@andrewheberle/serverless-ssh-ca 0.18.1 → 0.19.0

package/src/router.ts

@@ -1,11 +1,10 @@
 import { fromHono } from "chanfana"
 import { Hono, type Context } from "hono"
-import { createApi as apiv3 } from "./api/v3"
+import { createApi as apiv3 } from "./api/v3/index.js"
 import { HTTPException } from "hono/http-exception"
-import { logger } from "./logger"
-import type { SshCaBindings } from "./types"
+import { logger } from "./logger.js"
+import type { SshCaBindings } from "./types.js"
 
-export type CFArgs = [SshCaBindings, ExecutionContext]
 export type AppContext = Context<{ Bindings: SshCaBindings }>
 
 export const createApp = (env: SshCaBindings) => {

package/src/sshsig/formats.ts

@@ -1,4 +1,4 @@
-import { Reader } from "./reader";
+import { Reader } from "./reader.js";
 
 /**
  * Represents an SSH public key.

package/src/sshsig/index.ts

@@ -1,6 +1,6 @@
-import { Sig } from "./sig";
-import { verify as rawVerify } from "./verifier";
-import { parse } from "./sig_parser";
+import { Sig } from "./sig.js";
+import { verify as rawVerify } from "./verifier.js";
+import { parse } from "./sig_parser.js";
 
 /**
  * Verifies SSH signature against provided data.

package/src/sshsig/sig.ts

@@ -1,4 +1,4 @@
-import { Pubkey } from "./formats";
+import { Pubkey } from "./formats.js";
 
 /**
  * Represents a parsed SSH signature.

package/src/sshsig/sig_parser.ts

@@ -1,7 +1,7 @@
-import { Sig } from "./sig";
-import { Reader } from "./reader";
-import { parsePubkey } from "./formats";
-import { dearmor } from "./armor";
+import { Sig } from "./sig.js";
+import { Reader } from "./reader.js";
+import { parsePubkey } from "./formats.js";
+import { dearmor } from "./armor.js";
 
 /**
  * ECDSA signature algorithms whose signatures need converting from SSH

package/src/sshsig/verifier.ts

@@ -1,6 +1,6 @@
-import { Sig } from "./sig";
-import { convertAlgorithm, convertHash, convertPublicKey } from "./formats";
-import { Writer } from "./writer";
+import { Sig } from "./sig.js";
+import { convertAlgorithm, convertHash, convertPublicKey } from "./formats.js";
+import { Writer } from "./writer.js";
 
 export async function verify(
   subtle: SubtleCrypto,

package/src/types.ts

@@ -26,10 +26,35 @@ export type SSHExtension = {
     data: Buffer<ArrayBuffer>
 }
 
+/**
+ * The subset of a Cloudflare D1 database binding used by the CA.
+ *
+ * A Workers `D1Database` binding satisfies this structurally, so the package
+ * does not need to depend on `@cloudflare/workers-types`.
+ */
+export interface CaDatabase {
+    prepare(query: string): unknown
+    batch(statements: never[]): Promise<unknown>
+    exec(query: string): Promise<unknown>
+}
+
+/**
+ * The subset of a Cloudflare Secrets Store binding used to load the CA private key.
+ *
+ * A Workers `SecretsStoreSecret` binding satisfies this structurally.
+ */
+export interface CaSecret {
+    get(): Promise<string>
+}
+
+/**
+ * The bindings (environment) the CA expects, see {@link CaDatabase} and
+ * {@link CaSecret} for the non-string bindings.
+ */
 export interface SshCaBindings {
-    DB: D1Database
+    DB: CaDatabase
     DB_CERTIFICATE_RETENTION: string
-    PRIVATE_KEY: SecretsStoreSecret
+    PRIVATE_KEY: CaSecret
     SSH_CERTIFICATE_EXTENSIONS: string
     SSH_CERTIFICATE_LIFETIME: string
     SSH_CERTIFICATE_INCLUDE_SELF?: string | boolean

package/src/utils.ts

@@ -1,15 +1,19 @@
-import type { SshCaBindings } from "./types"
+import type { SshCaBindings } from "./types.js"
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors"
-import { Certificate, Key, KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey, PrivateKey } from "sshpk"
+import sshpk from "sshpk"
+import type { Certificate, Key, PrivateKey } from "sshpk"
 import z from "zod"
-import { verifyJWT } from "./verify"
-import { CertificateRequestJWTPayload } from "./types"
-import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof"
-import type { isRevoked as IsRevokedFn } from "./db"
-import { logger } from "./logger"
+import { verifyJWT } from "./verify.js"
+import { CertificateRequestJWTPayload } from "./types.js"
+import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js"
+import type { isRevoked as IsRevokedFn } from "./db/index.js"
+import { logger } from "./logger.js"
 import { ms } from "itty-time"
 import { InternalServerErrorException } from "chanfana"
 
+// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
+const { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } = sshpk
+
 export const fatalIssue = (ctx: z.RefinementCtx, message: string, val: unknown) => {
 	ctx.issues.push({
 		code: "custom",

package/src/verify.ts

@@ -1,7 +1,7 @@
 import { createRemoteJWKSet, jwtVerify } from "jose"
-import { CertificateRequestJWTPayload } from "./types"
-import type { SshCaBindings } from "./types"
-import { split } from "./utils"
+import { CertificateRequestJWTPayload } from "./types.js"
+import type { SshCaBindings } from "./types.js"
+import { split } from "./utils.js"
 
 type VerifyOptions = {
 	aud?: string | string[]