@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/dist/utils.d.ts

@@ -1,17 +1,73 @@
 import type { SshCaBindings } from "./types.js";
-import type { Certificate, Key, PrivateKey } from "sshpk";
+import { SshCertificate } from "./ssh/certificate.js";
+import { PublicKey, UnsupportedKeyError, type PrivateKey } from "./ssh/keys.js";
 import z from "zod";
 import { CertificateRequestJWTPayload } from "./types.js";
 import { RenewalProofOfPossession, ProofOfPossession } from "./proof.js";
 import type { isRevoked as IsRevokedFn } from "./db/index.js";
+export { UnsupportedKeyError };
 export declare const fatalIssue: (ctx: z.RefinementCtx, message: string, val: unknown) => never;
 export declare const transformProofOfPossession: (env: SshCaBindings, val: string, ctx: z.core.$RefinementCtx<string>) => ProofOfPossession | never;
 type AccessToken = {
     email: string;
     sub: string;
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export declare class TokenClaimError extends Error {
+    constructor(message: string);
+}
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export declare const tokenSubject: (payload: {
+    sub?: unknown;
+}) => string;
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export declare const tokenEmail: (payload: Record<string, unknown>) => {
+    ok: true;
+    email: string;
+} | {
+    ok: false;
+    error: string;
+};
 export declare const transformAuthorizationHeader: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => Promise<AccessToken | never>;
-export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Key | never;
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
+export declare const transformPublicKey: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => PublicKey | never;
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export declare const subjectKeyIssue: (key: PublicKey) => string | undefined;
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export declare const refineSubjectKey: (val: PublicKey, ctx: z.RefinementCtx) => void;
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -32,10 +88,10 @@ export declare const transformIdentityToken: (env: SshCaBindings, val: string, c
  * @param ctx The Zod context for any errors
  * @returns
  */
-export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => Certificate | never;
+export declare const transformCertificate: (val: string | Buffer<ArrayBufferLike>, ctx: z.RefinementCtx) => SshCertificate | never;
 type ParsedCertificateRequest = {
     proof: ProofOfPossession;
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
     identity: IdentityToken;
     extensions: string[];
@@ -43,7 +99,7 @@ type ParsedCertificateRequest = {
 export declare const refineCertificateRequest: (env: SshCaBindings, val: ParsedCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
 export declare const transformRenewalProofOfPossession: (env: SshCaBindings, val: string, ctx: z.RefinementCtx) => RenewalProofOfPossession | never;
 type HostCertificateRequest = {
-    public_key: Key;
+    public_key: PublicKey;
     lifetime: number;
 };
 type ParsedHostCertificateRequest = {
@@ -51,37 +107,67 @@ type ParsedHostCertificateRequest = {
     proof: ProofOfPossession;
 } & HostCertificateRequest;
 export declare const refineHostCertificateRequest: (env: SshCaBindings, val: ParsedHostCertificateRequest, ctx: z.RefinementCtx) => Promise<never>;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export declare const hostPrincipalIssue: (principal: string) => string | undefined;
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export declare const refineHostPrincipal: (val: string, ctx: z.RefinementCtx) => void;
 type ParsedHostCertificateRenewal = {
-    certificate: Certificate;
+    certificate: SshCertificate;
     proof: RenewalProofOfPossession;
 } & HostCertificateRequest;
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export declare const checkRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, certificate: SshCertificate) => Promise<string | undefined>;
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export declare const refineRenewableCertificate: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: {
+    certificate: SshCertificate;
+}, ctx: z.RefinementCtx) => Promise<never>;
 export declare const refineHostCertificateRenewal: (env: SshCaBindings, isRevoked: typeof IsRevokedFn, val: ParsedHostCertificateRenewal, ctx: z.RefinementCtx) => Promise<never>;
 type ParsedRevokeCertificate = {
     serial: bigint;
-    public_key: Key;
+    public_key: PublicKey;
     proof: ProofOfPossession;
 };
 export declare const refineRevokeCertificate: (env: SshCaBindings, val: ParsedRevokeCertificate, ctx: z.RefinementCtx) => Promise<never>;
 export declare const split: (v?: string | string[]) => string[];
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export declare class UnsupportedKeyError extends Error {
-    constructor(message: string);
-}
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export declare const getPrivateKey: (env: SshCaBindings) => Promise<PrivateKey>;
-export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<Key>;
-export {};
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
+export declare const getPublic: (env: SshCaBindings, key?: PrivateKey) => Promise<PublicKey>;
 //# sourceMappingURL=utils.d.ts.map

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AACzD,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAQ7D,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CA6CrI,CAAA;AAED,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,GAAG,GAAG,KA+BtG,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAajI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,WAAW,GAAG,KA+BhH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,GAAG,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,WAAW,CAAA;IACxB,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA+C5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,GAAG,CAAA;IACf,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAY1E,CAAA;AAED,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,GAAG,CAWjF,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,OAAO,EAAyB,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAqD,SAAS,EAAc,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,eAAe,CAAA;AAC9I,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAA;AACzD,OAAO,EAAE,wBAAwB,EAAE,iBAAiB,EAAwB,MAAM,YAAY,CAAA;AAC9F,OAAO,KAAK,EAAE,SAAS,IAAI,WAAW,EAAE,MAAM,eAAe,CAAA;AAK7D,OAAO,EAAE,mBAAmB,EAAE,CAAA;AAE9B,eAAO,MAAM,UAAU,QAAS,CAAC,CAAC,aAAa,WAAW,MAAM,OAAO,OAAO,UAQ7E,CAAA;AAED,eAAO,MAAM,0BAA0B,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAG,iBAAiB,GAAG,KA0BpI,CAAA;AAED,KAAK,WAAW,GAAG;IAClB,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;CACX,CAAA;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACzC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,YAAa;IAAE,GAAG,CAAC,EAAE,OAAO,CAAA;CAAE,KAAG,MAOzD,CAAA;AAcD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,YAAa,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAerH,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,WAAW,GAAG,KAAK,CAsDrI,CAAA;AAOD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,SAAS,GAAG,KA6B5G,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,QAAS,SAAS,KAAG,MAAM,GAAG,SAOzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,gBAAgB,QAAS,SAAS,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAID,eAAO,MAAM,kBAAkB,QAAS,aAAa,WAAW,4BAA4B,UAAU,MAAM,KAAG,MAAM,EAsCpH,CAAA;AAED,KAAK,aAAa,GAAG;IACpB,GAAG,EAAE,MAAM,CAAA;IACX,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,aAAa,QAAe,aAAa,OAAO,MAAM,GAAG,SAAS,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,CActH,CAAA;AAED,eAAO,MAAM,sBAAsB,QAAe,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,aAAa,GAAG,KAAK,CAkBjI,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAS,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,aAAa,KAAG,cAAc,GAAG,KA6BnH,CAAA;AAED,KAAK,wBAAwB,GAAG;IAC/B,KAAK,EAAE,iBAAiB,CAAA;IACxB,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,aAAa,CAAA;IACvB,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AAED,eAAO,MAAM,wBAAwB,QAAe,aAAa,OAAO,wBAAwB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBrI,CAAA;AAED,eAAO,MAAM,iCAAiC,QAAS,aAAa,OAAO,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,wBAAwB,GAAG,KAYpI,CAAA;AAED,KAAK,sBAAsB,GAAG;IAC7B,UAAU,EAAE,SAAS,CAAA;IACrB,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,KAAK,EAAE,iBAAiB,CAAA;CACxB,GAAG,sBAAsB,CAAA;AAE1B,eAAO,MAAM,4BAA4B,QAAe,aAAa,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA4B7I,CAAA;AAQD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,cAAe,MAAM,KAAG,MAAM,GAAG,SAc/D,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,OAAO,CAAC,CAAC,aAAa,KAAG,IAKvE,CAAA;AAED,KAAK,4BAA4B,GAAG;IACnC,WAAW,EAAE,cAAc,CAAA;IAC3B,KAAK,EAAE,wBAAwB,CAAA;CAC/B,GAAG,sBAAsB,CAAA;AAE1B;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,QAAe,aAAa,aAAa,OAAO,WAAW,eAAe,cAAc,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CA8C1J,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,0BAA0B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO;IAAE,WAAW,EAAE,cAAc,CAAA;CAAE,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAkB7K,CAAA;AAED,eAAO,MAAM,4BAA4B,QAAe,aAAa,aAAa,OAAO,WAAW,OAAO,4BAA4B,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CA6B5K,CAAA;AAED,KAAK,uBAAuB,GAAG;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,SAAS,CAAA;IACrB,KAAK,EAAE,iBAAiB,CAAA;CACxB,CAAA;AAED,eAAO,MAAM,uBAAuB,QAAe,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC,aAAa,KAAG,OAAO,CAAC,KAAK,CAmBnI,CAAA;AAED,eAAO,MAAM,KAAK,OAAQ,MAAM,GAAG,MAAM,EAAE,KAAG,MAAM,EAQnD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,aAAa,QAAe,aAAa,KAAG,OAAO,CAAC,UAAU,CAK1E,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,SAAS,QAAe,aAAa,QAAQ,UAAU,KAAG,OAAO,CAAC,SAAS,CAMvF,CAAA"}

package/dist/utils.js

@@ -1,13 +1,13 @@
 import { JWKInvalid, JWKSInvalid, JWSInvalid, JWSSignatureVerificationFailed, JWTClaimValidationFailed, JWTExpired, JWTInvalid } from "jose/errors";
-import sshpk from "sshpk";
+import { CertificateParseError, SshCertificate } from "./ssh/certificate.js";
+import { KeyParseError, MinimumRsaKeyBits, parsePrivateKey, PublicKey, rsaKeyBits, UnsupportedKeyError } from "./ssh/keys.js";
 import z from "zod";
-import { verifyJWT } from "./verify.js";
+import { MissingAudienceError, verifyJWT } from "./verify.js";
 import { RenewalProofOfPossession, ProofOfPossession, PossessionParseError } from "./proof.js";
 import { logger } from "./logger.js";
 import { ms } from "itty-time";
 import { InternalServerErrorException } from "chanfana";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { KeyParseError, CertificateParseError, parseCertificate, parseKey, parsePrivateKey } = sshpk;
+export { UnsupportedKeyError };
 export const fatalIssue = (ctx, message, val) => {
     ctx.issues.push({
         code: "custom",
@@ -42,6 +42,64 @@ export const transformProofOfPossession = (env, val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Thrown when a claim of a verified token is missing or is not of the
+ * expected type.
+ */
+export class TokenClaimError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "TokenClaimError";
+        Object.setPrototypeOf(this, TokenClaimError.prototype);
+    }
+}
+const SubjectClaimSchema = z.string().min(1);
+/**
+ * Returns the subject of a verified token, which is compared between the
+ * access and identity tokens so must always be present.
+ *
+ * @param payload The payload of a verified token
+ * @returns The `sub` claim of the token
+ * @throws {@link TokenClaimError} when the `sub` claim is missing, empty or not a string
+ */
+export const tokenSubject = (payload) => {
+    const parsed = SubjectClaimSchema.safeParse(payload.sub);
+    if (!parsed.success) {
+        throw new TokenClaimError("JWT was verified but was missing required sub claim");
+    }
+    return parsed.data;
+};
+/**
+ * The claims of an access token that identify the user's email address.
+ *
+ * `email_verified` is optional as not every IdP includes it, but when it is
+ * included it must be true, as an IdP may otherwise issue a token for an
+ * address the user has not shown they control.
+ */
+const EmailClaimsSchema = z.object({
+    email: z.email(),
+    email_verified: z.boolean().optional(),
+});
+/**
+ * Returns the email address of a verified access token, or why it cannot be
+ * used.
+ *
+ * @param payload The payload of a verified access token
+ * @returns The email address, or an error message if the claims are not acceptable
+ */
+export const tokenEmail = (payload) => {
+    if (payload.email === undefined) {
+        return { ok: false, error: "JWT was verified but was missing required email claim" };
+    }
+    const parsed = EmailClaimsSchema.safeParse(payload);
+    if (!parsed.success) {
+        return { ok: false, error: "JWT was verified but the email or email_verified claim was not valid" };
+    }
+    if (parsed.data.email_verified === false) {
+        return { ok: false, error: "JWT was verified but the email address has not been verified by the IdP" };
+    }
+    return { ok: true, email: parsed.data.email };
+};
 export const transformAuthorizationHeader = async (env, val, ctx) => {
     if (!val.startsWith("Bearer ") || val.length <= 7) {
         return fatalIssue(ctx, "authorization header must be a Bearer token", val);
@@ -52,18 +110,27 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
         return fatalIssue(ctx, "request did not contain a JWT", val);
     }
     try {
-        // verify jwt
-        const { payload } = await verifyJWT(env, jwt);
-        if (payload.email === undefined) {
-            return fatalIssue(ctx, "JWT was verified but was missing required email claim", val);
+        // verify jwt, which must be issued for this CA
+        const aud = split(env.JWT_ACCESS_TOKEN_AUD).length > 0 ? env.JWT_ACCESS_TOKEN_AUD : env.JWT_AUD;
+        const { payload } = await verifyJWT(env, jwt, aud);
+        const email = tokenEmail(payload);
+        if (!email.ok) {
+            l.warn(email.error, "in", "transformAuthorizationHeader");
+            return fatalIssue(ctx, email.error, val);
         }
         return {
-            email: payload.email,
-            sub: payload.sub,
+            email: email.email,
+            sub: tokenSubject(payload),
         };
     }
     catch (err) {
         switch (true) {
+            case (err instanceof MissingAudienceError):
+                // a misconfigured CA is a server error, not a validation failure
+                l.error(err.message, "in", "transformAuthorizationHeader");
+                throw new InternalServerErrorException(err.message);
+            case (err instanceof TokenClaimError):
+                return fatalIssue(ctx, err.message, val);
             case (err instanceof JWSInvalid):
                 return fatalIssue(ctx, "the access token was invalid", val);
             case (err instanceof JWTInvalid):
@@ -84,10 +151,19 @@ export const transformAuthorizationHeader = async (env, val, ctx) => {
         }
     }
 };
+// decodes a value sent as base64, which may already have been decoded by the schema
+const fromBase64 = (val) => {
+    return (typeof val === "string" ? Buffer.from(val, "base64") : Buffer.from(val)).toString("utf8");
+};
+/**
+ * Parses a public key in OpenSSH format, `${type} ${base64}[ ${comment}]`
+ *
+ * @param val The public key, either base64 encoded or as bytes
+ * @param ctx The Zod context for any errors
+ */
 export const transformPublicKey = (val, ctx) => {
     try {
-        const key = typeof val === "string" ? parseKey(Buffer.from(val, "base64")) : parseKey(val);
-        return key;
+        return PublicKey.parse(fromBase64(val));
     }
     catch (err) {
         switch (true) {
@@ -115,6 +191,33 @@ export const transformPublicKey = (val, ctx) => {
         return z.NEVER;
     }
 };
+/**
+ * Returns why a public key cannot be issued a certificate, or undefined if it
+ * can be.
+ *
+ * RSA keys must be at least {@link MinimumRsaKeyBits} bits, as smaller keys
+ * can be factored and are refused by current OpenSSH releases.
+ *
+ * @param key The public key a certificate would be issued for
+ * @returns The reason the key cannot be used, or undefined if it can be
+ */
+export const subjectKeyIssue = (key) => {
+    const bits = rsaKeyBits(key);
+    if (bits !== undefined && bits < MinimumRsaKeyBits) {
+        return `RSA keys must be at least ${MinimumRsaKeyBits} bits, not ${bits}`;
+    }
+    return undefined;
+};
+/**
+ * Refines a public key so only one allowed by {@link subjectKeyIssue} is
+ * accepted for a certificate request.
+ */
+export const refineSubjectKey = (val, ctx) => {
+    const issue = subjectKeyIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val.toString());
+    }
+};
 /**
  * Thrown by {@link identityPrincipals} when the principals claim of an
  * identity token is not a string or an array of strings.
@@ -161,11 +264,11 @@ export const parseIdentity = async (env, jwt, claim) => {
     if (jwt === undefined) {
         throw new Error("missing identity token");
     }
-    const aud = split(env.JWT_AUD);
-    const { payload } = await verifyJWT(env, jwt, { aud: aud.length === 0 ? undefined : aud });
+    const { payload } = await verifyJWT(env, jwt, env.JWT_AUD);
+    const sub = tokenSubject(payload);
     const principals = identityPrincipals(env, payload, claim);
     return {
-        sub: payload.sub,
+        sub: sub,
         principals: principals,
     };
 };
@@ -175,9 +278,14 @@ export const transformIdentityToken = async (env, val, ctx) => {
         return identity;
     }
     catch (err) {
+        // a misconfigured CA is a server error, not a validation failure
+        if (err instanceof MissingAudienceError) {
+            logger(env).error(err.message, "in", "transformIdentityToken");
+            throw new InternalServerErrorException(err.message);
+        }
         ctx.issues.push({
             code: "custom",
-            message: err instanceof PrincipalsClaimError ? err.message : "problem parsing identity token",
+            message: err instanceof PrincipalsClaimError || err instanceof TokenClaimError ? err.message : "problem parsing identity token",
             input: val
         });
         return z.NEVER;
@@ -191,8 +299,7 @@ export const transformIdentityToken = async (env, val, ctx) => {
  */
 export const transformCertificate = (val, ctx) => {
     try {
-        const cert = typeof val === "string" ? parseCertificate(Buffer.from(val, "base64"), "openssh") : parseCertificate(val, "openssh");
-        return cert;
+        return SshCertificate.parse(fromBase64(val));
     }
     catch (err) {
         switch (true) {
@@ -257,7 +364,7 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
     l.debug("started");
     try {
         // check proof of possession fingerprint matches public key
-        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString("ssh"));
+        l.debug("checking val.proof.matches()", "public_key", val.public_key.toString());
         if (!val.proof.matches(val.public_key)) {
             l.warn("proof of possession fingerprint did not match public_key");
             return fatalIssue(ctx, "proof of possession fingerprint did not match public_key", val);
@@ -277,31 +384,129 @@ export const refineHostCertificateRequest = async (env, val, ctx) => {
         return fatalIssue(ctx, "proof of possession verification unhandled error", val);
     }
 };
-export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) => {
+// characters that OpenSSH treats as pattern syntax when matching host
+// certificate principals, or that separate entries in a pattern list
+const HostPrincipalPatternChars = /[*?!,]/;
+// whitespace and control characters, which no host name contains
+const HostPrincipalInvalidChars = /[\s\p{Cc}]/u;
+/**
+ * Returns why a principal cannot be included on a host certificate, or
+ * undefined if it can be.
+ *
+ * OpenSSH matches the principals of a host certificate as patterns, so a
+ * principal such as `*` would make the certificate valid for every host that
+ * trusts the CA. Principals are otherwise not restricted, as hosts may be
+ * reached by IP address, bare host name or fully qualified domain name.
+ *
+ * @param principal The principal to check
+ * @returns The reason the principal cannot be used, or undefined if it can be
+ */
+export const hostPrincipalIssue = (principal) => {
+    if (principal === "") {
+        return "host certificate principals must not be empty";
+    }
+    if (HostPrincipalPatternChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain wildcard or pattern characters (*, ?, ! or ,)`;
+    }
+    if (HostPrincipalInvalidChars.test(principal)) {
+        return `host certificate principal ${JSON.stringify(principal)} must not contain whitespace or control characters`;
+    }
+    return undefined;
+};
+/**
+ * Refines a host certificate principal so only one allowed by
+ * {@link hostPrincipalIssue} is accepted.
+ */
+export const refineHostPrincipal = (val, ctx) => {
+    const issue = hostPrincipalIssue(val);
+    if (issue !== undefined) {
+        fatalIssue(ctx, issue, val);
+    }
+};
+/**
+ * Checks a certificate presented for renewal was issued by this CA, is a host
+ * certificate whose principals are allowed (see {@link hostPrincipalIssue}),
+ * is within its validity period and has not been revoked.
+ *
+ * @param env The CA bindings
+ * @param isRevoked Returns whether a serial has been revoked
+ * @param certificate The certificate presented for renewal
+ * @returns The reason the certificate cannot be renewed, or undefined if it can be
+ * @throws {@link UnsupportedKeyError} when the CA key is not supported
+ */
+export const checkRenewableCertificate = async (env, isRevoked, certificate) => {
+    // ensure certificate is signed by CA
+    const issuer = await getPublic(env);
+    if (!await certificate.isSignedBy(issuer)) {
+        return "the provided certificate was not signed by this CA";
+    }
+    // only host certificates can be renewed, as renewal does not need the
+    // OIDC authentication a user certificate is issued with
+    if (certificate.kind !== "host") {
+        return "the provided certificate is not a host certificate";
+    }
+    // a certificate issued before small RSA keys were refused must not be
+    // renewed, as the renewal would keep its key
+    const keyIssue = subjectKeyIssue(certificate.publicKey);
+    if (keyIssue !== undefined) {
+        return `the provided certificate cannot be renewed: ${keyIssue}`;
+    }
+    // a certificate issued before wildcard principals were refused must not
+    // be renewed, as the renewal would keep its principals
+    for (const principal of certificate.principals) {
+        const issue = hostPrincipalIssue(principal);
+        if (issue !== undefined) {
+            return `the provided certificate cannot be renewed: ${issue}`;
+        }
+    }
+    // check certificate is within its validity period, allowing for clock
+    // skew at the start as a certificate issued moments ago may have a
+    // validity start up to a second in the future
+    const now = Date.now();
+    if (now >= certificate.validBefore.getTime()) {
+        return "the provided certificate is expired";
+    }
+    if (certificate.validAfter.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
+        return "the provided certificate is not yet valid";
+    }
+    // ensure certificate presented for renewal is not revoked
+    if (await isRevoked(env, certificate.serial)) {
+        return "the provided certificate is revoked";
+    }
+    return undefined;
+};
+/**
+ * Refines a host certificate renewal so only a certificate that can be
+ * renewed (see {@link checkRenewableCertificate}) is accepted.
+ */
+export const refineRenewableCertificate = async (env, isRevoked, val, ctx) => {
     const l = logger(env);
     try {
-        // ensure certificate is signed by CA
-        const issuer = await getPublic(env);
-        if (!val.certificate.isSignedByKey(issuer)) {
-            return fatalIssue(ctx, "the provided certificate was not signed by this CA", val);
+        const reason = await checkRenewableCertificate(env, isRevoked, val.certificate);
+        if (reason !== undefined) {
+            return fatalIssue(ctx, reason, val);
         }
-        // check certificate is within its validity period, allowing for clock
-        // skew at the start as a certificate issued moments ago may have a
-        // validity start up to a second in the future
-        const now = Date.now();
-        if (now >= val.certificate.validUntil.getTime()) {
-            return fatalIssue(ctx, "the provided certificate is expired", val);
-        }
-        if (val.certificate.validFrom.getTime() > now + ms(env.CERTIFICATE_REQUEST_TIME_SKEW_MAX)) {
-            return fatalIssue(ctx, "the provided certificate is not yet valid", val);
+        return z.NEVER;
+    }
+    catch (err) {
+        // a misconfigured CA key is a server error, not a validation failure
+        if (err instanceof UnsupportedKeyError) {
+            l.error(err.message, "in", "refineRenewableCertificate");
+            throw new InternalServerErrorException(err.message);
         }
-        // ensure certificate presented for renewal is not revoked
-        const serial = val.certificate.serial.readBigUInt64BE(0);
-        if (await isRevoked(env, serial)) {
-            return fatalIssue(ctx, "the provided certificate is revoked", val);
+        l.error("certificate renewal check unhandled error", "in", "refineRenewableCertificate", "error", err);
+        return fatalIssue(ctx, "certificate renewal check unhandled error", val);
+    }
+};
+export const refineHostCertificateRenewal = async (env, isRevoked, val, ctx) => {
+    const l = logger(env);
+    try {
+        const reason = await checkRenewableCertificate(env, isRevoked, val.certificate);
+        if (reason !== undefined) {
+            return fatalIssue(ctx, reason, val);
         }
         // check proof of possession fingerprint matches public key and certificate subject key
-        if (!val.proof.matches(val.public_key, val.certificate.subjectKey)) {
+        if (!val.proof.matches(val.public_key, val.certificate.publicKey)) {
             return fatalIssue(ctx, "proof of possession fingerprints did not match public_key and/or certificate", val);
         }
         // verify proof of possession signature
@@ -349,46 +554,27 @@ export const split = (v) => {
                 : v.split(",")
             : v;
 };
-/**
- * Thrown by {@link getPrivateKey} when the CA private key is of a type that
- * cannot be used.
- */
-export class UnsupportedKeyError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "UnsupportedKeyError";
-        Object.setPrototypeOf(this, UnsupportedKeyError.prototype);
-    }
-}
 /**
  * Load and parse the CA private key from the `PRIVATE_KEY` secret.
  *
- * Only Ed25519 and ECDSA keys are supported. RSA keys are rejected because
- * sshpk signs RSA certificates with SHA-1 (`ssh-rsa`), which OpenSSH 8.2 and
- * later refuse by default, and because RSA keys in OpenSSH format are
- * converted with invalid CRT parameters that the Workers runtime rejects.
+ * Only Ed25519 and ECDSA keys are supported, as these are the key types that
+ * certificates and KRLs are signed with (see `createSigner` in `ssh/signer.ts`).
  *
- * @throws KeyParseError when the secret cannot be parsed.
+ * @throws {@link KeyParseError} when the secret cannot be parsed.
  * @throws {@link UnsupportedKeyError} when the key is not Ed25519 or ECDSA.
  */
 export const getPrivateKey = async (env) => {
     // grab private key from secret store
     const secret = await env.PRIVATE_KEY.get();
-    // parse it
-    const key = parsePrivateKey(secret);
-    if (key.type !== "ed25519" && key.type !== "ecdsa") {
-        throw new UnsupportedKeyError(`CA key type ${key.type} is not supported, the CA key must be Ed25519 or ECDSA`);
-    }
-    return key;
+    return parsePrivateKey(secret);
 };
+/**
+ * Returns the public key of the CA, with `ISSUER_DN` as its comment
+ */
 export const getPublic = async (env, key) => {
     if (key === undefined) {
         key = await getPrivateKey(env);
     }
-    // convert to a public key and add comment
-    const pub = key.toPublic();
-    pub.comment = env.ISSUER_DN;
-    // return in ssh format trimmed of any whitespace
-    return pub;
+    return key.publicKey.withComment(env.ISSUER_DN);
 };
 //# sourceMappingURL=utils.js.map