@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/dist/api/v4/schema.d.ts

@@ -0,0 +1,268 @@
+import z from "zod";
+import type { SshCaBindings } from "../../types.js";
+import { CertificateType } from "../../db/types.js";
+/**
+ * The name of the header carrying the proof of possession of the private key
+ */
+export declare const ProofHeader = "Proof-Of-Possession";
+export declare const createProofSchema: (env: SshCaBindings) => z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+/**
+ * Headers for a request authorised by a proof of possession alone
+ */
+export declare const createProofHeaderSchema: (env: SshCaBindings) => z.ZodObject<{
+    "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+}, z.core.$strip>;
+/**
+ * Headers for a request authenticated with an access token and authorised by
+ * a proof of possession
+ */
+export declare const createAuthenticatedHeaderSchema: (env: SshCaBindings) => z.ZodObject<{
+    Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        email: string;
+        sub: string;
+    }, string>>;
+    "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+}, z.core.$strip>;
+export declare const serialParamSchema: z.ZodObject<{
+    serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+}, z.core.$strip>;
+export declare const createCaPublicKeyEndpointSchema: () => {
+    tags: string[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "text/plain": {
+                    schema: z.ZodString;
+                };
+            };
+            description: string;
+        };
+    };
+    operationId: string;
+};
+export declare const createGetRevocationListEndpointSchema: (certificateType: CertificateType) => {
+    tags: ("Host" | "User")[];
+    summary: string;
+    description: string;
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        krl: Buffer<ArrayBuffer>;
+                        signature: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+    operationId: string;
+};
+export declare const issueUserCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    public_key: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+    identity: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        sub: string;
+        principals: string[];
+    }, string>>;
+    extensions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createIssueUserCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        extensions: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const issueHostCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    public_key: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/keys.js").PublicKey, Buffer<ArrayBuffer>>>;
+    identity: z.ZodPipe<z.ZodString, z.ZodTransform<{
+        sub: string;
+        principals: string[];
+    }, string>>;
+    principals: z.ZodArray<z.ZodString>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createIssueHostCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    security: {
+        oidcAuth: never[];
+    }[];
+    request: {
+        headers: z.ZodObject<{
+            Authorization: z.ZodPipe<z.ZodString, z.ZodTransform<{
+                email: string;
+                sub: string;
+            }, string>>;
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        public_key: import("../../ssh/keys.js").PublicKey;
+                        identity: {
+                            sub: string;
+                            principals: string[];
+                        };
+                        principals: string[];
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const renewHostCertificateEndpointBodySchema: (env: SshCaBindings) => z.ZodObject<{
+    certificate: z.ZodPipe<z.ZodPipe<z.ZodBase64, z.ZodTransform<Buffer<ArrayBuffer>, string>>, z.ZodTransform<import("../../ssh/certificate.js").SshCertificate, Buffer<ArrayBuffer>>>;
+    lifetime: z.ZodDefault<z.ZodInt>;
+}, z.core.$strip>;
+export declare const createRenewHostCertificateEndpointSchema: (env: SshCaBindings) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    request: {
+        params: z.ZodObject<{
+            serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+        }, z.core.$strip>;
+        headers: z.ZodObject<{
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+        body: {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: import("../../ssh/certificate.js").SshCertificate;
+                        lifetime: number;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: import("../../ssh/certificate.js").SshCertificate;
+                        lifetime: number;
+                    }, unknown>>;
+                };
+            };
+        };
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        certificate: Buffer<ArrayBuffer>;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+export declare const createRevokeCertificateEndpointSchema: (env: SshCaBindings, certificateType: CertificateType) => {
+    tags: ("Host" | "User")[];
+    operationId: string;
+    summary: string;
+    description: string;
+    request: {
+        params: z.ZodObject<{
+            serial: z.ZodPipe<z.ZodString, z.ZodTransform<bigint, string>>;
+        }, z.core.$strip>;
+        headers: z.ZodObject<{
+            "Proof-Of-Possession": z.ZodPipe<z.ZodString, z.ZodTransform<import("../../proof.js").ProofOfPossession, string>>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        "200": {
+            content: {
+                "application/json": {
+                    schema: z.ZodType<{
+                        revoked_at: string;
+                    }, unknown, z.core.$ZodTypeInternals<{
+                        revoked_at: string;
+                    }, unknown>>;
+                };
+            };
+            description: string;
+        };
+    };
+};
+//# sourceMappingURL=schema.d.ts.map

package/dist/api/v4/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/api/v4/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AACnB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAqBnD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAanD;;GAEG;AACH,eAAO,MAAM,WAAW,wBAAwB,CAAA;AAEhD,eAAO,MAAM,iBAAiB,QAAS,aAAa,+FAOnD,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,uBAAuB,QAAS,aAAa;;iBAIzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,+BAA+B,QAAS,aAAa;;;;;;iBAKjE,CAAA;AAED,eAAO,MAAM,iBAAiB;;iBAS5B,CAAA;AAUF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;CAG1C,CAAA;AAEF,eAAO,MAAM,qCAAqC,oBAAqB,eAAe;;;;;;;;;;;;;;;;;;;;;CAGpF,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;;;;;;iBAcxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;;;;QAOzE,OAAO;;;;;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAcJ,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;;;;;;iBAaxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;;;;QAOzE,OAAO;;;;;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAcJ,CAAA;AAEF,eAAO,MAAM,sCAAsC,QAAS,aAAa;;;iBAaxE,CAAA;AAED,eAAO,MAAM,wCAAwC,QAAS,aAAa;;;;;;QAMzE,MAAM;;;QACN,OAAO;;;QACP,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAcJ,CAAA;AAEF,eAAO,MAAM,qCAAqC,QAAS,aAAa,mBAAmB,eAAe;;;;;;QAMxG,MAAM;;;QACN,OAAO;;;;;;;;;;;;;;;;;;CAiBP,CAAA"}

package/dist/api/v4/schema.js

@@ -0,0 +1,186 @@
+import z from "zod";
+import { refineHostPrincipal, refineRenewableCertificate, split, transformCertificate, transformProofOfPossession, } from "../../utils.js";
+import { ConflictException, contentJson, InputValidationException, InternalServerErrorException, TooManyRequestsException, NotFoundException, UnauthorizedException, ForbiddenException, UnprocessableEntityException, } from "chanfana";
+import { seconds } from "itty-time";
+import { isRevoked } from "../../db/index.js";
+import { CertificateType } from "../../db/types.js";
+import { CaPublicKeyEndpointSchema, certificate, certificateTypeName, certificateTypeTag, createAccessTokenSchema, createIdentityTokenSchema, createRevocationListEndpointSchema, openapiStringByte, subjectPublicKey, } from "../schema.js";
+/**
+ * The name of the header carrying the proof of possession of the private key
+ */
+export const ProofHeader = "Proof-Of-Possession";
+export const createProofSchema = (env) => (z.string()
+    .meta({
+    description: "Proof of possession of the private key comprising of `${timestamp}.${fingerprint}.${signature}`. The signature is a BASE64 encoded armored SSHSIG signature, made with the `request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle` namespace, of `${timestamp}.${fingerprint}.${METHOD} ${path}` where `${METHOD} ${path}` is the request the proof is for, for example `DELETE /api/v4/user/certificates/12345678901234567890`. The timestamp is in milliseconds since the Unix epoch.",
+    example: "1765696780805.SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs.LS0tLS1CRUdJTiBTU0ggU0lHTkFUVVJFLS0tLS0K...",
+})
+    .transform((val, ctx) => transformProofOfPossession(env, val, ctx)));
+/**
+ * Headers for a request authorised by a proof of possession alone
+ */
+export const createProofHeaderSchema = (env) => (z.object({
+    [ProofHeader]: createProofSchema(env),
+}));
+/**
+ * Headers for a request authenticated with an access token and authorised by
+ * a proof of possession
+ */
+export const createAuthenticatedHeaderSchema = (env) => (z.object({
+    "Authorization": createAccessTokenSchema(env),
+    [ProofHeader]: createProofSchema(env),
+}));
+export const serialParamSchema = z.object({
+    // a string as JSON cannot carry a bigint and numbers lose precision
+    // above 2^53, and without leading zeros so the path a proof is made for
+    // has only one form
+    serial: z.string()
+        .regex(/^(0|[1-9]\d*)$/)
+        .transform(BigInt)
+        .refine((v) => v <= 0xffffffffffffffffn, { message: "serial must fit in an unsigned 64-bit integer" })
+        .meta({ description: "Serial number of the certificate", example: "12345678901234567890" }),
+});
+const certificateResponse = {
+    ...contentJson(z.object({
+        certificate: certificate,
+    })
+        .openapi("Certificate Response"))
+};
+export const createCaPublicKeyEndpointSchema = () => ({
+    ...CaPublicKeyEndpointSchema,
+    operationId: "get_ca_public_key",
+});
+export const createGetRevocationListEndpointSchema = (certificateType) => ({
+    ...createRevocationListEndpointSchema(certificateType),
+    operationId: `get_${certificateTypeName(certificateType)}_revocation_list`,
+});
+export const issueUserCertificateEndpointBodySchema = (env) => (z.object({
+    public_key: subjectPublicKey,
+    identity: createIdentityTokenSchema(env),
+    extensions: z.array(z.string())
+        .default(split(env.SSH_CERTIFICATE_EXTENSIONS))
+        .meta({ description: "Extensions to include in the issued SSH certificate" }),
+    lifetime: z.int()
+        .min(seconds("5 minutes"))
+        .max(seconds(env.SSH_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of issued SSH certificate" }),
+})
+    .openapi("User Certificate Issue Request"));
+export const createIssueUserCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.User)],
+    operationId: "issue_user_certificate",
+    summary: "Request a user certificate",
+    description: `Issues a signed SSH user certificate for the provided public key. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for \`public_key\` in the \`${ProofHeader}\` header made for this request. Principals on the issued certificate are derived from the identity token.`,
+    security: [{ oidcAuth: [] }],
+    request: {
+        headers: createAuthenticatedHeaderSchema(env),
+        body: contentJson(issueUserCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH User Certificate issued successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+        ...TooManyRequestsException.schema(),
+    }
+});
+export const issueHostCertificateEndpointBodySchema = (env) => (z.object({
+    public_key: subjectPublicKey,
+    identity: createIdentityTokenSchema(env),
+    principals: z.array(z.string().superRefine(refineHostPrincipal)).min(1)
+        .meta({ description: "List of principals to include on the issued certificate" }),
+    lifetime: z.int()
+        .min(seconds("24 hours"))
+        .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of issued Host SSH certificate" }),
+})
+    .openapi("Host Certificate Issue Request"));
+export const createIssueHostCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    operationId: "issue_host_certificate",
+    summary: "Request a host certificate",
+    description: `Issues a signed SSH host certificate for the provided public key and principals. The request must be authenticated with an access token and include an identity token from the OIDC IdP for the same subject, along with a proof of possession of the private key for \`public_key\` in the \`${ProofHeader}\` header made for this request. The user must be permitted to request host certificates by email address or role.`,
+    security: [{ oidcAuth: [] }],
+    request: {
+        headers: createAuthenticatedHeaderSchema(env),
+        body: contentJson(issueHostCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH Host Certificate issued successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+        ...TooManyRequestsException.schema(),
+    }
+});
+export const renewHostCertificateEndpointBodySchema = (env) => (z.object({
+    certificate: openapiStringByte
+        .transform(transformCertificate)
+        .meta({ description: "SSH certificate to renew, which must have the serial number in the path" }),
+    lifetime: z.int()
+        .min(seconds("24 hours"))
+        .max(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .default(seconds(env.SSH_HOST_CERTIFICATE_LIFETIME))
+        .meta({ description: "Lifetime of renewed Host SSH certificate" }),
+})
+    .superRefine((val, ctx) => refineRenewableCertificate(env, isRevoked, val, ctx))
+    .openapi("Host Certificate Renewal Request"));
+export const createRenewHostCertificateEndpointSchema = (env) => ({
+    tags: [certificateTypeTag(CertificateType.Host)],
+    operationId: "renew_host_certificate",
+    summary: "Renew a host certificate",
+    description: `Issues a new SSH host certificate for the same public key and principals as an existing, unexpired and unrevoked host certificate issued by this CA. No OIDC authentication is required; instead the \`${ProofHeader}\` header must contain a proof of possession of the private key for the existing certificate made for this request. The lifetime of the renewed certificate is no longer than that of the existing certificate. The existing certificate is revoked, so it cannot be used or renewed again once the renewed certificate is installed.`,
+    request: {
+        params: serialParamSchema,
+        headers: createProofHeaderSchema(env),
+        body: contentJson(renewHostCertificateEndpointBodySchema(env)),
+    },
+    responses: {
+        "200": {
+            description: "SSH Host Certificate renewed successfully",
+            ...certificateResponse,
+        },
+        ...UnauthorizedException.schema(),
+        ...ForbiddenException.schema(),
+        ...InputValidationException.schema(),
+        ...UnprocessableEntityException.schema(),
+        ...InternalServerErrorException.schema(),
+        ...TooManyRequestsException.schema(),
+    }
+});
+export const createRevokeCertificateEndpointSchema = (env, certificateType) => ({
+    tags: [certificateTypeTag(certificateType)],
+    operationId: `revoke_${certificateTypeName(certificateType)}_certificate`,
+    summary: `Revoke a ${certificateTypeName(certificateType)} certificate`,
+    description: `Revokes a ${certificateTypeName(certificateType)} certificate issued by this CA and adds it to the ${certificateTypeName(certificateType)} Key Revocation List. The \`${ProofHeader}\` header must contain a proof of possession of the private key for the public key that the certificate was issued for, made for this request. A certificate issued for a different public key is reported as not found.`,
+    request: {
+        params: serialParamSchema,
+        headers: createProofHeaderSchema(env),
+    },
+    responses: {
+        "200": {
+            description: `SSH ${certificateTypeName(certificateType)} certificate revoked successfully`,
+            ...contentJson(z.object({
+                revoked_at: z.iso.datetime(),
+            })
+                .openapi("Revocation Response")),
+        },
+        ...InputValidationException.schema(),
+        ...NotFoundException.schema(),
+        ...ConflictException.schema(),
+        ...InternalServerErrorException.schema(),
+        ...TooManyRequestsException.schema(),
+    }
+});
+//# sourceMappingURL=schema.js.map

package/dist/api/v4/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/api/v4/schema.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAA;AAEnB,OAAO,EACN,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,EACL,oBAAoB,EACpB,0BAA0B,GAC1B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACN,iBAAiB,EACjB,WAAW,EACX,wBAAwB,EACxB,4BAA4B,EAC5B,wBAAwB,EACxB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,4BAA4B,GAC5B,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACN,yBAAyB,EACzB,WAAW,EACX,mBAAmB,EACnB,kBAAkB,EAClB,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,cAAc,CAAA;AAErB;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAA;AAEhD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CACxD,CAAC,CAAC,MAAM,EAAE;KACR,IAAI,CAAC;IACL,WAAW,EAAE,0eAA0e;IACvf,OAAO,EAAE,8GAA8G;CACvH,CAAC;KACD,SAAS,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CACpE,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC9D,CAAC,CAAC,MAAM,CAAC;IACR,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;CACrC,CAAC,CACF,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CACtE,CAAC,CAAC,MAAM,CAAC;IACR,eAAe,EAAE,uBAAuB,CAAC,GAAG,CAAC;IAC7C,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,GAAG,CAAC;CACrC,CAAC,CACF,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,oEAAoE;IACpE,wEAAwE;IACxE,oBAAoB;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,KAAK,CAAC,gBAAgB,CAAC;SACvB,SAAS,CAAC,MAAM,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;SACrG,IAAI,CAAC,EAAE,WAAW,EAAE,kCAAkC,EAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;CAC5F,CAAC,CAAA;AAEF,MAAM,mBAAmB,GAAG;IAC3B,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;QACvB,WAAW,EAAE,WAAW;KACxB,CAAC;SACA,OAAO,CAAC,sBAAsB,CAAC,CAChC;CACD,CAAA;AAED,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,EAAE,CAAC,CAAC;IACrD,GAAG,yBAAyB;IAC5B,WAAW,EAAE,mBAAmB;CAChC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,eAAgC,EAAE,EAAE,CAAC,CAAC;IAC3F,GAAG,kCAAkC,CAAC,eAAe,CAAC;IACtD,WAAW,EAAE,OAAO,mBAAmB,CAAC,eAAe,CAAC,kBAAkB;CAC1E,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,gBAAgB;IAC5B,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;SAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IAC9E,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;SACzB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC1C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;SAC9C,IAAI,CAAC,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC;CAC7D,CAAC;KACA,OAAO,CAAC,gCAAgC,CAAC,CAC3C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,kRAAkR,WAAW,4GAA4G;IACtZ,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,+BAA+B,CAAC,GAAG,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,wBAAwB,CAAC,MAAM,EAAE;KACpC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,UAAU,EAAE,gBAAgB;IAC5B,QAAQ,EAAE,yBAAyB,CAAC,GAAG,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;SACrE,IAAI,CAAC,EAAE,WAAW,EAAE,yDAAyD,EAAE,CAAC;IAClF,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,CAAC;CAClE,CAAC;KACA,OAAO,CAAC,gCAAgC,CAAC,CAC3C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,4BAA4B;IACrC,WAAW,EAAE,iSAAiS,WAAW,oHAAoH;IAC7a,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC5B,OAAO,EAAE;QACR,OAAO,EAAE,+BAA+B,CAAC,GAAG,CAAC;QAC7C,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,0CAA0C;YACvD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,wBAAwB,CAAC,MAAM,EAAE;KACpC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAC7E,CAAC,CAAC,MAAM,CAAC;IACR,WAAW,EAAE,iBAAiB;SAC5B,SAAS,CAAC,oBAAoB,CAAC;SAC/B,IAAI,CAAC,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IAClG,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE;SACf,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;SACxB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SAC/C,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;SACnD,IAAI,CAAC,EAAE,WAAW,EAAE,0CAA0C,EAAE,CAAC;CACnE,CAAC;KACA,WAAW,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,0BAA0B,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;KAC/E,OAAO,CAAC,kCAAkC,CAAC,CAC7C,CAAA;AAED,MAAM,CAAC,MAAM,wCAAwC,GAAG,CAAC,GAAkB,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAChD,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,0BAA0B;IACnC,WAAW,EAAE,0MAA0M,WAAW,uUAAuU;IACziB,OAAO,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;QACrC,IAAI,EAAE,WAAW,CAAC,sCAAsC,CAAC,GAAG,CAAC,CAAC;KAC9D;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,2CAA2C;YACxD,GAAG,mBAAmB;SACtB;QACD,GAAG,qBAAqB,CAAC,MAAM,EAAE;QACjC,GAAG,kBAAkB,CAAC,MAAM,EAAE;QAC9B,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,wBAAwB,CAAC,MAAM,EAAE;KACpC;CACD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,qCAAqC,GAAG,CAAC,GAAkB,EAAE,eAAgC,EAAE,EAAE,CAAC,CAAC;IAC/G,IAAI,EAAE,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAC3C,WAAW,EAAE,UAAU,mBAAmB,CAAC,eAAe,CAAC,cAAc;IACzE,OAAO,EAAE,YAAY,mBAAmB,CAAC,eAAe,CAAC,cAAc;IACvE,WAAW,EAAE,aAAa,mBAAmB,CAAC,eAAe,CAAC,qDAAqD,mBAAmB,CAAC,eAAe,CAAC,+BAA+B,WAAW,0NAA0N;IAC3Z,OAAO,EAAE;QACR,MAAM,EAAE,iBAAiB;QACzB,OAAO,EAAE,uBAAuB,CAAC,GAAG,CAAC;KACrC;IACD,SAAS,EAAE;QACV,KAAK,EAAE;YACN,WAAW,EAAE,OAAO,mBAAmB,CAAC,eAAe,CAAC,mCAAmC;YAC3F,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC;gBACvB,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;aAC5B,CAAC;iBACA,OAAO,CAAC,qBAAqB,CAAC,CAC/B;SACD;QACD,GAAG,wBAAwB,CAAC,MAAM,EAAE;QACpC,GAAG,iBAAiB,CAAC,MAAM,EAAE;QAC7B,GAAG,iBAAiB,CAAC,MAAM,EAAE;QAC7B,GAAG,4BAA4B,CAAC,MAAM,EAAE;QACxC,GAAG,wBAAwB,CAAC,MAAM,EAAE;KACpC;CACD,CAAC,CAAA"}

package/dist/certificate.d.ts

@@ -1,5 +1,6 @@
-import type { Certificate, Identity, Key, PrivateKey } from "sshpk";
+import type { PrivateKey, PublicKey } from "./ssh/keys.js";
 import type { SshCaBindings } from "./types.js";
+import { type SshCertificate } from "./ssh/certificate.js";
 export type CreateCertificateOptions = {
     lifetime?: number;
     principals?: string[];
@@ -16,16 +17,18 @@ export type GenerateCertificateOptions = {
      */
     serial?: bigint;
 } & CreateCertificateOptions;
-export declare const generateCertificate: (env: SshCaBindings, email: string, key: PrivateKey, public_key: Key, options?: GenerateCertificateOptions) => Certificate;
-export declare function createSignedCertificate(env: SshCaBindings, email: string, public_key: Key, options?: CreateCertificateOptions): Promise<Certificate>;
+export declare const generateCertificate: (env: SshCaBindings, email: string, key: PrivateKey, public_key: PublicKey, options?: GenerateCertificateOptions) => Promise<SshCertificate>;
+export declare function createSignedCertificate(env: SshCaBindings, email: string, public_key: PublicKey, options?: CreateCertificateOptions): Promise<SshCertificate>;
 export type CreateHostCertificateOptions = {
     lifetime?: number;
     principals?: string[];
-    subjects?: Identity[];
 };
 export declare class BadIssuerError extends Error {
     constructor(message: string);
 }
-export declare function createSignedHostCertificate(env: SshCaBindings, public_key: Key, options?: CreateHostCertificateOptions): Promise<Certificate>;
-export declare const generateSerial: (serial?: bigint) => Buffer<ArrayBuffer>;
+export declare function createSignedHostCertificate(env: SshCaBindings, public_key: PublicKey, options?: CreateHostCertificateOptions): Promise<SshCertificate>;
+/**
+ * Returns a random certificate serial number
+ */
+export declare const generateSerial: () => bigint;
 //# sourceMappingURL=certificate.d.ts.map

package/dist/certificate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAGnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAO/C,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAQD,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAM1B;CACD;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,wBAAwB,CAAA;AAE5B,eAAO,MAAM,mBAAmB,QAAS,aAAa,SAAS,MAAM,OAAO,UAAU,cAAc,GAAG,YAAY,0BAA0B,KAAG,WAkG/I,CAAA;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,WAAW,CAAC,CAa1J;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,WAAW,CAAC,CAsCnJ;AAED,eAAO,MAAM,cAAc,YAAa,MAAM,KAAG,MAAM,CAAC,WAAW,CAUlE,CAAA"}
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../src/certificate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AAE1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAA2C,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGnG,MAAM,MAAM,wBAAwB,GAAG;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAC1C,YAAY,OAAO,EAAE,MAAM,EAM1B;CACD;AAED,MAAM,MAAM,0BAA0B,GAAG;IACxC;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;CACf,GAAG,wBAAwB,CAAA;AAqB5B,eAAO,MAAM,mBAAmB,QAAe,aAAa,SAAS,MAAM,OAAO,UAAU,cAAc,SAAS,YAAY,0BAA0B,KAAG,OAAO,CAAC,cAAc,CAsDjL,CAAA;AAED,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAanK;AAED,MAAM,MAAM,4BAA4B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACrB,CAAA;AAED,qBAAa,cAAe,SAAQ,KAAK;IACxC,YAAY,OAAO,EAAE,MAAM,EAK1B;CACD;AAED,wBAAsB,2BAA2B,CAAC,GAAG,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,4BAA4B,GAAG,OAAO,CAAC,cAAc,CAAC,CAmB5J;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,QAAO,MAEjC,CAAA"}