@andrewheberle/serverless-ssh-ca 0.17.5

package/dist/src/api/v3/index.js

@@ -0,0 +1,263 @@
+import { group } from "@andrewheberle/ts-slog";
+import { ApiException, ConflictException, ForbiddenException, fromHono, InternalServerErrorException, NotFoundException, OpenAPIRoute, UnauthorizedException, UnprocessableEntityException, } from "chanfana";
+import { Hono } from "hono";
+import { BadIssuerError, createSignedCertificate, createSignedHostCertificate, } from "../../certificate";
+import { getPublic, split, } from "../../utils";
+import { KeyParseError, parsePrivateKey, } from "sshpk";
+import { CertificateType, getRevocationList, recordCertificate, RevocationStatus, revocationStatus, revokeCertificate, } from "../../db";
+import { KRLBuilder } from "../../krl";
+import { CaPublicKeyEndpointSchema, HostCertificateRenewEndpointSchema, HostCertificateRequestEndpointSchema, RevocationListEndpointSchema, RevokeCertificateEndpointSchema, UserCertificateRequestEndpointSchema, } from "./schema";
+import { logger } from "../../logger";
+export const api = fromHono(new Hono());
+class CaPublicKeyEndpoint extends OpenAPIRoute {
+    schema = CaPublicKeyEndpointSchema;
+    async handle(c) {
+        const l = logger.with(...group("request", "action", "ca"));
+        try {
+            const pub = await getPublic();
+            return c.text(`${pub.toString("ssh").trim()}\n`);
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof KeyParseError):
+                    l.error("error parsing private key");
+                    throw new InternalServerErrorException("error parsing private key");
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.get("/ca", CaPublicKeyEndpoint);
+class UserCertificateRequestEndpoint extends OpenAPIRoute {
+    schema = UserCertificateRequestEndpointSchema;
+    async handle(c) {
+        const data = await this.getValidatedData();
+        const l = logger.with(...group("request", "type", "user", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+        if (data.body.identity.sub !== data.headers["Authorization"].sub) {
+            l.error("token subjects did not match");
+            throw new ForbiddenException("Possible token substitution as subjects for authentication and identity tokens did not match");
+        }
+        const opts = {
+            lifetime: data.body.lifetime,
+            principals: data.body.identity.principals,
+            extensions: data.body.extensions,
+        };
+        try {
+            const certificate = await createSignedCertificate(data.headers.Authorization.email, data.body.public_key, opts);
+            const response = {
+                certificate: btoa(certificate.toString("openssh"))
+            };
+            try {
+                await recordCertificate(c.env, certificate, data.headers.Authorization.email);
+            }
+            catch (err) {
+                l.error("there was a problem adding issued certificate to database", "error", err);
+            }
+            l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+            return c.json(response);
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.post("/user/certificate", UserCertificateRequestEndpoint);
+class RevocationListEndpoint extends OpenAPIRoute {
+    schema = RevocationListEndpointSchema;
+    async handle(c) {
+        const data = await this.getValidatedData();
+        const l = logger.with(...group("request", "type", data.params.certificateType, "action", "krl"));
+        const certificateType = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host;
+        try {
+            // get revoked serials
+            const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v));
+            // grab private key from secret store
+            const secret = await c.env.PRIVATE_KEY.get();
+            // parse key
+            const key = parsePrivateKey(secret);
+            // generate KRL
+            const krl = new KRLBuilder(key)
+                .addSerials(serials);
+            const krlBytes = krl.generate();
+            // convert to base64
+            const bytes = new Uint8Array(krlBytes);
+            let binary = "";
+            for (const byte of bytes) {
+                binary += String.fromCharCode(byte);
+            }
+            const base64Krl = btoa(binary);
+            const signature = await krl.signature();
+            return c.json({
+                krl: base64Krl,
+                signature: signature,
+            });
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof KeyParseError):
+                    l.error("error parsing private key");
+                    throw new InternalServerErrorException("error parsing private key");
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.get("/:certificateType/krl", RevocationListEndpoint);
+class HostCertificateRequestEndpoint extends OpenAPIRoute {
+    schema = HostCertificateRequestEndpointSchema;
+    async handle(c) {
+        const data = await this.getValidatedData();
+        const l = logger.with(...group("request", "type", "host", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+        // check id and access token are for the same user
+        if (data.body.identity.sub !== data.headers.Authorization.sub) {
+            l.error("token subjects did not match");
+            throw new ForbiddenException("possible token substitution as subjects for authentication and identity tokens did not match");
+        }
+        // check user can issue host certificates
+        if (!split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_EMAILS).includes(data.headers.Authorization.email) && !data.body.identity.principals.some((p) => split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_ROLES).includes(p))) {
+            l.error("unauthorized host certificate request");
+            throw new UnauthorizedException("User not allowed to issue host certificates");
+        }
+        const opts = {
+            lifetime: data.body.lifetime,
+            principals: data.body.principals,
+        };
+        try {
+            const certificate = await createSignedHostCertificate(data.body.public_key, opts);
+            const response = {
+                certificate: btoa(certificate.toString("openssh"))
+            };
+            try {
+                await recordCertificate(c.env, certificate, `host_${certificate.subjects[0].hostname}`, CertificateType.Host);
+            }
+            catch (err) {
+                l.error("there was a problem adding issued certificate to database", "error", err);
+            }
+            l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+            return c.json(response);
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.post("/host/certificate", HostCertificateRequestEndpoint);
+class HostCertificateRenewEndpoint extends OpenAPIRoute {
+    schema = HostCertificateRenewEndpointSchema;
+    async handle(c) {
+        const data = await this.getValidatedData();
+        const serial = data.body.certificate.serial.readBigUInt64BE(0);
+        const l = logger.with(...group("request", "type", "host", "action", "renewal", "serial", serial));
+        // use smaller of the current certificate lifetime and the requested lifetime
+        const originalLifetime = (data.body.certificate.validUntil.getTime() - data.body.certificate.validFrom.getTime()) / 1000;
+        const lifetime = originalLifetime > data.body.lifetime
+            ? data.body.lifetime
+            : originalLifetime;
+        const opts = {
+            lifetime: lifetime,
+            subjects: data.body.certificate.subjects
+        };
+        try {
+            const certificate = await createSignedHostCertificate(data.body.public_key, opts);
+            const response = {
+                certificate: btoa(certificate.toString("openssh"))
+            };
+            try {
+                await recordCertificate(c.env, certificate, `host_${certificate.subjects[0].hostname}`, CertificateType.Host);
+            }
+            catch (err) {
+                l.error("there was a problem adding issued certificate to database", "error", err);
+            }
+            l.info("completed issuing certificate", ...group("certificate", "principals", certificate.subjects.map(v => v.toString()).join(","), "serial", certificate.serial.readBigUInt64BE(0)));
+            return c.json(response);
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                case (err instanceof BadIssuerError):
+                    throw new UnprocessableEntityException(err.message);
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.post("/host/renew", HostCertificateRenewEndpoint);
+class RevokeCertificateEndpoint extends OpenAPIRoute {
+    schema = RevokeCertificateEndpointSchema;
+    async handle(c) {
+        const data = await this.getValidatedData();
+        const l = logger.with(...group("request", "type", data.params.certificateType, "action", "revoke", "serial", data.body.serial));
+        const certificatetype = data.params.certificateType === "user" ? CertificateType.User : CertificateType.Host;
+        // ensure certificate can be revoked
+        const status = await revocationStatus(c.env, data.body.serial, data.body.public_key.toString("ssh"), certificatetype);
+        switch (status) {
+            case RevocationStatus.Revoked:
+                l.warn("certificate is already revoked");
+                throw new ConflictException("certificate is already revoked");
+            case RevocationStatus.Unrevokable:
+                l.warn("cannot revoke this certificate");
+                throw new ForbiddenException("cannot revoke this certificate");
+            case RevocationStatus.NotFound:
+                l.warn("certificate not found");
+                throw new NotFoundException("certificate not found");
+        }
+        try {
+            const res = await revokeCertificate(c.env, data.body.serial);
+            if (res.length === 0) {
+                throw new InternalServerErrorException("no results were returned for revocation");
+            }
+            if (res.length > 1) {
+                logger.warn("more than one revocation result was returned", "count", res.length);
+            }
+            logger.info("completed revocation");
+            return c.json({
+                revoked_at: res[0].revoked_at
+            });
+        }
+        catch (err) {
+            switch (true) {
+                case (err instanceof ApiException):
+                    // re-throw any exisiting chanfana error
+                    throw err;
+                default:
+                    // otherwise throw as InternalServerErrorException
+                    l.error("unhandled error", "error", err);
+                    throw new InternalServerErrorException("internal server error");
+            }
+        }
+    }
+}
+api.post("/:certificateType/revoke", RevokeCertificateEndpoint);

package/dist/src/api/v3/schema.d.ts

@@ -0,0 +1,217 @@
+import z from "zod";
+export declare const CaPublicKeyEndpointSchema: {
+    responses: {
+        "200": {
+            content: {
+                "text/plain": {
+                    schema: z.ZodString;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const UserCertificateRequestEndpointSchema: {
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const RevocationListEndpointSchema: {
+    request: {
+        params: z.ZodObject<{
+            certificateType: z.ZodEnum<{
+                user: "user";
+                host: "host";
+            }>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const HostCertificateRequestEndpointSchema: {
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const HostCertificateRenewEndpointSchema: {
+    request: {
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: import("sshpk").Certificate;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").RenewalProofOfPossession;
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: import("sshpk").Certificate;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").RenewalProofOfPossession;
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const RevokeCertificateEndpointSchema: {
+    request: {
+        params: z.ZodObject<{
+            certificateType: z.ZodEnum<{
+                user: "user";
+                host: "host";
+            }>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        serial: bigint;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        serial: bigint;
+                        public_key: import("sshpk").Key;
+                        proof: import("../../proof").ProofOfPossession;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        revoked_at: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        revoked_at: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};