@andrewheberle/serverless-ssh-ca 0.22.0 → 0.24.0

package/dist/node/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAmD,EACnD,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAA;AAC9E,CAAC,CAAA"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/node/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AACnC,OAAO,CAAC,MAAM,KAAK,CAAA;AAGnB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAA;AAErE,qEAAqE;AACrE,MAAM,QAAQ,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;IACtE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AAC/D,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,2CAA2C,CAAC,CAAC,CAAC,kDAAkD,EAAE,CAAC,CAAA;AAElI,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAA;AAEvF;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,wBAAwB,EAAE,CAAC,CAAC,KAAK,CAAC;QACjC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QACrB,wDAAwD;QACxD,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0DAA0D,CAAC;KAC5E,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC;IACtE,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE;IACtC,wBAAwB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxD,4BAA4B,EAAE,OAAO,CAAC,QAAQ,EAAE;IAChD,kCAAkC,EAAE,OAAO,CAAC,QAAQ,EAAE;IACtD,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjD,6BAA6B,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7D,mCAAmC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1D,kCAAkC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzD,SAAS,EAAE,QAAQ;IACnB,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;IACtF,OAAO,EAAE,QAAQ;IACjB,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,QAAQ;IACpB,cAAc,EAAE,QAAQ;IACxB,oCAAoC,EAAE,QAAQ;IAC9C,iCAAiC,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAChE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC3E,CAAC,CAAA;AAOF;;GAEG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACnD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;QAEvC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,yBAAyB,CAAC,SAAS,CAAC,CAAA;IACjE,CAAC;CACD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAC9B,QAAkG,EAClG,MAAM,GAAuC,OAAO,CAAC,GAAG,EACxC,EAAE;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,yBAAyB,CAAC,2BAA2B,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAChG,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAA;AAC1I,CAAC,CAAA"}

package/dist/node/index.d.ts

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export type { CaEnv } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";

package/dist/node/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAChF,YAAY,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AACrC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/node/index.js

@@ -16,6 +16,7 @@
  *
  * @packageDocumentation
  */
+export { cacheInMemory } from "./cache.js";
 export { bindingsFromEnv, EnvSchema, InvalidConfigurationError } from "./env.js";
 export { secretFromFile, secretFromString } from "./secret.js";
 export { fromNodeSqlite } from "./sqlite.js";

package/dist/node/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/node/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,yBAAyB,EAAE,MAAM,UAAU,CAAA;AAEhF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA"}

package/dist/proof.d.ts

@@ -1,7 +1,22 @@
-import type { Fingerprint, Key } from "sshpk";
+import { PublicKey } from "./ssh/keys.js";
 import { Sig } from "./sshsig/sig.js";
 import { Logger } from "@andrewheberle/ts-slog";
 export declare const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export declare const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export declare const requestBinding: (method: string, path: string) => string;
 export declare class PossessionParseError extends Error {
     constructor(message: string, cause?: unknown);
 }
@@ -21,9 +36,10 @@ export declare class PossessionParseError extends Error {
  */
 export declare class ProofOfPossession {
     readonly timestamp: number;
-    readonly fingerprint: Fingerprint;
+    /** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
+    readonly fingerprint: string;
     readonly signature: Sig;
-    readonly signaturePubkey: Key;
+    readonly signaturePubkey: PublicKey;
     readonly logger: Logger;
     private readonly data;
     constructor(proof: string, options?: {
@@ -36,19 +52,32 @@ export declare class ProofOfPossession {
      * @returns true if signature is valid, false otherwise
      */
     verify(namespace?: string): Promise<boolean>;
+    /**
+     * Verifies the proof was made for a specific request, so it cannot be
+     * replayed against another endpoint or with other path parameters (such
+     * as a different certificate serial).
+     *
+     * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+     * the {@link RequestNamespace} namespace.
+     *
+     * @param method The HTTP method of the request
+     * @param path The path of the request with any parameters filled in
+     * @returns true if signature is valid for the request, false otherwise
+     */
+    verifyRequest(method: string, path: string): Promise<boolean>;
     /**
      *
      * @param keys array of keys to verify finterprint against
      * @returns true if the proof of possession fingerprint matches any of the provided keys, false otherwise
      */
-    matches(key: Key): boolean;
-    matches(...keys: Key[]): boolean;
+    matches(key: PublicKey): boolean;
+    matches(...keys: PublicKey[]): boolean;
 }
 export declare class PossessionMatchError extends Error {
     constructor(message: string, cause?: unknown);
 }
 export declare class RenewalProofOfPossession extends ProofOfPossession {
-    matches(key: Key): never;
-    matches(...keys: Key[]): boolean;
+    matches(key: PublicKey): never;
+    matches(...keys: PublicKey[]): boolean;
 }
 //# sourceMappingURL=proof.d.ts.map

package/dist/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAG7C,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAS,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAKhE,eAAO,MAAM,SAAS,mEAAmE,CAAA;AAEzF,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAE9B,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAkEpF;IAED;;;OAGG;IACG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAA;IAC1B,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;CAuBhC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;IACrD,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAA;IACxB,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;CAwBzC"}
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,SAAS,EAAE,MAAM,eAAe,CAAA;AAGxD,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AACrC,OAAO,EAAS,MAAM,EAAY,MAAM,wBAAwB,CAAA;AAKhE,eAAO,MAAM,SAAS,mEAAmE,CAAA;AAEzF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,2EAA2E,CAAA;AAExG;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,WAAY,MAAM,QAAQ,MAAM,KAAG,MAE7D,CAAA;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAiB;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAA;IACvB,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAQ;IAE9B,YAAY,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAiEpF;IAED;;;OAGG;IACG,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAEjD;IAED;;;;;;;;;;;OAWG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAElE;IAED;;;;OAIG;IACH,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAA;IAChC,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;CAuBtC;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAO3C;CACD;AAED,qBAAa,wBAAyB,SAAQ,iBAAiB;IACrD,OAAO,CAAC,GAAG,EAAE,SAAS,GAAG,KAAK,CAAA;IAC9B,OAAO,CAAC,GAAG,IAAI,EAAE,SAAS,EAAE,GAAG,OAAO,CAAA;CAwB/C"}

package/dist/proof.js

@@ -1,11 +1,28 @@
 import { ms } from "itty-time";
-import sshpk from "sshpk";
+import { KeyParseError, PublicKey } from "./ssh/keys.js";
 import { verify } from "./sshsig/index.js";
 import { parse } from "./sshsig/sig_parser.js";
 import { group, Logger, LogLevel } from "@andrewheberle/ts-slog";
-// sshpk is CommonJS and Node's ESM loader cannot detect most of its named exports, so values are taken from the default import
-const { FingerprintFormatError, parseFingerprint, parseKey } = sshpk;
+// a SHA256 fingerprint as shown by ssh-keygen -l, which is unpadded base64
+const FingerprintFormat = /^SHA256:[A-Za-z0-9+/]{43}$/;
 export const Namespace = "proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * The namespace used for proofs of possession that are bound to a request,
+ * kept separate from {@link Namespace} so a proof made for one form can never
+ * be accepted as the other.
+ */
+export const RequestNamespace = "request-proof-of-possession@com.github.serverless-ssh-ca.andrewheberle";
+/**
+ * Returns the request a proof of possession is bound to, which is appended to
+ * the signed data as `${timestamp}.${fingerprint}.${binding}`.
+ *
+ * @param method The HTTP method of the request, for example "DELETE"
+ * @param path The path of the request with any parameters filled in, for example "/api/v4/user/certificates/123"
+ * @returns The request binding, for example "DELETE /api/v4/user/certificates/123"
+ */
+export const requestBinding = (method, path) => {
+    return `${method.toUpperCase()} ${path}`;
+};
 export class PossessionParseError extends Error {
     constructor(message, cause) {
         super(message);
@@ -31,6 +48,7 @@ export class PossessionParseError extends Error {
  */
 export class ProofOfPossession {
     timestamp;
+    /** The SHA256 fingerprint of the key, for example "SHA256:79mq0wtpQMTvS4+Of8VzLN0qmYWNUyTXYmqKwhEgSLs" */
     fingerprint;
     signature;
     signaturePubkey;
@@ -58,10 +76,9 @@ export class ProofOfPossession {
             throw new PossessionParseError("timestamp was from the future");
         }
         try {
-            // parse fingerprint
-            const fingerprint = parseFingerprint(fingerprintString);
-            if (fingerprint === undefined) {
-                throw new PossessionParseError("fingerprint did not parse");
+            // check fingerprint
+            if (!FingerprintFormat.test(fingerprintString)) {
+                throw new PossessionParseError("proof of possession fingerprint was an invalid format");
             }
             // convert siganture from base64
             const signature = Buffer.from(signatureBase64, "base64").toString();
@@ -73,19 +90,19 @@ export class ProofOfPossession {
             catch (err) {
                 throw new PossessionParseError("proof of possession signature could not be parsed", err);
             }
-            this.fingerprint = fingerprint;
+            this.fingerprint = fingerprintString;
             this.data = `${timestamp}.${fingerprintString}`;
-            this.signaturePubkey = parseKey(this.signature.publickey.toString());
+            this.signaturePubkey = PublicKey.parse(this.signature.publickey.toString());
             // ensure the provided fingerprint matches the signature public key
-            if (!this.fingerprint.matches(this.signaturePubkey)) {
+            if (this.fingerprint !== this.signaturePubkey.fingerprint()) {
                 throw new PossessionParseError("proof of possession fingerprint does not match signature public key");
             }
-            this.logger.debug("constructor completed", ...group("this", "timestamp", this.timestamp, "fingerprint", this.fingerprint.toString("base64"), "signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint().toString("base64")));
+            this.logger.debug("constructor completed", ...group("this", "timestamp", this.timestamp, "fingerprint", this.fingerprint, "signaturePubkey.fingerprint()", this.signaturePubkey.fingerprint()));
         }
         catch (err) {
             switch (true) {
-                case (err instanceof FingerprintFormatError):
-                    throw new PossessionParseError("proof of possession fingerprint was an invalid format", err);
+                case (err instanceof KeyParseError):
+                    throw new PossessionParseError(`proof of possession signature key could not be used: ${err.message}`, err);
                 default:
                     throw err;
             }
@@ -98,17 +115,32 @@ export class ProofOfPossession {
     async verify(namespace) {
         return await verify(this.signature, this.data, { namespace: namespace || Namespace });
     }
+    /**
+     * Verifies the proof was made for a specific request, so it cannot be
+     * replayed against another endpoint or with other path parameters (such
+     * as a different certificate serial).
+     *
+     * The signed data is `${timestamp}.${fingerprint}.${METHOD} ${path}` using
+     * the {@link RequestNamespace} namespace.
+     *
+     * @param method The HTTP method of the request
+     * @param path The path of the request with any parameters filled in
+     * @returns true if signature is valid for the request, false otherwise
+     */
+    async verifyRequest(method, path) {
+        return await verify(this.signature, `${this.data}.${requestBinding(method, path)}`, { namespace: RequestNamespace });
+    }
     matches(...keys) {
         this.logger.debug("matches() called", "in", "ProofOfPossession", "keys", keys.length);
         try {
             for (const key of keys) {
                 // confirm proof of possession fingerprint matches keys
-                this.logger.debug("this.fingerprint.matches()", "in", "ProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"));
-                if (!this.fingerprint.matches(key))
+                this.logger.debug("comparing fingerprint", "in", "ProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString());
+                if (this.fingerprint !== key.fingerprint())
                     return false;
                 // also confirm key used to sign proof of possession matches
-                this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"));
-                if (!this.signaturePubkey.fingerprint().matches(key))
+                this.logger.debug("comparing signature public key", "in", "ProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString());
+                if (!this.signaturePubkey.equals(key))
                     return false;
             }
             this.logger.debug("matches() completed", "in", "ProofOfPossession", "keys", keys.length);
@@ -137,11 +169,11 @@ export class RenewalProofOfPossession extends ProofOfPossession {
         }
         try {
             for (const key of keys) {
-                this.logger.debug("this.fingerprint.matches()", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint.toString("base64"), "key", key.toString("ssh"));
-                if (!this.fingerprint.matches(key))
+                this.logger.debug("comparing fingerprint", "in", "RenewalProofOfPossession", "fingerprint", this.fingerprint, "key", key.toString());
+                if (this.fingerprint !== key.fingerprint())
                     return false;
-                this.logger.debug("this.signaturePubkey.fingerprint().matches()", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint().toString("base64"), "key", key.toString("ssh"));
-                if (!this.signaturePubkey.fingerprint().matches(key))
+                this.logger.debug("comparing signature public key", "in", "RenewalProofOfPossession", "signaturePubkey", this.signaturePubkey.fingerprint(), "key", key.toString());
+                if (!this.signaturePubkey.equals(key))
                     return false;
             }
             this.logger.debug("matches() completed", "in", "RenewalProofOfPossession", "keys", keys.length);

package/dist/proof.js.map

@@ -1 +1 @@
-{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,KAAK,MAAM,OAAO,CAAA;AAEzB,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEhE,+HAA+H;AAC/H,MAAM,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;AAEpE,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAA;AAEzF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAQ;IACjB,WAAW,CAAa;IACxB,SAAS,CAAK;IACd,eAAe,CAAK;IACpB,MAAM,CAAQ;IACN,IAAI,CAAQ;IAE9B,YAAY,KAAa,EAAE,OAA2D;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,GAAG,KAAK,CAAA;QAEhE,mBAAmB;QACnB,MAAM,SAAS,GAAW,QAAQ,CAAC,YAAa,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACpE,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,CAAC;YACJ,oBAAoB;YACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,iBAAkB,CAAC,CAAA;YACxD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAoB,CAAC,2BAA2B,CAAC,CAAA;YAC5D,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAgB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;YAEpE,aAAa;YACb,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC1B,IAAI,CAAC;gBACJ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;YAC9B,IAAI,CAAC,IAAI,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC/C,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;YAEpE,mEAAmE;YACnE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;gBACrD,MAAM,IAAI,oBAAoB,CAAC,qEAAqE,CAAC,CAAA;YACtG,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EACxC,GAAG,KAAK,CAAC,MAAM,EACd,WAAW,EAAE,IAAI,CAAC,SAAS,EAC3B,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAClD,+BAA+B,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CACtF,CACD,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,IAAI,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,YAAY,sBAAsB,CAAC;oBAC3C,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAA;gBAC7F;oBACC,MAAM,GAAG,CAAA;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAkB;QAC9B,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC,CAAA;IACtF,CAAC;IAUD,OAAO,CAAC,GAAG,IAAW;QACrB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACrF,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBAC1J,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjC,OAAO,KAAK,CAAA;gBAEb,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBAClM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;oBACnD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACxF,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC7E,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAIrD,OAAO,CAAC,GAAG,IAAW;QAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,6CAA6C,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4BAA4B,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACjK,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC;oBACjC,OAAO,KAAK,CAAA;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBACzM,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;oBACnD,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACvF,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../src/proof.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,WAAW,CAAA;AAC9B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,wBAAwB,CAAA;AAE9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAA;AAEhE,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,4BAA4B,CAAA;AAEtD,MAAM,CAAC,MAAM,SAAS,GAAG,gEAAgE,CAAA;AAEzF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,wEAAwE,CAAA;AAExG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,IAAY,EAAU,EAAE;IACtE,OAAO,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAA;AACzC,CAAC,CAAA;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAiB;IACpB,SAAS,CAAQ;IAC1B,0GAA0G;IACjG,WAAW,CAAQ;IACnB,SAAS,CAAK;IACd,eAAe,CAAW;IAC1B,MAAM,CAAQ;IACN,IAAI,CAAQ;IAE9B,YAAY,KAAa,EAAE,OAA2D;QACpF,IAAI,CAAC,MAAM,GAAG,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAA;QACtG,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,eAAe,CAAC,GAAG,KAAK,CAAA;QAEhE,mBAAmB;QACnB,MAAM,SAAS,GAAW,QAAQ,CAAC,YAAa,EAAE,EAAE,CAAC,CAAA;QACrD,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,oBAAoB,CAAC,4BAA4B,CAAC,CAAA;QAC7D,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACpE,MAAM,GAAG,GAAG,GAAG,GAAG,SAAS,CAAA;QAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAA;QAC1E,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;YAChB,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,CAAC,CAAA;QACpD,CAAC;QACD,IAAI,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,oBAAoB,CAAC,+BAA+B,CAAC,CAAA;QAChE,CAAC;QACD,IAAI,CAAC;YACJ,oBAAoB;YACpB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,iBAAkB,CAAC,EAAE,CAAC;gBACjD,MAAM,IAAI,oBAAoB,CAAC,uDAAuD,CAAC,CAAA;YACxF,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,eAAgB,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAA;YAEpE,aAAa;YACb,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;YAC1B,IAAI,CAAC;gBACJ,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAA;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,IAAI,oBAAoB,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAA;YACzF,CAAC;YAED,IAAI,CAAC,WAAW,GAAG,iBAAkB,CAAA;YACrC,IAAI,CAAC,IAAI,GAAG,GAAG,SAAS,IAAI,iBAAiB,EAAE,CAAA;YAC/C,IAAI,CAAC,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;YAE3E,mEAAmE;YACnE,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7D,MAAM,IAAI,oBAAoB,CAAC,qEAAqE,CAAC,CAAA;YACtG,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EACxC,GAAG,KAAK,CAAC,MAAM,EACd,WAAW,EAAE,IAAI,CAAC,SAAS,EAC3B,aAAa,EAAE,IAAI,CAAC,WAAW,EAC/B,+BAA+B,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,CACnE,CACD,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,QAAQ,IAAI,EAAE,CAAC;gBACd,KAAK,CAAC,GAAG,YAAY,aAAa,CAAC;oBAClC,MAAM,IAAI,oBAAoB,CAAC,wDAAwD,GAAG,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;gBAC3G;oBACC,MAAM,GAAG,CAAA;YACX,CAAC;QACF,CAAC;IACF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAkB;QAC9B,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,SAAS,IAAI,SAAS,EAAE,CAAC,CAAA;IACtF,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,IAAY;QAC/C,OAAO,MAAM,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAA;IACrH,CAAC;IAUD,OAAO,CAAC,GAAG,IAAiB;QAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QACrF,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,uDAAuD;gBACvD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAC7H,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE;oBACzC,OAAO,KAAK,CAAA;gBAEb,4DAA4D;gBAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBAC5J,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YACxF,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC7E,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC9C,YAAY,OAAe,EAAE,KAAe;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;QAClC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAElB,yDAAyD;QACzD,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAA;IAC5D,CAAC;CACD;AAED,MAAM,OAAO,wBAAyB,SAAQ,iBAAiB;IAIrD,OAAO,CAAC,GAAG,IAAiB;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5F,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,6CAA6C,CAAC,CAAA;QAC9E,CAAC;QAED,IAAI,CAAC;YACJ,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,IAAI,EAAE,0BAA0B,EAAE,aAAa,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACpI,IAAI,IAAI,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,EAAE;oBACzC,OAAO,KAAK,CAAA;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,IAAI,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACnK,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC;oBACpC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,EAAE,IAAI,EAAE,0BAA0B,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;YAC/F,OAAO,IAAI,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YACvF,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;CACD"}

package/dist/router.d.ts

@@ -3,5 +3,29 @@ import type { SshCaBindings } from "./types.js";
 export type AppContext = Context<{
     Bindings: SshCaBindings;
 }>;
-export declare const createApp: (env: SshCaBindings) => import("chanfana").HonoOpenAPIRouterType<import("hono/types").BlankEnv, import("hono/types").BlankSchema, "/">;
+/**
+ * Returns the key a request is rate limited by, or undefined if the request
+ * should not be rate limited.
+ */
+export type RateLimitKey = (req: Request) => string | undefined;
+/**
+ * Options for the CA that are not part of its bindings.
+ */
+export interface SshCaOptions {
+    /**
+     * Returns the key requests are rate limited by when `RATE_LIMITER` is
+     * set. Defaults to the client IP address in the `CF-Connecting-IP` header,
+     * which is set by Cloudflare, so other runtimes should provide one that
+     * suits their limiter, for example using a header set by a reverse proxy.
+     */
+    rateLimitKey?: RateLimitKey;
+}
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export declare const cloudflareClientIp: RateLimitKey;
+export declare const createApp: (env: SshCaBindings, options?: SshCaOptions) => import("chanfana").HonoOpenAPIRouterType<{
+    Bindings: SshCaBindings;
+}, import("hono/types").BlankSchema, "/">;
 //# sourceMappingURL=router.d.ts.map

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAIzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D,eAAO,MAAM,SAAS,QAAS,aAAa,mHA+B3C,CAAA"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AACA,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAA;AAMzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAE/C,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAA;CAAE,CAAC,CAAA;AAE7D;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,GAAG,SAAS,CAAA;AAE/D;;GAEG;AACH,MAAM,WAAW,YAAY;IACzB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAA;CAC9B;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,YAAwE,CAAA;AAKzG,eAAO,MAAM,SAAS,QAAS,aAAa,YAAW,YAAY;cAC7B,aAAa;yCAgElD,CAAA"}

package/dist/router.js

@@ -1,10 +1,48 @@
 import { fromHono } from "chanfana";
 import { Hono } from "hono";
 import { createApi as apiv3 } from "./api/v3/index.js";
+import { BasePath as v4BasePath, createApi as apiv4 } from "./api/v4/index.js";
 import { HTTPException } from "hono/http-exception";
 import { logger } from "./logger.js";
-export const createApp = (env) => {
+import { TooManyRequestsException } from "chanfana";
+/**
+ * Returns the client IP address set by Cloudflare in the `CF-Connecting-IP`
+ * header, which is the default key requests are rate limited by.
+ */
+export const cloudflareClientIp = (req) => req.headers.get("CF-Connecting-IP") ?? undefined;
+// requests that only read from the CA, which are not rate limited
+const ReadMethods = new Set(["GET", "HEAD", "OPTIONS"]);
+export const createApp = (env, options = {}) => {
     const hono = new Hono();
+    const rateLimitKey = options.rateLimitKey ?? cloudflareClientIp;
+    // limit requests to issue, renew and revoke certificates
+    hono.use("/api/*", async (c, next) => {
+        const limiter = c.env.RATE_LIMITER;
+        if (limiter === undefined || ReadMethods.has(c.req.method)) {
+            return await next();
+        }
+        const l = logger(env).with("in", "rateLimit");
+        const key = rateLimitKey(c.req.raw);
+        if (key === undefined) {
+            l.debug("no rate limit key for request");
+            return await next();
+        }
+        let success;
+        try {
+            success = (await limiter.limit({ key })).success;
+        }
+        catch (err) {
+            // a failing limiter must not stop certificates being issued or revoked
+            l.error("rate limiter failed", "error", err);
+            return await next();
+        }
+        if (!success) {
+            l.warn("request was rate limited", "key", key, "method", c.req.method, "path", c.req.path);
+            const err = new TooManyRequestsException();
+            return c.json({ success: false, errors: err.buildResponse(), result: {} }, 429);
+        }
+        return await next();
+    });
     // add error handling
     hono.onError((err, c) => {
         if (err instanceof HTTPException) {
@@ -17,7 +55,7 @@ export const createApp = (env) => {
         schema: {
             info: {
                 title: "Serverless SSH CA API",
-                version: "3.0.0"
+                version: "4.0.0"
             },
         }
     });
@@ -27,6 +65,7 @@ export const createApp = (env) => {
         bearerFormat: 'JWT',
     });
     app.route("/api/v3", apiv3(env));
+    app.route(v4BasePath, apiv4(env));
     return app;
 };
 //# sourceMappingURL=router.js.map

package/dist/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKpC,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAA;IAEvB,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEhC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AACnC,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAA;AACzC,OAAO,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACtD,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,SAAS,IAAI,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AAwBnD;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAiB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,SAAS,CAAA;AAEzG,kEAAkE;AAClE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAA;AAEvD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAkB,EAAE,OAAO,GAAiB,EAAE,EAAE,EAAE;IACxE,MAAM,IAAI,GAAG,IAAI,IAAI,EAA+B,CAAA;IACpD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAA;IAE/D,yDAAyD;IACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAA;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QAC7C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACnC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,CAAC,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAA;YACxC,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,OAAgB,CAAA;QACpB,IAAI,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,uEAAuE;YACvE,CAAC,CAAC,KAAK,CAAC,qBAAqB,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;YAC5C,OAAO,MAAM,IAAI,EAAE,CAAA;QACvB,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAC1F,MAAM,GAAG,GAAG,IAAI,wBAAwB,EAAE,CAAA;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;QACnF,CAAC;QAED,OAAO,MAAM,IAAI,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,qBAAqB;IACrB,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACpB,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAA;QAC5B,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,8BAA8B,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;QAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,uBAAuB,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACtG,CAAC,CAAC,CAAA;IAEF,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE;QAC7B,MAAM,EAAE;YACP,IAAI,EAAE;gBACL,KAAK,EAAE,uBAAuB;gBAC9B,OAAO,EAAE,OAAO;aAChB;SACD;KACD,CAAC,CAAA;IAEC,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,UAAU,EAAE;QAC1D,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,YAAY,EAAE,KAAK;KACtB,CAAC,CAAA;IAEF,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAChC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAEjC,OAAO,GAAG,CAAA;AACd,CAAC,CAAA"}

package/dist/ssh/certificate.d.ts

@@ -0,0 +1,93 @@
+import { PublicKey } from "./keys.js";
+import { type Signer } from "./signer.js";
+/**
+ * Encoding, decoding and signing of OpenSSH certificates as described in
+ * PROTOCOL.certkeys from OpenSSH
+ */
+/** Whether a certificate is for a user or a host */
+export type CertificateKind = "user" | "host";
+/** The fields of a certificate that are set by the CA */
+export type CertificateFields = {
+    /** Whether the certificate is for a user or a host */
+    kind: CertificateKind;
+    /** The public key being certified */
+    publicKey: PublicKey;
+    /** The serial number of the certificate */
+    serial: bigint;
+    /** The key ID of the certificate, which is logged by sshd when it is used */
+    keyId: string;
+    /** The users or hosts the certificate is valid for */
+    principals: string[];
+    /** The time from which the certificate is valid, to the second */
+    validAfter: Date;
+    /** The time until which the certificate is valid, to the second */
+    validBefore: Date;
+    /** The names of the extensions to include, which have no data */
+    extensions: string[];
+};
+/**
+ * Thrown when a certificate cannot be parsed
+ */
+export declare class CertificateParseError extends Error {
+    constructor(message: string, cause?: unknown);
+}
+/**
+ * A signed OpenSSH certificate
+ */
+export declare class SshCertificate {
+    /** The wire encoding of the certificate */
+    readonly bytes: Uint8Array;
+    /** The certificate type, for example "ssh-ed25519-cert-v01@openssh.com" */
+    readonly type: string;
+    readonly kind: CertificateKind;
+    /** The public key being certified */
+    readonly publicKey: PublicKey;
+    readonly serial: bigint;
+    readonly keyId: string;
+    readonly principals: string[];
+    readonly validAfter: Date;
+    readonly validBefore: Date;
+    /** The names of the extensions on the certificate */
+    readonly extensions: string[];
+    /** The wire encoding of the public key of the CA that signed the certificate */
+    readonly signatureKey: Uint8Array;
+    /** The signature of the CA in the SSH wire format */
+    readonly signature: Uint8Array;
+    /**
+     * Decodes a certificate from its wire encoding. This does not verify the
+     * signature on the certificate.
+     *
+     * @param bytes The wire encoding of the certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be decoded or its type is not supported
+     */
+    constructor(bytes: Uint8Array);
+    /**
+     * Parses a certificate in OpenSSH format, `${type} ${base64}[ ${comment}]`,
+     * as found in `-cert.pub` files. This does not verify the signature on the
+     * certificate.
+     *
+     * @param text The certificate
+     * @throws {@link CertificateParseError} when the certificate cannot be parsed or its type is not supported
+     */
+    static parse(text: string): SshCertificate;
+    /**
+     * Returns whether the certificate was signed by a CA key
+     *
+     * @param ca The public key of the CA
+     */
+    isSignedBy(ca: PublicKey): Promise<boolean>;
+    /**
+     * Returns the certificate in OpenSSH format, as used for `-cert.pub` files
+     */
+    toString(): string;
+}
+/**
+ * Creates and signs an OpenSSH certificate
+ *
+ * @param fields The fields of the certificate
+ * @param signer The CA key to sign the certificate with
+ * @returns The signed certificate
+ * @throws Error when the type of the public key being certified is not supported
+ */
+export declare const signCertificate: (fields: CertificateFields, signer: Signer) => Promise<SshCertificate>;
+//# sourceMappingURL=certificate.d.ts.map

package/dist/ssh/certificate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"certificate.d.ts","sourceRoot":"","sources":["../../src/ssh/certificate.ts"],"names":[],"mappings":"AAUA,OAAO,EAAiB,SAAS,EAAE,MAAM,WAAW,CAAA;AACpD,OAAO,EAAU,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAEjD;;;GAGG;AAEH,oDAAoD;AACpD,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAA;AAO7C,yDAAyD;AACzD,MAAM,MAAM,iBAAiB,GAAG;IAC/B,sDAAsD;IACtD,IAAI,EAAE,eAAe,CAAA;IACrB,qCAAqC;IACrC,SAAS,EAAE,SAAS,CAAA;IACpB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,sDAAsD;IACtD,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,kEAAkE;IAClE,UAAU,EAAE,IAAI,CAAA;IAChB,mEAAmE;IACnE,WAAW,EAAE,IAAI,CAAA;IACjB,iEAAiE;IACjE,UAAU,EAAE,MAAM,EAAE,CAAA;CACpB,CAAA;AA+BD;;GAEG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC/C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAM3C;CACD;AAED;;GAEG;AACH,qBAAa,cAAc;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;IAC1B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAA;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7B,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAA;IACjC,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAE9B;;;;;;OAMG;IACH,YAAY,KAAK,EAAE,UAAU,EA+B5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAmBzC;IAED;;;;OAIG;IACG,UAAU,CAAC,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAShD;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAEjB;CACD;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,WAAkB,iBAAiB,UAAU,MAAM,KAAG,OAAO,CAAC,cAAc,CAuBvG,CAAA"}