@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/README.md

@@ -41,6 +41,7 @@ Node.js 24 or later is required. Helpers for Node.js are imported from
 | `fromNodeSqlite(db)` | Uses a built-in `node:sqlite` database as the `DB` binding |
 | `secretFromFile(path)` | Reads the CA private key from a file (re-read each time it is needed) |
 | `secretFromString(value)` | Uses a string as the CA private key |
+| `cacheInMemory()` | Uses an in-memory cache as the optional `CACHE` binding (see [KRL Caching](#krl-caching)) |
 | `bindingsFromEnv({ DB, PRIVATE_KEY })` | Reads and validates the remaining configuration from `process.env` |
 
 `createSshCa(bindings)` returns a `fetch(request)` handler that takes a
@@ -216,6 +217,12 @@ sequenceDiagram
     deactivate Client
 ```
 
+Host certificate principals may be IP addresses, bare host names or fully
+qualified domain names. As OpenSSH matches the principals of a host
+certificate as patterns, principals containing wildcard or pattern characters
+(`*`, `?`, `!` or `,`), whitespace or control characters are refused, as a
+principal such as `*` would make the certificate valid for every host.
+
 #### Renewals
 
 Renewals are done using the existing certificate and will succeed if:
@@ -224,6 +231,12 @@ Renewals are done using the existing certificate and will succeed if:
 2. It was issued by the CA
 3. The public key used to obtain the certificate is the same as the one
 currently presented
+4. It has not been revoked, or already renewed
+
+The certificate that was renewed is revoked and added to the host KRL, so it
+cannot be used to renew again. SSH clients that check the host KRL will no
+longer accept it, so `sshd` must be reloaded to present the renewed
+certificate once it has been written to disk.
 
 This means the OIDC authentication flow is not required in this case as shown
 below when `ssh-ca-client-cli host --renew` is run:
@@ -239,12 +252,71 @@ sequenceDiagram
     deactivate Client
 ```
 
+## API
+
+The CA serves two versions of its API, which are documented in OpenAPI
+format at `/docs` and in [openapi.json](openapi.json):
+
+| Action                   | v3                              | v4                                              |
+|--------------------------|---------------------------------|-------------------------------------------------|
+| Get the CA public key    | `GET /api/v3/ca`                | `GET /api/v4/ca`                                |
+| Request user certificate | `POST /api/v3/user/certificate` | `POST /api/v4/user/certificates`                |
+| Revoke user certificate  | `POST /api/v3/user/revoke`      | `DELETE /api/v4/user/certificates/{serial}`     |
+| Get user KRL             | `GET /api/v3/user/krl`          | `GET /api/v4/user/krl`                          |
+| Request host certificate | `POST /api/v3/host/certificate` | `POST /api/v4/host/certificates`                |
+| Renew host certificate   | `POST /api/v3/host/renew`       | `POST /api/v4/host/certificates/{serial}/renew` |
+| Revoke host certificate  | `POST /api/v3/host/revoke`      | `DELETE /api/v4/host/certificates/{serial}`     |
+| Get host KRL             | `GET /api/v3/host/krl`          | `GET /api/v4/host/krl`                          |
+
+Certificates are issued for Ed25519, ECDSA and RSA keys. RSA keys must be at
+least 2048 bits; a request for a smaller key is refused with a `400` error,
+and a certificate for a smaller key cannot be renewed. Certificates for
+smaller keys can still be revoked.
+
+### Proof of Possession
+
+Requests that use an SSH key prove possession of its private key by including
+a proof of the form `${timestamp}.${fingerprint}.${signature}`, where
+`timestamp` is the time in milliseconds since the Unix epoch, `fingerprint` is
+the SHA256 fingerprint of the public key (for example
+`SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs`) and `signature` is the
+BASE64 encoded armored SSHSIG signature (as produced by `ssh-keygen -Y sign`)
+of the signed data. The proof is rejected if the timestamp is outside of
+`CERTIFICATE_REQUEST_TIME_SKEW_MAX` of the time on the CA.
+
+In v3 the proof is sent as the `proof` property of the request body and the
+signed data is `${timestamp}.${fingerprint}` using the
+`proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace.
+As this does not say which request the proof is for, a proof captured from one
+request may be replayed against another endpoint while it is valid.
+
+In v4 the proof is sent in the `Proof-Of-Possession` header and is bound to
+the request it is made for. The signed data is
+`${timestamp}.${fingerprint}.${METHOD} ${path}` using the
+`request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle`
+namespace, where `${METHOD} ${path}` is the request as documented in the
+OpenAPI schema with any parameters filled in, for example:
+
+```
+1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.DELETE /api/v4/user/certificates/12345678901234567890
+```
+
+Only `${timestamp}.${fingerprint}.${signature}` is sent, as the CA rebuilds
+the request part from the request it receives. The path does not change if
+the CA is served behind a proxy under another path, and serials in the path
+are written in decimal without leading zeros.
+
+In v4 the public key for a revocation or renewal is taken from the proof and
+the certificate respectively, so it is not sent separately.
+
 ## Configuration
 
 ### CA Private Key
 
 The CA private key is read from the `PRIVATE_KEY` Secrets Store binding and
-must be an Ed25519 or ECDSA (`nistp256`, `nistp384` or `nistp521`) key:
+must be an unencrypted Ed25519 or ECDSA (`nistp256`, `nistp384` or
+`nistp521`) key in OpenSSH format, which is what `ssh-keygen` creates by
+default:
 
 ```sh
 ssh-keygen -t ed25519 -N "" -C "" -f ssh-ca
@@ -274,6 +346,107 @@ Transfer the IdP settings as follows:
 The `openid` and `email` scopes are required, with enabling of refresh tokens
 (the `offline_access` scope) being optional, but recommended.
 
+`JWT_AUD` must be set to the audience the IdP issues tokens for this
+application with (for Cloudflare Access, the application's AUD tag). Both the
+access token and the identity token must be issued for this audience, so
+tokens the IdP issues for other applications are not accepted. If the IdP
+issues access tokens with a different audience to identity tokens, set
+`JWT_ACCESS_TOKEN_AUD` to the audience of the access token. Either value may
+be a comma separated list. If `JWT_AUD` is not set, requests that need a
+token fail with a `500` error.
+
+The `email` claim of the access token must be an email address. It is used as
+the key ID of user certificates, and with `SSH_CERTIFICATE_INCLUDE_SELF` its
+local part (before the `@`) is added as a principal. If the IdP includes the
+`email_verified` claim it must be `true`, so tokens for an address the IdP has
+not verified are refused.
+
+As the local part does not include the domain, `alice@example.com` and
+`alice@example.net` are given the same principal with
+`SSH_CERTIFICATE_INCLUDE_SELF`. Only enable it when the IdP only allows users
+from domains you control.
+
+### Rate Limiting
+
+Requests to issue, renew and revoke certificates can be rate limited by
+adding a [rate limit binding](https://developers.cloudflare.com/workers/runtime-apis/bindings/rate-limit/)
+named `RATE_LIMITER` to `wrangler.jsonc`:
+
+```jsonc
+"ratelimits": [
+	{
+		"name": "RATE_LIMITER",
+		"namespace_id": "1001",
+		"simple": { "limit": 10, "period": 60 }
+	}
+]
+```
+
+Requests are counted by the client IP address in the `CF-Connecting-IP`
+header, and requests over the limit receive a `429` response. Requests to get
+the CA public key and the KRLs are not limited, as many hosts may fetch them
+from the same address. When no `RATE_LIMITER` binding is configured, requests
+are not limited. If the rate limiter fails, the request is allowed and the
+error is logged, so certificates can still be issued and revoked.
+
+On Node.js, pass any limiter with the same shape (a `limit({ key })` method
+returning `{ success }`, see `CaRateLimiter`) as `RATE_LIMITER`, and choose
+the key requests are counted by with the `rateLimitKey` option, as there is no
+`CF-Connecting-IP` header:
+
+```ts
+const ca = createSshCa(bindingsFromEnv({
+    DB: fromNodeSqlite(new DatabaseSync("/var/lib/ssh-ca/ssh-ca.sqlite")),
+    PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+    RATE_LIMITER: myLimiter,
+}), {
+    // the client address as set by your reverse proxy
+    rateLimitKey: (req) => req.headers.get("X-Real-IP") ?? undefined,
+})
+```
+
+Requests for which `rateLimitKey` returns `undefined` are not limited.
+
+### KRL Caching
+
+Generating and signing a KRL reads every revoked certificate from the
+database, so the KRLs can be cached by adding an optional `CACHE` binding. On
+Workers this is a KV namespace:
+
+```jsonc
+"kv_namespaces": [
+    {
+        "binding": "CACHE",
+        "id": "<kv namespace id>"
+    }
+]
+```
+
+On Node.js an in-memory cache can be passed to `bindingsFromEnv`, or any
+other cache that implements the `CaCache` interface:
+
+```ts
+const ca = createSshCa(bindingsFromEnv({
+    DB: fromNodeSqlite(new DatabaseSync("/var/lib/ssh-ca/ssh-ca.sqlite")),
+    PRIVATE_KEY: secretFromFile("/etc/ssh-ca/ca_key"),
+    CACHE: cacheInMemory(),
+}))
+```
+
+A cached KRL is never served after it is out of date. Each certificate type
+has a revision in the database that is incremented whenever a certificate of
+that type is revoked (including the previous certificate on a host
+renewal), or when expired certificates are removed. The cache key includes
+this revision and the fingerprint of the CA key, so a revocation or a new CA
+key immediately uses a new key rather than relying on cache entries being
+deleted or the cache being consistent. Entries are left to expire after 7
+days.
+
+A KRL keeps the same version and generation date until its contents
+change, so a regenerated KRL is identical to the one that was cached. If the
+cache cannot be read or written the KRL is generated as it is without a
+cache.
+
 ### Client
 
 Please visit the ssh-ca-client repository for further information:

package/dist/api/operations.d.ts

@@ -0,0 +1,50 @@
+import { Logger } from "@andrewheberle/ts-slog";
+import type { AppContext } from "../router.js";
+import type { SshCertificate } from "../ssh/certificate.js";
+import { type PublicKey } from "../ssh/keys.js";
+import { CertificateType } from "../db/types.js";
+/**
+ * Returns the public key of the CA in OpenSSH format.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @returns The response containing the CA public key
+ */
+export declare const caPublicKey: (c: AppContext, l: Logger) => Promise<Response>;
+/**
+ * Returns the signed Key Revocation List for a type of certificate.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param certificateType The type of certificate to return the KRL for
+ * @returns The response containing the KRL and its signature
+ */
+export declare const revocationList: (c: AppContext, l: Logger, certificateType: CertificateType) => Promise<Response>;
+/**
+ * Signs a certificate, records it so it can later be revoked and returns it
+ * as the response to a certificate request or renewal.
+ *
+ * These are the steps shared by every API version once a request has been
+ * validated and authorised.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param sign Signs and returns the certificate
+ * @param certificateType The type of certificate being issued
+ * @param renews The host certificate being renewed, which is revoked when the new certificate is recorded
+ * @returns The response containing the issued certificate
+ */
+export declare const issueCertificate: (c: AppContext, l: Logger, sign: () => Promise<SshCertificate>, certificateType: CertificateType, renews?: SshCertificate) => Promise<Response>;
+/**
+ * Revokes a certificate once the requester has proven possession of the
+ * private key for the public key it was issued for.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param serial The serial of the certificate to revoke
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate being revoked
+ * @returns The response containing the time of revocation
+ */
+export declare const revoke: (c: AppContext, l: Logger, serial: bigint, publicKey: PublicKey, certificateType: CertificateType) => Promise<Response>;
+//# sourceMappingURL=operations.d.ts.map

package/dist/api/operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../src/api/operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAStD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AAG9C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAoChD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,MAAa,UAAU,KAAK,MAAM,KAAG,OAAO,CAAC,QAAQ,CAQ5E,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,MAAa,UAAU,KAAK,MAAM,mBAAmB,eAAe,KAAG,OAAO,CAAC,QAAQ,CA+DjH,CAAA;AAiDD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,MAAa,UAAU,KAAK,MAAM,QAAQ,MAAM,OAAO,CAAC,cAAc,CAAC,mBAAmB,eAAe,WAAW,cAAc,KAAG,OAAO,CAAC,QAAQ,CA0DjL,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,MAAa,UAAU,KAAK,MAAM,UAAU,MAAM,aAAa,SAAS,mBAAmB,eAAe,KAAG,OAAO,CAAC,QAAQ,CAwC/I,CAAA"}

package/dist/api/operations.js

@@ -0,0 +1,264 @@
+import { group } from "@andrewheberle/ts-slog";
+import { ApiException, ConflictException, InputValidationException, InternalServerErrorException, NotFoundException, UnprocessableEntityException, } from "chanfana";
+import { BadIssuerError, CertificateError } from "../certificate.js";
+import { KeyParseError } from "../ssh/keys.js";
+import { getPrivateKey, getPublic, UnsupportedKeyError } from "../utils.js";
+import { KRLBuilder } from "../krl.js";
+import { z } from "zod";
+import { certificateTypeName } from "./schema.js";
+import { getKrlRevision, getKrlVersion, getRevocationList, recordCertificate, recordRenewal, RevocationStatus, revocationStatus, revokeCertificate, } from "../db/index.js";
+/**
+ * Maps an error from an operation that uses the CA key to an API error.
+ */
+const caKeyError = (l, err) => {
+    switch (true) {
+        case (err instanceof UnsupportedKeyError):
+            l.error(err.message);
+            return new InternalServerErrorException(err.message);
+        case (err instanceof KeyParseError):
+            l.error("error parsing private key");
+            return new InternalServerErrorException("error parsing private key");
+        case (err instanceof ApiException):
+            // re-throw any exisiting chanfana error
+            return err;
+        default:
+            // otherwise throw as InternalServerErrorException
+            l.error("unhandled error", "error", err);
+            return new InternalServerErrorException("internal server error");
+    }
+};
+/**
+ * Returns the public key of the CA in OpenSSH format.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @returns The response containing the CA public key
+ */
+export const caPublicKey = async (c, l) => {
+    try {
+        const pub = await getPublic(c.env);
+        return c.text(`${pub.toString()}\n`);
+    }
+    catch (err) {
+        throw caKeyError(l, err);
+    }
+};
+/**
+ * Returns the signed Key Revocation List for a type of certificate.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param certificateType The type of certificate to return the KRL for
+ * @returns The response containing the KRL and its signature
+ */
+export const revocationList = async (c, l, certificateType) => {
+    try {
+        // grab private key from secret store
+        const key = await getPrivateKey(c.env);
+        // a cached KRL is keyed by the revision it was generated for, which
+        // changes whenever a certificate is revoked, and by the CA key that
+        // signed it, so a cached KRL is never used once it is out of date. The
+        // revision is read before the revoked serials, so the KRL cached for a
+        // revision includes at least every certificate revoked by then
+        const cache = c.env.CACHE;
+        const cacheKey = cache === undefined
+            ? undefined
+            : `krl:${certificateTypeName(certificateType)}:${key.publicKey.fingerprint()}:${await getKrlRevision(c.env, certificateType)}`;
+        if (cache !== undefined && cacheKey !== undefined) {
+            const cached = await readCachedKrl(cache, cacheKey, l);
+            if (cached !== undefined) {
+                return c.json(cached);
+            }
+        }
+        // get revoked serials
+        const serials = (await getRevocationList(c.env, certificateType)).map(v => BigInt(v));
+        // generate KRL
+        const krl = new KRLBuilder(key)
+            .addSerials(serials);
+        // the version only changes when the content of the KRL does, and every
+        // KRL with the same version has the same generation date
+        const { version, generatedAt } = await getKrlVersion(c.env, certificateType, await krl.digest());
+        const krlBytes = krl.generate(version, "", generatedAt);
+        // convert to base64
+        const bytes = new Uint8Array(krlBytes);
+        let binary = "";
+        for (const byte of bytes) {
+            binary += String.fromCharCode(byte);
+        }
+        const base64Krl = btoa(binary);
+        const signature = await krl.signature();
+        const response = {
+            krl: base64Krl,
+            signature: signature,
+        };
+        if (cache !== undefined && cacheKey !== undefined) {
+            try {
+                await cache.put(cacheKey, JSON.stringify(response), { expirationTtl: KrlCacheTtl });
+            }
+            catch (err) {
+                // the KRL is still returned, it is generated again next time
+                l.warn("could not cache KRL", "error", err);
+            }
+        }
+        return c.json(response);
+    }
+    catch (err) {
+        throw caKeyError(l, err);
+    }
+};
+const KrlResponseSchema = z.object({
+    krl: z.string(),
+    signature: z.string(),
+});
+// how long a cached KRL is kept, in seconds. A cached KRL is only used for
+// the revision it was generated for, so this only removes entries for earlier
+// revisions from the cache
+const KrlCacheTtl = 7 * 24 * 60 * 60;
+/**
+ * Returns a cached KRL response, or undefined if there is none or it cannot be
+ * used, in which case the KRL is generated again.
+ */
+const readCachedKrl = async (cache, key, l) => {
+    let cached;
+    try {
+        cached = await cache.get(key);
+    }
+    catch (err) {
+        l.warn("could not read cached KRL", "error", err);
+        return undefined;
+    }
+    if (cached === null) {
+        return undefined;
+    }
+    let json;
+    try {
+        json = JSON.parse(cached);
+    }
+    catch {
+        l.warn("cached KRL was not valid JSON");
+        return undefined;
+    }
+    const parsed = KrlResponseSchema.safeParse(json);
+    if (!parsed.success) {
+        l.warn("cached KRL was not a valid KRL response");
+        return undefined;
+    }
+    l.debug("using cached KRL", "key", key);
+    return parsed.data;
+};
+/**
+ * Signs a certificate, records it so it can later be revoked and returns it
+ * as the response to a certificate request or renewal.
+ *
+ * These are the steps shared by every API version once a request has been
+ * validated and authorised.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param sign Signs and returns the certificate
+ * @param certificateType The type of certificate being issued
+ * @param renews The host certificate being renewed, which is revoked when the new certificate is recorded
+ * @returns The response containing the issued certificate
+ */
+export const issueCertificate = async (c, l, sign, certificateType, renews) => {
+    try {
+        const certificate = await sign();
+        const response = {
+            certificate: btoa(certificate.toString())
+        };
+        let recorded;
+        try {
+            if (renews === undefined) {
+                await recordCertificate(c.env, certificate, certificate.keyId, certificateType);
+                recorded = true;
+            }
+            else {
+                recorded = await recordRenewal(c.env, renews, certificate);
+            }
+        }
+        catch (err) {
+            // a certificate that is not recorded cannot be revoked, so do not issue it
+            l.error("there was a problem adding issued certificate to database", "error", err);
+            throw new InternalServerErrorException("there was a problem recording the issued certificate");
+        }
+        if (!recorded) {
+            // the certificate was revoked, or renewed by another request, since it was checked
+            l.warn("certificate presented for renewal was revoked before the renewal was recorded");
+            throw new InputValidationException("the provided certificate is revoked", ["body", "certificate"]);
+        }
+        l.info("completed issuing certificate", ...group("certificate", "principals", certificate.principals.join(","), "serial", certificate.serial), ...(renews === undefined ? [] : group("renewed", "serial", renews.serial)));
+        return c.json(response);
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof UnsupportedKeyError):
+                l.error(err.message);
+                throw new InternalServerErrorException(err.message);
+            case (err instanceof ApiException):
+                // re-throw any exisiting chanfana error
+                throw err;
+            case (err instanceof BadIssuerError):
+                throw new UnprocessableEntityException(err.message);
+            case (err instanceof CertificateError):
+                // the request was valid but asked for a certificate the CA's
+                // configuration does not allow, such as an extension that is
+                // not permitted or one without any principals
+                l.warn("certificate could not be issued", "error", err.message);
+                throw new UnprocessableEntityException(err.message);
+            default:
+                // otherwise throw as InternalServerErrorException
+                l.error("unhandled error", "error", err);
+                throw new InternalServerErrorException("internal server error");
+        }
+    }
+};
+/**
+ * Revokes a certificate once the requester has proven possession of the
+ * private key for the public key it was issued for.
+ *
+ * @param c The request context
+ * @param l The logger for the request
+ * @param serial The serial of the certificate to revoke
+ * @param publicKey The public key the requester has proven possession of
+ * @param certificateType The type of certificate being revoked
+ * @returns The response containing the time of revocation
+ */
+export const revoke = async (c, l, serial, publicKey, certificateType) => {
+    // ensure certificate can be revoked
+    const status = await revocationStatus(c.env, serial, publicKey, certificateType);
+    switch (status) {
+        case RevocationStatus.Revoked:
+            l.warn("certificate is already revoked");
+            throw new ConflictException("certificate is already revoked");
+        case RevocationStatus.NotFound:
+            l.warn("certificate not found");
+            throw new NotFoundException("certificate not found");
+    }
+    try {
+        const res = await revokeCertificate(c.env, serial);
+        if (res.length === 0) {
+            // another request revoked the certificate after its status was checked
+            l.warn("certificate was revoked by another request");
+            throw new ConflictException("certificate is already revoked");
+        }
+        if (res.length > 1) {
+            l.warn("more than one revocation result was returned", "count", res.length);
+        }
+        l.info("completed revocation");
+        return c.json({
+            revoked_at: res[0].revoked_at
+        });
+    }
+    catch (err) {
+        switch (true) {
+            case (err instanceof ApiException):
+                // re-throw any exisiting chanfana error
+                throw err;
+            default:
+                // otherwise throw as InternalServerErrorException
+                l.error("unhandled error", "error", err);
+                throw new InternalServerErrorException("internal server error");
+        }
+    }
+};
+//# sourceMappingURL=operations.js.map

package/dist/api/operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operations.js","sourceRoot":"","sources":["../../src/api/operations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAU,MAAM,wBAAwB,CAAA;AACtD,OAAO,EACN,YAAY,EACZ,iBAAiB,EACjB,wBAAwB,EACxB,4BAA4B,EAC5B,iBAAiB,EACjB,4BAA4B,GAC5B,MAAM,UAAU,CAAA;AAGjB,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpE,OAAO,EAAE,aAAa,EAAkB,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AAE3E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EACN,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,gBAAgB,CAAA;AAEvB;;GAEG;AACH,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,GAAY,EAAgB,EAAE;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACd,KAAK,CAAC,GAAG,YAAY,mBAAmB,CAAC;YACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpB,OAAO,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACrD,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;YACpC,OAAO,IAAI,4BAA4B,CAAC,2BAA2B,CAAC,CAAA;QACrE,KAAK,CAAC,GAAG,YAAY,YAAY,CAAC;YACjC,wCAAwC;YACxC,OAAO,GAAG,CAAA;QACX;YACC,kDAAkD;YAClD,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACxC,OAAO,IAAI,4BAA4B,CAAC,uBAAuB,CAAC,CAAA;IAClE,CAAC;AACF,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,CAAa,EAAE,CAAS,EAAqB,EAAE;IAChF,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAElC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,CAAa,EAAE,CAAS,EAAE,eAAgC,EAAqB,EAAE;IACrH,IAAI,CAAC;QACJ,qCAAqC;QACrC,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAEtC,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA;QACzB,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS;YACnC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,OAAO,mBAAmB,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,CAAA;QAE/H,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAA;YACtD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACtB,CAAC;QACF,CAAC;QAED,sBAAsB;QACtB,MAAM,OAAO,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QAErF,eAAe;QACf,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC;aAC7B,UAAU,CAAC,OAAO,CAAC,CAAA;QAErB,uEAAuE;QACvE,yDAAyD;QACzD,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QAEhG,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,WAAW,CAAC,CAAA;QAEvD,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAE9B,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAA;QAEvC,MAAM,QAAQ,GAAgB;YAC7B,GAAG,EAAE,SAAS;YACd,SAAS,EAAE,SAAS;SACpB,CAAA;QAED,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,IAAI,CAAC;gBACJ,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC,CAAA;YACpF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,6DAA6D;gBAC7D,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC5C,CAAC;QACF,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACzB,CAAC;AACF,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAA;AAIF,2EAA2E;AAC3E,8EAA8E;AAC9E,2BAA2B;AAC3B,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;AAEpC;;;GAGG;AACH,MAAM,aAAa,GAAG,KAAK,EAAE,KAA8C,EAAE,GAAW,EAAE,CAAS,EAAoC,EAAE;IACxI,IAAI,MAAqB,CAAA;IACzB,IAAI,CAAC;QACJ,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,CAAC,2BAA2B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QACjD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACR,CAAC,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QACvC,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;QACjD,OAAO,SAAS,CAAA;IACjB,CAAC;IAED,CAAC,CAAC,KAAK,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,OAAO,MAAM,CAAC,IAAI,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EAAE,CAAa,EAAE,CAAS,EAAE,IAAmC,EAAE,eAAgC,EAAE,MAAuB,EAAqB,EAAE;IACrL,IAAI,CAAC;QACJ,MAAM,WAAW,GAAG,MAAM,IAAI,EAAE,CAAA;QAChC,MAAM,QAAQ,GAA8B;YAC3C,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;SACzC,CAAA;QAED,IAAI,QAAiB,CAAA;QACrB,IAAI,CAAC;YACJ,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,eAAe,CAAC,CAAA;gBAC/E,QAAQ,GAAG,IAAI,CAAA;YAChB,CAAC;iBAAM,CAAC;gBACP,QAAQ,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;YAC3D,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,2EAA2E;YAC3E,CAAC,CAAC,KAAK,CAAC,2DAA2D,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAClF,MAAM,IAAI,4BAA4B,CAAC,sDAAsD,CAAC,CAAA;QAC/F,CAAC;QAED,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,mFAAmF;YACnF,CAAC,CAAC,IAAI,CAAC,+EAA+E,CAAC,CAAA;YACvF,MAAM,IAAI,wBAAwB,CAAC,qCAAqC,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;QACnG,CAAC;QAED,CAAC,CAAC,IAAI,CAAC,+BAA+B,EACrC,GAAG,KAAK,CACP,aAAa,EAAE,YAAY,EAC3B,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,CAC9D,EACD,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAC1E,CAAA;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,mBAAmB,CAAC;gBACxC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBACpB,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD,KAAK,CAAC,GAAG,YAAY,YAAY,CAAC;gBACjC,wCAAwC;gBACxC,MAAM,GAAG,CAAA;YACV,KAAK,CAAC,GAAG,YAAY,cAAc,CAAC;gBACnC,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD,KAAK,CAAC,GAAG,YAAY,gBAAgB,CAAC;gBACrC,6DAA6D;gBAC7D,6DAA6D;gBAC7D,8CAA8C;gBAC9C,CAAC,CAAC,IAAI,CAAC,iCAAiC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC/D,MAAM,IAAI,4BAA4B,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YACpD;gBACC,kDAAkD;gBAClD,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACxC,MAAM,IAAI,4BAA4B,CAAC,uBAAuB,CAAC,CAAA;QACjE,CAAC;IACF,CAAC;AACF,CAAC,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EAAE,CAAa,EAAE,CAAS,EAAE,MAAc,EAAE,SAAoB,EAAE,eAAgC,EAAqB,EAAE;IACnJ,oCAAoC;IACpC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,CAAC,CAAA;IAChF,QAAQ,MAAM,EAAE,CAAC;QAChB,KAAK,gBAAgB,CAAC,OAAO;YAC5B,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAA;YACxC,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;QAC9D,KAAK,gBAAgB,CAAC,QAAQ;YAC7B,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAA;YAC/B,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,CAAC,CAAA;IACtD,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAElD,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,uEAAuE;YACvE,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAA;YACpD,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpB,CAAC,CAAC,IAAI,CAAC,8CAA8C,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5E,CAAC;QAED,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAA;QAC9B,OAAO,CAAC,CAAC,IAAI,CAAC;YACb,UAAU,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,UAAU;SAC9B,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,QAAQ,IAAI,EAAE,CAAC;YACd,KAAK,CAAC,GAAG,YAAY,YAAY,CAAC;gBACjC,wCAAwC;gBACxC,MAAM,GAAG,CAAA;YACV;gBACC,kDAAkD;gBAClD,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;gBACxC,MAAM,IAAI,4BAA4B,CAAC,uBAAuB,CAAC,CAAA;QACjE,CAAC;IACF,CAAC;AACF,CAAC,CAAA"}

package/dist/api/schema.d.ts

@@ -0,0 +1,72 @@
+import z from "zod";
+import type { SshCaBindings } from "../types.js";
+import { CertificateType } from "../db/types.js";
+/**
+ * Returns the name of a {@link CertificateType} as used in API paths and logs
+ * @param certificateType The type of certificate
+ * @returns "user" or "host"
+ */
+export declare const certificateTypeName: (certificateType: CertificateType) => "user" | "host";
+/**
+ * Returns the OpenAPI tag that groups the endpoints for a {@link CertificateType}
+ * @param certificateType The type of certificate
+ * @returns "User" or "Host"
+ */
+export declare const certificateTypeTag: (certificateType: CertificateType) => "User" | "Host";
+export declare const openapiStringByte: z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>;
+export declare const proofOfPossession: z.ZodString;
+export declare const publicKey: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+export declare const subjectPublicKey: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+export declare const createIdentityTokenSchema: (env: SshCaBindings) => z.ZodPipe<z.ZodString, z.ZodTransform<{
+    sub: string;
+    principals: string[];
+}, string>>;
+export declare const createAccessTokenSchema: (env: SshCaBindings) => z.ZodPipe<z.ZodString, z.ZodTransform<{
+    email: string;
+    sub: string;
+}, string>>;
+export declare const krl: z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>;
+export declare const createHeaderSchema: (env: SshCaBindings) => z.ZodObject<{
+    Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        email: string;
+        sub: string;
+    }, string>>;
+}, z.core.$strip>;
+export declare const certificate: z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>;
+export declare const CaPublicKeyEndpointSchema: {
+    tags: string[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "text/plain": {
+                    schema: z.ZodString;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createRevocationListEndpointSchema: (certificateType: CertificateType) => {
+    tags: ("Host" | "User")[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/api/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/api/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAWhD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AAEhD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oBAAqB,eAAe,KAAG,MAAM,GAAG,MAW/E,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,oBAAqB,eAAe,KAAG,MAAM,GAAG,MAW9E,CAAA;AAED,eAAO,MAAM,iBAAiB,qEASD,CAAA;AAE7B,eAAO,MAAM,iBAAiB,aAI3B,CAAA;AAEH,eAAO,MAAM,SAAS,yJAKnB,CAAA;AAEH,eAAO,MAAM,gBAAgB,yJAM1B,CAAA;AAEH,eAAO,MAAM,yBAAyB,QAAS,aAAa;;;WAO3D,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAS,aAAa;;;WAOzD,CAAA;AAED,eAAO,MAAM,GAAG,qEAC8B,CAAA;AAE9C,eAAO,MAAM,kBAAkB,QAAS,aAAa;;;;;iBAIpD,CAAA;AAED,eAAO,MAAM,WAAW,qEACqB,CAAA;AAE7C,eAAO,MAAM,yBAAyB;;;;;;YAMnC,OAAO;gBACN,YAAY;oBACX,MAAM;;;YAGR,WAAW;;;CAIb,CAAA;AAED,eAAO,MAAM,kCAAkC,oBAAqB,eAAe;;;;;;;;;;;;;;;;;;;;CAgBjF,CAAA"}