@andrewheberle/serverless-ssh-ca 0.22.0 → 0.23.0

package/dist/api/v4/schema.js

@@ -0,0 +1,182 @@
+import z from "zod";
+import { refineRenewableCertificate, split, transformCertificate, transformProofOfPossession, } from "../../utils.js";
+import { ConflictException, contentJson, InputValidationException, InternalServerErrorException, NotFoundException, UnauthorizedException, ForbiddenException, UnprocessableEntityException, } from "chanfana";
+import { seconds } from "itty-time";
+import { isRevoked } from "../../db/index.js";
+import { CertificateType } from "../../db/types.js";
+import { CaPublicKeyEndpointSchema, certificate, certificateTypeName, certificateTypeTag, createAccessTokenSchema, createIdentityTokenSchema, createRevocationListEndpointSchema, openapiStringByte, publicKey, } from "../schema.js";
+/**
+ * The name of the header carrying the proof of possession of the private key
+ */
+export const ProofHeader = "Proof-Of-Possession";
+export const createProofSchema = (env) => (z.string()
+    .meta({
+    description: "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
+    example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K...",
+})
+    .transform((val, ctx) => transformProofOfPossession(env, val, ctx)));
+/**
+ * Headers for a request authorised by a proof of possession alone
+ */
+export const createProofHeaderSchema = (env) => (z.object({
+    [ProofHeader]: createProofSchema(env),
+}));
+/**
+ * Headers for a request authenticated with an access token and authorised by
+ * a proof of possession
+ */
+export const createAuthenticatedHeaderSchema = (env) => (z.object({
+    "Authorization": createAccessTokenSchema(env),
+    [ProofHeader]: createProofSchema(env),
+}));
+export const serialParamSchema = z.object({
+    // a string as JSON cannot carry a bigint and numbers lose precision
+    // above 2^53, and without leading zeros so the path a proof is made for
+    // has only one form
+    serial: z.string()
+        .regex(/^(0|[1-9]\d*)$/)
+        .transform(BigInt)
+        .refine((v) => v <= 0xffffffffffffffffn, { message: "serial must fit in an unsigned 64-bit integer" })
+        .meta({ description: "Serial number of the certificate", example: "12345678901234567890" }),
+});
+const certificateResponse = {
+    ...contentJson(z.object({
+        certificate: certificate,
+    })
+        .openapi("Certificate Response"))
+};
+export const createCaPublicKeyEndpointSchema = () => ({
+    ...CaPublicKeyEndpointSchema,
+    operationId: "get_ca_public_key",
+});
+export const createGetRevocationListEndpointSchema = (certificateType) => ({
+    ...createRevocationListEndpointSchema(certificateType),
+    operationId: `get_${certificateTypeName(certificateType)}_revocation_list`,
+});
+export const issueUserCertificateEndpointBodySchema = (env) => (z.object({
+    public_key: publicKey,
+    identity: createIdentityTokenSchema(env),
+    extensions: z.array(z.string())
+        .default(split(env.SSH_CERTIFICATE_EXTENSIONS))
+        .meta({ description: "Extensions to include in the issued SSH certificate" }),
+    lifetime: z.int()
+        .min(seconds("5 minutes"))
+        .max(seconds(env.SSH_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of issued SSH certificate" }),
+})
+    .openapi("User Certificate Issue Request"));
+export const createIssueUserCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.User)],
+    operationId: "issue_user_certificate",
+    summary: "Request a user certificate",
+    description: `Issues a signed SSH user certificate for the provided public key. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for \`public_key\` in the \`${ProofHeader}\` header made for this request. Principals on the issued certificate are derived from the identity token.`,
+    security: [{ oidcAuth: [] }],
+    request: {
+        headers: createAuthenticatedHeaderSchema(env),
+        body: contentJson(issueUserCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH User Certificate issued successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+    }
+});
+export const issueHostCertificateEndpointBodySchema = (env) => (z.object({
+    public_key: publicKey,
+    identity: createIdentityTokenSchema(env),
+    principals: z.array(z.string()).min(1)
+        .meta({ description: "List of principals to include on the issued certificate" }),
+    lifetime: z.int()
+        .min(seconds("24 hours"))
+        .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of issued Host SSH certificate" }),
+})
+    .openapi("Host Certificate Issue Request"));
+export const createIssueHostCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    operationId: "issue_host_certificate",
+    summary: "Request a host certificate",
+    description: `Issues a signed SSH host certificate for the provided public key and principals. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for \`public_key\` in the \`${ProofHeader}\` header made for this request. The user must be permitted to request host certificates by email address or role.`,
+    security: [{ oidcAuth: [] }],
+    request: {
+        headers: createAuthenticatedHeaderSchema(env),
+        body: contentJson(issueHostCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH Host Certificate issued successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+    }
+});
+export const renewHostCertificateEndpointBodySchema = (env) => (z.object({
+    certificate: openapiStringByte
+        .transform(transformCertificate)
+        .meta({ description: "SSH certificate to renew, which must have the serial number in the path" }),
+    lifetime: z.int()
+        .min(seconds("24 hours"))
+        .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of renewed Host SSH certificate" }),
+})
+    .superRefine((val, ctx) => refineRenewableCertificate(env, isRevoked, val, ctx))
+    .openapi("Host Certificate Renewal Request"));
+export const createRenewHostCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    operationId: "renew_host_certificate",
+    summary: "Renew a host certificate",
+    description: `Issues a new SSH host certificate for the same public key and principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the \`${ProofHeader}\` header must contain a proof of possession of the private key for the existing certificate made for this request. The lifetime of the renewed certificate is no longer than that of the existing certificate.`,
+    request: {
+        params: serialParamSchema,
+        headers: createProofHeaderSchema(env),
+        body: contentJson(renewHostCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH Host Certificate renewed successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+    }
+});
+export const createRevokeCertificateEndpointSchema = (env, certificateType) => ({
+    tags: [certificateTypeTag(certificateType)],
+    operationId: `revoke_${certificateTypeName(certificateType)}_certificate`,
+    summary: `Revoke a ${certificateTypeName(certificateType)} certificate`,
+    description: `Revokes a ${certificateTypeName(certificateType)} certificate issued by this CA and adds it to the ${certificateTypeName(certificateType)} Key Revocation List. The \`${ProofHeader}\` header must contain a proof of possession of the private key for the public key that the certificate was issued for, made for this request. A certificate issued for a different public key is reported as not found.`,
+    request: {
+        params: serialParamSchema,
+        headers: createProofHeaderSchema(env),
+    },
+    responses: {
+        "200": {
+            description: `SSH ${certificateTypeName(certificateType)} certificate revoked successfully`,
+            ...contentJson(z.object({
+                revoked_at: z.iso.datetime(),
+            })
+                .openapi("Revocation Response")),
+        },
+        ...InputValidationException.schema(),
+        ...NotFoundException.schema(),
+        ...ConflictException.schema(),
+        ...InternalServerErrorException.schema(),
+    }
+});
+//# sourceMappingURL=schema.js.map

package/dist/api/v4/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/v4/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EACN,0BAA0B,EAC1B,KAAK,EACL,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC5B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACN,yBAAyB,EACzB,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,iBAAiB,EACjB,SAAS,GACT,MAAM,cAAc,CAAA;AAErB;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAEhD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CACxD,CAAC,CAAC,MAAM,EAAE;KACR,IAAI,CAAC;IACL,WAAW,EAAE,0eAA0e;IACvf,OAAO,EAAE,8GAA8G;CACvH,CAAC;KACD,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACpE,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC9D,CAAC,CAAC,MAAM,CAAC;IACR,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;CACrC,CAAC,CACF,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CACtE,CAAC,CAAC,MAAM,CAAC;IACR,eAAe,EAAE,uBAAuB,CAAC,GAAG,CAAC;IAC7C,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;CACrC,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oEAAoE;IACpE,wEAAwE;IACxE,oBAAoB;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,KAAK,CAAC,gBAAgB,CAAC;SACvB,SAAS,CAAC,MAAM,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;SACrG,IAAI,CAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;CAC5F,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG;IAC3B,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,WAAW,EAAE,WAAW;KACxB,CAAC;SACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;CACD,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,EAAE,CAAC,CAAC;IACrD,GAAG,yBAAyB;IAC5B,WAAW,EAAE,mBAAmB;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,eAAgC,EAAE,EAAE,CAAC,CAAC;IAC3F,GAAG,kCAAkC,CAAC,eAAe,CAAC;IACtD,WAAW,EAAE,OAAO,mBAAmB,CAAC,eAAe,CAAC,kBAAkB;CAC1E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;CAC7D,CAAC;KACA,OAAO,CAAC,gCAAgC,CAAC,CAC3C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,kRAAkR,WAAW,4GAA4G;IACtZ,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,+BAA+B,CAAC,GAAG,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,SAAS;IACrB,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACpC,IAAI,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;CAClE,CAAC;KACA,OAAO,CAAC,gCAAgC,CAAC,CAC3C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,iSAAiS,WAAW,oHAAoH;IAC7a,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,+BAA+B,CAAC,GAAG,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,WAAW,EAAE,iBAAiB;SAC5B,SAAS,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IAClG,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CACnE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KAC/E,OAAO,CAAC,kCAAkC,CAAC,CAC7C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,0BAA0B;IACnC,WAAW,EAAE,0MAA0M,WAAW,iNAAiN;IACnb,OAAO,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,2CAA2C;YACxD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,GAAkB,EAAE,eAAgC,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC3C,WAAW,EAAE,UAAU,mBAAmB,CAAC,eAAe,CAAC,cAAc;IACzE,OAAO,EAAE,YAAY,mBAAmB,CAAC,eAAe,CAAC,cAAc;IACvE,WAAW,EAAE,aAAa,mBAAmB,CAAC,eAAe,CAAC,qDAAqD,mBAAmB,CAAC,eAAe,CAAC,+BAA+B,WAAW,0NAA0N;IAC3Z,OAAO,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;KACrC;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,OAAO,mBAAmB,CAAC,eAAe,CAAC,mCAAmC;YAC3F,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;aAC5B,CAAC;iBACA,OAAO,CAAC,qBAAqB,CAAC,CAC/B;SACD;QACD,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,iBAAiB,CAAC,MAAM,EAAE;QAC7B,GAAG,iBAAiB,CAAC,MAAM,EAAE;QAC7B,GAAG,4BAA4B,CAAC,MAAM,EAAE;KACxC;CACD,CAAC,CAAA"}

package/dist/certificate.d.ts

@@ -1,5 +1,6 @@
-import type { Certificate, Identity, Key, PrivateKey } from "sshpk";
+import type { PrivateKey, PublicKey } from "./ssh/keys.js";
 import type { SshCaBindings } from "./types.js";
+import { type SshCertificate } from "./ssh/certificate.js";
 export type CreateCertificateOptions = {
     lifetime?: number;
     principals?: string[];
@@ -16,16 +17,18 @@ export type GenerateCertificateOptions = {
      */
     serial?: bigint;
 } & CreateCertificateOptions;
-export declare const generateCertificate: (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions) => Certificate;
-export declare function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate>;
+export declare const generateCertificate: (env: SshCaBindings, email: string, key: PrivateKey, public_key: PublicKey, options?: GenerateCertificateOptions) => Promise<SshCertificate>;
+export declare function createSignedCertificate(env: SshCaBindings, email: string, public_key: PublicKey, options?: CreateCertificateOptions): Promise<SshCertificate>;
 export type CreateHostCertificateOptions = {
     lifetime?: number;
     principals?: string[];
-    subjects?: Identity[];
 };
 export declare class BadIssuerError extends Error {
     constructor(message: string);
 }
-export declare function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate>;
-export declare const generateSerial: (serial?: bigint) => Buffer<ArrayBuffer>;
+export declare function createSignedHostCertificate(env: SshCaBindings, public_key: PublicKey, options?: CreateHostCertificateOptions): Promise<SshCertificate>;
+/**
+ * Returns a random certificate serial number
+ */
+export declare const generateSerial: () => bigint;
 //# sourceMappingURL=certificate.d.ts.map

package/dist/certificate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAQD,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAM1B;CACD;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,wBAAwB,CAAA;AAE5B,eAAO,MAAM,mBAAmB,QAAS,aAAa,SAAS,MAAM,OAAO,UAAU,cAAc,GAAG,YAAY,0BAA0B,KAAG,WAkG/I,CAAA;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAa1J;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,WAAW,CAAC,CAsCnJ;AAED,eAAO,MAAM,cAAc,YAAa,MAAM,KAAG,MAAM,CAAC,WAAW,CAUlE,CAAA"}
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGnG,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAM1B;CACD;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,wBAAwB,CAAA;AAqB5B,eAAO,MAAM,mBAAmB,QAAe,aAAa,SAAS,MAAM,OAAO,UAAU,cAAc,SAAS,YAAY,0BAA0B,KAAG,OAAO,CAAC,cAAc,CAsDjL,CAAA;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAanK;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAmB5J;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,QAAO,MAEjC,CAAA"}

package/dist/certificate.js

@@ -1,13 +1,7 @@
 import { seconds } from "itty-time";
-import sshpk from "sshpk";
 import { getPrivateKey, split } from "./utils.js";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { createCertificate, identityForHost, identityForUser, identityFromDN } = sshpk;
-/* const DefaultCreateCertificateOptions: CreateCertificateOptions = {
-    lifetime: seconds(env.SSH_CERTIFICATE_LIFETIME),
-    principals: [],
-    extensions: sshCertificateExtensions
-} */
+import { signCertificate } from "./ssh/certificate.js";
+import { createSigner } from "./ssh/signer.js";
 export class CertificateError extends Error {
     constructor(message) {
         super(message);
@@ -16,17 +10,32 @@ export class CertificateError extends Error {
         Object.setPrototypeOf(this, CertificateError.prototype);
     }
 }
-export const generateCertificate = (env, email, key, public_key, options) => {
-    let { lifetime } = options ?? {};
-    const { principals, extensions, serial } = options ?? {};
-    // add identities
+/**
+ * Signs a certificate with the CA key
+ *
+ * @throws {@link CertificateError} when the certificate has no principals,
+ * as OpenSSH accepts a certificate without principals for any user or host
+ */
+const sign = async (key, fields, lifetime) => {
+    if (fields.principals.length === 0) {
+        throw new CertificateError("a certificate must have at least one principal");
+    }
+    // the validity is to the second, so starts at the current second rather
+    // than in the future
+    const validAfter = new Date(Math.floor(Date.now() / 1000) * 1000);
+    const validBefore = new Date(validAfter.getTime() + lifetime * 1000);
+    return await signCertificate({ ...fields, validAfter, validBefore }, await createSigner(key));
+};
+export const generateCertificate = async (env, email, key, public_key, options) => {
+    const { lifetime, principals, extensions, serial } = options ?? {};
+    // add principals
     const includeSelf = env.SSH_CERTIFICATE_INCLUDE_SELF === undefined
         ? false
         : typeof env.SSH_CERTIFICATE_INCLUDE_SELF === "string"
             ? env.SSH_CERTIFICATE_INCLUDE_SELF === "true"
             : env.SSH_CERTIFICATE_INCLUDE_SELF;
-    const identity = includeSelf
-        ? [identityForUser(email.split("@")[0])]
+    const certificatePrincipals = includeSelf
+        ? [email.split("@")[0]]
         : [];
     // add email?
     const includeSelfEmail = env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === undefined
@@ -35,69 +44,34 @@ export const generateCertificate = (env, email, key, public_key, options) => {
             ? env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL === "true"
             : env.SSH_CERTIFICATE_INCLUDE_SELF_EMAIL;
     if (includeSelfEmail) {
-        identity.push(identityForUser(email));
+        certificatePrincipals.push(email);
     }
     if (principals !== undefined) {
-        for (const p of principals) {
-            identity.push(identityForUser(p));
-        }
-    }
-    for (const p of split(env.SSH_CERTIFICATE_PRINCIPALS)) {
-        identity.push(identityForUser(p));
-    }
-    // lifetime is the smaller of what was provided in the options or the default
-    lifetime = lifetime !== undefined
-        ? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
-        : seconds(env.SSH_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const s = generateSerial(serial);
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: s });
-    // ensure openssh info is included in certificate (should not occur)
-    if (certificate.signatures.openssh === undefined) {
-        throw new CertificateError("missing openssh information in certificate");
+        certificatePrincipals.push(...principals);
     }
+    certificatePrincipals.push(...split(env.SSH_CERTIFICATE_PRINCIPALS));
     const sshCertificateExtensions = split(env.SSH_CERTIFICATE_EXTENSIONS);
-    // add usage extensions
-    const sshextensions = [];
+    // if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
     if (extensions !== undefined) {
-        // if extensions are provided in request, ensure they do not include extra extensions beyond the defaults
         for (const ext of extensions) {
             if (!sshCertificateExtensions.includes(ext)) {
                 throw new CertificateError(`${ext} is not allowed`);
             }
-            // add to list of allowed extensions
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
         }
     }
-    else {
+    // lifetime is the smaller of what was provided in the options or the default
+    const certificateLifetime = lifetime !== undefined
+        ? Math.min(lifetime, seconds(env.SSH_CERTIFICATE_LIFETIME))
+        : seconds(env.SSH_CERTIFICATE_LIFETIME);
+    return await sign(key, {
+        kind: "user",
+        publicKey: public_key,
+        serial: serial ?? generateSerial(),
+        keyId: email,
+        principals: certificatePrincipals,
         // use defaults if not provided
-        sshCertificateExtensions.forEach((ext) => {
-            sshextensions.push({
-                critical: false,
-                name: ext,
-                data: Buffer.alloc(0)
-            });
-        });
-    }
-    // add info to certificate
-    certificate.signatures = {
-        openssh: {
-            nonce: certificate.signatures.openssh.nonce,
-            keyId: email,
-            signature: certificate.signatures.openssh.signature,
-            exts: sshextensions
-        }
-    };
-    // re-sign after changes
-    certificate.signWith(key);
-    return certificate;
+        extensions: extensions ?? sshCertificateExtensions,
+    }, certificateLifetime);
 };
 export async function createSignedCertificate(env, email, public_key, options) {
     // grab private key from secret store
@@ -109,7 +83,7 @@ export async function createSignedCertificate(env, email, public_key, options) {
             extensions: split(env.SSH_CERTIFICATE_EXTENSIONS)
         };
     }
-    return generateCertificate(env, email, key, public_key, options);
+    return await generateCertificate(env, email, key, public_key, options);
 }
 export class BadIssuerError extends Error {
     constructor(message) {
@@ -119,44 +93,26 @@ export class BadIssuerError extends Error {
     }
 }
 export async function createSignedHostCertificate(env, public_key, options) {
-    if (options === undefined) {
-        options = {
-            lifetime: seconds(env.SSH_HOST_CERTIFICATE_LIFETIME),
-            principals: []
-        };
-    }
-    // generate list of identities for host key
-    const identity = [];
-    if (options.principals !== undefined) {
-        for (const p of options.principals) {
-            identity.push(identityForHost(p));
-        }
-    }
-    // add any already provided subjects (for renewals only)
-    if (options.subjects !== undefined) {
-        identity.push(...options.subjects);
-    }
+    const principals = options?.principals ?? [];
     // grab private key from secret store
     const key = await getPrivateKey(env);
     // lifetime is the smaller of what was provided in the options or the default
-    const lifetime = options.lifetime !== undefined
+    const lifetime = options?.lifetime !== undefined
         ? Math.min(options.lifetime, seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
         : seconds(env.SSH_HOST_CERTIFICATE_LIFETIME);
-    // generate value for serial of certificate
-    const serial = generateSerial();
-    // set issuer of certificate based on ISSUER_DN
-    const issuer = identityFromDN(env.ISSUER_DN);
-    // create certificate
-    const certificate = createCertificate(identity, public_key, issuer, key, { lifetime: lifetime, serial: serial });
-    return certificate;
+    return await sign(key, {
+        kind: "host",
+        publicKey: public_key,
+        serial: generateSerial(),
+        keyId: `host_${principals[0]}`,
+        principals,
+        extensions: [],
+    }, lifetime);
 }
-export const generateSerial = (serial) => {
-    if (serial !== undefined) {
-        const s = Buffer.alloc(8);
-        s.writeBigUInt64BE(serial);
-        return s;
-    }
-    const randomBytes = crypto.getRandomValues(new Uint8Array(8));
-    return Buffer.from(randomBytes);
+/**
+ * Returns a random certificate serial number
+ */
+export const generateSerial = () => {
+    return new DataView(crypto.getRandomValues(new Uint8Array(8)).buffer).getBigUint64(0);
 };
 //# sourceMappingURL=certificate.js.map

package/dist/certificate.js.map

@@ -1 +1 @@
-{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,KAAK,MAAM,OAAO,CAAA;AAGzB,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAGjD,+HAA+H;AAC/H,MAAM,EAAE,iBAAiB,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,CAAA;AAUrF;;;;IAII;AAEJ,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAE9B,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;CACD;AAWD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAkB,EAAE,KAAa,EAAE,GAAe,EAAE,UAAe,EAAE,OAAoC,EAAe,EAAE;IAC7J,IAAI,EAAE,QAAQ,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAChC,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAExD,iBAAiB;IACjB,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,SAAS;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;YACrD,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YAC7C,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAA;IACpC,MAAM,QAAQ,GAAG,WAAW;QAC3B,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;QACzC,CAAC,CAAC,EAAE,CAAA;IAEL,aAAa;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,kCAAkC,KAAK,SAAS;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,kCAAkC,KAAK,QAAQ;YAC3D,CAAC,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM;YACnD,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC5B,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,EAAE,CAAC;QACvD,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,CAAC;IAGD,6EAA6E;IAC7E,QAAQ,GAAG,QAAQ,KAAK,SAAS;QAChC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAExC,2CAA2C;IAC3C,MAAM,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,CAAA;IAEhC,+CAA+C;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE5C,qBAAqB;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAA;IAE3G,oEAAoE;IACpE,IAAI,WAAW,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,gBAAgB,CAAC,4CAA4C,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,wBAAwB,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAEtE,uBAAuB;IACvB,MAAM,aAAa,GAAmB,EAAE,CAAA;IACxC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,yGAAyG;QACzG,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;YACpD,CAAC;YAED,oCAAoC;YACpC,aAAa,CAAC,IAAI,CAAC;gBAClB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACrB,CAAC,CAAA;QACH,CAAC;IACF,CAAC;SAAM,CAAC;QACP,+BAA+B;QAC/B,wBAAwB,CAAC,OAAO,CAAC,CAAC,GAAW,EAAE,EAAE;YAChD,aAAa,CAAC,IAAI,CAAC;gBAClB,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;aACrB,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;IAEH,CAAC;IAED,0BAA0B;IAC1B,WAAW,CAAC,UAAU,GAAG;QACxB,OAAO,EAAE;YACR,KAAK,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK;YAC3C,KAAK,EAAE,KAAK;YACZ,SAAS,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS;YACnD,IAAI,EAAE,aAAa;SACnB;KACD,CAAA;IAED,wBAAwB;IACxB,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAEzB,OAAO,WAAW,CAAA;AACnB,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAkB,EAAE,KAAa,EAAE,UAAe,EAAE,OAAkC;IACnI,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC/C,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC;SACjD,CAAA;IACF,CAAC;IAED,OAAO,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACjE,CAAC;AAQD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB,EAAE,UAAe,EAAE,OAAsC;IAC5H,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC;YACpD,UAAU,EAAE,EAAE;SACd,CAAA;IACF,CAAC;IACD,2CAA2C;IAC3C,MAAM,QAAQ,GAAe,EAAE,CAAA;IAC/B,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IAED,wDAAwD;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACnC,CAAC;IAED,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS;QAC9C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAE7C,2CAA2C;IAC3C,MAAM,MAAM,GAAG,cAAc,EAAE,CAAA;IAE/B,+CAA+C;IAC/C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAE5C,qBAAqB;IACrB,MAAM,WAAW,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAA;IAEhH,OAAO,WAAW,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAe,EAAuB,EAAE;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QACzB,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAA;QAE1B,OAAO,CAAC,CAAA;IACT,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;IAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;AAChC,CAAC,CAAA"}
+{"version":3,"file":"certificate.js","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EAAE,eAAe,EAA+C,MAAM,sBAAsB,CAAA;AACnG,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAQ9C,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAA;QAE9B,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACxD,CAAC;CACD;AAWD;;;;;GAKG;AACH,MAAM,IAAI,GAAG,KAAK,EAAE,GAAe,EAAE,MAA6D,EAAE,QAAgB,EAA2B,EAAE;IAChJ,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,gBAAgB,CAAC,gDAAgD,CAAC,CAAA;IAC7E,CAAC;IAED,wEAAwE;IACxE,qBAAqB;IACrB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;IACjE,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAA;IAEpE,OAAO,MAAM,eAAe,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC,CAAA;AAC9F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,GAAkB,EAAE,KAAa,EAAE,GAAe,EAAE,UAAqB,EAAE,OAAoC,EAA2B,EAAE;IACrL,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,EAAE,CAAA;IAElE,iBAAiB;IACjB,MAAM,WAAW,GAAG,GAAG,CAAC,4BAA4B,KAAK,SAAS;QACjE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,4BAA4B,KAAK,QAAQ;YACrD,CAAC,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM;YAC7C,CAAC,CAAC,GAAG,CAAC,4BAA4B,CAAA;IACpC,MAAM,qBAAqB,GAAG,WAAW;QACxC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QACxB,CAAC,CAAC,EAAE,CAAA;IAEL,aAAa;IACb,MAAM,gBAAgB,GAAG,GAAG,CAAC,kCAAkC,KAAK,SAAS;QAC5E,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,GAAG,CAAC,kCAAkC,KAAK,QAAQ;YAC3D,CAAC,CAAC,GAAG,CAAC,kCAAkC,KAAK,MAAM;YACnD,CAAC,CAAC,GAAG,CAAC,kCAAkC,CAAA;IAC1C,IAAI,gBAAgB,EAAE,CAAC;QACtB,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAClC,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,qBAAqB,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAA;IAC1C,CAAC;IAED,qBAAqB,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAA;IAEpE,MAAM,wBAAwB,GAAG,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAA;IAEtE,yGAAyG;IACzG,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,gBAAgB,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAA;YACpD,CAAC;QACF,CAAC;IACF,CAAC;IAED,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,QAAQ,KAAK,SAAS;QACjD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAA;IAExC,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE;QACtB,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,MAAM,IAAI,cAAc,EAAE;QAClC,KAAK,EAAE,KAAK;QACZ,UAAU,EAAE,qBAAqB;QACjC,+BAA+B;QAC/B,UAAU,EAAE,UAAU,IAAI,wBAAwB;KAClD,EAAE,mBAAmB,CAAC,CAAA;AACxB,CAAC,CAAA;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,GAAkB,EAAE,KAAa,EAAE,UAAqB,EAAE,OAAkC;IACzI,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,GAAG;YACT,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;YAC/C,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC;SACjD,CAAA;IACF,CAAC;IAED,OAAO,MAAM,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;AACvE,CAAC;AAOD,MAAM,OAAO,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAA;QAE5B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,CAAA;IACtD,CAAC;CACD;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,GAAkB,EAAE,UAAqB,EAAE,OAAsC;IAClI,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,EAAE,CAAA;IAE5C,qCAAqC;IACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAA;IAEpC,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,SAAS;QAC/C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAA;IAE7C,OAAO,MAAM,IAAI,CAAC,GAAG,EAAE;QACtB,IAAI,EAAE,MAAM;QACZ,SAAS,EAAE,UAAU;QACrB,MAAM,EAAE,cAAc,EAAE;QACxB,KAAK,EAAE,QAAQ,UAAU,CAAC,CAAC,CAAC,EAAE;QAC9B,UAAU;QACV,UAAU,EAAE,EAAE;KACd,EAAE,QAAQ,CAAC,CAAA;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE;IAC1C,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;AACtF,CAAC,CAAA"}

package/dist/db/index.d.ts

@@ -1,16 +1,28 @@
-import type { Certificate } from "sshpk";
+import { PublicKey } from "../ssh/keys.js";
+import type { SshCertificate } from "../ssh/certificate.js";
 import type { SshCaBindings } from "../types.js";
 import { CertificateType, type CertificateRecord } from "./types.js";
 export declare const dbCleanup: (env: SshCaBindings) => Promise<void>;
-export declare const recordCertificate: (env: SshCaBindings, certificate: Certificate, keyid: string, certificateType?: CertificateType) => Promise<void>;
+export declare const recordCertificate: (env: SshCaBindings, certificate: SshCertificate, keyid: string, certificateType?: CertificateType) => Promise<void>;
 export declare const isRevoked: (env: SshCaBindings, serial: bigint) => Promise<boolean>;
 export declare enum RevocationStatus {
     NotFound = 0,
     Revoked = 1,
-    Revokable = 2,
-    Unrevokable = 3
+    Revokable = 2
 }
-export declare const revocationStatus: (env: SshCaBindings, serial: bigint, publickey: string, certificateType: CertificateType) => Promise<RevocationStatus>;
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export declare const revocationStatus: (env: SshCaBindings, serial: bigint, publicKey: PublicKey, certificateType: CertificateType) => Promise<RevocationStatus>;
 export declare const getRevocationList: (env: SshCaBindings, certificateType: CertificateType) => Promise<string[]>;
 type RevokedCertificate = Pick<CertificateRecord, "revoked_at">;
 export declare const revokeCertificate: (env: SshCaBindings, serial: bigint) => Promise<RevokedCertificate[]>;

package/dist/db/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAoB,MAAM,OAAO,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAuC,MAAM,YAAY,CAAA;AAmBzG,eAAO,MAAM,SAAS,QAAe,aAAa,kBAsBjD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,WAAW,SAAS,MAAM,oBAAmB,eAAe,kBA2BpI,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;IACT,WAAW,IAAA;CACX;AAED,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,MAAM,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAwBxJ,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAsB9G,CAAA;AAED,KAAK,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAE/D,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAuBxG,CAAA;AAUD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,mBAAmB,eAAe,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CA4CxH,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/db/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAKhD,OAAO,EAAE,eAAe,EAAE,KAAK,iBAAiB,EAAuC,MAAM,YAAY,CAAA;AAmBzG,eAAO,MAAM,SAAS,QAAe,aAAa,kBAsBjD,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,eAAe,cAAc,SAAS,MAAM,oBAAmB,eAAe,kBAsBvI,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAYnF,CAAA;AAED,oBAAY,gBAAgB;IAC3B,QAAQ,IAAA;IACR,OAAO,IAAA;IACP,SAAS,IAAA;CACT;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,QAAe,aAAa,UAAU,MAAM,aAAa,SAAS,mBAAmB,eAAe,KAAG,OAAO,CAAC,gBAAgB,CAsB3J,CAAA;AAED,eAAO,MAAM,iBAAiB,QAAe,aAAa,mBAAmB,eAAe,KAAG,OAAO,CAAC,MAAM,EAAE,CAsB9G,CAAA;AAED,KAAK,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAA;AAE/D,eAAO,MAAM,iBAAiB,QAAe,aAAa,UAAU,MAAM,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAuBxG,CAAA;AAUD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,mBAAmB,eAAe,UAAU,MAAM,KAAG,OAAO,CAAC,MAAM,CA4CxH,CAAA"}

package/dist/db/index.js

@@ -1,3 +1,4 @@
+import { PublicKey } from "../ssh/keys.js";
 import { logger } from "../logger.js";
 import { D1QB } from "workers-qb";
 import { z } from "zod";
@@ -40,26 +41,21 @@ export const dbCleanup = async (env) => {
     }
 };
 export const recordCertificate = async (env, certificate, keyid, certificateType = CertificateType.User) => {
-    const serial = certificate.serial.readBigUInt64BE(0);
-    const subjects = certificate.subjects.map((v) => {
-        return v.toString();
-    }).join(",");
-    const extensions = certificate.getExtensions().map((v) => {
-        // @ts-expect-error: the name property does exist
-        return v.name;
-    }).join(",");
+    // principals are recorded as distinguished names, as they were when
+    // certificates were created with sshpk
+    const principals = certificate.principals.map((p) => `${certificate.kind === "host" ? "CN" : "UID"}=${p}`).join(",");
     const qb = await connect(env);
     const res = await qb.insert({
         tableName: "certificates",
         data: {
-            serial: `${serial}`,
+            serial: `${certificate.serial}`,
             key_id: keyid,
-            principals: subjects,
-            extensions: extensions,
-            valid_after: certificate.validFrom.toISOString(),
-            valid_before: certificate.validUntil.toISOString(),
+            principals: principals,
+            extensions: certificate.extensions.join(","),
+            valid_after: certificate.validAfter.toISOString(),
+            valid_before: certificate.validBefore.toISOString(),
             certificate_type: certificateType,
-            public_key: certificate.subjectKey.toString("ssh")
+            public_key: certificate.publicKey.toString()
         },
     }).execute();
     if (!res.success) {
@@ -83,28 +79,48 @@ export var RevocationStatus;
     RevocationStatus[RevocationStatus["NotFound"] = 0] = "NotFound";
     RevocationStatus[RevocationStatus["Revoked"] = 1] = "Revoked";
     RevocationStatus[RevocationStatus["Revokable"] = 2] = "Revokable";
-    RevocationStatus[RevocationStatus["Unrevokable"] = 3] = "Unrevokable";
 })(RevocationStatus || (RevocationStatus = {}));
-export const revocationStatus = async (env, serial, publickey, certificateType) => {
+// whether a public key recorded in OpenSSH format is the same as another key,
+// treating a recorded key that cannot be parsed as a different key
+const isKey = (recorded, publicKey) => {
+    try {
+        return PublicKey.parse(recorded).equals(publicKey);
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Returns whether a certificate can be revoked by the holder of a public key.
+ *
+ * The public key is compared by fingerprint, so a key with a different
+ * comment to the one the certificate was issued for still matches.
+ *
+ * @param env The CA bindings
+ * @param serial The serial of the certificate
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate
+ * @returns The revocation status of the certificate
+ */
+export const revocationStatus = async (env, serial, publicKey, certificateType) => {
     const qb = await connect(env);
     const res = await qb.fetchOne({
         tableName: "certificates",
         fields: ["public_key", "revoked_at"],
         where: {
-            conditions: "serial = ? AND public_key = ? AND certificate_type = ?",
-            params: [`${serial}`, publickey, certificateType]
+            conditions: "serial = ? AND certificate_type = ?",
+            params: [`${serial}`, certificateType]
         }
     }).execute();
-    if (res.results === undefined) {
+    // a certificate issued for another key is reported as not found, so
+    // requests cannot be used to discover which serials exist
+    if (res.results?.public_key == null || !isKey(res.results.public_key, publicKey)) {
         return RevocationStatus.NotFound;
     }
     if (res.results.revoked_at !== null) {
         return RevocationStatus.Revoked;
     }
-    if (publickey === res.results.public_key) {
-        return RevocationStatus.Revokable;
-    }
-    return RevocationStatus.Unrevokable;
+    return RevocationStatus.Revokable;
 };
 export const getRevocationList = async (env, certificateType) => {
     const qb = await connect(env);