@andrewheberle/serverless-ssh-ca 0.17.5 → 0.17.7

package/dist/src/utils.js

@@ -1,370 +0,0 @@
-import { env } from "cloudflare:workers";
-import { JWKInvalid, JWKSInvalid, JWSInvalid, JWTClaimValidationFailed, JWTInvalid } from "jose/errors";
-import { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } from "sshpk";
-import z from "zod";
-import { verifyJWT } from "./verify";
-import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof";
-import { isRevoked } from "./db";
-import { logger } from "./logger";
-export const fatalIssue = (ctx, message, val) => {
-    ctx.issues.push({
-        code: "custom",
-        message: message,
-        input: val
-    });
-    return z.NEVER;
-};
-export const transformProofOfPossession = (val, ctx) => {
-    try {
-        const proof = new ProofOfPossession(val, { logger: logger });
-        return proof;
-    }
-    catch (err) {
-        logger.error("proof of possession parsing error", "error", err);
-        switch (true) {
-            case (err instanceof PossessionParseError):
-                ctx.issues.push({
-                    code: "custom",
-                    message: err.message,
-                    input: val
-                });
-                break;
-            default:
-                ctx.issues.push({
-                    code: "custom",
-                    message: "proof of possession transform unhandled error",
-                    input: val
-                });
-        }
-        return z.NEVER;
-    }
-};
-export const transformAuthorizationHeader = async (val, ctx) => {
-    const jwt = val.replace("Bearer ", "");
-    if (jwt === "") {
-        return fatalIssue(ctx, "request did not contain a JWT", val);
-    }
-    try {
-        // verify jwt
-        const { payload } = await verifyJWT(jwt);
-        if (payload.email === undefined) {
-            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
-        }
-        return {
-            email: payload.email,
-            sub: payload.sub,
-        };
-    }
-    catch (err) {
-        switch (true) {
-            case (err instanceof JWSInvalid):
-                return fatalIssue(ctx, "the access token was invalid", val);
-            case (err instanceof JWTInvalid):
-                return fatalIssue(ctx, "the access token failed verification", val);
-            case (err instanceof JWKInvalid):
-                return fatalIssue(ctx, "the access token JWK was invalid", val);
-            case (err instanceof JWKSInvalid):
-                return fatalIssue(ctx, "the access token JWKS was invalid", val);
-            case (err instanceof JWTClaimValidationFailed):
-                return fatalIssue(ctx, "claim validtion of the JWT failed", val);
-            default:
-                logger.error("unhandled access token validation error", "in", "transformAuthorizationHeader", "error", err);
-                return fatalIssue(ctx, "unhandled access token validation error", val);
-        }
-    }
-};
-export const transformPublicKey = (val, ctx) => {
-    try {
-        const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val);
-        return key;
-    }
-    catch (err) {
-        switch (true) {
-            case (err instanceof TypeError):
-                ctx.issues.push({
-                    code: "custom",
-                    message: err.message,
-                    input: val
-                });
-                break;
-            case (err instanceof KeyParseError):
-                ctx.issues.push({
-                    code: "custom",
-                    message: err.message,
-                    input: val
-                });
-                break;
-            default:
-                ctx.issues.push({
-                    code: "custom",
-                    message: "unhandled error parsing public_key",
-                    input: val
-                });
-        }
-        return z.NEVER;
-    }
-};
-export const identityPrincipals = (payload, claim) => {
-    if (claim === undefined) {
-        claim = env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM;
-    }
-    const p = payload[claim];
-    if (p === undefined) {
-        logger.warn("claim was missing despite being set in CA config", "claim", claim);
-        return [];
-    }
-    if (p === "") {
-        logger.warn("claim was present but was an empty string", "claim", claim);
-        return [];
-    }
-    // make sure its always a string[]
-    const principals = typeof p === "string" ? [p] : p;
-    // replace any spaces with underscores
-    principals.forEach((value, index, array) => {
-        array[index] = value.replaceAll(" ", "_");
-    });
-    logger.info("identity token included principals", "principals", principals);
-    return principals;
-};
-export const parseIdentity = async (jwt, claim) => {
-    if (jwt === undefined) {
-        throw new Error("missing identity token");
-    }
-    const aud = env.JWT_AUD === undefined || env.JWT_AUD === "" ? undefined : split(env.JWT_AUD);
-    const { payload } = await verifyJWT(jwt, { aud: aud });
-    const principals = identityPrincipals(payload, claim);
-    return {
-        sub: payload.sub,
-        principals: principals,
-    };
-};
-export const transformIdentityToken = async (val, ctx) => {
-    try {
-        const identity = await parseIdentity(val, env.JWT_SSH_CERTIFICATE_PRINCIPALS_CLAIM);
-        return identity;
-    }
-    catch (err) {
-        ctx.issues.push({
-            code: "custom",
-            message: "problem parsing identity token",
-            input: val
-        });
-        return z.NEVER;
-    }
-};
-/**
- *
- * @param val A SSH certificate either a base64 encoded "string" or a "Buffer\<ArrayBufferLike\>"
- * @param ctx The Zod context for any errors
- * @returns
- */
-export const transformCertificate = (val, ctx) => {
-    try {
-        const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh");
-        return cert;
-    }
-    catch (err) {
-        switch (true) {
-            case (err instanceof TypeError):
-                ctx.issues.push({
-                    code: "custom",
-                    message: err.message,
-                    input: val
-                });
-                break;
-            case (err instanceof CertificateParseError):
-                ctx.issues.push({
-                    code: "custom",
-                    message: err.message,
-                    input: val
-                });
-                break;
-            default:
-                ctx.issues.push({
-                    code: "custom",
-                    message: "unhandled error parsing certificate",
-                    input: val
-                });
-        }
-        return z.NEVER;
-    }
-};
-export const refineCertificateRequest = async (val, ctx) => {
-    try {
-        // check proof of possession fingerprint matches public key
-        if (!val.proof.matches(val.public_key)) {
-            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.proof.verify();
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        logger.error("proof of possession verification unhandled error", "in", "refineCertificateRequest", "error", err);
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const refineLegacyCertificateRequest = async (val, ctx) => {
-    try {
-        // check proof of possession fingerprint matches public key
-        if (!val.nonce.matches(val.public_key)) {
-            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.nonce.verify("file");
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const transformRenewalProofOfPossession = (val, ctx) => {
-    try {
-        return new RenewalProofOfPossession(val, { logger: logger });
-    }
-    catch (err) {
-        if (err instanceof PossessionParseError) {
-            return fatalIssue(ctx, err.message, val);
-        }
-        logger.error("proof of possession verification unhandled error", "in", "transformRenewalProofOfPossession", "error", err);
-        return fatalIssue(ctx, "proof of possession transform unhandled error", val);
-    }
-};
-export const refineHostCertificateRequest = async (val, ctx) => {
-    const l = logger.with("in", "refineHostCertificateRequest");
-    l.debug("started");
-    try {
-        // check proof of possession fingerprint matches public key
-        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"));
-        if (!val.proof.matches(val.public_key)) {
-            l.warn("proof of possession fingerprint did not match public_key");
-            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
-        }
-        // verify proof of possession signature
-        l.debug("await val.proof.verify()");
-        const verified = await val.proof.verify();
-        if (!verified) {
-            l.warn("proof of possession signature validation failed");
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        l.debug("done");
-        return z.NEVER;
-    }
-    catch (err) {
-        l.error("proof of possession verification unhandled error", "error", err);
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const refineLegacyHostCertificateRequest = async (val, ctx) => {
-    try {
-        // check proof of possession fingerprint matches public key
-        if (!val.nonce.matches(val.public_key)) {
-            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.nonce.verify("file");
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const refineHostCertificateRenewal = async (val, ctx) => {
-    try {
-        // ensure certificate is signed by CA
-        const issuer = await getPublic();
-        if (!val.certificate.isSignedByKey(issuer)) {
-            return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
-        }
-        // check certificate is not expired
-        if (val.certificate.isExpired()) {
-            return fatalIssue(ctx, "the provided certificate is expired", val);
-        }
-        // ensure certificate presented for renewal is not revoked
-        const serial = val.certificate.serial.readBigUInt64BE(0);
-        if (await isRevoked(serial)) {
-            return fatalIssue(ctx, "the provided certificate is revoked", val);
-        }
-        // check proof of possession fingerprint matches public key and certificate subject key
-        if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
-            return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.proof.verify();
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        logger.error("proof of possession verification unhandled error", "in", "refineHostCertificateRenewal", "error", err);
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const refineRevokeCertificate = async (val, ctx) => {
-    try {
-        // check proof of possession fingerprint matches public key
-        if (!val.proof.matches(val.public_key)) {
-            return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.proof.verify();
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        logger.error("proof of possession verification unhandled error", "in", "refineRevokeCertificate", "error", err);
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const refineLegacyHostCertificateRenewal = async (val, ctx) => {
-    try {
-        // check certificate is not expired
-        if (val.certificate.isExpired()) {
-            return fatalIssue(ctx, "certificate is expired", val);
-        }
-        // check proof of possession fingerprint matches public key and certificate subject key
-        if (!val.nonce.matches(val.public_key, val.certificate.subjectKey)) {
-            return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
-        }
-        // verify proof of possession signature
-        const verified = await val.nonce.verify("file");
-        if (!verified) {
-            return fatalIssue(ctx, "proof of possession signature validation failed", val);
-        }
-        return z.NEVER;
-    }
-    catch (err) {
-        return fatalIssue(ctx, "proof of possession verification unhandled error", val);
-    }
-};
-export const split = (v) => {
-    if (v === "" || v === undefined) {
-        return [];
-    }
-    return v.split(",");
-};
-export const getPublic = async (key) => {
-    if (key === undefined) {
-        // grab private key from secret store
-        const secret = await env.PRIVATE_KEY.get();
-        // parse it
-        key = parsePrivateKey(secret);
-    }
-    // convert to a public key and add comment
-    const pub = key.toPublic();
-    pub.comment = env.ISSUER_DN;
-    // return in ssh format trimmed of any whitespace
-    return pub;
-};

package/dist/src/verify.d.ts

@@ -1,6 +0,0 @@
-import { CertificateRequestJWTPayload } from "./types";
-type VerifyOptions = {
-    aud?: string | string[];
-};
-export declare const verifyJWT: (jwt: string, opts?: VerifyOptions) => Promise<import("jose").JWTVerifyResult<CertificateRequestJWTPayload> & import("jose").ResolvedKey>;
-export {};

package/dist/src/verify.js

@@ -1,17 +0,0 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
-import { env } from "cloudflare:workers";
-import { split } from "./utils";
-export const verifyJWT = async (jwt, opts = {}) => {
-    const JWKS = createRemoteJWKSet(new URL(env.JWT_JWKS_URL));
-    if (opts.aud !== undefined) {
-        return await jwtVerify(jwt, JWKS, {
-            issuer: env.JWT_ISSUER,
-            algorithms: split(env.JWT_ALGORITHMS),
-            audience: opts.aud
-        });
-    }
-    return await jwtVerify(jwt, JWKS, {
-        issuer: env.JWT_ISSUER,
-        algorithms: split(env.JWT_ALGORITHMS),
-    });
-};