@andrewheberle/serverless-ssh-ca 0.21.0 → 0.23.0

package/dist/api/v3/schema.js

@@ -1,57 +1,11 @@
 import z from "zod";
-import { split, refineCertificateRequest, transformAuthorizationHeader, transformProofOfPossession, transformPublicKey, transformRenewalProofOfPossession, refineHostCertificateRequest, transformCertificate, refineHostCertificateRenewal, refineRevokeCertificate, transformIdentityToken, } from "../../utils.js";
+import { split, refineCertificateRequest, transformProofOfPossession, transformRenewalProofOfPossession, refineHostCertificateRequest, transformCertificate, refineHostCertificateRenewal, refineRevokeCertificate, } from "../../utils.js";
 import { ConflictException, contentJson, ForbiddenException, InputValidationException, InternalServerErrorException, UnauthorizedException, UnprocessableEntityException, } from "chanfana";
 import { seconds } from "itty-time";
 import { isRevoked } from "../../db/index.js";
-const openapiStringByte = z.base64()
-    .transform((v) => {
-    const a = z.util.base64ToUint8Array(v);
-    return Buffer.from(a.buffer, a.byteOffset, a.length);
-})
-    .openapi({ format: "byte" });
-const proofOfPossession = z.string()
-    .meta({
-    description: "Proof of possession comprising of ${timestamp}.${fingerprint}.${signature}",
-    example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0KVTFOSVUwbEhBQUFBQVFBQUFHZ0FBQUFUWldOa2MyRXRjMmhoTWkxdWFYTjBjREkxTmdBQUFBaHVhWE4wY0RJMQpOZ0FBQUVFRUR6Ymk4OE10alBYSDFCb1JURU9HaS96aEc4QnhQNVZUUW5OQkFNMGZtMExtekErUUZkUlNVYVRFCkdNN2l0QjhINmZNZFAydlAxcElQcGUyOWVLQkJZd0FBQUFSbWFXeGxBQUFBQUFBQUFBWnphR0UxTVRJQUFBQmsKQUFBQUUyVmpaSE5oTFhOb1lUSXRibWx6ZEhBeU5UWUFBQUJKQUFBQUlHdmZVZGNDQkRXa3ZwL0ZHS3NkakgrRQpKZzZXN0EvWUJVZng2Z0srQ01raEFBQUFJUUQxOFd5cDNZejZ0eXNvdllXbEJHTXprRnlYbFRrSHM5blVVRXJqCkczNWVPQT09Ci0tLS0tRU5EIFNTSCBTSUdOQVRVUkUtLS0tLQo="
-});
-const publicKey = openapiStringByte
-    .transform(transformPublicKey)
-    .meta({
-    description: "SSH public key to sign",
-    example: "ZWNkc2Etc2hhMi1uaXN0cDI1NiBBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkdNcFNKdHRmMEl0dE5DVmMyOFR6WEZSMUQweHZPM25wNjdWemVBUXNiZFpza3JEY1lqU2x3SjZIUERtVHBYYVUwbEVhWDlMNFloYy9jQ2YxTWU5RlRrPQo="
-});
-export const createIdentityTokenSchema = (env) => (z.string()
-    .meta({
-    description: "Identity Token JWT from OIDC IdP",
-    example: "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwiZW1haWwiOiJ1c2VyQGV4YW1wbGUuY29tIiwiaWF0IjoxNzc1NzAzMDk1fQ.ri_neAWnhMNK3LzlsrBcQYymSM4yRjmNSZZSeZiXhrEqtEz6c3cXk0Esq765umGjpUsWcosL-OFrDJlyAjTDnhrd9oV08uc_CW0rQRsJIGEuRo3ryxkLdVu9mGoZWEUb9KwjGJrwxvr-0cPWx5jaDyKwJcqMvtV_bEITUD51sDB1Vm89QfYRO_pGJo2vrRzSvMjpUenRpwPay4lYIBxl41_4YpR9Rc6VrIZuYsjV2iqEZ4eBrygMA7zPR_hN7l7s95FddLOzj5NsK57VT4uLHwYohx2oqMzw3M-B9HsZIQin_9q61pZFQXepzJth0woXiZheU27llnfHX967PhNQyg"
-})
-    .transform((val, ctx) => transformIdentityToken(env, val, ctx)));
-export const createAccessTokenSchema = (env) => (z.string()
-    .meta({
-    description: "Access Token JWT from OIDC IdP",
-    example: "Bearer eyJ..."
-})
-    .transform((val, ctx) => transformAuthorizationHeader(env, val, ctx)));
-const krl = openapiStringByte
-    .meta({ description: "Key Revocation List" });
-export const createHeaderSchema = (env) => (z.object({
-    "Authorization": createAccessTokenSchema(env)
-}));
-const certificate = openapiStringByte
-    .meta({ description: "Issued Certificate" });
-export const CaPublicKeyEndpointSchema = {
-    responses: {
-        "200": {
-            content: {
-                "text/plain": {
-                    schema: z.string()
-                }
-            },
-            description: "Returns SSH Certificate Authority Public Key",
-        },
-        ...InternalServerErrorException.schema(),
-    }
-};
+import { CertificateType } from "../../db/types.js";
+import { certificate, certificateTypeName, certificateTypeTag, createHeaderSchema, createIdentityTokenSchema, openapiStringByte, proofOfPossession, publicKey, } from "../schema.js";
+export { CaPublicKeyEndpointSchema, certificateTypeName, createAccessTokenSchema, createHeaderSchema, createIdentityTokenSchema, createRevocationListEndpointSchema, } from "../schema.js";
 export const userCertificateRequestEndpointBodySchema = (env) => (z.object({
     public_key: publicKey,
     proof: proofOfPossession
@@ -69,6 +23,9 @@ export const userCertificateRequestEndpointBodySchema = (env) => (z.object({
     .superRefine((val, ctx) => refineCertificateRequest(env, val, ctx))
     .openapi("User Certificate Request"));
 export const createUserCertificateRequestEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.User)],
+    summary: "Request a user certificate",
+    description: "Issues a signed SSH user certificate for the provided public key. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key. Principals on the issued certificate are derived from the identity token.",
     security: [{ oidcAuth: [] }],
     request: {
         headers: createHeaderSchema(env),
@@ -89,24 +46,6 @@ export const createUserCertificateRequestEndpointSchema = (env) => ({
         ...InternalServerErrorException.schema(),
     }
 });
-export const createRevocationListEndpointSchema = () => ({
-    request: {
-        params: z.object({
-            certificateType: z.enum(["user", "host"])
-        }),
-    },
-    responses: {
-        "200": {
-            description: "Returns an Open SSH Key Revocation List as BASE64 and an SSHSIG signature for verification",
-            ...contentJson(z.object({
-                krl: krl,
-                signature: z.string()
-            })
-                .openapi("Key Revocation List Response"))
-        },
-        ...InternalServerErrorException.schema(),
-    }
-});
 export const hostCertificateRequestEndpointBodySchema = (env) => (z.object({
     public_key: publicKey,
     proof: proofOfPossession
@@ -123,6 +62,9 @@ export const hostCertificateRequestEndpointBodySchema = (env) => (z.object({
     .superRefine((val, ctx) => refineHostCertificateRequest(env, val, ctx))
     .openapi("Host Certificate Request"));
 export const createHostCertificateRequestEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    summary: "Request a host certificate",
+    description: "Issues a signed SSH host certificate for the provided public key and principals. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key. The user must be permitted to request host certificates by email address or role.",
     security: [{ oidcAuth: [] }],
     request: {
         headers: createHeaderSchema(env),
@@ -159,6 +101,9 @@ export const hostCertificateRenewEndpointBodySchema = (env) => (z.object({
     .superRefine((val, ctx) => refineHostCertificateRenewal(env, isRevoked, val, ctx))
     .openapi("Host Certificate Renew"));
 export const createHostCertificateRenewEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    summary: "Renew a host certificate",
+    description: "Issues a new SSH host certificate with the same principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the public key must match the existing certificate and the proof of possession must be made with its private key. The lifetime of the renewed certificate is no longer than that of the existing certificate.",
     request: {
         body: contentJson(hostCertificateRenewEndpointBodySchema(env))
     },
@@ -191,16 +136,16 @@ export const revokeCertificateEndpointBodySchema = (env) => (z.object({
 })
     .openapi("Certificate Revocation")
     .superRefine((val, ctx) => refineRevokeCertificate(env, val, ctx)));
-export const createRevokeCertificateEndpointSchema = (env) => ({
+export const createRevokeCertificateEndpointSchema = (env, certificateType) => ({
+    tags: [certificateTypeTag(certificateType)],
+    summary: `Revoke a ${certificateTypeName(certificateType)} certificate`,
+    description: `Revokes a ${certificateTypeName(certificateType)} certificate issued by this CA, identified by its serial number, and adds it to the ${certificateTypeName(certificateType)} Key Revocation List. The request must include a proof of possession of the private key for the public key that the certificate was issued for.`,
     request: {
-        params: z.object({
-            certificateType: z.enum(["user", "host"])
-        }),
         body: contentJson(revokeCertificateEndpointBodySchema(env))
     },
     responses: {
         "200": {
-            description: "SSH certificate revoked successfully",
+            description: `SSH ${certificateTypeName(certificateType)} certificate revoked successfully`,
             ...contentJson(z.object({
                 revoked_at: z.iso.datetime(),
             })

package/dist/api/v3/schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/v3/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EACN,KAAK,EACL,wBAAwB,EACxB,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,iCAAiC,EACjC,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,GAC5B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAE7C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE;KAClC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE;IAChB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA;IACtC,OAAO,MAAM,CAAC,IAAI,CACjB,CAAC,CAAC,MAAM,EACR,CAAC,CAAC,UAAU,EACZ,CAAC,CAAC,MAAM,CACR,CAAA;AACF,CAAC,CAAC;KACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;AAE7B,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE;KAClC,IAAI,CAAC;IACL,WAAW,EAAE,4EAA4E;IACzF,OAAO,EAAE,+kBAA+kB;CACxlB,CAAC,CAAA;AAEH,MAAM,SAAS,GAAG,iBAAiB;KACjC,SAAS,CAAC,kBAAkB,CAAC;KAC7B,IAAI,CAAC;IACL,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,0NAA0N;CACnO,CAAC,CAAA;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAChE,CAAC,CAAC,MAAM,EAAE;KACR,IAAI,CAAC;IACL,WAAW,EAAE,kCAAkC;IAC/C,OAAO,EAAE,odAAod;CAC7d,CAAC;KACD,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAChE,CAAA;AAED,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC9D,CAAC,CAAC,MAAM,EAAE;KACR,IAAI,CAAC;IACL,WAAW,EAAE,gCAAgC;IAC7C,OAAO,EAAE,eAAe;CACxB,CAAC;KACD,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACtE,CAAA;AAED,MAAM,GAAG,GAAG,iBAAiB;KAC3B,IAAI,CAAC,EAAE,WAAW,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAE9C,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CACzD,CAAC,CAAC,MAAM,CAAC;IACR,eAAe,EAAE,uBAAuB,CAAC,GAAG,CAAC;CAC7C,CAAC,CACF,CAAA;AAED,MAAM,WAAW,GAAG,iBAAiB;KACnC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAA;AAE7C,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACxC,SAAS,EAAE;QACV,KAAK,EAAE;YACN,OAAO,EAAE;gBACR,YAAY,EAAE;oBACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;iBAClB;aACD;YACD,WAAW,EAAE,8CAA8C;SAC3D;QACD,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC/E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;CAC7D,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KAClE,OAAO,CAAC,0BAA0B,CAAC,CACrC,CAAA;AAED,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAClF,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAAC;KAChE;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,CAAC;KACF;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,4FAA4F;YACzG,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,GAAG,EAAE,GAAG;gBACR,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;aACrB,CAAC;iBACA,OAAO,CAAC,8BAA8B,CAAC,CACxC;SACD;QACD,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC/E,CAAC,CAAC,MAAM,CAAC;IACN,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;CAClE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KACtE,OAAO,CAAC,0BAA0B,CAAC,CACvC,CAAA;AAED,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAClF,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAAC;KAChE;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACP,WAAW,EAAE,iBAAiB;SAC5B,SAAS,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACnD,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iCAAiC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CACnE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KACjF,OAAO,CAAC,wBAAwB,CAAC,CACpC,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,OAAO,EAAE;QACR,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,2CAA2C;YACxD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC1E,CAAC,CAAC,MAAM,CAAC;IACP,6DAA6D;IAC7D,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,MAAM,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;SACrG,IAAI,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClG,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CACpE,CAAC;KACA,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACpE,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAC7E,OAAO,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;YAChB,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,CAAC;QACF,IAAI,EAAE,WAAW,CAAC,mCAAmC,CAAC,GAAG,CAAC,CAAC;KAC3D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,sCAAsC;YACnD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;aAC5B,CAAC;iBACA,OAAO,CAAC,qBAAqB,CAAC,CAC/B;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,iBAAiB,CAAC,MAAM,EAAE;KAC7B;CACD,CAAC,CAAA"}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/v3/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EACN,KAAK,EACL,wBAAwB,EACxB,0BAA0B,EAC1B,iCAAiC,EACjC,4BAA4B,EAC5B,oBAAoB,EACpB,4BAA4B,EAC5B,uBAAuB,GACvB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,iBAAiB,EACjB,WAAW,EACX,kBAAkB,EAClB,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,4BAA4B,GAC5B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,iBAAiB,EACjB,iBAAiB,EACjB,SAAS,GACT,MAAM,cAAc,CAAA;AAErB,OAAO,EACN,yBAAyB,EACzB,mBAAmB,EACnB,uBAAuB,EACvB,kBAAkB,EAClB,yBAAyB,EACzB,kCAAkC,GAClC,MAAM,cAAc,CAAA;AAErB,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC/E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;CAC7D,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KAClE,OAAO,CAAC,0BAA0B,CAAC,CACrC,CAAA;AAED,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,+TAA+T;IAC5U,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAAC;KAChE;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC/E,CAAC,CAAC,MAAM,CAAC;IACN,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;CAClE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KACtE,OAAO,CAAC,0BAA0B,CAAC,CACvC,CAAA;AAED,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAClF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,sVAAsV;IACnW,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,kBAAkB,CAAC,GAAG,CAAC;QAChC,IAAI,EAAE,WAAW,CAAC,wCAAwC,CAAC,GAAG,CAAC,CAAC;KAChE;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACP,WAAW,EAAE,iBAAiB;SAC5B,SAAS,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IACnD,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,iCAAiC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC3E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CACnE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,4BAA4B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KACjF,OAAO,CAAC,wBAAwB,CAAC,CACpC,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,EAAE,0BAA0B;IACnC,WAAW,EAAE,kYAAkY;IAC/Y,OAAO,EAAE;QACR,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,2CAA2C;YACxD,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,WAAW,EAAE,WAAW;aACxB,CAAC;iBACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mCAAmC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC1E,CAAC,CAAC,MAAM,CAAC;IACP,6DAA6D;IAC7D,oCAAoC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,MAAM,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;SACrG,IAAI,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClG,UAAU,EAAE,SAAS;IACrB,KAAK,EAAE,iBAAiB;SACtB,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;CACpE,CAAC;KACA,OAAO,CAAC,wBAAwB,CAAC;KACjC,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACpE,CAAA;AAED,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,GAAkB,EAAE,eAAgC,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC3C,OAAO,EAAE,YAAY,mBAAmB,CAAC,eAAe,CAAC,cAAc;IACvE,WAAW,EAAE,aAAa,mBAAmB,CAAC,eAAe,CAAC,uFAAuF,mBAAmB,CAAC,eAAe,CAAC,iJAAiJ;IAC1U,OAAO,EAAE;QACR,IAAI,EAAE,WAAW,CAAC,mCAAmC,CAAC,GAAG,CAAC,CAAC;KAC3D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,OAAO,mBAAmB,CAAC,eAAe,CAAC,mCAAmC;YAC3F,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;aAC5B,CAAC;iBACA,OAAO,CAAC,qBAAqB,CAAC,CAC/B;SACD;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,iBAAiB,CAAC,MAAM,EAAE;KAC7B;CACD,CAAC,CAAA"}

package/dist/api/v4/index.d.ts

@@ -0,0 +1,8 @@
+import type { SshCaBindings } from "../../types.js";
+/**
+ * The path the v4 API is served under, which is part of the request a proof
+ * of possession is made for
+ */
+export declare const BasePath = "/api/v4";
+export declare const createApi: (env: SshCaBindings) => import("chanfana").HonoOpenAPIRouterType<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=index.d.ts.map

package/dist/api/v4/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/api/v4/index.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAEnD;;;GAGG;AACH,eAAO,MAAM,QAAQ,YAAY,CAAA;AAqNjC,eAAO,MAAM,SAAS,QAAS,aAAa,mHAa3C,CAAA"}

package/dist/api/v4/index.js

@@ -0,0 +1,155 @@
+import { group } from "@andrewheberle/ts-slog";
+import { ForbiddenException, fromHono, InputValidationException, OpenAPIRoute, UnauthorizedException, } from "chanfana";
+import { Hono } from "hono";
+import { createSignedCertificate, createSignedHostCertificate, } from "../../certificate.js";
+import { split } from "../../utils.js";
+import { CertificateType } from "../../db/types.js";
+import { caPublicKey, issueCertificate, revocationList, revoke } from "../operations.js";
+import { certificateTypeName } from "../schema.js";
+import { createCaPublicKeyEndpointSchema, createGetRevocationListEndpointSchema, createIssueHostCertificateEndpointSchema, createIssueUserCertificateEndpointSchema, createRenewHostCertificateEndpointSchema, createRevokeCertificateEndpointSchema, ProofHeader, } from "./schema.js";
+import { logger } from "../../logger.js";
+/**
+ * The path the v4 API is served under, which is part of the request a proof
+ * of possession is made for
+ */
+export const BasePath = "/api/v4";
+/**
+ * Ensures a proof of possession was made with the private key for a public key
+ * and for this request, so it cannot be replayed against another endpoint or
+ * for another certificate.
+ *
+ * @param l The logger for the request
+ * @param proof The proof of possession from the request
+ * @param key The public key the proof must be made with
+ * @param method The HTTP method of the request
+ * @param path The path of the request below {@link BasePath}, with any parameters filled in
+ * @throws {@link InputValidationException} when the proof is not valid for the key and request
+ */
+const verifyProof = async (l, proof, key, method, path) => {
+    if (!proof.matches(key)) {
+        l.warn("proof of possession fingerprint did not match public key");
+        throw new InputValidationException("proof of possession fingerprint did not match public key", ["headers", ProofHeader]);
+    }
+    if (!await proof.verifyRequest(method, `${BasePath}${path}`)) {
+        l.warn("proof of possession signature validation failed");
+        throw new InputValidationException("proof of possession signature validation failed", ["headers", ProofHeader]);
+    }
+};
+const CaPublicKeyEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createCaPublicKeyEndpointSchema();
+        async handle(c) {
+            const l = logger(env).with(...group("request", "action", "ca"));
+            return await caPublicKey(c, l);
+        }
+    };
+};
+const IssueUserCertificateEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createIssueUserCertificateEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", "user", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+            await verifyProof(l, data.headers[ProofHeader], data.body.public_key, "POST", "/user/certificates");
+            if (data.body.identity.sub !== data.headers.Authorization.sub) {
+                l.error("token subjects did not match");
+                throw new ForbiddenException("Possible token substitution as subjects for authentication and identity tokens did not match");
+            }
+            const opts = {
+                lifetime: data.body.lifetime,
+                principals: data.body.identity.principals,
+                extensions: data.body.extensions,
+            };
+            return await issueCertificate(c, l, () => createSignedCertificate(c.env, data.headers.Authorization.email, data.body.public_key, opts), CertificateType.User);
+        }
+    };
+};
+const RevocationListEndpoint = (env, certificateType) => {
+    return class extends OpenAPIRoute {
+        schema = createGetRevocationListEndpointSchema(certificateType);
+        async handle(c) {
+            const l = logger(env).with(...group("request", "type", certificateTypeName(certificateType), "action", "krl"));
+            return await revocationList(c, l, certificateType);
+        }
+    };
+};
+const IssueHostCertificateEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createIssueHostCertificateEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const l = logger(env).with(...group("request", "type", "host", "action", "request"), ...group("auth_token", "email", data.headers.Authorization.email, "sub", data.headers.Authorization.sub), ...group("id_token", "sub", data.body.identity.sub));
+            await verifyProof(l, data.headers[ProofHeader], data.body.public_key, "POST", "/host/certificates");
+            // check id and access token are for the same user
+            if (data.body.identity.sub !== data.headers.Authorization.sub) {
+                l.error("token subjects did not match");
+                throw new ForbiddenException("possible token substitution as subjects for authentication and identity tokens did not match");
+            }
+            // check user can issue host certificates
+            if (!split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_EMAILS).includes(data.headers.Authorization.email) && !data.body.identity.principals.some((p) => split(c.env.SSH_HOST_CERTIFICATE_ALLOWED_ROLES).includes(p))) {
+                l.error("unauthorized host certificate request");
+                throw new UnauthorizedException("User not allowed to issue host certificates");
+            }
+            const opts = {
+                lifetime: data.body.lifetime,
+                principals: data.body.principals,
+            };
+            return await issueCertificate(c, l, () => createSignedHostCertificate(c.env, data.body.public_key, opts), CertificateType.Host);
+        }
+    };
+};
+const RenewHostCertificateEndpoint = (env) => {
+    return class extends OpenAPIRoute {
+        schema = createRenewHostCertificateEndpointSchema(env);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const serial = data.params.serial;
+            const l = logger(env).with(...group("request", "type", "host", "action", "renewal", "serial", serial));
+            // the serial in the path is what the proof was made for, so it
+            // must be the certificate being renewed
+            if (data.body.certificate.serial !== serial) {
+                l.warn("certificate serial did not match the serial in the path");
+                throw new InputValidationException("certificate serial did not match the serial in the path", ["body", "certificate"]);
+            }
+            await verifyProof(l, data.headers[ProofHeader], data.body.certificate.publicKey, "POST", `/host/certificates/${serial}/renew`);
+            // use smaller of the current certificate lifetime and the requested lifetime
+            const originalLifetime = (data.body.certificate.validBefore.getTime() - data.body.certificate.validAfter.getTime()) / 1000;
+            const lifetime = originalLifetime > data.body.lifetime
+                ? data.body.lifetime
+                : originalLifetime;
+            const opts = {
+                lifetime: lifetime,
+                principals: data.body.certificate.principals,
+            };
+            return await issueCertificate(c, l, () => createSignedHostCertificate(c.env, data.body.certificate.publicKey, opts), CertificateType.Host);
+        }
+    };
+};
+const RevokeCertificateEndpoint = (env, certificateType) => {
+    return class extends OpenAPIRoute {
+        schema = createRevokeCertificateEndpointSchema(env, certificateType);
+        async handle(c) {
+            const data = await this.getValidatedData();
+            const serial = data.params.serial;
+            const proof = data.headers[ProofHeader];
+            const l = logger(env).with(...group("request", "type", certificateTypeName(certificateType), "action", "revoke", "serial", serial));
+            // the key the proof was made with is the key the certificate must
+            // have been issued for
+            await verifyProof(l, proof, proof.signaturePubkey, "DELETE", `/${certificateTypeName(certificateType)}/certificates/${serial}`);
+            return await revoke(c, l, serial, proof.signaturePubkey, certificateType);
+        }
+    };
+};
+export const createApi = (env) => {
+    const api = fromHono(new Hono());
+    api.get("/ca", CaPublicKeyEndpoint(env));
+    api.post("/user/certificates", IssueUserCertificateEndpoint(env));
+    api.delete("/user/certificates/:serial", RevokeCertificateEndpoint(env, CertificateType.User));
+    api.get("/user/krl", RevocationListEndpoint(env, CertificateType.User));
+    api.post("/host/certificates", IssueHostCertificateEndpoint(env));
+    api.post("/host/certificates/:serial/renew", RenewHostCertificateEndpoint(env));
+    api.delete("/host/certificates/:serial", RevokeCertificateEndpoint(env, CertificateType.Host));
+    api.get("/host/krl", RevocationListEndpoint(env, CertificateType.Host));
+    return api;
+};
+//# sourceMappingURL=index.js.map

package/dist/api/v4/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/api/v4/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAU,MAAM,wBAAwB,CAAA;AACtD,OAAO,EACN,kBAAkB,EAClB,QAAQ,EACR,wBAAwB,EACxB,YAAY,EACZ,qBAAqB,GACrB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAG3B,OAAO,EAGN,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAA;AACxF,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EACN,+BAA+B,EAC/B,qCAAqC,EACrC,wCAAwC,EACxC,wCAAwC,EACxC,wCAAwC,EACxC,qCAAqC,EACrC,WAAW,GACX,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AAGxC;;;GAGG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAA;AAEjC;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG,KAAK,EAAE,CAAS,EAAE,KAAwB,EAAE,GAAc,EAAE,MAAc,EAAE,IAAY,EAAiB,EAAE;IAC9H,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,CAAC,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAA;QAClE,MAAM,IAAI,wBAAwB,CAAC,0DAA0D,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;IACzH,CAAC;IAED,IAAI,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,QAAQ,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,CAAC,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAA;QACzD,MAAM,IAAI,wBAAwB,CAAC,iDAAiD,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAA;IAChH,CAAC;AACF,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,GAAkB,EAAE,EAAE;IAClD,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,+BAA+B,EAAE,CAAA;QAE1C,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,CACnC,CAAA;YAED,OAAO,MAAM,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC/B,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,4BAA4B,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC3D,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,wCAAwC,CAAC,GAAG,CAAC,CAAA;QAEtD,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAsB,CAAA;YAE9D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,CACnB,EACD,GAAG,KAAK,CAAC,YAAY,EACpB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CACrC,EACD,GAAG,KAAK,CAAC,UAAU,EAClB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAC7B,CACD,CAAA;YAED,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAA;YAEnG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;gBAC/D,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBACvC,MAAM,IAAI,kBAAkB,CAAC,8FAA8F,CAAC,CAAA;YAC7H,CAAC;YAED,MAAM,IAAI,GAA6B;gBACtC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU;gBACzC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;aAChC,CAAA;YAED,OAAO,MAAM,gBAAgB,CAAC,CAAC,EAAE,CAAC,EACjC,GAAG,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAClG,eAAe,CAAC,IAAI,CACpB,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,sBAAsB,GAAG,CAAC,GAAkB,EAAE,eAAgC,EAAE,EAAE;IACvF,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,qCAAqC,CAAC,eAAe,CAAC,CAAA;QAE/D,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EACjB,MAAM,EAAE,mBAAmB,CAAC,eAAe,CAAC,EAC5C,QAAQ,EAAE,KAAK,CACf,CACD,CAAA;YAED,OAAO,MAAM,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,eAAe,CAAC,CAAA;QACnD,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,4BAA4B,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC3D,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,wCAAwC,CAAC,GAAG,CAAC,CAAA;QAEtD,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAsB,CAAA;YAE9D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,CACnB,EACD,GAAG,KAAK,CAAC,YAAY,EACpB,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,EACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CACrC,EACD,GAAG,KAAK,CAAC,UAAU,EAClB,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAC7B,CACD,CAAA;YAED,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAA;YAEnG,kDAAkD;YAClD,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC;gBAC/D,CAAC,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;gBACvC,MAAM,IAAI,kBAAkB,CAAC,8FAA8F,CAAC,CAAA;YAC7H,CAAC;YAED,yCAAyC;YACzC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrN,CAAC,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAA;gBAChD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAA;YAC/E,CAAC;YAED,MAAM,IAAI,GAAiC;gBAC1C,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ;gBAC5B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU;aAChC,CAAA;YAED,OAAO,MAAM,gBAAgB,CAAC,CAAC,EAAE,CAAC,EACjC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EACpE,eAAe,CAAC,IAAI,CACpB,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,4BAA4B,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC3D,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,wCAAwC,CAAC,GAAG,CAAC,CAAA;QAEtD,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAsB,CAAA;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;YAEjC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,MAAM,CAChB,CACD,CAAA;YAED,+DAA+D;YAC/D,wCAAwC;YACxC,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7C,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAA;gBACjE,MAAM,IAAI,wBAAwB,CAAC,yDAAyD,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;YACvH,CAAC;YAED,MAAM,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,sBAAsB,MAAM,QAAQ,CAAC,CAAA;YAE9H,6EAA6E;YAC7E,MAAM,gBAAgB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAA;YAC1H,MAAM,QAAQ,GAAG,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACrD,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ;gBACpB,CAAC,CAAC,gBAAgB,CAAA;YAEnB,MAAM,IAAI,GAAiC;gBAC1C,QAAQ,EAAE,QAAQ;gBAClB,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU;aAC5C,CAAA;YAED,OAAO,MAAM,gBAAgB,CAAC,CAAC,EAAE,CAAC,EACjC,GAAG,EAAE,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAC/E,eAAe,CAAC,IAAI,CACpB,CAAA;QACF,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,yBAAyB,GAAG,CAAC,GAAkB,EAAE,eAAgC,EAAE,EAAE;IAC1F,OAAO,KAAM,SAAQ,YAAY;QACvB,MAAM,GAAG,qCAAqC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;QAEpE,KAAK,CAAC,MAAM,CAAC,CAAa;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAsB,CAAA;YAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAA;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YAEvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACzB,GAAG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CACvG,CAAA;YAED,kEAAkE;YAClE,uBAAuB;YACvB,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,mBAAmB,CAAC,eAAe,CAAC,iBAAiB,MAAM,EAAE,CAAC,CAAA;YAE/H,OAAO,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,eAAe,EAAE,eAAe,CAAC,CAAA;QAC1E,CAAC;KACD,CAAA;AACF,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;IAEhC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAA;IACxC,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,GAAG,CAAC,MAAM,CAAC,4BAA4B,EAAE,yBAAyB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9F,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IACvE,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAA;IACjE,GAAG,CAAC,IAAI,CAAC,kCAAkC,EAAE,4BAA4B,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,GAAG,CAAC,MAAM,CAAC,4BAA4B,EAAE,yBAAyB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IAC9F,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,sBAAsB,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAA;IAEvE,OAAO,GAAG,CAAA;AACX,CAAC,CAAA"}

package/dist/api/v4/schema.d.ts

@@ -0,0 +1,268 @@
+import z from "zod";
+import type { SshCaBindings } from "../../types.js";
+import { CertificateType } from "../../db/types.js";
+/**
+ * The name of the header carrying the proof of possession of the private key
+ */
+export declare const ProofHeader = "Proof-Of-Possession";
+export declare const createProofSchema: (env: SshCaBindings) => z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+/**
+ * Headers for a request authorised by a proof of possession alone
+ */
+export declare const createProofHeaderSchema: (env: SshCaBindings) => z.ZodObject<{
+    "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+}, z.core.$strip>;
+/**
+ * Headers for a request authenticated with an access token and authorised by
+ * a proof of possession
+ */
+export declare const createAuthenticatedHeaderSchema: (env: SshCaBindings) => z.ZodObject<{
+    Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        email: string;
+        sub: string;
+    }, string>>;
+    "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+}, z.core.$strip>;
+export declare const serialParamSchema: z.ZodObject<{
+    serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+}, z.core.$strip>;
+export declare const createCaPublicKeyEndpointSchema: () => {
+    tags: string[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "text/plain": {
+                    schema: z.ZodString;
+                };
+            };
+            description: string;
+        };
+    };
+    operationId: string;
+};
+export declare const createGetRevocationListEndpointSchema: (certificateType: CertificateType) => {
+    tags: ("Host" | "User")[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+    operationId: string;
+};
+export declare const issueUserCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    public_key: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+    identity: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        sub: string;
+        principals: string[];
+    }, string>>;
+    extensions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createIssueUserCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const issueHostCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    public_key: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+    identity: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        sub: string;
+        principals: string[];
+    }, string>>;
+    principals: z.ZodArray<z.ZodString>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createIssueHostCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const renewHostCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    certificate: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/certificate.js").SshCertificate, Buffer<ArrayBuffer>>>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createRenewHostCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    request: {
+        params: z.ZodObject<{
+            serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+        }, z.core.$strip>;
+        headers: z.ZodObject<{
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: import("../../ssh/certificate.js").SshCertificate;
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: import("../../ssh/certificate.js").SshCertificate;
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createRevokeCertificateEndpointSchema: (env: SshCaBindings, certificateType: CertificateType) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    request: {
+        params: z.ZodObject<{
+            serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+        }, z.core.$strip>;
+        headers: z.ZodObject<{
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        revoked_at: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        revoked_at: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/api/v4/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/api/v4/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAmBnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAanD;;GAEG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAA;AAEhD,eAAO,MAAM,iBAAiB,QAAS,aAAa,+FAOnD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAS,aAAa;;iBAIzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,+BAA+B,QAAS,aAAa;;;;;;iBAKjE,CAAA;AAED,eAAO,MAAM,iBAAiB;;iBAS5B,CAAA;AAUF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;CAG1C,CAAA;AAEF,eAAO,MAAM,qCAAqC,oBAAqB,eAAe;;;;;;;;;;;;;;;;;;;;;CAGpF,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;;;;;;iBAcxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;;;;QAOzE,OAAO;;;;;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaJ,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;;;;;;iBAaxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;;;;QAOzE,OAAO;;;;;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaJ,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;iBAaxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;QAMzE,MAAM;;;QACN,OAAO;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAaJ,CAAA;AAEF,eAAO,MAAM,qCAAqC,QAAS,aAAa,mBAAmB,eAAe;;;;;;QAMxG,MAAM;;;QACN,OAAO;;;;;;;;;;;;;;;;;;CAgBP,CAAA"}