrivateKey, } from "sshpk";
+import { CertificateType, getRevocationList, recordCertificate, RevocationStatus, revocationStatus, revokeCertificate, } from "../../db";
+import { KRLBuilder } from "../../krl";
+import { CaPublicKeyEndpointSchema, createUserCertificateRequestEndpointSchema, createRevocationListEndpointSchema, createHostCertificateRequestEndpointSchema, createHostCertificateRenewEndpointSchema, createRevokeCertificateEndpointSchema, } from "./schema";
+import { logger } from "../../logger";
+const CaPublicKeyEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = CaPublicKeyEndpointSchema;
+        async handle(c) {
+            const l = logger(env).with(...group("request", "action", "ca"));
+            try {
+                const pub = await getPublic(c.env);
+                return c.text(`${pub.toString("ssh").trim()}\n`);
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof KeyParseError):
+                        l.error("error parsing private key");
+                        throw new InternalServerErrorException("error parsing private key");
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+const UserCertificateRequestEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createUserCertificateRequestEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", "user", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+            if (data.body.identity.sub !== data.headers["Authorization"].sub) {
+                l.error("token subjects did not match");
+                throw new ForbiddenException("Possible token substitution as subjects for authentication and identity tokens did not match");
+            }
+            const opts = {
+                lifetime: data.body.lifetime,
+                principals: data.body.identity.principals,
+                extensions: data.body.extensions,
+            };
+            try {
+                const certificate = await createSignedCertificate(c.env, data.headers.Authorization.email, data.body.public_key, opts);
+                const response = {
+                    certificate: btoa(certificate.toString("openssh"))
+                };
+                try {
+                    await recordCertificate(c.env, certificate, data.headers.Authorization.email);
+                }
+                catch (err) {
+                    l.error("there was a problem adding issued certificate to database", "error", err);
+                }
+                l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+                return c.json(response);
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+const RevocationListEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createRevocationListEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", data.params.certificateType, "action", "krl"));
+            const certificateType = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host;
+            try {
+                // get revoked serials
+                const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v));
+                // grab private key from secret store
+                const secret = await c.env.PRIVATE_KEY.get();
+                // parse key
+                const key = parsePrivateKey(secret);
+                // generate KRL
+                const krl = new KRLBuilder(key)
+                    .addSerials(serials);
+                const krlBytes = krl.generate();
+                // convert to base64
+                const bytes = new Uint8Array(krlBytes);
+                let binary = "";
+                for (const byte of bytes) {
+                    binary += String.fromCharCode(byte);
+                }
+                const base64Krl = btoa(binary);
+                const signature = await krl.signature();
+                return c.json({
+                    krl: base64Krl,
+                    signature: signature,
+                });
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof KeyParseError):
+                        l.error("error parsing private key");
+                        throw new InternalServerErrorException("error parsing private key");
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+const HostCertificateRequestEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createHostCertificateRequestEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", "host", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+            // check id and access token are for the same user
+            if (data.body.identity.sub !== data.headers.Authorization.sub) {
+                l.error("token subjects did not match");
+                throw new ForbiddenException("possible token substitution as subjects for authentication and identity tokens did not match");
+            }
+            // check user can issue host certificates
+            if (!split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_EMAILS).includes(data.headers.Authorization.email) && !data.body.identity.principals.some((p) => split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_ROLES).includes(p))) {
+                l.error("unauthorized host certificate request");
+                throw new UnauthorizedException("User not allowed to issue host certificates");
+            }
+            const opts = {
+                lifetime: data.body.lifetime,
+                principals: data.body.principals,
+            };
+            try {
+                const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts);
+                const response = {
+                    certificate: btoa(certificate.toString("openssh"))
+                };
+                try {
+                    await recordCertificate(c.env, certificate, `host_${certificate.subjects[0].hostname}`, CertificateType.Host);
+                }
+                catch (err) {
+                    l.error("there was a problem adding issued certificate to database", "error", err);
+                }
+                l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+                return c.json(response);
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+const HostCertificateRenewEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createHostCertificateRenewEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const serial = data.body.certificate.serial.readBigUInt64BE(0);
+            const l = logger(env).with(...group("request", "type", "host", "action", "renewal", "serial", serial));
+            // use smaller of the current certificate lifetime and the requested lifetime
+            const originalLifetime = (data.body.certificate.validUntil.getTime() - data.body.certificate.validFrom.getTime()) / 1000;
+            const lifetime = originalLifetime > data.body.lifetime
+                ? data.body.lifetime
+                : originalLifetime;
+            const opts = {
+                lifetime: lifetime,
+                subjects: data.body.certificate.subjects
+            };
+            try {
+                const certificate = await createSignedHostCertificate(c.env, data.body.public_key, opts);
+                const response = {
+                    certificate: btoa(certificate.toString("openssh"))
+                };
+                try {
+                    await recordCertificate(c.env, certificate, `host_${certificate.subjects[0].hostname}`, CertificateType.Host);
+                }
+                catch (err) {
+                    l.error("there was a problem adding issued certificate to database", "error", err);
+                }
+                l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+                return c.json(response);
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    case (err instanceof BadIssuerError):
+                        throw new UnprocessableEntityException(err.message);
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+const RevokeCertificateEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createRevokeCertificateEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", data.params.certificateType, "action", "revoke", "serial", data.body.serial));
+            const certificatetype = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host;
+            // ensure certificate can be revoked
+            const status = await revocationStatus(c.env, data.body.serial, data.body.public_key.toString("ssh"), certificatetype);
+            switch (status) {
+                case RevocationStatus.Revoked:
+                    l.warn("certificate is already revoked");
+                    throw new ConflictException("certificate is already revoked");
+                case RevocationStatus.Unrevokable:
+                    l.warn("cannot revoke this certificate");
+                    throw new ForbiddenException("cannot revoke this certificate");
+                case RevocationStatus.NotFound:
+                    l.warn("certificate not found");
+                    throw new NotFoundException("certificate not found");
+            }
+            try {
+                const res = await revokeCertificate(c.env, data.body.serial);
+                if (res.length === 0) {
+                    throw new InternalServerErrorException("no results were returned for revocation");
+                }
+                if (res.length > 1) {
+                    l.warn("more than one revocation result was returned", "count", res.length);
+                }
+                l.info("completed revocation");
+                return c.json({
+                    revoked_at: res[0].revoked_at
+                });
+            }
+            catch (err) {
+                switch (true) {
+                    case (err instanceof ApiException):
+                        // re-throw any exisiting chanfana error
+                        throw err;
+                    default:
+                        // otherwise throw as InternalServerErrorException
+                        l.error("unhandled error", "error", err);
+                        throw new InternalServerErrorException("internal server error");
+                }
+            }
+        }
+    };
+};
+export const createApi = (env) => {
+    const api = fromHono(new Hono());
+    api.get("/ca", CaPublicKeyEndpoint(env));
+    api.post("/user/certificate", UserCertificateRequestEndpoint(env));
+    api.get("/:certificateType/krl", RevocationListEndpoint(env));
+    api.post("/host/certificate", HostCertificateRequestEndpoint(env));
+    api.post("/host/renew", HostCertificateRenewEndpoint(env));
+    api.post("/:certificateType/revoke", RevokeCertificateEndpoint(env));
+    return api;
+};

package/dist/api/v3/schema.d.ts

@@ -0,0 +1,218 @@
+import z from "zod";
+import type { SshCaBindings } from "../../types";
+export declare const CaPublicKeyEndpointSchema: {
+    responses: {
+        "200": {
+            content: {
+                "text/plain": {
+                    schema: z.ZodString;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createUserCertificateRequestEndpointSchema: (env: SshCaBindings) => {
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createRevocationListEndpointSchema: (env: SshCaBindings) => {
+    request: {
+        params: z.ZodObject<{
+            certificateType: z.ZodEnum<{
+                user: "user";
+                host: "host";
+            }>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createHostCertificateRequestEndpointSchema: (env: SshCaBindings) => {
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createHostCertificateRenewEndpointSchema: (env: SshCaBindings) => {
+    request: {
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: import("sshpk").Certificate;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").RenewalProofOfPossession;
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: import("sshpk").Certificate;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").RenewalProofOfPossession;
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createRevokeCertificateEndpointSchema: (env: SshCaBindings) => {
+    request: {
+        params: z.ZodObject<{
+            certificateType: z.ZodEnum<{
+                user: "user";
+                host: "host";
+            }>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        serial: bigint;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        serial: bigint;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        revoked_at: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        revoked_at: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};